HG - Startup Security Leadership: Lessons to Level Up from Fortune 100 to Tech Startup - Ty Sbano

so here we are afternoon of higher ground I hate to say it our last session yes we're bringing it in we're bringing in so several times throughout the program people have sort of said I want to move from you know being in a big company to some kind of tech startup or I want to do something that's a little risky or something a little different for my career and so I was really excited when ty submitted this talk to really talk about hey you know it's okay to take that risk it's okay to sort of jump to the next level and I'm really excited that tech ty is going to share what that process is all about so let's

give it up for time thank you guys playing super warm intro I'm gonna talk a little bit about myself as a human being in this process it's a lot of storytelling it's not going to be technical it will be littered with swear words if you're offended with cursing if you're from a certain part of the US and it's cussing leave the room now I'm not that filtered so let's get into it so the whole idea behind this and the inspiration was my career and a big part of who I am I'm not gonna read all this [ __ ] to you but at the same time from a background standpoint education certificates like all these [ __ ]

things led me to an idea and the idea was I really like security I found out at an early stage at a small consulting place that I wanted to be in FinTech and through my journey at JPMorgan Chase rolling like one of the very first static analysis engines ounce labs before as confirmed by IBM - Capital One and rolling out and I know that's kind of a loaded term this week just with everything gone but I was there over five and a half years building applications security a red team all these functions but I also did some mergers and acquisitions and with it that was when I had a moment in my life to really determine well it seems

coolest [ __ ] when we acquire these companies where it's 10 to 20 people or maybe 30 people and they've been on this awesome journey together they're not mired with the quagmire of the OCC the FFIEC the SEC name another few letter acronym does not have their [ __ ] together and ask the same questions when you work at certain organizations maybe and I'm not gonna say it's like this is how it is but maybe you get to a point where all you do is manage people because you have a director title and maybe you talk to a bunch of people and all you do is no more hands on keyboard and you just make

powerpoints like these and sometimes that's the case sometimes it's not I have a little bit of joy because I've been beaten up a lot by creating a lot of storytelling decks and for me this is a part of who I am now so I really appreciate everything from that company but a big part of it was seeing all these cool startups come get acquired cash out go do their thing and then they started over again with a new idea and this mentality of anything's possible versus I work at these environments where I'm like hey guys let's talk about what's not possible this week launching every AWS instance leaving the SS three containers open where the [ __ ] you want

to do it and then kind of doing that quagmire of security but at scale it gets tough so I made the decision then I'm like yeah I want to start ramping down and I [ __ ] up and I went over to Target and that was 400,000 people and I was told I was going to be an individual contributor and the next thing you know I'm managing 37 people around the world building a team of 47 and I'm like why did I do this I stay there exactly 365 days started working towards getting out of where I was and going more towards I see so I ended up in SF at a company called Lending Club started wearing

multiple hats in the Bay Area and just got the confidence to jumping in this thing called periscope data and we were just acquired about three months ago not a cache exit I'm not done yet but at the same time I'm a security dude for some amazing founders in a great culture and that's a part of this discussion those lessons learned that I've taken from all this other [ __ ] and have been able to be successful to build a team to get budget to have trust in to enable the business so as we go through I think I have I don't know 23 minutes left and a big part of it is this is the last talk so

maybe I can go over but likely if we wrap I'm happy to chat more in person and that's more my engagement style than like this so I want to start with this term icky guy I didn't really talk about me as a human being you just saw my resume basically and that's not a good representation of me I'm half Japanese half American but I'm 100% American and what I mean by that is I'm part of this melting pot that that has been granted an opportunity in this wonderful country mired by all this other [ __ ] that I know a lot of people are very upset by but if you've been around the world as a military brat or

in other countries you come to really appreciate the things you get to do the difference is you get to making the impact you get to have but there's a term here iki got that it just doesn't translate well it translates like [ __ ] and it's really I'm not going to draw a Venn diagram but it's this Venn diagram it's like what you're good at what you're passionate about what the world needs and what you can get paid for they're right in the [ __ ] middle that should be the thing you should be doing if you're working at some job and making these powerpoints you're like why do I [ __ ] hate my life why am i

sitting through this goddamn breach in this other breach and trying to convince everyone else this is a breach and the lawyers are telling me hey a botnet is not a breach I'm like logged it to the count so is that a breach because I think that's a breach like and those are things where if you're wasting your energy and life don't do it because there are other options out there my point for this this figure out what the thing is that drives you for me it is a 100 site information security mostly a PIM product security but now the larger mindset the cultural shift I think that's a big element so if you want to

learn more about this search it but again you chat with me as well so let's start thinking about this like the planning for the move I mentioned I was at Capital One I got this [ __ ] bright idea but I also have this thing called a development action plan most folks have a five-year plan of like what they want to do and they're like this is cool I'm gonna just MIT's say some [ __ ] and never do it I'm a person that doesn't have time for people that say things but never gets it done the moment action plan actually cranks it down just a little bit you can give whatever time whatever stipulation I say

shoot for one to two years I say shoot for three top-level goals have a whole ton of micro goals ten to twelve under each one and just start checking these boxes and not only is it validating and feel but every six months when you go back and you check in or say you get a new boss at work and I've used this as a tool to help me expand my career every [ __ ] time they're like hey nice to meet you I'm your new boss I'm like cool here's Who I am show them this thing say here's where I need help here's where I want you to lean in here's what I'd like to do and if

there's nothing here that you can help me with just say everything's awesome and let me know when I'm [ __ ] it up and I will just make you look great right those are things where I think a development action plan is huge it's not your [ __ ] resume that says what I've done it's saying where I'm going what I'm going to do and you'll be surprised how many leaders will be like hey I got a friend that maybe at the startup they want to talk to you I'm like cool and that turns into an advisor role that turns into things were you build relationships and you get to do more things because you're just putting it

out there and stating a mission in a manifesto the next one no one loves talking about this jumping into a series B startup I took a 30 percent pay cut it was [ __ ] painful but at the same time I never let my lifestyle inflation outpace my expectation I will say taking a 15 hour flight to Israel and economy is pretty goddamn rough but at the same time that's part of the growth of the company I'm at now and I just have to roll with it as opposed to getting business-class Aviv mistake dinners every night eat steak news every night while you're here on vendors I highly recommend it but a big part of this make

sure you have enough cash in case there's that oh [ __ ] quarter that oh [ __ ] month and next thing you know you walk into a meeting room they're like hey you're one of our highest-paid employees I'm like but I'm not and I don't make that much just to be clear I'm very much underpaid like a lot of other people no well this could be your last day it's like all right be prepared to be confident and and what I mean by this is your financial buffer should be a thing that you're working your ass off in your career to save money and I'm not going to get into the whole financial freedom aspect of everything but have

enough confidence where if you didn't have a job tomorrow you will have a job tomorrow right in security right now like if you just have no job where you're at [ __ ] it I don't care what that means is you get into this enabler mindset where you can take on risk you can try all these things and you can actually present to the board and be like hey I just want to let you know it's [ __ ] up they're like oh well how's it so [ __ ] up I'm like you remember that cybersecurity tabletop we did we still haven't rolled out has your core bulb we still haven't done [ __ ]

social media training we I've done this and you can be very blunt and direct without having any personal attachment cuz you're like hey I like what I do I love work with y'all but at the same time I don't have to be here and in the moments where you have these hard discussions and I'll explain what a little bit later it gives you empowerment and that's what I mean by having that financial buffer is have the confidence to go in because if times are tough and you're like yeah I need a new raise and like sales aren't working half the team's bleed and out attrition is garbage you're not getting a raise and I highly recommend when you talk

about money it's before you join or before you get promoted other than that shut the [ __ ] up enjoy your money be cool the last one is your support network so the big one there with your financial buffer whoo my wife is my key stone that keeps me in able to do anything in life like putting on pants and these specific pants but at the same time having that conversation of like we're not gonna do X in the next couple of years we're not gonna do y I know you want a two carat diamond ring to replace that one about ten years ago and ain't gonna happen anytime soon sorry babe and then you deal with that

wrath but at the same time you need to have that support not only at home but in your actual professional network and that's why I love besides this is one of those environments where you meet all sorts of cool people because you didn't have to spend three G's to go to app thing and it's just snake oil in sales and you're just like I'm tired as opposed to here you should come get energy get inspired have good connections and this piece here the hard lesson for me going from a capital one to a target a lot of companies don't call you back when you're like hey I want to use your service they're like we're not able to sell for a deal less

than $50,000 I'm like I have $12,000 for this can you help me out you know you gotta like really hone in on the friends and the relationships so prepare for that shitty moment when you had all this power like I was 26 and I'm working out of a [ __ ] financial institution and they're trusting me with a two million run rate and a two million investment budget four billion dollars a year I don't have four million I don't know how did Rock four million but at the same time these are the things you get enabled but at the same time when you're dealing with the sales cycle of certain companies you're four million they want

all when your dude with like a quarter-million dollar security budget because you had to convince your organization and the board to do it you got to be very critical of how you spend money but at the same time you have to be critical because your options that you're investing to get there you want them to be worth something so you don't want to just spend money all over the place and ruin it for everyone on that journey so which startup you're like sounds great sign me up this goes back to that slide Ikki guy right what do you care about for me I've been working in all these security teams building out things we're top 10 financial becomes a top 500

security person organization needs to transform because all they did was a compliance hammer and how to create this thing called product security and all this other [ __ ] fun great the big problem I found in every security team there's a data problem how many people have a data leak but one person who Congrats today to swamp probably because you're like it's unstructured and I can't actually get to it I can't use any of this data one of the places I worked we built basically the company I work at it was cool for a little bit it was great we actually even built a mobile app or see sounds like we should sell this and I'm like I can't

work for this guy anymore because he's just gonna steal the Thunder I gotta go but the data problem within security teams is very real how do you translate the message of all this metrics and you can hear other talks on that but for me every [ __ ] place I worked and I want to make powerpoints I want to use tableau I just want to tell you any good here's why here are like our top three risks or here our top five like you want to review the 50 we can but that's a waste of time because you're not gonna prioritize [ __ ] out of that I'm gonna give you three I'm gonna go across three

and we'll work next so I think a big thing here when it comes to data for me the vertical is very simple I love security this company wants to pay me a lot less money to come do everything besides security what the interview is super critical if you're interviewing for a company and they're like hey I don't have a job description and I'm I like last three jobs I there was no description as a conversation it sounds great let's talk money interviews all this [ __ ] and we get there but in the interview process if you're going to a startup request that you meet the founders request that you meet with legal request that you meet with HR your

security person and you're not friends with these people good luck you have no constituents you have no fans you have no Champions inside that work if you go in and you meet with like engineering maybe there's like a person that's external on it that's kind of in the company but not really in the company so they're not fully there but they have options it's really weird you're not going to get the benefit of what is that company and how is the culture so when you unpack these things make sure you're working with good people make sure you're gonna be in the slog with people when shit's bad the quarter sucked and the marketing team just flipped and that's seven people

gone and you're resetting the cycle on it again you're willing to fight if you're not willing to do that don't [ __ ] join that startup go somewhere else because that commitment of maybe one year probably not five years maybe seven years probably but you have to be in this long-term mindset even though it's in this microcosm of every day must count every day has to be a result so when I think about interviewing make sure you have clarity around the people you're working for and what their expectations are the early versus late stage is a tough one I think if you're in a scenario where you're used to like a healthy paycheck and a bonus and

really great benefits and like 401k matching do a late stage and late stages like Series II there's F but it also means your options are gonna be like an okay bonus if things work out like if you joined lyft a year before the IPO tour uber before the app code you're gonna get something but it's not gonna be like when you join when they were disrupting the entire market right series a series B it's a bigger dice roll but you get to grow with the company keep that in mind that's gonna be fun as hell if you join a company like 1215 people it is and that's part of the interview right I joined a

company they're like we want to do this we don't know how to do it we're kind of doing some things

correct and again I think I had a very lucky experience so far I might not have a job after 30 more days and I'll explain why later but the early piece is rare but this is part of that network that's part of building this thing out of like what is the plan to get there you will find a lot of startups actually want security they don't know what the [ __ ] it means next so let's get started let's start with like [ __ ] grinding in this like startup we got the job we're there they set a bunch of [ __ ] but they have no idea what they actually want number one have an agile roadmap I have a lot

of friends that are from bigger companies they said ty' plan out your 3-year roadmap before you even get there I'm like I have no data I don't know a people I don't know who I want to piss off when I present this thing that's not how I roll show up knock some [ __ ] out for me it was gr compliance sock - you type - it's like check check kind of did those things they weren't that difficult as a security person but my ads will roadmap adjusted so every quarter it's like here is this clear crisp vision of like what we're gonna do I'm committing I'm gonna execute I don't have a team I'm gonna get the help of the rest of

the org to lean in and get this [ __ ] done because it's important otherwise maybe we get sued for gdpr maybe we don't I don't know I don't have data to back it up but I got to go run and get a bunch of [ __ ] done the next thing there is really building out that roadmap from okay your first 90 days are done likely that job interview was all they had the vision for what security is going to be now you got to tell them now you got to let everyone know using consistent language a framework something there will allow you to have that dialog for me this CSF the cybersecurity framework super easy to

use not that easy to bubble up in a pretty chart but at the same time you can just show like red yellow green here's how we're doing at the top four cool we have no ability to [ __ ] respond why not no one's ever thought about a response because we've never detected [ __ ] why did we detect [ __ ] like one thing you know and you have to go through those discussions to bring reality the intelligent risks this is back to make sure you have your financial buffer because you're going to roll the dice on some of these conversations we're like I'm gonna pull in the CEO because a third party just got popped

and I want to push a communication out to our customers because I believe their connections will break based on this message I've done the analysis with an engineer to find this specific ruby gem thanks Salesforce that they had a bad thing their security team basically captured everything in the URL and that include username and password but it was an old dated gem like this [ __ ] happens but at the same time your security team can be your biggest risk as well long story there I pull in the CEO to a room I Harry it ain't good what I see say is like I have 47 customers out of a thousand and I believe that on this date

Wednesday at this time based on this email that we received these customers probably also received it now what that means is if they fix it great they update their creds they update the job like we do all this work everything will be fine or we disclose this quickly we contact we use our see SMS we get ahead of it and we just say on the context of this is not a security incident for us this is more we want to make sure your functionality doesn't break and he's like ty what do you want to do and I'm like I want to communicate this [ __ ] now he's like sounds great and that was the

first time I had leverage outside support and I went to bat with a really not great scenario and I knew I had trust and I was building trust through these little battles to get to this larger war the next thing is that larger war when people bring you the stupidest [ __ ] like hey we have a flat network and there's nothing on it like why aren't we scanning it because it doesn't [ __ ] matter right if everything is cloud-based our SAS based or you rely on octa or you have like some VPN tunnel or you have maybe SSH that's done properly to your production environment your network might not matter one key example

for me is like everyone bitching about chromecast these chromecast I they're like unsecured like is this a problem like I want to be honest with you from an impact likelihood standpoint of me giving a [ __ ] this is very low and what I mean by this is like you have to physically be close or maybe you try to get to it based on our network and it somehow is exposed but like why am I going to spend more than three to seven seconds unpacking that No so that's what I mean like do you want to be known as the person with a brand that like hey you know what Tai did a great job he secured all our

chromecast's know you want to be the person that enabled every [ __ ] large deal because you're like eh or suck two's done oh they had questions I got in a [ __ ] call with their seaso and we agreed on all the red lines and the deal is done it was like wait how that happened I'm like you talk experts and then you push out the lawyer and things just get done right so you get these wins you think about what is the thing you're trying to be known for and what are you trying to do more to that you'll notice here at the bottom power point to a minimum storytelling to a max the Bay Area and

tech startups like no one wants to see slides but I had a great boss at one point in my career and an active mentor Brian warm he used to do this to me he did this is like Jedi mind trick he's like ty I want you to tell a story whatever [ __ ] presentation it was like hey I need static analysis hey I need to build this code review factory hey I need to do component analysis he's like I want you to tell a story and with that story if it happens to be PowerPoint that's okay if it's a whiteboard that's fine he's like but I'm not gonna tell you how to tell the story but ultimately he Jedi

had me in two hours making a goddamn PowerPoint it was very precise and brief but at the same time I've seen him do it - it's like future employees in life but a big part of it is some of your engineers don't want to see slides whiteboard when you wait board the SDLC and you say here's the software development lifecycle or here's DevOps I'm gonna go on a small rant stop saying SEC DevOps please if you take one thing away stop saying deaf SEC ops it's just DevOps quality is built into DevOps security as a subset of quality stop I kind of throw that in there now and then because I'm sick of this [ __ ]

and I know it's a marketing term no different than zero trust but at the same time be a part of the team be a part of the culture like I'm grinding with engineers looking at [ __ ] PRS I'm sitting there and having intelligent discussions because we went through a like a vulnerability to fix and then I can go to like a little sharing session that banja nears already doing I'm way here's time of use time of check and why it matters when it comes to like authorization and that turns into a lot of good conversation so next let's talk about like where these requirements came from why do you have a job I don't know

cuz I got lucky and someone called me one [ __ ] day and it was just the perfect time when I was sick of the [ __ ] no for me it was like it was this thing where they had no idea what they wanted they kind of heard some things reached out to me and I'm like you know and I'm tired as [ __ ] of my current role and I turned that page where I was open to new opportunities and it was just the perfect time so I got lucky but at the same time the origins of their security requirements for periscope it was customers customers want security they want assurance they want trust they

want confidence we're a data company and if we have all this data for data analytics and the data science lifecycle and show me how many data scientists redact or reduce or make things structure it or have any idea what's in the data Lake swamp let's call it a swamp still yeah whatever it is like every data science team you work with they want everything our platform enables that so I always have to be like you practice your hygiene everything's encrypted here here here here's all the things here's the native controls in AWS but for me the origin of where you're getting the drive is going to tell you a big part of that interview process if

they say it's we want good security we want to empower our customers to have a clean smooth cycle you probably sold you're gonna get a lot of wins but if they're like you know we really don't want to do security but you seem you seem alright like you don't want budget right like you don't want headcount you just want to like sit here and like we just want to put you on emails to say like we have a security person don't be that person I've got some friends that ended up in those roles and they're just sitting there and they're like how do I get budget I'm like storytelling like when was the last incident that you used

when was the last thing that mattered when was the last customer that they lost to a lead because you didn't have socked you type to or you didn't have [ __ ] hi so those are things that you have to generate as the business mindset the expected outcomes when we start getting into this what are you being measured by I think that's pretty simple if you want to talk kpi's k RS go somewhere else I don't talk that way I talk about like what is the thing that led to the business outcome and the continuous iteration for me this is taking feedback adjusting and rolling that so you can empower that business once again so let's switch I'm not going

to spend a ton of time on the culture of security but this comes back to the business model overall know what the goal is is it to sell is it to get users is it to get market share just be a part of that and don't be waiting at your desk or your shared space or whatever it is and hope that someone pulls you into the meeting go just be like how are we selling today what are the deals what are the things that matter how many users do we have how many bots do we have start injecting a lot of that thought process into the business model and then start really focusing and I put

sales enablement it's just purely enablement right we cover it up its enablement enable the culture enable the business be a person that's a not and no person this is just [ __ ] 12 years ago insecurity like I'm just gonna say it again be an enabler and that means someone that has a logical thought process to a contextual threat model if you're another person that says we don't want to be the next Capital One just because you use AWS it's not valid right think about your company think about your programming language think about our even in AWS right and you have to have these logical conversations if you're all GCP maybe you're not gonna be

that way but at the same time if you're a board asks we don't want to be that why'd that happen you're like I don't work there I don't have those details that's not us the things I care about is this environment this threat model this attack surface so iterate on that and really ground people when you start to educate them on it so I'm not going to spend a ton of time on training I think the previous person did a great talk with it I just want to just mention presence over Paul like over policy don't point back to the impose a policy unless you really need to but coaching is gonna get you a lot more wins when

you sit down with one engineer to do that thing to say I'm not gonna tell you to validate all inputs we're just gonna talk about the framework we're gonna start using consistent way to validate all inputs as opposed to like whack them all to death again I think this is pretty simple I hate CBTs most of you hate CBTs your engineers don't like CBT is either just as a reality check and if you go in without a contextually grounded thing like you're like we got to do epic we gave Oh wass top 10 I'm gonna go into a lot of rants on that one I'm gonna save them contextualize why if you go in and your

app SEC program starts with Olas top ten because PCI or something else you [ __ ] fail at app SEC I will not talk to you if you go in and say these are the things we care about because of the languages because of the frameworks because of how we deliver software and here's the thing if you don't deliver software and you outsource everything your app SEC program is in your contract language and I think those are things that you should think about before just rolling out shit-ass CBTs next staffing this one hit me pretty hard I was willing to take a 30 percent pay cut but [ __ ] none of my friends were know what I

didn't have an answer I sat there and I'm like okay let me go to the well let me see all the people that have been like mentoring chatting with want to get it to security you're gonna see a commonality especially at this conference people without security backgrounds getting into security and that's the only thing I hire for you got a passion it's gonna be security for the next like two to three years [ __ ] let's go if you want to get into security because you see a large paycheck get the [ __ ] out don't do this to us because you're lowering the bar if you're joining because you're like this is interesting I've always had this mindset

I'm looking for people to help as you're running a program you can't do this with your entire team it's gonna be very difficult to spend those times and that energy to mentor educate all the time in your own team take the time to choose wisely and if you choose that one person or two people you will get to a really great place the pay now or pay later I say this [ __ ] all the time it's like hey we either do the security thing or we just deal with a breach later for me it was like cybersecurity tabletop I want a security retainer they're like why do you need a security retainer I'm like in

the tabletop show me how you're gonna get ahold of anyone that we don't have a contract with and the answer was like well I got friends I'm like they didn't pick up the phone like tag called another friend I'm like they didn't pick up the phone this breach is so bad like as you're talking through a tabletop you're just like doing a gamified way of saying look if we have no structure or anything planned you're not gonna have that relationship ready to go the last thing I'll mention here is the employee lifecycle outside what we were talking about building your team get the org look at the people within the organization to me but that's part

of the magic of the why i choosing to be here and staying but also i ask those questions during the interview process and they all turn out to be true this goes back to your contextual threat model of like off-boarding thinking of how you're managing people if you give them a mac or if you give them a Chromebook or like what do you lock down or not lock down right so we start getting into this why we did this why did we join the startup we want our options worth something right we're not just these good-natured people that just want to help change the world we want to cash out as well so going through an acquisition it could

be [ __ ] rough I will say in my past hundred and twenty days I rolled the dice I want to go overtime if that's ok yeah that's cool I'm gonna keep going I had to negotiate my own job in the new world and a part of that I was already thirty per and now I'm gonna do this from 160 people now for 800 people on a global entity I'm not ready mentally emotionally financially and those were a lot of hard ask discussions being acquired not a cash exit just more opportunity to get to that exit that line under IPO initial public offering we all kind of want that but that's not always what we want right an IPO can go

poorly I was in a company called Lending Club my shares are worth nothing they looked great when I signed up and now they're worth [ __ ] you know when you look at the strike price or you look at the math behind valuation of a company there's a couple of great articles on medium I think Robin Hood just put out on there one newsletter it's it's kind of just a breakdown of how to look at options and if that's something you need to spend time on I'm not gonna cover it here but I highly recommend understanding what is the valuation what are the options what's outstanding and then what's your delusion if your delusion becomes this illusion

that you're gonna have money maybe this isn't worth it and then the threat model changes when you're acquired everything changes you have to think about who were those key engineers if they leave this [ __ ] is [ __ ] who are the people that are like the domain knowledge owners like are they incentive to stay who are the people that are running like the project management initiative to combine the company are they being transitioned out I'm dealing with that this week literally my project manager has been hanging for over four weeks and as a human sitting there being like what's it even like how are you dealing with this how have we done this to you and it's

like they're trying to manage this project but they're also managing to their own exit because they just can't say we want to keep you and everyone around us saying it so these are things you have to really consider when you go through these types of changes so now what we've done this talk we've chatted I'm over time I want you to have a couple of takeaways and then we can chat after this I'll get off the stage have it defined plan I think that's always good in life be ready to be agile if you haven't read the agile manifesto or highly recommended takes two seconds but be prepared to wear many hats the thing I didn't cover when I joined periscope I

signed up for security I took on compliance I own governance I took on IT I played lawyer convinced us to get internal counsel nine months after the fact what I played lawyer of quite a bit and I also did physical security because the bay area is scary as hell if you've been to RSA or anything out there like it's it's kind of getting better it's kind of getting worse but these are things that I didn't really build into my own mindset before I got there but at the same time I care about the people we can respond to a cyber security incident I don't know what to do about a physical security incident and I've spent a lot

of time doing that so wearing those hats be open to just saying yes and doing if you're coming from a world of just like this is all I do the startup life is not gonna be for you in that early stage go to the late stage and then figure out how to be a little bit more flexible and then culture over in a moment we've already talked about it I will skip the rest there and let's wrap hit me up on anything I'm the best on LinkedIn I think I suck on Twitter Instagram is mostly just my personal [ __ ] but LinkedIn is the thing like literally connect with me send me a message I'm

always happy to chat that's actually a place where I get real connections Twitter for me I don't know about you some people love it and InfoSec but I feel like I'm screaming into a chasm and then someone says something back and then there's no dialogue and then like do i DM them like doing it not i just it doesn't work for me so yeah thank you for your time i'm happy to field any questions so what i'm going to let's give him a round of applause [Applause]