Building the Case for Cybersecurity Funding

[00:00:00] Speaker 1: So the advice would be let's at least.

[00:00:02] John: Get you visibility of that attack surface. at least so you can understand what is there and what you have and what is the profile of risk on those devices that make up that attack surface. Let's just start there. I call it 1530 60 challenge, Because of the fact that it can be done so efficiently, I say, 15 minutes, I can get your visibility.

[00:00:25] John: in 30 minutes, we can already be, rotating and fixing default credentials, and by 60 minutes we could be patching firmware in some of the devices that you'd like to.

[00:01:07] Craig: Hello everybody and welcome to our next episode. I am craig duckworth the president of velta technology and today with me We have john becky from phosphorus john you want to introduce

[00:01:18] John: yourself? Absolutely, Craig. Thanks so much for having me. I'm John Vecchi. I'm the chief marketing officer here at Phosphorus Cybersecurity and I'm in Nashville where we are based this week.

[00:01:28] John: And I'm really excited. I've been trying to get on here with you for a long time. So I'm really excited to be here today.

[00:01:34] Craig: I am glad to have you. Nashville is a great city. I know that we adults are going to be there in a couple of weeks for the, partner summit. The 2nd, annual 1. we're, coming in right before Memorial weekend.

[00:01:46] Craig: You spent some time a couple of weeks ago with our team and the Indian gaming association out in Anaheim Before we get too far into it. I want to see what your thought was on that show what the interaction was Just from gaming side. I know that our two organizations we do iot stuff in Medical we do industrial we do gaming because the iot devices and you guys that's your focus But for us it kind of crosses all of them.

[00:02:16] Craig: So Two things. I want to get a little bit about the IOT devices as you and Phosphorus see them today. And then I want to talk a little bit about your interaction at the, at the gaming show in Anaheim.

[00:02:28] John: Yeah, no, it's a great question. It was really fun because obviously we talked to you about this market that the gaming side for a while.

[00:02:37] John: And as you know, we've seen recently, you know, we used to go months without a major cyber event on some of these big guys. Now it's like, you can't go a week and we know we've had a couple of big. Gaming, Vegas based gaming casinos being with ransomware attacks and things like that.

[00:02:54] John: So, it was great to get out there. I mean, obviously we focus on what we call X IOT. This is the extended internet of things, just for those of you who might not know that is and for today's discussion, that'll be relative just because it includes all these types of devices. Thank you.

[00:03:09] John: Enterprise Internet of Things. These are just think of these devices as in carpeted areas, you know, like cameras, printers, VoIP phones, networking equipment, right? HVAC controllers, smart lighting, building management systems, things like that. Right? And then you have the OT, which obviously we're going to.

[00:03:27] John: Touch on that today, the operational technology, the industrial control systems. Um, that's a whole major category as well. Then you have what we call IOT or industrial IOT. So now think all of the OT stuff, but with things like robotics, And manufacturing and the automobile industry and all these kinds of things.

[00:03:46] John: And then of course, last but not least is IOMT, which is the internet of medical things. So now we're touching on to medical devices, life, critical medical devices, infusion pumps, heart monitors, MRI machines, all those kinds. So we touch all of it, but obviously all of that stuff is across every vertical we just talked, I just talked about, right?

[00:04:08] John: but the gaming side is very, very interesting. I thought it was eye opening. look, we would have discussions and, we're not there with slot machines and providing gaming systems and things. We're there. to talk to these entities, and in this case, it was kind of the Indian gaming side about their attack surface about, specifically, as we say, do you have a handle on all these devices that are essentially running your operations?

[00:04:35] John: in a casino, you can't have an operating casino actually without cameras. So if your cameras go down, your casino goes down. That's just one case of something. and I thought that the discussions, they were really interesting. I think in many cases, look, they're not thinking about these things, right?

[00:04:52] John: Craig, as you know, you probably find that too, right? they're thinking about all the other, attack vectors and all those traditional end point things. But when you start talking about all these smart, intelligent devices that have IP addresses, and in many cases are like, you , Computers and Linux servers.

[00:05:08] John: they kind of tend to not think about those.

[00:05:10] Craig: Well, think about an IOT device. it's a smart device of anything from, like you said, thermostat to camera to So, for the audience, it's listening. most of them know what those devices are, but it's something with a firmware that does not have an operating system.

[00:05:27] Craig: Would that be a correct statement? So anything that has a computer chip in it, maybe think smart light bulb that you program to come on at 8 o'clock at night and go off at 6 o'clock in the morning, dusk to dawn type that has some sort of firmware in it. Would that be accurate? Would you say

[00:05:44] John: exactly accurate?

[00:05:45] John: So pretty simple. I say, look, these are smart devices. and they have characteristics that are common across all they have an IP, they speak TCP IP. and they run firmware. and because of those two things, they cannot have an endpoint agent. So they're not like, again, your traditional endpoints, your it and the workstations, laptops, all those kinds of things, servers.

[00:06:10] John: You know, like I say, you can't just throw tanium and crowdstrike on these things for the day.

[00:06:14] Craig: most organizations don't think that way. And if we circle back to the gaming show, it's important because as The industry has evolved. The machines are beginning to be smarter.

[00:06:27] Craig: The technology is there. mentioned cameras, every casino, the gaming jurisdictions that I've worked in, and I've been associated with the regulators require. Coverage for all the gaming devices to be able to see payouts to be able to see patrons the things that they're regulating You know, so cameras are is one piece and then you look at the machines themselves The machines have a thermal printer to print tickets.

[00:06:53] Craig: The machines have a Card reader to read the player database card that the players put in to identify themselves for points tracking stuff like that the machines have a Bill validator to validate and read the thermal tickets that you insert and the bills that go into it So every single machine on that gaming floor has three immediately identifiable IOT devices and organizations need to think, okay, so how do I protect that attack surface if they've got 500 machines?

[00:07:32] Craig: There's vulnerabilities just in that. not if you count the rest of the. Resort or the rest of the facility. If you look at the hotel, you've got, TVs and all the rooms. Some of them are smart. Some of them are not. You've got. Thermostats in the rooms. You have electronic doors in your hotels.

[00:07:55] Craig: You have elevators. You have all of these things that are running. we hear the almost comical. one of the casinos was attacked through a fish tank thermostat, but that's a reality no different than the target store that came in through the thermostat From a vendor that was doing some hvac work those devices that organizations Do not think about that are very proliferate throughout property.

[00:08:26] Craig: How do you, John at Phosphorus, how do you come into a property and help identify all of those devices? How do you come in and we go into a casino property, for example, what can we do to say, okay, let's run this. Tool this technology this phosphorus device and let's show you all Of these devices so at least they can understand what is there to begin?

[00:08:55] Craig: Trying to figure out how to solve that problem

[00:08:59] John: Yeah, totally makes sense. and usually when I think of this, I just kind of throw out the situation, what I call the state of this, right? So yeah, visibility, let's look at visibility. So how do we find, so the reality is 80%. So all of you watching this 80 percent of organizations everywhere will tell you they have limited to incomplete visibility of their organization.

[00:09:23] John: X. I. O. T. Estates and attack surface. So that's a massive visibility problem. They don't even know where they are, what they are. Big number. So there's a massive visibility. So that's one big, big problem. We don't even see them and know where they are. Then you just look at the state of let's say you do know where they are.

[00:09:41] John: 75 percent of these devices are running with default passwords and credentials. Okay. That's like the biggest, most Almost trivial is the biggest, simplest attack vector. There possibly isn't anything and 75 percent of these devices are running with default credentials, right? Average age of firmware is 7 plus years old.

[00:10:04] John: 68 percent of these devices have critical. And up CVSS. So about common vulnerability scores. Yeah, almost three quarters of them are having those types of critical vulnerabilities, ports and protocols of all kinds are wide open. and again, depending on the device, when we get into O.

[00:10:22] John: T. You know, there's not as many ports and protocols, but telling that, for example, will be wide open. If you get to a more sophisticated device. Everything's open because they come ready to just talk to everything. So you've got wifi, Bluetooth, SSH, HTTPS, HTTP, like FTP, everything's open. So that's a configuration problem.

[00:10:42] John: so this is the big issue here and it, goes across all of these entities, right? And if you just think of. Any one of them. So again, we talked about cameras. You mentioned printers, Greg, huge, huge thing. I don't really care what industry you're in, but let's look at gaming. Let's look at healthcare.

[00:10:57] John: Let's look at manufacturing. If printers go down in any stage of whatever it is that they're Providing a service or manufacturing things stop. absolutely do. Yes, stop. And, we refer to these as cyber physical systems specifically because a lot of these things are, controlling physics movement, something.

[00:11:18] John: And so, when 1 of them goes out, it can completely bring operations to a halt. It Can completely take someone offline. So the biggest thing we want to do when we approach an organization is to fix the very first thing, which is how do we get visibility of all the devices that you said? What, are they?

[00:11:35] John: How many do you have? What is the actual specific? we treat them like the animal kingdom, like a genus. And so we'll think of them like, okay, We're in kind of the genus wolf, And there are just multiple, multiple species of that. we approach it that way, So it'll just be, an HP printer.

[00:11:56] John: HP has tens of thousands of different types of printers. That's just one manufacturer making tens of thousands of different printers, right? So what we need to really find and identify all of them right down to their make model series. Everything and when we do that, then we all need to assess them for, as I mentioned, the risk posture that I said, are they running default credentials?

[00:12:17] John: What firmware version are they on? And how many others are there? And how many vulnerabilities do you have on that firmware? What ports and protocols are wide open? Is the certificate expired? all kinds of things like that. that's the kind of metadata we will pull out. So we want to provide full visibility with full risk assessment.

[00:12:35] John: something we had to literally rebuild from the ground up because, the passive tools will miss this. true. Because, kind of like just going to a cocktail party and trying to decide who everybody is from listening on conversations. It's not going to, you know, it's going to be tough.

[00:12:51] John: And so we actually communicate directly to that device in its native. Protocol and it's native language and we log into it once we know what it is, and we literally talk to it like it's management console. That's how we can decipher all of that information, which is critical before you figure out to fix it.

[00:13:08] John: Right?

[00:13:09] Craig: And then all that information is something that, we could provide back to the property, whether that be an industrial manufacturing facility, medical device. Medical facility, hospitals, they run a lot of critical, machinery, MRI machines, stuff like that. So, were thinking of gaming, so we would be able to go in, provide that data back to them, give them that full visibility, show them.

[00:13:33] Craig: would it make sense if we were to do that to go in and show them how easy it is to get into a device? Is that something that you guys typically would do because I've seen some of your team members go in and do a demo when they're showing the demo where they can go in, they can update firmware, they can update password is that something that is important for the properties to know how easy that is.

[00:14:01] John: It's critical. I mean, again, there's such fundamental hygiene issues. like I say, maybe you feel the same way, Craig, like living in this World of XIOT it for me and others. It's like we're living in 1994 because the state of these XIOT devices are similar to the state of laptops and other things in around 1994, when we were trying to figure out, um, what's the password and like, don't have all this stuff running, Oh, and make sure you update, your software and do all these basic, which today are just like.

[00:14:33] John: Trivial table stakes. But when you look at this stuff, we haven't even gotten there with these devices. So yes, we want to make sure we, we articulate and show and again, there are three to five of these devices for every employee in a typical organization, So just multiply it by three to five and that's how many devices.

[00:14:53] John: So if we show you, you have, you know, 10, 000 cameras, here's the exact thing. Types of cameras you have, and for these cameras, here's how many are running default credentials. Here's all the firmware versions are running, how many CVSs and vulnerabilities they have. here's all the ports and protocols that are open.

[00:15:11] John: Here's all the end of life devices. that's something you oftentimes want to know. Like you have no idea. These devices are no longer supported or in the case of like cameras, there are banned devices, So they could be like hike visions. Other types of cameras where the FCC, if you're in the United States, and sometimes even internationally, they, do abide by this where you don't want, you can't have that equipment really deployed and operational on your network, because it's considered a threat to our national security.

[00:15:40] John: So, we will tell you if you have banned devices. And so this will span all the different categories. And as you said, if you're in gaming, you've got cameras, you've got, the printers, you've got HVAC controllers, you've got all the building management systems, you've got OT stuff, going to have PLCs and operational technology and, all of these types of things.

[00:16:00] John: And we just want to try to bring that to the surface to say, look, you have a lot of devices, but first of all, if you have, you know, 5, 000, 10, 000 cameras. And they're all running default credentials. And they're basically just Linux servers that all I need to do is go on Google and ask, what is the default credentials for that camera?

[00:16:19] John: And I know it. And so boy. it's, to the internet, I can find it and if I just simply have to log into it with this default credentials, you don't even have to do a fancy ransomware attack anymore. To be honest with you, I can just log into all your cameras, change the passwords, lock you out of them and call you up and say, hello, I just, I own all your cameras.

[00:16:40] John: so yeah, uh, you need to, pay me or something, right? So, I think the future of some of this ex IoT is going to be some interesting things where you could literally have ransomware gangs going after this. It's the easiest ransomware attack you could ever have. You just go log in and change all the passwords.

[00:16:59] Craig: Yeah, when you look at manufacturing facilities, or you look at critical infrastructure that are using cameras in that situation. I talked with a client. It was earlier this week, and they were in there. They did an audit and they found that they had high vision camera. In their environment that when they had asked a vendor to remove them, he forgot 1, you know, luckily for them, this camera was offline.

[00:17:24] Craig: It was heathered to a monitor only. And there was not. Doing anything other than just still video of a particular process area, so it was not connected to anything at all, but it was still in their environment. And they fall under some very stringent requirements for the D. O. D. as they manufacture aerospace stuff.

[00:17:49] Craig: It was a scary realization for them, and they, did immediately remove that camera upon discovery, but they were not aware that it was still there.

[00:17:59] John: Yeah, and it's a simple thing, right? And this is a really painful issue across a lot of industries. I will tell you, even the Fed and the agencies themselves have.

[00:18:11] John: These kinds of cameras deployed and they oftentimes do not know where they are. they can't identify them. So what we want to do, we can do this. We will identify them and we can actually remove them from the network or make them inert. and that's a big, big thing to many. I mean, it's crazy, right?

[00:18:29] John: It's we haven't even started to talk about how we can rotate credentials and update firmware and shut off configurations and update certificates. We're just back at tell me where it is and take it off the network because it's not supposed to be there. And, again, when you look into the operational technology, the industrial side, you can move away from cameras and you can find an immense amount of O.

[00:18:52] John: T. Equipment. So, you hosts of industrial devices that are also Chinese manufactured. And in fact, manufacturer has to have access to those devices to support them. So part of the issue is some of these devices, remote access, the manufacturers have to access them for the warranty to be void, they need to come in.

[00:19:16] John: And so now you've got a situation where you've got all these devices and the manufacturers in China and they haven't a direct link straight in, To the OT side of it. So again, we talk about the convergence of IT OT, they have, collided head on, and, that collision has been going on, but you look at something like COVID that we talk about it, that just accelerated that to the end degree, and this is kind of the situation we have now.

[00:19:41] John: There really aren't any air gap networks anymore. You can use the word, but It doesn't really exist. Really?

[00:19:47] Craig: And we see that similarly on the gaming space. You know, you look at a gaming network, the true gaming floor is separated conceptually from the non gaming area, the guest area, because the nature of it, you got.

[00:20:03] Craig: Revenue that the state or the tribal commission is trying to protect and validate and make sure that it's there But some of the controls that they have, There was an issue with a casino probably a couple months back That because the commission was not able to validate they had some issues with the cameras They closed the casino for a couple days until they were able to rectify that situation So we know that just from part of the public disclosure of what MGM went through when they had their issue couple months back, theirs was to the tune of $110 million.

[00:20:41] Craig: Yeah. That was a giant number. publicly, companies are required to disclose that based on SCC rule. There's an issue now where MGM is counter suing the SEC trying to say, we don't wanna give you that information. I'm not sure where that'll end, but just the cost. Of downtime, if a casino is offline for 8 hours, 2 days, 3 days, that number is, can be astronomical because the casino, what they manufacture is fun.

[00:21:15] Craig: They manufacture entertainment and there's a cost of that. Coin in or the drop or the wind or however, you look at it from a casino industry is pure cash. that's where that number gets real big, real fast. So it's important for them to look at that. So if we were to try and think about how we could go into a property and.

[00:21:42] Craig: Identify these assets for them. what would make sense from trying to help them the most because I've worked there. I've been in the industry for a very long time. I understand what's taking place. What's happening. I gotta be honest with you. I think there's a fairly significant disconnect Nothing malicious or anything like that.

[00:22:05] Craig: I just don't believe that they have a good handle on all of the stuff That's there So, how could we show that value go in give them some things to do to really make sure that they are looking and under all the nooks and crannies and crevices to make sure that You Everybody's there, it's important.

[00:22:28] John: Yeah, well, and it's true. Like I said, it starts with visibility. The tricky thing, especially when we get into even gaming these environments where you've got a combination of traditional IOT type devices and then what we'd call. OT industrials, these are sensitive or maybe in a healthcare environment, life critical IOMT devices.

[00:22:50] John: They're sensitive, one of the things that has happened because of the current state of some of the tools that have been there for a long time is that those, a lot of the tools. that have really been built to find traditional it assets. So windows workstations and servers and traditional things.

[00:23:08] John: and when those tools have been used to try to go find these types of devices, it doesn't work well. So they're very sensitive. and, I call it waterboarding. That's essentially what these traditional things do. You know, they take the device, they throw it over and they just say, yeah, you know, can't scan tens of thousands of ports on an OT device or a sensitive industrial device or a medical device.

[00:23:32] John: And ask it, you know, try to find it that when they're really communicating essentially on one specific port and protocol primarily, and they don't speak that language. So, I say that because the whole discovery issue has been a difficult 1 because of the fact that's caused some issues and that's led some organizations certain issues to say, don't you the word, right? So it's bad. Yeah. Yeah, so we explain we have to show we call it intelligent active discovery. It's like intelligent polling. and we can show how we can do that very, very safely. We've never taken down a device yet. Knock on wood. and we are, using our technology to.

[00:24:08] John: actively intelligently find and discover things like infusion pumps, things like PLCs, things like, you know, a host of different types of devices, right? That are industrial, SCADA systems, you know, RTUs, environmental sensors, big gateways, like the kind that was Attacked actually in the, Fox, that attack that we just saw, the other week, so we can actually find these devices very safely. And so just by being able to go without hardware or agents, a lot of times, there's also difficulty with all the infrastructure stuff, you have to bring infrastructure in, you have to tap into their switching with spans and taps and it's gets heavy and complex.

[00:24:48] John: so if you can show how you can do that effectively and lightly with a software agent list based thing and come in and provide that visibility. Now, Craig, what we can do is give them that eye opening. So they're going to, like I said, 80 percent of these organizations don't have nearly complete visibility of the environment.

[00:25:06] John: Some have hardly any. so when you can actually show them that and they say, Whoa, what did you find? What are all those devices? I thought I had opening moment. Yeah. Right. And it's like, I thought I had only, you know, 6, 000 printers and you're telling me I have 25, 000. How did that happen?

[00:25:25] John: And well, this is what happens, right? So if we can show them that and then say, look, here's the brisk profile. Credentials. I mean, we'll just, and I, when I go out and talk, I actually show the hack. I show a camera hack. I show a robot hack, and I show how you can take advantage of these things.

[00:25:43] John: So we want to tell them, look, if, if you do have, you know, 25, 000 printers, and majority of them are running default passwords. let's start there. let's start there. We understand you might not want to go and start patching firmware yet, or whatever it might be. How about we go in eliminate that issue of default credentials, which if I'm an attacker, I'm going to start there.

[00:26:04] John: Like why would I do anything else? Yeah, true. Yeah. Or, you know, let's shut off Telenet, let's shut off all these, fix these configuration issues and then we can get the things like certificates and firmware and patching. but then of course we wanna be able to monitor those as well, because things happen, they change.

[00:26:22] John: So we focus a lot on the basics first and just try to help these issues, which, you know, I don't know if you saw, but just yesterday, All the agencies, you name every three letter agency we have, came up with another, fact sheet and what did they say?

[00:26:36] John: They said, here's the three recommendations to all of you with critical infrastructure, running industrial systems, three things, change your default passwords, shut off ports and protocols connected to the internet you don't need, and patch your firmware. it's that

[00:26:52] Craig: crawl walk run approach.

[00:26:54] Craig: This is a it's a methodology. This is a marathon. This is not a sprint. This takes time security. We hear this all the time from anybody. It's defense in depth. It's multiple approaches. This is one approach to address these devices, which are scattered throughout many, many organizations and many verticals, whether that be gaming, it'd be medical, it'd be industrial, across all of them.

[00:27:21] Craig: And a lot of times these devices are overlooked. what you guys are doing is, important to organizations. And so if we were to think, if there's one piece of advice. Request industries makes no difference whether we're talking to gaming operator that's trying to figure out where to start what to do, or if we're addressing or listening to a manufacturer that has.

[00:27:45] Craig: 5, 10 plants, and they're doing some, continuous monitoring, but it's not getting all their IOT devices and they're struggling with that. What's some advice that you would give someone listening today of where to start? What could they do to take that step to begin improving their posture on that journey?

[00:28:08] Craig: No matter where they are, they may be in the unaware phase. They may be. Fairly mature, but not all the way there yet. what's some advice you could give them?

[00:28:18] John: Well, look, I'd say, work with a partner, their partner, like Velta and us to say, look, the very least, let us come in and give you the visibility you don't have, This XIOT attack surface is 30 percent of their entire attack surface. And they don't know, they don't have a grasp. That it's that large. It's a, third. I mean, remember these XRG devices outnumber traditional endpoints by an order of magnitude, right? We're up to now 65 billion of these devices worldwide.

[00:28:50] John: Compare that to endpoint devices. There's about. Five to 6 billion endpoint devices on earth, about as many as people. And that number's decreasing flat to decreasing XIOT devices, 60 to 65 billion increasing about 18 percent every year. So it's about a third of the attack server. So the advice would be let's at least.

[00:29:11] John: Get you visibility of that attack surface. at least so you can understand what is there and what you have and what is the profile of risk on those devices that make up that attack surface. Let's just start there. I call it 1530 60 challenge, Because of the fact that it can be done so efficiently, I say, 15 minutes, I can get your visibility.

[00:29:33] John: in 30 minutes, we can already be, rotating and fixing default credentials, and by 60 minutes we could be patching firmware in some of the devices that you'd like to. That's a huge, that's,

[00:29:44] Craig: that's a great, great story. Absolutely. if we could go in and then within an hour Yeah.

[00:29:51] Craig: Have them some visibility. So at least Then that was kind of my, point. This is not a 30 day process. This is a, you can begin seeing things quickly so that you as an organization can determine what your next steps need to be and how you need to proceed forward. that's a great approach, Sean.

[00:30:11] John: Yeah, it's key, right? I mean, in many cases, Craig, that a lot of your viewers and watchers don't, may not know that there is technology there. Now it's a whole new generation of technology. Now we can actually go safely, find it, assess it, and then actually fix. There's never been anything to fix this, right.

[00:30:28] John: Can actually go fix these underlying, this hygiene, like credentials and firmware and configurations and all these things. And oftentimes it's. They don't know, or if they do have a reference of it, they're thinking, like you said, this is a, Oh my gosh, it's going to be 90 days. We're going to have to deploy all this infrastructure.

[00:30:45] John: We're going to have to do this. It's going to take a long time. And we just say, no, no, again, 15, 30, in one hour, we could literally be that far. so let's start there. You don't have to worry about, you have to do it. Do anything to fix it now, but let's at least get you the visibility. Let's get you the awareness of, that attack surface, what it's made up of and how at risk it is.

[00:31:09] John: And then we can just take a breath and say, okay, do I want to start fixing this stuff? And look at, if you do, we can be rotating credentials on those 20, 000 cameras. I mentioned right away. And, in short order, they're just. It's automated and done. You don't have to think about it. and we can actually rotate them on a regular schedule, just like you're doing on everything else.

[00:31:29] John: So, that's the kind of biggest advice I just give. And even when I go and talk and you do too, I say this all the time, like, let's please, let's get visibility of this attack surface. It's massive and it's growing and it's terribly vulnerable and all the attackers and nation States and threat actors, and.

[00:31:49] John: all the, ransomware gangs, they know it, trust me. They know it, uh, they, they are going to go after this stuff because they know maybe you're not even thinking about it.

[00:32:01] Craig: Yep. Nope. You're right. Well, I think that's all the time we've got. So Johnny has been a real pleasure having you on.

[00:32:07] Craig: work that you guys are doing there at Phosphorus is so important. You know, you mentioned it a couple of times, the number of X IOT devices every year is going up astronomical. That's the highest growth rate of devices across the industry. So that you guys can protect that and help us as the. partners go in and identify and provide that is is amazing work.

[00:32:29] Craig: I really appreciate your time It's always a great pleasure to talk to you So thank you very much

[00:32:35] John: You got it craig my pleasure and it's always a pleasure partnering with the great team over there at velta And we look forward to it and uh can't thank you enough for having me today. Yep. Thank you