Teetering on the Precipice: How We Can Save Kids from a Career in Cybercrime

You have a round of applause. >> Oh, applause. If you don't applause at the end, I know it's been a disaster. So, it's downhill from here. Uh, it's really really great to be back at Bides. Um, actually, in the, uh, advert for this talk, it said I was a sector specialist. Uh, that is a total lie. So, uh, I have no credibility to stand up here, particularly at Bsides. So, I'm not technical. I'm not a hacker. I've never worked in cyber security. So, actually even like half of you guys. Yeah. No, but like uh we do a lot of presentations. I always say when I come to Bides anywhere in the world, it's the toughest crowd uh because you

guys are the real real hackers in the world. So, uh thank you for the invitation. Uh and it's a real uh privilege and pleasure to be here. I bribed a lot of people at the bar with some stickers uh to say that if you want to if you want to talk about saving kids from cyber crime um come and come and listen to our little chat. I'm going to spend uh about 30 35 minutes talking to you about what myself and my co-founder Dan Deer who comes from Amsterdam uh what we've been doing for the last couple of years. Um we met because he asked me if I wanted to invest in cyber security. Don has been in cyber security

for 25 years. set up and sold a bunch of different businesses. And so I came over to learn and I walked into a room with six hackers. I think Hugo was actually on the phone and 3 hours later I walked out terrified and I got on a plane from Amsterdam to Zurich that afternoon and it's actually one of the most beautiful flights you can take because you fly over the Alps and everyone's got their noses against the window and it's like oh toblone but in 5D and there was just me sitting on the other side of the plane filled with parental paranoia just riding this thing going [ __ ] WHAT'S HAPPENING TO THE KIDS?

Why are they being groomed by the bad guys off gaming platforms? And why is no one doing anything about it? I landed. I called Dan and I said, "I think we're going to go from friends to co-founders because I think we need to solve the problem." And that's the mission that we're on. Our mission is to create a generation of ethical hackers to make the world safer. And the reason why we're doing that are reasons that you guys will know about. So, uh, just this year alone, the global cost of cyber crime is, uh, predicted to be $10.5 trillion. $10.5 trillion. That's the global cost of COVID, according to the IMF. In two years time, they think it's going to be

$24 trillion. That seems like an impossible number. If that is true, that is the GDP of the United States. And obviously, last year it was$8 trillion. So, we know that the rise of cyber crime is a real problem. But I think what's really really scary is who are the bad guys? And of course, we all talk about Iran and Russia and and China and uh North Korea and all of that is true. And we also talk about the organized cyber gangs out of South America, South Asia, Eastern Europe, and Africa. Also, that is true. But what the data shows is that the vast majority of the people committing the crime are children. In fact, Europole published a report

where they interviewed 14,000 teenagers across Europe and the UK. 69% of them have committed a cyber crime or a gross cyber misdemeanor. 69%. The FBI who sit on our advisory board will tell you that the average age of someone that they arrest for serious crime is 37 years old. But the average age of someone there at risk for cyber crime is 19 years old. And in fact, if you just look at the media, you can see that it's a really big social issue. None of these stories are new to you guys, but for example, the guy who was arrested as the head of Lapsis, I'm not sure anyone really believes he was the head of Lapsis, was

an 18-year-old autistic kid from Oxford in the UK. the Marks and Spencers and Co-op and Harros, which are the biggest retailers in the UK, they were hacked about four months ago. It cost a billion dollars of enterprise value. The four people arrested for that hack by the National Crime Agency was 17 years old, 19 years old, and two 20 year olds. The uh hack on uh the uh government ministries in the Hague just a month ago was run by two Dutch teenagers who were recruited by Russian intelligence off uh off Telegram. So what you're seeing is the age profile of the cyber criminal gangs today is increasingly young. It is thought that Scattered Spider are also

behind the Jaguar Land Rover hack that has cost Jaguar Land Rover $2.2 billion. It's put 140 businesses in uh liquidation and the UK government has now bailed out a foreignowned company try to put that together uh for 1.5 billion pounds. So the impact of this youth cyber crime is really really for real and it's a problem that we are trying to understand where it comes from and what the entry point is. We feel like this generation is at an ethical fork in the road. They're either going to be a real liability to society, but they could also be a real asset. And so when we look into understanding who they are, what's super clear is that every

hacker is a gamer. In fact, I sat with uh Jeff Man, whom some of you may know, but he's the founder of the NSA's red teaming. And Jeff in the US is one of the godfathers of Bides. He's an amazing guy. And I said, "Well, Jeff, you must be super technical, right? because you know you're like one of the old school hackers. And he was like, "No, I'm not technical. Of course, you need some technical skills, but they change every year. What you need is puzzle logic. You need pattern identification. You need to be able to see things other people don't see and solve things in a way that other people can't solve." And the way he

learned to do that was sitting with his dad in probably, sorry Jeff, the 1960s doing wooden puzzles and metal puzzles and playing chess and playing turn-based games and developing his puzzle logic that way. And in his mind, every single hacker is a gamer. And actually, you just have to go back to history. If you look in the 1930s during the Second World War, Winston Churchill from the UK, he saw two ways to try to win the war. Get the Americans involved. We kind of might regret that at the moment, but get the Americans involved. And the second way was to solve the Enigma code. And the Enigma code was the telecoms system, signal system the Germans were

using to have the Ubot to attack the merchant navy ships, which is all the supplies around the ocean. So what Churchill did is he went to Alan Turing who we were with his grandson actually two nights ago. We went to Alan Turing who was an autistic mathematician and said Alan we need corkcrew minds. We need the best corkcrew minds in our country who think differently who think atypically some would say diversely to solve problems. So what he did is he developed a cryptographic puzzle and he put that cryptographic puzzle in the newspaper and he said if you can solve this puzzle you get an interview at Bletchley Park and the puzzles were solved and the people were hired were

predominantly neurodeiverse autistic Polish women and this was the crew that he put together to crack the Enigma code. So there is history to show that if you understand the gaming mindset and how people game and how people think and how people solve puzzles and you look for those corkcrew minds, the people who think differently, the atypicals, then you can identify what a future hacker really looks like. And what that means today is that the next wave of hackers and cyber talent are gamers. I want to show you this kid. He's one of the founders of our youth community. Uh Dylan uh when he was 12 years old during COVID, his high school wouldn't let him

use um uh Teams. So all of their friends were at home on their own going crazy. There was no social interaction. We all have a bit of PTSD off the back of that. And so what Dylan decided to do was to hack Microsoft. They're not a sponsor, are they? That's always a bit embarrassing if they're a sponsor. No, they're not on. They should be though. Uh we should call them. So, uh, he hacked Microsoft and he opened up Teams for 2 and a half weeks for his school friends so that they could all socialize. It actually spread like wildfire across the US. All the teenagers in all of the high schools got hold of it and started using it. He got

pulled by the FBI after two and a half weeks and they referred the case to Microsoft and they said, "What do you want to do? You want us to prosecute this kid?" But to their great credit, they didn't prosecute him. They gave him a job. And last year at um Black Hat in in Vegas, Dylan won bug bounty of the year at Microsoft. We think he earned about $300,000 last year from Microsoft legitimately for a specialist program just for his talent and abilities. And he developed all of his talent and abilities by learning how to hack computer games. So there is a whole wave of gamers out there who have got talent. And in fact, there are 3.2 billion

gamers in the planet. Just to put that into perspective, there are 3.5 billion football fans, 93% of Gen Z game. And when you look at how they spend their time every day, what you'll see is that they spend 30 minutes a day on Snapchat, 50 minutes a day on Tik Tok, 114 minutes a day gaming. In fact, the Times in the UK published a report last month that said British male teenagers are spending more time gaming than they are doing their homework. And of course, what happens is the school thinks a corkcrew minded neurodeiverse teenager who is spending all their time gaming, they think they've checked out of school and they're dumb. But the reality is they're

smarter than their computer science teacher. They know more than their math teacher. They find it completely boring and pointless. And the parents, they think that Dylan is just wasting his time playing computer games in his bedroom. Why are you playing Fortnite, Dylan? But what they don't understand is like a live laboratory for skills development. And so this talent is unidentified and unseen and missed. Unfortunately, the only guys who have worked out about this rich vein of talent are the bad guys. The bad guys have identified that they can identify young kids who are developing their skills from the age of 11 years old and they can recruit them as hackers into their community. In fact, in 2024,

132,000 kids were groomed by cyber gangs through gaming platforms. It's a 30% year-on-year spike. And that's because the kids are motivated. And the use case would be my son Rafa. Rafa is 11 years old and he plays Roblox like 79 million other kids a day. Just to put that in perspective, the most watched bit of TV in the world that happens once a year is the Super Bowl, which is four hours of painful, patient, it's a hard watch, and there's 120 million people watching it. So, one and a half days of Roblox, not even a day of Minecraft, which is 140 million people a day. And so, what you take my son Rafa, he plays Roblox. He'll

come up to me and go, "Dad, can I have 10 Robux to buy some stuff in the game?" And because I'm a perfect parent like everyone else here, I will say no. And what he will do is he'll find a way. YouTube will teach him how to hack hack the game. Google will give him the tools. The Discord will find him a community. And he'll put his skills to work. And when he starts hacking the games and securing what he wants, he starts to get noticed. And if he's really good, he starts to develop modification software. And if I asked a question here, which I did to 300 kids in Manchester on Tuesday, how many of

you create modification software? It was over 50% of the room. So when they do that, they're getting on the radar. They're getting identified by the gangs. It's like a cyber criminal GitHub and they can see the talent of these kids. And then what happens is they approach Rafa and they go, "Hey Rafa, you want to earn some Bitcoin? Why don't you come over to this Discord community and we'll put it together?" We have a uh 12-year-old kid, or he was 12. He hacked Roblox and in one day he stole a bunch of tokens. It hadn't been released. He sold them on the secondary market. At 12 years old, he made $35,000 in a day. The next day he put that all into

Bitcoin and 18 months later he had a wallet with $400,000 in it. And his parents only He's nodding. He's like, "I wish my kid was like that." He maybe is. Uh the next day he went up to his parents. And the only reason they found out is because he said, "At what point should I start paying tax?" Which may be self- selecting in itself. By the way, the threshold for a minor is $6,000 if anyone's worried about what your kid's up to. So the thing is he's now part of our youth community and he's just finished an internship with us. He's now 15. He's now using his hacking skills for ethical hacking and that's a

sign of a a kid can go well. We've come across an 11-year-old with $14 million in his bank account in Oxford. And I remember his mom who was a lawyer saying, "I'm just really worried people are going to think Johnny's a criminal." I was like, "Well, I probably he's probably a criminal." There's an eight-year-old we've come across who's got $4 million in a bank account. There is a kid famously in the Netherlands who eight years old ordered an AK-47 to be delivered to his nice Bloomandal suburban home. So the reality is and you guys will know that story already. So the reality is these kids are like are super highly active. So how do we uh how do we help them? How do we

direct them away from this journey? This journey is actually developed by the National Crime Agency in the UK and done the Politi technique. Is that how I say it? Politi the high-tech crime unit in the Netherlands. Um the Dutch are actually top three in the world for policing cyber crime. Uh that's partly because you also have the top three cyber criminals in the world but you have amazing talent. Fansen Valta these guys the police force are really amazing. They developed this uh this view of the cyber criminal pathway. So kids are basically start gaming on platforms on on on tablets very young. If you go to your local pizza restaurant you'll see the kids are like faceplanted

at 5 years old into the iPad. When I was their age, I was just faceplanted into the pasta, but they've kind of moved on. Uh, and they and they develop into playing uh challenging and strategic games, and that's fine. Then they start to choose which kind of games are really interested in, and that tells you a lot about a kid. If you play Eve Online, you're into really long-term strategic games. If you're playing Call of Duty, you're into games which you can blow [ __ ] up, but they all tell you a little bit about your your character type. Then, of course, they start getting rewarded. When they're getting rewarded, it feels tangible. And these kids are

winners, right? They're really good. They're often neurodeiverse and autistic. They're better than the neurotypical idiots like me. And so they really get rewarded fast. And that's when they start to think, "Wow, this is great." And then they start getting scammed. You can speak to any single kid. Have you been Have you been hacked or scammed on Roblox? Have you been hacked or scammed on Minecraft? It's a uniform 100% yes. And right now it's brain rots and 6767 chaos is exactly where where it's all happening. And the interesting thing is once you get scammed, you want to know how to scam. And that's the road that leads you in to the uh the hacking chat rooms and then

into the dark web. I'll give you a life and story of that. One of our community members is called Ricky Hanel Schumaca. He was a an American. He's not your atypical actually. He was an American baseball star. Uh 15 years old. He was top 10 in America at baseball. He was on a pathway to a college scholarship and then ultimately into the MLB. And he was playing Halo. and uh he got cut off, you know, he he got doxed um or dodoed by his competitor. He got lost kicked out of the tournament and he was furious. He was so mad. So what he did is he went online to find out how he did it. He's a

bright kid. So he found out how to do it and he worked out that you could hack into someone's account and sever their connectivity. So he started doing it and he found in some online community forums and he was actually really good at it and someone tapped him on the shoulder and said, "Hey Ricky, did you know that if you can do that, you can also hack into people's crypto wallets and crypto accounts?" And for him that was just an extension of like messing about online. So he started doing that. And fast forward eight years, he went to jail for a $15 million cry crypto heist. He went to jail for four years and he came out

in November. And when I did a podcast with Ricky, I asked the typical stupid like middle-aged father's question, which was like, "How was it in jail?" And what he said is, "Well, I'm not one of them." It's really interesting. I'm not one of them. He goes, "I've lived with criminals in jail for four years. I know I'm not a criminal like you like those guys. I was a kid who didn't understand the consequences and no one managed me. No one stopped me. And I never had to stab someone to steal their money. I was just [ __ ] around and it was really lucrative. I didn't even buy anything with my money." And that is the

journey that these kids can fall very quickly into the underbelly. So what can we learn then about what a kid is doing online? How can we intercede and help them? Well, you can learn a lot about the games that people play. Tells you a lot about their personalities. So here are um six pieces. What I'm showing you here is the output of research we did with two universities in the UK, Roampton and Abetate University uh to understand the skill sets sorry that you can see the skill sets from gaming that correlate into cyber. The first thing is you can learn someone's mindset and motivation by the games they play. So if you like things that go boom like Call of Duty,

uh that's destructive. So you like highintensity short burst excitement. Um if you're more of a social person, like to play the Nintendo world than Pokemon stuff, uh that's competition, but it's very community orientated. Uh if you like playing uh games like EFC or what used to be FIFA, uh then you're into the mastery of it, taking one thing, getting really deep at it. Um, if you are into any of the immersion games, the fantasy games, so Zelda type stuff, League of Legends type stuff, then you're into like long-term stories. And actually, I think the best ones to get someone to read of is if you're into Minecraft and Roblox and you're seeing kids creating worlds. So, if you are familiar with

Brain Rots, I I forgive you because it's really frustrating. But, uh, any kid under the age of 13 is obsessed. Uh, 11 million kids a day playing that game. that was created by like a 22-year-old Brazilian Italian kid in Sa Paulo who just loved creating worlds on Roblox. So, you know, that really tells you a sign of their mindset. So, you can see what people's motivations are just by the games that they play. But then what's really interesting as an industry, what we do is we create lots of competitions, don't we? When I say we, as you know, I'm a a complete charlatan, but uh but we create a load of competitions to evaluate people's

skill sets. And these are competitions that you guys will be really familiar with. So, uh, the capture the flags, sorry about the lines, the capture the flags are testing, you know, vulnerability hunting, logic, and puzzles, but actually there's a whole load of recreational games that kids are playing, young people are playing that also test similar um similar mindsets. So, puzzle games and stealth missions. You know, we create red team attack challenges and that test exploitation, stealth, and persistence, but that so do infiltration games and rogike games. Purple team exercises test strategy adaptation and adversarial, but so do competitive PVPs and arena esports and policy and war games. And this is what the military have been doing for like 50

years. What they're trying to do is test strategy, diplomacy, and risk trade-offs. But so do turn-based strategy games, really long-term turn-based strategy games. So actually, you can look at it what someone is doing in gaming and start to understand what kind of skill sets they're developing because what we know about the industry is there are 4.8 8 million unfilled jobs supposedly, right? 4.8 million unfilled jobs. But what everyone will tell you is you can't get a job as a young person. And the main reason is a you haven't got a compliance certificate which costs, you know, 500 to a,000 euros to get, but b because you don't have quotes real world experience. But actually, if you

understand what these kids are doing in the gaming environments, you realize they've been developing real world experience for quite a long time. We're just measuring the wrong items. So gaming in itself is already developing the right skill sets, but we wanted to go a little bit of a step further. So what we did is we said, okay, there's gaming and there's cheat code using that's going to tell you some stuff, but what's the gaming GitHub? Like what's the equivalent when you can really identify someone's cyber skill sets based on what they're actually the software they're building? And that's when you get into the mods and modification software world. And I'm sure a whole load of you are in it. A

whole load of you have developed your own skills in that space. But we did an analysis and we said well let's look at the techniques in modding and let's work out what the descriptions are and let's see what the correlation is to what you might do in cyber security because if the hypothesis is a kid a kid doesn't know anything until they've done like three years at BAE systems maybe that's not right. Maybe they're already developing those skills. We're just not evaluating them in the right way. So you can see the the the content up here, but just to pick a couple ones. You know, the probably the most used modification after just uh dosing people is creating

aimbots. And as you well know, there's [ __ ] aim bots I might make and then there's going to be amazing aimbots that you might make. There's different gradations of it. And for those that don't know, but I really feel like you guys all know, but you know, if if the two of us are playing uh Call of Duty together, I have to aim at you and shoot you, and I may or may not get you. Uh but because you're really smart and you've created a namebot, it does it automatically and takes me out. So you win, I lose, I go home and cry and you move on to the next to the next level.

But interestingly, in developing an aimbot, that is memory manipulation. That is the same as uh memory injections and malware hooks. And as you can see by the analysis here, we've really looked down and actually this is just a small snapshot of it. We really looked down at all the gaming modification behaviors and skill sets and understood how they can correlate to cyber security skill sets. And if you take the assumption that the overlap between a gamer and a hacker is 100%. And if you take the assumption that um you can develop skill sets in gaming and software techniques in gaming and particularly if you are corkcrew minded neurodeiverse kind of off the grid not fitting into that the

system. This is actually the greatest talent identifier that you can imagine for the next wave of Gen Z hackers. We've tested this. We put now hundreds and hundreds and hundreds of of young people aged 12 to 25 through this program to correlate like are those skills attributable enough and our uh CPO is actually the former CISO of Cognizant of Verizon and and he's for 10 years has been hiring people out of the subterranean gaming sector based on these modification skills. So, we know we know it works and and we're pretty excited about what this means for like the next wave of youngsters who right now often, like I said, we're in Manchester on Tuesday. We're in a really

really poor part of Manchester with kids who really are given no hope. Like, forget about university. It's just completely not even a conversation for them. You know, maybe it's getting to 16, possibly an apprenticeship. The only thing that got the thing they really do in their lives is gaming and walking the streets. The schools can't help them. and the parents are often doing shift work, so they don't have time for the kids. The kids think there is no option. But when we sit there and put them through an evaluation and say, "Hey, look, holy shoot, you've got amazing skills here that you think you're just doing on Call of Duty aimbot creations and making your, you know, £500 a month

and selling your modification software. Actually, you've got great potential." And that's where you see their eyes light up and you see that there's a new pathway for them for having legitimate legitimate jobs. And if you buy the theory, then actually the scale of this is insane, right? 3.2 billion gamers. If we could get 1%, if we can find 1% of that community who are creating modification software, are cheating really, really well, and have developed their skills, we're talking about a potential workforce of 32 million. 32 million. There's 4.8 million unfilled jobs at the moment. And the problem is no one's talking to them. No one's talking to them at moment. The the issue is this is that the industry is this old

guy over here. The industry is this guy going, "Oh, you got to go to university and you got to have government compliance certificates and you got to do a billion years work experience as a sock analyst. And if you're still breathing, maybe we'll give you an entry-level job." And guess what? It's not working because the companies are getting hacked every day. It's a [ __ ] show out there. There is the the best talent that make it through that system are so resilient and have had moments of fortune. But there's an amazing set of talent that is not even entering that system. We had uh Beer Skylab, she's one of the founders of our youth community.

She created the girls who hack platform when she was 11. It's a safe space for female hackers. She's now 18. And I was in America with her and there was a room full of like balding middle-aged white male consultants. And we Yeah, but they were ugly and you know you are Yeah, that's true. You know, and uh and they were being very like boomer about the whole thing and they were like, "We haven't got a problem with talent." And she said, "Okay, well, you are irrelevant to me. Your generation is irrelevant. Your industry is irrelevant. The language you use is irrelevant. You don't talk to me. You don't inspire me. You don't make me feel like there's a career opportunity

for me in cyber security." And that that is a problem. So we need to be less like this guy and more understanding what the talent's actually doing to build their skill sets to understand that gaming is a live laboratory for skill set development and start to speak to them in their language. And here's how we're trying to solve the problem. So we have built Haptai the hacking aptitude AI platform. What that does is build a hacking aptitude profile of young people. At the moment it's 16 for various safeguarding reasons. because we don't haven't quite gone younger yet, but for 16 to 27 year olds and we don't look at their LinkedIn because they're not on it. And we don't look at résumés

because if they do have a resume, it's written by chat GBT and it's going to be read by ChatGBT and then it's just like two ghosts talking to each other. So what we do is we look at their gaming behavior. We look at their psychometrics. We took a professor of psychology from clinical psychology from Oxford University to build a map, a mapping system that can identify the levels of neurodeiversity, the types of character and how they make decisions and then we look at their performative uh performances in games as well as their modification software they're building so that we can build a full hapti profile of them. We've run hundreds of young people through this

and I've got to say the buyin has been awesome. So I'm just going to show you a couple of examples um to see how we're approaching it. So, first of all, our interface, as you can see, is a terminal. Like, we want to be miles away from the word career. We want to be miles away from mom and dad and schools and universities. We want to be firmly in gaming logic. It's prompt based. So, that's already a natural filter uh for the kind of mindsets we're looking for. And what we're doing is we're we're saying, hey, at the top, you're going to see here nine personas. These are nine personas that are clinically psycho psychologically put together for the

type of hacker that you might be. Some will be exploiters, some will be manipulators, some will be defenders, some will be fixers, alchemists, executives, strategists, and that is all your actual character type. There's no right or wrong, but not every hacker is the same. And if you can understand someone's personality and motivations, remember that slide I showed you about the games that people play, you can understand how they're going to address problems. So we help them understand which one of these profiles they are. And then here you can see their progress through our platform, the games that they've uploaded, the projects uh that they've done, and the challenges that they've gone through. So they can see

their progress as they build their hacking aptitude profile. And here's all the journey that we take them through. It's all prompt based. And this is the bit that they get really excited about. It's so cool when you put this in front of teams and you're like, "Pick your games. Which games are you playing?" We've now profiled about 170 of of the most popular games in the world, but up to really like obscure ones as well, as well as the ones that are that are kind of AAA Hollywood produced game um by game studios. And what they do is they select their game. They select the game that they play. And already that is pre predispositioning them for us to

understand what kind of mind they are. And once they've select their game, we start to ask them questions here about how they play the game. So in this case, Cara has said she's playing Fortnite. So, we say, "Do you prefer playing in a team or do you prefer playing solo?" And she goes, "Well, I really like playing team mode." Okay, that's already a decision. And then we go, "Um, for both Fortnite and Valerin, what role do you enjoy playing on the team and why?" And she responds, "I like playing support, offering suppressive fire from a distance and monitoring the field to gather information." She's probably not going to write that exact language, but I I appreciate it, but you get the

point. And so, now we know that she's someone in the support staff. She's not the someone who's running off fully aggressive. And then we go, "Do you prefer playing offensive or defensive?" And she goes, "Well, I don't really know." And she goes, "That's okay." And all of this is building a psychographic model of the kind of mindset that she has. And then we go into the bit that we thought they wouldn't answer. Hey, do you cheat? Are you a cheater? Oh my god. That when I was playing Monopoly as a kid, we all accused each other of cheating. We never cheated. No, no, no, no. Not me. The money. No, I didn't steal that from the bank. These guys

cannot wait to tell you what they're doing cheating. They think that's a bone of like a like a moment of pride. And so we asked them, here you can see uh have you ever made a mod for a game? Yes or no. Have you ever cheated at a video game? Have you ever created a exch for a for a game? Do you consider yourself a speedrunner? A really big telltel sign. Have you ever used a mod? So what happens is they start answering these questions and we're building a psychographic profile of them. And then we ask them to upload any vulnerability disclosures or any modification softwares. It's like the GitHub bit so we can assess it. And then this is where

it becomes really cool. Then they see their profile. Their profile as a teen gamer with potential skills for the future. Not their profile as a school graduate ticking all the boxes of why they learned medieval history that no one cares about. So what you have here is in this case this individual has got three lead characteristics. Executtor supported by being core and defender. That that's her profile. So the executive highlights her ability to thrive in high press pressure scenarios. That's why she's playing Fortnite. She makes swift decisions and maintains control against chaos. So you know what kind of environment that she's going to thrive in. The summary here is that she is a uh sorry then down here what you'll

see is a map. If anyone's played FIFA or uh international superstar soccer ISS, you'll really recognize this mapping of behaviors. But we've mapped it against cognitive behavioral human social and technical. So, we're using the language that she understands and mapping how her her her character looks at. And then we go, well, let's look at your aptitudes. Well, you're really strong at systems thinking and improvisation. You're pretty good at crisis decision-m, adversarial simulation, and pattern recognition. But here's like what you suck at. So, like, don't apply for a career where you're going to have to use protocol tinkering, curiosity, tribe dynamics awareness, continuous tinkering, or anomaly spotting. I actually don't even understand half of those things. But but

what you're doing is you're building a picture for her of what world she's going to suit in. And then you can give her this the summary. The candidates's profile is characterized by a strong alignment with the ex executive persona, excelling in systems thinking and improvisation, which are crucial for navigating complex and high stakes environments. Their cognitive strengths are complemented by behavioral adaptability, making them a versatile and effective operator in dynamic scenarios. So we're helping them understand their own their own profile and that then enables us to say well hey this is the kind of stuff in cyber that you can do. First of all they never even heard of cyber remember it's irrelevant to them but what we're doing is helping

them map their career path. So in this case we're saying hey you're most suited to be a red team operator and a sock analyst and an incident response handler. So here is a career path that you can have based on your gaming behaviors but by the way you would be the worst cyber security analyst. do not apply for that job. You will not enjoy it. Um, you'll be mid to low a capable as a social engineering pentester and you'd be okay as a devops engineer. But this is this is where your persona and your skill sets are well suited for. And then we can start to map you for what roles are that you would apply and what

your dimensions are. So this is the role and then this is your personality match. so that ultimately this candidate can start to see that there is a career path for them based on what they've done in gaming and uh and and modding and hacking. So, and then we we we break it all down. So, so this product uh at the moment is being rolled out across the UK, across Saudi Arabia, across the Balkans. Uh we have 20,000 kids running through it in the UK right now, 42,000 in Saudi Arabia. It should be about 50,000 in the Balkans. um going through the schools through the governments trying to capture particularly the kind of uh the the part of society that

doesn't have a pathway you know not the kind of affluent middle-ass kid who lives in Blumenal who's going to go to UVA you know they've got a path probably you know uh but but what about the ones who don't and that's why the governments are taking it through into into their into their platforms so I guess the question is how do you get them to think it's cool how do we engage them uh what we know is that you can't talk to this generation like a parent or a school or law enforcement or a government or to be honest most cyber security companies. You have to speak to them in the language that they understand. Popular

culture, content, social media, influencer competition gaming esports. So, we have a full media ecosystem. Um we're so happy to be participating in so many bides. Um that's been such an awesome experience. um every time. Uh Beer is the chairwoman of um the um Defcon nextgen workstream. So we get loads of brilliant young talent coming through um Defcon. Uh in the UK we have this cyber first program. It's a government funded program to identify hackers at the age of 14 and and and sponsor them through uh high school, college, and university. Uh we have our own social media guys. So our young hackers make content all the time. I'm not allowed to see it. They just

publish it. Uh they do it on the iPhone. and there's no money. The last one, I think earlier this week, got three million views. Like, I don't understand any of it. Uh, but that is about Gen Z talking to Gen Z in the language they understand, demystifying cyber and taking the piss out of the middle-aged white guy, which actually they did the other day. I didn't realize that they put an um uh when I grew up, we used to gather around music festivals. When I lived in Amsterdam, we still do that as like middle-aged people. Hey, Don. And, uh, but this generation, they're gathering around esports. 550 million kids follow esports a year. Uh I'm so happy to say

that uh tomorrow we're making an announcement that we'll be launching the first ever ethical hacking esports format. We're doing it in partnership with the um UK esports federation, the global esports federation and the savvy gaming group. Uh just to put that in perspective, the esports world cup this year had two billion streams in two billion streams in over an 8week period. So uh we just hired uh the CEO of David Beckham's esports team has come to run our esports. Uh so that is really the way to activate hacking in a kind of cool popular cultural context. And then we have a load of um can't talk too much about it but kind of TV shows and films

and stuff coming out to create a popular cultural narrative about ethical hacking. Make it cool and aspirational instead of making it always seen as criminal. Um for you guys here there's a bunch of our virtue members already. Hugo is a is a member. Thanks Hugo. We love that. Um we have a community now of about 300 we think of the world's most influential um ethical hackers ranging from Marcus Hutchkins to Chris Weissopal to uh Astred Usammans Barry uh you know the lots of people you guys will know in the Netherlands um they do stuff all the time they we put them on documentaries we put them on TV shows all over the world on news channels and they're all

banging the drum for doing the right thing for this young generation. So if you guys want to be part of that, if you want to contribute your voice and your intelligence to this um community, please please come and join us. It's it's unbelievably exciting place to be. Um and then we have the the real stars. These are the four members of our founding members of our youth community. Beer, I spoke about uh Dylan I spoke about. Cole, he hangs out um hacking back to all the scam centers in India. That's what he does in his free time. uh and you're walking into his room and there'll be some middle-aged guy in Delhi crying on the phone trying to

explain why he keeps ripping off pensioners in Florida. Um that that's what he does in his spare time. Uh but this kid, if there's one name for you to remember here, is Marco Liberal. He is the most generational savant in the world. I think when Marco was two years old, he kept taking stuff out of the cupboards and his mom Katarina was going crazy. So she put padlocks on the cupboards. She came downstairs and he had lockpicked the padlocks. At three years old, he wrote his first code. At five years old, he wrote his first malware. At 11 years old, he keynoted at Black Hat Middle East. He's now 15 and he is teaching computer

science postgrads at the King Abdullah Science and Technology University in Jeda. It's the most funded university in the planet for technology. He's teaching them cyber security. This boy is an absolute savant. He is unbelievably autistic. He's so autistic. And the real hero behind Marco is his mom, Katarina, because she saw that this boy needed to live a different life. He was the most corkcrew of corkcrew minds. She took him out of school. She said, "That's not going to work." She committed her life to creating what I can only describe as a platform for this kid to shine. When many people would have tried to be embarrassed about their kid or said he's a problem, she said, "He's the most

amazing talent." and she's created this world for him where elevating him on a daily basis. He is now part of the Saudi government advising them on their cyber security talent development program. This guy is the exact prototype of when a kid is backed and spotted and given a pathway he can have an outsized impact on the planet. And I'm so proud that he's part of our our founding group. And if you are at Black Hat Riad uh in two weeks time, he's keynoting again. Um and he's a really cool cat. So that's it guys. What we want to do is change this cycle. This is all cool, but this was crime. So now we want this all to be

cool and we want this to be careers. And if we can do our job and identify the most exciting talent through what they're doing in gaming platforms and put the spotlight on them and give them a direction into the industry, we can create a generation of ethical hackers to make the world safer, which is going to benefit society. It's going to benefit businesses. It's going to benefit jobs and governments. And in the end, we can all go to bed sleeping that bit easier. Thank you very much for your time.