How storytelling made me a better infosec professional

Thank you so much for the intro and the summary. That's pretty much for the talk, so thank you very much for coming along. So I'm Javad, I work at AlienVault. You can follow me on the interwebs and we can go on. So finally, I'm in Lisbon and it's a great honor and a pleasure and I'm really happy to be here. And I know everyone says that, but I really am happy to be here because just over a month ago I was in hospital with having my third ECG of the day and I was at home and I got really dizzy at one point And the next thing I know, my wife's calling me, she's shaking

me, saying, "What's the matter? What's the matter?" Then I see some ambulance crew around me, then I'm being put in an ambulance, and then I'm in hospital and I'm lying there and I'm like, "What's happening to my life?" And all I could think of was a year before, my dad had similar problems. and he ended up having a double bypass and then had the pacemaker for him and made him a little hand, sort of like inflatable hand with a glove there. He was quite appreciative of that. I'm a good son like that, aren't I? So I was thinking, oh, maybe the men in the Malik family are just suddenly all their parts are reaching the

end of their warranty and needing stuff. But thankfully I didn't need a bypass or anything like that. It was, yeah, probably eight something dodgy. But I am really happy to be here because I was there in hospital and I was thinking, okay, I'm not going to die. That's a good thing. Will I be able to fly up to Lisbon? And the second thing I thought, that would make an awesome story to kick it off with, isn't it? And that's the great thing about stories. And stories are broken into two real major parts. It's what did it look like and how did it make you feel? That's all there is to it. So, you know, I'm

sure if, like, hopefully none of you have had any scary incidents where you've gone to a hospital or anything like that, but maybe you know someone. You know, when you think about it, you know how it makes you feel. And it's not very pleasant. And you know what it looks like. Why is it sticking out? Storytelling is really, really good because actually there's a psychological science that goes on behind it. I'm not even going to pretend to understand what that all is or how it works, but Basically, when you look at brain signals and someone's narrating a story to someone else, there's a lot of neural coupling that takes place, which is basically the person

that's telling the story starts reliving the emotions and those neurons fire off in the brain, and the people that are listening, their brain actually starts firing off the same neurons, which is why we get emotional when we watch a film or we listen to a good song or something like that. There's all that coupling that's going on. A story adds what I like to call, it adds toothpicks. And the reason I say it adds toothpicks is in the Netherlands a couple of years ago, there was a food convention. So it's like on our security conferences where there are lots of booths and people take along their food. And they're like, hey, why don't you sample

my food? And people take the food and they sniff it and then they chew on it slowly and digest the taste. And there were a couple of students, and they had a YouTube video about this as well, they showed it. They went to McDonald's, they bought some burgers and they chopped it into little squares. And then they put toothpicks into the little squares and they laid it out on a tray and they went to the food conference and they said, these are our organic homemade burgers, would you like to try some? And people were like, okay, and they pick it up and they chew on it and it's... "This is really, really good stuff. I

can taste the organic... This is a really good alternative to McDonald's or any junk food. I really like it." And that's what a story does. A lot of it is just presentation. Of course, this is like a bit of a lie, but, you know, how it's presented and how you actually convey the message actually changes in reality how people perceive it and how they consume it. So storytelling has helped me in my career a lot. I joined AlienVault about three years ago and one of my roles is really to speak externally. So it's not just here but speaking to journalists, speaking to people who've got queries, people who've been doing research and I I ended up doing really well in the job. I think I was made

for it because if you do a search for me and A. Linvold in the news section, you find hundreds of stories and articles where I'm quoted. This isn't me just being an American and blowing my own trumpet. This is just like, this is the only thing that I think I do differently. It's like when I speak to someone, I try to put it in terms that they understand. But it's not just for me. If you go on LinkedIn and you do a search for storyteller as an official title, you get over 10,000 hits. So it's a growing sort of thing. I think it's a bit of a rubbish title. I'll never call myself a storyteller.

I wouldn't advise anyone to say, hey, I'm a storyteller. Unless maybe you live in San Francisco because everyone's got really weird titles over there. But it's for everyone. I mean... If you're doing security awareness, that's the most common thing that people say, "Oh, if we can tell a good story, we can make our users more aware." But even things like risk articulation, when we write a risk for the risk register, we just say, "Oh, reputational risk, high, medium, low, whatever, put it in there." Or is it an opportunity to actually explain to people who might not be really aware of what you're trying to say? Reporting, we all complain about reporting. Everyone, who here likes

writing their report at the end of a pen test or an audit? You know, very few people actually do. But that's kind of like one of the real key aspects of our job. If we can do a better job at conveying what we learn and what we want the other people to do. Journalists, it can help in your career, interviews, the full works. There's a quote by Stephen Denning in his book. I'll let you read it. This is really bad, I shouldn't do that. Okay, time on time on face of the task of persuading group managers to get enthusiastic about major change. Storytelling was the only thing that worked. Why does storytelling work when you're

trying to convey a major change? Because you're trying to take people from a position of your hair, this is what the future looks like. You're trying to get them to that point and the story is what helps build those blocks and creates that vision in people's minds. Now, we work in an industry which is booming. It's a growth industry, which is fantastic. The problem is that when there's so much money and an industry is booming, there's a lot of people who want some of that money without necessarily putting in the effort or knowing much about it. So one of the challenges we face as a security industry, there's lots of people trying to sell stuff or trying to market stuff or

trying to position themselves as experts just because there's money in it. And so you might not feel that storytelling is relevant to you or you're happy in your job, but if you're not telling the right security message or you're not sending the right security message out there, someone else is going to hijack that narrative instead of you. And we're going to miss a lot of opportunities. This is a short video I'm going to just play for you. And I think it highlights the importance of good messaging. It's only like a minute long. and it gives you a break from hearing my voice. So hopefully the sound... Do I need to plug in the sound separately?

No no no. It'll come through? Cool. It's not very that much audio heavy, but... What did you do to the scene? I wrote the scene, but different words. Thanks, man. I really like... Oops. Sorry. That's so amazing. I really like that example because it just shows how by changing a few words, by changing the positioning of what you're saying, you can change the impact. The situation hasn't changed. He's still a blind beggar. But simply, so initially he was starting from a position of poor me, look at me, I'm blind, help me. And then he's changing the perspective to, "It's a beautiful day, you can see it, I wish I could see it." And people can empathise with that because you're starting from a position where it's relevant

to the other person, not from yourself. And how many times in security do we see this? "Oh, we have this problem, our users are dumb, or my manager doesn't get it, or I don't have budget." No one really cares. We're starting from that position where, "I'm blind, help me." So now I'm going to give you seven tips of things I learned over time in how you can improve your storytelling for InfoSec specifically. Seven is a nice number and it also lets you know how much more you've got to put up with me. So number one, the formula. A story is really, really, really simple in general terms. There's three components to it. There's a character, there's some conflict, and then there's some resolution.

So imagine Romeo and Juliet, I'm sure you're all familiar with the story. Romeo and Juliet, boy and girl, want to get married, they love each other. Parents say, "Okay," they throw a big wedding and they live happily ever after. That's nice, but it's not a story. What you want is some conflict. They want to get married, parents say no, and then they fight against the system and then they go off and then they get married and then they die or whatever. But there's some resolution at the end of it. So when we are crafting our story, when we are crafting our narrative, who are the characters? Are we putting the characters in the right place? What's the conflict there? And what actually is the resolution we're trying to

see? If our users are clicking on phishing links all the time, They're a character, but we often mischaracterize them as being the bad guys. We're saying they're the dumb users. They're the ones making the mistakes. Well, are they? Maybe they're just the innocent victims. Well, okay, what's the conflict? They're clicking on links. How do we change that? That's what we're trying to resolve. And what's the actual resolution? And this is where we fall into vanity metrics. Oh, 80% were clicking before, and now only like 60% are clicking. Is that the actual resolution we're looking for? Is it a different level of awareness? There are lots of scenarios that we need to look at and just work out, are we actually finding the right conflict? Are we solving the conflict

for the users and the business? Or are we just worried about our own issues and putting that as a central focus? Scenes. I watch a lot of movies. And if you hang out with me for any period of time, my kids now actually are cutting on to the fact that half the good things I say are lines from movies. But, you know, when you watch a movie, a story is like a movie, but you're creating it in someone's mind. and your words have the power of editing that movie and adding drama or adding some feeling to it. So I'd say just think about when you're crafting your narrative, when you're writing your report, and it

can be something as boring as a pen test report or even a vulnerability scan. The thing is the numbers are there, the data's there, but is it telling you a story? Put the audience first. And this goes back to the example of the beggar. Why put yourself first when you can put the audience first? And putting the audience first is something we, I wouldn't say, sometimes I see it like people don't put the audience first. And what we need to do is put the audience first, but also appreciate the fact that business people are actually like clever people, users are clever people, and they know how to make decisions as well. So I like the

term choice architecture. It's where you explain the scenario to them and then you let them make their choice themselves. Not lob a grenade over the thing, say, "You can accept the risk or not." And there's a good example of this. I read there was a school, a secondary school, and there were girls who were reaching teenage years and they started discovering makeup. So a lot of them, what they like to do in the toilet is they put on their lipstick and then they'd like to kiss the mirror in the toilet to leave a lip print because they thought it was cute or nice or what have you. And the principle was like, we need to find a way of stopping the girls from doing this because it's just not

good, it's not hygienic properly, it doesn't look nice, we have to clean it, what sort of message does it send out? And so if you think about the principle, if he came from a security perspective, he would say, "Let me write a policy that forbids girls from putting on lipstick and kissing the mirror." Maybe that. Maybe we have quarterly inspections where someone goes and checks all the mirrors. Maybe we start fining or penalizing students who do that. And that's kind of like a very traditional rigid approach, but that doesn't tell a story and it doesn't give any choice to the end user. So instead one evening, what he did after school, he invited a bunch

of girls over into the bathrooms and he said, "Girls, you're growing up, I've got daughters of my own, I know you're not going to stop putting on makeup. I know you're not really going to, you don't really want to stop kissing the mirrors because you think that the lip prints look good." So he goes, "But I just want to explain to you what my challenge is here. That as a principal, I've got to make sure all the facilities are clean and look good. And my caretaker over here, and his caretaker was there with the cleaning stuff, he goes, "He has a really hard job cleaning this off every day." And he goes, "Caretaker, would you mind showing these ladies how hard a job it

is?" So, he picks up his mop and he dumps it into a toilet. Gets it all wet. Picks it up and starts brushing down the kitchen. And then he takes it out and he dumps it in the toilet again and he takes it out and the principal's like, poor guy, he's like, you know, 58 years old, he's got to put his back up, this is really hard work, it's not in his job description. Anyway girls, I just wanted to share with you what the problem is, the choice is yours, you know, but this is just a challenge I have, help me help you. Surprisingly, no one ever kissed a mirror again, no idea why. And I really like that example, like, you know, how do we

talk to the business when we go to the, you know, someone and say, stop doing this, stop like leaving your web apps vulnerable or stop, you know, stop exposing credentials on a net. You know, how are we positioning that? How are we explaining that to them? And are we giving them enough choice to make the right decision? Number four, so what? And this is my time to sort of like neg on red teams and pen testers a bit. And I think it's important for like conference speakers around the world. We have some really, really talented people and they do some awesome stuff. But half the time you go and you see a speaker and they'll be like, So I got my night vision goggles, I put

on my army jacket, I went at midnight, I crawled through the fields, I took a photograph of someone's ID badge and then I cloned it and then I broke into the building and then I got into this server room and then I social engineered my way here. Then I got my, you know, rubber ducky and I plugged it in and I ran these commands and I totally owned that company and I walked out like a boss with my shades on, didn't turn back and look at the explosion. That's kind of like a summary of a lot of talks we hear. And then it's like, cool story, bro. So what? So what? Maybe the point is

I just want to brag in front of my friends and my peers. Okay, if that's your what, then that's great. But that really doesn't help anyone else say like, What's the takeaway there? What do you want me to do about it? Is there actually something actionable that I can do to defend against it? Or is there some skills there that you advise us to learn or not learn or behaviors to change? So I think like insecurity, it's like, so what? What is it? What are you trying to say? And the answer... even though I work for a vendor, the answer isn't buy our box and that will save you because that doesn't work either. There

should be a real reason and if it's not then I think re-evaluate why you're explaining something. Follow a structure. This isn't a hard or fast rule but it really helps. If you follow a structure, It helps you put things into context in terms of the characters, the conflict, the resolution. And, you know, if you look at Hollywood, they say there are only seven real stories there. There's like, you know, defeat the monster, the rebirth, you know, the hero's journey, all that kind of stuff. If you go to journalists or writers, they use something called the inverted pyramid, where they start something. If you read it, it's like, okay, Barcelona played Real Madrid and they won 5-0 or something, for example. So that would be the headline, Barcelona beat Real

Madrid 5-0. And so if all you read is the headline, that's all the information you need, and you can walk away. If you start reading from the top, the start of the story will start with the most important information. Were they playing at home? Were they playing away? And then you get into like who scored the goals? And then you get into like what time were the goals scored? And then you get into like how many substitutions were made? Yellow cards, red cards? And then at the end you might say, and the manager was saying, we're really happy with our performance. So the trick in this is that the reader can stop reading at any

point that article and they'll understand the gist of what you're trying to say. So people that are only interested in what the result was, they can just read the headline and get all the information they need. People that are really into it... Okay, apparently my voice isn't loud enough. You have the white settle right here. And then you start... That's really important in sort of the reports we write or how we present information. A lot of people don't have the time or the energy or the patience to go through reading all of our findings, but if we structure it in a usable way, we can get over the most important information. I don't expect you to read this. I just thought this is a really good

example. This is from a book called Save the Cat. It's actually a Hollywood movie screenwriting template. And nearly every Hollywood movie, because they feel so similar, it's because they follow a structure like this. You start with a hero, there's his quest, he finds his powers, there's a main villain he's trying to beat, there's a girl he's trying to get, there's a false victory, there's a false defeat. At the end, everything's all good. And that's pretty much every movie that you go to. So... And it's not like, you know, we use that, we have methodologies and we have standards and we have all that kind of stuff that we adhere to. So, you know, it's just

another form of structure that can be used. Comedians are really, really good at this. And I think they're like one of the best storytellers that are around because They go and they don't have even slides, they don't have anything, and it feels like they're just freestyling. "Oh, I woke up and I walked to the shop and this happened and you laugh and then that happened." But, but, If you break it down, they're using a lot of structure. There's a lot of techniques there. There's repetition, there's rules of three, there's callbacks, there's sort of like observational, there's stereotypes. There's all those kinds of things thrown into that. And these are all things that you can take

and you can pick up and you can use as part of your messaging and communication. Tailoring it to the medium, this is my favourite one. And I've had long, long discussions with people about this. So one thing is, I really appreciate everything Cooper does, and we film all the talks for people that aren't here. I'm not really a big fan of watching talks on YouTube, because I think when you're in the room and you watch the speaker live, and there's a chance to interact, and there's that kind of like, "Buzz, do you feel the energy in the room?" It's just me. Okay, just me. Okay. But, you know, I just think that, you know, the

way I'm speaking right now is very different to how I'm going to speak to you if we meet in the coffee area downstairs. The way I'm presenting this information now should be very different from how I wrote it in a white paper, if I wrote it in a blog, if I made a video about it, it should be different. If I'm talking about this on a podcast, it should be different. Because each medium has its own strengths. And if you tailor it to each medium, it will be far more impactful. If you're going to do the lazy way, and I've seen people do this, they'll write a white paper, and it's a really good white

paper, on some vulnerability they've found, then they'll go up on stage and they'll basically read the white paper. If you're going to get on stage and read me the white paper, I will just read your white paper anyway. I don't need you to narrate it to me. It's not an audiobook. So tailor your message to the medium. We often see this bit like, you know, "Oh, the book was better than the movie." And that's where, like, you know... Because we have certain expectations of mediums. The seventh, the last and most important point is to edit. And I would say, brutally edit. Be really, really brutal in your editing. The irony is not lost on me.

I'm up here doing a 45 minute talk and I'm saying, "Edit and get your message down." This should be a lightning talk. I should be able to do it in 15 minutes. But oftentimes we don't really appreciate fully how much we can condense things. Hemingway, I believe. Ernst Hemingway. He said he was a big fan of cutting things down, getting rid of unnecessary detail. There's actually a site, you can go online, there's Hemingway Writer. It's like an online editor. You can paste in some text and it'll tell you stuff like remove this, remove this, remove that. It's quite interesting. But yeah, he said, he told a The saddest story ever, and it's only six words long.

I really like it. But his story is, baby shoes for sale, never worn. That's a bit sad. I'd like to play it in the room, haven't I? Sorry. We've got to change the mood, haven't we? Okay, what we're going to do then is... because I feel a bit bad, that's a bit depressing. It's depressing in the morning, everyone's getting a bit happy. So I need your help for a second. Okay, so what we're going to do, I'm going to finish the talk here. I'm going to finish the talk here, I'm going to say thank you, and I'm going to walk out, and then I want you all to clap and ask for an encore. Hang on with me, yeah? I want you

to put it really, really loud. Clap, clap, say "George, you're my, you're my encore, encore, encore." And then I'll come back, yeah? Okay? So, three, two, one. Thank you very much, everybody. This is a surprise. You must really love me. I did not expect this at all. I'm gonna tweet this out later. I'm gonna be like, "I've got an encore at B-Sides Lisbon." That's a story, isn't it? Ignore the details. Ignore who's like, you know, ignore the facts. Don't let the facts get in the way of the good story. That's what I was going to say. But it's a great story, and people are going to hear about this, and then they're going to be like, what was that

all about? And then it gives you something to talk about. And even if you don't remember anything, you're going to remember this part, actually. I don't like it. So... You can change the mood really quickly and you just need to ask for permission. And people want to play along, people want to have a bit of time, people want to improve their situation. And if you work together you can make it happen. A lot of people ask me, so it's a good thing you called me back because I did have a few more seconds. It would have been embarrassing if I just left without going through this. How do you generate ideas? And a lot of

people come to see, oh, you're so creative and I'm not creative and I can never come up with a good idea. And I'm like, no, there are ideas everywhere. You just need to pluck them out of the air. And, you know, you've got your own life to look at. Think about stuff that happened at school or when you were growing up or... You know, that time that you nearly crashed your dad's car. Look at your organisation, the company you work for. Is there something there? There's characters all around you. There's that manager who's got an annoying habit or who doesn't schedule stuff properly and they call you up like, you know, an hour before a

client call is needed or something. Or, you know, there's life all around. And, you know, you can look at how people often refer... Is this still on? No. Yeah, okay, good. You look around about how people look at sports people and they always use them as inspirational stories and motivation and they'll always give you nice quotes and what have you. Analogies Project, I don't know if it's still running. I should check it out. There's a website called the Analogies Project and people just submit stories about InfoSec that are analogies, which are a really good way of kick-starting some ideas as well. You can just go on there and people say how sun cream is like a firewall, like whatever. It's a weird analogy. But actually, analogies

are fantastic. If you can find ways of tying two unrelated things together and making a... It can make a really good story, it can actually give a really unique perspective into how to do it. So it's kind of like, you know, if I put dog's food into my cat's feeding bowl, will she eat it? Oh, that's like secret injection, isn't it? No, probably not. Imagine the world. where web applications fire, would it? I like the "imagine a world". It's like how every trailer starts in movies, doesn't it? And it's a really good technique to start, if you're trying to solve a problem, trying to work through it. I don't know if it works for everyone.

It works really well for me. It's like, imagine a world where... And when you're talking about security vision or your strategy, The question is, what is that world you're trying to imagine? What's that world that you're trying to get people to buy into? What's that world that you're trying to get people to do? So we talk about web application vulnerabilities, for example. Imagine a world where no web application was vulnerable. Or conversely, imagine a world where every web application was vulnerable. And then work backwards from there. What does that world look like? What are our challenges? How do we want to solve them? What's the best case scenario? What's the worst case scenario? All these

things really help because sometimes we're so fixated on like, "Hey, found a vulnerable family, what about injection floors? Let's move on." Why? Because everyone knows they're bad. Okay, well, why are they bad? I'd like to remind people, I'm not talking about marketing. I'm not saying explain stuff in a better way so you can market your product. I'm saying we as an industry need to market our ideas. We need to push our ideas, we need to educate the masses because if we, or you, I won't include me in that, if you guys aren't controlling the narrative, if you're not saying what's right, what's wrong, how it should be fixed, how it shouldn't be fixed, someone else is going to hijack that narrative. And then what were you going to do?

Then you're going to sit on the side and say, "Oh, you know, Gregory Evans is here, he's talking about some rubbish, and, you know, he's on Fox News, he's on CNN, and I'm not, and I know more than him." Well, what have you done to control that narrative? And we're really good, like, we can complain on Twitter, like, the best of them, we're like, we should get a gold medal in that. Like, so-and-so is talking rubbish. Well, okay, they're talking rubbish. How do we combat that? How do we get control of the narrative? And the industry is mainstream. We're a mainstream industry. And conferences like this are growing everywhere, like, you know, there's so many

B sites, propped up all around the world, and it's a testament to how great the community is and everyone gets together. But how do we take it out from there? How do we take the ideas that we learn here, how do we take it to other places? And you don't even need to know a great deal about it. A lot of people suffer from, you know, I know I do suffer from imposter syndrome sometimes. Why am I going and speaking there? Why are they inviting me? No one's going to care about me. But there's always something you know that someone else doesn't know. And if you can take something you've learned, something you know, and

take it somewhere else, pass it on, pay it forward, as they say, it will make a big difference. Because we can't do this on our own. Because the problem is so large out there. So in short, I'm saying, don't shut up. Just keep on talking about it. And there's a really good example of this. Tiddy Smith was 10 years old and this was in 2004. I see a few people like, "This is a really, really sad story." No, she doesn't die in this, okay? So, spoiler alert. She was 10 years old and she was on holiday with her sister and her ex in Bali. They were walking along the beach one morning and the tide had gone out.

She was like, "That tide's gone out really, really far." But tide goes up, but it went really, really far. But people were chilling out there, enjoying themselves. Lifeguards were there, everyone's there and everything. And then she remembered that in geography class, her teacher had shown the class a video of Hawaii in 1946, where the tide had gone out very, very similarly, like, you know, a couple of miles out. It should be obvious it was a tsunami. So she started freaking out. She was like, "The tide was out in Hawaii, the tide's out here, a tsunami's coming." And so she turns to her parents and says, "A tsunami's coming, we need to get out of here."

And they're like, "What's a tsunami?" No one knew what a tsunami was. And she's like, "No, no, no, it's really bad. The tide's gone out and that's going to come back and it's going to come crashing in. It's going to kill us all." The parents were like, you know, like, "Shut up. It's okay. I'll buy you an ice cream, love." And she's like, "No, no, no!" She's like getting hysterical. And if any of you parents or you dealt with little kids, that's the worst thing. Especially when you're on a holiday and the kid starts getting hysterical. You're like, "Okay, let me walk away. You're having tantrum over there. I'm just gonna walk away and like

ignore you for a bit." But she was getting really hysterical. So her dad's like, "Okay, maybe she's onto something. She never ever freaks out like this. This isn't like her." And so he does, and like, you know, the English the thing that they fear the most is embarrassment, public embarrassment. But he still, he went up to the lifeguard and said, "Look, the tide's gone out really, really far. It's uncharacteristically far. My daughter's really freaking out. Do you think maybe there is some truth in what she's saying? They're like, "Well, I don't know. We've never seen it go out this far, but now that you mention it, why don't we just evacuate the beach?" So there's about 380 people on the beach, and eventually they gathered everyone, and everyone's like,

"What are they talking about?" And they went on to the hotels, and they got up to the third floor, and they didn't have to wait long, because a few minutes later, a tsunami came crashing in. That was Boxing Day 2004 and across South East Asia, you know, millions, hundreds of thousands of people lost their lives and that was the one beach that no one died on because a 10 year old girl didn't shut up. I hope you see where the analogy is there. We can't afford to shut up. Sometimes it's small things, sometimes it's big things. Even now when you look at things like IoT, because I talked yesterday about lights and everything, and they're quite difficult, by 2020 there'll be 22 billion whatever connected devices. You

know, that's the tsunami, that's one of many tsunamis that come across the digital world at the moment. What are we doing to fix it? How are we going to fix it? Are we just going to sit in the corner and grumble amongst our peers on Twitter? I'm not saying throw a tantrum like Sidney Smith on the beach, but saying like, you know, what are we doing to control the narrative? What are we doing to change people's perspective? What are we doing to change people's minds? Because that's probably the most important thing. I don't think we have a problem with technology. We have all the technology we need. We don't need another black box or a

blinky light box. That's not going to solve anything. We don't need more education. I mean, you know, you guys are all smart people. There's loads of smart people around the world. We don't lack the expertise. We don't lack the technology. What we lack is the buy-in. And that's what I think. So if there's one thing you can take away from it, it's like, try to pass your message on, try to communicate in a more effective way, because I think that's where we're kind of like losing the... That's where we can make the most progress in the least amount of time. Thank you very, very much, everybody. Thank you.