Ex-CIA Cyber Chief: Here's What Keeps Me Up at Night

In a world of rising cyber threats, what keeps the CIA’s former head of cybersecurity up at night? Today on Digital Disruption, we’re joined by Andy Boyd, former Head of the CIA’s Center for Cyber Intelligence. Andy was a Senior Intelligence Service officer in the Central Intelligence Agency’s Directorate of Operations (DO). His most recent assignment was Director of the CIA’s Center for Cyber Intelligence (CCI) which is responsible for intelligence collection, analysis, and operations focused on foreign cyber threats to US interests. Andy has experience leading worldwide intelligence operations and has in-depth knowledge of geopolitics, cyber operations, security practices, and risk mitigation. Andy sits down with Geoff to discuss the future of cybersecurity in a rapidly evolving digital world. With decades of experience in cyber intelligence, Andy explains how global threats are evolving, from traditional espionage to AI-driven cyberattacks and disinformation. He dives into how intelligence agencies like the CIA assess and respond to state-sponsored cyber threats from China and Russia, and why the private sector is now a primary target. Andy breaks down how emerging technologies like generative AI are changing both offensive and defensive cyber strategies, and what this means for governments, businesses, and people. Andy also shares how one of the world’s leading professional services firms is navigating this new landscape, using culture, data, and innovation to stay ahead of cyber risks. In this episode: 00:00 Intro 02:45 What the CIA's Cyber Intelligence Center actually does 05:30 Leading transformation across a global enterprise 07:20 Evolution of cyber threats from nation-states 08:15 Building trust and transparency with business stakeholders 11:10 The critical role of data in decision-making 13:00 How the CIA detects and responds to cyber attacks 17:05 Creating a culture of innovation and adaptability 17:45 The private sector as a frontline target 20:40 How Aon is approaching talent and upskilling 23:10 Offensive cyber operations: how far should the U. S. go? 27:30 Key leadership lessons and advice for future CIOs 29:50 China's cyber capabilities vs. Russia's tactics 35:25 The role of intelligence in election security 40:50 Why disinformation is more dangerous than hacking 45:30 How AI is transforming cyber espionage 50:10 What keeps Andy Boyd up at night 54:40 The importance of public awareness and resilience Connect with Andy: LinkedIn: https://www.linkedin.com/in/andrew-g-boyd-12194673/ Visit our website: https://www.infotech.com/ Follow us on YouTube: https://www.youtube.com/@InfoTechRG

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Geoff Nielson?

  Hey everyone, I'm super excited to be sitting down with Andy Boyd. He's the recent head of the CIA Center for Cyber Intelligence. This is a guy who has briefed the US Cabinet on cyber threats to the most powerful country in the world and how they can respond. I want to know what keeps him up at night, what we should be worried about, and what intelligence is being kept from us. For news junkies like me out there, we're going to go deep on cyber, less so on traditional warfare like what we're seeing in Iran and Israel. It should be an amazing conversation. Let's jump in.

• 0:34Geoff Nielson?

  Andy, thanks so much for being here today. I really appreciate it. You are the former director of the Center for Cyber Intelligence at the CIA. Maybe just to start off, can you give us a flavor of what the Center for Cyber Intelligence does at the CIA?

• 0:50Speaker 01

  Good morning. Thanks, Jeff, for having me on the podcast. This is a really exciting opportunity. Yeah, so I retired from CIA back in October 2023, and for the four preceding years, I was, as you noted, the director for the Center for Cyber Intelligence. And so what I've said publicly about this before, and there are obviously some limitations to the level of detail I can get into, but the Center for Cyber Intelligence is what we would call the mission manager for all things cyber at CIA. That means offensive cyber, strategic analysis, and all the technology tools, engineering that goes into both of those disciplines. At the end of the day, CIA is an intelligence collection enterprise and an intelligence

• 1:34Speaker 01

  analytical enterprise. And so the Center for Cyber Intelligence produced all the strategic intelligence for the president on down in the US government, on nation-state and on nation-state cyber threats, how they related to the US government and how it related to threats against our economy, our private sector, and whatnot. But in addition to that, we were responsible for using our tools to collect intelligence across a whole array of disciplines, be it counterterrorism to near-peer nation-state competition. And it was a great honor to lead that workforce, a highly skilled workforce for the four years I was in that job.

• 2:16Geoff Nielson?

  That's it's super, super interesting and you know, obviously so, so important. You mentioned, you know, offensive cyber capabilities. In the analysis side, was there a role to play defensively as well and sharing intelligence that could be used to help, uh, you know, organizations, either public or, um, you know, within the US commercial to, you know, defend against potential, you know, bad actors? Or was it purely more the offensive side?

• 2:42Speaker 01

  Uh, no. So, I mean, and this is an interesting, uh, point because there's tactical intelligence and I mean that from a small I, you know, not necessarily just government intelligence. And then there's strategic intelligence and what the CIA does is more at the strategic level. Uh, when I was getting out of, uh, retiring from the government, uh, I got a lot of calls from folks asking if I was interested in various CISO jobs. And I said, I am not qualified to be a CISO. I am not a network defender, uh, and I never have been. But what our strategic analysis looked at is to give the context as to what the cyber threats were principally from nation states, China, Russia, Iran, North Korea, but also ransomware actors, other criminal actors, a whole variety of hacking schemes

• 3:27Speaker 01

  and wrote it at a level, uh, for executives really, um, uh, to make decisions on to how to defend the, the country. I mean, why is, you know, China half hacking what the salt typhoon, uh, vault typhoon situations? Why were the Russians doing what they were doing with their cyber tools? It, it was useful for context for the, the average CISO, even US government CISOs to use to understand the context, but it wasn't going to tell them how to defend their network. That's a different type of intelligence.

• 3:58Geoff Nielson?

  Right. And did you find, so I mean, you, you sort of had a front row seat to, uh, being able to understand exactly the threat levels that, that, that we could expect here. Did you find that most, you know, kind of organizational leaders, whether they're, yeah, I'm thinking largely outside the government, but inside the government too. Were they able to properly assess the threat level or did you find they were underestimating it?

• 4:23Speaker 01

  It depends. I mean, there's certain industry, you know, the Department of Homeland Security, CISA, which does all the cyber defense and critical infrastructure defense.

• 4:35Geoff Nielson?

  Yeah, they better know.

• 4:37Speaker 01

  Yeah, well, they identify 16, and they do, but they identify 16 critical infrastructure sectors. And certain sectors are extraordinarily good at cyber defense. You know, the financial sector really understands it. Because it's a no-fail mission for them. If a nation-state or non-nation-state actor hacks into a major banking system, I mean, we're all going to be hurt by that. But they also, because they're banks, they have the financial resources to have good cyber defense. Go all the way down the spectrum, and there are certain critical infrastructure sectors that don't have good cyber defense. And it's not necessarily their fault. They sometimes didn't even really

• 5:19Speaker 01

  consider themselves part of a digital landscape, for instance, water treatment plants, wastewater treatment. And so they were victims from nation-state actors, from ransomware actors over the past few years. And so CISA and others have begun to really focus on that. So I think it varies from industry to industry. And I do think the US government, the private sector is coalescing around a way to defend those critical infrastructures. But it's going to be, it's going to vary from industry to industry, frankly.

• 5:51Geoff Nielson?

  So what, when you were leading the center, what kept you up at night? And what keeps you up at night these days? And how has the cyber threat landscape changed in that time?

• 6:01Speaker 01

  I've never slept better since October 2023.

• 6:05Geoff Nielson?

  I'm happy to hear that, maybe.

• 6:07Speaker 01

  What kept me up? And I spent the bulk of my CIA career serving in the Middle East. I'm an Arabic speaker. I did a lot of work in the counterterrorism space, as most of my generation did after 9/11. That stuff kept me up at night because of the mission, but also worrying about what it all meant. So as the leader for the Center for Cyber Intelligence, I had less sleepless nights.

• 6:35Speaker 01

  But it was more of a longer burn than counterterrorism. It's thinking about, you know, do we have the manpower? Do we have the infrastructure? Do we have the relationship between the government and the private sector to really defend against what I think is an existential threat? It's not the kind of threat that takes down the World Trade Center. It's not the kind of threat that results in an airplane crashing into the Pentagon. You know, that's a very visible threat, but it's as much an existential threat with a longer burn time. And I'll cite one, you know, private sector example that is not necessarily nation-state ransomware actors, which frequently have a dotted line relationship, particularly in Russia with state actors.

• 7:20Speaker 01

  But there was a ransomware attack against United Healthcare this past year and a subsidiary of United Healthcare called Change Healthcare, which essentially manages all the pharmacy distribution, CVS, Walgreens in the United States at least. I don't know about Canada, but it may be part of the same system, but I'm not sure. That ransomware attack, the ransomware attackers asked for $22 million in ransomware, which was paid. What frequently gets overlooked is that the overall cost and loss in revenue to United Healthcare was north of $1.6 billion. And I think it's still growing and you multiply that and that's just one company. Now granted, a very large company, but still just one company in one of those critical infrastructure

• 8:04Speaker 01

  sectors. You multiply that across multiple industries. And, you know, there's billions and billions of dollars at stake every single day due to cyber threats, due to data theft, intellectual property theft, ransomware attacks, et cetera. So it is an existential threat. So in the aggregate, all of that stuff kept me up at night. But I'm sleeping better now.

• 8:27Geoff Nielson?

  I'm happy to hear that. And I mean, even in the conversation so far, you know, there's everything from, you know, existential threats to organizations financially to, you know, attacks on critical infrastructure. You know, if you were advising, and I think in some cases you are, you know, organizational leaders, what what type of actors would you want them to be most concerned about? Is it nation-states? Is it, you know, organized crime? Is it one-offs? You mentioned kind of nation-state adjacent actors? And what are the implications of some of the, you know, some of the threats there?

• 9:04Speaker 01

  So I think, you know, even in the, the very advanced folks like in the financial services industries who have, you know, very strong personnel working on cybersecurity, even they admit that they need to engage with the US government, be it with DHS, CISA, be it with the entities at Treasury, or whoever their, you know, as, as we like to call it, sector-specific relationship with the federal government is, because they don't know everything and they need to know the strategic context. Um, and they under, they need to understand why possibly a state actor would want to attack, you know, a certain network and whatnot. For example, um, you know, in February 2022,

• 9:50Speaker 01

  uh, the Russians invaded Ukraine. But we, you know, in that, and I was still in the government then, we went through different decisions, you know, at the policy level and on what level of support we were going to provide to the Ukrainians. And we had many discussions in, in policy circles as to what that may trigger as far as cyber attacks, you know, other attacks, but my focus obviously with cyber attacks uh, from the Russians. And, you know, what I found is a lot of the critical infrastructure leaders in the private sector wanted to understand, okay, what's coming down the pike and what should we be prepared for potentially from the Russians? It turns out that there wasn't much coming from the Russian side against uh, US networks, financial institutions, et cetera.

• 10:34Speaker 01

  Um, but that doesn't mean we, you know, that was unknowable in February 2022 and we had to be prepared. And so it was interesting to me is some of the most highly skilled cyber defenders in those critical infrastructure sectors still wanted to understand, you know, what the threat was uh, from Russia. I think the same context we now, you know, again, I made reference to Vault Typhoon, which is, it essentially is the, the People's Republic of China pre-positioning tools on critical infrastructure in the event that there is a Potentially across Taiwan Strait conflict between the United States and China, volt typhoon and then salt typhoon, which was again,

• 11:15Speaker 01

  some entity within the Chinese government, I suspect their intelligence agency putting tools down on our telecommunications infrastructure in the United States and using it to collect information against senior US government leaders and others. I think the conversation has shifted away, at least for now, from what the Russians are doing because that's just, it was sort of a nothing burger for the United States at least, to something that is not a nothing burger, the Chinese threat, both from intelligence collection perspective and a critical infrastructure protection perspective. And having those industry leaders, telecommunications leaders be cognizant of that threat, potentially even at a classified government information level, I think is critical.

• 12:00Speaker 01

  All those conversations are happening, you know, maybe not on a daily basis, but at least on a weekly basis.

• 12:08Geoff Nielson?

  Right. And so, you know, if you had the magic power to be kind of everywhere at once across the,

• 12:18Geoff Nielson?

  I guess, the defense surface, so to speak, across governments and organizations. And let me, you know, say first, like, my goal here is not to expose national weaknesses, but like, where do you think, like, where would you be most concerned about shoring up, you know, our ability to defend ourselves against some of these attacks?

• 12:40Speaker 01

  I mean, I think most immediately, and this has been talked about in the press quite a bit. I think we have to reset where we are in the telecommunications infrastructure because that undergirds, you know, everything that we do. Luckily, I mean, knowing that that is the threat and it's there is important, but it's going to, you know, the telecommunications infrastructure in the United States is sort of a Balkanized infrastructure that was cobbled together from what used to be AT&T. And then it became what we call in the US, the baby bells back in the eighties. And so as a result, it's not a particularly logical infrastructure and that has to be changed because.

• 13:19Speaker 01

  You know, the barn door was wide open and that's how the Chinese got in. So that I would love to see that, you know, be a major focus in 2025 for infrastructure security. But, you know, there's a lot of other things as well. I mean, how, how we, you know, it's, it's something that's evolved over the past two years, the advent of chat, chat GPT, and the advances that we have in AI technology. I worry deeply that our intellectual property is getting stolen at a rate that it's almost too late to close the barn door. And we have to develop the defensive techniques against our, our algorithms, our, our, our way, our way of defending our intellectual property in AI.

• 14:01Speaker 01

  And then legislation and then policy that helps, helps us do that. That is my next major concern. As far as the other critical infrastructure sector, you know, gas and oil transportation, electric distribution, water distribution, wastewater treatment, healthcare, education, all those are critical infrastructure sectors.

• 14:25Speaker 01

  We, you know, we have to address those as well. But honestly, we don't have enough bandwidth in the US government or the private sector to do them all at once. But we'll get there.

• 14:35Geoff Nielson?

  Yeah. You, you, you mentioned policy and I'm curious from a, from a defensive posture perspective, like, what is the role of policy versus, you know, technological defense versus, you know, defense in terms of like, you know, human user training and defending from that perspective? And I'm sure that there's a few other dimensions as well, but is it all three? Where do we get the most bang for our buck?

• 14:59Speaker 01

  I mean, it is, it is all three and I'll just reference, you know, I was, last week was the RSA, the, the, with the leading, you know, cybersecurity conference in San Francisco every year. And there was, you know, 60,000 attendees, private sector, you know, global, private sector representation, but also. International government and the the current administration was very well represented there from the Secretary of Homeland Security Kristi Noem on down military figures, intelligence, community figures. And what what's there's, there's obviously very significant differences in policy and H, you know, human resources practices between the Biden administration and the Trump administration.

• 15:41Speaker 01

  But what struck me was the seriousness with which the the current representatives last week from the administration are are thinking about cybersecurity akin to what the previous team in the Biden administration did. So cybersecurity is a is a bipartisan issue and policy is part of that. And I'll I'll cite one, one point that that Kristi Noem's deputy talked about at a forum I attended. There's a a policy started under the Biden administration called Secure by Design wherein software developers don't beta test their their software on their customers.

• 16:22Speaker 01

  They actually design it with security in mind and, you know, user experience and functionality and whatnot. Um, I had thought that that was going to change significantly with this current administration and there may be tweaks on it as far as how they address the private sector. But in general, it would appear that that the new administration supports secure by design and it's going to, you know, set policy parameters in collaboration with Congress on legislation to mandate that private sector's software development is done with security as a default in mind, which I think is critically important. So so that, you know, private sector, how how they develop software and deal with infrastructure,

• 17:05Speaker 01

  policy from from the White House, the executive branch in the government and legislation from Congress are all critical in my mind, you know, three, three legs of the stool, so to speak.

• 17:16Geoff Nielson?

  Right. So you know, you mentioned secure by design.

• 17:21Geoff Nielson?

  And to me, that's, you know, that's an arrow in the quiver, let's say, of what an organization can do to, you know, remain secure. When you're advising, you know, CISOs or, you know, senior security leaders at different organizations, if they were, if they're asking like, where do I start with this? How do I, you know, what tactics can I put into place? To make sure that we're secure, you know, do you have some stock answers for, you know, the best starting points that are gonna, you know, have the most outsized impact?

• 17:50Speaker 01

  It really depends on the size of the company, like a major bank with tens of thousands of employees can buy an enormous amount of products to, you know, deal with external threats, deal with insider threats, deal with vulnerabilities on their own networks and whatnot. You know, down to, you know, companies of a dozen people or less. And it's more the small companies that that are an issue, I think, and they have to really lean on CISA. Try to get help from the government where, you know, they're not gonna, they're gonna have to really track or outsource to us because, you know, some companies are too small to even have a CISO or even an IT, you know, provider.

• 18:33Speaker 01

  So they have to be careful who they bring in to manage that sort of stuff because there are certain small companies that frankly are as important as the big companies. That company that makes, you know, some certain widget for, you know, US Air Force fighter aircraft. If their networks are compromised by a state actor that wants to understand how those jet engines or whatever are assembled, they're equally at risk as the Lockheed Martins of the world are.

• 19:01Speaker 01

  Yet the Lockheed Martins of the world are going to be able to buy every tool that you can imagine. So I, a lot of those discussions happen at RSA, a lot of people focused on like, how do we detect those, those external threats, but there are an enormous number of products out there for what we would call a tax surface management. And, you know, looking inside at your own inventory, the bring your own device.

• 19:26Speaker 01

  Epoch that we live in makes defending networks even more difficult because not every everybody is going to be as wise as as to how to to secure your own your own endpoints. So it's so it's a it's a very big job for for CISOs or the security providers for the for those small companies. But but what is great now is, you know, 10 years ago, nobody was really focused on any of that. Both at the US government level and the private sector level, we're having a very open conversation. You know, as evidenced last week at RSA. And I so so I do think we're we're heading in the correct direction to ensure that those existential threats are minimized to the greatest extent possible.

• 20:11Geoff Nielson?

  The so so thinking about those like small and mid sized organizations, I I mean, I I agree with you. I feel like that is the biggest risk and it's the long tail of risk there. If if the board of one of those companies brought you in and said, you know, Andy, you know, how exposed are we? Do you have sort of like a questionnaire in your mind or, you know, a a a quick cheat sheet for how you would assess their exposure level to threats?

• 20:40Speaker 01

  I I don't have a cheat sheet because again, every every company is going to be different, but I have I have addressed, you know, various boards of directors on that particular issue and I'm on three boards myself, so I'm constantly worried about that as it relates to the companies that that I I'm involved with. But, you know, I I what I say is if you're a company that's big enough to have a CISO or or a chief security officer, you know, I mean, really, two things is is identity management and ensuring that you you don't have people pretending to be other people on your, you know, in your organization. And then access control. If you if you manage those two things, pretty much everything else, you know, takes care of itself.

• 21:26Speaker 01

  The third thing, and this is, you know, basically since the dawn of of, you know, hacking in in the 80s. You know, teach your your employees about phishing and social engineering and do not click on that link. If you if you don't know it's from, I mean, it's it's sounds like like, well, yeah, of course not like in 2025, nobody would do that. But the overwhelming majority of ransomware attacks in particular, but also, you know, state actor hacking is via spear phishing. And with the advent of AI tools, chat, GPT, and the and the other ones, it makes it a

• 22:06Speaker 01

  lot easier because, you know, previously, the emails would be written in gibberish. It'd be like, okay, this is obviously some guy from, you know, you know, wherever in the planet trying to hack my computer, click, you know, click on this and we'll give you $200,000 or whatever. Not now because of AI tools, you can have idiomatically correct American English and, you know, it can sound like it's coming from your boss. So it's it's a very difficult thing to do. There there are identity management tools that are much more advanced than they were several years ago. But really, I mean, that is what I would say to abort is identity management and access control and ensure that people who don't need access to certain SharePoint devices or whatnot don't have that access.

• 22:51Geoff Nielson?

  Yeah, no, it it makes sense. And I think I think that's very much in line with what, you know, I've heard from security analysts around here anyway. But you did, you brought up AI and you brought it up a little bit earlier and I I want to talk about that for a minute. How in your mind is AI changing the threat landscape these days? Did I mean, I'll ask that in two ways. How is it changing it from the bad actor perspective? How is it changing it from our ability to defend? And, you know, net net, what does that mean?

• 23:21Speaker 01

  You know, so I I think it's it like a lot of advances in technology, both the attackers and the defenders sort of go down that field together and maybe not at the exact same pace, but. You know, so again, the social engineering aspect of ransomware is a lot easier with AI tools. Also, you know, someone who really has no vulnerability research or exploit development skills can use AI tools to frankly, just build exploits and send them down the pipe with really no training or experience in that as well. And there's, you know, they're not going to be able to build zero days off of AI tools per se.

• 24:02Speaker 01

  But there's a lot of, you know, the top 10 vulnerabilities on endpoints are all end days. And have been out there and unpacked for a very long time. AI tools are going to help bad actors deal with that. That being said, um, you know, AI tools in the SOC, in a, in a company's, you know, security operations center, uh, are advancing at, at, at a rate that I never would have predicted two years ago that they would have been. And, and, and automating the ability to see what the threat landscape is out there, automating the ability to look inside your network and watch changes on endpoints and, and, and, you know, actors that are doing things that are outside the normal.

• 24:44Speaker 01

  The average human is not going to be able to detect those abnormalities and shut them down. So I mean, I, I think, you know, over time, frankly, over the next year or two, I think a lot of those security operations center tools are going to be completely driven by AI. Other AI tools and, and folks that I saw, uh, out at RSA and were in RSA last year, using those AI tools to detect, detect deep fakes, to detect audio fakes, a lot of audio fakes. I mean, a number of your, your viewers and listeners may have been getting random spam calls on their phones. Don't ever answer them because what I think, what we think people are doing is trying to get a voice cut from you.

• 25:28Speaker 01

  And then use that uh, for, for audio deep fakes to use, like if you use an audio or, or a voice imprint for getting access to your bank account or whatever. I think a lot of the banks are moving away from that, thank God, uh, and using different forms of MFA.

• 25:49Speaker 01

  But all of those tools are, are being developed, video, like detection tools for video deep fakes. I mean, I, I, a friend of mine has developed. An audio deep fake tool, which you may remember from the election when President Biden was still in the race. He, he, somebody made a deep fake of his voice telling people not to go to the polls in New Hampshire during the New Hampshire primary. It sounded exactly like him. This guy's tool was able to detect that that's not actually President Biden. And, and those certain, and that's a very, you know, famous example, but that sort of stuff at a much lower level happens on, almost on a daily basis. So I'm very confident where we are as defenders, you know, on both sides of that AI equation.

• 26:34Speaker 01

  But also from, from just a, a, a how we build software in general. I think a lot of the writing of software is going to be done using AI tools, leaving the human to work on, on more advanced things or enhancing the user experience and whatever the software tool is. And so, you know, there's been a lot of talk, oh, it's going to replace. You know, people shouldn't go to get computer science degrees anymore because you're going to be replaced and, you know, why learn how to code when AI is going to do it? You still have to learn how to, how to code if you're going to be in that industry. It's just going to make your job a lot easier and you can work on other things and you can, you know,

• 27:14Speaker 01

  a quality check as opposed to, you know, writing the basics of, of, of software development. So I think in the aggregate, AI tools are going to be great for the cybersecurity industry.

• 27:29Geoff Nielson?

  That's great. And, and yeah, I, I tend to agree on the coding side. And you know, what I, what I think about too, is it's like, like engineering didn't, as a field, didn't disappear when the advent of the calculator came along, right? Or the computer, it's, you know, it automates some of the, you know, some of the more operational stuff. But yeah, fair enough. Um, I did want to ask you though, Andy.

• 27:52Geoff Nielson?

  Whether it's AI related or not, and, and, you know, I'll, I'll let you use your own discretion in answering this, but can you tell us maybe a little bit about any, um, any cyber attacks? Or capabilities that you uncovered that surprised you with their sophistication or even their innovation?

• 28:14Speaker 01

  Um, yeah, I don't know if it's innovation per se, it's, it's the brazenness of it, maybe. Um, and I'll go back to the, the vault typhoon, uh, salt typhoon. I mean, a number of experts have discussed this in the press, um, so it's, it's not particularly, uh, sensitive, but, um, I mean, it's sensitive to the industries, but not from a, uh, intelligence perspective. The vault typhoon prepositioning of tools was, was executed using what we call living off the land techniques. So it wasn't some very sophisticated zero day exploit. It was essentially looking for those vulnerabilities and using what is already existing out there, uh, as far as tools go.

• 28:59Speaker 01

  So, so that the very aspect or the very act of living off the land of using end days or tools that you can find on the dark web. You really don't look like a, a major nation state actor. And so it took a long time for us, uh, both in the private sector and the government to detect that. And, and that was pretty gutsy on the, on, on the, on the, you know, the People's Republic of China government. We think the, the military, uh, cyber entities prepositioning tools and infrastructure in the, uh, Indo-Pacific, uh, prepositioning tools on infrastructure in the United States. But just, you know, being very hard to detect because it's not, it doesn't look like nation state actor. So that, that surprised me in that sense.

• 29:44Speaker 01

  What also surprised me and another Chinese attacks and salt typhoon attack, was that they really studied the target. And again, it wasn't a sophisticated zero day per se, but they, they studied the vulnerabilities and built what they needed to, to get in those networks. And it was essentially not unlike the vault typhoon exploiting our own weaknesses.

• 30:06Speaker 01

  So it's it's it's taken a change in how we analyze the threat. Previously, it was like, okay, sophisticated actors, zero days, they're really gonna build something that is just so innovative and we hadn't seen before. And it's actually really the opposite now. It it's using our own vulnerabilities and exploiting those, which did surprise me that that that technique is is being used. So we just have to be much more cognizant of that and be more cognizant of our own weaknesses. Just like if you're the CISO at a medium sized company, it's important to know what the threat is externally, but you have to deeply understand your own vulnerabilities, your own endpoints, your own network vulnerabilities, or what's on the outside is gonna have a

• 30:49Speaker 01

  much easier, you know, job getting on the inside.

• 30:54Geoff Nielson?

  When you talk about vulnerabilities and weaknesses, can you can you add a little bit of color to that? What what, you know, types of vulnerabilities are we talking about here?

• 31:02Speaker 01

  Unpatched endpoints. I mean, it it at the end of the day, ransomware actors, you know, foreign intelligence organizations or entities that wanna conduct disruptive or destructive offensive cyber attacks, they wanna land on an endpoint. And and at the endpoint is a desktop, a laptop, a phone, those were the vulnerabilities are. So, you know, for all of your viewers and listeners, you know, update your software on your endpoint. If you're an Apple user, update as frequently as possible. If you're an Android user, update as frequently as possible. And the same goes for your desktops and laptops. Now, you know, in 2025, that's fairly easy if you're paying attention.

• 31:47Speaker 01

  But, you know, there's other things on your networks that are patched less frequently. There's, you know, your Wi-Fi routers, your your network devices that unless you're an IT professional or a CISO, you don't really think a whole lot about those. And and that, you know, worries me. Vulnerabilities on those that are, you know, eventually identified by CISA and they get a CDE rating and whatnot. But you really got to be paying attention. You have to like be patching those things on a on a routine basis. The other concern is IOT devices, which are very rarely patched. You know, I, you know, we now have, you know, refrigerators that seem to be like sentient beings in and of themselves.

• 32:32Speaker 01

  And those, those are attack vectors if they're on your network, if they're networked in with the rest of your devices. That is a very significant vulnerability. And I do think, you know, we, we focus on IT security. But there's OT security, operational technology that I really think we need to focus more on because that, that is a significant vulnerability. And then finally, you know, I referenced earlier the bring your, bring your own device, which sort of dominates, you know, most companies now. It's, it's understanding, it's for the CISO and the IT professionals, the CIOs, if the company is big enough to have a CIO, to understand what the threat factor is from those bring, bring your own device situations and ensuring that you have policies

• 33:18Speaker 01

  and an ability to check that your employees are actually doing what they're supposed to do and updating software in their own devices.

• 33:25Geoff Nielson?

  Right. We've talked, we've talked mainly about kind of organizational risk. And there we talked a little bit more about, you know, device level risk and how you get into the networks. One of the threats I've been hearing more about lately, and I don't know if it's been on your radar, Andy, I imagine it is in some capacity is I've, I've heard it described as, I think it's called like, like pig butchering scams or basically, you know, human engineering approaches where you actually build trust over a long period of time. And then, you know, you, you have progressively bigger asks and find ways to exploit people at a level that ends up being millions and millions of dollars. Is that, is that something that's on your radar?

• 34:07Geoff Nielson?

  And how does that fit into the, you know, the broader threat landscape?

• 34:11Speaker 01

  I mean, it is, and it's especially concerning for vulnerable, you know, populations, you know, older people. I mean, you know, my, my mother and father are older and now granted, I briefed them on that. And so they don't, they don't have not yet fallen victim to that. Um, but it happens on a daily basis and there's entire, particularly in Southeast Asia. Um, it's, it's developed into a thing where there's entire offices or warehouses filled with folks that are, that are working on these, uh, schemes. You know, on it, it's not all that different than years ago when, you know, the Nigerian prince would call you up and say, hey, I just need a loan of $50,000 and I'm going to give you a million dollars in return.

• 34:56Speaker 01

  I mean, it's, it's the same sort of social engineering idea. It's just that it's been, it's being done at a scale, uh, that it hadn't been done before. That being said, um, I mean, a lot of foreign governments, even the, the Chinese government is very focused on it and is very concerned about it. I mean, there's Chinese nationals that have been lured into working in these, you know, pig butchering farms or whatever, whatever we want to call them.

• 35:25Speaker 01

  But as far as like cyber threats writ large, you know, nation state threats, ransomware threats. I still would not put that in my top five of, of things that I focus on. I do think it's, it's a major threat to vulnerable populations. Um, but as far as existential threats to, to our livelihoods, I, I, I don't really consider it rising to that level.

• 35:51Geoff Nielson?

  Makes sense. So, so going back to that level and to that top five, if you think about our current, I'll call it exposure and infection. To what degree are you worried? Like we, we've talked about some of these tools. We've talked about critical infrastructure. Are we already significantly exposed in a way where if some of these nation states, you know, wanted to move?

• 36:17Geoff Nielson?

  To, you know, more of like I'll call a hot phase of cyber war. They could, they could, you know, push a button and, you know, really cripple cyber infrastructure or are we sufficiently defended now and it's about staying defended? Like, where are we in that cycle?

• 36:31Speaker 01

  So I, you know, I, I'll, I'll use a couple of descriptors for that. So, you know, again, I mentioned earlier that I spent much of my career in the counterterrorism space and immediately after nine 11, there was a number of US government agencies that were kind of doing their own thing. We hadn't really coalesced into a, into a organized entity. We did quite quickly over time, the intelligence community, the special operations community, the law enforcement community, and then all of our foreign partners. Um, to the point whereby I would argue, you know, mid 2002, we had a pretty good, uh, you know, set of tools within the US government and our allies

• 37:11Speaker 01

  to, to fight that terrorism fight. I think we're in that continuum right now in 2025 where we're coalescing our, our, you know, government capabilities on the defensive, on the offensive, on the strategic analysis, on the policy and on the legislation. The major difference between what we're doing today and cyber threats and what we did in counterterrorism is that arguably 90% maybe even more, 95% of the attack surface is owned by the private sector. That's a big difference. And so what that coalescing is including the private sector, but, you know, for instance, some of the, the US government leaders that are referenced earlier were part of roundtables

• 37:53Speaker 01

  with CEOs, CSOs, CISOs at RSA last week. And we were talking collectively about a strategy on how to deal with that, what our weaknesses are, and really, you know, looking at what, who, who owns the defensive responsibilities? Who owns, you know, the middle road, the active defense of yanking threats off the data centers, other, you know, US-owned or, you know, North American networks? And then who owns the offensive side? The actual active offensive side? I argued that offensive cyber operations are really the realm of governments, you know, in theory, under appropriate authorities, delegating to certain private sector companies, but you're not going to have

• 38:38Speaker 01

  You know, the telecommunications industry, you know, hacking into the Chinese telecommunications industry in revenge for salt hyphen. That's just not the way it's going to work. But it was very useful to have that dialogue. So are we vulnerable? Yes, we are vulnerable. But are we aware of those vulnerabilities as an industry? Yeah. We just have to have the policy and the legislation to support both the defense, you know, the just defending networks, the standard CISO type activity, the active defense of having the authorities to, you know, if you're a company that owns data centers, actively removing foreign threats once they've been identified either by your own

• 39:24Speaker 01

  situational awareness or intelligence provided by the government. And then how we go about using offensive tools. In Washington, at least, you hear a lot of people talking about wanting to get more aggressive on offensive cyber. The problem is sometimes they don't define what they mean by that. And so I'm spending quite a bit of time helping people get to a definition of what they mean by that. Because to your point, is some foreign entity can just push a button and attack our critical infrastructure? It doesn't work that way. There are three components of effective cyber attacks, speed, control, and intensity. And they're all sort of countervailing

• 40:05Speaker 01

  variables. You can have some really intense cyber attacks, but they're going to be out of control. And then you get sort of a worm that goes globally, breaking everyone's networks. There are certain actors that are happy to do that, but you really can't affect and disrupt and destroy particular targets if you're going to do it that way. So we just, as a government and with our allied partners, really need to come to coalesce around what we mean by offensive cyber and how that is going to contribute to the defense. Or, more importantly, as a deterrent to foreign cyber attacks.

• 40:42Speaker 01

  But all those conversations are going and that some people think, you know, people in glass houses shouldn't throw stones in context of offensive cyber operations. I mean, you know, our foreign adversaries have pretty fragile glass houses as well. So I think we're all on the same, you know, playing field there.

• 41:02Geoff Nielson?

  The offensive cyber is exactly where I wanted to go. And it's already interesting. You kind of distinguished offensive cyber versus what you called active defensive. Are we? Would you consider us in a state of either cold cyber warfare right now with any nation states or hot cyber warfare? And what do you like? How would you describe our current posture toward, you know, offensive operations there?

• 41:31Speaker 01

  No, so I don't think we're in a state of constant cyber warfare. I mean, it just, it's, it's, I mean, warfare involves bombs and, you know, guns and death and destruction. And we've never seen a cyber attack, you know, result, you know, quite that. So I mean, I think a lot of what we see as or get interpreted as cyber attacks are really intelligence operations, collecting information on whatever the target may be. And sometimes it's not US government. I mean, the Chinese have stolen an enormous amount of intellectual property from, you know, a variety of industries.

• 42:07Speaker 01

  Is that cyber warfare? I don't think so, really. It's, it's, it's intelligence operations, but in a very different context than we would use our intelligence tools. The vault typhoon prepositioning tools, is that an act of warfare? Yes, theoretically, but it's really preparing for potential warfare. So, so I mean, we are in a very, you know, active period of, of, you know, doing reconnaissance against our adversaries in cyberspace to understand what the threat is. But we're not, we're not in a period of active warfare.

• 42:44Speaker 01

  Now, on the, on the military side, cyber command has a mandate to continuously look at these various networks in case of wartime against a whole variety of adversaries, not necessarily just the Chinese, Russians, Iranians and North Koreans. But again, I would argue that's akin to, you know, driving an aircraft carrier like, you know, off the coast of an adversary nation. They know you're there. They know you're in the cyber context. They know you're in the networks. And it does act as a deterrent in some ways. It's not a very public deterrent like an aircraft carrier, but it is in a lot of ways

• 43:28Speaker 01

  a similar sort of thought process.

• 43:31Geoff Nielson?

  So that's exactly what I wanted to ask you about next. So is it, are we currently in a state where we're able to use, you know, the threats of cyber warfare or, you know, offensive cyber operations as a deterrent? And in your mind, you know, is that an effective strategy that we should be pursuing?

• 43:53Speaker 01

  We are not yet there, but that conversation is happening. And the conversation also, you know, happened during previous attacks, or sorry, I'm using the wrong language because it wasn't an attack. The SolarWinds incident, which was an intelligence collection operation, or the ransomware attack on Colonial Pipeline where, you know, our gasoline distribution got shut down on the eastern seaboard several years ago. You know, so, so there was a lot of discussions on how you respond to that. You don't necessarily need to respond to a cyber incident with cyber tools. You can use diplomatic tools. You can use sanctions.

• 44:34Speaker 01

  You can shut down embassies or consulates, eject, you know, foreign adversary diplomats, whatever the case may be. But as far as a true cyber deterrence, we're still having that conversation yet and haven't, you know, coalesced around what that looks like. But for example, the Iranians attacked water treatment facility, IOT devices that were made in Israel, but used in Pennsylvania, New Jersey and Texas, I believe, last year. They attacked these as sort of a demonstration of their, their abrobum against us for having an Israeli company, you know, manage our water treatment.

• 45:17Speaker 01

  I believe a deterrent step on that is if an attack like that happens again, we should have a reciprocal. Again, I'm not in a policy position, but this would be my recommendation is to have a reciprocal attack to say, we know you did this. Now we're going to do something to your water treatment plant. That doesn't result in, in, you know, death and destruction, but it, but it is a point which I think in the aggregate will be a deterrent, will have a deterrent effect against the Iranians or whatever other actor it is. And I'll cite, as since we're talking about Iran, I will cite what the Iranians have used their cyber tools for in the past in what I would call coercive diplomacy. It's not warfare.

• 45:59Speaker 01

  It's, it's something other than warfare, but the Albanians were hosting the Mujahideen al-Hulk, which was an Iranian opposition organization. And the Iranians didn't like that. And they put pressure on the Albanians to eject the Mujahideen al-Hulk from their safe haven there in Albania. And the Albanians were, you know, not listening. So the Iranians shut down the Albanian government networks. I mean, really destroyed the networks and, and did not try to hide it. It, it had the intended effect. The Albanians started rethinking whether they were going to host the Mujahideen al-Hulk. So, I mean, countries do use their cyber tools in, to, to achieve diplomatic or defensive ends. We just have not really done that yet.

• 46:44Speaker 01

  And for a variety of policy and legal reasons. But I think we're, you know, we're, we're moving the policy in a direction where we're going to have those offensive tools at, at, at the ready and more so than we have in the past.

• 46:58Geoff Nielson?

  I, I love the, I love the analogy of, um, you know, the aircraft carrier and being able to just, just have kind of a, I don't know if you can call, I've, I've never called an aircraft carrier subtle before, but like a subtle display of strength and deterrence there. Or even, you know, I think more recently of like surfacing a nuclear sub, right? Like just being able to show like, hey, we're here, we have the capability.

• 47:18Speaker 01

  And the Navy has done that for years. I mean, that's why. You know, Navy ships around the world make port calls. It's in part so that the sailors can get off and relax a little bit. But the real reason is a show of force saying, we're here. You make reference to submarines. Yeah, we're here. We're, you know, one country away from whatever adversary it might be. And so it does send a message. I mean, it's harder to do that in cyberspace, but you know, we have, we have a cyber partner, both on the military side and across the US government. We, we have cyber relationships, defensive and offensive cyber relationships across the globe. And our adversaries are aware of that, and that sends a message as well.

• 48:01Geoff Nielson?

  Hmm. Yeah. You mentioned, you mentioned Iran and it came up in a few different contexts there. When I think of, you know, offensive cyber operations, still, you know, the number one that comes to my mind, you know, ever is probably Stuxnet. And, and I'm curious, I mean, first of all, and, and for, for listeners or viewers who aren't familiar with Stuxnet, it was, you know, if I can call it a virus, it was malicious code that was injected into Iranian, you know, nuclear, you know, refineries or plants that like really set back their nuclear program. And so I, I mean, a couple of questions for you, Andy. First of all, is Stuxnet in your mind still the, the greatest, like the, the most impactful example

• 48:44Geoff Nielson?

  of, you know, cyber offensive operations? And second of all, do you expect us to see another from, from, not just from the US or Israel or whoever? Globally, do you expect to see another Stuxnet sized moment in the next five years?

• 49:02Speaker 01

  So, you know, I, I, uh, I will neither confirm nor deny my own knowledge of that. Outside of a fantastic book by a good friend of mine, Kim Zetter. There's a book called Countdown to Zero Day, uh, which is, is the most detailed account of, of the Stuxnet event. And, and you know, what I, what I would say it differentiates, you know, what Kim talks about in that book is, um, the very specific, you know, using a process, uh, PLC, process logic controllers, and a very targeted thing to achieve a specific.

• 49:41Speaker 01

  Uh, policy goal.

• 49:42Geoff Nielson?

  Right.

• 49:43Speaker 01

  Um, and that goes back to my speed, intensity and control. You, you can do it fast. You can do it intense. You can do it controlled, but all those variables have to be in sync. And I would argue, and again, the way that Kim Zetter outlines it in her book, that all those variables were in synchronicity and that's a very, very rare thing. So are we going to see more of those uh, in the future? Yeah, maybe. I mean, if, if, if a nation state, United States or others is trying to achieve a very specific goal um, in, in an operation short of war, uh, maybe. But again, I, I, I'll go back to February 2022 and, and, and the Russians.

• 50:24Speaker 01

  I mean, we, uh, we expected, you know, Stuxnet like cyber attacks from the Russians against the Ukrainians, against uh, NATO, our NATO partners against us if we supported the Ukrainians. And for the most part, uh, that did not happen. Um, I mean, there was one, the day before the Russians invaded Ukraine, there was a one, one attack against the satellite communications network that was fairly effective. That indicated to us that they had pre-planned that and thought that one out. But if you don't, if you as a, as a, as a government, in this case, the Russians didn't very specifically plan out like one would plan, you know, the invasion and, and they didn't do a very good job of planning their invasion.

• 51:08Speaker 01

  You're not going to have effective cyber attacks either. You know, so, so again, to the whole point, like, can people just push a button? No, it has to be very well thought out and have a very specific objective. Something I would think in the next five years in, in, you know, in international arena will, you know, trigger the need uh, for some nation state uh, to do that. But it's not going to be like in the movies where like the, the power goes out, you know, from Los Angeles to New York. It just, it just doesn't work that way. It would have to be very specific. They want to take down X or they want to do, have, you know, Y effect on a particular network.

• 51:46Speaker 01

  And then, you know, if that happens, I hope, you know, Kim Zetter writes another book, you know, um, so that I, I can reference that vice, you know, my own knowledge of it.

• 51:55Geoff Nielson?

  Right. I do want to come back to the Russian piece, though, and you described it earlier as like the cyber warfare component of the Ukraine invasion as a nothing burger. And in some ways, at least from what I've read, I've read very things from either, yes, it was truly a nothing burger to, wow, there was actually more than we're hearing about publicly. And, you know, there were some operations there. But it's, see, as far as I can tell, we were almost caught off guard by how absent the cyber warfare element was from that invasion. And I'm curious if you have any insider speculation as to why?

• 52:31Speaker 01

  So, so the why is multifaceted. I mean, I do, I do think Ukrainians beefed up their defenses after Nafta and various other cyber attacks, starting, you know, when the Russians invaded or occupied Crimea back in 2014 on through 2017 and then up until 2022. They built out their own government cyber defenses very, you know, in a very robust manner. They also partnered with Western cyber defense companies. They partnered with Microsoft and a whole variety of other, other foreign entities. I mean, all of that, you know, quadrupled after the invasion, but they had already built up those relationships. So that's one. I mean, the defenders had a boat.

• 53:16Speaker 01

  Two goes back to my, my, my other point where, you know, you had that highway going up towards Belarus into Ukraine where tanks, Russian trucks were all like stuck because they didn't think through the logistics and the fuel necessary for that, for that invasion. There was a corollary on the cyber side. They didn't plan particularly well on the cyber attacks. They didn't really inform the, the leadership of the cyber entities to the degree that they needed to. So you need, you need very, you know, detailed planning to have effective cyber attacks. So I think that's the second variable that, that, you know, made it what we thought were going to be more intense attacks just, just never happened.

• 54:00Speaker 01

  And then the third is, you know, the Russian, Vladimir Putin's perception that if he escalated cyber attacks against NATO or just the United States or NATO writ large, that may have been an escalatory event that triggered something that the Russians didn't want to deal with. I mean, in their mind, the Ukrainian invasion was going to be a short-lived. It wasn't, and and they didn't want to escalate. And I do think, and maybe correctly, you know, Putin continues to fear that that escalation, despite the fact that we crossed almost every red line that we predicted. Uh, you know, providing weapons to the Ukrainians, uh, cutting off the Russians from the uh, the banking

• 54:44Speaker 01

  system, the SWIFT system and whatnot. Um, and they, and they, you know, you know, still didn't retaliate for that. And then the the fourth variable actually is, I mean, if the Russians destroyed all the Ukrainian networks uh, in route to their invasion, um, they they would have no networks to use when they got to Kiev. I mean, they thought it would be a short, uh, a short-lived invasion. They would occupy. They would take over the country and they were going to need those now. And so, once, once it was clear that that wasn't going to happen, um, they, you would have thought they would have conducted cyber attacks against the networks in Kiev or the electric grids. But instead, what they did is is they used,

• 55:26Speaker 01

  you know, artillery and missiles and rockets and whatnot. Um, in my mind, if they actually had the tools to attack the electric grid in Ukraine, they would have because a cyber attack is certainly cheaper than sending ballistic missiles against the electric grid. So, um, so, so I think, you know, all four of those variables are relevant. Um, and I think that will inform how we assess nation-state threats going forward, but we shouldn't, you know, overlearn those lessons because China is a very different place than Russia.

• 55:58Geoff Nielson?

  Yeah.

• 56:01Geoff Nielson?

  So, as we think about threat vectors going forward, you know, I, I think lots has been said about this, and I don't want to necessarily rehash it. But in your mind, are there any kind of um, under-reported or, you know, under-covered uh, threat vectors that you think should get more airtime or should be higher on people's minds?

• 56:23Speaker 01

  I mean, not necessarily, although, you know, we focus in this industry a lot on things that we discovered. We talk a lot about, you know, the telecommunications industry because of the Salt Typhoon attack. What I worry about is the thing that we haven't discovered yet. So as soon as we identify a threat, we should start pivoting off to, okay, what are we missing? We discovered Volt Typhoon and penetrations of critical infrastructure in that context, but what are we missing? And so I think it has to be a constantly refreshing discussion on, you know, the threat vectors, you know, there's the known, knowns, the known unknowns, and then the unknown unknowns, that to use a phrase that former Secretary of Defense,

• 57:07Speaker 01

  Don Rumsold, used to use. It's the, it's the unknown unknowns that concern me deeply within the critical infrastructure sector. And it just takes a lot of creative thinking from cyber defenders to think those through and to have a public dialogue about it. Now, the only thing that we should, we should do behind closed doors in the US government is if we have intelligence that we can't, you know, discuss publicly due to sources and methods. But otherwise, we should have a very public discussion on these threats because, you know, there's plenty of industries out there that are not going to have access to the US government on a, on a, on a direct basis. And they need to be part of the dialogue.

• 57:51Geoff Nielson?

  So what's your best advice for CISOs and for boards, you know, across the private sector on, you know, they're like your best advice for how they keep themselves safe and contribute to keeping, you know, the nation safe?

• 58:06Speaker 01

  So for boards or, you know, chairman or CEOs, my and people in this industry will, will recognize this point, but stop treating your CISOs like they're basement dwellers and they, they don't belong at the board meeting or they don't belong in the C suite. If you're serious about cybersecurity, then treat your CISO and your CISO like part of the leadership team. For years, CISOs have been treated like, oh yeah, we gotta hire a CISO, but we don't really want to see him, you know, and, and just sort of lock him in the basement and that'll be fine. Because what, you know, Policy and legislation, it's in some ways, it's already there, but it more is coming.

• 58:51Speaker 01

  If you don't, as a CEO or a board member, understand the threat vector and have a routine conversation with your CISO, with your CSO, you're going to be liable for cyber attacks against your customers' data or whatnot. So that's the advice for the boards and other leadership entities at various corporations. For the CISOs, I mean, I could recommend, you know, go on for an hour about various tools, various threat vectors to worry about. But I think the best strategic advice I would awkward any CISO is just as it's incumbent on the board to understand the CISO, the CISO has to understand the board.

• 59:31Speaker 01

  And you can't be, you know, crying wolf every time there's a threat vector because your job is to prevent those threat vectors. And you have to understand, and a lot of folks in the cybersecurity industry are very channeled down that cybersecurity realm. You have to understand what is important to your CEO, what's important to your CFO, what's important to the board, and what matters from a product development perspective, what matters from a revenue perspective, and frame everything that you do as a CISO or a CSO into how you're contributing to the mission of that company, whatever the product is, be it a software company or, you know, a toy manufacturer, whatever the case may be.

• 1:00:14Speaker 01

  Because, you know, for years, again, CISOs were locked in the basement by the CEO, but they kind of liked it. They kind of liked being in their own world. CISOs cannot just sequester themselves in their own world. They have to be part of the dialogue and they have to have reasonable requests for investments in security. You know, how, explain to the CEO and the board how an investment in a million dollars in impact surface management tools or network defense tools, why it matters and what the cost will be if they don't invest that. And that's hard. A lot of IT security professionals don't necessarily know how to have that dialogue with the senior leadership in their companies, but they have to learn.

• 1:00:58Geoff Nielson?

  Well, well said. It makes sense. And I think that's extremely powerful advice for both sides there. Andy, I did want to ask you, dangerous question. What's your craziest cyber career story that you can share today?

• 1:01:16Speaker 01

  Um, I, the, the cra- I don't know if it's crazy. It's just, it was, it was a wake up call for me. On the importance of cyber as it relates to the intelligence community, but how it relates to national security writ large. And it again goes back to February 2022. I received a call from the Director of CIA, Bill Burns at the time, that I needed to participate with him in White House level meetings, you know, with cabinet level meetings. Not as a cabinet member, but as a backbencher supporting him. And I was like, that's weird. I'm not the guy in charge of, you know, that thing in Europe.

• 1:01:59Speaker 01

  But it was because of the potential for cyber threats that were out there that I participated in those conversations. And that was a wake up call to me where, I mean, I was very cognizant of our capabilities in cyberspace and whatnot. But it was a wake up call to me like, oh, wow, this is, we're now cyber warriors, so to speak, are now at the front table. And, and, you know, frankly, it's a corollary to what we just discussed about SISOs. Like, I didn't sequester myself in the basement as Director of CCI. But I didn't necessarily think I was going to be at that table for that particular, particular discussion. But cyber defense and cyber strategic analysis is infused in everything now.

• 1:02:43Speaker 01

  So I shouldn't have been surprised, but that was, that was a very surprising moment in my tenure as a cyber leader.

• 1:02:50Geoff Nielson?

  Well, that, I mean, it's amazing and it speaks. On the one hand, I'm glad that that's starting to get that recognition, but it speaks to the importance of it. And, you know, it kind of acts as a beacon, I would hope, to, you know, some of the organizations that are maybe, you know, are maybe resisting, you know, that, that position and want to keep SISOs in the basement. So.

• 1:03:10Speaker 01

  Right, right.

• 1:03:11Geoff Nielson?

  Awesome. Andy, this has been a super, super interesting discussion. I wanted to say a big thanks for joining today. So we covered a lot of ground and I really appreciate your insights.

• 1:03:23Speaker 01

  Thank you, Jeff. I really appreciate it and I enjoyed our conversation.