Supply Chain Risk: Your Vendors Have Vendors You've Never Heard Of

Jawanza [00:00:00] do we want to also become a cybersecurity shop? And the answer's usually no, but you kind of have to be in this environment where this, th- these companies are targeted, right? They're the weak link in an economy and a supply chain where, hey, if you can shut down the place that makes all of the, the bolts or the place that makes, the industrial, machinery for oil and gas, then it's a big victory as an opponent.

Jawanza So yeah, there's no choice but to become more of a cybersecurity-focused company, even when it's not your bread and butter as a, an industrial company.

Intro - Outro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up, and let's get into this week's episode.[00:01:00]

Craig Hi, this is Craig Duckworth. And today with me I have the distinguished Jawanza Joseph, the CEO of Parakeet Risk. Welcome, Jawanza. Introduce yourself and give us a little background if you would, please.

Jawanza Yeah, thanks, Craig, for, for having me on. It's, it's a pleasure. And, yeah, I, I am the s- currently the CEO of Parakeet Risk.

Jawanza previous to this I worked at Adobe and Pluralsight, MasterCard, all in different roles, in, in engineering. And, I, I kinda spun out to, to start this company because I felt the, you know, industrial sector is kind of maybe the most underserved when it came to technology, and also that risk management is a space that is boring and not a space that everyone wants to, to go into, so it left the perfect gap for me.

Jawanza yeah, I've, I've been working in technology for about 15 years now, and yeah, I'm, I'm excited to, to tackle the, the problems that are, present in this industry

Craig welcome. [00:02:00] third-party risk is absolutely critical in today's environment. You look at the supply chain, you look at organizations, especially manufacturers like where we play, and, you know, we are a, a very large systems integrator.

Craig We've got AEC, we've got control systems integration, and we, just as our organization, we have many suppliers that provide stuff to us. I can... We are a supplier to many other organizations, and organizations have to figure out how they manage, how they identify, how they interact with that third-party risk.

Craig what's your thought, or what's some guidance on how they can begin looking at that, treating that and, and trying to mitigate that? I know that's a lot, but we gotta... You can't eat the elephant in one bite. You gotta start a chunk at a time.

Jawanza Yeah, certainly. well, I'll, I'll do my best. I think this is a, it's an evolving problem, and one that becomes more complex [00:03:00] in the environment that we're in today with artificial intelligence and, kind of the growing role of that software supply chain as we introduce more and more vendors.

Jawanza But the, the way to think about it, I think, is just the way you would approach any other problem. When you have a system of teams and companies that you work with, not all of them are equal. You know, some have more weight, some can produce, mu- produce much more liability for you. And so it starts with just an exercise of just cataloging and prioritizing.

Jawanza Okay, which ones of our vendors are the most dangerous? If they were to have a breach, how would that impact us? if they, if their suppliers were to have a breach, how would that impact us? And then going on a kind of a crusade to protect yourself from those risks. So whether that be a, "I need more attestation from this vendor that they do security practices and other practices that matter to me so that I can feel like I'm successfully mitigating this risk," and then all the way down to, "Do I have adequate insurance for, this problem?

Jawanza if [00:04:00] something were to go wrong, would I be covered? Would I be able to not suffer a, a tremendous fin- financial loss from this?" So there is kind of the, the technological step, which we can get to in a second, but really before any technology, it's just understanding who are your vendors. You know, as we work with customers every day, that question sometimes it doesn't have a simple answer.

Jawanza there's not great cataloging. maybe there's, you know, i- in the mind of the CEO or in the mind of the people on the field, they know who they are, but having a, a system, having it cataloged, having it organized, having it scored is really step one. And then step two and three, there's a lot more things that could be done.

Jawanza But that's it, that's where we start.

Craig Well, a- and I would say just looking at some of our practices and industry practices across the- industrial environments as a whole, it's not clear sometimes who those vendors are. You may contract with vendor A who is subbing to vendor B [00:05:00] and C, and you don't know are you getting vendor B's people, vendor C's people, or vendor A's people.

Craig You, and it's, and sometimes that's not always clear. I know that legal does their best to try and prevent those situations or try to identify those in MSAs and contracts, but it's not always clean sometimes when you have multiple layer upon layer in larger organizations or a, a very deep third-party supply chain, I want to call it.

Jawanza Yeah. I, I, I completely agree with that. And, yeah, I'm sure that you s- you see that in your work day to day, and it does present some immense challenges because if you're trying to be thorough, you can't really be thorough if there's just a lot of opaqueness, and you're trying to get to a place where there's more clarity.

Jawanza and I think that in this environment where there is such high risk, where we're seeing more and more breaches, where there are more, th- there's a kind of a regulatory density [00:06:00] around especially cybersecurity, with third parties, it's, it's reasonable to ask of your vendors and, and third parties for more.

Jawanza everyone is doing it. There's more pressure because the risk is higher, and so that does translate into more work for you, but it's work that's worth doing because of the danger that, that persists.

Craig it is, and we are seeing a lot of that driven by insurance regulations, by coverage. no longer is it Appropriate nor acceptable to simply check a box and say, "We have a firewall.

Craig Our OT environments are protected to qualify for cyber insurance." They're asking multi-page documentation about specific environments, the controls environment, the vendor environment that accesses your situation. it's very [00:07:00] complex at best.

Jawanza Certainly. And there is a lot of cost that comes to you as a company in order to furnish these types of data and to continuously monitor it.

Jawanza and there's not always a easy software solution off the, the shelf like there can be in a purely IT environment. you know, for our, our IT side of our software, you know, we're able to attest to a lot of things automatically because we just plug into our, our provider and it, it just attests to it. In an OT, IT mixed environment, it's gonna be a lot harder to, to do that.

Jawanza you can say you have the firewall, but can you furnish an, an access log? Can you furnish all the things that you need to do for your insurer to be happy? And the answer is may- maybe, but it's gonna take you having a culture and a cost structure that allows you to do that. But, you know, calculating backwards, is this worth it?

Jawanza we're, we're a company, we're trying to build cars, or we're trying to, build [00:08:00] a building. Like, do we want to also become a cybersecurity shop? And the answer's usually no, but you kind of have to be in this environment where this, th- these companies are targeted, right? They're, they're the weak link in a, an economy and a supply chain where, hey, if you can shut down the place that makes all of the, the bolts or the place that makes, the industrial, machinery for oil and gas, then it's a big victory as a, as an opponent.

Jawanza So yeah, there's no choice but to become more of a cybersecurity-focused company, even when it's not your bread and butter as a, an industrial company.

Craig Yeah. You know, the, the nefarious actors are becoming more and more resilient, in the way that they treat stuff. the advancement of, of AI is helping them become bad quicker.

Craig it's helping us identify faster and as well, so it's, it's a double-edged sword. But, you know, as you, you [00:09:00] look at it,it's not an industrial versus an IT solution. This is a we- everything needs to be looked at holistically across the enterprise, and that doesn't always happen. And a lot of time, the leadership is not always fully abreast of what the actual risk is.

Craig Would you agree?

Jawanza I, I would agree with that. and I would say also, that we have created an environment where the checkbox has been adequate for so long. did you give a questionnaire to your suppliers and did they attest to X, Y, and Z? And you have that on the record, so this is your, your defense.

Jawanza But it's not really good enough because as, as you described, as a, a kind of a CEO level or C-suite level, there just needs to be a real understanding of the risks that are present, are present and how [00:10:00] we are going to mitigate them or transfer them. And yeah, getting that full picture across the whole company, 'cause it's like you said, it's not just OT and IT, it's also access patterns.

Jawanza Who can get into the facility? You know, who can actually access the controls and the PLCs and the SCADAs? And how, and, and how much of a threat is that versus who can even get into our Microsoft Teams environment? it's, it's a, it's all open questions that's, that doesn't always transfer up to that C-suite level.

Craig and you know, we're seeing from some of the contractual obligations for tenant versus owner and what the tenant requires the owner to do to meet obligations. A, a, a real-life example is, you know, we work within the, the data center environment with multiple clients, that are varied from owner-operator to tenant to end user, and kind of across that entire gamut.

Craig And we're seeing [00:11:00] regulations being forced down from some of those providers in that mix where they are required contractually to be able to identify a new asset In their OT environment within five minutes. That's not days, it's not hours, it's five minutes. So again, having that understanding, so now it's a people process technology, so what technology you have that can do that, what reporting and capabilities you have that can notify that, and then logging to make sure that you satisfy that legal obligation from that third-party risk that is being forced down to you as part of those conditions.

Craig So it's becoming real, whether that is a insurance driven, that is a compliance [00:12:00] governance driven, don't know, but it's a, it's a reality.

Jawanza Y- yeah, I would say it, it's kind of all of the above, based on what, what we're seeing. There's contracts that are stipulating this. There is a very scattershot regulatory environment.

Jawanza I know there are some companies like Anthropic that are really begging for some kind of regulatory framework from the m- federal side, and then there are state regulations that are coming out that, that are being challenged as well. And then as an operator or owner, you have a tremendous amount of liability.

Jawanza You know, the, some of these projects are billions of dollars and, you know, they're running workloads for OpenAI or Anthropic, and you have to protect it. And so you may introduce these draconian, types of, policies to try to just do another layer of protection. And there's also the insurance side.

Jawanza for the last, you know, several years it's been, pretty quiet and a, a soft market in cyber because, you know, while there are headlines about these big [00:13:00] breaches, you know, for the kind of average, part of the distribution, it's pretty quiet. so it's actually a very, very productive and profitable line of insurance.

Jawanza But now it's changing kind of rapidly. So, you know, we have to think about, not only the amount of new vulnerabilities that could be introduced because of AI, but also,the new kind of attack vectors. So s- some of the things that we see as we monitor is not only is the number of, you know, vulnerabilities just skyrocketing because AI can find them quicker, there's also just no solutions to those either.

Jawanza So your liability is increasing at a pace that's unprecedented and, you know, there needs to be new ways of attacking it, which we, we don't have a- all in place quite yet.

Craig you know, and a, a, a perfect real life headline that, that just came out is OpenAI taught its- a logarithm to hack out of itself.

Craig And it, it- I'm like, how... So where does it all [00:14:00] stop? You know, at, at that point it's just crazy, you know, but the cost of figuring it out has to be in line with, the return. It can't be organizations spend $5 million to s- to protect 5,000. It, that, the math won't work. So, you know, as we go through that, it's important that, The justification be there

Jawanza Yeah, it's, it's challenging because especially in these, you know, industrial companies,the, kind of margins really vary company by company depending on what you're making.

Jawanza But historically it's seen as like a high capital expenditure and, you know, low margin kind of business that, that just does a lot of volume. And so thinking about, okay, let's add more,more ca- operational expense by doing more cybersecurity doesn't really sound that attractive,to the business because there's no returns on any of this, right?

Jawanza The returns are just all defense. And, but [00:15:00] it's... The, I think the national security implications and the overall implications of what a, a real breach would do to our ability to get oil and, and gas and other natural resources and, you know, water supply. And that's kind of on the side of just being able to produce our shirts and our hats and our, our basketballs.

Jawanza So we, yeah, we, we have to, to do something. But, how can we control the cost of doing it? Because, yeah, the, the margins that existed traditionally in, in IT and, software, you could keep throwing on more and more software vendors, but it just can't be the same, for, the, the company producing vehicles or whatever it might be.

Craig Yeah. I would agree. And, you know, you look at an after breach effect on an organization. You've got your reputation, you've got your brand, you've got your image. Those are all in the media. And then you've got your cost of not being able to produce something. you know, and those are [00:16:00] not often shared with that supply chain.

Craig Those are absorbed regardless of where in the supply chain the breach happened. You know, it could be that bolt manufacturer that's providing a bolt or a specific part for that car you make that caused this, but it's never that bolt company that's in the headlines. It's the car manufacturer. The reputational damages to that, the, the, let's call it parent.

Craig It's not really a parent-child organization, but it's, it's the, the one that's manufacturing the product, not all the supply that's coming in. so what would a, a well-run third-party risk program look like? What are some things that organizations need to have in place?

Jawanza Yeah. I would say, kinda maybe harking back a little bit to the earlier part of the conversation, having that vendor database that is up to date, and then [00:17:00] also that is weighing each vendor appropriately.

Jawanza That- I think that's the, the base step. We've gotta know who are we dealing with, what, how is what they're furnishing matter to us, whether that's a software pr- product, whether that's a, you know, part, what- whatever it might be. So that, that's, I think a hallmark of a good organization. You know, their, kind of vendor database or, or their supply chain, management system is up to date, and then there's someone that's, that's in charge of keeping that or, or a team of people that's in charge of keeping that.

Jawanza The next thing is on the cybersecurity side that we have a really good understanding of where those entry points are. so if we're dealing with, vendors that have access to our systems, either remotely or, can come in on person, badge in, that there is a real map that, that's living and u- and understanding of what, what exists today and where our, our kind of our biggest weaknesses are.

Jawanza so that, I think that artifact, I- ideally in the, the kind of the most [00:18:00] fancy orgs, that's a living artifact. You could pull up a, a kind of a digital representation. Okay, we can see who's accessing what where. and I would say that maybe the third one that's... And these are all for just, like, really resilient, good organizations.

Jawanza I'd say that the third one is that as a, an organization yourself, you have a real commitment and, maybe you can even furnish an artifact that shows this is our what we call a trust center. So, this is how we do security. the- these are the things that we attest to doing. this is how our network is secured.

Jawanza This is, you know, the- these are the vendors that we operate with. so being able to produce all of that, I think, is makes you a kind of the 1%. And then there's more things you can do on top of that, but these three are just the, the best place to start.

Craig Okay, and I would call those three probably table stakes, and more organizations that are walking the walk, not just checking a box and, and talking the talk.

Craig So again, it's one thing [00:19:00] to culturally do those things, and it's another thing to have a mouthpiece that says, "We do it," but underneath there are gaps and flaws within that process. Would you say?

Jawanza Yeah. Well, I, I would say, by, by doing that third thing where you attest to something, right? W- 'cause, you know, like the SOC 2 framework has some of this and, and it, it- it's, it's putting you in a position where it can be just, you know, just kind of a lip service and you can say, "We, we do this."

Jawanza But I think by k- by kind of putting your reputation out there and saying, "This is what we do," you have to address the things that are below. and, and I think that the best companies will do that, and the worst companies will just check the box and do the best, the best that they can to just get the certification.

Jawanza But by putting your name out there, I think it does put you in a position as an executive team and as a company to, "Hey, we really wanna attest to these values." it... That's what I've seen over and over again i- [00:20:00] is like, if you can... if you commit to that, it actually does have tho- those repercussions.

Jawanza But like you said, it does seem table stakes, but you'd be surprised what you find out there.

Craig Yeah. well, there's all, all, all organizations are in, are in different phases or stages of, of third-party risk. You know, you look at a small mom-and-pop organization that has two or three vendors, they may intimately know those vendors and they may know without having something documented what their cyber hygiene is, and they may feel comfortable.

Craig To large global multinational organizations that may have hundreds or thousands of providers that feed into that, let's call it a risk register, for lack of better term, and how that's managed and when those vendors fall off or new ones come on, or they change policies or they do something different, There's a... It's very complex. So [00:21:00] in, in the event that something does happen or something does go south- Who do you normally see is the, let's call it the responsible party that has to say, here's where we failed"? Is that something that, that you guys help guide, that you advise clients? Is that normally a CEO type?

Craig Is it a legal? Is it a communications? And, and really, where does that fall in line from any experience that you have that where you guys may have helped someone work through that?

Jawanza Y- yeah, certainly. So, pa- part of our product i- is dealing with, crisis m- management or, like, m- mitigating, when, when these types of events happen.

Jawanza And, part of our, our product also helps our, our customers plan this, like who, who's gonna be in charge of comms, who's gonna be in charge of, the kind of the liability and reaching out to insurance. And, then there's also a [00:22:00] element of doing, like, game days. "Okay, something's happening, like, let's just do this and, and go forward with it."

Craig So an incident response planning type event.

Jawanza Exactly. and so typ- typically, it's, this is gonna be outlined as more of a, insurable thing. So within a, a policy, you need to have some kind of, framework, right? So, who, who's gonna be communicating? Who's going to be, ultimately responsible in terms of the, the kind of, game day?

Jawanza Like, who's, who's, who's the, the point of contact? but in, in this case, it, it depends on the structure of the company. But typically, it will be the CEO that's gonna be the, the kind of mouthpiece and, and figure that, that is really guiding the public perception of it. But as far as, like, who will fall on the sword when it's all over, it's gonna be whoever is over, security, right?

Jawanza That, I've seen 9 out of 10 times that's what will happen, is that if it's a, if it's a security incident, you know, it will be, if there's a chief information security officer or chief information officer, however that company's [00:23:00] structured, th- they typically are gonna be the ones that fall on the sword.

Jawanza in, in some other event, you may see, like, a chief legal officer fall on the sword. But, yeah, that, that security officer, part of why they're compensated so highly, why they have such a big budget is because they will, inevitably fall on that sword when things go wrong.

Craig Yeah. I would say one of my favorite- Things to point out in an organization is when I look at a CISO or someone of that level that's responsible, that person often has responsibility for security of the enterprise.

Craig But when it comes to the industrial networks and the industrial layer, they don't have the authority to affect change. So they are not intentionally being set up to fail, but having, being in a position to [00:24:00] have responsibility without authority is a horrible spot to be in. And because of the divide between that IT and that OT layer

Craig They don't understand, and that's not always a good position to be in.

Jawanza Yeah, it's, it's really funny,to hear that, and also, true, because it's, it's one of the most perplexing things I find about this environment where,I think, IT is in some ways superior in terms of, like, the compensation and, you know, the, the perception.

Jawanza But then OT, for the, for these types of companies are... I mean, it's the most important part of the company, right? it, it's a, the way that things are, are built and, and the way that they're automated.

Craig The cash register. It makes the money.

Jawanza It's the cash register. and so yeah, it's a, it's a very, perplexing thing because like you said, the IoT or the IT, you know, CISO may- maybe never operated any of [00:25:00] these ty- this type of stuff, right?

Jawanza So they don't have, they shouldn't have the authority. But then as an organization, having both these two roles roll up to, like, a C level, it doesn't always make sense. So there needs to be some consideration of, like, how we can structure these organizations better. But this conversation's been going on for, decades now, so I don't know that there's any quick solutions.

Craig And I don't think there's a quick solution. I think that one, OT really needs to kind of grow up and own this. There needs to be a shared responsibility. and when we see organizations collaborate and work together, when the CISO says, "Hey, guys, we gotta fix this problem," and the plant manager or the operations team says, "I agree with you.

Craig Why don't you come down here to the plant, get yourself a pair of hard-toed shoes and a hard hat, and let's walk out here, and you understand the implications [00:26:00] of take that Windows 7 machine off the floor today. Okay, this production line's gonna go down. Is that okay? Because I don't have the authority to do that."

Craig You know? If, if you have a get out of jail free card from the CEO that says, "Take the plant down while we pull this Windows 7 machine off-" I'm all gonna do it. But if not, we're gonna make our product and this Windows 7 machine is gonna stay right where it is.

Jawanza Yeah. Yeah. I think that's a, a great illustration and example of, yeah, just what it looks like, right?

Jawanza where, from an IT perspective, yeah, we can, we can tolerate a lot of downtime, and we can actually put a, banner on our website and say, "Hey, we're gonna be offline for three hours," right? But, from a OT perspective, that, that's just not acceptable, right? we can, we can do planned downtime, we can do our, our thing, but we can't...

Jawanza it's just not the same level S- of SLAs, right? We've got a lot of agreements in this kind of web of agreements, and we... Hey, we [00:27:00] just can't go offline for a day so that we can replace this Windows 97 machine with a Windows 8 or whatever. yeah, it's a completely different environment, and I think there is a, there's a way that we can bridge this gap, but like you said, it's not, there's no quick fixes.

Jawanza It's, it's much more of a communication and a slow roll, and also the, the IT side just understanding the OT side a lot better and what it looks like from a kinda day-to-day management perspective.

Craig Yeah. But to get down into that layer, that's where I think we as an industry win. When the collaboration is there, the IT guys that have the responsibility come down to the plant, they spend some time on the plant floor, they understand the process, so they have a respect from the OT teams, which might grant them that authority to do what they need to do.

Craig But you're right, this is not [00:28:00] an overnight fix. It's been decades in the making. I think we're getting closer, but we're not there yet.

Jawanza I agree. I mean, you consider, the emergence of IT and, you know, how the salaries there have just skyrocketed, and OT, it's, it's not seen as a comparable alternative.

Jawanza It's just sort of seen as, oh, you're, you're the blue collar, programmer, right? Versus the, the white collar. yeah, there, there is some cultural divide that needs to be mended.

Craig Yep. So if you could give maybe- A couple steps that organizations could do today that are trying to figure this out. Where can they start?

Craig What's a couple pointers that would get 'em on the right path maybe?

Jawanza Yeah, that's a great question, and, sorry to, to beat the same, same drum again, but I think the most important thing is the cataloging. Like, you have to know who you're even interfacing with, which that is a [00:29:00] harder question to answer than it seems on the surface.

Jawanza You may know, hey, we get our parts from Bob Inc., but do you know anything about Bob Inc. and how they do security? You know, maybe all of their n- maybe their whole network is open. Maybe, you know, they have interns working there that, that should- shouldn't have privileged access but do. So you need to start and understand who are, who are the places that are the most threatening to me, and what are their practices?

Jawanza and then that, and that's something that should come at minimal cost. It doesn't require you to buy any software. It just is an exercise i- in doing that. I'd say the s- the second thing is, really getting a handle on your own posture. Like, what, what is it today that you do, if you do anything at all?

Jawanza do you secure your networks? do you have, a- an air-gapped solution? Who, who has access to the different, vendors of software that you, that you, you, you have, procurement and contracts with? and so I think these are... They sound very table stakes, but, you know, we work with giant organizations, and [00:30:00] some of this stuff's missing, right?

Jawanza It's, it's not fully cataloged. It's not fully understood. So I think that, as, as unsexy as that sounds, it's, I think, the place that makes the most sense to start, and that will expose a lot, right? It would be very clear, "Hey, we don't have any idea about this, and maybe we should invest in a tool that will help us to get this information quicker, catalog it faster.

Jawanza Maybe we should invest in a tool that already knows about the security posture of these companies, and we could fill our database in with that." So it gives you a, a base to then move forward from there.

Craig Yeah, no, and I, I absolutely wouldn't apologize for repeating it because I, like a lot of other people, need to hear it, like, five or six or seven times to fully comprehend it, and that was only the third time, so beat that drum.

Craig I, I don't mind at all. I think it's good. So from your experience, where do you see the space going? Do you see it continuing to evolve? And how do organizations that take that [00:31:00] advice, that are strengthening that third-party vendor profile, how do they position themselves within the ecosystem versus ones that don't take it as serious?

Jawanza Yeah, this is, I'm gonna get a little bit, sci-fi tin hat here, so I apologize a little bit. But I, I... The way I see this going into the future is that each company will have a, some kinda attestation, like a verifiable credential that says, "This is how we do things," right? That these, "This is how our OT environment is, this is how our IT environment is.

Jawanza This is a list of all of our, subprocessors or, or third- third parties that we deal with." And that we will kinda have these almost like trading cards that, that we can use and, and attest to each other. I think that's necessary and sufficient as well, but it's gonna be very, very hard to get here.

Jawanza But that's where I see the future in about five years,that's how we'll, we'll all transact. how to get there is, [00:32:00] is gonna be a combination of, like, really open standards that says, "This is how a... This is how this should even look." And then we need a, a system of getting to this data cheaper and faster, right?

Jawanza If, if it's gonna take us millions of dollars to catalog all of this, trade these cards, it's never gonna happen. we have to have a way that this is pretty much zero cost for some people in this ecosystem, and that the cost is borne by maybe the ones that can bear the cost the most. And so that- that's where, that- that's where we're trying to get to and, and what we're trying to contribute.

Jawanza But, you know, that- that's what I imagine.

Craig Okay. No, great insight, great conversation. this... we could talk about this for days. you know, the, the industry as a whole really needs to take a look at how they're managing it and understand what their true risk are from whether that's being driven by GRC, that's being driven by insurance requirements, [00:33:00] if that's just driven by the cultural values of the organization to do better.

Craig Really, it's a need. And thank you so much for your time and helping us understand it, guidance on it, and hopefully the listeners will learn something.

Jawanza Yeah, and, and thank you for having me. This was a, a real pleasure. And, yeah, I, I just love this industry, and I think whatever can be done to help protect the operators and help us to be more prosperous as a, a world.

Jawanza imagining a world where we can reduce a lot of these risks and these costs, and then we can have, cheaper housing, cheaper... I got a, I got a filling the other day. Cheaper filling, right? it's a world I wanna live in. I, I hope to be a small part of that.

Craig Yep. you're doing it.

Craig Keep up the great work. Thank you for your time. Great conversation. I appreciate it.

Jawanza thank you. Have a good one.

Intro - Outro Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. And if you found this podcast [00:34:00] helpful or have a topic you'd like us to discuss, please leave us a review or let us know.

Intro - Outro Thanks again for listening. See you next time.