What are some of the primary things you're seeing in terms of why folks just do not have these things in place? Is it a resources thing? Is it a lack of understanding? What's typically that initial hurdle that they need to get over?

Yeah, I think sometimes there's several paradigm issues, I would argue.

In manufacturing specifically, assuming they have followed reasonably to the Purdue model, operational tech would be separated away from corporate tech.

The issue here in manufacturing, of course, is that that separation doesn't actually facilitate availability and practice anymore because the operational systems that actually run the manufacturing plants, the assembly lines, the machines, et cetera, are in need of information that flows from corporate systems.

So when the ERP solutions become inaccessible, the organization can no longer coordinate production right and so at some point they run out of raw materials etc and so i think first paradigm i would just highlight is that i think many in manufacturing think because they have separated ot from it that they are somehow resilient uh from these types of attacks and i would just say it doesn't seem to play out in practice at least from our experiences second i would just say that um in it we've been trained to basically learn how to defend our systems from product vendors.

And so many organizations have been led to believe and possibly, you can't blame them, right? It's how they've been trained by product vendors that solutions are survivable.

And we use the word survivable, not immutable, because every product vendor as it relates to recovery solutions has a different differing definition of what the word immutable means.

How can we shift gears a little bit and get folks thinking in that same way about cybersecurity and protecting a lot of these, especially on the OT side, a lot of these assets?

Can we go through some of the tactics that you're tracking here, you and your colleagues? Are there patterns that you're following?

Oh, yeah.

In the context of Scattered Spider, certainly they're in the news a lot.

We have seen many events where they have actually used self-service password reset against organizations.

You may or may not know that Microsoft so graciously turns on self-service password reset for administrator accounts, privileged accounts, by default in Office 365.

So you don't actually have to do anything for that weakness to be enabled in your tenancy.

Microsoft has so graciously done that for you, and Scattered Spider abuses it.

And they, they feel as though they've confidently checked that box, and yet when it comes down to it, they, they're left coming up short.

What does that look like in the real world?

Yeah, I'll give you, I'll give you some real world examples of this.

Actually, Coalition, a cyber liability carrier based in California, uh, a researcher there recently r-released a piece, uh, where he actually said that, you know, during significant breach, companies that have filed claims, cyber liability claims, uh, fifty-eight percent of them discovered a partial or significant failure of their recovery capabilities during said breach or said significant security event.

What we know from our own data is that eighty-four percent of organizations that we meet in breach, it's the first time we've ever met them to actually orchestrate their recovery from a disastrous exfiltration or destructive event, that eighty-four percent of those organizations do not have a single survivable copy of backups.

And so I would just say to you, organizations are commonly spending a lot of money on expensive backup and recovery tooling, things like Zerto, Rubrik, Cohesity, Veeam, uh, Datto, Druva, insert backup product here, and these, these products are commonly not orchestrated to actually use the features that they're designed and for properly.

And frankly, because most of the time these things are not being implemented from the context of breach.

I'll give you another example.

And I can't help but think that that makes the security teams less effective.