Name: Cyber Attacks on CPS - 5 Things You Can Do Now to Reduce Your Risk Exposure
Uploaded: 2025-08-25T18:17:40.707Z
Duration: 1 h 8 s
Description: Cyber Attacks on CPS - 5 Things You Can Do Now to Reduce Your Risk Exposure

Transcript for "Cyber Attacks on CPS - 5 Things You Can Do Now to Reduce Your Risk Exposure": Hello, everybody. Thank you for joining our webinar. We are very pleased to talk about a topic that is near and dear to all of our hearts, something that is certainly making the news on almost a daily basis. We're gonna cover, some of the cyberattacks and what you do around cyber physical systems or as we like to call CPS. We typically think about cyber physical systems in terms of things like manufacturing or critical infrastructure. Obviously, anything that takes into account things like PLCs, DCSs, HMIs, these types of things. So I'm joined by two real luminaries in this field, and I'm glad to introduce them today. Firstly, I'd like to introduce, Eli Edelkin, the CISO of KADA. Eli, thank you for joining today. Tell us a little bit about yourself. Thanks. My name is Eli Edelkind. I'm the chief information security officer and also responsible for infrastructure engineering, at Cava. Cava is a growing fast casual Mediterranean restaurant brand dedicated to heart health and humanity to food. I really appreciate the opportunity to speak with you guys today. Great, Eli. And and thank you. I I think I've been to Cava a couple of times, so, well done there. I'd also like to introduce to you Danny Brynn, who is the former CEO of Artario. If you recall, Armis has, acquired Artario a number of months ago, and we've, included Artario, which has a full complement of on prem OT offerings. We've included that in the SentriX platform today. So, Danny, thank you for joining. Tell us a little bit about yourself. It's It's a pleasure to be here, Michael, today with you and Eli, and I'm looking forward to this, webinar. I have been, practicing CPS cybersecurity for more than three decades. Most of my career was with the federal government, the Israeli Defense Forces. The peak of my career was the I was privileged to establish and be the first commander of the, federal military joint cyber, defense command. Post my, retirement, I established with my CTO and cofounder, Yair Othar Otorio, which, is a unique technology, which we're part of Armistead, and we're very proud of that. That enables, CPS environments to assess exposure and and, reduce risks that are associated with operations coming from the cyber, domain. And, we we can deliver that today as an on prem or cloud or hybrid depending on the customer's preference. So I'm very happy to be here today with you. Okay. Great. Well, thank you all for joining. I have a couple of questions here that, you know, are near and dear that we get asked on a regular basis, and it's great for us to be able to answer from a very antiseptic type of laboratory way of of of thinking about things. But I figured, that what we would do today, gentlemen, is really talk about what it's like in the trenches, what it's like in the field. So, Eli, I'd love to start with you if that's okay. We talk about cyber physical systems or what's called CPS in a lot of instances, and how you have this constant improvement. We realized that, you know, ten years ago, fifteen years ago, an attack on a cyber physical system like a, PLC was virtually unheard of. And today, it's becoming more and more popular. We can think back, easily fifteen years ago to, things like Stuxnet. Even more recent, there have been all kinds of attacks. Some of the watershed moments have been things, like, Colonial Pipeline. There's been a variety of JBS. We've been kind of, ticked them off on a regular basis. But in terms of, of being in the trenches today, we're seeing this on a regular basis. So, let's let's just suppose, you know, we're talking about an average, site, and, you know, now now it's become a board issue. Right? And there are all kinds of edicts and directives from the board. We have to improve CPS security. Let's say your task is saying, you know, next thirty days, you know, what's your plan? Where where do you start? Where where do you when when somebody, comes to you from the board or or from the c suite and says, we we just need to get this under control, what do you do the first thirty days? Where do you start? Yeah. So I think, first of all, it's important for context. Am I am I starting a new in a new role, or am I, in a in a role where I just haven't cared much about that yet? If I were starting in a new role, first thing I'd wanna understand is how that business is run, because, security exists, to enable the business. Right? And there's there's a lot of security folks that just come in and start thinking about all of the the frameworks or technical things that need to be done. So first and foremost, I want to understand how is the business running and, and what are what's what's the crown jewel, so to speak, of that specific, CPS area. And and once I understand that, the next big step would be visibility. So, visibility into assets is it's twenty twenty five. It's no longer a, it's no longer a nice to have. It's something that we have to have. So gaining visibility into what my assets are, what's communicating to what, All of those things is paramount. And and what you'll find is along that journey, you'll be able to identify, you know, you got thirty days, so that's not a lot of time. But but I believe that if you focus on those two things, you'll be able to find the areas that are the the easy ones to do to be able to say, hey. Let's let's do this. Let's do this. And then what things are gonna be a little bit harder that you're gonna need to road map and figure out what you can do thirty days. Because no business is gonna come to a security person and say, hey. We got thirty days. You can turn off our business to do this work. Great. So, ultimately, it's it's find out about the business, get visibility. And along the way, you're gonna find some some easy things that you can implement to help out and, reduce that exposure, increase that security posture. And then the things that are gonna be a little bit harder for the business to deal with, or technically to implement. You put in a you build out a roadmap to to accomplish. So so it is very important, and and thank you for for having for bringing up this question. I would say that, there are two main tasks or, that I would like to accomplish. One is changing the the game board from being as a CISO, from being just a cost center to to basically convince and and portray to the board that we have we're going to put a plan in place that are going is going to associate the operational and business, the revenue, of the company's risks to to the plan that we are building, and and it will be, mutually connected. And the second one is to, build visibility into a six months road map. So we need to understand what are the assets, if there is something in place or not, which are connected to and and probably we'll talk about that a little bit later. But, what is the operational context of the asset? Because in the CPS environment, not all assets are born equal. You have the same the same technology, the same PLC, the same HMI can can play in two different roles, carrying two different risks, two different exposures, and two different impacts. So so those type of things are are important, to understand. Have a as comprehensive as possible list of what are the existing security controls, even not assessing them, but just have them in place, and what are their resources, the teams, because, we need to understand that. If the time will allow, I would try and put a sixty ninety, one hundred twenty day high level plan with some milestones and deliverable. Yeah. That's really you know, it's a very key point that you raised at the outset, which is everything has to relate back to the business. Right? If, there are some things that are incredibly important and that are kind of critical path that we have to take care of before maybe something else that isn't as critical path. And I love the the the notion that you brought up about visibility. You know, more often than not, when we talk to an organization that has been breached in some sort of way or that, suffered some kind of security incident, oftentimes they say, you know, if I only knew. You know, if I only knew that this server was still up and running, or that this had access to the outside, or, you know, that this person who who still has access actually left the company three years ago. These are all really important things. You know, one of the things we talk a lot about is about real time visibility. I I can't tell you how many places where, you know, we talk about asset inventory, we talk about being able to see what's happening, is key, and what they, what a lot of organizations do is they pull out green bar paper with a inventory of what they have in their environment. Can you talk a little bit about what real time inventory, or asset inventory looks like, and how do you accomplish something like that? Yeah. So I think, I used to have a a t shirt from a security vendor that said, you know, see your world, kinda wish you didn't. And, you know, it is, very true that a lot of times with security, we get a lot of tools that tell you just kinda let you stink. Right? And, it becomes hard to just figure out what's the what's the next right thing to do. But it's absolutely essential to, have that bias towards visibility because, ignorance is no longer an excuse. I remember back in the day, folks would actively say, hey. If I see that, then I have to fix it. Right? Well, that's not that's not necessarily true because you have to prioritize your work. You have to understand what the bigger risks are, and those types of things, and nobody expects things to be done, in one day. So you have you have to understand what's in your environment to be able to fix it. I think when I think about visibility in a CPS environment, I'm thinking about understanding the in the the the the nuance between the infrastructure, the network, and, and identity. Right? So I I really think in those three areas, endpoint, network, identity, and, you know, endpoint being the full scope of the the software running on it, and the, and the actual hardware. What's its state? What's its configuration? Those types of things. When I'm thinking about network, I'm thinking about, what's exposed to the outside world, how does traffic flow in and out of the environment or environments, and then, what's the overall segmentation structure of the environment. And then when I'm thinking about identity, I'm thinking about everything from remote access to, how people are are authenticated and what access they have within the environment. When you when you add those three things in and you have the that that visibility, again, kind of back to the first point, it allows you to figure out what's the what's the next right move to do to secure your environment, and not all the times is the highest security value what you should do next. Sometimes there's a a low hanging fruit that's easier to do that can mitigate some of the the higher risks, within your environment as well. So, yeah. And and I think that Eli has touched most of the important parts of the inventory. I I would just add a couple of things. As I said in in my opening remarks, I would try and add attribute the operational role to the asset, to the inventory itself. And I would add also to the inventory, the all the IT, IoT, OT devices that are part of the entire process itself. So so this is this is highly important. And, I would try, and and I think that one of the most, challenging tasks in in caring, and building an ongoing updated inventory is scalability and simplicity of data acquisition. And, I would try and use as as much as possible smart ways, that will be both effective and efficient in in in acquiring the data and and building the very accurate, asset inventory. So, with armies, have have looked a couple of of these, technologies in place. One of them, of course, is the integrations. We have nearly 200 integrations into the ecosystem. This enables to to be very accurate and and and very quick and and, without the need to overload the the network. And and for areas that we need an additional keep additional focus, we have the safe active query in place that enables to extract specific information that is is relevant. So so I would I just to to emphasize, I would bring to the the inventory the operational wall context. And, I would try and do that not in a traditional, passive monitoring type of of way, just leveraging integrations and say effective query. Absolutely. You know, one of the things that I I use the term that I've heard in the military many times, which is the idea that it's great to know that, you know, it's an ABB server, it's a Rockwell server, and this is the model number. But you have to get what I call deep situational awareness. You actually have to understand things like code plugs and who has access and and version numbers and all this other good kind of stuff. And not not only that, but also the the attack likely attack paths. Right? If if something defeats a an asset or a device, where's where are the hackers likely to go next? So understanding the attack paths are really important. You know, we we talked about at the outset the idea of this being a board level thing now, where the c suite is concerned about things like cyber physical systems, things like exposure management in general. If you had to pick one metric, and I'm sure you measure many in your environment as we all do, what's one metric that you you think we just can't live without when we talk about cyber physical system security? Yeah. So I think if I had to pick one, and and I don't think there is one, I deal with a lot of different metrics every day. I think I think at its heart, cybersecurity is becoming a data analytics problem. And so, you know, metrics and and data is what I what I look at all day long. But I think if I had to pick one metric, it would be some sort of an exposure metric. I don't really have it off the top of my head, but it would probably be a metric around, what around the exposure of assets rate, around the environment. So what's is anything exposed outside of, outside of the environment, outside of its segment from a from a physical layer and network layer, and what are those and if not, then what are their overall exposure as far as vulnerabilities, things like that, and also identity? So I would have to come up with some sort of a formula to try to combine all that together around around exposure. But I but I think that, on having that kind of a metric of that shows that you understand what's in your environment and you understand its, its posture is is where I would wanna be. So it's really about finding the right metric for your environment that actually shows real risk reduction for all intents and purposes. Yeah. I think exposure is is where my head goes to that. I I don't I can't think of a a specific metric, but I would probably if if I had to come up with just one, then I would I would I would build something around, the exposure of assets. So I do agree with what Eli said that, there isn't one metric that tells the entire story, but, as we're trying now to to bridge, the gap between our professional roles and the board, which basically what interests them is revenues, I would I would try and and and start with one metrics that it is the operational risk or the business risk. Now we know that the business risk in in CPS organizations is derived from three pillars. It will be uptime or, operational resiliency or productivity. The second one will be liability. It could, be derived from safety matters or from downtime, or or, not downtime. Let's say that malfunction, products that you are delivering or or things like that. And and, of course, the the first two have a very strong influence on on brand. So so I would try to to be able and and build a risk metrics that will be, comprised from all the metrics that Eli touched, and and it will be one metrics to follow. It will show how effective we are and how efficient we are in maintaining, the the CPS environment up and running. Fair enough. You know, when I think about cyber physical systems, so much has changed over time. Right? It's become a target where it used to be something that was completely air gapped. Nobody thought about security. Matter of fact, many many of the older protocols go through plain text. It's not even encrypted. Right? So things have changed on a regular basis. Is there anything that we, perhaps, as an industry used to hold on to in terms of ways to reduce exposure, whether it's air gapping or something else that is just not so applicable anymore? I mean, is there some is there some kind of, sacred cow that we traditionally looked at that perhaps we need to rethink? I think that in the CPS area, CPS has been over time, has been a very infrastructure heavy area. And I think that a lot of what has been done in industry is around perimeter defense, and network layers. I I grew up in infrastructure, and I I have a soft spot for for traditional infrastructure, but it's just not enough anymore. And I think that, you know, how we think about perimeter defense is is really what needs to be rethought. I'm not a big fan of saying, you know, blah blah blah is the new perimeter. I think that's kind of easy. There's a lot to a good network perimeter that that has to be there. It's table stakes. Right? But it's not enough. Right? So in in 2025, you have to have a good network perimeter. You have to have good internal segmentation. But you but you can't use that as an excuse to not make sure that your systems aren't in a good state, that you don't have a baseline, for your systems. And that, you know, the the old thought of, well, if I have this thing properly segmented, then I just don't have to touch it, and and my manufacturing folks can do whatever they want. It doesn't exist anymore. And, there's also, a lot of in the CPS space, there's a lot of places where contractors have to access the system, things like that. So the identity becomes, another place where you have to treat it like it like another perimeter, that you're dealing with. So I think really where where my message would be would be that the traditional a lot of companies still think that they just, you know, stand up a a really good firewall on the border and and, everything that happens inside is is protected. Whereas, you know, the the defense in-depth, the zero trust mentality is really, it is really making a lot of grounds in this area, and it needs to continue. Perimeter security needs to continue, but, there there is no, from a security perspective, folks need to think through that there is no, hard to find perimeter anymore because there's a lot of things done purposefully and intentfully to, to bypass those perimeters. So, I think that you touched most of the sacred cows. I I would try and and and and add a couple more. One is that operational floors are very sensitive. Usually, it's all technology or technology that was not, developed with with cybersecurity embedded in them. And and so everything needs to be manual, or you can't scan, or you can't do anything proactive because it will damage the production floor. I think that today with leveraging the technology, advantages, and and, of course, we have that in in the ArmyCentrix platform for our customers. We can solve all of these, showstoppers, let's call it like that, that were in the past, with zero, impact to production and with maximum value to the customer. So I would say that if somebody would say, you can't do that because it will take down production, he needs to rethink. Today, we we have a couple of of ways to, walk around those challenges and and still provide very advanced, very focused, outcomes to to the customers. Let me give you one example, and maybe we'll talk, in details more late in details later in during the webinar. We have developed what we call the cyber digital twin. By the data acquisition for multiple layers, multiple planes like the operational plane, the network plane, the security controls plane, we are building a sandbox, virtual representation of the operational floor, and then we can scan this near real time, duplicate of of the floor. So each and every gap, misconfiguration, exposures, as we identify in the sandbox, virtual representation will be applicable also on the production floor, but with zero impact to production floor. So so there are many ways to overcome, the challenges that we faced over the last twenty years. We just need an open minded an open mind for that. Yeah. It's really a very important area that you bring up. You know, I actually have done some research into a lot of the attacks that have happened last, you know, five, seven years. And what I found is more than half of the attacks that have impacted an OT system actually start on the IT side. So, you know, whether you have, some kind of, a SharePoint system or you have, file sharing or other things like that, all that has to happen is that a hacker gets, a foothold somewhere, and then they move from IT to OT or vice versa. But that idea of of moving around that the, perimeter is certainly still there, but it can be somewhat amorphous at times and it could be dynamic, is something that that's that's really important we have to take into mind. You know, one of the things that we see, I think, that is, somewhat new is, you know, when we talk about hackers, we talk about nation states now. Right? If we were sitting here fifteen or twenty years ago, it would be, you know, the college or high school student in his parents' basement, you know, that was trying to get notoriety on the Internet and and broke into some environment and and and and played around with it. Today, it's much more about real cyber espionage, maybe cyber terrorism, other things like that. And what we're seeing is that attackers, whomever they are, they spend a lot of time in terms of doing specific reconnaissance before launching an attack. They can be a long time in an environment looking at things, poking around before they issue any kind of an attack. What do you think in terms of that? What what's the kind of the earliest metric, the earliest telltale sign that somebody that you've been compromised and somebody is getting ready to launch an attack? Is there anything we can look for in an environment that can point us in that direction that there may be something going on? Yeah. So that's a good question. I think the there's not any one thing in this area. You know, I'm a huge, I'm a huge MITRE attack and defend fan. I think I think, you know, it it really helps for us to establish our way of thinking. And I think that, initial access, beak is there's many different ways for initial access. And, you know, what we're finding what we're finding in, you know, across the industry, when you look at a lot of the, a lot of the big names, incidents that that have happened over the last couple years is that initial access has unfortunately been through unsophisticated means, like you're saying, through IT instead of OT. And, once that's done, it's a lot easier to because folks generally are more focused on perimeter security than than, all the other things on the inside. So I I really think that it's a defense in-depth, type thing to look at, And and it's around initial access, and and reconnaissance are really kinda where you have to be able to to see and understand. I think that behave behavioral type anomalies are becoming, are becoming more and more important. You know, there was a, there was a push a while ago for behavior analytics, and I think it, I think it fell off the hype cycle. I don't know what that you know, exactly what that is. But I think with the with the new way that systems are interconnected and the security, the the security, requirements to do more analytics on data and stuff like that and then the proliferation of, better machine learning and artificial intelligence. I think behavior analytics is gonna become more and more a key capability for for security folks and ultimately understanding, differences and behaviors of people systems and people infrastructure networks, is gonna be is gonna be more and more important. A lot of times, you'll see, a device that, you know, changes just a little bit, starts acting a little bit differently, you know, goes off baseline. Hey. This didn't, you know, this didn't get its patched. Those are those are little things that you that you'll see in the environment that you just treat like a a normal bump in the night. And, you know, that's why the the hygiene piece is so important because what you'll see at most companies is that, you know, the initial the initial find of a problem many times isn't a red alert we have an issue. It's a it's an engineer being like, that's a little odd. You know, what's what why why why did this thing just do that, or why did we have this behavior happen? And then they start investigating. They're like, okay. That's not supposed to be like that. It's not supposed to be like that. So how do you how do you take that watchful eye of an engineer that knows what the systems are supposed to be doing, and how do you replicate that at scale, with the data that you have and and newer technology? So, my answer is going to be it depends on who is the adversary. If you're against nation state actors, then then my answer will will will be of one one, fairly. Now because I do believe, and this is my personal belief, that 99% of our customers, of our audience today are not going to face nation state actors' attacks. So let's take the more what I used to call the cone flu type of, alley. And, so you usually, we will see those type of early landings or or, first signs of being compromised in the that are connecting the CPS environment to the IT or, the global web. It could be the supply chain. It could be a VPN. It could be, a jump server. It could be all all of these embarkation points to the CPS. And the second one is we will see, some user anomaly user behavior anomaly. And and and today, most organizations are not monitoring the user behavior. They are just monitoring the asset behavior. So so I I would start by by and, again, this is this is our our belief within armies. This is why we have developed the SRA as part of our delivery platform. I would start looking both on the, embarkation points and on the users that are trying to to go and and and manage or change or control something within the CPS environment. Awesome. So, you know, one of the things I mean, you remember this back from your from your network days. I certainly have been there. We remember, we used to always talk about the five nines. Right? Uptime, five nines. Maybe you can have, you know, forty three minutes of downtime a year to still maintain that SLA and everything else. When I think about cyber physical systems, you know, whether it is, you know, car manufacturing or electricity or operating whatever it is. Right? The these these OT environments demand uptime. Right? They can have that maybe they have one or two maintenance windows a year. So you can actually be running systems for a very long time where you know that there's a vulnerability that has to be patched, or perhaps tens or hundreds or thousands of vulnerabilities that need to be patched. How do you kind of balance that unnatural balance of ensuring that your systems are hardened, but maintaining the uptime that's necessary of a cyber physical system? Yeah. So that's a great question. I think first of all first of all, like, as security professionals, we deal with the CIA triad, and I think a lot of times we lose perspective. Availability is is is the king. And, our job is to protect our our company or, the entity that we serve. And, if we're taking it down, if we're not allowing them to do their business, then we're then we're not doing that job. Right? So, you know, I look at I look at it as a technical challenge to try to figure out how do we enable their business to roll at the pace that they want to, and there's a cost to that. So, if if you're in an environment where the line, you know, the line can never come down ever. It's twenty four seven. Then you have to build a high availability line. Right? So you have to build a line where you can where you can, where you have some redundancy, where you can take a system down while another system is is running in its place. Do what you need to do to maintenance it, and then put that back in line. Right? It's the same thing for for infrastructure. You know, you can have it if you can do daily maintenance, it can be relatively cheap. Right? But if you need something that if you need something that is always running, if you need something like the the space station, which is always always running and, you know, you can't take the the space station down because, you know, astronauts have to do things, or survive, then you have to figure out, you know, what what works operationally for that unit and what can what can come down without affecting the overall the overall plant. And one of those windows And if you can't figure out when it can come down, then you have to figure out, okay. How can how can we build a better system that enables that availability that they're looking for, but but allows us to secure it properly. So whether it's, whether it's a high availability system where you can take part of it down and and put it back in, or a, or a, system that is so well segmented, physically, via identity, via all those things? How do you segment it so much that the risk is you know, they are they are they are mitigating those risks? And when I say segment, I don't just mean network. I mean, across the different areas, which are important. So, ultimately, it's, that's why this is a a fun, role with with CPS is because I think, ultimately, it's it's dependent upon the business. And what makes the security leadership hard is that there's a lot of different ways to to do this that we have to try to make sure that we can accommodate the business with. So as as we usually say, patching is not an option in CPS environments, and and and and we must recognize that. And this is why, if you recall at the beginning of of the webinar, I was addressing, security controls. As part of the assessment or the ongoing assessment that, one should do, you should, assess the coverage of the security controls and the utilization. And let me give you an example. We had a customer, a large, automotive OEM that had nearly 700, industrial firewalls in front of important lines or assets in their largest production floor. But most of them were configured any to any. So, basically, you have very good coverage. You have zero utilization. So the risk is very high. And the way the way to overcome this downtime is stop or cease thinking about vulnerabilities. Try to deal with the exploitation. If you have an affordable asset, which you cannot patch now because it doesn't carry the patch, it doesn't have the patch, the you lose warranty. It's not a maintenance window. You need to have to be, ongoing on production, leverage your security controls to cut off the exploitability of this fallible asset in a way that, suits the the data flow that is required for production. So, we at Armis with our tech graph engines, today deliver that out of the box, which will enable the, the customer, the CISO, to assess how, effective our security controls. And in case that we see that there is an highly high risk, which is an impactful, asset that is highly exposed, and and and, as carries a a significant vulnerability, we will provide mitigation steps that are feasible, easy to implement, will not require downtime, and, they will leverage existing security controls on the site. Yeah. I I love the fact that you have mentioned now several times the business. Right? It's so important to remember that this is driving the business. It's not a science experiment. It's not an experiment in technology. It's always about the business. And that kind of leads me to my last question that I I'd love to get your opinion on from from the CISO seat. You know, one of the things that we've always thought about security is that it is a cost center. It's, friction laden. It doesn't necessarily drive the business. And now the conventional wisdom is really changing. As a consumer, whether it's b to b or b to c, security can really be turned on its head and say, this is an enabler. Right? This keeps us up and running. This is a good thing. Maybe as a as a bank customer, I will actually go to a bank that has better security, whether it's on the identity and access management side or whether it's on the system side or whatever else. How do you create as a as a CSO, how do you create a culture where a line of business managers really view, you know, CPS as an enabler and not as a blocker to your environment? Yeah. I think I I think of security maturity in kind of three three layers. I think of, like, you have compliance, you have security, and then you have resilience. Right? And I think, traditionally, there's a lot of folks in security that say compliance isn't security. Well well, sorry. You wouldn't have compliance if it didn't help to make you somewhat more secure. There always are some interesting compliance paper drills that don't do that. But but for the most part, compliance isn't meant to either make your make is is meant to make your company better in some regards. Right? So, you know, the the old school way of thinking about things was how do we how do we do our how do we run our business while being compliant? Right? And, ultimately, when you do that, you come up with ways to you you come up with barriers to entry, essentially. You come up with, you know, gates that have to be opened up for people to go through, and that doesn't feel good. That always sees security as kind of the gate guard, as the person with the gate, that you have to say mother, may I. Right? And nobody wants to Everybody wants to do great things for the most part. And, and and having somebody that you have to that you have to beg to do your job doesn't feel good. So then there's a layer of security, which is, which is focused on how do we how do we make the business secure. There's there's things that are you can be compliant and and not have that that for security sake makes you better. And and I think what what really pushes modern security teams into the direction of being a good partner is really focusing on resilience. Right? So most businesses want to be able to, survive a power outage. Right? Most businesses want to be able to continue selling when something breaks. Most businesses want to be able to continue manufacturing when something breaks. So I think focusing on the resilience aspect of your business and, really helps to build that relationship because business owners, compliance compliance feels like something you it feels like eating your vegetables. It's not something that, it's not something that everybody loves to do, but every but but folks in business understand it has to happen. When you focus on resilience, you're able to become that partner that helps them to keep their business running. Right? So I think, the focus on resilience bridges that gap of, hey. I'm not just a security person here to here to enforce security with my badge on. I'm the person here trying to help you keep your business running, and I understand the importance of your business, the layers of your business, and, what the priorities of your business are. So that that resilience mindset coupled with the fact that modern security tools are bridging the gap to where you don't have to be the gate guard. You can come as a security leader with options that make people's lives easier, give them the access they need, give them the tools they need, and makes it happen in a way that if you do it right, inherently is compliant with less with less friction. Right? You can't eliminate all friction. But if you give but if you focus on instead of being the gate guard and building gates, if you focus on building the highways that allow people to drive really fast through, And as long as they're on that highway, they are safe and secure. That's really where you want to be. Based on the one metric that is important, which is the risk. And and we know that today in our global, economy or competitive economy, atmosphere, organizations need to dig it out, to digitize, to innovate. Everybody is talking about AI and introducing AI in production, the co pilots. All of these are boosting, productivity or or building, competitiveness, and they are important to the vitality of the business. If we, as CISOs, can demonstrate that although we are introducing high risk technologies into production, we can maintain the level of risk to be, beneath what we call the risk appetite of the organization, and and to do that with a limited or a relatively limited resource allocation, I think that, we are going to bridge this, discrepancy of if you want to keep things safe, don't innovate. Wonderful. Well, with that, we are out of time today. Eli Edelkine, the CISO of Kava, thank you for joining us today. You can bet where I'm gonna have my next meal. But really appreciate all of your insights and and really appreciate you sharing them with the audience. I'd also like to thank Danny Bren, the former CISO of Artario, now, working over at Armis. Like to thank you gentlemen both for joining, and, like to thank our audience for joining. Hope to see you all on a future call. With that, thank you very much.