Sell the Value, Not the Fear: Funding OT Security and Getting Ready for Post-Quantum

Recorded: 2026-10-26 (Riverside) Host: Aaron Crow Guest: Shaun Six, CEO and President, UTSI International

*Source: Riverside aligned transcript of the clean-body edit (pauses and fillers removed by Riverside), pulled 2026-10-26. Section headers from the Show Notes chapters; times are clean-body M:SS. Words unchanged: no grammar, filler or wording edited.*

*Name caveat: the ASR writes the guest as "Sean". He is SHAUN Six. It also writes Jonathan Pollet as "Pole" and Dr. Georgianna Shea as "Shaw", "Shay" or "George". SOC appears as "sock".*

*The phone-ringing aside (19:54 to 20:52) is marked below; it is cut from the published episode.*

0:00 Welcome and introduction

Aaron Crow (0:00): Thank you for joining me on another episode of the Protect It All podcast, where I get the joy and privilege to sit across from folks that I get to meet in person. Sometimes I don't get to meet the people in person before I have these conversations. Other times, like to it with today's guests, I do meet them in person and we have a drink and we talk shop and all those kind of fun things at conferences or on client engagements or whatever those things are. So today's guest, Sean, why don't you introduce yourself? First of all, thank you for being here. Thank you for joining me today, taking time out of your schedule.

Aaron Crow (0:30): But yeah, why don't you introduce yourself, tell us who you are, background, all that ~ ~ fun stuff that you want everybody to know about.

0:36 From oil and gas operator to CEO: how UTSI fell into cybersecurity

Shaun Six (0:36): Sure, thanks, Aaron. I am CEO and president of UTSI and I've been here for four years. I took over as CEO in 2023. but we're a 41-year-old company. We do systems integration and kind of fell into cybersecurity because as you know, back in the day we were putting stuff out that was open protocol, no encryption, no zero trust setup. And then we started seeing cyber attacks. And I've been ~ in the oil space and oil critical infrastructure started out in oil and gas 20 years ago. So I was

Shaun Six (1:04): 10 years on the operator side. And then I got moved into an innovation role, you know, almost 12 years ago now. And I started rolling out some really cool things, but unbeknownst to me, we were rolling out some cybersecurity vulnerabilities as well. And I don't know, I think w bat, you know, when when you're in an innovation role, your job is to solve the problem that the company brought forward and you found that you don't have anything in your Rolodex to solve that problem.

Shaun Six (1:30): And so we were doing things like rolling out ~ floating tank gauges and that was an amazing feat. You know, we we had these wireless or wired tank gauges that took people off the tanks, so we ended up saving a bunch of well, a actually not to be hyperbolic, but lives. Our number one fatality at the time was people on and around tanks. And so rolling out those tank gauges got people off the tanks, but it also increased our accuracy. unbeknownst to us, we were

1:56 Deploying connected equipment, and learning the exposures later

Shaun Six (1:56): Rolling out exploits that would later be used. If you've heard of Harvest Now Decrypt Later, I am

Aaron Crow (2:01): Mm-hmm.

Shaun Six (2:02): guilty as charged. So we we rolled those out, not realizing that we had a bunch of connectivity to the field devices and that the Chinese would later use those as decentralized mesh network in a very innovative way. So anyway, so we got into cybersecurity quite by ~ just by default, you know, rolling out OT and being the people that knew it really well. And I'm fortunate to have worked for Dan Nagala, who founded UTSI.

Shaun Six (2:25): And when I joined, we were doing a handful of really cool projects. But he was on one hand doing interviews with the Wall Street Journal on some leaks that had happened because of bad Chinese steel that we had bought during the 20 teens. And then on the other side, he was one of the investigators for the ~ post-colonial incident and then worked with the TSA on the what would become SD two. So he was working on SD one at the time. So I got to learn up front and see ~ the errors of my ways and

Shaun Six (2:52): And then ~ we've ended up building up an entire cybersecurity practice, and that's led by Charles Zachmeyer, goes by Zach, and ~ Dennis Parker was employee number one at UTSI, left UTSI, went to Chevron, stood up their OT cybersecurity practice, and helped write IC 62443-3-2 on the operator side, and then came to UTSI to help us build out our cybersecurity practice after he retired from Chevron and brought Zach in to replace him. So

Shaun Six (3:17): I have to say I'm on the backs of giants and ~ I'm learning from everybody every day.

Aaron Crow (3:20): Yeah.

Shaun Six (3:22): It's very interesting and the space is changing every day. So it's a very dynamic and interesting place. But I also want to say I'm a ~ longtime listener, first time caller. And I appreciate appreciate being on the podcast, man.

3:34 Aaron: learning from the intern, and "stop when unsure"

Aaron Crow (3:34): Yeah, man, I appreciate it. It's it's it's been a fun journey for me. ~ ~ we talked a little bit before we recorded. ~ ~ ~ I I I really enjoy the conversations and and learning to your point. ~ ~ ~ I've been doing this for a long time as well, right? I've been in in OT and and technology for 30 years. And ~ but at the same time, I learn from so many amaz I my dad was in critical infrastructure for 40 something years, right? So I still have conversations with him because he built a lot of the power plants that I've supported over in

Aaron Crow (4:02): and and been part of so I've been in OT since I was born, really. I it's been conversation at my dinner table ~ my my whole life. So you know it's it's ~ we we the I always look at things as like the day you stop learning and growing is when you die, right? You know, I that's why I don't think about retirement in the same way that you know others do, I guess. I don't ever want to stop innovating, stop creating, stop building, stop doing things.

Aaron Crow (4:30): Because that's where I'm I'm constantly growing. I if if if I turn the camera down here, there's ~ trinkets and things, technology, ~ ~ wires and ~ ~ things that I'm doing, all of 3D printing cases and all the things, you know, ~ that are it it's just what I do and and and it's why I think people like us are good at what we do, right? We're not I'm not afraid to say I to learn from the intern, right? The the 22 year old.

Aaron Crow (4:56): that has, ~ ~ no experience. I'm not afraid to say, you can teach me something. I have people on my podcast all the time that have I literally had a conversation with a kid the other day. And I say kid because I'm, you know, almost 50 and he's half my age or less. ~ and and we were having a conversation and this person had has spoken at DEF CON, has spoken on Black Hat stages. and when he was asking me, ~

Aaron Crow (5:23): Going through the the process, the same process you did to be on the podcast. And he was like, Well, can I ask a question? I'm Yeah, sure. He goes, Well, why would you want me on your podcast? And it kind of threw me aside. And I was just like, Why would I not? Like you have you have knowledge and value to give. That's what this whole thing is for. Like, I you don't have to have 30 years experience or you know, the CEO of a company or the be the VP or or you know, have worked at these large companies.

Aaron Crow (5:53): All of us have value to give. And that's what this platform I that's why I've created this thing and why I do this. ~ I get the privilege to talk to great people like you and others as well. But you know, it doesn't, it's not a you know, it you don't have to have a certain seniority to be to have value in this space. And part of that for me comes from the OT side from from operations, ~ that you probably have seen as well. Is like that stop when unsure, right?

Shaun Six (6:20): Mm-hmm.

Aaron Crow (6:20): You can be the newest person in the room, but you should be able to s ask a question, say, that doesn't look right. Are we sure about this? And ask those questions. And everybody should be, if you have that that type of of and you've built that culture, that safety culture, that that questioning attitude culture in your environment, it doesn't matter if you're the CEO or the janitor, they should all be able to question you. And it should be like, Yeah, wait, let let's let's make sure, right? Let's stop for a second. Let's make sure.

Aaron Crow (6:50): Let's make sure that everybody's on the same page. We're not making assumptions because I've done this this task 30 times or a hundred times or a thousand times. This new person coming in is seeing something potentially that I don't see, which is

Shaun Six (7:02): Mm-hmm.

Aaron Crow (7:03): why I'm terrified about how much our knowledge is leaving. We have new people coming in, and that there's a giant gap between those two today.

7:14 Why OT people are humbler: the risk profile starts with people

Shaun Six (7:14): There really is. That's to be honest, that's the number one motivator for me is the well, one of the top as far as priorities go. ~ OT security is is something that ~ is a has become more of a calling, I think, for our company. And it's because you see the interdependencies and the lack of funding, the lack of focus and the lack of resources. But then when you go out in the field, and something else I think too is ~ people in OT are

Shaun Six (7:43): far more I don't want to say as it's a blanket statement and I know that's ~ always bad, but they're more ~ humble because in the OT space you your risk your risk profile on a project, when we were going through innovation projects and I had an OT project, it was how many people could die is number one on the risk profile. Is it one or more? How many people could get injured, one or more.

Shaun Six (8:07): And then is there an environmental impact? Is there a regulatory? So regulatory is like four levels down. And then you get to finance. And you do

Aaron Crow (8:12): Yeah. Yeah.

Shaun Six (8:14): an IT project and it's like, what's the financial impact? And so your your attitude is different. And then if you've been in OT long enough, you know people who have been injured or or passed away. And that was back to the water thing. I was, we had three people, two pass away, unfortunately, and then one critically injured, and it was all on tanks and

Shaun Six (8:34): So ~ ~ you go out to the field and you see people that are actually putting their lives at risk and they depend on your data for their safety. And that emergency shutdown not doing its job or being hacked stops that

Aaron Crow (8:45): Mm-hmm.

Shaun Six (8:46): the whole reason that exists is because of the safety element first and foremost. And so you end up meeting people that are willing to ask those questions. And sometimes you don't get that, I think, in the IT space, especially when it's finance focused. It's it's all about how much money can I make in the shortest amount of time and our incentives are inverse really.

Shaun Six (9:02): I think the companies that support most infrastructure have ~ you know, I don't want to talk about about an industry, but management consultants or people that are looking at an Excel spreadsheet, never step

9:13 The workforce gap: who is leaving and who is coming in

Aaron Crow (9:11): Mm-hmm. Yep.

Shaun Six (9:13): foot in the field. And there's a place for those people, but they need to have context. And I think they miss that. So they make a lot of changes that impact the OT folks, and they're the ones that are out there splicing wires and putting it in. And to your point about the knowledge gap, when I got in 20 years ago, the recruiter that brought me into Devon Energy in Oklahoma City.

Shaun Six (9:30): ~ said the average age of the critical resource, whether it's engineering or technology, was 55 and there was three leaving for everyone coming in. Years later, I've moved on, moved up, moved to Houston. I'm at a consulting firm. I go back to Devon and I take him out to lunch and I'm like, hey, thanks for this amazing career. I had no idea when I got into it that I would be so interested in everything.

Shaun Six (9:53): and have such a great ride. And how are you guys doing on that? Because they invested in two universities in Oklahoma for engineering and for technology and to recruit people in, and they rebranded to to be a sexier company in Oklahoma City.

Aaron Crow (10:04): Mm-hmm.

Shaun Six (10:04): And the ratio had gone up, and this was back in 2016. So the ratio at in as of twenty sixteen was one to five, and the average age was sixty-five. And since then I've been in, you know, refineries, mining facilities, green energy,

Aaron Crow (10:18): Mm-hmm.

Shaun Six (10:19): you name it, if there's technology involved and we've been under the hood.

Shaun Six (10:22): Whether it's a a mine site in Australia, a refinery in Canada, a green energy space in Europe, ~ it that ratio is the same in the Western world all around. We've got five people even for every one coming in. The average technical resource lasts about two to three years before they move out. So the reality is we just don't have enough people filling those roles and they're already underfunded and unsupported. So, and especially when you get to companies that are not the chevrons, because chevron can afford to put, you know, multiple we were at a conference recently talking about quantum.

10:52 Quantum at the conference: a myth on one side, a research team on the other

Shaun Six (10:52): And I think that's where you and I caught was CybersecCon. And so Jonathan Pole, which I I know you guys go back, ~

Aaron Crow (10:56): Mm-hmm. Yeah.

Shaun Six (10:59): we're presenting on post-quantum cryptography. And I wanted him to talk about to review this assessment that we put together. ~ Dr. Georgiana Shaw, or Shay, I always say Shaw, ~ Shay, sorry. I have a Disha Shaw that works on the team, and I say Desha Shaw like every day. So I'm like, ~ so Dr. Shay, ~ she published a book called Post Quantum Leadership. And

Shaun Six (11:21): It's about ~ essentially the the the reality that I think and you were talking earlier about the question you that you used to ask at the end. ~ that to me is quantum. Quantum is the the big thing that's coming that no one's talking about. So I've when I first started researching it in twenty two, I was I got this feedback that it's like a nothing burger. And even last year, talking to a CISO of a major oil company, he said, I'll be long gone 30 years later, and this won't will never have happened.

Shaun Six (11:48): So there's that side and then there's another side where we're at CybersecCon and then a large oil company comes in after the talk, after Jonathan and I finished, and they had one OT readiness person and an IT quantum readiness person, and they have

Aaron Crow (12:03): Mm-hmm.

Shaun Six (12:03): a quantum readiness research organization. So you've got these like two polar differences. And I I'm like, what information do you have that this guy needs to have? Because it's obviously there's a myth there, but

Shaun Six (12:16): Anyway, I I kinda went down a rabbit hole. But there's ~ I think the quantum side probably is the most interesting and then the the rip that's like the the two competing things I think about every day are how do we re this replacement ratio, the one to five, how do we how do we fix that? And how do we attract more people in? And I've you know, we've been doing this for a while and I've lost people to, you know, mommy daycare apps, dog walking apps, fintech out of New York or, you know, funding here in Houston. And it's hard to compete.

12:36 Losing engineers to venture-funded apps

Shaun Six (12:44): ~ ~ they'll get a dou double their salary, their sign-on bonus is almost what their salary is. So it's like I can't compete with ~ ~ these VC funded

Aaron Crow (12:50): Mm-hmm.

Shaun Six (12:50): startups that throw in money. But at the end of the day, the the incentives on the big corporations and even the VCs are valuation, valuation, valuation, and they don't focus on the value that's provided by the critical infrastructure that all of this sets on top of. And as a result, we've not recruited people into this space and we've not made it ~ attractable.

Shaun Six (13:11): ~ ~ attractive. And so I've ~ I've been promoting when I go out and I talk in the wild, ~ and people will come to me afterwards. How do I learn more about this? So I send them to to Mike Holcomb's page on on

13:23 Getting people into OT: Mike Holcomb, ICS Village and community colleges

Aaron Crow (13:20): Yeah. Yep.

Shaun Six (13:23): LinkedIn and his YouTube and I send them to your podcast. But there's we need more of that. We need more people promoting this stuff. So I appreciate what you do. And it is definitely helping because people will reference you or they'll go to your site and they'll reach back later and thank me for sending them to you. So I appreciate what you're doing.

Aaron Crow (13:36): Yeah. Well,

Aaron Crow (13:38): it it's it's huge. It's the reason why again I do this. It's why Mike Colcomb does this, right? It it's many of us in this space that do this. It's why you step on stage and and do these things, right? You know, obviously there's a benefit. Yes, we can potentially get customers out of it, all that kind of stuff. But I think ultimately I do this because I want to build the next generation. Eventually I'd like to be able to hand that baton to someone, right? You know, I I'm part of the ICS Village, I'm an advisor with ICS Village and we're building training.

Aaron Crow (14:06): ~ ~ ~ we did a we did a course at Harvard, ~ OT cybersecurity, a Harvard

Shaun Six (14:11): no.

Aaron Crow (14:11): level class at OT at for OT cybersecurity. ~

Shaun Six (14:14): Excellent.

Aaron Crow (14:14): I just did a class last, was it two weeks ago, I think, ~ at my local community college, where I came in and talked firewalls and network security and OT and all that kind of stuff in in a guest speaker for for this cybersecurity course within this this local community college. So the two extremes, like you've got Harvard and then you've got

Aaron Crow (14:34): ~ ~ local community college and both are valuable, right? ~ ~ yes, it's cool to go, ~ ~ speak or be part of Harvard, but it's just as important to be ~ for everyone because we need way more than what one university or one, you know, group can do. So with with ~ ICS Village, we're building training that we're gonna be doing at, you know, potentially at CybersecCon with with with Sam and Michael, and we're doing it at DEF CON in Singapore ~ in February and and we've

Aaron Crow (15:04): We're building out this entire program for training because we see this giant gap. ICS Village is a nonprofit organization. So they have access to potentially grants and and and getting into government organizations and things like that, right? So we're building this thing out because just like you're saying, right? We see this large void of every time we go to a conference, everybody's like, How do I learn more? How do I get into OT?

15:30 Entry level with five years of experience

Aaron Crow (15:30): Because the other side of that coin is is every job I s every job posting I see in OT is entry level with five years experience. Right?

Shaun Six (15:40): Yeah.

Aaron Crow (15:41): Like it says entry level,

Shaun Six (15:41): Show me that guy.

Aaron Crow (15:43): but like the the actual requirements down in it's like well you really have to have been doing this for five to ten years to be able to do like they just don't marry up, right? And there's no right. Exactly. And why would

Shaun Six (15:48): Yeah. Yeah, we want to pay you entry level, but we want you to have some real experience. Yeah. Yeah. That is hilarious. I think that's great.

Shaun Six (15:58): Go ahead, sir. Yeah, yeah, no, exactly. Yeah.

Aaron Crow (15:58): Why would they choose that, right? Why would they choose to your point, ~ on the VC

Aaron Crow (16:02): side, I can go be a an entry level at a VC, make more money and have, ~ ~ stock options, all that kind of stuff. So we've got to make this valuable from a training perspective so we can get the knowledge, but also from a compensation and and career path and and and all of those things need to be there as well. Otherwise, we're not gonna be able to recruit good talent. It's the same reason why, ~ ~ some of the best cyber hackers in the world come from, ~ ~

Aaron Crow (16:27): the three letter agencies in the government, but it's also a reason why they end up leaving and going to the private sector because they can make ten X the money in the private sector that they can in the military. Right. It's just,

16:40 Physical I/O on the show floor, and the pay problem

Shaun Six (16:37): Mm-hmm.

Aaron Crow (16:38): it's not the same, right?

Shaun Six (16:40): Yeah, I don't know. Yeah, that's a good point. But how do you fix that? How do you bridge that gap? I think doing what you're doing is part of the puzzle. And then the other one that is there's something sexy about having ~ physical IO out on a conference room floor or in a demo. ~ Oren does a good job of that. He'll roll around, have his hard hat on, he rolls out, he

Aaron Crow (16:58): Yes. Yes.

Shaun Six (17:00): he puts it up, and you'll see people just start flocking to him because there's blinky

Aaron Crow (17:03): Yeah.

Shaun Six (17:04): lights and if you push a button, something moves. And I think people are attracted to that, you know, where the digital

Shaun Six (17:09): Where the physical meets the digital and then how to manipulate the physical through robotics and automation. And they're attracted to it. They just, ~ ~ it's a hard place to compete when it's probably what most most technologists would prefer to do. The reason why you've got stuff on your desk right now is because there's a very it's tactile and it's rewarding to see something successfully deployed. But then you go look at your paycheck and then and that's something we're always competing against is, ~ ~ I I'll pay a junior finance analyst two times or three times what my most senior person

Shaun Six (17:39): what I can build them for. And you're touching critical infrastructure that that makes the world go around, but I can't pay you because they won't pay us, you know, at the end of the day. So I've

Aaron Crow (17:48): Correct.

Shaun Six (17:49): got to figure out this. I have found that by going back to the ~ the bigger picture and showing them the importance of what they do. And earlier this year at s at level zero, I was asked to do a like a TED style talk.

18:03 Maslow's hierarchy and the 16 critical infrastructure sectors

Aaron Crow (18:02): Mm-hmm.

Shaun Six (18:03): And they were like make it lighthearted and not not super techie because they've been beat over the head with technology all day. So

Shaun Six (18:09): so I talked about ~ Maslow's hierarchy of needs.

Aaron Crow (18:12): Mm-hmm.

Shaun Six (18:12): And I was showing the, you know, the goal is to get up that mountaintop. And at the end of the day, you know, we all have that right and that privilege to go up the hierarchy of needs because that bottom two layers, like you could take the 16 critical infrastructure sectors from CISA and map it over the layer one and layer two of of Maslow's hierarchy. And so I was showing this picture of ~

Shaun Six (18:36): Someone at the top, ~ ~ doing their ~ self-actualization. And then I show another mountain and a guy's taking a TikTok video. And I was like, so ~ ~ whether you're on the mountaintop of sexual set self-actualization or TikTok, ultimately you're there because the foundation is here. And it's about three days on average when you pull that layer out, and then the slide changes and you see the two guys go down the mountain and they they switch from their selfie and their self-actualization to pitchforks and torches.

Shaun Six (19:02): And the reality is if you've been in Houston during a hurricane or a freeze,

Aaron Crow (19:06): Mm-hmm.

Shaun Six (19:06): it's about three days before you see violence go up, housebreaking. ~ you see ~ ~ robberies go up and then you see people looting. And ~ there's most people don't have like a stockpile and they're not ready for it. We depend daily for, you know, this communication right now to work. We're we're hopping over things we don't own or control or really understand to have this conversation and that's how business

Aaron Crow (19:27): Yep.

Shaun Six (19:27): is done.

Aaron Crow (19:28): Yeah.

Shaun Six (19:28): And ~ it's you know, you take that away for three days and most people, most organizations would fail, but most households would would ~ be hurting really bad. And I think if you can play to that and talk to people about like finding the calling of supporting modern civilization, ~ but then you have to stay competitive because at the end of the day they've got a life to live and they've got a retirement to chase and and you gotta be realistic about that. So we'll get there together. I'll I'll let you know what I find on on my journal.

Aaron Crow (19:54):

*[CUT from the published episode: phone aside, 19:54 to 20:52]*

Aaron Crow (19:57): Yeah, you know, it's it's ~ it's never ending where we hang on a second. I gotta pause. I've got ~ something in my ear again. I don't know where the hell this is coming.

Shaun Six (20:07): comes for your phone or your ~ device?

Aaron Crow (20:09): It's

Aaron Crow (20:09): coming through my headphones through my computer, but I don't see what's ringing. Very weird. All right, so that'll be cut out in post. Yeah, it's like a phone

Shaun Six (20:19): Got a ringing in your ears.

Aaron Crow (20:22): call coming from somewhere and I don't know where it's coming from. Like I it

Shaun Six (20:25): Coming from inside the house.

Aaron Crow (20:28): Okay. ~ so yeah, voicemail. Voicemail. Like what am I getting Google Voice is what it is, but I had Google Voice open and

Shaun Six (20:37): It's the hackers, man. They know you're on a podcast

Aaron Crow (20:40): What the hell?

Shaun Six (20:41): right now and they wanna they wanna get to you.

Aaron Crow (20:43): Yeah, it's very likely. Yeah. and it's on Do Not Disturb. So how is it coming through? That's weird. Anyways. ~ so

Shaun Six (20:49): Wow.

Aaron Crow (20:52): with the obviously we we talked about the the knowledge gap and and getting folks in. Like how are you seeing I I wanna double down. I wanna go into the the the quantum thing and and have a conversation there, but before I do, I wanna double t double click on that the value gap that I see.

21:10 The value gap: the expert with the hammer, and the five-day assessment

Aaron Crow (21:10): a and you hit on it, right? Is you've got these people like myself, ~ ~ ~ you've got people, you, me, others, we have 30 years experience. ~ we we we have all this. And then when when we come in, it's the it's the old analogy of, you know, the the the the the engine is broken or or whatever the big process is broken and they can't get anybody to fix it. they finally find this expert, you know, it's cost a million dollars a day or a million dollars, whatever, some big number.

Aaron Crow (21:38): They they bring in this expert. He walks in, he walks right up to the thing, he hits it with a hammer. Five seconds later it's working. He gives them a bill. And you're like, Well, that's too expensive. You were only in there for five seconds. ~ I'm not paying that. And the value is is is his response is you didn't pay me for the five seconds I was there. You paid me for the 40 years of experience that I knew I walked in and in five seconds knew exactly where to hit it, and now it's working again. Right. So it's hard to tr to judge that value based on

Aaron Crow (22:05): ~ ~ I I had this conversation with a with another guy that we were doing an assessment. And we were doing an assessment across five sites. And the first assessment at this site, and it was a pretty small site. Each site was pretty small. And we were at the first site, and he had scheduled it to be a week long, like five days. We sh we traveled on Monday. He wanted us to leave on Friday. Tuesday at lunch, I'm like, I've booked my travel home. And he was like, What? I'm like, Well, I've already walked the site.

Aaron Crow (22:36): I've seen everything that's here. You're gonna give me all the knowledge. I have sensors that are placed around this the environment. You're going to give me those. You're gonna send those back to me at the end of the week. You don't need me to sit in this room and just sit here for the next four days and have extra expenses and more hours. Like, that's not the value. That's not the best use of my time or your time, right?

Shaun Six (23:00): Mm-hmm.

Aaron Crow (23:00): I'm gonna go home. And and his question was.

Aaron Crow (23:03): That same question. Well, how do I justify the cost per site when you're only here a day and a half? I'm like, you're you're missing this. ~

Shaun Six (23:13): Yeah.

Aaron Crow (23:14): yes, I'm physically on site for a day and a half, but I have weeks of work that I'm going to be doing from what I've done on site and the other data that's going to go into the value and the knowledge and the assessment and the crunching of the data and pulling all those things together. It's not just what I do while I'm here.

Aaron Crow (23:32): Most of the value is the things that I do out there. When I'm here, it's just because I've been to so many sites, I can walk a site and say, this is important, this is not important. I know what questions to ask. ~ ~ I I can get that gauge because I have I've walked, ~ ~ worn that hard hat so many times. I've seen

Shaun Six (23:48): Mm-hmm.

Aaron Crow (23:49): so many sites, whether it's an oil and gas site, whether it's a power plant, a manufacturing facility, ~ ~ transportation location. It doesn't matter. ~ I I've seen so many of them.

Aaron Crow (23:58): That I know at least what questions to ask and where those things are, right? So how how do we fix this gap in corporations and and the financial guys that are looking at the spreadsheets and looking at this this resource? That resource is really expensive. Why is that resource so expensive? Because they don't necessarily I don't feel they understand or or they've been able to quantify the value and the risk.

Aaron Crow (24:28): by not having that skilled person, by not investing enough time in the right resources, the right capabilities, the right, ~ ~ implementation architecture, ~ ~ that it's a domino that goes down. But how how are orgs I I see to your point, you've got one org that is got an OT quantification, you know, quantum t team and an IT guy and then like a kind of learning center. And you've got others are like, yeah, it's fake. It's not happening. Like

Aaron Crow (24:55): Where is that gap? ~ that's where I think we have to figure out on a business side, how do we start helping them have these conversations? And I feel so many boards are accepting risk. They don't really understand the risk that they're accepting and they're just signing off on things and hoping for the best. I know that I just did a die tribe there. So

25:15 Where to put the X, fixed price, and the three-day fix

Shaun Six (25:12): Yeah. No, it's

Shaun Six (25:15): good. I think ~ yeah, there's a few things there. So one of is ~ you know, the guy that comes in and he draws the X and gets the bill and they say why. He's like, you know, it's a a dollar to draw the X, but knowing where to put the doll where to put the X is ten thousand dollars. ~

Aaron Crow (25:29): Correct.

Shaun Six (25:30): we started doing fixed price for that reason and I learned early on we had a green energy company that could not sell, it's costing about a hundred grand a day and lost

Shaun Six (25:40): energy cells to the state of California because the state of California requires your control system to send time series data and they have to validate that data and the configuration before they'll allow you to start selling to the grid. They couldn't figure it out. They're ~ maybe three months behind after they built this huge, ~ ~ half a billion dollar installation. And we put a, you know, the risk was on us for the fixed price, fixed price. If I don't know how to do it, I'm going to eat the cost, but we think we can do it in three weeks.

Shaun Six (26:07): And we'll get into the weeds and we'll figure it out. And a junior analyst, like we were talking earlier before the call, ~ sometimes it's the guy that doesn't know anything that knows to ask the question. So we had a senior person that's going through these very complex problems of what it might be and theorizing stuff. And we're about three days in. And the junior guy was actually just hired, maybe two, two, three weeks in no OT experience, computer science major. And ~ he's just going through

Shaun Six (26:31): development discipline and looking at what the requirements are and what the state register says and what was actually deployed. And it was the equivalent of somebody that copy and pasted a URL and forgot to copy the entire URL. And he thought, this can't be that simple. So he deploys it and before he goes and he asks the senior guy who's going through this very, you know, complex architecture review. And he goes, that actually might be it. ~ let's get on the phone and try this out with him. And so we tried it out, pushed it.

Shaun Six (27:00): data start sending beautifully. Everything had been done just right. And then when we send the bill, the guy says, Hey, you guys solved this in three days, but you're charging me for three weeks. And it's that whole where to put the X, you know, that's, you know, and then you also look at the, you know, half a million dollars or whatever it would have cost them to not if we had waited for three weeks to solve this problem, they would have lost exponentially more than what we charge them. So ~ sometimes it's having that conversation and figuring out how to ~

27:29 Quantifying the value: a trusted advisor, not selling fear

Shaun Six (27:29): quantify the value for them. And I think two, I can't remember, this was from a financial firm that has been talking with us. They said for every dollar you invest in OT cybersecurity, you buy down $3 worth of risk. And a lot of our jobs, so you might have a champion inside the company. That one company I was telling you about, they've actually pivoted from saying this is never happening to now having a quantum readiness review board that includes OT. So in one year the tides have shifted.

Shaun Six (27:55): But I think it's being that trusted advisor and not selling fear. That's, ~ ~ they need people and and one of the statistics that came out, and one of the guys sent me this paper. The reason why he doesn't believe it is people that feel like quantum is coming tomorrow are often selling you quantum boxes or solutions or whatever. And the people that think it's not coming at all are the people that have an IT background and that have been doing this for a while and have not been researching quantum at all. So there's this ~ ~ big disparity of hyperbole on one side and just complete.

Shaun Six (28:25): ~ ignorance for lack of a better tr term of of what it actually means. So bridging that gap as an advisor, I think, and then also quantifying it, because at the end of the day, especially a large organization, that CISO, whoever funded you to come in and do that work, they own a small piece of the budget and they have to share and distribute that budget out. So going in and helping them quantify the value and doing that in a way that is again not salesy, but helps them justify and find value in what you do, but be able to present that up to a board because they're going up

Shaun Six (28:54): ~ ~ one of our stakeholders ~ is the CIO of a large organization and we help him with his budget every year and he goes through and and quantifies all the activity that we've done and the risk we've bought down. ~ and then he can go to the CFO and get on the same page. So when they go to the board, because you're going in there with HR account, everybody's

29:13 The one-page budget for the board

Aaron Crow (29:13): Uh-huh.

Shaun Six (29:13): everybody's fighting for the board's attention and their budget. And yes, the HR person is the most important tool in the world, most important project in the world. And so you're helping a CIO who often is not an OT expert.

Shaun Six (29:24): A understand it, quantify it, and compete with IT budgets, but then the COO and C all the other C level going in at the same time. You've got an hour or two hours, whatever it is with your board to asset your budget. You gotta make an argument in a short amount of time and be really good and compelling. So part of what we've been doing to help bridge that gap is put it on a page. If it's more than a page, you're not gonna get read. And help them show what we invested last year, what value we got out of it, whether it's buying down risk or actual uptime, whatever. What are the what are the

Shaun Six (29:53): verifiable metrics that show success. And then what are we asking for next year and what do we think that value is going to be? And that has been a good ~ for us, that's been a a very positive solution as far as helping the C suite get funding, A, get understanding and feel confident. And then B go get that funding because at the end of the day they're they're up against a handful of other stakeholders competing for the same bucket of money.

30:13 Water districts and city council budgets

Aaron Crow (30:13): Yep. Well, I it I've I've had that conversation around ~ water districts. ~ ~ a lot of our why is what wastewater and water utilities, ~ ~ so so behind ~ you know, power utility or or oil and gas. ~ and and I've literally been part of a project where we built the budget. So we came in, did an assessment, built the budget, did the same thing you were just talking about. The difference is instead of going to the board because it's a big company, they went to the city council.

Shaun Six (30:43): Mm-hmm.

Aaron Crow (30:43): And

Aaron Crow (30:43): they're going to the city council for money. And they're going up against the police department that needs a new, ~ ~ ~ police cruiser. They're going up against the school board that needs a new school or a building or a roof repaired, right? Or teachers or whatever, right? So

Shaun Six (30:57): Yeah. Or teachers. Yeah. Yeah. Yeah.

Aaron Crow (31:01): this cyber risk thing, especially it's probably less now, but you know, five years ago, it was like, is it really gonna happen? Why don't we just

Aaron Crow (31:10): not do that and just we've been fine so far and nothing's ever happened. Why would they attack us type thing? ~ you know, and so it's been hard to justify sometimes those costs. ~ to your point though, I think that's changing. I think people and that's where I've always been on the other side. And what I loved about what you just said is what is that ROI from last year? Right. Because we don't always look at cyber, like cyber is usually a cost center. It's something that costs us money. We don't get value from

31:39 Selling availability and reliability, not "cyber"

Aaron Crow (31:39): And I think that's not true. I think there's absolutely value, but you have to understand how you're doing it. So like when I was pitching this at power plants, I walked in with no budget, but I wasn't pitching cyber. I was pitching, I can make your process more available. I can help you troubleshoot better. I can give you more visibility into your environments. Like I can, I can help with reliability, availability. Like those are the words that I was using. And I built my program on those things.

Aaron Crow (32:06): So those were the primary charges on the technology stack that I chose when I was rolling these things out. Selfishly, with me and the CISO and the back end, we were also getting alerts and notifications and cybersecurity awareness. And we also implemented firewalls and segmentation and all that kind of stuff. And I got all those things too. But the reason, the value, the ROI for the business was all of that availability. And that was once we implemented those things and showed them those things, they're like, this is amazing.

Aaron Crow (32:36): They don't care that there's a firewall there. They don't care that you're getting the alerting. They don't care about the sock. That's not the thing they see on a day-to-day basis and that brings them value. But all those things are there in most every cyber program. They're just not focused on. And the attention in the ROI isn't necessarily displayed or understood, which is what the COO and the CFO wants to see next year. When where did we we spent this million dollars last year? What do we get from it?

Shaun Six (33:02): Yeah.

Aaron Crow (33:02): What's the value?

Aaron Crow (33:04): Why why do you now you're asking for another million? I we just spent a million dollars last year. You need more money? Why do you need more money? ~ that's a conversation we're having all the time. And I think cyber has done it un unwell many times.

Shaun Six (33:13): Yeah, you have to justify. Yeah, I think so

Shaun Six (33:17): too. Yeah, you have to justify your existence every year. And you're like, how how are you not, ~ ~ how are you not on the same page? And what's amazing too on the cyber risk quantification conversation, ~ the publicly traded boards, those those board members are liable. they have a fiduciary responsibility. So whenever you frame it that way and you go, Hey, these are cyber physical systems.

33:41 Cyber safety is physical safety: educating the board

Shaun Six (33:41): Cyber safety is physical safety in an OT environment. You have to educate them. But once you do, they perk up and they and they change their tune quite

Aaron Crow (33:47): Right. Right.

Shaun Six (33:48): a bit. ~ but that's an interesting that you have to justify it every year is is a little frustrating. But you do, and and it's it's the reality of it. People just are unaware. On the water side, there was an alert today. One of the guys on the team, Jacob, he's like our IC guru. So we we've got him, you know, doing IC trainings and stuff.

Shaun Six (34:08): And he monitors these alerts, but he's out in in West Houston and there were fourteen MUDs in the KD district sent out

Aaron Crow (34:15): Mm-hmm.

Shaun Six (34:15): an alarm for low pressure today. And their response to it was they said, We have ~ we don't know what's wrong. We'll be sending somebody to each site to inspect. It's like can you imagine like an oil company having low pressure on a pipeline and then not having any idea of of why their pressure is so low and you know

Shaun Six (34:35): It's because it's un unfunded and unsupported and you have to compete with all these interests that are public interests. It's a public record. So yeah, we've been working with Jonathan Pole on that. And so he's got a handful, we've done a handful of water, and we decided to put our heads together and make it where we can do ~ our our job, our our goal was what works for oil and gas doesn't work necessarily for water because they don't have the same budget or resources.

35:01 Water: a lower-cost assessment for utilities without oil and gas budgets

Shaun Six (35:01): So we really had to pivot because our experience is more, ~ ~ large infrastructure clients. And we together have been able to bring our costs down to a fraction of what an assessment would cost historically, but also what ~ the time. And our goal is to get them into run and maintain as quickly as possible. But ~ those are, you know, people that are attacking water are not after money. They're after hampering critical infrastructure and bringing down our supply chain.

Shaun Six (35:28): And I think water is the easiest. If you're looking at all the sixteen sectors, water is is intrinsically linked to almost all of them. You know, like you need water for cooling a nuclear facility, you need water for ~ cooling a power gin turbine, you need water at home, you need water to treat oil. So you take water offline, you take down three or four other immediately three other four in infrastructure sectors.

Shaun Six (35:52): I was trying to think about I lost track of thought, but the you had said something earlier about the ~ the big the big guys and getting their attention. I'll come back to it. It'll come it'll come back to me.

Aaron Crow (36:03): Yeah, all good. So so I want to dig into a little bit into the quantum. That's that's definitely a conversation. I've had a few episodes on. Most people talk about AI because that's the the forward thing that everybody's thinking about the most. But I dive into a bit, like what is the concern with quantum? What's the value for it? how does it fit into an OT space? How does it fit into cyber risk? and what are the things we need to be looking for, thinking about and and and how do we protect against.

Aaron Crow (36:33): And start thinking about, ~ ~ what do we do about ~ quantum and and how is it going to impact us?

36:39 How Shaun got into quantum: the box he could not test

Shaun Six (36:39): Yeah, for sure. ~ this talk is something that I honestly thought, ~ if you told me in twenty-two, I'd be talking about it, much less writing about it. I I would have called you a liar. So we first got pitched this quantum box back in 2022, and our team looked at it, and then we had ~ one of our operators reached out and said, is this thing real? 'Cause they're they're getting pitched. And I think their parent company said, Hey, there's this executive order under the Biden administration for quantum readiness. It doesn't talk about

Shaun Six (37:07): private sector, but it had some some teeth in it for public sep sector. And ~ he said, what do we need to be worried about? And so I started kind of going through my my research back then and talking to people and we could not tell these boxes if they were truly quantum derived anything. And it just had the word quantum on the box, but it was and they wouldn't tell you what kind of encryption they're using. And at the end of the day, you can't prove what you can't

Shaun Six (37:32): see or test. And so we just we just ~ ~ walked away from that particular piece, but it did spark my interest and I started reaching out. And we have since partnered with ~ a company called Secure Quantum out of Chile and ~ they helped me with my understanding of quantum. And AI does play a part in quantum in a way that I don't think we saw coming, which is if you look at ~ the ability to create a qubit and then if you're interested in learning more about this, Dr. George's book is called

38:01 A book for CISOs: quantum and cryptography for non-specialists

Shaun Six (38:01): Post quantum readiness. And it is for ~ it is for quantum ~ for CISOs. It's written in a way that CISOs can take it. So the first half of the book is what is quantum and then what is cryptography and how to do these two things. You're not gonna come out as an expert, but you're gonna understand how qubits are made, how they have to be cohered to work together, and then ~ and the problem that the error correction that happens inside. So it's you know, you could get a it's basically quantum for the non-quantum physicist.

Shaun Six (38:29): And then there the cryptography for the non-cryptographer. ~ how does cryptography, how do we use cryptography in our daily lives? And when you start to understand that, when you start to understand that cryptography is used in everything we do, and

Aaron Crow (38:40): Mm-hmm.

Shaun Six (38:41): we talk about zero trust, and there's obviously a higher level of cryptography and more layers, but it's used in pretty much everything that you do. Whenever you're sending a even a text message or a phone call or whatever, if you're on email, you know, whenever you type in your password, there's there's a cryptographic key that's being exchanged and and you don't see that key, but

Shaun Six (38:58): ~ the ability for quantum to actually work functionally has been what's in question. And ~ I will say I I used to I used to go non I don't like selling fear and I don't like being hyperbolic. So th those are two things I'm like always trying to avoid because I hate people that sell fear and are hyperbolic, you know. I just I hate

Aaron Crow (39:17): Mm-hmm.

Shaun Six (39:18): being sold that stuff and I I I don't want to ever be pitching that to anybody.

39:22 Why AI and quantum are accelerating each other

Shaun Six (39:22): but having said that, I do think we're in an arms race. And I think we're ~ ~ living through the Manhattan 2.0 project. And it's ironically quantum, because if you're familiar with the idea, first conceptualized at Los Alamos, they were working on that on bomb and they figured, hey, in the future there's going to be this thing called a quantum computer. ~ physics have gotten to a point now where creating the qubit, and then you'll see this trajectory from like 2002 where we start really playing with qubits, and you see it following Moore's Law until about 2018.

Shaun Six (39:51): As far as its capability and its doubling. And then in 2018, it breaks away from Moore's Law. And then 22, it just is like a a hockey stick. And in this year, there's been more progress in quantum than in the last decade. And it is because the use of AI and the ability for AI to help monitor the creation of the qubit, make sure you do it properly, and then it goes in and then error correct whenever the qubit falls out of coherence.

Aaron Crow (40:15): Mm-hmm.

Shaun Six (40:16): And then proving. And then now

Shaun Six (40:18): the so and so the methods of how to create qubits and how to monitor and manage and keep them coherent, that all has been accelerated by quantum by AI. So the the combination of quantum AI is both exhilarating but also terrifying. And we're seeing now ~ with LLMs, they're kind of behaving in a way ~ that that quantum works. So quantum, like if you're going through a maze, you know, and you use a classical computer, you're gonna just go down one line at a time.

Shaun Six (40:46): You find an error, and then you're gonna come back and start over and retrace your steps. And so whenever you're breaking cryptography, it works much the same. It's you're you're just going down until you find the error, and then you go back and you just start over. And I think one great example of that is ~ this year, I think it was back in June, somewhere in that time frame. The Chinese, someone leaked the Chinese quantum computer had solved this theorem. Now it's not a cryptographic attack, it's just a meaningless theorem, doesn't have really practical use.

Shaun Six (41:13): But the best computer in the world is the US supercomputer. I believe it's called Hercules. I may be wrong on the name. But ~ the supercomputer they say would take 10 quatrillion years. So I had to look that up because I don't know what quatrillion is. That's a one with 19 zeros. And so I

Aaron Crow (41:28): That's a lot.

Shaun Six (41:28): had never heard that term before. And I was like, is this something I'm supposed to know? But ~ yeah, so 10 quatrillion years for our best in class supercomputer. And depending on what ~ source you see from the Chinese League, they say it was either four microseconds or four minutes.

Shaun Six (41:42): Either way, they solved this theorem that would take us ten quadrillion years. So ~

Aaron Crow (41:46): Mm-hmm.

Shaun Six (41:47): you know, ordered order of magnitude faster or better than than what we've got. So right after that, and I'm not saying it's because of that, I don't know, but speculation would say p possibly, the US government comes out with the the executive order and I can't remember the name of f anyway, it came out in June.

Shaun Six (42:05): And the executive order was about advanced cryptographic attacks. So in the Biden administration, you see them talking about post-quantum cryptography, but realizing that AI, while it's going, it's you're able to send agents down multiple pathways at the same time. And you

Aaron Crow (42:18): Mm-hmm.

Shaun Six (42:19): have an agent setting on top that's feeding back what worked, what didn't work. So you avoid those mistakes on the other side. So we are seeing some cryptographic attacks through AI that we thought would take quantum to do.

42:30 Timelines for post-quantum plans

Shaun Six (42:30): but we're also seeing the acceleration of quantum. So the timelines from the Biden administration went from, I believe, 2035 having a post-quantum implementation and starting your post-quantum plan in 2032. They've pulled that forward and said you need to have this by, I believe, 2029 now. a few of the oil companies we're working with, they actually have they have to put their post-quantum readiness plan in practice in 2027 and be fully migrated by 2029. And the recent Google ~ announcement was.

Shaun Six (42:58): The quantum computer will be here by 2029. Unfortunately, NIST put out this, not unfortunately, it's fortunate that NIST did this. So NIST put out the post-quantum ~ cryptography test basically in 2016. And they had 10 finalists and their idea that quantum computers would crack modern cryptography. 10 finalists, I think maybe four made it through phase two, 10 made it into phase one, four made it to phase two, and only one made it to phase three. It's been under test and review by the world's best cryptographers.

Shaun Six (43:27): using ~ whatever they can to try to break the cryptography or find flaws in it. Mythos found a flaw in it in 20 hours. So we are down to zero. So they they're gonna go try it's actually a foundational firmware issue. So they they figured out, you know, or I can't remember that the initial coding, but they they're going back and re-redoing that piece of it and they think they can redeploy it. But the the reality is that AI cracked it, not not quantum. So

Shaun Six (43:53): quantum's gonna be able to do that, go down the pathways ~ much better than AI. And so what you've seen AI do, just imagine any, you know, 10X that on a on a quantum computer. So I thought I had came up with the when I was researching this and I'm chart I I was using my AI bot to chart advancement and acceleration. And it is this like amazing hockey stick that goes up and you go, Moore's law is dead, and I go, Hey, I think I created a term.

44:19 "Moore's law is dead" and the book behind the term

Shaun Six (44:19): And I Google it and it's a chapter in in the book post quantum supremacy. So he he literally yeah, and he came out with that like a year before I found it. So so the term. Yeah. I was gonna register

Aaron Crow (44:29): Dang it.

Shaun Six (44:31): that domain, sell it for a few hundred thousand. Didn't didn't work out. Yeah.

Aaron Crow (44:34): There you

44:38 Aaron: what should listeners ask their boards this budget season

Aaron Crow (44:38): go. So so there's there's so much and and I I know we we've kind of we've talked about a lot. We've talked everything from from people to quantum to safety and and everything in between. ~ you know, what is the what are the things that you think ~ if you were gonna give somebody listening to this, so the audience, we have everybody from you know, new folks that are coming into the organ that coming into OT or cybersecurity to the CISOs.

Aaron Crow (45:02): and kind of everything in between. Like what what do you want them to take away? Like what if what's the value you want them to think about coming away from this conversation? or questions you think they should be asking going into their board meetings this this week, this year. It's getting close to Q4. ~ and and it so all these budgets for twenty twenty seven are coming up and you know what what what technology do we need? What how big is our team? Like what budgets are we doing? Like all these questions are very pertinent right now.

45:32 Insurance, assessments and standard frameworks

Shaun Six (45:32): Yeah, I think ~ if you could go back to the standard frameworks like IEC 62443, 2022 insurance companies didn't want to see an OT assessment, but they started writing into their ~ in the writer that ~ automation systems are not insured by the cybersecurity policy. So a lot of people didn't realize that until they got hacked and they realized I don't have ~ cy I don't have OT cyber insurance. And

Shaun Six (45:58): Going back now, they're requiring it. If you want an OT policy, they're requiring some kind of assessment and a roadmap to

Aaron Crow (46:04): Mm-hmm.

Shaun Six (46:04): show that you're actually looking after this stuff. The best thing you could do, I think, well, I would say, hey, let's get if I if I'm a C CO of a of a large or small organization, ~ do a standard framework assessment that includes asset inventory. While you're out there doing your asset inventory, and that's also a great way to kind of bridge the gap with the five to one. So you've got, you know, you're you're

46:14 Pair the retiring expert with a junior, and the bills of material

Shaun Six (46:26): guy that's going to retire in the next few years and your junior resource that doesn't know anything, pair them together, go out, do an assessment. They'll learn what's out there. They'll get to put their hands on it, see it. And you can use tools like Clarity, like like Nazomi to do the tapping.

Aaron Crow (46:39): Mm-hmm.

Shaun Six (46:40): And so you'll teach them some new tools to do the assessment and to see what's actually hanging out there. While you're doing your asset inventory, go ahead and do what we're calling the bomb of bombs. Your firmware bill of material, your software bill of material, if you've got AI in your OT, your AI bill of material.

Shaun Six (46:55): And then the I think the most important one is the cryptographic bill of material. ~ and then and then the ability to contextualize that because ~ in sending an IT person to do this, they'll prioritize it the same way they would in an IT stack. And the OT stack is a C V E is not a C VE, ~ a deprecated cryptographic standard is not the same as if you had like a ~ internet exposed device. So you want to you can teach them, you know, like whatever the Purdue 2 2.0 model that you've rolled out.

Shaun Six (47:24): But you can teach them those zon zones and conduits and then make sure things are buttoned up properly while you're out there, but then pull that inventory in. And the next step on that would be take that inventory and whoever's been the designated, you know, put this in your knock and your sock to monitor whenever ~ an attack happens, because these attacks aren't happening yet, like these schedules aren't deprecated. Although

Aaron Crow (47:43): Mm-hmm.

Shaun Six (47:44): a majority of the ~ zero trust that's been implemented, you know, in the last 20 years, those standards are deprecated now.

Shaun Six (47:51): So if you go through the NIST deprecation schedule and you look, you'll find a lot of deprecated ~ standard or cryptography in your stack. But if you've got it behind the right f segmentation, you then you're fine. So you want to

48:03 Segmentation, deprecation and a migration you have tested

Aaron Crow (48:03): Right.

Shaun Six (48:03): make sure the segmentation is appropriate for the job that it's doing. And so that's a great way to train a new person as well, to marry them with the senior person so they get that knowledge transfer and then also build your cryptographic bill of material.

Shaun Six (48:16): and then put it into a framework that's gonna actually be monitored so that whenever those standards get deprecated, ~ ~ exactly where they are and ~ ~ you have a plan to maybe you have a kill switch or you roll over or you have a a migration that you've been testing that you can go live with. So ~ ~ I don't know if I answered your question, but that's that's yeah.

48:32 How to find Shaun and UTSI; the post-quantum readiness plan for OT

Aaron Crow (48:29): Yeah. No, that's it. That's perfect. Yeah,

Aaron Crow (48:32): I love it. Yeah. Thank you. No, so okay, how do people what call to action? How how do people find out more about UTSI, find out about you? Obviously, you give a lot of talks, you give a lot of value back in. What how do how do people find more about you guys?

Shaun Six (48:46): Yeah, thank you. UTSI.com. we're also on LinkedIn as UTSI, and my LinkedIn is just forward slash Sean Six. ~ Dr. George and I are actually presenting on postquantum tomorrow in Minnesota. ~ and we we have put together, so her book talks about all the templates that you need to go forward as a CISO, but what it doesn't do is give you the how to get there. And me having you know 20 years of project management in OT, I was like, we need to put this together. So she and I have written an OT writing sp

Shaun Six (49:16): Quantum readiness plan for OT. And we're presenting on that a handful of times. I think it'll be 11 this year that we've presented on this, but it

Aaron Crow (49:21): wow.

Shaun Six (49:22): got published a few weeks ago on ~ automation.com. So if you look up ~ post-quantum readiness for operational technology on automation.com, it there's a paywall. Our goal is to get that's only it's only you know 1500 words. So our goal is to publish a more comprehensive and get that out for free. Because our goal is to get everybody using it, deploying it. There's tons of tools out there to help you do it.

Shaun Six (49:44): Nazomi, for example, Clarity, you can pull that cryptographic bill material while you're doing your asset inventory. You just have to be intentional about doing it. So we're our goal is to get everyone doing this because at the end the day we're all dependent on each other's success. So ~

Aaron Crow (49:56): Yeah.

Shaun Six (49:56): yeah.

Aaron Crow (49:57): Absolutely. Well we'll put links in the show notes for all those those resources. There were a couple of books that we called out through the time. We'll put all those things in there as well. ~ and then, ~ ~ Sean, just t share all the the speaking opportunities that you're doing that people can come catch you. We'll put all those things in the show notes as well. So ~ la last call, anything you want you want to say or or want people to know before before we close out.

Shaun Six (50:19): Sure. ~ Jonathan and I are speaking at API cybersecurity in November together on post quantum. And there's an entire panel. All the speakers are amazing, and one of them has a book that I haven't read yet, but I got to see him speak a few months ago. It looks amazing. So I'm really excited to be on the panel and then to meet these guys. And we'd look forward to seeing anybody that's going to the Iber the API cybersecurity conference. We'll be there talking on the Tuesday.

Aaron Crow (50:39): Awesome. Yeah, definitely go check that out, Jonathan. And and there there's there's gonna be a lot of value on that. In fact, I need to get we've been going back and forth. I need to get Jonathan on the podcast. We've been we've been talking about it, but haven't haven't had it happen. So I need to make that happen. So you

Shaun Six (50:49): ~ he'd be great. Yeah.

Aaron Crow (50:51): need to hit him on it and say, Hey, make this happen because there's there's just too much OT is a small world and and ~ you know we we all have the same circles and there's just there's too much value to give. So I appreciate it. But yeah, man, Sean, thank you so much for your time today, sir.

51:05 Close

Aaron Crow (51:05): I appreciate ~ your the your knowledge and your your value and giving back and and spending time with me today and sharing. man, I'm I I'm excited to dig into that that post quantum for OT ~ and and share it with with the audience as well. So ~ thank you for your time today and I look forward to seeing you at the next event.

Shaun Six (51:22): Yeah, forward to it. Thank you. Cheers.

Aaron Crow (51:23): Yeah.

Transcript lightly edited for readability.