In this episode, Tony Cook, Vice President of Service Strategy and Threat Intelligence at GuidePoint Security, and Patricia Titus, Field CISO at Abnormal AI, discuss how agencies use AI to prevent phishing attacks and secure email gateways. Discover how Federal agencies can leverage threat intelligence, incident response, attack surface management and Zero Trust to protect critical information.
[Anthony Jimenez] (0:12 - 0:43)
Welcome back to Carahcast, the podcast from Carahsoft, the trusted government IT solutions provider. Subscribe to get the latest technology updates in the public sector. I'm Anthony Jimenez, your host from the Carahsoft production team.
On behalf of GuidePoint, we would like to welcome you to today's podcast, focused on advancing federal cybersecurity with trusted AI. Tony Cook, Vice President of Service Strategy and Threat Intelligence for GuidePoint Security, and Patricia Titus, Field Chief Information Security Officer at Abnormal AI, will discuss a GuidePoint security conversation focused on advancing federal cybersecurity with trusted AI.
[Tony Cook] (0:43 - 2:20)
Welcome to Mission Ready, a GuidePoint security conversation focused on advancing federal cybersecurity with trusted AI. Today we're exploring how nation-state actors are changing the email threat environment, where traditional defenses can struggle, and what federal security leaders can do to strengthen their security posture. I'm Tony Cook with GuidePoint Security, and I'm joined with Patty Titus from Abnormal Security.
A quick word on where I sit at GuidePoint Security. I work on the side of the house that looks at an organization the way an adversary does, so external surface management, incident response, and threat intelligence. In practice, that means I spend most of my week with security teams, a lot of them in the public sector, figuring out what an attacker can see, what they can reach, and how fast we'd know if they got in.
Email comes up in nearly every one of those conversations because it's still the front door that most attackers try to get in with. So this topic isn't just academic for me. Hopefully it'll be really, really fun.
My guest today has seen this from more angles than almost anyone I could have asked. Patty Titus is a field CISO at Abnormal Security, but before that she spent more than 25 years in security and held the CISO role at TSA, the Transportation Security Administration, at Freddie Mac, at Symantec, at Unisys, at Markle, and most recently at Booking Holdings. She started her career in military intelligence, and she's made the hard email security decisions from the operator's chair in government and private sector, which is the perspective we want to talk about today.
She also serves on the boards of Blackkite and Glasswing Ventures. Patty, welcome. Before we get into the threats, is there anything you'd like to add about the path that got you to this point?
[Patricia Titus] (2:20 - 2:30)
No, it's a, and just one little tune-up. I know it says signals intelligence, but I do like to say that's just a fancy word for a Morse intercept operator. So there you go.
[Tony Cook] (2:31 - 2:56)
Very nice. Very nice. Awesome.
So let's start at the top. Every agency already has email security. There's no shortage of vendors, and there's no shortage of policy.
So what I want to understand is what's actually different about this moment in time for us? If you had to use one sentence, what would security, what should security leaders understand in the email-borne nation-state threats right now?
[Patricia Titus] (2:57 - 3:05)
It's moving at non-human speed. That's my one-liner. Normally I can't just give one line, but that's my one-liner.
[Tony Cook] (3:06 - 3:15)
Yeah, moving faster than we're able to do. What's changed enough that the older assumptions about email defense don't hold up anymore, right? So if we're changing that mentality, what does that mean?
[Patricia Titus] (3:15 - 4:00)
Yeah, so, you know, traditionally, and it worked really well, by the way. Let me just quantify that before I get started. It's email security.
We're looking for indicators of compromise. And to be honest with you, what you were hoping is it would happen to somebody else first, and then you could send your folks off to write rules or update firewalls or check the endpoints, whatever it was that you did based on your email protection in place. But the IOCs today, those indicators are not good enough anymore.
The emails come in and they just don't have any of the normal flags that would set our email security out to alert.
[Tony Cook] (4:01 - 4:18)
Yeah, no, that makes 100% sense. So why should a federal leader treat this as a mission readiness issue rather than just an email security issue, right? So if those things aren't fast enough, right, like, is this a mission issue?
Or is this just an email security issue?
[Patricia Titus] (4:18 - 6:15)
No, it's a mission issue. And the reason it's a mission issue, is we're already seeing this type of capability. You know, we've been, we've been training our people on how to spot phishing campaigns.
And, and we've spent a lot of money, quite frankly, in the public sector and the private sector on being able to spot like, you see a rogue domain that just doesn't look right. Or, you know, it's asking you to click on something, and there's urgency to it. Well, they're coming in now without any of those.
And so we're expecting our employees to be that frontline of defense when it's not defensible anymore. So back in the day, when I was at TSA, I remember Kip Holly. He was our administrator at the time.
And he said, Patty, when are you going to stop using humans as the frontline of defense? And I did make the comment when we stopped using humans to screen bags. And as you know, the technology and baggage screening has gotten a lot better.
If you remember the early days of TSA, they would open your suitcase and go through everything. And that I liken that to the way email security has also morphed over time. So we don't, we don't have time to go through everybody's suitcase, basically, of what's in an email.
Now, what we have to do is look at what is the behavioral components. So I did read today in Revolt that they had a huge breach. This is a European, I believe it's a crypto company.
And they had an urgent message from the government to send passport data, IBANs, accounts, the whole nine yards. They only got their banking license in March. And they sent it all.
So like 6 million. And like, as you know, the IBANs and all your account information is how you're moving crypto around.
[Tony Cook] (6:15 - 6:17)
Yeah, that's incredibly important information.
[Patricia Titus] (6:18 - 6:37)
Incredibly unfortunate for this company. But again, how are we thinking differently about protecting our employees and taking the decision making out of their hands so they can focus on their job and not be paranoid about clicking on stuff. People are just paralyzed.
They're paralyzed.
[Tony Cook] (6:38 - 7:19)
Now that makes 100%. I love that analogy of being able to make it look exactly like how TSA would have worked to begin with, right? So as luggage comes in, that's way moving way too fast at this point, right?
Like you'd have to be just shoving, you know, baggage through and hoping that somebody gets something out. And that really kind of alludes to like, where that mission actually kind of lives, which is in the mailbox, right? Like, that's where we're, we're trying to get to.
So if that mission is, if that mailbox is where the mission kind of lives right now, let's talk about who's actually coming after that, right? You've watched this from inside a federal agency and from the commercial side. So make this a little bit more concrete for me.
What does a modern nation state email campaign targeting a federal agency actually look like from start to finish?
[Patricia Titus] (7:20 - 8:57)
It looks like legitimate traffic. It looks like a contractor that you do business with that may have had his credentials hijacked or harvested. It even has the same tone as how you would communicate with them.
So maybe I do business with Bill and my opening email would say, Hey Bill, how's it going? How's the wife and kids? It used to be, it would not look like that.
It would come in saying, hello Bill. I would like to talk about our procurement activities. It's not coming in like that.
It's coming in like how I communicate with Bill. And so it's, it's so much easier to target an individual specifically, instead of it being the spray and pray of yesterday where they would just send out tons of phishing to a broad spectrum. Maybe they bought a, a cache of, of, uh, of credentials from the dark web and they were just blasting it out.
They now have the ability with AI to target that specifically to Tony. Like I know everything there is to know about Tony because I scraped everything I could find on Tony in machine speed. So, and they put together this well-crafted, they, they even have like, you know, they have everything about you.
And I was on a panel last week at Billington and, and they actually said, if you have a voicemail message on your phone, that's enough to capture to do a phishing. Yeah.
[Tony Cook] (8:57 - 10:34)
It was in faster and faster before where you used to even see like, maybe it was a word document that had like a macro in it that can come across and you click on it and get something right. Or to your point, like going back to that TSA example, right? Like maybe even there was like a pocket knife inside of something.
Are you going to catch that? Obviously you're going to catch some parts of those, even then moving it like kind of machine speed maybe, but they're not even doing that anymore. These things are more identity based, right?
Like where it's about who you are and what those things actually look like to, to mimic what that is. I think one of the things like when we're starting to think a little bit more about using AI for social engineering, for that to become like the next level of this. And we ask about like scalability on that.
There is no, you know, thing that they can't scale up to on that side. So definitely makes sense. Have you seen any of those?
Like, I mean, obviously we've seen a little bit with Russia, we've seen it with midnight blizzard and China with storms and a bunch of these nation state actors starting to really utilize the things that you're talking about, right? And those hard to know patterns, right? Some of the ones that we look at are vendor email compromises, things that look very specific, very exactly like in most instances, what that would look like from the vendor in and of itself.
Some of those are more O-off consent phishing, right? Where the victim grants a malicious app access to your mailbox, right? So some things that we haven't even really kind of seen before in that side.
And I think one of the things that we're trying to understand on this side is, is like the secure email gateway sits at the perimeter and sees all of the inbound email and decides on what known bad indicators are, right? Is that still the case today? Is that still what we're kind of looking like from that mentality?
[Patricia Titus] (10:34 - 11:36)
Yeah, I mean, the the segs, the secure email gateways are doing their job based on old capabilities, old technology, that's the indicators of compromise, the malware, looking for an attachment, you know, looking for it coming from a rogue domain. So yeah, those are still it's still catching some of them. If you've got Microsoft, or you've got Google as an example, sure, it's going to catch some of it.
Some of the challenge is that you really don't know what's getting in. But I'll tell you, once you see it, you can't unsee it. Yeah, so it's, you know, we've got to find better ways to to ensure that we're closing down the front door as much as possible.
And making sure that the bad guys basically don't get into our environments in the first place. And, and don't, what you don't want is an email that gets through the seg, and it sits in someone's email box. And that dwell time gives them time to click.
[Tony Cook] (11:37 - 11:38)
Yeah, that makes sense.
[Patricia Titus] (11:38 - 11:47)
And then it's going to propagate. And so let's, let's just let's do what Kip asked me to do. It was a little bit ago, like 2003.
[Tony Cook] (11:47 - 12:35)
Not that long ago. It was just a couple years ago. All right, let's double click down on that for a little bit.
So you just described that attacks that don't look malicious on the surface. And the industry's answer in a federal, I'm sorry about that. Five seconds.
You just described attacks that don't look malicious on the surface. The industry's answer to that is also AI. And in a federal environment that we're just carrying comes with a lot of baggage.
I'd rather take the skepticism seriously than just wave it off and keep this approach, not just about any one tool. So let's start with the simplest version. How would you explain behavior based email detection in plain English to a skeptical federal mission owner?
[Patricia Titus] (12:36 - 15:22)
Yeah, so you have a challenge, right? You have a challenge of balancing protection, speed, scale with human behavior, which what what we want to do is be able to understand the behavior of the individuals as they're going about their business, answering emails, which somebody once told me we were going to be done with email by now, but it's still the pervasive way we all communicate. And so you want to understand what's normal behavior for the person on the network?
What's normal communications? Who do they spend the bulk of their time talking to? Is it a specific set of contractors?
Is it a specific function that they do? Maybe they're a COTAR, a contracting officer, technical representative. And so they have very specific duties.
They go about their day in a specific way. And so if I can learn the person's behavior, I'm going to spot when that behavior is not normal. And so to put it in simplest terms, we learn everything about the individual on the network.
So the behavioral analysis looks at tens of thousands of attributes of the individual and basically says this is what's normal. So when something happens out of the ordinary, like all of a sudden I send information to a Gmail account versus a company domain, how am I capturing that and saying are you sure you really meant to do that? And so we haven't had enough time really to help people get comfortable.
So a little antidote from when I was a CISO at one company and we actually bought Abnormal to solve a problem. And I went to HR and said we're buying this capability. And they said that looks like profiling.
And I said it is, but I'm not doing it. It's not like the old DLP where I actually got a report that said, you know, so and so tried to send privileged and confidential information outside the corporate domain. Did we want to do that?
And then it would come to somebody had to put eyes on it, like a human had to look at it and make a determination and a verdict. Today, that's happening in a large language model. Technically, I'm not really reading everybody's data.
A machine is learning it. And the machines are not running out and going, you know, hopping on a train, going home and gossiping about some person that read their email. That's just not what's happening.
[Tony Cook] (15:24 - 15:58)
That's funny. So being able to sit back and actually baseline down at the at the inbox level and being able to pull out anything that is abnormal. You guys can keep that one for sure.
No, that makes sense. Something that we were talking back and forth with in prep leading up to some of these was that not all AI enabled security is trustworthy. Right.
Like when you're going back and forth, you're talking about the LLM that's actually doing a lot of those. How would a federal team know the difference and what should they be able to verify for themselves, regardless of a vendor, whether that's abnormal or someone else, like being able to make sure that you can trust that AI?
[Patricia Titus] (15:59 - 16:53)
Yeah, well, that's an interesting question, because we get that a lot, honestly, as field CISOs. How do I trust what is coming out of your large language model? It's not hallucinating or regardless of who it is.
I would say not all AI models are treated equally. And so you have to do your proper due diligence. So there should always be a human in the loop.
So nondeterministic AI, in my mind, is not quite there yet. I'm sorry, deterministic. Nondeterministic is where you're asking it to do automation, such as workflow automation, playbooks, I can take my security operations center playbook and just put it in there.
And when I'm done with the lessons learned session, it will automatically update my playbooks. We always used to have to wait for a SOC analyst to do that.
[Tony Cook] (16:54 - 16:57)
If a lessons learned meeting ever happened to be able to come back to it.
[Patricia Titus] (16:57 - 17:51)
There's that. But I think when it comes to AI, you have to ask questions, especially in the federal government, like tell me how you're securing it. How are you training it?
Are you training it on my data or everybody's data? You got to set up a set of questions based on risk management and say, tell me how you're managing risk within your large language models to try to get a little bit more comfortable, which means surprise, federal employees, you need to understand AI to ask the right questions. And so this isn't just let's teach our cyber security teams or privacy teams.
It's like all the way from procurement to HR to finance. Everybody's got to understand AI and how it works in order to be able, if you're using it to see when it goes rogue.
[Tony Cook] (17:52 - 18:25)
Yeah. If there's one point we can make during this entire thing, that would probably be the most important thing for like the next 10 years of your life is to just take the time and understand exactly what this, what AI actually is doing in your field period. And no matter what you are like in cyber security, what we're talking about right now, this is super important, but this permeates almost every single field.
And we really need to kind of understand that stuff. But great points, right? Like where does the data live?
What's retained? Who's actually getting trained on that mailbox and content? Because that data could be accessed by somebody you don't want them to be accessed by as well.
And that could be...
[Patricia Titus] (18:25 - 18:38)
Well, the beautiful thing is everything should stay in your tenant. And you don't want journaling. Lord knows we don't need another copy of emails hanging out somewhere where it can be compromised.
[Tony Cook] (18:38 - 18:41)
And that's a common practice all over the place.
[Patricia Titus] (18:41 - 18:47)
It is unfortunate. So as you said earlier, there's a lot of security products out there. They are not created equal.
[Tony Cook] (18:48 - 19:19)
All of them have something that they could get better at. So everything we've talked about so far has been a little bit of theory, but I kind of want to talk a little bit more into practice about what's actually happened in the past. So you've made these calls to CISO with a budget, with a board and a team that was tired.
You can't really talk about federal incidents, but you've also lived this. So take us back to an environment where you were able to see a real existing email security approach that potentially either had an issue or had to change.
[Patricia Titus] (19:20 - 20:27)
Yeah. So back in the day, we'll just leave it there, business email compromises have been a thing for quite some time. And really all you need to do is have one of those to give you a wake up call that yes, your SIG is working fine, but not as fine as you need it to.
Again, just a few emails getting through where someone's interacting with it. And this has happened probably hundreds of thousands of times to CISOs where you get the phone call. I think we just sent money to someone we shouldn't have.
What do we do? How do we recall it? Well, now with Microsoft, I don't think you can recall anymore.
Never figured out in email where that button was either. So I really think it's important that when we think about how our SIGs are working and how we're educating people. And I lost my train of thought.
Ask me the question again. And then I'll pick it up.
[Tony Cook] (20:29 - 20:36)
What did you see in your organization that made you realize the existing email security approach had to change or there was an existing issue?
[Patricia Titus] (20:36 - 20:39)
Okay, hopefully you guys can splice this together.
[Tony Cook] (20:40 - 20:40)
Good.
[Patricia Titus] (20:42 - 21:53)
So in a previous company, we had a situation where I got the phone call. We think we wired money to the wrong place. And so that was the beginning of really being able to dig into the whole business email compromise problem.
And fortunately, it did not cost our company money, we were able to work with the FBI to get the money back. And so I use that as an opportunity. You know, we always say that in security, don't let a good crisis go to waste.
And so the question was, how do we make sure this doesn't happen again? And the answer was, I'll just take a little bit of that money I saved and we can put it to better use, which happened. Fortunately, I've leadership that was very attuned to understanding, I didn't ask for things over the top that I was very realistic about what we needed based on our risk profile.
And in a conversation with one of the IT executives, they said, well, that's an anomaly that won't happen again, which really should, when you say things out loud, it's, it's almost like you just wish it to happen.
[Tony Cook] (21:54 - 21:55)
And it did knock on wood moment.
[Patricia Titus] (21:55 - 22:10)
Yeah, it did. And so there's always, always knock on issues. So that just really solidified it.
And so we went out on a hunt to try to solve that problem for ourselves.
[Tony Cook] (22:12 - 22:30)
Okay. So a lot of times when something like that happens in the federal arena, right, there's not always like just money that just kind of pops out, right, for some of those things. What would you say to a federal leader who just went through something like that, but potentially doesn't have the ability to, to make those changes right away, but still needs to deal with the problem?
[Patricia Titus] (22:30 - 22:55)
Yeah, that's a great question. And we got into this conversation a little bit, some, some other security professionals and I were talking about it. And I think in these cases, you have to get creative, right?
So money doesn't grow on trees in the private sector either, by the way, I think there was only one company I worked at that they were like, go buy whatever you want. And I'll share that name after this podcast.
[Tony Cook] (22:55 - 22:57)
We'll go work for them afterwards.
[Patricia Titus] (22:57 - 24:38)
No. And so I, I really think you have to get creative. First of all, we love to buy point solutions.
I heard that there are like, you know, hundreds of point solutions in a large enterprise. And, and someone told me at one of the big institutions that they had like one security tool for every person that worked in the company. So if you think about it, it's an opportunity to optimize what you've got.
First of all, do all the tools bring the same value that they did when you purchase them? So I remember one company I joined, I did an optimization exercise. And I said, why do we have this tool?
Well, we needed it for this one thing that happened. Okay, who knows how to use it? Well, that person left the company.
Great. Shut it off. Whoa, what if we'll buy something when we need to, if there's a problem that shut it off.
So in the first 30 days, I think after, you know, I was getting ready to do my 90 day readout. So it was really a 45 days, I was able to optimize and save over 250,000 in unnecessary cybersecurity spend, because people didn't know how to use the tools. So there's optimization, there is look across the portfolio of products you have not just in security, but in IT, there's a lot of capabilities in IT that they're not leveraging, because they're the IT shop, not the security shop.
So go look and see, are you fully utilizing that tech, and see where you can cut costs by leveraging someone else's spend. So if the CIO is spending it, you might as well leverage it, right?
[Tony Cook] (24:38 - 24:50)
And a lot of times you'll hear that excuse, well, that's an IT tool, we can't use that, or like, there's not roles and responsibilities, just even be able to look at it and make that determination, which could save you tons of money to be able to go on the other side.
[Patricia Titus] (24:50 - 25:49)
Absolutely. And that's where companies like yours can help so much, because you've got that broad expertise, where my expertise was in VPNs. And so, you know, come on in and help me like look across this and look for ways to save money so you can spend money.
Don't give up your budget. Look for ways that you can cut costs, cut licensing. Does everybody in your organization need a YubiKey?
Does everybody need whatever it is that maybe you've got, or should be for like 10 people, and you've got it for all 200? So look for ways to optimize and look for ways to get creative, because you're likely not going to get more budget. So you're going to have to figure out from a risk perspective, where am I going to hemorrhage money if we're breached?
And how do I stop it? It's unfortunate, but it has to be at the gateway.
[Tony Cook] (25:51 - 26:46)
That makes a ton of sense. I can absolutely see, especially in working in this field, right? Like if a security or a SOC or any security team starts using a tooling so much, right, they treat that tool like a hammer, and then everything's a nail afterwards, right?
You can't quite get to anything. And what I've noticed over the last probably really six months, while people really started to kind of get more and more into AI, with their vibe coding new apps for something that happens on that side, it's almost kind of become the same thing, right? Like, I could just buy my vibe code my way out of XYZ to be able to make sure that that tooling does what I think it does.
But then you never take that step back to wonder, how am I actually able to do this? And I love what you said earlier, where it kind of goes back to, like, is this tool actually making a difference, right? Do people know how to use it?
Is it actually doing something? Like, making sure that even when you're going through some of these new AI toolings that are coming out, like, what am I solving? What am I really getting to?
[Patricia Titus] (26:46 - 26:59)
It's measurements. How do you metric it? How do you measure its success?
And you should know that before you go into it, right? Like, I'm going to be able to actually show cost savings from avoidance.
[Tony Cook] (27:00 - 27:29)
Yeah, knowing what you get to. And I think a lot of people, when they first get into AI, or they start doing some tooling on this side, right? That's the the methodology is, is know the answer before you get there, right?
Like, I want to know what I'm trying to get to. Now I can code or get whatever else I need to or put in what a product I need to get to. But this is the end state that I want to get to, right?
And when you start to deviate from that, just because it's a cool tool, or I can add additional functionality, or I can do this, a lot of times you're adding costs without any, like, taking away from any of the risks that you actually have on that side, too.
[Patricia Titus] (27:29 - 28:00)
I do want to clarify, though, that, you know, you have a goal in mind of, I want to be more secure, I want to be managed risk better, or whatever it is. You also have to recognize that that threat is changing so rapidly that your goal is going to move, your objectives are going to move, unless they're like some, you know, I want to make the board happy, or I want to, you know, make the IG happy, or, you know, I got to put in a FISMA report card, whatever it is.
[Tony Cook] (28:00 - 28:02)
Cost savings have to happen, I have to do this.
[Patricia Titus] (28:03 - 29:04)
Exactly. And the, you know, keep the lights on. And I will tell you a strategy that was very effective for me, when I was in the federal government, was tying my security program to the National Strategy for the Traveling Public.
It's a waterfall approach, it worked back then, it seemed to continue to work well throughout my career, especially in the government, when it was, we need you to come back and tell us what 7% cut, what that impact is going to be. And I could actually show if I don't do this, here's the impact to the traveling public. And when you tie it to some catastrophe, like loss of life, loss of property, you know, the things that matter to your mission in the government, you're going to have a higher probability that you will not lose budget.
And you may actually walk out of the room with someone else's, which was normally what happened to me.
[Tony Cook] (29:05 - 29:08)
Wow. Yeah. And that lesson could be applied to almost anything, right?
[Patricia Titus] (29:08 - 29:22)
Anything, anywhere. Tie it to something that really matters. And it's not always well, the company will make more money.
It's, you got to tie it to something that really has meaningful mission impact.
[Tony Cook] (29:23 - 30:12)
Yeah, directly. And I think that that's one of the hard parts for a lot of security organizations, whether you work in a SOC, or you're designing something, a lot of times you're so far away from the mission that you can't quite get there. But that's what security leadership is supposed to be there for, to tie those things together.
And a lot of times, unfortunately, that's what we do see, right? Like, how can I make sure that the budget's held to or that, you know, we're able to react to this many alerts, or we're doing these things, and you never really kind of get to the mission in and of itself, which is a great way of being able to look at it. Okay, so that's the lesson.
So now let's make it actionable and vendor neutral. A federal CISO listening to this has a stack in place, a budget cycle and an authority to operate process to get through. So if they wanted to pressure test their email security posture, their email security posture tomorrow morning, where should that team actually begin?
[Patricia Titus] (30:14 - 30:21)
You got, well, first of all, you got to do research. You got to go out and look across the estate of email security tools, capabilities.
[Tony Cook] (30:22 - 30:23)
Same thing that we just walked through, really.
[Patricia Titus] (30:23 - 31:56)
And you got to figure out, okay, these are must have. So everybody does this. Like, that's part of the COTAR's responsibility is to make sure that you've gone through and laid out, what are the outcomes I'm looking for?
And you got to do your research. This is where AI could probably help you a lot, right? So you go to Claude, you go to Gemini, you go to whoever.
Tell me what I should be looking for, for functionality in an AI security tool for email. And see if it aligns with what you were thinking. And then you got to do a bake off.
You got to figure out, okay, what am I trying to get out of? Am I trying to optimize my SOC so that I can eliminate some of the burnout that's happening? The alert fatigue?
So there's the optimization. Am I trying to reduce the amount of phishing that's coming in? Am I trying to curb the misdirected emails?
What is my intention on this solution? And then look across, you know, Gartner's got a great set of documents. You can look at Gartner, although I am not one to lead with someone else's research, I do like to use that as a directional.
So I know some CISOs where if it's not in the upper right quadrant, I'm not buying it. I don't think that's always an indicator. Because there's a lot of new startups out there that aren't going to be in the quadrant.
And some that are actually starting new quadrants.
[Tony Cook] (31:56 - 33:10)
I think that's the biggest thing that I've seen across this is what, what the industry is currently seeing, because it's so easy to go out and actually fix a problem with a solution that has never even been, you know, thought of before with Vodka and get everything else out. So there's these niche things that are popping up all over the place that solve those problems. And then it's the problem of like, do you just wait for them to get bought out?
Or do you buy those things? Or do you kind of move forward with where you're at on these ones or potentially build it yourself, right? Like those things constantly pop up, and then trying to make sure that you're actually looking at the risk that you're trying to solve on that side as well.
So that's a, it's a great mentality for all of it. I think a lot of the times when I think about the federal sector on these ones, you almost always have some policy, or something you're trying to get to like the new zero trust portion. And how do I accomplish some of these things?
And then you look at that quadrant, you look over at another department or another federal entity, and you look at them and you say, all right, well, they're solving it this way. So maybe I can get to that part. But what I love the most about what you said was, do your own research, try to figure it out from that mentality, you don't have to do the same things.
And even if you are a smaller federal entity, you can have that ability to change what other people think about it as well by being able to implement your own solution on that side.
[Tony Cook] (33:12 - 33:27)
So we've covered a lot of ground. But before we wrap, I want to leave people with one thing that they can actually go off of not a list of 10 things, because we've talked about quite a few different things here. So what's one action you'd encourage every federal security leader listening to this to take this quarter that they can do something with?
[Patricia Titus] (33:29 - 34:40)
Go to your vendor community and ask for free. Freemium is the word of the day. So that's what I would say is there.
Yes, you still have to do contracting documentation, you got to get NDAs in place and do all the appropriate legal and compliance requirements. Where can I go to pressure test what a vendor is offering me without impacting operations? I mean, is it going to take me 10 hours to implement implement a system I'm going to have to coordinate with it?
I mean, what's the heavy lift I have to do? How can I simplify that for my team? What is easy to integrate?
What is a couple clicks before I start getting data? And then how long am I going to run it to feel like I got enough data that I can make a decision? So is it 30 days, 45 days?
Maybe it's 60. Whatever it is, make sure you're very upfront and ask for free. I mean, all I can do is say no.
And then you can go to somebody else who says yes.
[Tony Cook] (34:40 - 35:19)
Yeah, absolutely. And most of the time, if you've had this long standing relationship with them, or if you've bought their product for so long, they're more than happy to jump in to be able to provide something to you. And for the new people, they're always ready and waiting to be able to do a new sales pitch for you to get whatever you need on that side.
So that's an awesome one. Well, thank you, Patty. And for our listeners who want to go deeper, GuidePoint Security and Abnormal Security have created a federally focused white paper, exploring nation state email attacks and trusted AI.
To access the white paper and connect to our joint team, follow the link in the episode description. Thank you, Patty. For our listeners who want to go deeper, GuidePoint Security.
It was already in there. All right. Okay.
[Anthony Jimenez] (35:20 - 35:36)
Thanks for listening. And thank you to our guests, Tony Cook and Patricia Titus. Don't forget to like, comment and subscribe to Carahcast and be sure to listen to our other discussions.
If you'd like more information on how GuidePoint can assist your organization, please visit www.Carahsoft.com or www.GuidePointSecurity.com.