Building modern state and local government security without starting over

I'm delighted to be joined by three of some of the top tech leaders in state and local government and they happen to be three Cloudflare customers as well. So we'll do introductions in just a moment. For those of you that are wondering about Cloudflare and the U.S. public sector space, we are powering about 100 government agencies in U.S. federal, state and local government. We have for this group, we have a GovRamp authorization across the states. We have FedRamp High authorization, which we just announced in August. And we also have announced our intent to pursue DoD IL-4 authorization as as well. So public sector is a newer business for Cloudflare, but a very rapidly growing business. And we're happy to showcase our customers and have this conversation today. So when we when we talk about state and local government, what we've learned is that, you know, this is rarely a clean build. And that's why we have the kind of the title of the panel for today, you know, building modern state local government security without starting over, without ripping everything out with, because that's not the reality for state and local government customers. And I think we'll hear about different variations on that story from from our three panelists today. So with that, let me introduce the panel. We have John McCaffrey here. John is Commissioner and Chief Information Officer, actually of Suffolk County, New York, Suffolk County, home to about one and a half million residents. 12 states actually have fewer than one and a half million residents. So it's a pretty big county outside of New York City. I think it's the largest county outside of in terms of population outside of the five boroughs of New York City. Welcome, John, thank you for being here. And then staying somewhat close geographically, we have Doha Ozturk. Doha is the Executive Director, Information Security and Infrastructure for the New York City Department of Buildings, which is responsible for 1.1 million buildings in New York City. Correct, Doha? It's it's it's very exciting every day. And there's always something new. And thank you for having me. And thank you for being here. And then we have Matthew Forsberg, who's the Chief Defense Branch Chief of the California Department of Technology, Office of Information Security. The Office of Information Security in California sets security policy and delivers shared defensive services across state agencies. And that's a very big state with different budgets, different problems, correct? Yes, that's very correct. So we've got one of the largest counties in the United States, the largest city in the United States, and one of the largest states and the largest economy in the United States represented on stage here. Thank you all for being here. Really appreciate having us. So let's just do a quick round. Give us give us the 30 second version of your environment. What what are you responsible for protecting? How big is your team? And what's the one thing about your infrastructure that would surprise a private sector CISA? So in Suffolk, we are responsible for oversight of the entire network. We are federated in a lot of the counties are not, but we are federated in terms of IT. So we have IT staff in some of the in various departments. But we've tried to create a, at least a collaborative environment, working with all those departments and whatnot. I have an overall staff of about 150. We have a security team that we built over the last two and a half years of 10 from maybe three, actually, following a major breach, some of you are probably aware, in September of 2022. I think the thing that would surprise a private sector CI almost is the thought process to deal with all these complexities with such a limited staff. And I realize, you know, I think that's true for all of us, probably. But I think that's the biggest thing. And regardless, IT-wide, security, measure -wide, there's that very limited staff to deal with the issues that we deal in the complexity of a $4 billion organization. Thank you, John. Doha? So I'm responsible for protecting, managing, implementing, and also patching of the entire network infrastructure, including routers and switches, as well as the cloud infrastructure, server infrastructure. I'm also responsible for maintaining the security of our public-facing web applications. And my team is really, including the help desk, is about 15 individuals, give or take. And then one of the things that may be surprising is that we talk about red tape. It's not red tape. It's just a red wall. And, you know, you spend years trying to figure out a process that's been in place for, you know, over decades. And it doesn't make a whole lot of sense when you actually start working on it. But once you do, and once you're in it, it starts making a lot of sense. And that red wall just becomes really having a lot more clarity on how we can move forward. So I run the state SOC. So we have about 118 customers right now, all across the executive branch and a few other POVs sprinkled in from local government as well. We do it on a team of about 30 people, with about 15 in the SOC. It's SOC analysts, and the rest are like administrators and engineers. We do a lot of monitoring. We don't do a lot of response. So they basically feed our logs into Sentinel. And then we monitor around that. I think one piece that would kind of surprise people would be like how disparate the networks are. So generally, when you have one SOC for a company, you would get a certain tech stack, a certain security stack, and you'd know your network, hopefully. With this one, we have 118 different security stacks. So everything's a little bit different. Everything requires fine tuning. Every, you know, every customer has a different security, you know, maturity. So that's what I think would surprise most people. Great. All right. So let's, let's kind of dive in to, to each of your stories, which, which, as I said, I think are variations on this concept of you don't have the luxury of just starting over to solve problems, to, to address vulnerabilities. You, you don't have the luxury to do that. You, you have to work with what you have. So, so, John, let's, let's start with you. So Suffolk County has, has rebuilt a lot over the past few years, as you'd mentioned, right, since, since 2022. When you looked at the environment that you inherited, how did you decide what to replace outright versus what to put new protection in front of and, and keep running? So I think, you know, coming in, again, following a, a major cyber incident in September of 2022, my team came in, in, as an administration in early 24. And, and there was progress being made, but we were still in the sort of recovery mode, if you will, from the breach. And I think that, you know, the decision making, first, you're sitting down and you're having these discussions with everybody, widely, department, within the department, outside of the department, understand what's in place, coming in blind, if you will. But I think the, you're looking at and saying, really, what can, the legacy systems that you know, you're not going to do a wholesale replacement of, those systems in a sense that we need to protect, protect for and against, if you will. But we have integrations with the state systems as well. And we need to, we're working on something now where the FBI is involved, and we have to make sure that we have protections in place for ourselves, even though, you know, you'd like to think that those agencies are protected as well. So I think it's the making the decisions about where you could put, put those edge controls, things that the Cloudflare has brought to us, web application firewall, looking at those legacy systems and saying, how do you, we're not going to reinvent them, we're not going to probably got, no, we got, we're not going to recode if it's internal, we don't have control if it's not, if it's one of the state systems. So it's basically looking and saying, what can we do at the edge? What can we put in place to make sure that those are protected, those legacy systems, especially? So I think the decision process is not easy because you have to look at it holistically, but then you really do have to come back and say, okay, what's, where are our most vulnerable places that we have to protect against? And how quickly can we do that? Is that something that we can do within the system, network controls, firewalls, you know, those things, or, but I think the thing looking at it saying immediately is those legacy systems where you don't, there was no opportunity even for built-in controls. Hmm. County government. So one more question, one more fact before, before you go on to Doha. So county government runs service, you run services that, you know, the residents can't do without, right? You have to, you have to keep them running. How do you modernize the security on those systems that you can't go offline for, for maintenance? So there's multiple ways you have to be looking at it, right? So obviously I think one of it is in terms of deployments, looking at blue green deployments or canary deployments where you're keeping system, keeping the existing system running and either like holistically having that, that secondary system. It's also looking at micro segmentation, breaking some of those things down, which again, Cloudflare, you know, is helping us with that type of thing. Zero Trust network, building Zero Trust network. And having now having AI where we're looking at AI, which the ability to use AI for detection, obviously, and remediation of systems that are in place. But I think that it really comes down to deployment and as well as the edge patching on the edge, if you will, and whatnot. So that that gives us the ability to at least keep those systems running and put those protections in place around the systems, but bigger than just the original perimeter of controls that we had in place. Great. Thank you, John. All right, Doha, you're up. And we've, we had a very interesting setup when we first started working with the New York City Department of Buildings. And, and we had a, we spent a lot of time getting our contract down, right? But, but we didn't, we couldn't start from a clean slate there, we had to do the work, get the contract in place. So, so you had a public facing application that was end of life, unsupported, carrying multiple critical vulnerabilities, but still essential to the mission, right, of those 1.1 million buildings. The conventional answer would have been, hire a consultant, try to fix it that way. You want a different direction, right? When we, when we first met you, tell us about, tell us about the story. Yeah, so our inspections applications, which is end of life application, as well as this running on end of life servers. In addition to that, it was actually also running on an end of life F5 load balancer as well. So I had like, we had multiple angles here that we had to kind of cover. So we had to first get off the load balancer and go to another on-prem load balancer. And because the application was end of life, we didn't really have any, any support to modify the application. So, so we tried for six months to, you know, get on a different load balancer that was on prem. And it was, it was just not, the application was just not working. So when, when we started looking at Cloudflare and what Cloudflare has to offer from their application services suite, there was a cloud load balancer. And, you know, we, we, we were like, it's been six months, we're not going anywhere. So we went ahead and actually tested on Cloudflare web, web, I'll say web load balancer. And we were able to have successfully test everything within three weeks. So Cloudflare is not only managing the security of this application from a lab perspective, where it also manages our on-prem end of life servers, load balancing them through a web load balancer. And we were one of the first agencies in New York City to actually manage on-prem servers via a cloud load balancer. In addition to that, the ease of use for, for the WAF was, was just really, really incredible for us. Because we were not able to change the, the base code on the application. We used application level patching on Cloudflare WAF to be able to remediate almost all of the vulnerabilities, critical and medium vulnerabilities that we had for this application. We worked very closely with Cloudflare and their tech support to make this happen. But I have a regular firewall engineer that also just manages this WAF. So as, as challenging as it is, I did not have to go get a new position or find someone new to manage this solution. So it's, it's a twofold, threefold for us, you know, ease of use, ability to secure and use additional solutions within a single suite to get things done the way it needs to get done. All right. And so, so virtual patching gets talked about a lot, but kind of done rarely. You wrote custom rules against a vulnerability report line by line, right, that you described in, in our case study. What did that actually take? And what did you have to learn to maintain it yourselves? So this is actually part of our operations in a sense where, you know, quarterly we scan all of our web-basing applications for vulnerabilities. I mean, I think that's what something that everyone here should do. If you're not doing it, just start doing it. It's much better to be stuck with an SLA to a compliance team versus actually having someone else finding the problem. So we not only use this application, I'm sorry, we not only used our end of life application to actually patch virtual patching, but we also do virtual patching on our up-to-date applications because with critical vulnerabilities of seven days SLAs, our application team is not really able to, you know, remediate that within seven days. So pretty much we look at the vulnerability. We work with the Cloudflare tech team to be able to remediate vulnerabilities. And we do this more than, more than you may think, probably at least a couple of times a month, because we continue seeing vulnerabilities and we want to be able to secure them until the application teams can actually remediate. Great. Thank you, Doha. All right. So we have two New Yorkers now, now onto the West Coast. And so we have a county, a city, now statewide with, with, with Matthew. So Matthew, you're, you're defending at statewide scale across agencies with very, very different levels of maturity. How do you raise the floor without forcing every entity into kind of a rip and replace type scenario? Well, I, I don't think you can force them at this point, right? There's just no way. It took years to convince, convince them to get into one SIEM. And, you know, if you were to rip that out, it would, everyone would go into chaos. So impossible. But I think applying tools on top of, you know, the SIEM and traditional, whatever they're running is really important now. This, for example, when we got, when I first got here about eight months ago, you know, we started using CLAWD or whatever to run across the SIEM, which allowed us to, you know, see things at scale that normally would have taken weeks or months to kind of develop. And then it also allows us to kind of fine tune each tenant a lot easier, develop rules and custom rules. And that's, that's really key, because when you look at a MSSP model, generally they're writing like generic rules. And that's just by the nature of the business, right? When you're, when you contract with someone. But now we can apply those rules very specifically to our customers. Also, we're buying products that we can scale across all the tenants, Cloudflare, Protective DNS, like that type of stuff. And we hope to be able to, I don't want all their DNS traffic. I just want, you know, specific, the IOCs. So, yeah, we're kind of doing that. We're doing automated pen testing. We're, we're looking at how that affects, you know, legacy equipment and then applying specific rules around that. And really, if they can't raise their own maturity, we're just applying protection around their, their environment to kind of just mitigate any issues that they have. Because a lot of our customers, they're not, they joined the SOC for a reason, right? They either don't have the money to stand up their own SOC, or they, you know, they don't have the IT team. They only have an IT team. They don't have a security team. So they're not like security minded. Even though they're a great IT team, they might not think in terms of kind of protecting the environment. So kind of working with them and not forcing them, but like suggesting like, hey, you might want to make these changes has been very successful for us. And, and this shared service environment, what, what does this environment allow individual agencies to do that they, that they couldn't do before? Yeah, a lot of it has to do with just being able to see, I'll just give an example, like Quartzline. I don't know if anyone's seen that recently. It's like a really annoying piece of malware. And it'll pop up in one environment. And, you know, we can search across everyone else's environment and kind of see that and, and stop it fairly quickly. So just the shared intelligence layer is huge. Same thing that we were going to do with DNS. And then also things like a lot of people aren't deploying WAF across all the environments either. So we're trying to get everyone at least, you know, if you are not going to patch, you're not going to upgrade your equipment, at least put a WAF in front of it, at least do something to kind of mitigate those issues. So that's kind of where, that's kind of where we're at with that. Okay, great. Well, that that gives you a flavor of what each which each of these customers are facing. And each of these leaders are facing and the challenge and how Cloudflare help. I have some more questions. But I'd love to hear first if there's questions from the audience that you have, that you have for this group for John, for Doha, for Matthew. Any questions from the audience? So let's get the mic. Let's get one of the mics down there. Thank you very much. Peter Sosla. John, in particular, in the 2022 breach, recognizing that carnage that you had to deal with coming into the shop in 2024. And recognizing the build a new security team, as you mentioned, going from three to 10. The real challenge, and I'm curious on everybody's take on this, but in particular, you, is that the turnover of the talent of secure in that environment, the younger generation comes and goes, the older generation is kind of faded away. But the gap is getting larger and larger for the requirements, security teams of 10 is on the staff. So what are your thoughts about that? How do we, you know, deal with that challenge? Thank you. Yeah. So that's, that's the unfortunate nature of our, of all of us in public sector, right. Is, is, you know, hiring and retaining talent is a great difficulty. And I, I actually talked to each of the individuals when, when someone comes in, whether I was part of the hiring process or not, I talked to every new employee that comes in, you know, not all of us can do that in the larger environments. But I've, I've said to, to all of the, the staff that comes on, you know, if you can, you can go into, and this was my mindset. I've been, I've been in the private, in public sector for 36 years. Um, and it was sort of my mindset, but, but it's hard to convince a younger person. I mean, we'll talk about ages and convince a younger person of the beauty of working for the government and looking, Hey, when you're 65, you know, you'll have a great pension and you'll have medical benefits. That's not great for a 22 year old or a 25 year old. Right. So, um, for me, it's talking to them about the beauty of the disparate nature of government. If you will. And I say, typically, if you're going into, I always use insurance, but if you're going into an insurance organization, whether it's a developer or a cyber, but there's a developer, maybe you're in marketing, or maybe you're in actuarials, or maybe you're in the administration area with, with, in our environment, you're looking at, you're going to be involved with health. You'll be involved with the comptroller's office with ANC. You'll be involved with the legislature. You'll be involved with the county clerk. You'll be involved with police and sheriff and, and social services. So it's a broader experience and you get it. You're trying to really, at that point, it's trying to convince them of the value. But I also, I have taken the approach with, and again, this is across my entire career in leadership, um, is if I can keep them for three years and get a really great talent there for three years, and then they go out and that's, we've got to manage that way. But as, as Pete says, the, the, the pool is getting smaller and smaller, uh, in our area that even just the, the ability for younger people to, to afford a home or what have you. It's just, it's very difficult. So it really is sort of about enticing that, that nature and looking at it and saying, how do I, how do I start now to look at three years out because I'm going to lose people. I have a, uh, uh, I just, I just, just informed them. I, um, Pete is with our, what I didn't control our comptroller's office. Um, but that was not a planted question, right? No, but I knew he would ask, um, but, but it really is looking at it from a standpoint of how do we plan for that? We created a, uh, an internship program. So we're trying to pull young people out every, and we give them meaningful jobs that they're actually shadowing somebody or working, not just, not just filing or something like that as an intern. Um, but also, um, again, it's, it's just, it's very difficult. It's hard to manage. So it's trying to entice them about the appeal of, of government, the appeal of the benefits that we do have, and maybe looking at it as a, you know, a good place, a good place to retire 10, 20, 30 years later. Uh, but that's, that's really the greatest difficulty is trying to maintain, but just being realistic about it and saying, if I, so I, what I started to say was I'm for Pete, we had a young woman who came on to our cybersecurity team. Um, six months later, she got a lot better money. And I know that's going to continue to happen with that team, right? That if you, if you got the experience of one year or two in cybersecurity, you're, you're going to be, you know, marketable very quickly. So it's, it's, uh, just trying to entice them in, in whatever way you can. Thank you. Um, great question. So, um, that's, I feel that that kind of starts with me and the environment that I create for everyone to, uh, to work in. Um, you know, while it's, it's difficult and it's, it's a lot of pressure. I work on creating a, um, grass is green here, kind of an environment. And, and while the, the, the pay is, you know, limited and opportunities may not seem that that many, um, one of the things I always try to concentrate on is tech individuals are hungry for more tech. So, um, I go out there, I put myself out there to look for new tech, um, security or cloud, whatever that needs to be. And, um, I've bring in vendors, I work with them and I engage my, uh, you know, my employees to work with these vendors. And, um, you know, the beauty of having the security team, as well as the infrastructure team and network team, I'm able to create sub teams, smaller teams. I pick one from each other team and I get a smaller team in different fields doing an actual project on a one, on a one solution. So, uh, this creates an excitement for them and then they enjoy it and they get to experience new things. Uh, you know, while doing all this, I also try to get rid of anything, legacy, anything that we don't, I don't feel that is a benefit to the organization, whether it's the technology itself, uh, or how much it costs. You know, there's multiple ways of looking at applications. So it's, um, it's essentially just turnover is actually the turnover within technology, just get rid of all tech, bring new tech in. And, um, I also, um, force everyone to do two or three weeks of training a year, at least. I, um, you know, I brought in a on-demand solution so that everyone can take training whenever they need to. And then I also send them to classes once for, for one week, uh, on a different, from a different, uh, vendor so that they get to experience things in multiple ways. And Microsoft and, and, and, you know, other, other companies have other free solutions that we use all the time to, to make this happen. I think that's a really great point. I've also found success in kind of giving people, uh, the leeway to, to build stuff as I kind of like the timeline we're in right now, because you can be like, oh yeah, build something in house. Um, and you know, they can bring it to you. And I've had a lot of people bring ideas to me and we can kind of build those, uh, without having to pay a vendor necessarily. You know, we could do a lot of stuff, uh, by ourselves now. Um, and we also do, uh, training as well. We, we do SANS. Um, we give our analysts a SANS course every year. So that's, they love that. Um, and we give them the time to, to finish those. Thank you. Other questions. Yes, sir. Jay's got a mic for you. A lot about the systems, uh, with, uh, with users having, uh, old switches, uh, older tools like SMS and, uh, authenticator, how are you handling, uh, user secure fingers? So I mean, again, it's for us, it's, it's putting the, uh, as, as, to, to as great an extent as you can, as putting a barrier around that, you know, the, the role and, and the tools that can be used, I'll just go off into AI tools. Now we'd put tools in place to ensure that, uh, no one is going row with, or at least to, to attempt to assure that no one's going row with, with AI. And we've limited it at this point to, um, the Microsoft and then case by case evaluating and allowing as, as need, if someone says they need caught and can make a good justification to it, to, to, through their administration to us. Um, but again, I think it's, it really comes down to even just what we talk about in general is putting the, you know, whether the web application firewall or doing anything that you can at the edge, because you're, you know, back when you get down to the, uh, the, uh, XDRs and things like that, you're not controlling those specific tools, right? So it's doing whatever you can at the edge to look at the traffic and determine where it's originating and where it's, you know, from the inside, from the outside and the, and both, you know, the, the, by, uh, I'm, I'm losing my word, but the, the two-way traffic, if you will. And so that's, that really is, is, is managing it that way as best you can and putting the tools in place to control it, or at least monitor and, and alert. Um, um, so the user security really starts at the end point. So, um, you know, we are very, very, um, operationally made SLAs, short SLAs for patching. So, so we kind of have to start from the end point itself and not just the user. So we have, for example, five days, three day SLAs for Microsoft patches. We have eight hour SLAs for Chrome, Adobe, and so on. So, so we enforce these things, which I feel will eliminate maybe 80% of the problems, give or take. Um, so, so, you know, it's not really let the user just secure the user, secure the end points, and then you can also secure the user as well. So in addition to that, we have, we have notifications alerts, uh, that we manage in, in a way where if a person, if our account is trying to log into a lot of end points at one time, or, or actually doing things that have some anomalies, including entry ID geolocations and so on, um, you know, we immediately reset their password and, and, and reset their, uh, MFA tokens. So, um, you know, there's just really pro productive things you can do without actually having to do an overkill that will give you a lot more, uh, you know, a lot more secure than, than, than you may unfortunately think. Unfortunately, I can't mandate anything, um, I can suggest, but, um, we're, we're getting better at onboarding. Uh, so when we onboard a new customer, we go through kind of what their security stack is and, you know, what are you doing? Um, most of our customers are Microsoft customers. So it's very easy to kind of click through and enable some of the, the tools that they have. Um, I would say 85 to 90% of our true positives are identity-based attacks. So it's, it's, it's huge. Like BCs. Um, so, and the nice thing is like with the fidelity of logging nowadays, you can kind of tell when they don't have two factor turned on or they're using legacy authentication and that type of stuff. So, uh, really just kind of searching through the environments. We had analysts who will go through all the time and be like, Oh, you have legacy turned on here. You know, please fix it. Um, again, I can't mandate they fix it, but I can highly suggest that they do. So that's kind of how we're, we're dealing with it. Um, and on the executive side, there is mandates around like what they have to have. So that makes it a lot easier. Um, so that's kind of how we're, we're, we're protecting identity. Great. Thank you. Three more questions. Hi, this is Ali. Uh, I am public sector leader of Turkey and I have some guests from, uh, you know, our customers, local government leaders. Uh, they are also curious about, you know, uh, all government entities around the world have their, uh, both global and local restriction, uh, compliance requirements. How do you ensure that you are compliant while using a platform like Cloudflare? Um, from a compliance perspective, uh, within New York city, we are actually governed by office of, uh, office of technology innovation, OTI and a New York city cyber command. So there's an entire, uh, compliance team over there and, and, and they make sure we actually try to keep the SLAs, especially on critical SLAs, uh, so, and, and, and again, compliance, you have to kind of look at yourself first, but before you can actually worry about the compliance guys, because they're at the end of the day, I mean, it's, it's, it's paperwork, right? You're, you're, you're doing something, you're sending emails, but if, if you can, if you can create a operationalized based solutions, then the reality is your, your compliance percentage, uh, from, from an incompliance percentage actually just significantly drops. So, um, in a while we, we try to keep to the SLAs on a lot of things that we face, um, operationalizing, uh, things in play and, and making sure that it gets done and really be adamant about it, uh, is, is really where I start. And the compliance teams at that point have, they don't come back to us as often because our, again, our compliance is not as bad as maybe some other agencies. And Matt, if you want to answer that when you can, we have a few minutes left. I want to, I want to be able to get to other questions too. Um, but if, if one of you wants to add anything on, uh, we have a lot of audits, um, for the state on the executive side. Um, one thing that I will say with compliance is that I've seen plenty of organizations that are compliant, but that doesn't necessarily mean that they're secure, right? So you want to kind of validate, validate kind of what's going on in their environment, which is why I love working for the SOC, because I can just kind of dive into logs and be like, well, you say you're compliant, but not necessarily true. So that's kind of where I come from from that. There were two more on this side. Um, kind of segwaying off the previous question, uh, newer security tools, as we saw this morning are going to leverage more AI. And in terms of the different, uh, nature of predictability or lack thereof, does this represent new procurement challenges and how is a public sector hoping to tackle those? So if I understood, I think, you know, from our standpoint, it really is, um, you know, it's an overall analysis and hopefully not analysis paralysis when you're looking at the tools that you're looking, you're asking about the tools that we are purchasing. Is that, yeah. So I, and it really is going through and, uh, I'm, uh, you know, my, I try to be the buffer for my staff. So we're not so, so huge. So I basically, I attempt to listen to every vendor that knocks on the door. It's not easy, right. But I, I don't have, I don't, I really don't have someone to feel that, but I try to do that and then be the buffer so that I'm not tying up my staff with, with analysis of tools and whatnot. But if this sounds like it's worthwhile, then let's, let's take it to the, you know, the folks who know, and I'll take it to my staff. Um, and it, it basically, that's what it comes down to is there, there's a flood of tools, right? And you can be doing it. You've been developing something internally. You're looking at everybody's, everybody's got a tool that they, that they say we need, right. And it's just, and it's true for the corporate, the private sector as well. Right. But, um, I think that's really what it comes down to is just weighing and, and sort of looking at it from an RFQ or RFP or an RFI type of standpoint, even if that's not really the way it was put out there to look at something, but, but bring it in. Let's look at the different vendors. Let's look at the different tools and do weighted scoring for that. I think from a technical perspective, we're kind of looking at what models they're using, model pinning. Um, and, uh, the state itself is still working on that, but from my personal perspective, I'm kind of trying to move towards like on-prem inference, um, building my own tools, using, uh, open way models. Um, and that way I have a little bit more control. Um, if we're, if I'm looking at a tool that is, uh, you know, being sold to me, I'm looking at, um, where they're hosting it, you know, the same requirements I would normally put around any vendor. Is it posted in the United States? Is it being run by people in the United States? That type of stuff. All right, great. So let's do just a quick, uh, lightning round to, to close out here. Um, so what, what would be one piece of advice that you would have for other state and local technology leaders here in the room and elsewhere, other service providers and, and, and vendors here in the room? What would be one piece of advice that you have for them and helping you address the types of challenges that we talked about today? You know, I think it's the, to, to sort of for us to determine the challenge and put it out there, but it's looking at and saying, you have to, you have to map your environment and that mapping means mapping the, you know, exactly the systems you have in place. I mean, it means mapping the network, but it also means mapping your audience, if you will, the, the, like the, for us, the various departments and whatnot, uh, and, and sort of mapping it out that coming into the role with no real understanding of the environment, uh, that, that type of thing. And then looking at things, what, what do you, what do you need to do? What do you, what can you put in place immediately? Like we talked, I think the first question for me is looking at it and saying, what do you need to do? What do you need to replace? What's your timeframe to do it? What's your budget to do it? How do you budget for it? And then, and also looking at it from the standpoint of, um, then moving forward, putting the back, putting the guardrails, if you will, around that, using, using those tools, the web application firewall, the Zero Trust network, where you need to isolation and, and doing, uh, um, as I said, micro segmentation as well as, uh, immutable systems and things. Where do you do that? And that's the, you know, that's the thing is you have to come in and how do you, you know, walk into an environment like this? So you have, it's, it's the 30,000 foot view and how do you get to 10 and how do you get to five quickly? And it's, it's not easy, right? Then, and we're, again, we're a mid-sized environment compared to some of the others. Yes. Um, for me, um, essentially first thing you want to really do is just try to reduce your footprint as much as you can. You don't want to be skewering. You don't want to be skewering things that you don't really need to manage. So, um, that's one of the first things that I did. I actually went ahead and looked at the entire, um, um, security, I'm sorry, uh, tech tech stack and see what I could do to reduce, uh, the tech stack overall, and then, you know, deal with whatever else is in front of you. And then try to operationalize security in a, in a manner where it just makes sense and it's not very complex so that you can actually make the, you know, you can actually move forward trying to, uh, resolve everything at once. And, uh, the last thing, and I said this before is, you know, you have to scan your public facing solutions and make sure you scan them, uh, and, and, and then just deal with those in that level that at least, you know, what the problems are before anybody else gets to it. I, uh, I wouldn't say that there's not necessarily a fear of like agentic probing and all that type of stuff, but I do believe there's like a certain amount of FUD surrounding the run around that. So I would say like, uh, cyber hygiene still applies, right? You want to let your attack surface, um, as much as possible. Um, you want to put things up like WAFs, uh, if you can't. Um, and I think, you know, we see like a billion probes per day, but what does really a probe mean? You know, the automated scanners are everywhere. Um, and then, um, know your environment, uh, inside and out. That's a huge, you know, a huge issue. We go, I used to do, uh, forensics for a long time. You go into someone's environment and they have no idea what's going on, right? Like, um, that's even gonna get worse if you do suffer, uh, kind of an LLM style attack with agents. Like it's, it's even more complicated now. So knowing your environment is, is crucial. Um, and then things like automated pen testing, always testing your environment is going to be huge in the future. Well, John, Doha, Matthew, uh, thank you very, very much for being on the panel. Thank you for the partnership that we have with each one of you. We're, we're honored to be able to help you solve some of these problems. I'm, I'm glad that none of you had to start over, uh, uh, that, that, uh, that we were able to help in, in terms of addressing some of the challenges that we've talked about today. I really, really appreciate you coming to San Francisco, being a part of this connect conference and to everyone in the audience. Thank you for joining as well.