Name: From Reactive to Resilient: Why Predictive VM is the Modern Cybersecurity Imperative
Uploaded: 2025-08-06T06:03:11.305Z
Duration: 45 min 8 s
Description: From Reactive to Resilient: Why Predictive VM is the Modern Cybersecurity Imperative

Transcript for "From Reactive to Resilient: Why Predictive VM is the Modern Cybersecurity Imperative": Welcome to today's webinar. I had the discussion with Carlos and Moh a few months ago, but I truly believe the content is more relevant than ever. With the recent announcement that Armis has been named the leader in the Forrester Way for unified vulnerability management, we wanted to revisit the importance of proper prioritization and remediation of all sorts of security findings. And this is applicable to any organization, whether it's health care, OT, or enterprise. Now to read the Forrester Wave report, please find the link in the docs tab of this webinar. And now we hope you enjoy this conversation, and you'll get a chance to learn why predictive vulnerability management is one of the most crucial security elements in your entire tech stack. Welcome, everyone, to this final episode of the Cyber Insights series. Today is a really cool topic. We'll be discussing why traditional vulnerability management is no longer sufficient and why predictive vulnerability management is, crucial to your security strategy. I'm not alone to do this today. I'm really, flattered to be joined by two rock stars at Armis. We have Carlos. We have Moh. Guys, welcome to the webinar. Thank you. Yeah. Thanks for having us. How are you doing today? Awesome. Very excited. Yeah. Hey. Just as a way of introduction, Carlos, maybe you can start. Can you introduce yourself to the audience as well? Yeah. I'm Carlos Granada. I'm the CTO for the Armis. I've been in Armis for six years now. It sounds it feels like a lifetime. My background is control systems engineering. I I actually worked in several, levels of a project from a OT perspective. And, in the last fifteen years, I've been focusing in cybersecurity, helping protect, OT environments. Oh, cool. And thanks for bringing your expertise on this webinar. What about you, Maxime? Yeah. Hey, everybody. I'm the CTO for health care, at Armis, and, been here for about five years. So a little bit shorter than Carlos, but still feels like a lifetime. And, prior to this, my expertise or area of expertise is, health care cybersecurity. So working directly for health care organizations for almost, ten years, building information security programs, living through a couple of ransomware attacks, couple of patient privacy breach investigation, and all that stuff. So, again, super happy to be here and excited for the discussion. Yeah. And this should be really cool because we'll have two, different visions, you from your medical, vertical experience and then OT. Kind of there there's similarities probably. There's a lot of differences as well that we can cover, so this should be an interesting conversation. As for myself, I've been with the company for a little over, over one and a half years, so it doesn't feel like a lifetime. But, I would I would rather say time flies when you're having fun, so looking forward to the to the next years. And so going back to the topic of today, as a way of introduction, what I often hear is that a lot of organizations, whether they're traditional enterprise IT organizations, whether they're in, a medical, industry or, in manufacturing or or in OT, everybody feels a bit overwhelmed. And overwhelmed is something we often hear, not just with vulnerabilities, so traditional CVEs, but it's more than just vulnerabilities. Is is this something that you guys are seeing in your respective verticals as well? Yes. That's correct. Across the OT, environments, you know, the the the the flat of, vulnerabilities, is producing some concerns, across, you know, you know, how, mature, OT environments are and and, you know, how what to do with it, sort of how to deal with that that influx of vulnerabilities that have been, you know, released lately. So there's there's influx parts. Can yeah. Can you confirm on your side, Moh? Yeah. I was just gonna add in there absolutely the same thing as Merit on the health care side of the house. And I think it's, an evolution on how folks are looking at the composition of their environment because it's not just the enterprise assets now. It's the it's the entire tax surface. And what this means is shining a light in areas that historically, maybe for twenty, thirty years, nobody's paid attention to. And there's a massive uptick all of a sudden to 10,000 more vulnerabilities that I'm responsible for that I had absolutely no idea about. So trying to figure out the balance of how do we get out from under this is is extremely overwhelming. Yeah. Probably, these are the comp the the biggest complexity is that, you know, is is who is accountable to actually resolve these issues? Because from from the OT perspective, you know, obviously, the CISO is ultimately the responsible across across the board in the in the organization when it comes to responsibility in the OT environment. So there is not a representation that can help the CISO to fix those problems because at the end of the day, the OT personnel is focused on production and safety. So security is not really part of of their role, and, and that makes it, like, more complicated because who do we, you know, assign to resolve these, these issues? Yeah. So there's there's a in time to Sorry. I didn't want to interrupt you. Moh, go ahead. I was gonna say an apology. It just struck another thought in me as well. Just on the flip side, when you have clinical engineers in in in in my example, they're not cybersecurity experts. Their main goal is in cybersecurity, but now it's increasingly becoming part of their role and expectation as to help with this. So taking a cybersecurity element of risk and then assigning it to another team that doesn't have that expertise and that's not their top priority from a, responsibility perspective or keeping the business up and running, there's a little bit of friction that gets created. And it's really part of the issue is also a a very process oriented one that industries are trying to figure out how to navigate to really achieve effective vulnerability management. Okay. So kind of, trying to summarize what what what you discussed here. There's a problem on the influx side just because of the volume. Like, there's a there's a number that is hard to to follow. And there's there are also other, more specific, I would say, potential issues in in those industries that are related to, roles and responsibilities. Like, clinical engineers, aren't maybe, clinical engineers aren't maybe in the perfect teams to to address vulnerabilities, whereas, Carlos, as you mentioned, sometimes it's just a lack of clear roles and responsibilities and who should be addressing those. So I would like to take this further in a a concept that is sometimes referred to as the impossible race. Like, the volume is overwhelming. The traditional methods that we have are no longer sufficient. Even with what we have in place, we're probably missing out on a lot of vulnerabilities because we have assets that are left unmonitored. Why is it that the traditional or existing methods cannot keep up with what is needed in, for example, the the medical industry, Moh? Yeah. So from my perspective, one is what we've just done is we turned on the lights, as I was mentioning to an area that hasn't been paid attention to. And medical devices are very specialized in nature. There's legacy applications, legacy operating systems, very specialized functionality that, aren't prone or aren't, supported to be updated and upgraded every patch Tuesday as an example that Microsoft might release or other application and other vulnerabilities that come out. So number one is, the number of vulnerabilities are either stagnant on specific medical devices, as is or they're just constantly increasing, but there's nothing you can do to actually remediate them directly. That's number one. I think, number two on the flip side of that is given just how fast and accessible different types of, tools are. Right? I'm gonna I'm gonna leverage the artificial intelligence, side of the house where it's it's much faster, for folks to discover different types of vulnerabilities. There's much more integration and reliance on solution stacks, on smarter devices being connected to the network that just this massive uptake in the number of devices, in the number of smart assets, in the application stacks that we're using has just resulted in an astronomical climb, not to mention taking into account architecture changes, the cloud, repositories. All these different layers and and aspects of the attack surface has just led to a a massive, monumental increase in vulnerabilities. Yes. And if I may ask on on the cloud side of things, you mentioned, like new, deployments, new infrastructures. Does that also change the type of, broader security findings? Because it's probably more than just CVEs. Right? It's more than just traditional vulnerabilities. Yeah. Absolutely. Love the fact that you brought that in because I think to your point, when we're talking about vulnerabilities, what are we ultimately trying to address? Risk. And risk manifests itself in a number of different ways, not only the technical CVEs that have been released, but you think of behavioral risk, configuration risk, things of that nature. And some of the things that are completely overlooked when it comes to cloud environments are something as simple as default admin passwords, or the fact that you have internal servers and things like that that are just external accessible to the Internet. Not technical vulnerabilities from a CVE perspective and defined in this vulnerability database, but insecure configurations that security teams would absolutely change in a heartbeat if you were to raise that up to them. Yeah. Do you see similar challenges, Carlos, in operational technology? So we we do see the same challenges, but we see in our team operations is, we see other challenges. From a from our operational perspective and equipment perspective, you know, sometimes we need to wait for the for the vendor who basically develops, the technology to release, a, you know, a a list of patches or, even operating systems that are gonna be supported by the technology itself. So we cannot be completely, you know, up to date, even even, you know, understand, you know, what the risk are. We we definitely will understand them. But we can't do anything because we need to wait for the vendor to tell us, hey. Now you can actually install these patches. Hang on a minute. Now we need to analyze what patches addresses, what risks of vulnerabilities, and then, implement those patches, which brings to the second problem, which is, you know, when do we implement those patches? Because if we are constantly operating and constantly producing, so we can't just implement the patches because that means that we have to have a shutdown. And shutdown means, you know, a stop of production, which means that, you know, the the the the the operation is gonna be unhappy. So so when do we implement dispatches? Typically, there is a a shutdown windows where we can leverage the installation of dispatches. But these shutdown windows are typically every six months, and it happens during two weeks. But the tasks that we implement during those two weeks needs to be managed. And, typically, we have a project manager that tell us, okay, so we can actually do all these tasks. Now this shutdown window is to do everything that is outstanding and from operational's perspective. I'm talking about electrical, mechanical, of course, security, and and so forth. So to for us to be able to add that one task of installing a patch or series of patches, then also bring us the question, okay, so which equipment are we gonna implement this? And then we need to correlate that information with the actual task in for from a project perspective. And if that, overlaps with one of the testings that they're gonna do with a specific piece of equipment that they're actually modifying, it's gonna bring another problem because it's like, well, we can't do those ones because that that equipment, even though it's shut down, cannot go offline because we needed to test something else. So it creates that very complex situation that, you know, remediation becomes almost impossible, so we have to bring other methods. And Mhmm. The new you know, this is actually part of of of what I'm excited about because now we can effectively understand and target those vulnerabilities, like Moh was actually saying before, that using AI and bringing that information of what is important, what is actually being attacked today, what is actually the talk of, the vulnerabilities that everyone is talking about, from an attacker perspective. So we can focus on those and then, you know, prioritize properly so that during that window of of opportunity that we have every six months, then we can, address all those patches. Only the patches that actually really, really important that makes the whole process more efficiently. Yeah. That's a really that's a key concept that you're highlighting there, and I think it's worth that we discuss it a bit because prioritization is, like the golden standard or what we should be achieving when we talk about modern vulnerability management or moving beyond traditional vulnerability management. However, as you pointed out, within this idea of prioritization, there's there's multiple, aspects. There's the aspect of business criticality. Right? Business criticality is one of the one of the, leading factors for me to determine which vulnerabilities to address first, And you explained that really well in in in OT environments because the the available windows are super limited. So I I have to make a choice, which ones to prioritize first. So that's one aspect is the the business criticality. But the other part of, potential part of prioritization is taking into account whether these vulnerabilities or other security findings are being exploited, whether, in similar environments, whether these vulnerabilities draw attention from threat actors. And this is where the power of, technologies like early warning that we do or AI driven technologies really can make a difference. I I think, you see this coming up as well, Moh for medical? Yeah. Absolutely. And I think the the issue here is that the traditional vulnerability management approach, namely CVSS scores, it's highlighted that if everything coming out is a CVSS score of nine or above, and every single vulnerability is critical, then how do we really identify what is critical? And I think when we're thinking about even the evolution of asset inventory, traditionally, it may have been a list of assets, a list of laptops, devices, things of that nature that security teams, information technology teams are responsible for securing and patching, and very quickly that asset inventory list has expanded. And what we're seeing in medical is what I like to call the evolution of the medical device profile is vendors are leveraging non specialized form factors. So an iPad, or a much more cheaper generic workstation, a Raspberry Pi, and they're using it in a clinical context whether by attaching peripheral adapters or scanning devices, etcetera. So now no longer is just simply an analysis of a MAC address that identifies this device as an iPad good enough. It's about understanding the operating profile of the device, how it's being used, but then also tying it back to the different vertical and industry lines of business. And what's the risk what's the core risk to your industry, and what's the risk appetite of your organization? And what I mean by that is really, at the crux of any health care organization, what's one of the top, if not the most important thing, is patient care delivery and patient safety. So for me to prioritize or look at CVSS scores of critical and focus on securing devices that might be in a, in an educational, seminar room or in a training room as opposed to assets that are directly touching patients. That is a big, big miss in terms of my efforts in reducing my true contextualized organizational risk and in the risk to my patients. So I think from a evolution of vulnerability management, it is really understanding what's the key elements, what's the key assets, and how is it that it's impacting, you know, Carlos, from your vertical, my my operational uptime, my efficiency to deliver x, y, and z for patients, the safety element or the availability of patient care services, and how am I reducing the risk across, again, not only vulnerabilities, but all the different security findings across all my different assets. This is actually a very important topic of, you know, you know, what resonated with me with me now is, like, how we we reduce that risk. Because sometimes we can't eliminate the risk. We need to mitigate it sometime, and then create exceptions. And, you know, with the new technologies, we can now understand the, the attack effect, the vectors of the devices, the behaviors of the devices, what the devices are talking to. So, yes, now we understand the vulnerabilities. We can prioritize the vulnerabilities using all the tools that we've mentioned before. But now what we can do is correlate all that information and understanding what the device behavior is and what the devices are talking to. Are they talking to external networks? Are they talking to internal network? Within the internal network, which devices are they talking to? And then we can start creating process processes to, you know, create a network segmentation, process to, to then limit how these devices communicate across the the environment and then understand, you know, which devices should be connecting to and then enforcing that connectivity. And this is something that we can do in OT, and we're actually doing in OT right now. They're looking at the vulnerabilities, products that are vulnerabilities, then analyzing the behaviors, and then create it creating, you know, network segmentation rules to ensure that these devices, you know, minimize the risks and and and the effects that these devices have across all the different devices in the network. Yeah. And I I think it's important that we also highlight, the true business outcomes or of such an approach. Meaning, I've seen instances where, prospects or customers would start with hundreds of thousands, may maybe even millions at some point, of of of security findings. And by applying such a technology and applying the business context and preemptive warnings and factoring in all of these all of the richness that that a solution like ours has to offer, the results are dramatic. Right? We go sometimes from hundreds of thousands where it's impossible to build a a plan to a few thousands where you can now start to address these vulnerabilities, start building a plan, or as you said, if you cannot patch them right away, look for alternative mitigation, strategy. So the reality is that just many like, we we started this conversations by saying that many many organizations feel overwhelmed. Well, it's by applying this logic, by factoring in all of this intelligence, you can get to a manageable amount of, security findings and vulnerabilities and start building a plan. That's essentially what you're saying. And from from a key perspective, you know, it's all about, you know, understanding the risks, but then the workflow. So how do we do and this is actually the the key part of, you know, integrating all this information, all these findings into our workflow to then, you know, create sections of how are we gonna, you know you know, address those issues. And and the new technologies allows us to not only to create, you know, rules across how to group them into small pieces so that we can actually address them, But also, and again and and and have all the the technology to to to really monitor the the maturity of the process itself, but also create campaigns to then address the the ones that are important, like I've mentioned before, and then associate that to an owner and then, you know, get that owner to to to focus on that. And that owner could well be the project manager that is actually working on the, on on that, shutdown window from from an OT perspective. So that's all important because you have the tools to, you know, efficiently create a workflow to minimize the findings that you're talking about. And when you say efficiently managing that workflow, I think it's important that we highlight the following. Many people, when they hear workflow or remediation workflow, they think about these ticketing workflows. Right? In many cases, larger organizations, it's really hard to find the owner of a specific asset. And then you can throw, as much tickets as you want over the fence. That's not the way it will will lead to to a positive result. Right? So how can technologies like armies help in in this process in in making sure that we do, better than what traditionally vulnerability management has been doing. Is this something you can address, Moh? Yeah. So if I look at the the the process and where I think Armis is really, really helping break down the silos is let's start from the basics. Right? And that is very simply which teams and, individuals are responsible, for the different assets. And somebody who owns an asset is not necessarily responsible for the remediation. Somebody who owns the remediation is not necessarily responsible for the asset. And I think as we approach this new gen, an arena of vulnerability management, it's extremely important when there's so many different teams involved and so many different leaderships that have, you know, metrics to report on and SLAs and efficiencies and things of that nature. It is very important to understand what the roles and responsibilities are. And a lot of times, if it's, you know, a traditional approach of even if you've identified all the unmanaged assets, all the billing managed systems, the medical devices, cloud assets, etcetera. First of all, who owns these devices? Who can I follow-up with when it comes to responsibility of vulnerability and mitigation and and, you know, risk reduction? Because a security team, to your point, that might email out an Excel sheet to a broad server team and nobody's really taking ownership and running with it. And then two weeks later or a month later, hey, what's the update on this? And it's crickets because nobody's picked up and run with it. That is a glaring gap, and that's one of the reasons why vulnerability management efforts and mitigation efforts stall. So I think, what I love about the approach that Armis is taking is we're really breaking down the silos in terms of who owns the assets in a medical device. But even at a granular level, if it's an imaging modality, it's diagnostic imaging team that's responsible. If it's a infusion pump, it's the clinical engineering team that's responsible. If it is a lab equipment, the lab department is responsible or the the the maintenance, members of that. And as we create the different, campaign as Carlos was mentioning, The key here is making sure that workflows aren't becoming overly complex and difficult to adopt as part of any of this. So a clinical engineer, an HTM health care technology management, individual, if we're trying to get them to use a completely new platform, a completely technical platform, again, that's not part of their purview, that is a very difficult learning curve. As simple as it may sound to us, it is a very difficult learning curve that just presents itself as a number of different ways as obstacles. So for us, on the flip side, if you need the assistance, which it is, all of these individuals are now extensions of cybersecurity teams. If I need their help, the most efficient way is for me to integrate myself into their workflow and remove and break any silos or barriers that it takes for them to be able to accomplish their task. And that's where that workflow of taking a security finding, having a clear, concise owner on who's gonna be responsible for mitigating this, having the clear details and steps outlined for the exact items and actions to take, and then pushing it into a ticket that the clinical engineer comes in. There were they as part of their routine, as part of their process, Monday morning, the first thing I'm doing is looking at my list of tasks for the day. And once I start going through it, that's how I'm gonna make the different, that's how I'm gonna make progress essentially. So I think that's a very overlooked element that the vulnerability, management area just assumed that others are gonna conform to the cybersecurity approach of mitigating vulnerabilities. And it's become very abundantly clear given how the lack of progress over the past year, two years that people have visibility into OT and medical devices, very abundantly clear that collaboration, that process management, that even just, simplifying remediation information is a key to making progress here. From a from an IT perspective, you know, I I still have to say that the the the process is actually difficult. And and the main reason why it's difficult is OT environments are are well known for for having a lot of legacy equipment. Okay? So, you know, I've been in projects where, you know, the the the contract stipulates to Aveda that the equipment that they are selling to us must be supported for at least thirty years. And you when you think about that in a in a in a technology point of view, thirty years is a it's a long time. So and and we right now, we are suffering the the the the challenge of of understanding the the the these legacy systems that actually across every single, OT environment that we have come across with. And then that give us two issues. Number one is a know how. Okay? So what how how do we protect these devices? Number two, what these devices are? What do they do? And then more importantly, who do we belong to? Okay? So it it is a challenge where, you know, get to know this type of equipment and associate this like Moh was actually mentioning before, associate this clearly to an owner can become quite different difficult. So I go back one step more from a more perspective. What what Moh was actually saying is, you know, from the very basic is, you know, understand simply understand what is in the environment, in the OT environments, from not not from a, from a from a device perspective, but but but also from a behavioral perspective. You know, what do we have? Is that is that a workstation? Is that a server? Is it POC? Is it something else? And when I say something else, it it it becomes more clear that IT and OT convergent have been happening very slowly from a long time because there is a lot of equipment that has been added to the OT network to help production. And we're talking about, for instance, cameras, voice phones, the displays. It's a lot of equipment that, you know, has a reason within operations to be there. And and but, you know, they belong to IT to the IT people. So then when you start looking at the visibility across all these different different devices, then we have been working with customers to understand, you know, who these, devices need to be managed by. Okay? And this is actually become quite complex, because it's not just discover the devices, define the devices, but also allocate the devices to the specific owners. And, you know, when you get to that once once you get to that point, then you start looking at the risks, the vulnerabilities. Okay? And then the findings across the behaviors. But now, because we have been doing that from the very beginning, you know, from from an analyst perspective, so now we have we clearly know who this device belong to, where this what are these findings, and how we can actually incorporate, define this into the workflows specifically. Now one thing that we need to take into account from an OT perspective, operational to type perspective, is what's one saying that we we we have in OT. It's like, too many alerts give the same effects of no alerts at all at all. When you have too many alerts, you know, it's too overwhelming. And, you know, the the the the operator doesn't know what to do with it. So you have to always have a a a rationalization of alerts to make sure that when you create alerts, when you have findings, you have the findings that you can do something about. Okay? Do not create findings that actually you know, there is no solution for it so that you can actually create that process. And, you know, WiFi help us, you know, to create that process because we can create rules, you know, to address the specific findings and group the findings across the different, you know, actions that you can apply and how critical does those actions are and who these, findings need to be associated to. And I just give you an example, when you when it comes to end of life end of support, if the equipment is running, you know, that's not a concern because the equipment equipment is running. What is the what the concern is is what to do, you know, if the equipment fails and who needs to know about that. So then you can actually start creating rules around, you know, the very critical findings and how you remediate or some of the findings that you can't really remediate and then you need to mitigate. And then those findings that you can actually create an exception, but then, you know, delay the the reaction when, when when, you know, in six months' time. For instance, this end of liability and support that is gonna, you know, reach that that status in six months. Okay. Well, let's just not focus about those. Just move those from 16. Let's just address those within six months' time, and then let's just focus on those rules that are actually really important right now. So and that's actually something that we need to take into account of how to, you know, spread the actions to something that is actually meaningful today, but not too many so that people can actually feel comfortable in addressing those issues, when when when they need to address them. Yeah. I think what you're highlighting is another factor of another or another way to prioritize. It's kind of a remediation driven prioritization. Right? One of the factors that I would consider when prior to when prioritizing is not just the business context that we have already discussed. It's not just the early warnings that we potentially, saw, but it's also the fact, like, does the remediation exist, or will I need to mitigate? Will this need to wait, etcetera? So this is, for me, another factor in the flow of prioritization, if you will. Right. And I I think if we if we want to wrap things up, I'm gonna give a bit of a summary of what we discussed, and then I'll leave you you guys with your final comments here, is that, we started off with Teams filmed overwhelmed across verticals, across industries, across all sorts of, vulnerabilities and security findings. So the volume is high. Regardless of their industry you're in, it's a struggle. It's a it's a battle that you cannot win. So we need technology to help us. We need technology to take these, this unmanageable amounts to a manageable list, of security findings and vulnerabilities where we can start build our plan. And in order to do so, like I just mentioned, we need to factor in business context the fact that these, vulnerabilities have have been exploited in a while or not, through early warnings. Carlos, you brought up a really good point. It's the fact that there's a remediation, exist for this type of vulnerability, or will it need to wait? Will we need to go creative with other mitigation? All of this will need to be factored in. Once we have that manageable list, we then can also use technologies like Armis to think about who is the owner of that asset. It will help us, in some sort of a predictive way, if you will, to say, we believe or the system believes that this team and this person should be responsible for the remediation because we know that we if we don't cover the last piece of the puzzle, it will fail. Right? You can do all the work that that that you can do in prioritization. If you don't have an efficient remediation workflow with clear ownership assignments, there's no way you're gonna have success. And, ultimately, technology like ours and others helps you to, to monitor of this, to track progress, to see how tools and teams are performing. So kind of closing the loop here with with what we discussed. Maybe you we you could leave we could leave the audience today with a thought that is that is more specific to your industries. What would you say as as SME, as expert, as CTO, for example, Moh, for you in medical? This is just the new year. Yeah. 2025 is still the time to do predictions. What is the trend that you see in your industry that you think is is here to stay that is worth sharing with the audience today? Yeah. Simple as it sounds. I think it's look at the entirety of your attack surface. Some of the largest attacks that we continue to see on a regular basis isn't a, extremely complex exploit. It is related to fundamental cybersecurity controls that are missing. It is related to misconfigurations. So with that, focus on strictly vulnerabilities and CVEs, there are massive gaps in the attack surface and security posture of organizations that have led to month long downtimes that ultimately impact patient care. So the the the lens to look at this from is what are my most critical patient services? What are they reliant upon? What are the potential attack vectors that can get to them? And start making sure whether it's managed devices or unmanaged devices, how are you mitigating misconfigurations and overarching security findings beyond simply vulnerabilities. Yeah. So even if you're in health care, don't just look at medical devices. Consider the full scope. That's what you're saying. Yeah. Thanks, Moh. What about you, Carlos? For me, it's it's also simple. Right? So, you know, do something about it. Okay? I know it's it can actually be difficult, and and overwhelming with everything that's happening today. But the first step is always very important. So don't get overwhelmed into your journey, but get started, you know, one step at a time. And, you know you know, as soon as you start the process and and and you start understanding how the process moves and how what is this the the the maturity level that you wanna reach, you know, set small goals, but then start looking at, you know, planning of how how to do it. You know, we're here to help, from through that process, and and we actually can give you advice, and and and how to actually get to what you need to get. I appreciate it. So thanks again, guys. This concludes our cyber insight series. It's been a pleasure to having you on on on this one. As an audience, if you want to know more about the Armis solutions, make sure to visit army.com. And with that, I'm gonna wish you a good rest of the day. Thank you, everyone.