Podcast Transcript

Welcome to the RSAC Cyber at the Top podcast where security leaders across industries share the strategies, hard lessons, and real experiences shaping modern cybersecurity and AI. Insights are grounded in community and built for every level of profession.

Frontier AI models are moving from the lab into the hands of defenders faster than almost anyone predicted. Security leaders are being asked to make real decisions about using and implementing them with very little historical precedent to draw on. Today, I'm thrilled to be joined by Anthony Grieco, Chief Security and Trust Officer at Cisco.

He was among the first defenders to get early access to Mythos, one of Anthropic's frontier models.

This was through Project Glasswing, a cybersecurity initiative to secure the world's most critical software. We'll talk about what that early access looked like and what advice he'd give to other security executives based on that experience.

We'll also step back to talk about how leaders are managing this constant change, how to bring your teams and boards along, and how to separate real risk from noise in a moment that's full of both.

Anthony, so great to have you here. Thanks so much for being a part of this.

Hugh, it's great to be here. It's a fun topic and exciting times. That's for sure.

Oh my gosh. Exciting, unprecedented, not enough words to describe it.

Maybe to start off, if you could just give us a quick overview of your role.

Yeah. So, my name is Anthony Grieco. I'm chief security and trust officer at Cisco. I run a couple of important functions for the company. One, we defend Cisco as an enterprise. We work with all of our product organizations to build security into the products that we produce, and we've got a lot of work that we do with our customers to earn and maintain trust or certifications, certifications, compliance, and and all of those sorts of functions of advice and counsel, as security teams, across the globe.

Alright. That's great. And and earlier this year, Cisco one... Was one of the first defenders to be part of Anthropix project class wing. What was it like to be a part of that early group?

Yeah. Look. We...

You know, inside of Cisco, we've got a pretty aggressive offensive cybersecurity team that's fairly well known in a whole bunch of different corners of the security industry. And and so they've made, you know, careers out of being really, excellent hackers of, you know, our products proactively to help find, issues before, adversaries do. You know, our products and services aren't aren't necessarily just kind of the traditional SaaS web applications, which we certainly have, but we also have deeply embedded systems. Right?

The the devices that are at the core of the Internet are are are not just computers right there. It's super complicated systems. And so, you know, we've we've had a really aggressive offensive cybersecurity team for many years. We got access to what is now known as Mythos, you know, a number of weeks before Glasswing was was publicly announced.

And, and through our partnership with Anthropic, you know, we we had really gotten access and we're kinda given given access to it and kind of asked for feedback on what the models were capable of. And so we put it in the hands of our offensive cybersecurity team. The the feedback was almost instantaneous from the team. I'll never forget the phone call that I got on on that Friday after getting access to it on a Thursday, and and the the reaction was like, this is different.

This is a function above what we had been seeing before. The team had been playing around the...

With the existing models both in the kind of the open weight, open source world as well as kind of the, you know, from the frontier models that were publicly available.

This felt different to them. And and so so we immediately began to kind of think about where the boundaries of the models were, applying it to some important areas for us to give us deeper insights once the team had that initial kind of reaction to, to what they had seen. And it it was really apparent to us that this was a this was a big step function from a capability perspective, and it required a different, different level of attention and response response than what we had been otherwise looking to leverage the AI models for previously.

So I'm I'm just trying to put myself in your shoes. It's Friday. You get the call. You've got a legendary ninja group of cybersecurity professionals over there at Cisco.

What do you then do with this step function and power? Like, how did you decide where to point this thing first? Was it a specific security use case, or was it more exploratory?

The first thing that we really leaned into is how do we take this, model and the larger harness that we had built previously, and we'd plug the model into, put it in the hands of our teams that really look at the product security and software and hardware security of the systems that we produce and sell to our customers and and use as an enterprise as well. And so we were really looking at that. How do we take software, you know, source code designs, binary system systems that are out there running in in the wild, and how do we take this access model and harness and use it to figure out are there vulnerabilities and exposures that we need to go fix in in the context of all of our portfolio.

And so that for us was a really clear kinda target area that we wanted and had been spending a lot of time on. That's what this team was really focused on is is finding those things ahead of time. So we applied the model. We applied it to an existing harness that we had built that I think is, is also worth us spending some time to talk about.

But but it was really after a core product that we have as a as a as a company that is out in the wild, deployed with our customers, and ones that we had seen adversaries paying a lot of attention to. And so we we we start to think about from a risk based perspective. Right? If I...

If I've got a a powerful capability that maybe gives me new insights into what's going on, I'm gonna apply it to the thing that I think has the most value and return on it. And so that's where we started. And and we've started very narrowly. We started in that one product and and and took the entirety of what that product is and and and plugged it in the model on the harness.

And the results from that were were, again, step functions above what we had seen anywhere else.

And and and we started immediately to begin to refine what it is we were doing in this space. We we recognize this was different. And and so we kinda went over the course of, you know, we had access to this model for a number of weeks before it was out publicly. We went from kinda trying it out on this one product to running it across, as we sit here right now, across, 40 to 50 product lines at one time by taking the...

That entire team of, of really offensive minded cybersecurity folks, enabling them with the harness and the model and turning them loose across the the entire portfolio. Over the course of a few weeks, it was really a a pretty significant transformation for us. And so that's on the technical side. We did all that.

And then as you might imagine, I was having a lot of conversations with our executive leadership team about what we were finding, what this meant for the business, what this meant for what we needed to go do. This point in time that we're at was was really a conversation like none other that I've had in in in my in my career for sure.

I definitely want to come back to that, but I also want to hit on something that you mentioned. I remember when this Project Glasswing was unfolding and talking to several friends that had access, And it was really interesting, just the variability in their responses. The ones that had amazing offensive cyber teams, and had already invested in building harnesses, like, wow, this thing's incredible. It's a huge step up. But then when I spoke to some other ones that really just didn't have the human capital, the folks that had experience in this space, especially on the offensive side, like well geez, we're just trying to figure out is this really better than what's out there. So I guess my question is, how important is the harness when somebody's now evaluating yet another new model that comes out?

Yeah. Look, I...

This is the most fascinating thing to begin to dig into, and as you talk to people that have to these models or any of the other models. The analogy I've used with a bunch of our executives is, you know, when ChatGPT came out, it was a really fascinating point in time. And, like, you know, if I look at how I use ChatGPT, I I I probably wrote a little bit better email or help me kinda create a better document because I could put some thoughts into it and help refine it. But it didn't fundamentally change how I was doing my job.

It may be a little bit more efficient or proficient in particular areas, and and and these these advanced models or any of the models effectively kinda behave in the same way. If you give them to an individual, you tell them to use them in their job, they can probably do incrementally better in what it...

Whatever their job is. So if they're a red team or trying to find vulnerabilities and they just integrate it into what that individual is doing, then they probably get a little bit more effective, but they don't transform the overall function. If you look at what we did with the harness and what we ultimately have done with the entire offensive security, efforts here, it's been a full autonomous journey of taking these models with the harness, and turning what was ultimately, you know, a multistep process that involved humans and handoffs of information and data historically into an entirely automated process using the harness to drive that automation and the models to do the work, on each step of automation.

So, for example, you know, the the effort to take source code and design documentation and all the things that you have as a as a producer of technology or a creator of applications and to look for potential vulnerabilities in it, like, that's one step in the process, and you can use a model to help you in that space. But how do you take those results and then turn them into something that's actionable? Well, we've automated that process.

Our harness drives and finds a bunch of potential things that we need to pay attention to from a potential vulnerability perspective. But then we take it a step further, and we take that information and data using the harness to go drive and ask the models to do a different set of things. We said, go try to build a proof of concept exploit as an example. And when you think about that as a next step in that process, okay.

That's cool. And, again, if that's all I was doing, an...

Model might help me do that one piece better. But with the harness, I'm driving all that in an autonomous way. And then I take that proof of concept exploit, and what do I do next? Well, maybe I wanna try to go see whether or not that proof of concept actually works on an operational system Using the harness to drive the model to do that step of the overall automation process is a is a next component of of what you see doing with the harness using the models underneath it.

And then maybe you can envision a loop that happens in there. Maybe it wasn't successful, but maybe it got close. And so maybe you need to go back. Okay.

Have you automated that with a harness? The model's helping you do the actual execution, but the harness driving that overall automation. And then once you figure out you actually have a problem, well, go fix the code.

Right? So that's another step in the process. And so here again, you can envision a model helping any individual function along that path to get a little bit better, maybe incrementally more productive.

But the real unlock for us has been automation across that entire suite with a harness. And so that when I get a new model, whether it's an open weight, open source, something we train internally, an external foundational model, I plug it into that harness, and I see where did... Where can I optimize? And, oh, by the way, I put different models at each different space, each different move within that harness to optimize for cost effectiveness, all sorts of different things that can go into that world. This is the future. You know? And and the the results of it really, for me, are are are the really exciting things. I... You know, we we were... We... I mentioned we were doing all this work while we were, you know, running it across a bunch of different, parts of our estate.

I go away, for Memorial Day weekend on a Friday looking at the dashboard of all the findings. I come back on the Tuesday morning, and I look at the dashboard.

The models haven't stopped. The harness hasn't stopped. That full automation hasn't stopped. And it's not like we have new work to go, like, think about whether or not it's something we need to pay attention to.

The full thing has been happening all weekend, and there's real work for people to go off and fix and ship new software to our customers. And so that's the real for us unlock that, I I think we're all kind of figuring out how do we do that full automation with the models as the core components.

Let let me ask you this. Not every security leader has access to some of these frontier models, especially when they're new and young. And it and it makes sense. Right? All the model making companies, these frontier model generators, they're still thinking about what's the right thing to do and how do I responsibly release these things and what sequence?

For listeners that are working with more conventional tools, or only have access to the publicly available models, what's the version of this journey that they can start today? Like what would you recommend they work on right now to prepare themselves to this world of automation?

Yeah. Look. I...

This is super important because there's...

There is real work that you...

Just because you don't have access to one of these fancy models doesn't mean there isn't something you could be doing super productive today and and really making progress, to empower and enable an organization to have the maximum value with AI capabilities in this same sort of manner. So the first and foremost thing I think that folks need to realize and start to investigate is this notion of harnessing and really understanding how they can take advantage of whatever models they have access to. It doesn't matter if you have access to Mythos or g p t five five or five six cyber or just an open weight, open source.

We we trained a model, a very small model that can run on very small infrastructure that we've open weight and open source that can help people find vulnerabilities. But driving these models with a harness and starting to get the employees and teams that are responsible for these sorts of things starting to think in these ways is super important.

We've open sourced our harness or a specification for our harness in the Cisco, Foundry security specifications out on GitHub, and it gives defenders a script, a a specification to run to create their own harness for their environment. And it allows them to take whatever model they have access to and begin to plug it in in the way that I've described it in order to help people begin to try these sorts of motions out. I think the biggest thing that we as security defenders have to start to really lean in and embrace in in this era It's not... Having access to the great models is super important and and get as good a model as you can. But the bigger transformation I think we're all going through is how do I automate workflows?

How do I automate systems that used to require me individual teams, human handoffs, passing of information and context between organizations? If you really think about it, what we're talking about with these harnesses and and the work that we're doing in security is not any different than what any of the other business leaders trying to do right now with AI.

The difference between productivity improvements and fundamentally transforming how you do your business through automation is really, I think, the world that we're in right now with cybersecurity. So it doesn't matter what model you have access to. Get as good a model as you can. Start to think about how you automate these processes using these harnesses and and begin to think about what that automation looks like, to transform what used to be, very human driven activities into things that you can turn into fully automated systems.

I think that's really where where we're all headed, and this is just a good example, in my opinion, of of what I think we're gonna see across a broad range of things. We're doing similar things in security operations center, automating how we're doing, SOC, event processing. Right? It's it's the same thing.

What used to require tier one, tier two, tier three SOC operators that I can use AI and automation to automate the handoff of information and context between agents and systems and models that help us detect and control risks in the context of incident response and detection engineering and all of these different things. So I...

This for me is, I think, the biggest, thing that we can all be doing is lean in and embrace that mindset, through putting our our teams. Worst thing that we can do is say, I don't have access to mythos, so therefore, there's nothing I can do. That's that's the wrong answer in this moment.

I love that. And and I I wanna just take a big step back and ask you maybe just a leadership question around cyber security. Even beyond this year's announcements related to the frontier AI models, there's so much changing in how we approach security. As a leader, how are you managing just this constant influx of change, and what advice would you give to others?

The observation as I talk to my team and and and my peers, It is one of the most energizing and and chaotic times, you know, in in this industry, it seems. And so I I...

When when we really are are focused on things right now, the the challenge of a leader, I think, is to keep the teams focused on what we believe are the most important things to get done in this moment. It is super easy to get distracted with with the new thing that comes out, the new headline that's happening, the new model that gets released. All of those things end up being potential disruptions in the context of of of us as leaders and, frankly, for our teams. We're spending a lot of time just reinforcing, like, what are we working on?

Why are we working on it? Why do we think it's the right and and most important things? And and how that's going to help us, continue building more resilient systems and helping our companies and organizations be more resilient in in this moment. At the same time, we are all having to learn how to be more agile.

What we were doing yesterday probably needs to fundamentally change. So we're spending a lot of, a lot of our energy, helping, both ourselves and, frankly, our teams, think through how do we get comfortable with that full automation that I just described. What are we going to do as teams once that is happening, and how do we think about the next set of things that we need to do post that automation? These are the the next sets of, of discussions that we're having.

But but first and foremost, like, being very clear about what prioritization is, and making sure that when you change those prioritizations in this moment, being extraordinarily clear about that it's changed and why, is is really, really essential. As a leader, I think the the biggest challenge is keeping up with all of the different inputs to that prioritization conversation.

You know, as as we know, this... You know, I I... My my joke has been, you know, cybersecurity people usually get other cybersecurity people excited about cybersecurity things. Right? If we're honest, this industry has been like a a self reinforcing, mechanism for many years.

This moment and and all of these things have, have crossed the blood brain barrier to executives that aren't cybersecurity executives and board members that aren't cybersecurity, you know, savvy folks or come from this industry. And and so us kind of being the bridge and being the voice of reason and helping educate those folks that, frankly, many of us have advocated for and said, like, oh my gosh. If only we could have more attention from and and prioritization from these people for many years. Like, this is our role as leaders right now. It's a really unique time, in that way. So as a leader, like, keep the teams focused, help folks understand what the priorities, be aware that they're gonna change, be clear about that communication, and then be the translation layer for for for those that we have only dreamt of talking to is, I think, the the number one goals right now as leaders.

Yeah. You make such a great point. I mean, it it is incredible. You're right. We've always wanted a seat at the table right along with every other function in the business. It seems like today either we have it or we're definitely getting there.

How do you bring those folks like a board member, senior leadership, the CEO along with you on the journey? Because there's a there's there's a lot of complexity. Right? They they start to read about these things and all these new vulnerabilities that are being found and, you know, what we're doing to automate.

These are words that, you know, they're not the typical words that you hear in the boardroom. How do how do you bring those folks along with you? What's what's the best advice? Is it stories?

Is it analogies?

All of these things start with with the environments where board members, executives are all humans. And so understanding where they're coming from, how they consume and understand information, you know, at, if they're a board member that's got a background in finance and numbers and statistics may be useful, maybe not, depending on what their what their background are. So I think my first advice in all of these is they're all humans. And so just as we do with any audience, understanding your audience and understanding how to connect with them, I think, is, you know, research object number one as a as a as a...

As somebody that's gonna be talking to them. I, you know, I I think we we spend a lot of time. We're we're really fortunate to have an executive leadership team and a board that really understands the importance of cybersecurity and regardless of kind of the details underneath it in in the context of the role that we play as a company in the world and and kind of what we do with our customers. So so we start in a place where there's a a good general awareness of how important these topics are, and and then it gets into these stories.

It really is helping relate what we're seeing, what the risks are, and how they relate to things that are are closer to home for them and and really building a a set of understanding and then confidence.

Those are the two things that that we spend a lot of time, helping them understand what risks we're trying to manage in terms that they will understand and then keeping them updated. I mean, in this moment, I I think many of my peers would reflect the same.

I had more conversations with these folks, on a more frequent basis over the past four months than than, you know, I think any of us could have predicted. And and so that's an opportunity to not just have a once a year or once a quarter conversation about these topics, which might have been the historical way that some folks engage in these topics, but it's more ongoing. So there's also a a a... An ability to kinda continue to bring them along in this journey, and not feel like you gotta do it all in in one sitting, which is, maybe... Especially when it comes to depending on how you engage with boards and executive leaders, maybe how how folks have been forced to to do that in the past.

I also wanna ask you about just how you personally sort through the noise that's out there right now. It's an incredibly noisy time in cybersecurity.

You're known as a calm and pragmatic leader. How do you personally sort out real risk from the noise? Like, when you see news about model escapes at Frontier Labs and they're going off and making decisions to go after other places, this is just one of n pieces of noise that now show up in any given week.

How do you sit back and think about, okay, is this relevant to me? Is this something I need to take action on? Is this something my team needs to take action on? Do you have a process or anything that you can share?

Well, there's a couple things that... I mean, first and foremost, we have an amazing team, and so teammates that are in this world together helping contextualize what's happening out there and paying attention, I think, is a is a key component to this. For me, personally, like, I use AI to help me summarize what's going on in the world. It's pretty easy to pick out the things that are going to get the attention of the, the outside community, outside of security, the headlines like, you know, a model escaping and attacking somebody. You know that's a big headline that understanding it at a at a more foundational level is a really important thing.

And and what we do across the board is... There's a couple things that are really important is is there something we can learn from it? How exposed are we to it if it was to happen to us?

And and then, you know, what it is we need to be communicating based off of either one of those things, I think, is really what the the name of the game is. Obviously, too, you know, we we talk about it, and it it may sound a little cliche, but cybersecurity is a team sport. And so having, you know, the phone a friend and the the the network of people that, you know, hey. Did you see this? Y'all... You know, this is really interesting is a is a really important component to that. I mean, organizations like RSAC and the community that you all are building is a is a nontrivial component to how we are all gonna deal with that that onslaught of things as we go forward.

And so it's it's a combination of all these things. I will tell you at a personal level, I'm spending a lot of time with AI, and I'm asking AI to help me with some of these things as well, process some of the inbounds and and and get context and see what it can do to help with some of that prioritization. It's... That's been an exciting journey to kinda not just talk about it, but live it, and so doing a little bit of that as well.

I'd be remiss if I didn't ask you about talent. So AI is impacting how many leaders think about talent, team structure. Is it changing how you lead your team and how you think about talent?

Oh, completely. You know, the the the mindset that's necessary to adopt these sorts of capabilities and maximize what we're doing in the a... Age of AI and then stay aware of and be agile to deal with what is changing in the environment even if your job isn't, you know, directly automating an entire process. This is a a a really big learning experience for us as as leaders, I think. You know, when you look at the capabilities that we've built inside of our organization in the automation of the harness, I'll be honest with you. Like, it's come out of places that I would have never expected.

And when I look at where AI is enabling... You know, AI is a democratizer of things that used to be hard to do.

It used to be hard to write soft. Right? It used to be hard to automate an entire business process.

Now you have people that have ingenuity, curiosity, and the the...

They're just...

The the access to the tools, and you start to see these transformational things coming out of them and at levels of transformation that used to be, you know, six months of effort and 15 meetings with different teams of, can I do this, and how do I do that, and can you implement this for me? Like, all of that is melting away. And so as leaders, like, the biggest thing that I'm trying to do right now is where are the sources of light of those sorts of things happening inside of the organization? How do we lift them up?

How do we share those stories and bring others along with it? You know, one of the things that we do inside of my team is, you know, record a three minute video every week, put them in a a chat room that everybody's in, and I sit down with a coffee on Saturday morning. And I I watch all the ones that have been submitted throughout the week, And I see these amazing ideas that are coming from people. I've been in this organ...

I've been in Cisco for twenty seven years. I know a lot of people inside this team, but I see faces and names solving hard problems that I've I haven't met, and and I'm now excited to get to meet and figure out how we we we hold these people up and and and and and really think about the talent that we've got in very different ways.

It's a... It's just an exciting time to to try out different techniques to to surface that and and and really take advantage of that democratization. That's really what I I think we're all trying to do right now as leaders with the talent that we have.

That's fantastic. I just love that philosophy. The great ideas can come from anywhere, and in a way it's liberating some folks that have the talent but maybe not, you know, assembly code knowledge and the ability to overwrite EIP on the stack, but they have interesting ideas. And it sounds like those folks are now surfacing, and you've got a mechanism at least to harness some of the great ideas that they have.

Yeah. Look. And and, you know, I've got a bunch of friends in sales that used to be technologists in their early days and and have kinda shifted to interfacing with customers, but they they have great ideas all the time. Now they have tools that help them do it.

Now as a defender, right, so I'm also responsible for helping make sure that all of that is secured. That creates a whole separate set of challenges as they have access to these tools and capabilities. And and what used to be friction and and cost a lot of energy and time for them to do things that they might not have been able to achieve is at their fingertips, and that creates a whole bunch of different risks that you get to manage. And and that's the exciting thing.

Right? All of these things are are creating opportunity and and challenges to...

For all of us to stretch and learn new things.

I I I gotta share one experience with you.

So this must have been almost twenty years ago, I wrote the first software security course for Columbia.

So I was a professor there for a while, and I would teach this class. It was called Software Security and Exploitation, which attracted a lot of people. Right? So undergrads, grad students, PhD students.

Great name. Yeah.

Yeah. No, know you put exploitation in and everybody's like, Oh, yeah. Oh, jeez. And it attracted a very diverse group of folks.

You teach them stuff. You have to teach them offensive techniques in order for them to understand how to defend, and so, you know, you teach them SQL injection, you teach them writing buffer overflows and taking over the stack and all of that stuff.

And without fail, at the beginning of every class there was somebody, even though you spend a huge amount of time on ethics, that will show up maybe half an hour early and say, Look, I tried this single quote in a URL for my credit union, and and this is what I found. And then it's always the conversation of, look, you never do that to a live production system. You only do it.

But it is crazy how the kind of morality that that same human being, a very, very moral person, they would never think about going into a seven Eleven and picking up a Sinkers bar and putting it in their pocket, right? They're like, I don't even know anybody like that. But with technology, it's incredible the distance that it creates from the native morality that you have around things.

And I just wondered if, you know, it sounds like you're hinting at some of the same things, like you give these very powerful tools to folks that have great ideas, they have great intentions, and using them, for example, to break a product because they want to make the company more secure, but they don't natively have this understanding of the side effects and implications. So it's it's something that we're gonna have to deal with overall, I think, as a security space and as security leaders.

100%. I like it. You know, so if you look at you know, when we got access to what is now known as Mythos, and even today, like, it is a very small group of people that have access to the most capable things, for exactly that reason is those people, you know, have different expectations on them inside of the company. But but the but the broader point is, like, it's...

We are at this stage where the barrier between thinking about doing a thing and actually doing a thing are...

It...

It's it's evaporating. And the implications of doing that thing are not always clear to folks. And you're right. Like, the...

Just the distance in the digital world, I think, is gonna create a whole bunch of...

Like, if employee would never think about intentionally leaving a stack of really sensitive data out at the park on a park bench. Right? But there...

There's digital equivalents of that that they may or may not know that they're doing in that moment when they're just asking an AI to do a thing. And so this...

For us as defenders is really gonna be the the the the need and the opportunity for us to insert ourselves in in that conversation. This is one of the things, though, that I, like, I get really excited about AI. Like, if you think about...

We've we've open sourced something else called CodeGuard.

It's a bunch of AI agents and skills that help... You you basically plug them into the, you know, the I... AI enabled IDEs, the cursors, the codex, the wind surfs of the world.

And you, and and effectively, sit there alongside the developer as they're writing the code or as the AI is writing the code and do all the things that we hope should be done from a security perspective that we've been training humans to do for for twenty five years. Look for a buffer overflow. Don't put secrets in the code. All of these foundational things that we've wanted humans to do, now we're able to use agents to do it. So at the same time, this barrier is is is evaporating and maybe these risks are evolving. I think we have an opportunity to insert and use that same technology for good.

And and that's the optimism in me is I think we have an opportunity to kind of put some of those guardrails in place as as defenders, and and maybe we'll end up on the better side of it all.

I I I love your optimism, and I feel the same way. And so last question for you. What... What's one piece of advice that you'd give to a peer security executive that's that's just getting started on the journey of automating with AI? What... What's the first thing that they should do, think about, see, watch?

What would you point out?

I think there's just a...

Go learn from the harnesses. Don't stop because you don't have access to the models, and do it with some talent that you might not otherwise think about using for for the for the conversation. Those are the three things that I would recommend to folks.

That... That's great. Very practical and really tapping into the talent that you already have.

Anthony, thank you so much for being a part of this, and listeners, thanks so much for tuning in. Please keep the conversation going on our RSAC membership platform by visiting 1rsac.com/membership, and be sure to check onersac.com for new content posted year round. Anthony, thanks so much. I really appreciate it. It's so great talking to you, and thanks for your leadership in this space.