Speaker 1 00:12 Welcome back to yet another episode of The Segment. Today's guest is Dr. Alex Schulman, Global CISO at Kraken Technologies, where she's responsible for securing the AI-powered platform, accelerating the clean energy transition across continents, and someone I go way back with all the way to our city days. Well, more on that later. And a lot has changed since then. The data center has given way to the cloud. The workforce has changed. AI is changing how we work again. But I'm not sure all of our thinking about how we secure the enterprise has kept pace, and Alex is the perfect person to unpack that with. She's spent decades across cybersecurity, cloud, engineering, risk, and digital transformation, including as managing director and cloud security leader at EY. Today, she's applying that experience as global CISO at Kraken. So Alex and I are going to dig into what security leadership needs to look like for the modern enterprise. We'll discuss what we may need to rethink, where security teams should focus their energy, and why data segmentation, blast radius, and Zero Trust become even more important as AI enters the picture, Alex, welcome to the segment. Speaker 2 01:25 Thanks, Raghu. So excited to reconnect. Always such a pleasure to chat with you, and especially on these topics. Speaker 1 01:31 Yes, yes, absolutely. When when we're thinking about these topics, it was like, well, who's the expert that we have to talk to? And your name was very much top of the list, so so happy that you're here. First question to you, Alex. You've been right in the middle of what I think are two significant technology transformations over the last decade. First, when organizations were really at the infancy of adopting cloud, you were leading cloud security engineering, and now as organizations everywhere are trying to get an understanding of how AI should be used, you're responsible for securing that. Tell us about your perspectives across these. Speaker 2 02:15 Thanks, I think cloud changed our way of thinking, and AI is further extending it. When we started with these first cloud migration projects, we started addressing the first things that we need to change in our security concepts, and now AI is challenging this even further. Let's take a few examples. If we'll go 20 years back, we used to think that the end-user devices are trusted. They were directly connected to production networks, and companies were controlling exactly what the employees can run on these laptops. Then we started having SaaS and cloud, and this already started challenging. This we started talking about shadow SaaS tools and other tools that employees started deploying on their laptops. With AI, it is going to be even more challenging because even the definition of shadow AI is not clear. Soon, our employees will be developing tools by themselves. It won't even have this formal name or formal company behind it, because people will be just writing these pieces of code that they will be using. How are we controlling all of this? So our thinking needs to change. We need to treat these devices as untrusted, and we need to focus more on what matters the most for our companies, and this is exactly where cloud and Zero Trust are coming into play. Because when we move to cloud, we realize that we need to control access to cloud. We cannot directly connect this to the same network, and this is the advantage of cloud that it has this Zero Trust thinking built in, and that's what we need to focus on. How are we extending this Zero Trust thinking now to AI, to the AI identities, and all the other things that we'll be having in these environments, and treating all of the devices As untrusted, because pretty soon and even now we can't control everything that is running on them because it became so easy to develop new software. So that's the change that we started, and now it is having a much bigger impact on everyone. Speaker 1 04:39 So you've already touched on kind of that that change in trust model, and you've introduced the the term Zero Trust. So we'll come back to that. Another insight that I'd like you to bring is that the types of roles you've had you were at IBM, you've been involved in research, you've run engineering teams, you've been a sector. On the consultancy side, advising organizations about how they should think about security strategy, and today you're a CSO. So, how have those varied experiences shaped the way you approach your CSO role? Speaker 2 05:14 Yes, thank you. First of all, they're very all of them are very connected, because the fundamental approaches of what we need to do to build high quality and secure software didn't change. We may have new technologies, but we still want this high quality and secure software. So these fundamentals didn't change. But what became obvious to me over the years is that security sits in the intersection of all other functions? It is not about building the best security tool. It is not about detecting the most advanced threats. It is about looking at all the functions and looking at how can we reduce the risk for everyone, both the employees and the clients, and the mission of the company. So it is about looking across all these pillars that is so critical, and this is what took me years to realize because you really need to feel it. But I think this is what all of this CSO is all about. Speaker 1 06:18 So you mentioned the term fundamentals, and if I think about the last six months in particular, since all this news around frontier AI and cybersecurity capabilities or frontier AI models has really come into vogue and has really been dominating technology news and cyber news, one of the things that we are seeing continually return back to is how organizations should be prioritizing fundamentals, right? The most essentials of cybersecurity. So I have a question to you, not not as a CSO, but as a security practitioner. It seems very obvious that fundamentals is things that we should do, right? Why do you feel that fundamentals have either not been dull well enough, or maybe have been ignored, Speaker 2 07:07 or maybe they're changing? Let's take identities as one example. What was considered fundamental in identity management 10 years ago was designed around human identities and passwords. So these fundamentals were around how are we controlling the provisioning of human identities. Then with cloud, we got this proliferation of non-human identities, service accounts, and all these things. So we said, okay, now this is what we consider as our fundamentals. We need to be on top of these service accounts, and we have our best practices when it comes to cloud identity management. Now, with AI, we have kind of new fundamentals because AI identities deserve their own category, or at least that's my opinion. We cannot use human identities for this. We cannot use traditional cloud identities for this, because it's about this combination of actions and scope that the agents can do. So I think maybe that's the next evolution in the identity and access management space. So I feel as it is this combination. We do we do need to do fundamentals, but these are different in each space, and these are evolving. So we need to catch up on all of this, both do what we had to do 20 years ago, but now also address these new challenges. And sometimes we don't have the playbooks yet, so we need to experiment and figure out what's the best approach. We'll Speaker 1 08:37 come back to that. So only because I introduced sort of this whole frontier AI thing. So I just like your take. When you saw the Frontier AI, the news, right? Whether it was the Mythos announcement, and of course, there's been many follow-ups after that. There have even been like breakouts, right, by multiple models. What has your reaction been? Speaker 2 08:59 So first of all, I think it was kind of expected. I don't think that many people in the industry were surprised, and in a way, we've been discussing this for a for a long time now. So personally, I was not surprised, and it is challenging our traditional way of thinking that we've been also bringing up since the beginning of cloud, but maybe now we need to better formalize this. Let's take another example: patching, everyone's favorite topic. Some companies used to have things like patching Thursday. This won't work anymore. We can't wait for Thursday. So all of this needs to be integrated into this daily management. Let's get back to cloud. Everything that we discussed since the beginning of cloud-it's about rebuilding. It's not about patching. So we need to have these continuous processes to rebuild software very quickly and. Should be natively integrated into the software development processes because if we'll be waiting for patching Thursday, it will be too late. So I think it is about this integration of all of these security concepts into the software development processes that becomes even more critical. But we've been talking about this for decades, so I think this example just highlights something that we've been discussing for a while now. Speaker 1 10:28 So, following up on that point, if we now think about this in the context of like security strategy, right? How would you say security strategy today for countering the threats that we have today for protecting the most important assets that we have today. How do you think that has changed? Let's say over the last 10 years. Speaker 2 10:51 I think 10 years ago, cell engineers could say security is not my problem because IT and security were managed in the centralized way for them, and I think this is what has changed because we need now everyone to take an active role in security management. Most teams are already doing this natively because this is how modern software is developed. But I think this is the main change that now we need everyone to think about cybersecurity all the time. It is not just something that the security team should be thinking about, and it is about helping everyone to do their job in this space. Speaker 1 11:31 And just on that, so I think I think what you're what you're saying there is is that security has moved from being kind of the responsibility of the security team to being everyone's responsibility, so end users, developers, engineers, IT teams, etc. Everyone is responsible for security. That feels like very much an awareness and an awareness piece in terms of that actual adoption and taking on that responsibility, do you do you see that transition very much being in effect? Speaker 2 12:07 I think is more natural to those who started developing in the cloud. So in cloud cloud native companies, it is just part of the process. I think it is even more than awareness, because awareness implies this almost reactive mode. Let's just be aware that these things may happen. While I think we need to change our way of thinking that it is this proactive approach that we need everyone to take, because if these things are just not part of everyone's day-to-day engineering and operations, we won't be able to do what we need to do. Speaker 1 12:46 And by proactive, do you mean almost ahead of the threat? Speaker 2 12:50 Exactly, it is about thinking about all these aspects when people are developing and operating software. Speaker 1 12:56 Okay, so that that that's interesting because there is there is the perception on the defender side, that we're always playing catch up with the attacker, right? We're kind of waiting for an attacker to make a move, and then we see what they've done, and then we kind of scramble and adapt. But what you're proposing is that we can get ahead of that. So explain how we get ahead and how we stay ahead. Speaker 2 13:20 First, this bonus will always be challenging, so I don't know if it is about staying ahead or it's just the way we need to manage software today. It needs to be. Let's get back to the patching example. Previously, 20 years ago, we had security teams coming in and patching systems. Today we have developers who are taking the latest images and redeploying hundreds of times per day, and we need them to constantly be thinking about this: Is this the right version? Is it reliable? Sometimes even taking the latest version is not the right thing because you need to ensure that no malware was introduced into this version, and it is about having all this as part of your development processes that becomes even more critical. That's the best approach to vulnerability management because we need everyone to take an active role in introducing this when they're managing software, obviously things may become vulnerable later on, and that's what we need to handle out of cycle. But we want to minimize the number of cases that we need to handle out of cycle. Speaker 1 14:33 So, kind of one of the things that that you have spoken about is really also about the evolution of the workforce itself. So we we've spent a bit of time focused on how we build better and more secure software, but an equal part of is how you secure the the modern workforce. Firstly, let's think about this from the perspective of employees, right? How have their expectations changed? Speaker 2 14:57 I think they expect more freedom in general. If 20 years ago we could tell people, okay, these are the only things that you can do on your laptop. Now we can't. We're saying the opposite. We're saying we need all of you to be creative all the time, because this is how we want to develop new features and give better service to our customers and achieve our mission. And I think newer generations are just faster with adopting new tools, experimenting with AIs, AI tools, and innovating all the time. And that's what we want to encourage. So I think that's the difference, and it is this transition between centrally managed IT organizations that were telling people these are the software tools that you can use and you're operating within these limits to this new environment where software development became easy. Software tools are available. People are developing software tools by themselves. We want humans to be more creative, and I think this is what is changing our approach to cybersecurity. That instead of us policing people, we are helping them to protect themselves and to protect what they care the most, and to protect the company mission. Speaker 1 16:15 So, as a security leader, when you're faced with this challenge of employees wanting to have more freedom, more flexibility, more creativity. Like, what is your what is your response to that initially? Because it it feels like it sometimes it goes against the grains of what you're trying to do with security. Speaker 2 16:34 Let me bring this question back to you and to the audience as parents. Are parents happy with kids experimenting with things? Speaker 1 16:43 Definitely not. Not when I'm not when my teenage kids are trying to sort of say, "Oh, can I have this app, that app, etc. The answer is almost always known, and then I get told that, "Oh, that means that you don't want me to have friends, or you don't want me to be creative, or or I get something thrown back at me as a reason about why they should have access. Speaker 2 17:03 Yes, but I think we will have employees that are doing only what they are told. There will be zero innovation, and this is why we need to help everyone understand what what is considered to be safe, how to protect themselves. But we do need to encourage innovation even more than before now. Once again, because there will be so many things that will be simply replaced by AI. That without this innovative thinking, I think many things will be frozen, and especially for our company, we do want bring better customer service, accelerate green energy, and other things. We do need our employees to be creative. Speaker 1 17:50 So with that, right? Because I feel that one of the transitions from a secure, essentially from a mentality perspective, is that that let's say 15 years ago there could be a very binary response. It's like either yes or no, right? But whereas now, again tying it back to what you're saying about sort of productivity, creativity, experimentation, etc. you have to be comfortable with a bunch of answers which are not yes or no, but are like somewhere in the middle, and are lots of gray areas. And like, how does that impact your role and like the the the essence of the role? Speaker 2 18:32 It is about defining what should they care about when it comes to the security of what they're doing. For example, protecting access to cloud, protecting access to data, protecting secrets-all these things that we know that they are critical. And how can they pay more attention? And what can we bring to protect them against these threats? And honestly, our industry is also still evolving in this space, because today we have more tools that will allow companies to know what is shadow AI, rather than tools that will accept that employees are actually developing software even for their own productivity. But we want this software to be safe, and we want to protect access to cloud, and we need to see, we need to have better visibility on how these things may be exploited to get to these other environments that we care more about, and that's what we would like to achieve. We do not always have enough tools to do this. This is where we hope to see more innovation. But security tools are evolving, and security teams have now more freedom to develop tools by themselves. Yeah. So maybe that's where the answer will be coming from. Speaker 1 19:54 And I remember again going back to our city days when we were trying to put in place. Good practices for adopting cloud. One of the key things that you were driving in particular were specific patterns, right? Specific patterns and security patterns that we were hoping that would enable encourage both rapid adoption, but also secure, responsible adoption. Like if we now look back 10 years on, is that now very much the way security teams kind of think? That's the default about providing the right patterns, but a range of patterns that enable employees to be productive and be secure. I Speaker 2 20:36 think maybe what what has evolved is where are these patterns today? We have more patterns for cloud, for example, because that's where we spent more time during the last decade developing these patterns for cloud access, for example, cloud segmentation, and other best practices that we absolutely need to have in place. We focused, I think, as an industry, less on laptop behavior patterns. But maybe once again, maybe that's fine because we need to treat these devices as untrusted, and we need to continue investing more in these patterns for cloud and now AI, because that's where the data is. So maybe this shift is fine, and maybe we should just continue doing what started with the beginning of cloud. Speaker 1 21:28 So you you you said that word untrusted again. So let let's go back to sort of and you introduced that in your your initial sort of intro at the top. The other term you introduced then was Zero Trust as well. So let's start here. For you, Alex, what does Zero Trust mean to you? Like, how do you define Zero Trust? It Speaker 2 21:48 is about operating with zero assumptions about the underlying layer, whether that's the access or the device or the platform that the software is running on or the layers below or above. Each component should assume Zero Trust on all thrust. So for me, it's not just about identities or network. It's about all of these controls because we need to assume Zero Trust for everything, each and every component, essentially reducing the blast trade use for everything. Speaker 1 22:24 Firstly, I think that this is the first time that I've heard someone use the term that you did-that defining Zero Trust as essentially not having any assumptions about the asset, right, or not having any assumptions about the state, and effectively bring building it all up from from the ground up in order to then determine what is what is valid and not. So, if we think now about Zero Trust, how does that impact or affect your strategy? Speaker 2 22:56 I truly believe that that's what we need to focus on. That's that this is the most fundamental thing that we should continue having, and we should be constantly expanding. It starts with cloud access, but this should be an active area of investment. Some of the models, when it comes to AI, for example, are still evolving because we need to apply the same concept of Zero Trust now to AI agents that may be accessing our data through MCPs or the protocols, so we should continue running what we have, but we should continue expanding this all these approaches to these newer areas, Speaker 1 23:41 so you're you're firmly a kind of a Zero Trust advocate, a Zero Trust believer, and and and and do you think that the that the need for Zero Trust as sort of a key strategy? Do you think that need has has increased as technology has evolved? Speaker 2 24:01 Absolutely. Bring this back to our discussion. If we think that AI will make our devices even more untrusted, we need to have more Zero Trust in other areas. So I think everything that we are going through with AI right now will only accelerate the need for Zero Trust, because if indeed software is easy to develop, people will have more tools. We cannot trust end user devices. We need to have more controls where the data is. Yeah, we we have solutions for cloud access, when it comes to AI, we need more and better solutions, and that's where I would love to see our industry developing more solutions for us to be available. Speaker 1 24:54 So, so just on that, about more solutions. When when we went on this rapid adoption of. Public cloud. The perception was what the cloud service providers actually provided a really excellent set of security capabilities to secure their environments. But it was just sort of, I guess, understanding education meant that often people would still go away and leave a s3 bucket world readable, right? Because it was easy. Do you think that as we adopt AI, do you think we actually have an opportunity to secure AI and AI workloads and applications and agents, etc. in a much stronger way than let's say we had secured cloud previously, or is it a completely different problem? Speaker 2 25:41 I think it is the same problem, and I think we can learn a lot from cloud. And I think this is what we should be expanding. We should be taking our lessons learned from cloud and expanding them to AI. Let me give you one example. The most fundamental thing in cloud is the cloud shared responsibility model that all of the providers have been highlighting since the beginning of cloud. They can do the best work in securing what they control. Speaker 1 26:13 Yeah. Speaker 2 26:13 But if these s3 buckets are open, outside of their control. Speaker 1 26:19 Yeah. Speaker 2 26:19 So we have this with cloud and cloud configurations, where the cloud provider is responsible for running and securing the cloud and the services, while the users are responsible to securely use them. But this meaning of securely using them is more complicated now with AI, because tech providers will be providing platforms to run agents, and then the users of these agents will have more control to configure the identities, the scope, the function of these agents, and it is this joint shared responsibility model that will become even more critical as we're stepping into these new AI models because it is this joint partnership that will be truly critical for the providers like us to give the tools to control, but then for the customers to manage this, to manage the scope and the identities and all other things that are associated with these agents. So I'm a big believer in the shared responsibility model. I think all companies will need to continue investing in this. I hope as things will be evolving, there will be more and more clarity on how to manage this, and we'll have more and more tools to help clients with their part of the shared responsibility model, because we do have this in the cloud space, we have this in the SaaS space. We still don't have enough in the AI space. Help see more tools helping clients with their part of the shared responsibility model when it comes to AI in the cloud. Speaker 1 27:59 Yeah, I can absolutely assure our listeners that Alex's stance on the shared responsibility model has been remarkably consistent over over the last decade or so that I've known her. Right, she could literally repeat this this this exact line even 10 plus years ago. So I want to ask you a a question, a related question, but in a slightly different manner. When I look at how we were rushing into cloud 12 years ago, and the way we were looking at cloud security as a completely new discipline, as if some of these challenges had never existed before, I feel that that was a set of mistakes that we made when securing cloud, and we didn't just think of well, this is just, it's kind of like the data center, but one misconfiguration away from being exposed to the internet, which is really kind of what you need to think about. And I feel that when I look at how we're approaching securing AI, we are, in many ways, think like bringing some of that same baggage with it in terms of treating it as a completely different class of technology that needs to be secured in a different way, and I feel that that's introducing mistakes and challenges to securing it. What's your perspective on that? Speaker 2 29:14 I think that's a very good and valid point that we need to pay attention to, and let's look at the differences between different companies. If you will look at cloud-native companies, they don't have the centralized cloud team. They expect all the employees to know how to kind of build solutions, operate solutions in the cloud. I think large organizations created these dedicated cloud teams to accelerate the migration, but the intention always was: it is temporary. It will help us with the migration, with the transition, and then we'll be able to just spread this across our existing teams. And I think some enterprises did this. They viewed this as. Temporary, and then when they migrated large volumes of their apps into the cloud, it became everyone's responsibility. Some organizations still didn't make this change, but I think this is exactly what we may need to when it comes to AI. Some companies have centralized AI teams helping them to drive this transformation, but I think the goal should always be for everyone to pick this up later on, because cloud, AI, security, all of this, this is everyone's responsibility, and I think engineers need to understand all of them, and if we will have engineers who don't understand cloud or AI or security, it's a problem. Yeah. So I think maybe that's the evolution that we're going through. Speaker 1 30:51 I think that's such a such an important point, and the reason I say this is that I I'm going to draw a parallel because I'm involved in a lot of like customer conversations, right? And often the focus is overly on what is my day one outcome. So that that's kind of like a parallel to is like a transformation team delivering a transformation, but it's not often enough on how do I then run this effectively day two, day three, day four. How do I keep it evergreen? So, so, and I think that that parallels exactly what you're saying in that transformation. We just think about I want to transform, right? We don't think about well, how do I run this and how do I maintain it going forward? And that's probably a key part of ensuring you do this effectively to get to your outcome, but also in a way that is operational. Is that? Do you see that exactly? Speaker 2 31:46 And this is why, for example, large companies when they started with cloud migration, they created dedicated cloud security teams. Speaker 1 31:55 Yeah. Speaker 2 31:56 Cloud native companies don't have cloud native teams because it's everyone's responsibility. Speaker 1 32:03 Yeah, yeah. Speaker 2 32:04 And I think it's the same with AI. Some companies may be creating dedicated AI security teams. Others will just distribute this across everyone because everyone needs to be operating within these newer environments. Speaker 1 32:20 Bringing it back to to AI now and Zero Trust, how do you put in place or how do you extend your Zero Trust strategy to effectively secure your use of AI? Speaker 2 32:34 In a way, I think this is where it is easier when you're cloud native, because this is where the critical AI is, so this only strengthens this cloud native strategy, saying that let's focus on areas where the data is, and let's bring more controls to these environments, and let's bring more controls over AI in these environments. Speaker 1 33:03 So you mentioned about it, like adopting AI and adopting AI in cloud makes it much easier to secure, right? Because you're kind of securing it where the data is. So is securing AI fundamentally just a data security problem, or is it, or essentially all the pillars of security as relevant when thinking about securing modern AI environments? Speaker 2 33:28 Yes. So first of all, it is not necessarily easier. It is just that's the focus area. Speaker 1 33:34 Okay. Speaker 2 33:34 Because of where the data is, and you're spot on. It is not just one thing, because traditionally when people discuss data protection, 20 years ago, encryption was the main focus. Now it's about access to data. It is even part of the design, because segmentation should be part of everyone's design. It's the most critical thing that you need to do as early as possible, and it is very difficult to add later on. So, in the same way, security should be everyone's responsibility and top of mind for everyone. We want segmentation to be part of these designs as early as possible. Speaker 1 34:17 Awesome. So, what what keeps you up at night? Like when you when you go to sleep at night, what is there any particular thing that that worries you that thinks, oh, this is a problem that we need to fix, or the world needs to the world needs to fix? Speaker 2 34:31 That's not a good question to ask CISOs ever. We have so many things that we need to worry about. So I think quality of sleep is not something difficult to our profession. Let me put it like Speaker 1 34:48 okay, okay. So let let me, if you're happy to play along, I'm I'm going to give you some rapid fire questions, right? So you've got like let's say one sentence. Within which you've got to answer this. Speaker 2 35:02 Cool, let's try. Speaker 1 35:03 And I, right, and I haven't shown you these questions, so so these are really off the cuff. All right, first one: What is the one cybersecurity truth most organizations don't want to hear? Speaker 2 35:17 That is like in healthcare, most people are not healthy. That's the reality. This is why doctors are learning protocols to treat diseases and save lives. We should be doing more of this in cybersecurity. We should not be assuming that everyone is healthy. Okay. Speaker 1 35:36 Second question: What is something that the cybersecurity industry treats as accepted wisdom or essentially a fundamental truth, but that you think is actually fundamentally wrong. Speaker 2 35:51 I think it's about some CISOs think that people are doing what they're being told. We need to accept that humans will not necessarily be following policies or other things that they're being told. We just need to accept that's human nature, and we need to build controls around it. Speaker 1 36:15 Okay. All right. Next one. The last time you were significantly wrong about something in cyber, and what was it? Speaker 2 36:26 Let's get back to our discussions 10 more than 10 years ago. Speaker 1 36:30 Yeah. Speaker 2 36:31 You remember I was very concerned with container security. Speaker 1 36:35 Yes. Speaker 2 36:35 I'm still very concerned with this problem because essentially containers are less secure than virtual virtual machines in many aspects because of the shared operating system. Yes, this problem is still real, is still relevant, but I think CSOs and other leaders just need to think across so many layers and so many different things that we cannot just focus on one specific problem. We need to accept that most probably we will continue having these problems, exactly like in healthcare. People are not healthy, so we need to accept that we have certain newer technologies that have certain risks, and we need to address this as a risk management problem, rather than kind of this software engineering. It is a software engineering problem, yeah. But CISOs need to look at this from the risk management angle. Speaker 1 37:32 Understood. So it's it's essentially choose. It's almost a way of saying choose what are the most important battles to fight, right, and accept that the others are probably not worth spending time and energy on. Speaker 2 37:44 Have this risk view on everything and prioritize based on risk. And it is the same with end user devices. We need to constantly review what are the areas of bigger risk, and that's what we need to focus Speaker 1 37:56 on. Awesome. Well, Alex, like you have such a wonderful and and varied experience, as we kind of sort of covered in the intro, right? So that puts you in kind of a unique position to like look into a crystal ball and provide our listeners with with advice. So if you're looking at sort of the industry and across organizations as a whole, if there was one thing you could recommend our listeners to focus on over the next 12 months, what would it be and why? Speaker 2 38:30 So first of all, I don't have a crystal ball, but what I would recommend everyone, even in their personal lives, pay attention to cybersecurity. It is not easy because even in our personal lives, when we are managing our personal accounts, our bank accounts, our energy accounts, not so many things that may go wrong. But we just need people to be thinking about this, and we need everyone to be more proactive about this, both in our personal lives and our professional lives, and regardless of what your role is within the organization, we just need people to think about this because it's not someone else's problem. It is not isolated. It is part of the business. It is part of the company mission, and that's why we need everyone to take an active role in this across the industry. Speaker 1 39:21 I think that's a fantastic bit of advice to leave everyone with. It's simple, it's actionable. Get aware about cyber, make it a priority. Right, you've got to start there. Well, Alex, thank you so much for accepting our invitation to be on the segment. It's wonderful to speak with you more than a decade after we first started working together, so yeah, very exciting. Thank you so much. Speaker 2 39:43 Thanks, Alex. Excited to reconnect and help to work with you one day. Speaker 1 39:46 Yeah, absolutely. Let's make it happen. Thanks for tuning in to this week's episode of The Segment. For even more information and Zero Trust resources, check out our website at illumio.com. You can also connect with us. On LinkedIn and Twitter at Illumio, and if you like today's conversation, you can find our other episodes wherever you get your podcasts. I'm your host Raghu Nandakumara, and we'll be back soon.