Rethinking insider risk for a workforce of people and agents

Talk today, Rethinking Insider Threat in an agentic and AI world. You know, how things have potentially changed. We're going to talk through some of that and go through some scenarios and things here. The cast of characters here. Photos look very relevant to Insider Threat. If you've all picked up on LinkedIn anytime recently, the one photograph that was tied to approximately 120, 130 profiles. Yeah, I mean, we all fit the bill here, right? But we'll let each one of us kind of go through and introduce ourselves as we get to each one of our sections. We're going to break it up into four different sections, each cover kind of a topic and some things and then go to Q&A at the end. So we're going to kick it off with Ryan to start. So, Ryan, you want to jump in? Hey, everybody. I'm Ryan LaSalle. I'm the CEO of Nisos. We're a human risk intelligence company. We're a great partner of Cloudflare. They use us to help find some of the insider threats and help prevent employment fraud. So I thought we'd spend a little time today talking about a little bit of those external signals of what we're seeing in the market of what we need to be ready for. We are going to talk about, to Craig's point, agentic AI. We're also going to talk about how human adversaries are using AI to get jobs inside companies. So a couple of stats for you. Gartner feels or is saying pretty strongly that by 2028, one in four candidates are going to be fake. If any of you are working with your recruiting teams today, you're seeing that there is an onslaught of bots submitting resumes. There's an onslaught of people going through all kinds of credential inflation. There's diploma mills. These are all the things that have been going on for years and years and years. Now, with the advent of deep fakes and nation states industrializing these attacks, it's going to get much, much worse. I think the second piece in there is that a lot of hiring managers are seeing that 60% of the interactions have some sort of AI misrepresentation, whether it's inflation on the resume, sometimes assistance in skills tests and other things like that. But there seems to be a general inflation of capability of candidates. But then more importantly, most people feel like they're not ready to counter that and detect it. So the notion of if one in four is fake and we see it pretty prevalently and now we feel like we aren't prepared, we thought this would be a good conversation to have because we're going to spend more time talking about the how-tos than the problems. And we'll get into that as we go. I'm going to start with a case study, though. This case study is from a cell that my team encountered last year running an operation on. You might recognize some of these pictures if you're on TikTok. We are sort of TikTok famous right now. We just hit 11 million views on an NBC News story that was about this operation. But last summer, we had a role open for an AI engineer on our team. We've been doing North Korean employment fraud investigations and publishing about it since 2023. But one of these guys actually applied for a job with us. And we got into the interview over Zoom. We realized what was going on and we decided to run an operation on him. So we reached out to the FBI. We went through a set of guardrails and we hired Joe. That's this guy up at the top left. Joe, the guy on the top left, has 15 years of full stack development experience. He's got rag experience from his job at Best Buy in 2015, a technology that came out when Meta released it in 2022. So he is ahead of his time and wise behind his years. But we noticed a bunch of things about Joe besides the weird age discrepancy from his resume. His resume, all those things in blue, exactly matched our job descriptions. They are using AI to create the personas and create the resumes. And I'll talk about what tools they're using as we get into it. In the middle, once we hired him, we sent him a laptop. That's what our laptop could see. We ended up inside a laptop farm in Florida. The first red flag we saw from him besides all the weird behaviors was he changed his address right before we needed to send him a laptop. He actually asked us to send it to his mom's house in a different place. When the laptop opened, that was the closet. Cloudflare is an infrastructure company at its heart, and so many of you may be network engineers, and hopefully you're deeply offended by the cabling in this closet. I sure was. But actually, we've blurred out the names to protect the innocent victims, but we can actually see from our camera the names of the other companies in there. There was a healthcare company. There was a mortgage company. There were a bunch of other companies who were in the closet with us. And the guy who ran the closet was smart enough to know that he never showed up on camera, but they plugged in a KVM switch, and they started remoting in, and Joe logged into our laptop with his personal credentials. Once he did that, the operation really began. Because we could see all the things he was doing all day long. Mostly he was applying for jobs and creating purpose -built resumes and sending them off. He was applying to and interviewing for over 70 different jobs a day. It was pretty crazy. But he also logged in to his Google Wallet that gave us all of his other credentials. So we followed those into a Discord server where we found the cell he was part of. So this was an entire network of 22 individuals going back nine months who had applied to 170,000 jobs and landed 76 of them. We started pulling down the job offers out of the Discord server and calling companies and being like, Joe's not a real guy. Michael's not a real guy. And all the personas and tried to burn them down a little bit. We found four different laptop farms in the U.S. from this. One was part of the NBC story. One was part of Nicole Perlroth's podcast this summer called To Catch a Thief. She actually went and knocked on the door and talked to the girl who was running it. That's their leaderboard, the dashboard there. They actually measure everybody and metric them. It runs like a competitive pyramid scheme. And the guy who's got the top bidder, the top number of applications to jobs is at 27,000 jobs. The top employment, the guy who lands the most jobs, landed 19 jobs over the course of this nine-month operation. He didn't do all of them. Some of them he handed off to other folks in his cell. Some of them he went out and outsourced to other job boards to go fulfill the jobs. I thought there was a couple other things that were interesting. One is that's their shared team calendar. That's all the interviews they had in one week in September last year. Like it is a whole industry industrialized to get jobs at U.S. companies. That's their only purpose is to harvest payroll and fund the nuclear regime. But down at the bottom, they're kind of cheap. They shared one chat GBT account across all of them. And they were using it. Let me go to the next slide. They were using that actually to get through. I don't know. We got it. There we go. New here. Okay. They were using that account to get through their interviews. So when we were interviewing Joe, he kept looking off screen every time he'd answer a question. He would say, hmm, very interesting. Let me think. And then he would look over here and he would read his answer to us. As we were watching, they actually got better at, they kept getting caught doing that. And so they actually increased their technology. And they built a teleprompter screen that was a transparent overlay over Zoom. So they could read their instructions while maintaining eye contact with the camera. And it was chat GBT that was powering the answers to their questions. Technical questions, personality questions, questions about the university they went to. Whatever questions you throw at them, chat GBT was answering for them and they were spinning it back. But like I said, they're cheap. So they maintain one account across everybody. And there was actually a budgeting discussion that said you could only maintain up to $20 a month of spend. So they were starting to stress the system. But also when new models would come out, if they were thinking too hard, it would slow them down in the interviews. And so they would actually have performance conversations around which models to use to allow them to speed through the interviews more naturally. So that was pretty interesting. But they used AI in a lot of different ways. Some of these things are things you can detect when you're as a security partner to HR. Some of the things are a little bit harder. But they used tools to build their personas. To create the resume, they actually used a bunch of open models on their laptops. But they used other tools as well to try to gauge whether they looked the age of their persona. We talked about passing the interviews. They used face swapping tools. And I think we've seen a lot of people trying to counter that. But as those tools get better, as virtual cameras get better, those are going to be harder and harder to thwart. You're going to have to kind of really train HR to become a deepfake detection capability. And then finally, they actually, once they land the job, they did the job. They were using tools like all of our engineers use to be able to deliver at or above their proficiency level. Most of them were pretty good employees. Most of them got caught because they had to miss meetings because they were working so many jobs that they couldn't make all the FaceTime stuff. But they're all individual contributors. They're all working remote jobs. And they're all getting better and better at passing for legitimate employees. Which is a little bit of just setting the table around the story that we're going to be working through on how do you, if insider threat happens before you even hire the people, how do you move earlier, left a bang into understanding and preventing that from happening? How do you build your trusted workforce? How do you pull all the intelligence that a company has around its candidates and its people to get smarter and smarter about sourcing that stuff? And then how do you respond effectively? And that's what we're going to be going through today. That was awesome, Ryan. You know, it reminded me of one thing. Last year, we had a case we were investigating. And when we were talking to the manager of the team, he said exactly that. He goes, what? That's my best employee. I want to clone him like 20 times. And I mean, it's crazy to think these guys are out there doing it just for economic reasons, but actually slinging good code. They're not putting implants in. They're not doing anything. They're literally just trying to keep that extra 150K in. I'm Chris O'Rourke. I run the React team as part of Cloud Force One here at Cloudflare. So we do the offensive security, pen testing, red teaming, incident response, and insider threat hunting. I've been doing it for about 20 years. Started out in the Army, NSA, and I've worked with a lot of the guys here as well as on our team for almost 20 years. Today, I'm going to talk a little bit off of that and kind of into this new paradigm that we're starting to see over the past year of it's not just the insider risk or the exterior threat actors. But it's the culmination of AI being leveraged internally once they're in the network. And more importantly, AI may actually be your insider. I know that sounds kind of weird. Next slide. So there's a couple of things that we want to think about here. So the access we give our AI is probably the biggest risk we have in the modern world. Last year, everybody was pushing to add as much AI as possible into their environment, which is great. Unfortunately, security teams generally were not involved nearly where they should have been, quite frankly, because a lot of the practices that you have to put in place to secure the data within your network just hadn't taken place. But one of the things that we started finding out is that as you're deploying these agents and these entities inside of your organizations, a lot of people weren't understanding what the agent identity was. What is the purpose of that agent? What is the role of what needs to happen? And they weren't realizing what kind of tools were connected. So just like the insiders that were coming in from the outside where we give them a new account, we give them passwords. You're doing the exact same thing for your AI agents, except most of you aren't. You're not paying attention. You're just giving examples. So a good example is a few months ago, we had a customer who said, hey, we added an MCP server to Salesforce so that anybody in the org can have access via AI. Who wouldn't like that, right? I'm getting ready to get on a call. I'm going to query Salesforce and say, hey, give me all the information. That's cool. But if anyone in here has ever paid for a Salesforce license, you know that you're not going to buy one for every employee inside your organization. So these guys said, hey, we only need one. We got an admin account. So they set the admin account as the account in their MCP server. And after 400 gigs of data were taken and a little post in the dark web offering to sell it, they realized, whoops, we might have had too much access available. So that kind of goes into your biggest gap here, right? The investigation side. When you're deploying the AI, how do you detect it? How do you detect those behaviors? The same tools and techniques we're using to detect people, we also have to apply to AI. Misconfigurations, gathering data they shouldn't, connecting to GitHub at weird hours, pulling down the data. They're an exact emulation of the actual threat actor that's a human, right? Because we're the ones motivating it. The big thing that we're seeing is a lack of or excessive attempts at identity access management. So if you're an economic espionage kind of person, more so than just trying to get a foothold, you're focused on doing your job the right way. You're not pushing security boundaries. But if you're one of those remote workers or you're an insider and you're trying to gather more information out of the company, you're constantly trying to elevate your privileges to get that data you're not supposed to have. There's usually key indicators of this. You see people trying to access systems they shouldn't. You see the alerts and logs. And largely, we pay attention for people, but we're not logging. And when we are, we're not paying attention to the logs of the AI trying to do the same exact thing in our environment. Of course, exposed credentials is a big one. Some of the AI hoovering, recently a customer I was working with, they were using Google Drive to share documents. And I mean, we know we're going to tell everyone don't put passwords in a text file, but people still do that and dump it into Google Drive. Well, unfortunately, they were sending an email to a customer. The customer responded. They had an automated AI responder. And it decided it was also going to regurgitate a whole bunch of passwords and configuration data that happened to be stored in a drive. Now, I'm not blaming Google for that one. I'm blaming just the structure of how it was set up. But that's a pretty wild one. Imagine you run a store where you're selling clothing and someone says, hey, I got a medium t-shirt. I needed a large. It's like, cool, we'll just SSH into this box here, gather this data here, and you can have our bank information. That'd be pretty cool. I get a large t-shirt and some money. I like it. And then the final thing that we start working about is like, how do you mitigate it? How do you stop those scenarios from happening? Well, you kind of have to build a privileged situation where it's least privileged, just like you would with the people. The same thing when you have an employee who's coming in that you don't know. You kind of put those restrictions on to stop them from accessing. You do the same thing with your AI agents or your harnesses, whatever you've built. Right. You need least privilege. You need approval gates for certain types of actions. If you're doing like CI, CD, where you've integrated the AI components into it, you need to have the right people looking at it, just like you would with any other human. And then you just need to model the activity. And what's scary about all of this is that when you take a remote worker and they're able to come through and use AI to get in, they're then able to take your AI and token spend to do their job for you. So in many of these instances where they were hiring other people to fill the job, now they don't even have to do that. I mean, we're in the age of Muse and Rockbot and everything where it's not infeasible to think that one of these scammers will get in, they'll get the job, and they're going to set up a bot. And it's going to do 80% efficiency. But you know what? 80% is probably still 60% more than the average person when you see the amount of code that's coming out. Right. So you're going to have AI be this next level component of these remote worker scams or even insider scams. I'm not going to say that I don't use AI. I use it quite a bit. I love it. It's everywhere. But you're going to find that there are going to be points where people are going to automate their job and just kind of disappear. And so that insider risk is still going to be there. It's something that I'd be well aware of in your environment now. If you're not, make sure you understand what the AI has access to. And that leads us into Saurabh. Hi, everyone. My name is Saurabh Zaman. I help lead our internal search team, which covers security incidents, covers insider threats, and any investigative function here at Cloudflare. So you guys heard Ryan kind of give the overview from a external intelligence standpoint, like when you're actually tracking campaigns and you're tracking people. What does that look like? Right. And then Chris talking about AI and talking about like, yes, AI is a big risk. Right. It's not just the AI itself. It's the humans also using the AI. Right. So I'm going to be talking about when these threats start to manifest. Now they're hitting you at your front door. What do you do? Uh oh. Insider threats took our slide over. All right. Perfect. Yeah, we definitely plan that. But I like to tell stories, right? Got a bunch of nice pictures up here. So Ryan actually mentioned KVMs, right? That is part of tradecraft that many insider threats will use, whether it be DPRK, Nigerians, so on and so forth, because it allows you more access, right? If you're shipping out a laptop somewhere, you need to access it or someone else needs to access it. But what should an organization do, right? As with security alerting, you do have to fine tune what you want to detect. So I'll walk you through a story of we received an alert. It's always three o'clock in the morning, always for some reason, right? Every security issue happens at three o'clock in the morning. So we received a security alert. And what's it saying? It's saying IP over KVM. There are probably legitimate uses for KVMs. But if we were to just run at every signal that fires, right, we would spend a lot of time just triaging and a lot of toil kind of going through everything. So the approach that we take, heavy user of AI, right? But if you're going to identify insider threats in your environment, right, as similar to security alerting, right, you want to compound signals together, right? So in our scenarios, it's like we're looking at, okay, yes, you have IP over KVM alert. But what else is happening, right? We have a home-built UEBA that will look at variations of access. It will look at anomalies and such and so on and so forth. By themselves, it may be very noisy. But together, combined with multiple signals, it paints a story, right? So let me walk you through this, right? You get an IP over KVM alert. While you're looking at it, our agents will go and pull some information in which you can say, hey, user X, the same user that we're looking into probably, right? User X, well, there's anomalies in access hours. Strangely, their working hours is aligning with Asia. I don't know why, right? They're working at night. It's supposed to be in Austin, Texas, but they're working at night. The next thing, for some reason, you see a long duration of Zoom sessions. Most organizations will use Zoom or some type of messaging platform or chat platform, whatever. Whether it be Teams, Google Meets, Zoom, whatever. But there's something about that, right? Because you can actually give remote control access. So that's another way of allowing other people to access your host or access data that belongs to a particular user. And what else? Well, unapproved AI usage, right? So Cloudflare, obviously, like a lot of our talks today are about AI, right? The adoption of AI. How do you build safe AI? So on and so forth. So Cloudflare does adopt and we own dog food, right? We have Cloudflare OS, which we adopt internally. We have a lot of workflows. A lot of our sort of alerting workflows or SOC workflows or cert workflows or insider workflows are AI assisted. We add human in the loop. But what ends up happening is that, okay, you have the sanctioned AI and then you have the unapproved AI, right? As kind of Chris was talking about, right? Like AI can be either your friend or it can be the gateway into leaking a ton of data. But the unapproved ones is something that we all must look for, right? As an organization, we should have a common path. We should have a common tool set, a common way of accessing AI so we can control what data goes in there, what data does not go in there, what controls do we need and so on and so forth. So if we're tracking anomalies in access, long duration of Zoom sessions, unapproved AI usage, and there's a high number of unapproved software, what's going on? That itself together paints a picture. This person, maybe they're giving remote access, right? Maybe they are allowing other people to access it. Maybe they're developing something and they're using unapproved AI tools because, for example, we have AI gateway. The prompts that you run in our gateway, we're going to see them. Maybe they know that. Well, they likely do, especially if they work it, right? So what this allows us to do, because we can automate a lot of what comes to the forefront, right? We're able to come to a quick determination of, is this a potential insider threat that needs even more investigation? So I'll tell you, as we start investigating it, we start to realize that, yes, all of these things are things to look into. But for some reason, people treat AI like it's their best friend, right? We find a treasure trove of evidence when we're actually, whether it's looking through our AI gateway, looking at the kind of the prompts that they're doing, what kind of work are they doing? Or even if they decide to use unapproved AI, you can actually grab the databases generally from computers, right? And if you were to parse that, that's when you start seeing them asking questions. It's like, hey, I have access to Salesforce. I want to send it here, right? If you use the frontier models, they'll probably say, oh, it's not allowed. But if you use other models, you can likely get through it. But we're finding a lot of value in correlating data, correlating signals, and putting it all together, because you need a bigger picture. Then once you start creating these signals, this may not be the only one person, right? They triggered one alarm, but this may not be the only one person. We can use that to hunt. We can use that to identify a network in our environment. We can use that to identify other individuals. Not only us, right? Through threat intel sharing, we can talk to our counterparts. We can talk to law enforcement. We can identify, okay, maybe this is a trend that impacts everyone. Because honestly, a lot of the tradecraft from these advanced APTs or the VDPRK, the Nigerians or whatever, right? They're not targeting just Cloudflare. They're not just targeting Nessos. They're not targeting just our customers. They're targeting everyone. And they are sharing tradecraft. So these are signals that we can actually look for. What was the number you had? It was something like 27,000 or something like that? Job applications? Yeah, 170,000. Going back to it, we have a company we work with that turned off all recruiting because every candidate that made it through the queue was a North Korean fraudster. And so at some point, it now becomes like a national security issue because people who are trying to get jobs can't get jobs. They've basically hacked, they've DDoSed our recruiting pipelines. And I think the notion of those signals that you're looking for, I love the way you think about it because every step of the way, there's more and more insights you can start to mine. We'll talk about this at the end. But force those decisions and using AI as the synthesis because it's been so hard. The false positive rate on insider threat solutions is so high. It's so expensive to get the right investigations that the more things you can start to cobble together through your own lens, the better and more sophisticated and more agile your enterprise response will be. And the principles are not new, right? Threat detection, whether it's for insider threat or security threats, is not new. We've been doing it for a few years as an industry, actually many years. So you apply the same principles, maybe the actors change, the tactics change, right? But it does come down into the noise to signal to alert ratio, right? How can you get more efficacy in what you want to alert? So that even by us using AI, like, okay, why do we do that? Because we want our teams right there. Because we want to have our team be able to act very quickly with information, right? So you also want the human in the loop. But just to kind of take a step back real quick, right? In the last scenario, I talked about like once the threat actor gets in, how do you detect it, right? What do you do? But it doesn't start there. There's a whole story here. Your controls or what you do to protect yourself actually starts at the inception of the job posting, at the inception of onboarding, at the inception of the applications, right? So kind of break it down, right? There's pre -onboarding and post-onboarding. But if you think about the sheer number of applicants that you start getting, right? If for one job, two jobs, three jobs, it's a lot. But that's also a data source, right? Because we're seeing similar experiences, different names, maybe even similar headshots, right? Anytime there's the same headshot over and over again, we'll change the name, right? John Smith, Tim Smith, whatever. Whatever name you could think of, it's there. But what we're seeing is that at that inception of when they're applying, right? There's a lot of information that you have. You can actually correlate resumes. You can correlate experience. You can correlate even techniques that they use to build their resumes, right? Are they using publicly available tools or are they using software tools to generate their resume? You can check to see if the content's AI generated as well, right? There's a little bit more deterministic models that are kind of coming out. Not fully deterministic, but more deterministic. You can use that as well. But the emphasis here is that at that pre-onboarding stage, right? You can actually filter and assign risk scores to the applicants that are actually trying to apply to your jobs. So, that's when they're applying. You can look at their resume. You can look at how many... So, you can create a cryptographic score of a resume and say, Hey, this is a unique value of this particular resume. Where does it match up? Everywhere else, right? You can identify similarities there, right? If you have 500 resumes that look almost exactly the same, just the name is different and the phone number is different, and sometimes they mess up. They use the same phone number, right? That's your way to take things out. But like, obviously, you have to work within the confines of laws and so on and so forth, right? But so that you start there. But then what? So, insider threat is not just the security folks, right? It's not just your IT people. It's not just these guys here that we bring in for help, right? It is the HR people within your organization. It is the interviewers, right? Obviously, we don't want... Interviewers are not going to be the experts of identifying insider threat while they're interviewing them. However, giving them telltale signs of what things to look out for, right? It's better to tell us or raise your hand if you see something suspicious rather than assume that, no, it's fine, right? We've actually gotten a lot of traction just at that stage where interviewers are saying, hey, this person looked very suspicious based on blah, blah, blah. It looks like they're using AI or whatever the case is, right? But that's a training thing. That's a cultural thing that you have to build within your organization as well. And then as you start kind of moving down the chain, right? Like, you have to validate their experiences. If you're at offer stage, right? That background check is extremely important. How many times have you guys seen that like the person applying is dead, right? Or it's like a stolen identity. We've had instances where it's a stolen identity and this person has been dead for like 10 years. We're like, wow, where'd he come from? But that's quite important. And then adopting technologies that forces people to verify as well, right? Whether that's through the background check, submitting all your documents on time, submitting your identification cards, and making sure that you actually correlate and identify it, right? Sometimes in the fog of trying to hire very quickly, we bypass. But it's very crucial that we do not do that, right? To the best of our ability. So as you kind of do that now, you're still coming in, right? So this is kind of pre -onboarding now. We talked about what happens when they come in, right? But inside a threat, it's not like you can have one alert, right? We talked about the IP over KVM stuff, right? Like the threat actors know that we know that they're using this. So they are changing their tactics. So a big thing about insider threats is that, like, you have to look at behavioral anomalies, right? It's not like malware here, IP address here, right? We got them. No, you have to look at, like, over a period of time, right? What is the normal for them? What is the base normal for them? And if they deviate, is it always bad? Maybe, right? But if they deviate, why are they deviating? There's always a reason why, right? And you should be able to track that. And then you have to correlate the information, right? As we talked about, like, hey, when we're doing investigations, we're actually looking back into that data set of the applicant pool, right? We're looking at resumes. And we're looking at the activities they're doing while they're in. And we're looking at, kind of, what are they doing? What are they accessing? What is out of scope for them? What makes sense? What doesn't make sense, right? You have to kind of try to identify that information and categorize it. And then, let's say that after you do all this stuff, what happens? Well, it's continuous lessons learned, right? So, this may lead to, you might fire someone. You might call the FBI. You do whatever you need to do, right? After you have enough data. But the investigations don't happen in a vacuum, right? You must apply these lessons learned and go back. And if you think about it, like, go back to, what can we do better at the pre-onboarding stage? What can we do better at the post -onboarding stage? And then, what can we do better when we catch them? Because sometimes when you catch them, to isolate them, to get them off your network, it's tricky. Especially if you're a global company as Cloudflare, right? If you don't have solid proof, it gets very difficult. Especially with employment laws and so on and so forth, right? Your own policies, whatever the case is. So, you have to have or think about these things beforehand and try to make a game plan. Now, I know I talked a lot. I hope everyone kind of took in what I had to say. But, like, there's a very important piece here, which I'm going to pass over to Craig. He's going to talk about the organizational alignment. It's not, like I said, it's not just a security team. Yeah. So, Craig Struppard, I lead our incident response team, threat, intel, engineering, insider threat, red team, a couple other things. But organizational alignment, you heard from the conversation here, just from the three people talking here, like, this is clearly not just security, right? You've got to have partnerships throughout. I'm going to go to the next slide here and kind of talk through some of these partnerships that we found valuable, that others, I think, are probably finding valuable. Just going through the list here, HR, recruiting, right? Some of the things Ryan talked about in Joe's case, right? He was very much using AI in his interview process. Shirao just talked about it in some of the feedback loops and training. How do you train and get your recruiters some of that information that they can then key off of to stop some of this before it even becomes a problem, right? If you can stop it up front, all the better. But you have to partner with those folks. Yes, they're probably thinking, like, you know, could this be an insider? Could this be the remote work person we're looking out for? But, like, the reinforcement of that is key, especially for those people that are the front lines. That goes for hiring managers as well, right? It's not just recruiting. Like, everyone in here that's a hiring manager should be able to get that same feedback. So as you're giving that feedback to HR, is there broader comms that need to go out across your hiring base? Like, hiring managers, go to this wiki, take this training, whatever that is. You catch four or five more, great. That's four or five more that he doesn't have to deal with and deal with all of the mess that he just talked about. Legal privacy, are there lawyers in the room? Anybody, a lawyer, want to raise their hand? Good, we don't like them anyways. I am absolutely kidding because I say that, but we fight with them all the time around things like, on the front end, resume gathering. I would like to collect as much telemetry as absolutely possible on the endpoint and the browser and everything about that user so I can take that and follow that all the way through their application process the next time they connect to Google Meet, the next time they connect into whatever system we're using. Legal privacy says, well, guess what? In certain countries you can't do that and only certain data and all of that. So, as much as I say I don't like them, I like them because they keep us out of trouble. There also are, hey, we found this, how do we go about handling this? Do we need to get legal or law enforcement or FBI involved? So, as much as I say I don't like working with them, they're very, very important. Establish those partnerships if you haven't already. Shirav also brought it up too, you need to exercise those things. So, rather than being in the middle of, hey, we found Joe, who's obviously a problem, how do we handle this? Hey, what if we find Joe? What are we going to do? Who are we going to bring in? What evidence should we be collecting and storing and sharing with outside counsel? Who is outside counsel? Like, do I need to call Chris and get an IR engagement going because this maybe exceeds our forensics capability? So, all of that is stuff that you can be planning out ahead of time and you start that with conversations and partnerships, right? If anybody's involved in insider threat, again, it's not just a security thing. IT, they manage your endpoints, right? They have views into software that's on them. But more importantly, Joe, again, back from Ryan's presentation, hey, I actually need that laptop shift to my mom's house or I'm traveling this week, send it to New Mexico where the other laptop farm was, right? So, like, how do we as security or IT flag that and raise that? Like, okay, maybe it's legit. Hiring manager, did you know this person's going to be in wherever instead of their, oh, that could have been bad, their home base, right? So, how do we handle that? How do we train them to look for those things? The other part I didn't bring up in HR. Somebody on boards, they change their payment. Where are they getting paid to? From their initial bank to some random other location, to another bank account that could be DPRK, right? Or an offshore account that they just use to funnel money through. Well, how do we get in that loop? Because that's not something security would typically, like, I need to see your financial payment logs. Someone's going to look at you a little funny if you're asking for that. But if I say, hey, I'm looking for this scenario, now we can have a conversation and we can talk through the workflow of how to get that. Then the business side. No matter what company you work at, the eyes of the company are all of you, all of your users. The people that maybe sit next to somebody or are on a meeting with somebody, teammates of somebody. This person's never on camera. Actually, they were on camera one time. They didn't have an accent the second time they were when they weren't on camera. Like, okay, now what do we do? How do we report it? All those processes. So, again, the partnerships across these teams are key. The other part I'll bring up, Sharaf highlighted it a little bit with the feedback loop. Let's just take Joe, for example, from Ryan's scenario. A feedback loop, like after the investigation's done, we get it to the authorities, all of that. Sit every one of these groups down. Security, HR, legal, business people, hiring managers, whoever. Let's talk through Joe. What do we know about Joe? On the front end, recruiting, what did you see? Did you have any notes in your talent management system that says, you know, I might have a concern about this guy? Like, I think he might be looking over here to gather answers, but I still passed him through because he answered everything correctly. Like, okay, maybe that's something we need to highlight. IT, again, with the laptop. Well, actually, he requested to ship it there because of this. Okay, now we got a flag, right? You can do all of this in that feedback loop and reinforce these things, honestly, and find new things that you may not have been looking for. Some of the software that we find, remote access or just use, is a great feedback loop into, like, our threat detection teams, right? Of, hey, this might be new. Or we get something from Anisos that says, hey, we're seeing new tradecraft. Like, hey, we want to put that into our systems. How do we look for it? The business side of things. Again, how do we get in front of those managers and say, look, we saw this happen here. Real-life Cloudflare scenario. This user did this. He was running long-running Zoom sessions. Again, joined video one time, no accent. Second time, no video accent. Hiring managers. Like, this is a key, right? Like, these are key things to be looking for. You have to raise this. So getting involved across your business is the only way this is successful. Because there's not always going to be the alert to him. If you heard what Ryan said, right? Like, these guys are producing output. If they're your top performer, why would you question it, right? Like, they're doing good work. Let them go. But there are other signals out there outside of the digital signals. The digital signals are super important. We should continue to evolve those. But these partnerships and exercising that process, those feedback loops as you find these insiders, go all the way back to resumes. Look at the resume. Are there things there that should be keyed on? Interviews, notes, onboarding, financials. Like, go back through the whole entire thing and just see if you can strengthen this program you have built and the process you've got built and maybe exercise them, make them better. Yeah, I mean, I don't know if you guys have anything else on the organizational side. No, I think one interesting thing is that, you know, in the experience we've had with investigating a lot of these, it's very rare that it's just one person. Many times, once the first person gets in, they start referring additional people. And we've seen nested as many as 25 people in an organization that were all parts of these kinds of groups. So, you know, once one person gets the foot in, they understand the process. It's quick, it's easier, it's repeatable. And the second one, to bring up your point about, there's a lot of human element in all these cases that we've worked in. I imagine it's probably been very similar for some of the stuff with Ryan is that in every one of these instances, all the red flags were there. And when you talk to the people that interact with them, they will tell you they saw the red flags. But oftentimes people say, well, I had a deadline. I had deliverables I had to meet. He was pushing good code. I wasn't going to rock the boat. And that's kind of a weird situation too, because now you have people who are almost willingly saying, I'm going to accept that there's an issue, but my mission is more important. So you need to create an environment that encourages people to actually share that things are going on and maybe not be so strict on their deliverables to where they're not going to feel compelled to share that that's there. But it's been an interesting one. And the other part is, even with all these controls in place, we've had an experience where some of these guys are taking advantage of just geopolitical issues, generating IDs without necessarily being an actualized citizen, creating personas, stealing someone's information, their resume, generating a fake ID or a legitimate ID actually in another state and then shipping the laptop three houses down. Like these guys are smart. They're not novices in what they're doing. And I imagine, Ryan, you've probably got some input on that as well. Yeah. I mean, they're exploiting, they're exploiting their remote work as a new attack surface for every company. And identity is the bulwark against that. And there are fair ways to exploit all the different processes and systems to generate the identities. The other thing I'll just say is incentives matter a lot. Chris mentioned about like, they're my best coder. I just sort of had to look the other way because they were doing good work. Recruiters' number one priority is to fill that job as fast as possible with the best candidate possible. They are not thinking about how to protect the business from insider risk. Hiring teams are looking for that right skill. They're exhausted having to churn through different resumes. The incentives aren't aligned. Security's best and highest purpose is to figure out how to enable those incentives to also manage risk. So for the recruiter, it's about time savings. You're spending way too much time talking to too many fake candidates. Let me take that off your plate. For the hiring manager, you're spending way too much time trying to scrutinize whether this person's using AI to answer their questions. Let me take that off your plate. For the poly worker, who's trying to work multiple jobs and work across your business and expose your IP to your competitors, let me help the legal counsel reduce the exposure of that loss. And so every time security's engaging with the business, it's about helping to hack their incentives while delivering on the mission.