So what happens if the vendor in question is a huge entity that has multiple resources that you and or your customers are also using? How difficult is it to address those compliant liabilities without that big vendor's input who might be busy putting out other fires and you're trying to mitigate it in your end? Chris, why don't you offer your thoughts on that?

Sure, absolutely.

I think documentation first on our end, right, to really get to the heart of how we're interfacing with them, what the data is that we're working with, the sensitivity and the overall compliance or regulatory or contractual obligations that we may have around that.

Gives us a sense, and that's part of what's in our response playbook, gives us a sense of what we're working with and what the criticality might be.

On the simultaneously, the team is responding and continuing to try and get to those right people at the vendor organization to get the folks to really talk to us, right? Because ultimately, it's about that face-to-face communication, at least for me.

But ultimately, if you can get those personal relationships on the front end, That's really always the best thing, I think.

It's really great when you can just reach out to the colleague, your fellow CSO, your fellow CIO, your fellow CISO, and just say, hey, what's going on here, right? And just have a one-on-one conversation because the scary thing sometimes is when email catches fire, right? When Teams catches fire and you'll see all of a sudden you have 23, 50 people on these emails and the information's not quite correct.

Chris, how about your considerations on how to weigh what to do after the dust settles?