0:03I'm delighted to be joined by three of some of the top tech leaders in state and local government, and they happen to be three Cloudflare customers as well. So we'll do introductions in just a moment. For those of you that are wondering about Cloudflare and the U .S. public sector space, we are powering about 100 government agencies. in U.S. federal, state, and local government. We have, for this group, we have a GovRamp authorization across the states. We have FedRamp High authorization, which we just announced in August. And we also have announced our intent to pursue DOD IL-4 authorization as well.

0:48So public sector is a newer business for Cloudflare, but a very rapidly growing business. And we're happy to showcase. our customers and have this conversation today so when we when we talk about state and local government what what we've learned is that you know this is rarely a clean build and that's why we have the kind of the title of the panel for today you know building modern state local government security without starting over without ripping everything out with uh because that's not the reality for state and local government customers And I think we'll hear about different variations on that story from our three panelists today. So with that, let me introduce the panel.

1:34We have John McCaffrey here. John is Commissioner -in -Chief Information Officer, actually, of Suffolk County, New York. Suffolk County, home to about one and a half million residents. Twelve states actually have fewer than one and a half million residents. So it's a pretty big county outside of New York City. We're the largest county outside of, in terms of population, outside of the five boroughs of New York City. Welcome, John. Thank you for being here. And then, staying somewhat close geographically, we have Doha Ozturk. Doha is the Executive Director, Information Security and Infrastructure for the New York City Department of Buildings, which is responsible for 1 .1 million buildings in New York City. Correct, Doha?

2:21it's it's it's very exciting every day and there's always something new and thank you for having me and thank you for being here and then we have matthew forsberg who's the chief defense branch chief of the california department of technology office of information security uh the office of information security in california sets security policy delivers shared defensive services across state agencies and that's a very big state with different budgets different problems correct yes that's very correct so we've got one of the largest counties in the united states the largest city in the united states and one of the largest states and the largest economy in the united states represented on stage here thank you all for being here really appreciate having us so let's just do a you know quick round give us give us the 30 second version of your environment what what are you responsible for protecting How big is your team?

3:18And what's the one thing about your infrastructure that would surprise a private sector seesaw? So in Suffolk, we are responsible for our oversight of the entire network. We are federated in a lot of the counties are not, but we are federated in terms of IT. So we have IT staff in the various departments, but we've tried to create at least a collaborative environment. working with all those departments and whatnot. I have an overall staff of about 150. We have a security team that we built over the last two and a half years of 10 from maybe three, actually, following a major breach, some of you are probably aware, in September of 2022.

4:04I think the thing that would surprise private sector, CIO most, is the thought process. to deal with all of these complexities with such a limited staff. And I think that's true for all of us probably, but I think that's the biggest thing. And regardless, IT-wide, security measure-wide, there's that very limited staff to deal with the issues that we deal with and the complexity of a $4 billion organization. Thank you, John. So I'm responsible for protecting, managing, implementing, and also... batching of the entire network infrastructure, including routers and switches, as well as the cloud infrastructure, server infrastructure. I'm also responsible for maintaining the secure to our public facing web applications.

4:50And my team is really including the help desk is about 15 individuals, give or take. And then one of the things that may be surprising is that we talk about red tape. It's not red tape. It's just the red wall. And, you know, you spend years trying to figure out a process that's been in place for, you know, over decades. And it doesn't make a whole lot of sense when you actually start working on it. But once you do and once you're in it, it starts making a lot of sense. And that red wall just becomes really having a lot more clarity on how we can move forward.

5:36So I... run the state sock so we have about 118 customers right now all across the executive branch and a few other povs sprinkled in from local government as well we do it on a team of about 30 people with about 15 in the sock as sock analysts and the rest are like administrators and engineers

6:00we do a lot of monitoring we don't do as much response They basically feed our logs into Sentinel, and then we monitor around that. I think one piece that would kind of surprise people would be like how disparate the networks are. So generally, when you have one SOC for a company, you would get a certain tech stack, a certain security stack, and you'd know your network, hopefully. With this one, we have 118 different security stacks. So everything's a little bit different. Everything requires... fine -tuning every uh you know every customer has a different security you know maturity so that's what i think would surprise most people great all right so let's uh let's kind of dive in to uh to each of your stories which which as i said i think are variations on on this concept of you don't have the luxury of just starting over to to solve problems to it to address vulnerabilities.

7:01You don't have a luxury to do that. You have to work with what you have. So, John, let's start with you. So Suffolk County has rebuilt a lot over the past few years, as you mentioned, right, since 2022. When you looked at the environment that you inherited, how did you decide what to replace? outright versus what to put new protection in front of and and keep running so i think you know coming in again following a a major uh cyber incident in september of 2022 uh my team came in in uh as an administration in early 24 and and there was progress being made but we were still in the in sort of recovery mode if you will from the breach um And I think that, you know, the decision making, first, you're sitting down and you're having these discussions with everybody widely, department, within the department, outside the department, understand what's in place, coming in blind, if you will.

8:10But I think you're looking at and saying, really, what can the legacy systems that you know you're not going to do a wholesale replacement of, those systems in a sense that we need to protect for a guest, if you will. We have integrations with the state systems as well, and we're working on something now where the FBI is involved, and we have to make sure that we have protections in place for ourselves, even though you'd like to think that those agencies are protected as well. So I think it's making the decisions about where you can put those edge controls, things that Cloudflare has brought to us, web application firewall, looking at those legacy systems and saying, we're not going to re- them. We're not going to recode if it's internal.

8:58We don't have control if it's not, if it's one of the state systems. So it's basically looking and saying, what can we do at the edge? What can we put in place to make sure that those are protected, those legacy systems especially? So I think the decision process is not easy because you have to look at it holistically. But then you really do have to come back and say, okay, where are our most vulnerable places that we have to protect you guys? And how cool is it? How quickly can we do that? Is that something that we can do within the system? Network controls, firewalls, you know, those things. But I think the thing looking at it and saying immediately is those legacy systems where you don't, there was no opportunity even for built -in controls.

9:39So one more question, one more question before you go on to Doha. So county government runs service, you run services. that, you know, the residents can't do without, right? You have to keep them running. How do you modernize the security on those systems that you can't go offline for maintenance? So there are multiple ways you have to be looking at it, right? So obviously I think one of it is in terms of deployments, looking at blue-green deployments or canary deployments where you're keeping the existing system running and either like holistically having that secondary system. It's also looking at micro -segmentation, breaking some of those things down, which, again, Cloudflare, you know, is helping us with that type of thing.

10:25Zero-trust network, building zero-trust network.

10:29And now having AI, where we're looking at AI, which the ability to use AI for detection, obviously, and remediation of the systems that are in place. But I think that it really comes down to deployment. as well as the edge patching on the edge, if you will, and whatnot. So that gives us the ability to at least keep those systems running and put those protections in place around the systems, but bigger than just the original perimeter of controls that we had in place. Great. Thank you, John. All right, Doha, you're up. And we had a very interesting setup when we first started working with the New York City Department buildings. We had a we spent a lot of time getting our contract down. Right. But but we didn't we didn't have time on that either. Right. We had we couldn't start from a clean slate there.

11:18We had to do the work, get the contract in place. So so you had a public facing application that that was end of life, unsupported, carrying multiple critical vulnerabilities, but still essential to the mission. Right. Of those one point one million buildings, the conventional. answer would have been hire a consultant try to fix it that way you want a different direction right when we when we first met you tell us about tell us about the story yeah so uh our inspections applications which is end of life uh application as well as is running on end of life servers uh in addition to that it was actually also running on an end of life f5 load balancer as well so i had like we had multiple angles here that we had to kind of cover so um we had to first get off the load balancer and go to another on-prem load balancer and because the application was emda life we didn't really have any any support to modify the application so um um so we tried for six months to uh you know get on a different load balancer that was on -prem and it was it was just not the application was just not working so um when when we started at cloudflare and what cloudflare has to offer uh from their application services suite uh there was a cloud load mouser and uh you know we we we were like let's spend six months we're not going

12:49anywhere so we went ahead and actually tested on cloudflare uh uh web uh web um i'll say web browser and we were able to have successfully uh test everything within three weeks so um cloudflare is not only managing the security of this application from a WAF perspective, where it also manages our on-prem end-of-life servers, load balancing them through a web load balancer. And we were one of the first agencies in New York City to actually manage on-prem servers via a cloud load balancer. In addition to that, the ease of use for the WAF was was just really really incredible for us because we were not able to change the uh the base code on the application we used application level uh patching on claflare wav to be able to remediate almost all of the vulnerabilities critical and and then medium vulnerabilities that we had for this application we worked very closely with claflare and and and their tech support to make this happen um but But I have a regular firewall engineer that just manages this WAF.

14:08So as challenging it is, I did not have to go get a new position or find someone new to manage this solution. So it's a twofold, threefold for us, ease of use, ability to secure and use additional solutions within a single suite to get things done the way it needs to be. get done all right and so so virtual patching gets talked about a lot but kind of done rarely uh you wrote custom rules against a vulnerability report line by line right that you describe in in our case study what did that actually take and what did you have to learn to maintain it yourselves so this is actually part of our operation in a sense where, you know, quarterly we scan all of our web-pacing applications for vulnerabilities.

15:05I mean, I think that's something that everyone here should do. If you're not doing it, just start doing it. It's much better to be stuck with an SLA to a compliance team versus actually having someone else finding the problem. So we not only used this application, I'm sorry, we not only used our end-of-lake application to actually patch. virtual patching, but we also do virtual patching on our up -to -date applications because with critical vulnerabilities of seven days SLAs, our application team is not really able to, you know, remediate that within seven days. So pretty much we look at the vulnerability, we work with the Cloudflare tech team to be able to remediate vulnerabilities, and we do this.

15:54more than you may think, probably at least a couple of times a month because we continue seeing vulnerabilities and we want to be able to secure them until the application teams can actually remediate. Great. Thank you, Doha. All right, so we have two New Yorkers now onto the West Coast. And so we have a county, a city, now statewide with Matthew. Matthew, you're you're defending at statewide scale across agencies with very, very different levels of maturity. How do you raise the floor without forcing every entity into kind of a rip and replace type scenario? Well, I don't think you can force them at this point. Right. There's just no way it took years to convince convince them to get into one sim.

16:44And, you know, if you were to rip that out, it would everyone go into chaos. So impossible. But I think. applying tools on top of you know the salmon traditional whatever they're running is really important now this for example when we got when I first got here about eight months ago you know we started using Claude or whatever to run across the sim which allowed us to you know see things at scale that normally would have taken weeks or months to kind of develop and then it also allows us to kind of fine-tune each tenant a lot easier develop rules and custom rules. And that's really key because when you look at a MSSP model, generally they're writing like generic rules. And that's just by the nature of the business, right?

17:30When you're when you contract with someone, but now we can apply those rules very specifically to our customers. Also, we're buying products that we can scale across all the tenants, Cloudflare, ProtectiveDNS, like that type of stuff. We hope to be able to, I don't want all their DNS traffic, I just want specific the IOCs. So yeah, we're kind of doing that. We're doing automated pen testing, we're looking at how that affects legacy equipment and then applying specific rules around that and really, if they can't raise their own maturity, we're just applying protection around their environment to kind of just mitigate any issues that they Because a lot of our customers, they're not, they join the SOC for a reason, right?

18:19They either don't have the money to stand up their own SOC or they, you know, they don't have the IT team. They only have an IT team. They don't have a security team. So they're not like security minded. Even though they're a great IT team, they might not think in terms of kind of protecting the environment. So kind of working with them and not forcing them, but like suggesting like, hey, you might want to make these changes has been very successful for us. And this shared service environment, what does this environment allow individual agencies to do that they couldn't do before? Yeah, a lot of it has to do with just being able to see, I'll just give an example, like QuartzLine. I don't know if anyone's seen that recently. It's like a really annoying piece of malware. And it'll pop up in one environment and we can search across everyone else's environment and kind of see that and stop it fairly quickly.

19:11um so just the shared intelligence layer is huge um same thing that we were going to do with dns and then also things like a lot of people aren't deploying WAF across all the environments either so we're trying to get everyone at least you know if you are not going to patch you're not going to upgrade your equipment um at least put a WAF in front of it of at least do something to kind of mitigate those issues uh so that's kind of where that's kind of where we're at with that okay great Well, that gives you a flavor of what each of these customers are facing and each of these leaders are facing and the challenge and how Cloudflare helped. I have some more questions, but I'd love to hear first if there's questions from the audience that you have for this group, for John, for Doha, for Matthew.

19:57Any questions from the audience? One, I thought.

20:02So let's get one of the mics down there. Thank you very much. Peter Slausler. John, in particular, in the 2022 breach, recognizing that carnage that you had to deal with coming into the shop in 2024, and recognizing the build-a-new security team, as you mentioned, going from 3 to 10, the real challenge, and I'm curious on everybody's take on this, but in particular you, is that the turnover of the talent of securing that environment, the younger generation, comes and goes. The older generation is kind of fading away. But the gap is getting larger and larger for the requirements. Security teams of 10 is understaffed. So what are your thoughts about that? How do we, you know, deal with that challenge? Thank you. Yeah.

20:48So that's the unfortunate nature of all of us in public sector, right, is, you know, hiring and retaining talent is a great difficulty. Um, and I, I, actually talk to each of the individuals when, when someone comes in, whether I was part of the hiring process or not, I talk to every new employee that comes in, you know, not all of us can do that in the larger environments, but I've, I've said to, to all of the, the staff that comes on, you know, you can, you can go into, and this was my mindset. I've been, I've been in the private, in public sector for 36 years. Um, and it was sort of my mindset, but, but it's hard to convince a younger i mean we'll talk about ageism convince a younger person of the beauty of working for the government and looking hey when you're 65 you know you'll have a great pension and you'll have medical benefits that's not great for a 22 year old or a 25 year old right so um for me it's talking to them about the beauty of the disparate nature of government if you will and i say typically if you're going into i always use insurance but if you're going into an insurance organization whether it's developer or cyber but there's a developer maybe you're in marketing or maybe you're in actuarials or maybe you're in the administration area with with in our environment you're looking at you're going to be involved with health you'll be involved with the comptroller's office with a and c you'll be involved with the legislature you'll be involved with the county clerk you'll be involved with police and sheriff and and social services so it's a broader experience and you get it you're trying to really at that point

22:20it's trying to convince them of the value but i also i have taken the approach with and again this is across my entire career and in leadership, um, is if I can keep them for three years and get a really great talent there for three years, and then they go out and that's, we've got to manage that way. But as, as Pete says, the, the, the pool is getting smaller and smaller, uh, in our area that even just the, the ability for younger people to, to afford a home or what have you, it's just, it's very difficult. So it really is sort of about enticing that, that nature and looking at and saying how. do I, how do I start now to look at three years out because I'm going to lose people? I have a, uh, uh, I just, I just, just informed him. Um, um, Peter's with our, what didn't control our controller's office.

23:05Um, but that was not a planted question, right? No, but I knew he would ask. Um, but, but it really, it's, is looking at it from a standpoint of how do we plan for We created a, uh, an internship program. So we're trying to pull young people out every, and we give them meaningful jobs that they're shadowing somebody or working, not just filing or something like that as an intern. But also, again, it's just, it's very difficult. It's hard to manage. So it's trying to entice them about the appeal of government, the appeal of the benefits that we do have, and maybe looking at it as a, you know, a good place, a good place to retire 10, 20, 30 years later. But that's really the greatest difficulty is trying to maintain, but just being realistic about it.

23:51saying if i so i what i started to say was i'm for pete we had a young woman who came on to our cyber security team um six months later she got a lot better money and i know that's going to continue to happen with that team right that if you if you got the experience of one year or two in cyber security you're you're going to be you know marketable very quickly so it's it's uh you're just trying to entice them in in whatever way you can thank you um great question I feel that that kind of starts with me and the environment that I create for everyone to work in. You know, while it's difficult and it's a lot of pressure, I work on creating a grass is green here kind of an environment.

24:38And while the pay is limited and opportunities may not seem that many, One of the things I always try to concentrate on is tech individuals are hungry for more tech. So I go out there, I put myself out there to look for new tech, security or cloud, whatever that needs to be. And I bring in vendors, I work with them, and I engage my, you know, my employees to work with these vendors. And, you know, the beauty of having the security team as well as... team and network team, I'm able to create sub -teams, smaller teams. I pick one from each other team and I get a smaller team in different fields doing an actual project on one solution.

25:29So this creates an excitement for them and then they enjoy it and they get to experience new things. You know, while doing all this, I also try to get rid of anything, legacy, anything that I don't feel that is a benefit to the organization. whether it's the technology itself or how much it costs you know there's multiple ways of looking at applications so it's it's essentially just turnover is actually the turnover within technology just get rid of all tech bring new tech in and I also force everyone to do two or three weeks of training a year at least I you know I brought in a on -demand solution so that Everyone can take training whenever they need to.

26:14And then I also send them to classes once for one week on a different from a different vendor so that they get to experience things in multiple ways. And Microsoft and other other companies have other free solutions that we use all the time to make this happen. I think that's a really great point. I've also found success in kind of giving people the leeway to to build stuff as I kind of like the time. we're in right now because you can be like oh yeah build something in house um and you know they can bring it to you and i've had a lot of people bring ideas to me and we can kind of build those without having to pay a vendor necessarily you know we could do a lot of stuff uh by ourselves now um and we also do uh training as well we do sans we give our analysts a sans course every year so that's they love that um and we give them the time to to finish those great Thank you.

27:09Other questions?

27:18Yes, sir.

27:21Jay's got a mic for you. I feel about the systems with users having older tools like SMS and Authenticator apps. How are you handling a user? secure fingers.

27:41My question is how you can use the security in Moves? Yeah, so, I mean, again, for us it's putting the, to as great an extent as you can, it's putting a barrier around, you know, the role and the tools that can be used. I'll just go off into AI tools now. We'd put tools in place to ensure that no one is going row with or at least to attempt to assure that no one's going row with with ai and we've limited it at this point to um the microsoft and then case by case evaluating and allowing as as need if someone says they need claude and can make a good justification to it to through their administration to us um but again i think it really comes down to even just what we talk about in general is putting the you know with the web application firewall or doing anything that you can at the edge because you're, you know, the back, when you get down to the, uh, the, uh, XDRs and things like that, you're not controlling those specific tools, right?

28:41So it's doing whatever you can at the edge to look at the traffic and determine where it's originating and where it's, you know, from the inside, from the outside and the, and both, you know, the, the, by, uh, I'm, I'm losing my word, but the, the two -way traffic, if you will. And so that's the, really is, is, is managing it that way as best you can. at putting the tools in place to control it, or at least monitor and alert?

29:08So the user's security release really starts at the endpoint. So, you know, we are very, very operationally made SLAs, short SLAs for patching. So we kind of have to start from the endpoint itself and not just the user. So we have, for example, five-day, three-day SLAs for... of patches we have eight hour slas for chrome adobe and so on so so reinforce these things which i feel will eliminate maybe 80 of the problems give or take um so so you know it's not really let the user just secure the user secure the endpoints and then you can also secure the user as well so in addition to that we have we have notifications alerts uh that we manage in in a way where if a person if an account is trying to log into a lot of endpoints at one time or actually doing things that have some anomalies, including entry ID, geolocations, and so on.

30:07You know, we immediately reset their password and reset their MFA tokens. So, you know, they're just really productive things you can do without actually having to do an overkill that will give you a lot more, you know, a lot more secure than... then you may own towards anything unfortunately i can't mandate anything um i can suggest but um we're getting better at onboarding uh so when we onboard a new customer we go through kind of what their security stack is and you know what are you doing um most of our customers are microsoft customers so it's very easy to kind of click through and enable some of the the tools that they have um i would say 85 to 90 percent of our true positives are identity -based attacks. So it's, it's, it's huge, like BCs.

30:52Um, so, and the nice thing is like with the fidelity of logging nowadays, you can kind of tell when they don't have two-factor turned on or they're using legacy authentication and that type of stuff. So, uh, really just kind of searching through the environments. We have analysts who will go through all the time and be like, oh, you have legacy turned on here. You know, please fix it. Um, again, I can't mandate they fix it, but I can highly suggest that they do. So that's kind of how we're, we're dealing with But on the executive side, there is mandates around like what they have to have. So that makes it a lot easier. So that's kind of how we're protecting identity.

31:33Great.

31:35Three more questions.

31:42Hi, this is Ali. I am public sector leader of Turkey and I have some guests. from our customers, local government leaders. They are also curious about all government entities around the world have their both global and local restriction compliance requirements. How do you ensure that you are compliant while using a platform like Cloudflare?

32:17From a compliance perspective, within New York City, we are actually governed by Office of Technology and Innovation, OTI, and New York City Cyber Command. So there's an entire compliance team over there, and they make sure we actually try to keep the SLAs, especially on critical SLAs.

32:38And again, compliance, you have to kind of look at yourself first before you can actually... about the compliance guys because they're at the end of the day i mean it's it's it's paperwork right you're you're you're doing something you're sending emails but if if you can if you can create a operationalized base solutions then the reality is your your compliance percentage uh from from an incompliant percentage actually just significantly drops so um in a while we we try to keep to the slas on a lot of things we face operationalizing things in play and making sure that it gets done and really be adamant about it is really where I start. And the compliance teams at that point, they don't come back to us as often because, again, our compliance is not as bad as maybe some other agencies.

33:32And Matt, if you want to answer that when you can, we have a few minutes left. I want to be able to get to other questions too. Um, but if, if one of you wants to add anything on, uh, we have a lot of audits, um, for the state on the executive side. Um, one thing that I will say with compliance is that I've seen plenty of organizations that are compliant, but that doesn't necessarily mean that they're secure, right? So you want to kind of validate, validate kind of what's going on in their environment, which is why I love working for the SOC. Cause I can just kind of dive into law and be like, well, you say you're compliant, but not necessarily. fairly true. So that's kind of where I come from from that.

34:14There were two more on this side. Kind of segwaying off the previous question, newer security tools, as we saw this morning, are going to leverage more AI. And in terms of the different nature of predictability or lack thereof, does this represent new procurement challenges? And how is public sector hoping to tackle those?

34:39so if i understood i i think you know from our standpoint it really is um you know it's an overall analysis and and hopefully not analysis paralysis when you're looking at the tools that you're looking you're asking about the tools that we are purchasing is that yeah so i and it really is going through and uh i'm uh you know my i try to be the buffer for my staff so we're not so so huge so i basically i attempt to listen to every vendor that knocks on the door. It's not easy, right? But I, I don't have, I don't, I really don't have someone to feel that, but I try to do that and then be the buffer so that I'm not tying up my staff with, with analysis of tools and whatnot. But if this sounds like it's worthwhile, then let's, let's take it to the, you know, the folks who know, and I'll take it to my staff. Um, and it, it basically, that's what it comes down to is there, there's a flood of tools, right? And you can be doing it, you've been developing something internally.

35:26You're looking at everybody's, everybody's got a tool that they, that they say we need, right? And it's just, and it's. for the corporate the private sector as well right but um i think that's really what it comes down to is just weighing and and sort of looking at it from an rfq or rfp or an rfi type of standpoint even if that's not really the way it was put out there to look at something but but bring it in let's look at the different vendors let's look at the different tools and do weighted scoring for lack of that i think from a technical perspective we're kind of looking at what models they're using model pinning um and the state itself is still working on that. But from my personal perspective, I'm kind of trying to move towards like on -prem inference, building my own tools, using open -way models.

36:12And that way I have a little bit more control. If I'm looking at a tool that is, you know, being sold to me, I'm looking at where they're hosting it. You know, the same requirements I would normally put around any vendor. Is it posted in the United States? Is it being run by people in the United United States to that type of stuff. All right. Great. So let's do just a quick lightning round to close out here. So what would be one piece of advice that you would have for other state and local technology leaders here in the room and elsewhere, other service providers and vendors here in the room? What would be one piece of advice that you have?

36:57them and helping you address the types of challenges that we talked about today you know i think it's the to to sort of for us to determine the challenge and put it out there but it's looking at and saying you have to you have to map your environment and that mapping means mapping the you know exactly the systems you have in place it means mapping the network but also means mapping your audience if you will the the like the for us in the various departments and whatnot and sort of mapping it out that coming into the role with no real understanding of the environment uh that type of thing and then looking at things what what do you what do you need to do what do you what can you put in place immediately like we talked i think the first question for me is looking at and saying what do you need to do what what do you need to replace how what's your time frame to do it what's your budget to do it how do you budget for it and then and also looking at it from the standpoint of um then moving forward putting the back putting the guardrails if you will around that you Using those tools, the web application firewall, the zero trust network, where you need to isolation and doing, as I said, micro segmentation as well as immutable systems and things.

38:06Where do you do that? And that's the thing is you have to come in and how do you walk into an environment like this? It's the 30,000 foot view and how do you get to 10 and how do you get to five quickly? It's not easy, right? And again, we're a mid-sized environment compared to some of the others.

38:24Yes. For me, essentially, first thing you want to really do is just try to reduce your footprint as much as you can. You don't want to be skewering things that you don't really need to manage. So that's one of the first things that I did. I actually went ahead and looked at the entire tech stack and see what I could do to reduce the tech stack overall and then deal with whatever else is in front of you. and then try to operationalize security in a manner where it just makes sense and it's not very complex so that you can actually move forward trying to resolve everything at once. And the last thing, and I said this before, is you have to scan your public-facing solutions and make sure you scan them and then just deal with those in that level that at least you know what the problems are before anybody else gets to it.

39:20i uh i wouldn't say that there's not necessarily a fear of like agentic probing and all that type of stuff but i do believe there's like a certain amount of fud surrounding around around that so i would say like cyber hygiene still applies right you want to let your attack surface um as much as possible um you want to put things up like laughs uh if you can't um and i think you know we see like billion probes per day but what does really a probe mean you know the automated scanners are everywhere um and then um know your environment uh inside and out that's a huge you know a huge issue we go i used to do for uh forensics differ for a long time you go into someone's environment and they have no idea what's going on right like um that's even get worse if you do suffer a kind of an lm style attack with agents like it's it's even more complicated now so knowing your environment is is crucial.

40:14And then things like automated pen testing, always testing your environment is going to be huge in the future. Great. Well, John, Doha, Matthew, thank you very, very much for being on the panel. Thank you for the partnership that we have with each one of you. We're honored to be able to help you solve some of these problems. I'm glad that none of you had to start over, uh, that, that, uh, that we were able to help in, in terms of. addressing some of the challenges that we've talked about today. I really, really appreciate you coming to San Francisco, being a part of this Connect conference. And to everyone in the audience, thank you for joining as well.