0:02My name is Sean Doherty, and I lead our work with financial services customers from a strategy and go -to -market perspective. Super excited to be here with you today to talk about how we're partnering with our FinServe customers across resilience, security modernization, and innovation. And I'm very lucky today to be joined by three fantastic customers. We have Q2, one of the largest digital banking platforms. in North America, Health Equity, the largest HSA custodian in the market, and Experian, a cornerstone of the credit infrastructure market.

0:39At Cloudflare, 16 years ago, our founders embarked on a mission to make the internet secure and available for companies to operate on. That's our mission, to help build a better internet. The one thing that I hope everyone here gets out of the chat today is how we're helping our financial services customers to meet their mission. So we work with over 2 ,000 financial institutions today, in addition to customers in other regulated industries and obviously the millions of customers who are in our free tier. The work never really stops in financial services. Financial services continues to be the most attacked industry. the world. We have volumetric attacks up 700 % year over year.

1:29And I'm sure all of you are feeling it over the last two days, plus a couple of weeks ago. Anytime a new exploit hits like Netscale or PHP yesterday, you all are often the first targeted and we're often the first ones to see it. And I guess if we're doing our jobs well, the first ones to reach out to help. after we've blogged about it um that brings us to our first theme which is architecting for resilience so that when those vulnerabilities do hit you can still operate with pace with reliability and with efficiency so we work with the vast majority of the top 25 global financial institutions in the world but we also work with small community banks we work with neoclouds wealth managers, asset managers, as well as, you know, the critical capital markets infrastructure providers.

2:25And when we talk about resilience, it often looks different to those different archetypes. For some, like the shape of resilience kind of takes the form of dual vendor architectures that allow for seamless failover. For others, it looks more like consolidation of vendor sprawl to a best in suite. platform like Cloudflare with a single control plane and robust automation. And for others, it looks more like kind of layered defense in depth. If you heard Grant talking about putting SSO in front of remote gateways to really reinforce the front line of defense. The thing I love about events like this is that we have every single one of those archetypes in the room.

3:10And I hope you all take that as an opportunity to talk to one another about what's working. and what's not working. And I'm very, very thrilled to have Jordan Hager, who is the SVP of Cloud and Developer Platform at Q2, come up and talk to us about what resilience means from the perspective of Q2, a multi-cloud digital banking platform. Jordan, welcome you.

3:39So Jordan, just to start, can you tell us a little bit about Q2 and your role? Yeah, yeah, for sure. Q2 Software, headquartered out of Austin, Texas, provides financial services solutions to 450, roughly, banks and credit unions across the United States. You know, just funny being here in San Francisco, walking down the sidewalk, you know, see many of our customers, you know, just kind of casually strolling. And, you know, again, we feel like we play a pretty important... critical role and kind of, I think, the freedom and flexibility that account holders have in the United States to choose beyond just, I think, the top three. Again, I mentioned 450 financial institutions. It covers about 60 % of the top 100 financial institutions in the United States, and we service more than 26 million consumers and end users.

4:35Incredible scale. When you think about resilience, you're not just thinking. about your firm. You're thinking about the 450 financial institutions, the 26 million of us who rely on that platform to show up when you need it. Can you talk a little bit more about, you know, what that responsibility looks like and what the challenges are that come with it? Yeah. Yeah. It was funny listening to the keynote this morning, you know, talking about Zynga and how I don't think Cloudflare was ready for Zynga back, you know, in 2000, I think it was 12. we've been a cloud player customer since 2019 I think we had similar concerns not because I think we were operating a similar scale as a Zynga but I think because we feel so strongly about the importance of resilience for those 26 million users I think you know when we talk about resilience and you think about what we do we essentially stand between the account holder and their money and I would say you know nothing will make somebody much madder than interrupting or disrupting their ability to access their money.

5:43So again, we take, I think, pride in that responsibility. We take great pride in being able to do that for our customers. We move about $10 million a minute through our platform, which sounds like a lot, but the reality is, is we're judged on a transaction by transaction basis. I think when you start to kind of boil. down, how important that is. We're talking about not only people's paychecks, companies' payrolls, but I think the example I always like to use is imagine yourself sitting in a title company or a loan office trying to close on a house, and the funds don't show up on the day that you're supposed to close the house. And you've got a U -Haul full of furniture, you're ready to move in, and the excitement of being able to move into that house, and then the wire doesn't show up.

6:33up and you know the title company can't close and you got to come back the next day that's the the worst case scenario but we have to think about the worst case scenario when we think about resilience um and just how disruptive that that can be to people's lives when we don't do our jobs incredible the scale of q2 i'm so impressed with i think if you aggregate all of the the assets ultimately that you're supporting in transactions you guys fall within the top top top four yeah with a wee behind tests Wells and Bank of America in terms of asset size. Yeah, that's incredible. Just by show of hands, does anybody know that that was the scale of Q2 in terms of what they're supporting? Other than the Q2 people in here, Dave, you've probably never even heard of Q2. Yeah.

7:16it's not really a secret to threat actors. Yeah. They do know, and unfortunately it means that you are a pretty big target given the amount of the economy that you're ultimately supporting. So, the threat landscape today, geez, it's different than it was even a month ago. Like, how has it accelerated for you? Frontier models, agents now having to interact with the services that you provide, like, how are you thinking about your perimeter and how Cloudflare helps the many challenges that you have? Yeah, I think, I think going back to why did we make this decision back in 2019? And I think I'm, I take a lot of pride as well. And I think being ahead of the curve in terms of how we thought about Cloudflare is this kind of force multiplier. For a company that was operating in multiple public clouds, so multi -cloud architecture at the time, we still had data centers as well.

8:06And we just thought about the, I think, how operationally complex it would be to operate across multiple cloud environments, private cloud, public cloud. We just felt this need really early on to unify that control plan. I think you said it earlier. I've heard it a couple of times today, but I would have always, you know. talked about this ubiquitous control plane and the ability to centralize. And we didn't really do it so much for the benefit or the purpose of consolidation of vendors. It was really more the operational scale that we could get if we thought about a single control plane, one WAF, one firewall, one load balancer, you know, to kind of rule them all, so to speak. And I think you bring that forward to, you know, how timely it is today. I almost blame you guys for the PHP vulnerabilities as a...

8:53talking point of conference i'm kidding um but uh you know you think about we essentially go to one you know control plane to roll out a laugh policy to then you know mitigate or de -risk that php vulnerability so i just think about that as a really good and timely example of how operationally we're able to scale across again a pretty complex environment thinking again if we had to go to you know seven different wafts to roll these you know signatures it would be pretty complex and then i think if fast forward to today you start to think about the acceleration of things like post -quantum cryptography and i think the need to be able to get the pqc as quickly as possible that's not something that we really have to think about it's something that you know we get as a benefit or a value add of being on the cloudflare platform i mean ssl rotation there's so many things that i think we've just been like man imagine the day where we had to go manually rotate certificates if we had to go think about pqc and you know the readiness behind pqc so um i think again we've gotten a ton of um amplification if you will out of the ability to just leverage the cloud cloud cloud cloud platform um for again kind of this management of this multi -cloud environment and then you know just finally say i was um at a cloudfire event a while back speaking with jeremy hartman who runs infrastructure for cloudfire and i said is it true that this whole like toxic combination where two lows can become essentially a high

10:23and he's like, it's very true. And I was like, man, like, I kind of like throw the towel and then just go, you guys do this for us. I don't want to think about this. We've talked a lot over the years you have about post-quantum. And I think with the Emeritus stuff just this week, I feel like, you know, the warnings on the rear view. is, like, 100-point font now and blinking red. So, I mean, can you talk a little bit more about the value of, you know, just having that from the Cloudflare platform, especially for those who are not sitting in a position where they have that consolidation and they're having to do inventory thousands of, like, on-premise devices in order to get ready for this? Yeah, again, it's almost, you know, we're spoiled in the sense that we don't have to think a lot about it.

11:13Today, I think 40 % of our traffic is PQC enabled and that's not something we've had to really, we haven't taken an action to do that. That's just, again, something that Cloudflare has helped us achieve. I think you think about TLS, you know, life cycle around TLS 1 .1 to 1 .2 to 1 .3. Again, nothing that we're doing to support, I think, what almost feels like run or keep the lights on type of business, run the business type of work. that's just something that we're not really having to think much about again the the best part of that is is that we're able to think about the things that are value adds to our customers um they just expect us to do that type of work yeah so we're able to then go think about and again i think kind of the um in retrospect the funny thing about this conference is five years ago very much an infrastructure conference i remember this slide is like cloudflare is a him that's like replace the word Developer platform was not one of the words that you could substitute in.

12:13So it's funny to see now how this has evolved. But I think the cool part of that is that we're really now talking about the things that create value, intrinsic value for our customers. And unfortunately, PQC is not one of those. It's just an expectation that we can do that, right? And a fair expectation of that. So you mentioned being able to focus on those more value-add things. What are some examples of some of those projects that you're teaching? were able to tackle that you wouldn't have had the resources to do. Yeah, I mean, aside from what we've talked about in terms of infrastructure, it's almost, again, a little serendipitous here in that the people attending conference from the Q2 team are now part of our Innovation Studio Marketplace team, people that are responsible for opening our platform up to our customers to then allow our customers to develop on the platform.

13:02So we have developers here at the conference, which, again, it's, you know, life. life comes at you fast as they say um but it's cool to just see like we're able to now think about how we can leverage you know primitives and isolates and things like that to kind of think expand the capabilities and we were sitting at dinner last night one of the the gentlemen said you know the thing i've gotten from this conference is i'm not thinking big enough i'm not you know dreaming big enough so i think that's the really cool part is we're just now i think kind of like cracking open this new opportunity or this new channel of things that we can go do on the Cloudflare platform. I'd love to hear it. And, you know, one of those new primitives that you guys are leveraging is our AI gateway to start to unlock, you know, enablement of agentic within Q2.

13:48How are you thinking, you know, about managing that tension between enablement, security, and also cost? Yeah, yeah, good question. So again, we historically have always thought about how we manage that tension between Q2 and Q2. managed a single control plane at the perimeter to keep the bad guys out, almost this outside -in mentality. Now we're thinking really more about kind of inside out. And, you know, when I think about some of the things I heard this morning, such as, you know, being able to allow the enterprise to keep up at the pace in which I think people want to consume AI and AI tools, that's the challenge here, is how does the enterprise not get in the way of innovation? and the appetite to consume more and more of the things that I think allow us to innovate.

14:36And again, we're now thinking about AI Gateway as, again, single control plane, enablement for the business, but also I think to protect people from doing something where, again, we are in a regulated industry. Our customers do have expectations about how we're managing and securing their data. We need to make sure that we're being thoughtful about that. But again, I think this comes back to... consolidation, single control plane, AI gateway for the ability to do that at scale across multiple cloud environments. Not a whole lot different than when we're talking about WAF, but then some of the value adds here that we get from things like dynamic prompt routing, hopefully, you know, I think token optimization. You know, I think everybody's kind of living through this tokenomics and thin ops challenge that we're facing. So our hope, I think we literally signed the deal, you know, three weeks ago, but our hope is that it's almost self-funding in terms of, I think, kind of the value that we get back from optimizing our token spend, but also not getting in the way of what I think a business is trying to incredible.

15:35But I can't wait to have you on stage again next year to hear about the use cases that you've been able to unlock with that. Yeah, me too. Jordan, thank you so much. Yeah, thank you. I really appreciate it. Thank you so much.

15:51So, for the next theme, we're going to move up the stack a bit and talk more about how Cloudflare is helping to secure and modernize client experiences. In an agentic era, I think security and agentic client experiences often feel like two sides of the same coin. So if you flip to one, you risk a reach, you flip to another, and you risk being disintermediated from your own client journey. We at Cloudflare hope that you don't have to make that decision when you work with us. But don't take my word for it. I'm going to welcome Ajit Gadam, who's the head of Fraud, Trust, and AI Platforms at HealthEquity to talk about how Cloudsler is helping to secure nearly $40 billion worth of our own healthcare dollars.

16:40So, Ajit, welcome. Just to start, can you tell us a little bit about your role within HealthEquity and what you guys do for the healthcare economy, Jim? Yeah, so for those who don't know HealthEquity, equity, we're the nation's largest. So actually, I'll take a step back. Probably a couple of weeks from now, every one of you might be receiving an email from your HR or benefits team saying, hey, it's that time of the year, open enrollment starts. So go click on that button and then take care of your, you know, what plan are you, you know, looking for from a benefit standpoint. So health equity, we're the nation's largest benefits administration. from that standpoint, whether it's your health savings accounts, FSAs, dependent care, child care benefits, commuter even, so everything. All close to about 17 million humans use us, so we're pretty active.

17:33My role at health equity, I lead our fraud and trust teams, but I also have responsibility and oversight for AI and data security as well. large portfolio, including identity, I forgot about identity, the big one. So we package all of that together. And we think about this as a umbrella notion of trust. How do we deliver trust? It comes through securing identities, data, AI, agentic experiences. And, you know, we put that package together in my portfolio. It's a pretty unique relationship that you have with your their healthcare dollars for a moment of need in in the future can you can you it's it's unique compared to other financial institutions can you talk about how you have to manage under what is effectively the regulatory regime of a bank but probably not as many resources as some of the banks in this room but equally high client expectations yeah i mean uh uh for those who know what i mean like i had a similar role at wells fargo uh so So the comparison and contrast is very obvious, but there's so many similarities and differences at the same time.

18:51And what's unique about health equity is, like, you think about it, like, it's we're holding your PII. We're holding your medical data, a.k.a. PHI. We're also safeguarding the dollars. Like, when you subscribe to that enrollment plan, you're saying, hey, take... x dollars from my paycheck that's coming in to us so we call that as your custodian of those assets so in a way we're your bank uh we're uh we're a financial fintech company and we're a healthcare company so it's like a pretty amazing cocktail of uh data very interesting data assets and dollars all smashed together yeah so it's interesting super interesting and You shared an anecdote with me about a dad in the emergency room last week.

19:43I wonder if you could tell that story here because it's really interesting. I think it's something security leaders are sometimes scared to say out loud. Yeah, so this was my first opportunity in my professional career working for a health care institution. And one of the first things that we experienced, like my team experience, I experienced was

20:07Just go back to reflecting on some of my personal experiences and perhaps yours is someone set up a transaction, a point -of -sale terminal, and they have been largely an inactive user for, say, the last five years. And their first transaction ever that your system is seeing is, say, for $5 ,000. What do most anomaly detections? fraud detection, network detection models say, hey, we don't know this person, we don't trust that individual, this is coming in from a foreign location, they have never used their card ever, and it's coming for a very high dollar transaction, so if we get this wrong, you know, we're in a world of trouble. So what's a natural, how do we train our models?

20:54We train it to say, this is bad, denied, fraud. decline it. In my world, the most interesting fact is, like, say, the scenario I was sharing with Sean was when you're using your healthcare dollars, you're hopefully, you never had a chance to use your healthcare debit card because maybe you and your family are healthy. So, you know, let's keep it that way. But say when you need it and you're, say, you're at the prescriptions office, you need to engage in that transaction at the hospital for your child who needs to go to Arjun Care. And when you're at that point of sale terminal at the doctor's office, at the hospital, and when you swipe that card for $5 ,000 for the first time, that transaction better work.

21:43That's the fundamental difference from an interesting perspective. It's not just about the threat, like what we traditionally think about a threat. All that, we just had to toss it out because none of that applied. In those high-dollar situations, they... work the first time not the second time see you talked a lot about how you can introduce at least you know some smart friction into that process which i i think is the only way to think about when you have that responsibility on the other side so can you talk a little bit about how cloud flare layers and dials actually allow you to implement that so you can show up but also be secure yeah i mean it's been a pretty fantastic partnership with with uh with cloud I had a chance to work for the largest payment network on the world.

22:33So I sort of understand the powerful effects of a network. And that's what I was looking for in Cloudflare is when someone is looking at 23% or whatever that number is now on the global internet traffic, both the good and the bad. Like I said, in my situation, that first time when that needs to work, the only way. for us to be successful is to delegate some of that friction rate limiting behavioral analytics location analytics geothreshold and just the whole thing from a capability standpoint when you have a trusted partner who sees the world the good and the bad and the ugly and you're able to distill that to very fine -tuned outcomes and rules then you know we can rely on that to sort of secure our boundary and anything that comes in to us we can add those passive friction right like whether it's a behavior biometrics like how do you type how do you move your mouse touch devices gestures look so those passive indicators so we marry cloud data then behavior analytics data the device intelligence that we sort of introduced into our app and our products and services you pull that together.

23:51The risk engine allows us to surface some pretty smart friction and how do we not interdict every single thing that's coming in, but we interdict on what is not an outlier from a data standpoint, but an outlier in behavior. So it allows us to be very smart about that. It's incredible. I'm sure it's taken you guys a long time to implement, and this is not a problem that's ever solved, right? You need to continue to innovate in order to guarantee. that kind of member experience but once you managed through the challenging period of getting this really in a place that you were comfortable with where did the team start to dedicate focus in terms of the broader member experience yeah um so another interesting thing i just want to go back on my dad experience and i think this might resonate more sean with with your question is um you know our front lines whether it's a call center staff, or the agents that we have enabled to serve as a customer.

24:54Like, if you think about it, like, again, if you lose your card, I'll just speak on that, you're annoyed, but you order a card, and for 48 hours, you are sort of in a pickle. But when you're calling in, and attackers know this, and we know that the attackers know it, they are trying to exploit the time time sensitivity on the situation, they know that, like imagine, and I get to say the same attacker in my same dad example, now they're trying to social engineer, they're trying to call into our call center saying, hey, I'm a dad, I'm a kid with me, I need to swipe this card, or I need to log into my account, I'm not able to log in, unlock me. What is that agent trained to do? They are trained to service the individual, they're trained to, they're empowered.

25:44to take care of them then that is our biggest problem is is how do we power our agentic experiences and our staff where they're not being an investigator they're not being a security specialist we do not want them to interrogate the customer because most of the times it's genuine it's a dad who needs help it's not an attacker who's trying to social engineer so so for us like for our team The amount of time we're spending now, especially post -training, our chat experiences, how do we distill down the differences between a attacker or not? And then we always knew for the last 20 years that trust or authentication is never a Boolean factor.

26:34It is a continuous function that has never been more real than now. Well, Ajit, thank you so much for joining us today and for being such a fantastic partner to Cloudflare.

26:50So Ajit talked a bit about agentic experiences, which is a great transition to our final topic, which is building for an agentic future. And I think especially the events over the last couple of days highlight the fact that a lot of our FinServe customers think about Cloudflare in break glass moments. DDoS. There's a new vulnerability. We need to deploy a WAF role. But increasingly, thanks to our developer platform, our inference capabilities, and just like the sheer pace of innovation, customers are starting to think about us as a partner more for light bulb moments. And I'm really excited to have Kathleen Peters join, who's the chief innovation officer at Experian, to talk about one of those light bulb collaborations.

27:36Awesome. Thanks for joining us today. Thank you, Sean. So, Kathleen, can you tell us a little bit about your role at Experian? Yes. So, I am Chief Innovation Officer, particularly of our identity and fraud business at Experian. And innovation means prototyping. It means second and third rise in new product development. But it also means finding the right partnerships, as well as potential startups that we want to engage to either have early partnerships. with, or maybe even an investment. So it's a little bit of organic and inorganic to bring the best solution together. It's been fantastic. You've been such an incredible partner, not only to Cloudflare, but to the financial services ecosystem. And I think people know Experian for, you know, credit data, obviously, but what we've worked on feels a lot more like frontier technology to me. Yeah, absolutely.

28:24I'd love for you to tell the group here more about Experian HR. trust, what it is, and like why now is like the most critical time for us to be working together on solutions like this. Yeah, thank you for that. Yeah, Experian obviously known globally for our very trusted data for identity verification, financial health, credit risk. These are the things that we're known for. But underlying all of that capability is the ability to do advanced analytics, insights. There's a lot of innovation there to bring all of this to life. A lot of our business is B2B, financial institutions represent our largest client base, but we also have a massive direct -to -consumer engagement and population as well.

29:12And so as we saw the agentic revolution starting to happen, and as we started thinking about this last year and what that would mean in terms of innovation, we recognized that one of the early areas where this was taking off. was going to take off was agentic commerce. So I think when we started talking maybe around Christmas time or even January, this was an area that was being leaned into. Open AI was early talking with Stripe. There was this notion that agents would be able to help us shop. I think the help me plan my travel example is we're growing weary of that one now, but that was the one that everyone was talking about for a while. And then there was a whole lot of experimentation going on. I live here in the Bay Area. We would go to tech meetups, plugging together different boards and APIs, talking to APIs and a lot of happy paths, technological proofs.

30:04And we would all clap and it was exciting. But at that time, there wasn't a whole lot of shopping going on yet. So we started talking to folks in industry, partners of ours, clients of ours, as well as big retailers and banks themselves saying, why is nobody shopping? And even just asking our coworkers, our friends, our family, why is nobody shopping? shopping yet. I was like, well, I don't know if I trust it. We heard over and over again on both sides of the equation. I'm not sure if I can trust. And why can't we trust? I don't know if you guys have been watching Elon Musk just about 10 days ago, too, said, hey, no problem. Take a picture of your credit card. Give it to GrokBot. Everything will be fine. So there's still that trust that we have to earn. And if we think about even e-commerce and how e-commerce started out like what made all of us comfortable decades ago to just go into the internet and give amazon or paypal or a merchant our credit card online because things would go wrong we need to know that when things went wrong it would be remediated and every relying party in that chain understood where their position was what their responsibility was and it would be made right we trust and we love shopping on amazon today because we can find we need.

31:20If we make a mistake, we order too many, we change our mind, we don't like it, wrong size, whatever, we know we can go to Whole Foods or to UPS or just throw it in the mail. Everyone will be taken care of. Merchant's happy. We're happy. What does that look like when Muse is shopping for us? Well, I don't know yet. Who has tried Muse or Dot or Instinct? A handful of people in the room. Yeah, I know Tim has. Yes. Super convenient, right? It's actually exciting. how good it is. We are miles from where we were a year ago when we first started talking about this. The convenience is intoxicating. And yet, what's going to happen when something goes wrong? I talked about innocent things. Oh, I changed my mind, didn't get it in time, whatever, wrong size. Those are the innocent things. The fraudsters are coming. If there's anybody who's experimenting a lot that every hand would be raised in this room, it would be fraudsters, right? Right?

32:10And so I know know that this holiday shopping season is going to be one gigantic experiment. And so getting back to your question, like why now? Why Experian? Why are we leaning into this? For decades, we have been verifying human identities. And the reason e -commerce has worked for so long is because everyone understands the role and it all comes back to knowing the human behind the transaction. And whether the human is going to be in the loop, which I think is going to be for a little while on financial services, the promise of AI assistance is for autonomy. And for that to be possible and viable, we need to know who is the verified human behind the agent. Not just the email you signed up for your Grok account with, because you can do that for your dog.

32:58It is like, who is the actual verified human that would pass a KYC for a financial institution for getting at my HSA account? We need to have that verified identity tokenized. and available if it's going to be highly available i also want to be at the edge so that i can be rapid in my responsiveness and that's where working with cloudflare has been awesome it's been quite a journey since yeah i can't believe that it's only been since december january and i yeah i feel like you know the the friction in the in the ecosystem is like bounced around you know it yep consumers a bit with issuers a bit with merchants like what are you hearing today from the ecosystem in terms of where there's real momentum and where friction and that trust is still maybe not there yeah i think the user interface so just over the last uh if you look back amuse was announced almost exactly eight weeks ago september 8th i think was exact date so we're just still in the matter of weeks on this right now so that friction of how do i get started i'm not really sure a lot are excited about the convenience of these personal assistant funds.

34:13And because they're coming from some of the big tech foundation companies, as opposed to the early version of OpenClaw, which was just open source, and who knows, right? All of us as security professionals got really worried. I think coming from these very solid platforms, that friction, we've taken a step to building trust with consumers. I'm not sure that trust is earned just yet. Let's see what happens when things go wrong. But I think that friction is one where consumers are now ready more than before to experiment. The friction that I see happening is retailers are worried about losing the relationship with that consumer, the loyalty. I mean, even as a consumer, I want to be recognized when I go and I shop.

34:59I want my points. I want to be able to get the freebies. I want the special pricing. I want the loyalty. better believe the merchant wants to recognize and maintain that relationship what does that look like so that one's not quite sorted out but they don't want to miss all of the traffic either the real change in the friction point is that financial institutions are coming to us now and saying oh this is earlier than we thought yeah we thought we're gonna be able to wait till next year um but as you may have seen with jamie diamond's announcement to lock the front door None of these personal assistants are going to be, you know, migrating their way around Chase .com if he can help it. Right. They're already there. That's why. Right. So. So no more anyway.

35:45That is a high friction, I think, temporary situation till they can figure out how do we get that trust. And once the trust is established, then we should be able to do FCRA regulated types of account opening credit card applications. this is an area of trust, so it's going to be high friction for a little while. That makes sense. And yeah, we'll talk a little bit more about edge use cases. But last time we spoke, you mentioned you sat down with a CISO of a major restaurant brand. And I was wondering if you could tell that story, because I think it does really encapsulate like the friction that exists in these security leaders' heads. Yeah. So this is just in the last month. So Muse is on the scene, had a chance to sit down with the CISO of one of these umbrellas. of brands of fast casual restaurants name them right now but it is public and we can talk about it afterwards if you like um but what he was seeing so he has a number of restaurants that are in their restaurant family um and a lot of these are where people might order something and have it sent via a food delivery network etc and so interestingly and we were kind of laughing about this is there is an unusual number of people who are ordering pancakes to be delivered now who wants soggy lukewarm pancakes i'm not sure but apparently this is very popular especially late at night with agents with agents with agents and so what was really crazy was all of a sudden and at that time and this is again about four weeks ago he said our franchisees are getting slammed with muse agents trying to buy pancakes and like

37:19the pancakes thing that's funny to me but he was worried about fraud and so he said they have a big challenge here this because with his restaurant brand a lot of the actual retailers are franchisees sure they don't have CISOs they don't have professional firewalls they're kind of inheriting whatever is on the platform that's just delivering the business and they're that last mile to deliver they do not want to pass up this new channel of business because an influencer says hey it's that time buy your pancakes all of a sudden the orders are coming in they don't want to miss that but they're also really worried about fraud people are giving in the clear 16 digit unencrypted pans of their credit card numbers to these agents to go by on their behalf. And then those credit card numbers are being presented as if they're a human to the franchisee so that the door delivery guy can can then deliver the food.

38:10He's like I am so worried about the fraud threat surface here and how I manage this across. So he started leaning in early and he's putting infrastructure in place to helped to know that agent, to recognize that is there even a human behind it? Are they just under attack? What kind of information? How do we do data minimization? And so this is a really evolving space. And it's not just banks. It's even restaurants. It's low dollar value transactions at volume. It's franchisees. So I think this is a real changing environment that is going to be when we watch this space. So Cloudfire obviously sits in front of a large, large portion of these merchants and their pancakes.

38:59Can you tell us a little bit more about the role that you think Edge has to play in agent trust and the registries as well? Yeah, I think one experience that I've had, if you've been playing around for a while, so let's never mind the personal assistants for a moment, but if you've been using ChatGPT or Claude or Gemini, just to... do some exploration, some discovery recommendations, it is still kind of slow. If you compare that, if we're honest with ourselves, to compare that to, I just need to do a simple Google search of a question, it's much slower than that. There's going to be a low tolerance, which is why I think the assistants are actually so popular, because of the convenience that maybe we just don't have to wait on anything. But it's going to be so critical for businesses.

39:46relying parties to understand that there is a human behind that agent that there is verifiable intent that the under the guardrails that are known are understood by that relying party and this has to happen in real time it's often not just one party it's not just the merchant with cloud flare in front right they're relying on that as a first line of defense because they're going to need to give information to the payment rails to however they're doing their fulfillment. And so there are a number of parties that in real time, we have to settle this very quickly. And that's why having reliable information right on the edge is going to be so critical. Yesterday, our head of innovation engineering, Tim, gave a talk in the technical track of some of the things that we've already built to show that this is possible and the value it can bring.

40:37So this is just the tip of the iceberg. We're really excited about what's to come. It's incredible. I encourage you, if it was recording, to go see Tim's chat from yesterday. I guess one last question, moving away from like edge delivery to more of the edge use cases you mentioned, JP Morgan, some of these use cases like agentic trading did come to the surface way faster than I thought they would with platforms like Robinhood. I guess two part question, like one, what recommendations would you make to the large financial institutions who are grappling with this? And then part two, Where do you think this is headed in the next like six to 12 months? And I'm glad you didn't say six years. You know, yeah, I get those questions are ridiculous anymore. I think it's really interesting what's happening and what we're developing is a playbook for financial institutions.

41:25And this, again, it makes the bread and butter of our business. These are largest clients around the world. They trust Experian to help them understand their risk, especially associated with these kinds of transactions. We want to be able to create. to pay playbooks such that when you have instances like what Chase is doing, they've made the announcement that they're going to block all of these personal assistants and other third-party bots or agents at the front door. And then there's going to be some sort of token swap whereby then an agent from Chase will then carry that transaction inside of Chase and then be able to hand it back out to whatever showed up. So this is going to be a new type of development. There's going to be a lot of layers. trust there? What needs to be present? How are you going to be able to evidence that? Because we all have to report to regulators when we're in this kind of a space.

42:12Is the regulator educated as to what to look for? How are we going to explain everything that's going on here? Anyone who does financial models know that explainability and evidence is such a key part of this. So these are some of the things that are going to be evolving. That playbook is something that we know is needed. It's needed for our own properties as well as for our clients. And so we're excited to be working on thinking about what that future looks like. And as we look forward to what's next, I think that this is going to be a very interesting season. We know the fraudsters are going to be experimenting and looking for wherever there's a crack or a vulnerability. They're going to be looking to see how they take advantage of some of the weakest links, which today are still call centers and customer support and traditional tools.

43:02can be deepfaked there, especially when it comes to voice and even images and such. So we need to be really aware and think about as an industry, how we're going to deal with this situation, because it's going to be coming at scale and a scale that we never even imagined. Well, Kaffin, thank you so much for joining me today. I can't wait to work with you guys more on these emerging protocols over the next months. Wonderful. Thank you so much.