Podcast Transcript

Welcome to Cyber at the Top, a podcast from RSAC that unpacks real experiences, lessons learned, and practical strategies from CISOs at some of the world's leading organizations.

Welcome everybody to this edition of Cyber at the Top. Thank you for listening in. I'm your host Hugh Thompson, executive chairman of RSAC.

Zero trust has become one of the most talked about strategies in cybersecurity.

And in the age of AI, it's more relevant than ever. As organizations adopt AI across our operations and attackers use it to move faster and smarter, the principles of continuous verification, least privilege, and segmentation are taking on new urgency.

Today, I'm so excited to be joined by Doctor. Alissa Abdullah, Deputy Chief Security Officer at Mastercard and recognized as a leader across the industry as Doctor. J, who's implemented Zero Trust at scale to explore what it really means in practice.

We'll also look ahead at how AI is reshaping both the challenges and opportunities in Zero Trust. Let's dive in. Doctor Jay, thank you so much for being here. It's great to have you.

Thank you for having me. Thank you for having me. Very, very excited.

Well, let let me start off just with some orientation to our listeners. Can you give us a quick overview of your role?

Sure. I am the deputy chief security officer for Mastercard, and I lead, an organization called Emerging Corporate Security Solutions. So I get to wear two hats.

One is the deputy and then the other as thinking about the future of Mastercard, how we secure our assets in the future, and making sure we have the right projects and things in place so that we're ready for the future. So it's an exciting role. It's a huge remit. You know, I think about building resilience and making sure innovation and security move together. And it's just really a role about balancing risk and opportunity so that we can all grow securely.

That's great.

I mean, what what a cool title and what an amazing organization.

I mean, Mastercard is pioneering in so many areas and especially in cybersecurity.

And and and let me ask you. So zero trust, it... It's become one of the most used terms in cyber, and I'll just share with you that every year for the submissions that come in for for RSAC conference, we do these word clouds and analytics. And if you went back three years ago, it just dominated the word cloud of terms that people would use. So zero would show up and trust would show up.

It's it's everywhere.

How do you define zero trust in the context of Mastercard?

You know, we we kinda grappled with the definition just, I think, as an industry as the word and... As that phrasing was coming about.

It is not a product. Right? And in in the very beginning, we saw lots of vendors come out and say, I've got the Zero Trust product. I've got a product for Zero Trust.

It is not a product. It is a principle. It is a paradigm shift. We assume breach, we verify everything.

That's what Zero Trust is all about, and it's really more important now than I think it's ever been. There's no implicit trust. So, you know, when we first started the Internet, it was come one, come all, everybody join, you know, connect with me. And we were easily making these trusted connections trusted connections, and we didn't really verify all the time.

And then we found ourselves in a bit of trouble. So now we're saying, wait a minute. There is zero trust. I'm going to assume breach.

I wanna verify every connection that I make. And sometimes that verification is easy, and sometimes it takes a little due diligence. We're spreading that thought e...

Also, you know, externally when you think about...

And it's...

I...

Because I I don't think of it as just a cybersecurity term.

It is a term that I think people should talk to their family about, different organizations and nonprofits about. We have to be in this mindset of zero trust because... We'll talk about this later, I'm sure, but AI is a game changer. And so when you think about zero trust, access is contextual. It is identity. It is device health. It is behavior.

All of those things matter when you think about access. Then when you think about what's in... Whether you're inside or outside of the network, because now we're not bound by boundaries or by a perimeter, everything is moving. And so zero trust means we enforce least privilege. No one gets access... Any more access than they need. They get it when they need it, and they only get it for as long as they need it. And I think that's gonna continue. The fact, as long as you need it, it's gonna shorten and shorten and shorten and shorten.

It's a... It's just a living model. It's a paradigm shift. It is not one moment in time or one project, but it is really a principle around... Or paradigm shift around around how we secure our infrastructure and our networks for today and for the future.

You know, I I love the texture that you just added to least privilege. Okay? Often people forget the as long as you need it part. Right?

And we've seen that, you know, really show up with these credential thefts and, you know, the ability to go in and replay sessions and things like that. It really is kind of a limiting factor. And you're right. AI changes everything.

So how has the advent or just widespread adoption of AI made this more critical for the business? How should people think about AI as as making zero trust an even more important paradigm?

I was in a conversation earlier this week, and I heard someone say zero trust is dead. And I said, you have the absolute wrong perspective because AI accelerates everything. So zero trust is really gonna be critical. I mean, AI accelerates everything.

It accelerates innovation, and it accelerates attacks. And so if you think about it from the fact that it can accelerate attack, I want a zero trust infrastructure, which means I want micro segmentation so that if something were to happen, I have the network segmented in the the right way that's for my organization and my culture and my risk tolerance so that there's constant...

There's just that word again, access going into each of the different micro segmented areas. That is gonna become really, really important because AI scales massively. It's gonna take everything that we know and everything that we love, and it can help us scale it faster and quicker than we ever have before. And so when you think about attackers using AI for phishing, to scale phishing, to exploit vulnerabilities, to evade detection, I really want Zero Trust to help give me the guardrails, the continuous verification, the dynamic access, all of that to make sure I have the right, guardrails in place for innovation and guardrails in places to make sure I'm secure from attacks.

And so AI adoption is...

It will help us not create blind spots, and zero trust, I think, is gonna help us with that too. So I think zero trust is not dead. I think it's a nonnegotiable.

I agree with you. Rumors of its death are greatly exaggerated.

Right?

And it it just needs to be de facto standard, and you make such a great case for it.

What do you think, though, for an organization that say, yes. I want this.

What foundational elements do you think that they need to have in place before they can realistically go down this path towards zero trust?

I get the pleasure of being known as Mastercard's cybersecurity futurist, which means none of my answers can be wrong. With that said, when I think about the future, the future, I think, is going to be based on identity and data.

We're gonna care about the network. We're gonna help... You know, do all the health and health and feeding and and maintaining and innovation in the network piece.

But the main points are gonna be identity and data.

And I say that because you start with identity. If you have access to my data and it's not... And it's anonymized, then you really don't have access to me or information about me. You just have anonymized data and insights.

The other piece of that is the data piece.

Data is is the currency of everything.

And so if you think about it from that perspective, the foundational elements have to be situated around your identity and your data, which means you've gotta verify access. Right? And if you can't verify x...

Access, then you can't enforce the trust at the end. I think about...

If I think with my today hat on, I'm thinking about phishing resistant MFA. If I think about my future hat, you know, we've gotta, like, continuously move past MFA. And it will be...

And when I say move past MFA, I mean the traditional MFA. It will be layered. We will really be thinking about biometrics. And not just one biometric, not just a finger...

A thumbprint or a face ID. It will be multiple biometrics because our information is out there. I've got enough enough, identity theft protection until to last me till I'm 80. So I don't need that anymore.

But, you know, knowing and and thinking about how I protect my identity and how we protect identities within an organization is gonna be a foundational element. We've gotta make sure we know our assets. The visibility is critical, and it's critical before you protect anything. And so...

And I say that because pre AI, we were dealing with shadow IT. Post AI, we're gonna be dealing with shadow IT and shadow AI. So you've gotta think about your assets and those foundational elements as well. So I don't wanna make this sound like, oh, if all you think about is your identity and all you think about is your data, then you can you can ignore some of the other things, but you cannot.

You've gotta...

If you think about your identity and you think about your data, it pulls you to to really think through the network, the device, you know, all of those other areas within zero trust are equally important.

You said it so well. And, you know, things things are changing with AI, and you're right. This this shadow AI and, you know, people just using it because they see results and it's compelling and, jeez, they have personal ChatGPT subscription, so why not? And, you know, let's just bring it into my work environment or work culture.

Given all of this, what unique challenges have you faced when implementing zero trust at scale? Like, I think about Mastercard, and the scale is unfathomable.

How how do you... What are some of the biggest things that you've run into?

Mastercard, we operate in 210 countries and territories all around the world. We are doing billions and billions of transactions every year. And so when you think about something, or security that has to scale, we really...

There's a lot of complexity there. We have cloud. We have on prem. We've got third party integrations.

You know, that list goes on and on. So it's a very highly multifaceted environment, very complex.

But we have, I think, the biggest challenge, which is making sure interoperability happens. Right? Even though we're such a large organization and I think a very, very mature organization, we have to continuously make sure that no matter what lever we pull on this zero trust journey, the identity, the device, and the network all talk to each other, and that interoperability, continues to happen and continues to happen with a good experience. Because if you don't let it happen, if you if you create a bad experience with zero trust, you'll have more shadow IT and more shadow AI, and you'll have, you know, bigger problems.

So we've learned to scale, and scaling demands automation, and it demands strong governance. And if you think about it from that perspective, how much can I automate and how much can I make sure I have the right governance structure around that, then you're well on your way? I will tell you, we cannot run down this this journey of zero trust and forget about the basics, though, because AI is going to really hold a mirror up to your face. I mean, my my daughter does it every morning.

She holds a mirror up, and she's like, where did that bump come from? That's what AI is gonna do. It's gonna hold a mirror up to your face. You're gonna...

And it's gonna tell you and and and really expose all of the holes in your network...

Well, not all, but, you know, just for the sake of this argument, your your vulnerabilities, more than you thought. It will really shine a light on your bad practices and bad habits because just like we want zero trust to scale, just like we want, adoption to scale, well, the threats are scaling as well. The the bad part...

And I I was having a conversation, like I said earlier this week, and we were calling it dark AI.

Dark AI scales as well. So you've gotta make sure that when you're thinking about those unique challenges of implementing zero trust at scale, that you're not deterred, that you start with automation. And if you start with automation, to be honest with you, then you're kinda well on your way and can now really step gingerly through the rest of the journey.

You know, I'm just imagining putting myself in the seat of I wanna do it. I wanna implement zero trust, and I have this lofty goal at the end of feeling like I've got this continuous validation. You know, I've got my identities in check. I know where my data is. I've got AI under control.

What do you encourage people to look at as markers of progress? Like, how do I know that today that I'm better than I was yesterday? Because you described it as a journey, which I think is a really, really great way to think about it. How do you know you're making progress on the journey?

We use a formal maturity model that's based on zero trust pillars of identity, device, network, apps, and data. And on that journey, we score ourselves and say whether we're traditional, whether... Or all the way up to optimal. In certain areas, we wanna be optimal. Certain areas, we want to be on the journey to optimal, and and, you know, you pull those levers based on your needs. I wanna I wanna make sure I I note that it is a journey.

It is not an endpoint. Right? There is no time that you should... That you're gonna look up and say, I'm done. Because let me tell you a story. I started the Zero Trust maturity framework project at Mastercard six years ago. I'm the executive sponsor for Zero Trust in our organization.

And so probably last year, I said, oh my goodness. When am I gonna be done talking about zero trust? When am I gonna be finished with this whole journey? And guess what? We did another assessment this year, and my team said the goalpost has moved.

And I said, no. The goalpost hasn't moved. We have evolved. When we started six years ago, we didn't have AI in, you know, users using AI.

We were using it in the background for fraud and and threat modeling and things like that, But we didn't have it in our infrastructure every day, people wanting to...

You know, really wanting to dig in and use it and play with it and things like that. So the goalpost hasn't changed. Technology evolves. And so as technology evolves, those pillars may stay the same.

But the way you the way you assess and measure progress, you may have to relook at your milestones to show what was optimal yesterday is not optimal today. I tell my husband, yesterday's price ain't today's price when I wanna buy a new pair of shoes. So it's the same thing that that...

It's a journey.

It is a trust model that is actually maturing and continues to evolve. And so I look at faster response times. I look at real time anomaly detection. Those are things that tell us that we're moving in the right direction, but even those things ebb and flow as things become more accessible to us. So right now, we're talking about AI. But what happens in the next few years when we're talking about AI and quantum? Because the power and scale and speed of quantum married with AI, my goodness, that is going to really...

If you don't have have... If you have not started the zero trust journey, if you have not wrapped up the basics, man, you're really gonna have a hard fight to fight.

That's a good way and a sobering way to put it. And, you know, I can remember, and I'm sure you've had conversations like this too years ago talking to board members in general and them almost thinking about security itself as a finite project. Like, hey. We're gonna secure our systems and when...

Or hey. Are you guys done with that? Did you did you do that? Did you already secure it?

And and, obviously, everybody that's in security understands that it's continuous. You'll have to do it forever. You've got an active adversary, you know, all of it. And I love you linking zero trust with it the same way, that it is going to be a continuous journey.

It's not like, oh, great. We started the project x years ago, x months ago, and we're gonna be done by December 15.

It's it's not... It doesn't take the form of something like that.

And it's it's it's good it's good to hear you articulate that. And and I'm wondering, you know, just on AI, and you you talked about it a couple of times already. It's it's such a potential accelerant for the business, potential, you know, accelerant for cyber, and there's so many startups and companies that are coming into the space and, you know, offering AI assistance in all these different areas of cyber. Attackers are using it. They're getting better.

How do you see AI help accelerate things like decision making or automation inside this context of zero trust? Like, are there ways that AI can be used to accelerate that zero trust journey?

Yeah. I think AI is gonna help detect anomalies faster and automate responses much quicker. And I put that in the context of zero trust because when you think about how AI is going to amplify both sides, offense and defense, adversary is using AI to get in, and I need to use AI to power and bolster up zero trust, my defenses, my anomaly detection, my autonomous responses, if I can, and and and and maybe we'll hit on that a little bit, to help make sure that I continuously stay on the zero trust journey. Because AI can be used to buy...

Bypass traditional controls and mimic trusted behavior. And so I want AI on the other side, on my side, to be able to bolster advanced controls, right, and to ensure and reverify my trusts that I have in in tact already. So it now includes AI governance. I think Zero Trust is is going to now really have to double down into AI governance, Monitoring what models do and and who they interact with is gonna be really, really important.

So we treat AI as a part of the attack surface, not just a magic bullet. Right? If I think about it from an opportunity and a risk perspective, you know, you have to think from the perspective of where were we...

I talk a lot about this pre AI and post AI. Pre AI, the adversary still had a help desk. If you didn't...

If if if the malware didn't work, here's the 1800 number to call, and it's a help desk to help you get the malware working so that you can use it to your benefit. So if I think about it from that perspective, from a from a risk perspective, my goodness, the the fact that they are now able to use AI with the level of sophistication that it has, without the level of risk that I have, without the guardrails that I have abide by, without the regulation, I can't fight that on my own. I have to fight that with AI. And now I turn my head and think about the opportunity.

And I I I tease this a little bit as the Mastercard cybersecurity futurist. The opportunity is vast. So I think the future of AI is really AI personas working on your behalf. Like, I really believe some years from now, hopefully, I will not have retired. Hopefully, this will send me into retirement, but the both of us will be sitting on a beach.

And our AI persona will be doing all of our work for us because we programmed it and tuned it to do everything we needed to do.

AI can...

Will easily replace a lot of the thinking tasks. And don't think of the AI that we have now because the AI that we have now is the worst we will ever have. Can you imagine that? AI that...

Now is the worst you will ever have. And I am astounded many times when I'm using AI to do certain things and when we use it within Mastercard, when we look at it for fraud protection, when we look at it for fraud prevention, because that's what we're looking...

That's what we're using it for now to prevent fraud, I am astounded at what we are able to find and what we're able to do. So if I'm astounded now, think about, man, what the future holds. So that...

There's a lot of opportunity there. That means I can work 24 by seven because I won't be working to be my AI persona working on my behalf, closing deals, making decisions, analyzing data, all of that on my behalf as a cyclical...

A 24 by seven doctor j. My husband hates the sound of that, but I think it's a great idea.

I love it. I love it. That's that's great. And, I mean, that's such a great way for somebody to think about it. Don't think about the AI you have right now because it's the worst AI you'll ever have. It's only gonna get better from here.

How do you get everybody else on the journey with you? Like, the vision you paint is so clear. And and what I've noticed about how you describe it is you don't use any technical jargon. You're talking to somebody and can relate to, you know, a board member. You can relate to anybody in the company as well as somebody that's incredibly technical.

This is something that I've seen so many times that folks that are very technically proficient almost, like, either hide behind jargon or can't translate the jargon into words that matter.

How do you bring people along this journey with you without overwhelming them with all the technical terms and jargon. And now we're gonna put ZTNA here and, you know, here's how we're gonna do model integrity over here. You... And you just kinda lose people. How do you... How would you coach people on that?

I think it is a skill. Before we talked about my current role, my previous role, I was the deputy CIO for president Obama. So, you know, making things very plain for people who weren't heavily technical...

President Obama was...

Is actually quite technical. Making sure the message gets across all around to all stakeholders, it is it is definitely a skill. But I think it's something that we have to take ownership of and we have to do because cybersecurity, as it grows, is not just the company's responsibility. It is every person's responsibility, and they have to understand what those connections are.

So when I talk about zero trust principles to AI and how that goes together, I tell people treat AI as if it's an identity. It needs to authenticate. It needs authorization. You need to make sure that it has accountability at every step.

You need to make sure that AI and the models have least privilege. And when I sit...

When I say it in those terms, people are like, oh, yeah. Okay. If if I treat AI and those models as if they are an entirely new identity and add those things. No more long lived credentials.

Right? We don't want people to have long lived credentials. So why would you have an AI model with long lived credentials or or orphaned agents when we're getting into this agentic cycles? Those are ticking time bombs.

Right? And so we have to make sure that the decisions that we make, the actions that we're taking with zero trust, that people understand how it applies to AI. And the way I do that is by telling people, you treat AI like you treat any other identity, and you will probably be, well placed in the journey.

I I can't miss the opportunity to to ask you this. I mean, I think about the scale of Mastercard. I use a Mastercard all the time. My family does. My parents do, for example.

We've been in this dilemma forever of striking the balance between security and usability, and especially when you're thinking about a high trust environment like financial services. From employees all the way down to to customers.

How do you how do you think about that?

Because the attackers are so good, and you mentioned the help desk example. They're so good at manipulating people. Right? And AI will only help to scale that.

How do you how do you counsel people?

Here's the way to think about integrating security, but you can't take your eye off the ball of what it's gonna do to the usability on the other side?

It is. It's a hard problem because if you make security clunky, then no one's going to...

Then your operation is not gonna be secure because people aren't...

They're just not gonna do it. They're they're not going to abide by the the governance structure, the the rules that you put in place. And I think, you know, you think about misconfigurations and you think about shadow AI or shadow IT, This happens because a lot of times people wanna work around or they don't know the process, so you've gotta kinda make it easy. I think within Mastercard, we look at it as our responsibility to stop fraud before it happens.

Our responsibility to make it...

Make security easy for our customers, for our stakeholders, for those who are working with us, and understandable so that they are on this journey. We're all on this journey together. We're in an arms race. We're all on this journey together.

And that even goes to, like, some of the thought leadership sessions that I have. And I've...

I talk to seniors. I talk to my kids. I talk to, you know, young school kids, and making sure that everyone understands what their responsibility is, and I kinda look at it at it as a rite of passage. You want this information.

You want this device. You want to, have the autonomy to do things and not be afraid, well, you want the autonomy to do things and not be afraid, then you have to have the right cybersecurity principles in you, in your DNA so that, you know, if you get a a a smishing message, a text message that has a link, you know not to click. If you see a a FaceTime, because I think this is the future as well, FaceTime is gonna come in, and they're gonna say, hi.

I'm Melissa from x y z bank. We've decided that we're offering our customers $20. $20 and all... That's all I need to help secure your entire banking profile.

People like my mom would be like, that's a great idea. $20? I've got $20. It won't be I need 50,000 Bitcoin.

It won't. It will be, I'm a help desk person, somebody who you can't who you can't verify. I'm a help desk person. Give me $20, and I'm gonna do this thing for you.

And you're gonna say, that's a great idea. Here's my $20. Think about that. I'm in Washington DC right now.

Think about it if half the people in Washington DC did that.

Then I could... I would retire. Right? If I if I had a deepfake that did that, I would retire because so many people would fall for that. The bar of entry is getting lower and lower and lower for for the adversary and people who want to try to break into things just like the bar of entry for acceptance and understanding is getting lower and lower and lower too. The bar of entry to be attacked is getting lower and lower and lower too. So as you're thinking about AI lowering the bar of entry, it's lowering the bar of entry in all areas, and we have to make it cons... We have to make security... Cybersecurity consumable in all of those different areas so that all of your stakeholders understand what's at stake.

That is a great direction to kinda give folks. How do you make it easier for every single person? How do you make it more intuitive? You know, I just...

I'm curious about your experience, but I'm thinking about the first time that Apple introduced in the iPhone Touch ID. Right? And it was one of the one of the few examples that I could point to. When I was a professor at Columbia teaching computer security, you get into this security usability trade off.

Like, you have to talk about it because it's a real thing most of the time. There really is a trade off.

But that's one of the few examples I could point to where for a lot of the population, they could actually increase usability because they can now just put their thumb on this phone and get in and not type their passcode anymore.

And they've increased their security because some of them may have not even had a passcode before because they don't wanna go... Problem of typing it in.

But those examples seem so rare, so uncommon that both increase at the same time.

And I'm I'm just curious. Do you see us evolving even as an industry and the types of controls that come in that we really will get to a place where people will just naturally be more secure? Like, there's there's usability and people are gonna be able to do intuitive things, but behind the scenes, we're gonna help secure it in a way that's just frictionless to them.

I think there will be a balance. It will definitely help, AI is gonna help us accelerate decision making. I think when you think about it from a security perspective, we are going to move to be more proactive than reactive Because it it... And and this has evolved because one of the things we used to say a lot of times in the White House is it doesn't matter unless it had... You know, unless it happens on the Wall Street Journal or the Washington Post.

Because we just saw everything was so reactive. There were many times where we can't be reactive. We can't be reactive. We have to be proactive. And that's just an evolution of where we were with technology and everything at that time. It was very reactive kind of culture.

When I think about now, we...

Enough everyday people have had identity theft instances or have been breached that now everybody recognizes you've gotta be proactive. Before, it was, oh, this is a business thing. This is the...

They're only attacking the big businesses. They're not attacking me. You know, you would hear about those very, very, very, small amounts, so which made us reactive when we heard about it, you know, on the small amount. But now I think we've heard about it so much.

And, like, I I think I started out this, earlier saying I've got enough identity theft protection till I'm 80. I don't need anymore. That...

I think I shared this...

That same sentiment with...

That that a lot of people share. We've gotta be more proactive. And so AI is gonna help us do that. AI is going to help us flag anomalies so that we can be more active.

We can adjust dynamically. So we're doing that right now in the business. Right? We're doing that now from a business perspective.

My...

I thought things that happen, consumer enablement and engagement happens first. Like, mass adoption happens first. Of course, mass adoption of AI...

We've been we've been using AI in in Mastercard for the past, probably, two decades for fraud prevention for our prevention. It wasn't a buzzword until mass adoption, mainstream adoption, right, from a from a everyday people level. I think the the benefit of AI in cybersecurity is gonna flip. The mass adoption and the way we're using it now will eventually trickle to the consumer level, regular everyday people.

The AI...

Having the AI flag and anomalies, having the AI adjust dynamically to malware, to threats, to be able to deter things. We're do...

We're using AI now within big businesses.

That will somehow make its way to something that's smaller, that's more consumable for the everyday person to have that embedded on their devices.

Some type of AI that can adjust dynamically, that can... I mean, we've we've got automation right now that can blocks... You know, and things that can block spam. I'm talking about going further than that.

You know, I think I think there's gonna be a balance between the reactive still and the proactive. But I think no matter what, we will still have human in command. We will still have human oversight at some point. We just now have to grapple with. And as we think about AI in the future, at what point do we want the human in command? How much autonomy do you want AI to have? Because AI is a tool, but it's not a free pass.

So when I say that, I mean, it's a tool. And when it doesn't work, it's not AI's fault. It's gonna be whoever designed, whoever input...

You know, whoever didn't do their due diligence, we're gonna be pointing fingers. So it's a tool, not a free pass. You So still have to have the human oversight and the human in command. We just need to figure out where is that human, in command evolution gonna take place and how quickly will we start turning things over.

And that's why I think the zero trust framework is so important. Because as you start turning things over and giving it more autonomy, then you have the zero trust framework that says, wait a minute. I've I'm I'm doing the right things with identities. I...

I'm doing the right things with devices, and AI won't be able to...

Will will only be able to work in the box that you give it, and you will give it that zero trust framework to work within, and you'll be better off for Love it.

And and I'll... I'm just gonna come back full circle and ask you one last question because I love the visual that you painted. Like, years from now, I wanna be on the beach, and I want these AI agents operating on my behalf. Well, you're governing them. You're governing them. But even the fact that you're on the beach has got this kind of relaxed notion that you feel like you're under control of these things. I'm from The Bahamas, so I I very much resonate with that that analogy.

People talk about it as if it's something scary. Oh my goodness. AI is gonna take over. It's gonna be horrible. And I'm thinking like, please, if you could do my job, at least half of it, I want you to do that.

I'll take 20%.

Right. 20%. I'll take it.

What what... Last question for you is, like, if somebody... If you're talking to another chief security officer or security leader and they were just starting, coming back full circle on their zero trust journey, you know, right now, what's the one big thing you'd tell them to do or avoid based on your experience? How do they get to that beach where they got zero trust in place, AI's a part of the mix? What can they do right now?

I'll stay with the beach visual. Don't boil the ocean. Start with identity and MFA. If you start there, you're you're at a great point in the journey to look around and say, okay.

What else do I need to do? What I would say to avoid is avoid treating it as a tech project. It is actually a cultural shift. You have to embed it in your DNA.

You've gotta focus on quick wins. You've gotta bank...

Game, and build momentum. So that, I think, is what you tell them to, you know, to to do and to avoid.

I love it. Doctor j, thank you so much for being here. This has been fantastic. You're such a great articulator, especially of these concepts that other people just make unapproachable. Like, I just feel it's so approach able when you talk about them.

And, again, thanks for being a part of this. And listeners, thank you so much for tuning in. Please keep the conversation going on our RSAC membership platform by visiting 1rsac.com/membership, and be sure to check 1rsac.com

for new content posted year round. Doctor. Jay, thanks a lot. This has been awesome.