And that ability and willingness to listen And understand where your expertise ends and another person's begins, I think has been really critical to our success.

I feel like that's also come up in so many different cases, whether it's trying to write blogs or documentation and having the ability to go back to, like right now, my current victim is infamy going and being like, this is how I'm trying to describe this.

Like, is this accurate? Or like SysFix as well.

And they'll come back and like, you know, take whatever my language is, this completely butchered the technical concept behind, you know, tombstones or whatever.

And they'll like get it to something that's, you know, accurate from a developer perspective, but also, like, readable and understandable from a human perspective.

So, like, even little things like that, just making sure that we're communicating externally things that are accurate to things like, you know, some of the modeling conversations that we've had, like, when we were going through the iNet service model and poor Redox, we thought we were going to, like, start...

Like, we thought that we were going to, like, psychologically break him because we were... going through it and like kept redoing aspects of it again, again, again.

I was also wondering, has there ever been a moment where there's a problem that analysts that you've been trying to solve, but you don't know what the technical solution would look like? How do you two entities work together to try to solve that problem?

Oh, go ahead.

I would argue that it doesn't also matter necessarily if we agree on what a campaign is.

We have the same definition.

You just need to know what mine is and I need to know what yours is so that we can map them together.

So I feel like when we're having all these arguments about it, and I think that also kind of goes a little bit towards the naming schemes.

I feel like How does Pride and Prejudice start? It's a truth universally acknowledged.

You need to have a naming scheme.

Not necessarily always

When you talk about showing your work, do you feel or have you noticed that analysts and practitioners aren't really asked to show their work a lot? Or is that changing as, you know, time has gone by? I don't know

if it's necessarily changing.

I feel like, you know, the silence had mentioned that so much of what we're how we're sharing information is still through prose and reporting.

Right.

And my experience, like showing your work was kind of went to the extent of just in the report, like once it left your team.

And it was very hard to to kind of do your due diligence if you were viewing someone's work or something like that, because you basically had to recreate their investigation if you didn't have.

Um, you know, I was on a team that didn't have access to synapse or Nucleus, which was the predecessor.

um but coming back to you know like the investigation portion of of your work um what what do you all have to say about malware like when does that become relevant in investigations and is there a risk in relying too heavily on the malware families like what is what are your opinions on that