Enhancing Security in the Age of AI and Agents | TSG Ep. 948

Hey, don't, uh, secret agents have to deal with security too, or is it security have to deal with agents. We're trying to figure that out. What's the security with all the agents that we're creating here on the Textron gang?

Well, welcome back for joining our elite team here of Textile Techstrong gangs. I guess we are gang members. Uh, Mitch Ashley here with Futurum.

Great, great to be joined by, um, our, our crew of Jack Fowler and Steven Foskett. Guys, welcome, welcome. Thank you.

Great to be here. I am definitely a secret agent. You are.

Well, that's what I was thinking about agents. Aren't they like secret and don't they deal with security? And suddenly, now, I, you know, we talk about secrets of agents and that's what we're gonna get into.

com, talking about security run MCP servers. Um, are we, it seems like the topic has been, uh, come up but not been addressed. We talk about security for agents.

We talk about identity here and there. You know, the team members, are they, whatever, you know, how do we, how do they get their permissions? But there doesn't seem to be any, uh, like real solid frameworks around agents today, at least not yet.

Now, you can look into some of the open standards and say, there may be some things there, but I don't think Jack, somebody in the security community is gonna say, yeah, I'm happy with everything looks good to me. No, I think it's the exact opposite. In fact, uh, the, uh, entire security, uh, identity security world sort of shakes their head and looks at it.

Like, does the face ballman? You know, what are you thinking when you created MCP and had no concept of identity and MCP and said, oh, we'll just wave our hands and do some OAL tokens or something else and let somebody else deal with it. Uh, the the challenge is really that we're moving from a human world to an agent world where agents act on behalf of humans.

And it's important to understand, uh, the agent's identity, the server's identity, the human who's the agent is acting on behalf of, or for the benefits of identity in every single action transaction that occurs. And right now, there's a lot of anonymity and anonymity in security is a bad thing, right? So there's a lot of talk about at the high level, here's some high level constructs we need to think about.

And so I wrote an article about some, uh, uh, identity security folks coming out and saying, you know, there's a lot of issues with anonymity with, um, how you communicate the information back and forth. Uh, how often you go back to the user to re-authenticate, to get permissions, and how to make that cleaner. And here's some high level thoughts to think about it, but we haven't moved beyond that to here's an actual protocol that actually thinks about and cares about it.

And the big concern is we're running at a million miles an hour trying to make agents useful and get money out of them without thinking about the security. And that's just generally a bad thing in my book. And we can't wait for them to be agentic.

Right. Steven, at the same time, you know, we, you host AI infrastructure, uh, field days and, and AI oriented things. I'm wondering how much, how much is security coming up and what are vendors saying about this?

Yeah. Well, for, to be clear, yeah. Alistair hosts AI infrastructure Field days.

Yes, that's true. I host AI Field Day, and that's where this stuff comes up. Uh, AI Field Day.

I know it's confusing 'cause there's two that sound a lot like, um, and in fact, actually the last week I was at NetApp Insight and there was a lot of conversation there as well about this. Um, first off, let me just say that that article on Security Boulevard that, uh, about this topic is just really excellent because it goes over a lot of the potential issues with agents in a very clear, straightforward way. And it's so true.

I mean, think just, just think about what is being pitched at us about agentic ai, you know, oh, it'll automatically, you know, find the right flight for you and book it. Um, wait a second, right? Do I really want my browser?

You know, do I really want perplexity to decide how about, or, or even better, do I really want Google to decide which flight to buy and buy it without any approval? Or alternatively, as it says in, in there as well, there's that chaos of approvals. Or alternatively, do I really want to click the little button and say, buy me a flight, and then have it say, do I have your permission to access your calendar?

Do I have per your permission to access your email? Do I have your permission to access your, uh, frequent flyer accounts? Do I have your permission to, you know, because again, that's, that's another issue.

Um, uh, another other issue I wanna point out. I was reading the CloudFlare blog, um, last week, and they were talking about, um, you know, their, their, uh, one of their articles, uh, using, uh, MCP in code mode. Uh, their, their thesis is we've been all been using MCP wrong.

Their suggestion is that instead of calling tools, what we should do is have MCP dynamically recode the calling and the APIs on our behalf automatically, and then run it as code instead of in MCP. And the whole time I'm reading that, I'm just thinking, but what about security? So essentially we want to, we want to just tell AI every time the agents do anything, Hey, go ahead and just rewrite this yourself.

Like, just figure out how to do it, would you? And yeah, I mean, it's, it's just, it's just a complete total nightmare. And, and so I wanna point out what, what, um, the clever thing that NetApp announced last week, and this is not gonna solve this problem, but I liked one aspect of it.

They are in their new, um, AI data engine. They are using, uh, AI tools to do data classification and to then use that to enforce access controls on data. So instead of, um, instead of just saying like, uh, I think you can access everything on that file share, you would be able to say, you can access, you know, data related to ACME Corporation client, but no financial information.

And then that way, and, and their, their idea was, and I completely agree with this, that the only way to keep an LLM from leaking data is to never let that data into the LLM to begin with. And, and they're, so they're using ai, but in no way that actually is exposing anything. They're just using it to create metadata, and then they're enforcing access based on the metadata that was created in a sort of a standard deterministic programmatic API type way.

So there it is not AI talking to ai, it's actually, you can't access this. You can only get this subset of data. And I love that idea.

Interesting. I was also at, uh, at the Oracle last week at the, uh, a now renamed AI world, um, and similar kind of approach of not only is it did the data store, but that's, you know, they have databases, massive databases, uh, business applications, E-R-P-C-R-M, et cetera. And their approach is something similar where they said, look, the data never leaves this platform and AI will access it through MCP, but that MCP will be controlled by all of our existing security and privacy policy.

So you already implement in those products. Um, so That's like the same idea except for structured data, whereas, and NetApp was talking specifically about unstructured and mot multimodal data. Yep.

Makes a lot of sense. So it, it's interesting, you, we, I wanna go back to the, the, the polymorphic topic you brought up of code creating code, right? And that's, we're already doing that.

We just have it in the developer's hands when it's creating code for us, right? Um, but that's very much where, where this is heading, is that agents will be able to create agents, agents will be able to create code dynamically. Um, and in doing, doing, so, yeah, it might be minor things, but still that's how, how things get linked in.

That's how c credentials get lost. All kinds of issues kind of come up. That article you were talking about on Security Boulevard, by the way, was we'll put a link to it beyond chatbots.

Why, uh, agent security is the industry's next major challenge. And there are like 10 items. I think there were, that came from the artificial intelligence, identity management community group that, that had a number of, of these issues that they talked about that need to be addressed.

So, yeah, I'm sure it's not everything, but I thought that was a good list too, extra point. The, the interesting thing about all that and sort of the polymorphic is we, we do that a little bit today in a very subtle way, which is when you think about infrastructure as code, that really is mm-hmm. Uh, another form of that where we say, here is some code that defines the desired state of our environment.

Now you go figure out how to write code to talk to agents that are, or to have agents that go talk to different types of systems, whether it's servers or routers or storage devices, to get 'em configured the way you want them to, to operate. And in that environment, we still have a very big problem of anonymity of access, right? Every, if you think about those types of environments and infrastructure as code, everything you're doing is a privileged to access.

You're operating as a super user or in a system administrator where you can go change any configuration. You can, uh, delete hosts, delete servers, delete virtual machines to start 'em, start multiple instances. And with the anonymity in there, it's very hard to audit and trace back who's doing what and why something actually happened.

And hey, you know, we just shut down our entire production server. What happened? Well, this agent turned it off, but why did that agent turn it off?

I don't know. Because, you know, somebody somewhere made a typo in an IAC file. But there's no way to tie all of that back together without a lot of manual effort.

And very often, because it's all anonymous access, you can't, and that's part of the problem in the MCP world as well, is agents can take on and work for multiple people simultaneously, and they can do things, uh, autonomously, right? Where you say, Hey, I wanna buy an airline ticket. But that triggers many different actions, which could trigger many different agents to do things, as you said, access your calendar, put something on my calendar or delete a meeting off of my calendar by mistake.

Right? Hey, that meeting disappeared. I don't know why it disappeared.

Who made it disappear? Where's that, uh, log? You know, I feel like I'm reliving the, uh, dipping back here in history.

The, uh, the 12 blinking clock on the VHS tech tape deck. I can barely keep HubSpot and LinkedIn connected all the time. I have to go back and relink it.

Yeah. Um, how are we gonna do that? That's the thing, right?

And, and again, in Cloudflare's defense, I mean, they're not talking about zero authentication. I mean, they just use conventional, um, au authentication tokens. Um, and MCP is fully, uh, able to do, you know, standard authentication tokens.

But, um, like you said, I mean, that introduces a sense, a a sense of fragility and, and sort of a black box nature to it, where you're just not sure, uh, where did it get this token? Who's it authorized as, you know, how do I control this? Um, and, you know, yeah, the, the blinking 12 o'clock problem, um, we are all gonna face that problem, because it doesn't matter how smart you are when you're, I said black box now twice here.

I'm gonna say it again. Um, when you're faced with, you know, fundamentally, um, agents, agent to agent is a black box, you know, you're saying, you know, here's some tools that you can use. Now, they do, again, to cloudflare's defense.

They're running these things in a sandbox. Um, they're using authentication tokens, but it's the step of having the agent create its own code. That gets me a little scared.

Um, you know, their justification is that LLMs, um, you know, the trouble with MCP, and this is actually kind of a clever thought, the trouble with MCP is that LLMs were never trained on any dataset that contains MCP calls because MCP didn't exist when they were being trained. Hmm. And so it doesn't understand fundamentally how to deal with special, the special MCP tool calling token and how to call tools.

E even, even if it's been, um, fine tuned and to, to, to handle MCP, it's not fundamental to its training. Whereas allowing it to reach, redo everything in TypeScript, it's, it has a huge experience with TypeScript, and it's able then to more effectively execute all that I agree with. It's just, but that doesn't change the fact that we don't know what it's executing and nobody knows because it's executing in a sandboxed environment that's ephemeral and then it evaporates.

It also doesn't change the fact that right now, code generation capabilities are at, at the infancy, right? Very, very, uh, immature stage. And so the probability that it generates code that does something wrong is relatively high today.

Yeah. Go generate some code and go execute it. And don't ask me and don't show me Now.

Go. Exactly. And, and AI likes to generate a lot of code for you on your behalf, even if you don't want it to.

You have to be careful with it. Well, good, good stuff. I mean, we've covered a range of, you know, what about the MCP?

What about MCP, who's, it's like the weather, who's doing something about it? Oh. Or agent security.

So, uh, I have a feeling we're gonna talk about this topic a lot more. So stay tuned, we'll be back and we'll be, uh, jump to our next topic. You've earned it.

The spotlight, the responsibility, the weight of teams, companies, and entire industries fall on your shoulders. Lives depend on your decisions, your home life included, that work you are protected physically and digitally. Nothing gets through your team without a fight.

But in a globally connected world, everyone sees you, including those who mean to cause you and your organization harm. And now home your sanctuary attackers see an opportunity. Your digital front door is wide open.

And what compromises your home can breach your boardroom. Because the devil's greatest trick isn't targeting your workplace firewall. It's convincing you that your personal life isn't at risk.

Black cloak, digital executive protection, defending the new attack surface your personal life. Well, we're talking about security day. It's security day on the Textron Gang.

com talking about the, the big secrets leak, if you will. Uh, that has to do with vs. Code visual studio code, developer tool, IDE, uh, through extensions leaking secrets.

Um, Wiz had earlier this year, uh, announced the discovery about, about how many supply chain security, supply chain leaks that were due to these extensions, not only in VS code, but also open BSX marketplace. And then Microsoft researchers found that, uh, publishers of more than 100 vs code extensions leaked access tokens. Hmm.

That would've enabled a, a bad actor to distribute malware to more than 150,000 users. Eh, what's a, you know, that's not bad. It's kind of a small number, isn't it?

So, so it, it just shows you the, the attack or the leakage surface of data and security credentials, secrets is as far wide and as deep as as you can make it. And now we're talking about developer tools. We're, we're talking about MCP, you know, that's now also part of the developer tool space.

So what are the security folks gonna do about this? Jack, when are you gonna fix this for us? When are we gonna fix it?

No, when are you gonna fix this, Jack? When am I gonna fix it? There you go.

Personally, gonna fix it. Well, I, you know, I'll, I'll use a very simple analogy that the IDE, the integrated development environment is effectively the web browser for developers, right? It's their main way if they interact with things and extensions in the ID inter, uh, interface are the equivalent of the extensions in a web browser.

And so we sort of have the, it's the exact same problem we've had in web browsers for a while. If you have rogue or malicious or poorly programmed extensions, they can come in and get access to your password, see where you're typing, yada, yada, yada, the same sort of security things. And so, uh, you know, uh, we have a couple of, in the security world, we now have a couple of, um, startups doing browser detection and response, which I wrote about recently, like Square x, who has an extension that goes out and tries to, uh, protect the user of a web browser from malicious activity by, either by either websites or other extensions.

And now, or maybe we'll go and see developer, browser developer environment, IDE security tools that are gonna have to be third party tools to come in and look at this. Or, um, the other option is to go towards more of the Apple model, where you have a, uh, walled garden and somebody Microsoft for visuals, uh, studio and, uh, goes out and vets the extensions to say that this is behaving properly or not. And that's an awful lot of work on both cases.

So I don't know. Yeah. On the square X thing, I, I, I have to say, uh, we did just have them present at Security Field Day.

So if you wanna learn how, what that's all about, you can just Google Square X and Security Field Day and you'll find a video, which is a, a deep dive demo of, of exactly what they're doing. But absolutely, um, the thing that, that gets me about this kind of in relationship to the previous discussion that we had, the, the leaking of secrets. I mean, we just talked about tokens and secrets in MCP and how that works.

Um, the leaking of secrets is one of the primary things that, um, jail breakers are trying to do with AI models. Um, basically figure out how to make it leak secrets for me. And there are many ways, and, and, and you cannot and fundamentally prevent that, except by having sort of a convoluted calling process.

Like I could see a situation where somebody could have an MCP tool that exists that is only a secret's vault, maybe one password should do that, and, um, and basically have the agent call a tool that it doesn't have visibility into. And then that tool then basically just provides the token on your behalf or something like that. Because if, if it can see the secret, then it can leak.

The secret. And that's the problem with this vs code story, is that essentially people left the, the token, the secret in the code. And the thing is, um, you know, black hats are literally, I mean, they, they basically just have regular expressions searching for, you know, tokens and secrets on GitHub and vs.

Code and everything constantly. So if you do it even for a moment if you like, oh, commit that, oh man, oh, no, no, no, nope. Lemme get rid of that, you know, well, guess what?

You know, you just, you know, it's gone. You know, as soon as you say it, it's gone. It reminds me of the situation back in the day when we would set up, you know, windows servers and within literally 30 seconds, somebody was hitting, um, known vulnerabilities and windows to try to, uh, you know, hack into those servers over the internet.

So you had to like, like install, you know, windows servers, uh, disconnected because otherwise somebody would hack it before you could even apply the patch. It, it's kind of the same thing here. And, and in vs code what it sounds like too, people didn't even do that.

They didn't even get rid of the, the stuff quickly. They, they just did it and didn't know that they did it. Um, at the end, you know, you're talking about, um, you're thinking about vibe coding, you're thinking about AI written code, uh, I think there's a very good chance that AI is gonna put some sloppy code out there that's gonna include tokens and secrets and that aren't properly managed Well, and, and it's not, you know, rookies doing this too.

I mean, they found, you know, extensions that came from open AI and Gemini, Google, Gemini, philanthropic, you know, perplexity even as well as AWS and GitHub, et cetera. So there, so these are, you know, are weren't just kind of rogue actors out there that who left their secrets in their extension. And, and there are things to do exactly like you're talking about and and development world.

One of the popular open sources, one is called Vault. And that's the way it is. The secrets is stored there, and it's only because the trust relationship you set up between your code, your system, and that vault that gives you the access token yet to get that credential, that secret, um, I, I kind of faulted at, at, at the IDE level.

This should be built into the IDE, right? There are, and you can use secrets managers in VS code. Um, but that should be part of it.

It should be very easy to manage secrets already, just right in the IDE pop it right there. It already has, you know, I built the trust relationship when I installed it. This is my test environment.

This is, I hook up to my corporate environment. That should be part of how that's set up. I mean, it's, jack security is set up from the beginning, not after the car leaves the factory.

And we want to add airbags, which is, which is why I, my column is secure by design. I really fundamentally believe we need to think about security at day one. When we talked about MCP earlier, we didn't think about the identity portion of the security of MCP.

When we look at the IDE, the IDE is something that has grown organically over 40 years, right? You know, when I was an engineer many, many years ago, we used a text editor, right? There was no integrated development environment.

You didn't have all the tools integrated, you ran you outta screen to do, you know, you red typed your code, you exited the editor, and then you invoked the compiler and then you invoked your test environment. Uh, so in systems that have grown organically, we haven't really thought about security at, at the beginning. And I think it's now time, it's clearly time to sort of take a pause and say, how do we build, how do we sort of rethink this so that we can import the security tools that we need into it?

Such as, um, uh, secrets managers you built into the ID environment, or, and, and, and not only that, but how do we make it a standard operating procedure of how we teach programmers and engineers to develop, is to think about that and to use the secrets manager rather than the hard coding it. But I wanna say, no, go ahead. Maybe the IDE could enforce that and basically refuse to allow you to put secrets in, in your code to start with.

I think it's something, something you brought up earlier, Mitch, was that, you know, you named, you know, the, the rogues gallery who, who of, uh, who's who of AI as part of the, the group that created extensions, that leaked code. And my question is, and something Stephen brought up is, was that code that leaked the secrets written by a human or by ai? Well, that, that's a good question.

I, I'll money and it wasnt the same code for all of 'em. I bet money is by by both. Yeah.

Was it written in 2025? Probably ai ai. No.

And I didn't name didn't, I didn't name all names. I'm holding some of that. No, no, absolutely.

There was a lot more, but, alright. Well, you know, I think, so the, the, the parting thought is when we talk about software supply chain security, we're usually thinking about SBOs and package managers and things, source source images and things like that. We have to also think about the tool chain.

We're now using AI based browser tools to do development and running agents in browsers, right? So all of all of that execution environment, either for development or production, all that has to be secured. So it's the tool chain too.

The whole part of it. That's how SolarWinds happen. So we'll be back.

We're gonna finish up on security theme. One more topic. Discover Techron Group, the epicenter of tech innovation.

We are your go-to for reaching IT leaders and practitioners worldwide. Our secret impactful content that sparks awareness, engagement, and top quality leads with us. You'll access editorial websites, streaming videos, virtual events, custom content analyst research, and more.

Join our satisfied clients. Let's revolutionize your tech journey. Contact us today and tell your story to the world in the most powerful way with Textron Group.

Well, welcome back. We're gonna shift a little bit and not just pick on AI security. That's a little bit too easy at the moment.

I think in some ways we're gonna talk about really the runtime environment for cloud native applications with AI powered security. Hmm, okay. There's an interesting thought.

Now of course, when we talk about cloud native, we're usually talking about Kubernetes, at least as one of the technology that's pretty common to run. Um, and we also, we also look at, you know, visibility through things like, um, observability type tools, uh, things like that. I know this is an area that you looked in a to in prepara preparation for today's segment.

Jack, give us kind of your rundown. Um, well I think, you know, in one of the articles that Alan wrote, and I think he said it best, which is you can't secure what you can't see, right? And so we really need to think about in a, in a cloud native Kubernetes environment, how do we understand what's actually happening in the running environment, not necessarily in the development or code environment.

So you'll have, and as we talked about with or the first segment in MCP, you will have instances of your application either talking to other instances, um, or talking to other resources in your environment. And you may not, you probably won't have visibility into all of that because it might be they're in a process communication on the same server or, um, going across a, a local connection that's not part of your outbound network security protocols and what you're looking at for network security. So if you're not observing what's going on, you can't understand if something bad is happening.

I think that's the crux of the problem. And so as you start having AI developed code and AI running in your environment, now, there's a whole lot more happening that you don't know about. And so understand, trying to get a handle on that invisibility into that, I think is critical.

Yeah, it's an interesting thing too. And Alan's and Alan's chew take at the end of this article he's talking, he talks about it's not humans versus machines for security. It's human and, and machines working together.

And with ai, since agents and AI often mimic or do things that are essentially what a user would do, whether developer or, or an end user. So machine identity doesn't kind of cut it anymore in what we traditionally think of a machine to machine identity security mechanism. 'cause the actions it's taking is actually looks more like an end user or is frankly, it's just a digital user.

It, it's so interesting how similar this is to our discussion of MCP in that, um, you know, the, the, this whole idea that, uh, cloud native applications can and absolutely do spin up and, uh, then destroy, uh, containers that are basically, I'm gonna call 'em agents, uh, you know Mm-hmm. So microservice could have, could be an agent. Absolutely could be.

And uh, you know, that they create these agents that they run an, uh, something on them and then they destroy the container afterward. Um, it's the same challenge. Uh, and I do like the idea of, you know, kind of turning it over on its head.

It's kinda like what I was talking about with NetApp and their MCP kind of protections by doing automatic AI based data classification, the idea of using ai, not, you know, it's not like running AI applications. It's basically just throwing some AI at the problem by saying, Hey, ai, keep an eye on what's going on in this environment all the time. Um, it's ac i, I like the idea because it's just another tool, it's another quote set of eyes, even though it's not really a set of eyes, but it's another, um, opportunity to discover something going on in this environment.

So, you know, by having AI watch non-AI things, I think that's one of its better uses. Um, I've been pretty excited about, uh, AI assisted firewalls. Um, I'm pretty excited about AI data classification.

I'm pretty excited about, you know, AI assisted security generally because, not, not that it's gonna solve the problems, but that it has a chance, it has a shot of detecting things that we wouldn't normally detect. Um, do you see that too? I, I definitely do.

I think the, for me, one of the differences here is when we think about, you know, AI is a very broad, encompassing term. One of the challenges when you think about an LLM, a large language model, it is designed to be non-deterministic, give it the same inputs, and it gives you a different answer when we're doing analytics, which is essentially what we're talking about here, is looking at, uh, a series of data that's repetitive, the same type of data, and really looking for an anomalies, right? That is what traditionally is called machine learning, but is designed to be very deterministic.

Give it the same inputs, it will give you the same outputs. The advantage that machine learning has is that it can operate at a speed and scale that humans can't. So it can look at a vast amount of data that humans can't deal with in our heads and can do it at very, very quickly.

And that allows you to look for, um, anomalies bad behavior or strange behavior over a greater period of time. So one of the things that attackers try to do is they try to operate, um, low and slow. Like right where ACP attacks, right?

I'm sorry, a CP type type of tax. Yeah, yeah, yeah. A CP tax where, where basically you're trying to exfiltrate data, but if you send, uh, uh, you know, a couple packets every second, rather than a couple of gigabytes every second, you might escape notice.

And so they can operate over very long periods of time, 30, 60, 90 days before they're discovered. And at that, during that time, they're able to, you know, exfiltrate a lot of data. It would be very hard for a human looking at the data, the, the telemetry that you have about what's going on in your network and find something like that.

'cause it's literally the proverbial needle in the haystack. But it is something that, uh, machine language, uh, sorry, machine learning program can do. And I think it's a very good application of AI to look at these vast amounts of telemetry about what's going on in our environment to identify things that shouldn't be happening.

Well, you know, it, it, I, I like the promise of where we're going because, you know, we, we've gone from let's do log aggregation, get a whole of logs in one place so we can find them. Let's put 'em all into one system so we can do analysis and application performance monitoring. Let's put more sophistication to it and, and have observability.

So we could do more analytics on it and connect the dots across, uh, the organization applications. So the next layer, in addition to AI being part of the solution is graph technology, which is adding context to that. Um, HashiCorp announced kind of, they're claiming the moniker of the agentic infrastructure, um, adding AI capabilities into, into what we do with, uh, Terraform.

And, but what it's informed by is something called infograph, which is a graph technology that is the state of what the infrastructure looks like. You know, we were talking earlier about code, generating code. Well, and you use the infrastructures code example, and that's perfect one, if you're doing it in isolation, co-create this.

That's one thing. If you're doing that in, in the context of a larger system, well, how do I find out what that is? How does AI find out what that is?

That gives you a lot more, uh, I think validity to be able to handle the, not only the volume, but the breadth you were talking about, Jack. I think there's a lot of promise in that, in, in helping solve some of these issues. Well, I'm, I'm glad you brought up sort of the graph concepts because that's something that Microsoft itself, uh, is also thinking about.

Um, Microsoft gave a, participated in a tech field, a exclusive event, uh, and they talked about how their integrating, uh, graph, uh, the concept of graphs and graph database into their, um, uh, si their, their sim and their entire security AI security platform. Mm-hmm. And part of it is that attackers think in graphs, right?

They think about, I'm, I've penetrated this particular server or a host or device endpoint or user now from there, how do I, what's the graph look like that I get to the next part and the next part to explore? Because they don't have visibility into the entire infrastructure at once. So they sort of have to build that out and they think about it in terms of graphs.

So if you can build your tools around the same way that the attacker thinks and understand the graphs of how your systems are interacting with each other, it gives you a leg up in understanding what's going on and, and trying to be one step ahead of the attackers. Steven, how much is graph technology coming up in the vendor events that you're doing with field days? Yeah, we're hearing about it a lot more.

And, um, yeah, this, this whole idea is absolutely coming up from sort of people who are i companies that are ahead of the, ahead of the, the trends instead of, uh, you know, sort of looking at things the, the old way. Um, I don't know enough about it yet, but I do know that we have seen it and heard about it from a wide variety of companies at Field Day. And um, yeah, I'd be really, uh, interested to see where it goes.

Oh, you'll have to get, uh, Neo four J or somebody like that into a field day and, and love to have somebody or anybody else. By the way, if you're interested, contact Steven or any, anybody here, we'll, we'll set you up and I think that'd be a fascinating set of conversations, so. Well, good.

Well, well, gentlemen, it's been, it's been fun. You know, I feel like we were, um, we're, we're missing the, the Allen drummer and, uh, so, but we decided to do the Rush Band and just kind of fill in. So we've got the trio back together just for some new players.

So good to have you here, guys. Have a good week everybody. Thanks for watching today.

Be sure in Tech, we talked a lot about Tech Field Day, thankfully, uh, Stephen was here. We could touch on them. com.

tv. Fantastic. So stay tuned.

So starting tomorrow, right? Wednesday, what'd you said? Wednesday, Thursday?

Yeah, it's, yeah, Wednesday, Thursday 22nd and 23rd. Very nice. Very nice.

Excellent. Well everyone be ready 'cause we're gonna be talking about agents and CPS and runtime security a lot, I'm sure. Alright, well be safe out there.

And, uh, please check out the rest of the program. We're out here on the Techstrong tv, uh, the great shows and interviews and conversations that are happening, things like Tech Field Day as well. We, we will talk to you soon.