Is there anything that's been like surprising, right? Or as you guys have been exposed to maybe kind of some new frontiers ahead of maybe some of your peers, are there any kind of lessons or insights there about kind of new risks or maybe a new way of approaching kind of some of these threats that seem like promising?

There are a couple of things, but let me start by talking a little bit about what's not changed.

So the threat actor motivations, their goals have not changed, like credentials, data, system access, like the things that were interesting to a threat actor are still interesting to a threat actor.

And really what we've seen throughout this whole last few years is that the speed and the cost to get those things.

is where we're seeing the real difference.

And that's for them as well as for us.

And so as you think about how that works inside a security program, talking to my peers and other security teams, a lot of muscle memory that we've built up as a field for how to accomplish this job well, that muscle memory needs to adapt to the changes in cost and scale because you might have assessed something as difficult or expensive and hence unlikely and taken one risk mitigation approach five years ago, Whereas that's no longer necessarily appropriate.

optimistic person.

And how did the idea for After the Revolution first come to you?

Um, that one, you know, also, uh, somewhat autobiographical or not so much autobiographical, but, um, whatever the word is for biographical about my family, familia biographical, um, My grandfather who was my father's stepfather, but the man I really grew up with and knew as my grandfather, I had always known was an ideological communist, and it was a point of great pride in my family that not just he, but also my grandmother, some of their kids were really ideological leftists.

They were activists.

They are very much at the center of their life in a way that is, I would say, parallel to the way religion is at the center of some other people's lives, was the idea that a fight for a better and more equal and fairer world was, yeah, that thought was at the center.

And when in the 90s, and I always known that my grandpa Joe was blacklisted, that he had had this career in government that was incredibly promising.

He worked for the OSS, which was like the precursor to the CIA during World War II.

And then he was working for the UN and he was actually the assistant to Trig V. Leith.

Yeah,

What exactly did you see that tipped you off that this worker was not who they purported to be, or contractor in this case?

There's not one indicator or one candidate or one thing that lets you know that you're in this situation.

It's more like a pattern that crystallizes over time.

We started noticing anomalies, so a work history that didn't line up geographically with other things on a resume, or a degree at a school that didn't offer the major that was listed, or a plus one for a phone number when the candidate's resume was for a, a US person.

It's what's known as keystroke latency.

We were able to use the initial set of indicators to look at things including latency data, which is a, a, a really interesting signal, right? When someone is using a VPN from across the world to kind of digitally hide their location, you would expect someone who's connecting directly to corporate systems to have maybe a 10 millisecond-ish round trip time, and this was 10 times higher than that.

And so that signal, combined with the other signals, combined with the way the person understood their work, the level of depth that they might have, those all added up to, okay, this is a person we need to quickly remove and confirm that they didn't ever have access to something sensitive.