When Cyber Stops the Line, Safety Is on the Line

Shankar [00:00:00] cybersecurity and physical safety are all linked together.

Shankar Because people still think of them as independent buckets, but they are tied at the hip, and sometimes people don't grasp the very nuance that they are all tied together. Cybersecurity is patient safety. Cybersecurity is operational safety. Cybersecurity is plant safety.

Intro - Outro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Craig Hi, welcome. Today, I have with me the honored guest of Shankar, who is the CEO of Assimily. If you would, please introduce yourself. Give us a little background and, and kind of [00:01:00] what brought you to the OT side.

Shankar Yeah. So first of all, thanks so much, Craig, for having me here. Pleasure to be here. So just a couple of lines about Assimily first for everybody who, who's listening.

Shankar So Assimily, we are a proactive cyber asset and man- cyber asset management platform. We help with visibility of all the connected devices in the environment, provide exposure management to understand where the attacks are gonna come from and how do you prioritize it, threat detection and response to detect threats, and we have some forensic analysis modules.

Shankar And then the most important thing is we also help with mitigation, so our solution has capabilities around patching, and it has capabilities around segmentation and micro-segmentation. So those are the four pillars we do, and then we have some other modules around compliance, configuration control, and so on,as well.

Shankar In terms of my own journey and how Assimily started, I started Assimily around eight years ago, and I used to run the IoT business at Symantec, so I had been dealing with critical infrastructure, which includes manufacturing, cities, oil and gas, [00:02:00] healthcare for many years before that, and I had been spending time in this, in these verticals.

Shankar And so many of the problems that I looked at during that phase, we realized that you need a special purpose solution built from the grounds up to solve this because many of the solutions seem to be built for IT and then translated to these verticals. So we realized we needed something grounds up built for these OT, IoT, medical devices, industrial devices.

Shankar And so that's how I started on the jour-- That's how we started, I started Assimily, and then before that, that's how I got started on the journey because I found this entire space fascinating because of the nuances and differences in these devices.

Craig Oh, so that's a great path. and the fact that you've made your way from the IT side into the IoT, IoMT, and the OT space is unique.

Craig it gives you a good balance of kind of what's happening.

Shankar Absolutely. And look, I think because I spent so many years at Symantec doing this, I spent a lot of time working with [00:03:00] practitioners, working with people who are in the operations team, and that was my life for many years. And in fact, even today in Asimily, we have people who have come from a clinical background, come from an operations background.

Shankar So the company is a mixture of IT and OT people, and, that's kind of how this industry works. You have to merge the two worlds to make it work.

Craig Yeah, no, I would say 100% correct. We don't walk in and see just PLCs. There are HMIs, there are cameras, there are printers, there are a number of assets on that industrial side that make up that entire ecosystem, and it's good to have a balance of all of that to understand how they operate differently than on the IT side.

Craig So that's a plus.

Shankar Good question. Yeah, absolutely.

Craig Let's, let's kinda dive in a little bit. Help me understand a little bit on some of the projects that... So when we see clients that are trying to go down this road of, how do I [00:04:00] begin securing and protecting my industrial networks? When I'm looking to do remediation, I'm looking to do micro segmentation.

Craig They get started, they pick a tool, they test the tool, they buy the tool, they get everything ready to go, and then they're like paralysis by analysis, and they don't know how to, let's call it execute, for lack of a better term, and they just kinda stall out. Is that anything that you guys are seeing, or what are you seeing kinda to, that's the, where the industry is struggling maybe?

Shankar Great question, Craig. And in fact, this is a common problem in these, critical infrastructure verticals because people have heard, "Oh, there's a solution out there. Let me just go buy it. It's good." we see that people get into this analysis paralysis phase when they have started off with a solution in mind rather than a goal in mind.

Shankar Because you start to start with the goal in mind, you got to say, "What is it that I'm trying to [00:05:00] achieve? Am I just trying to get some visibility?" That is one set of tool and one set of process you implement. Am I trying to really mitigate? Am I just trying to understand my highest risk so I can meet an audit requirement?

Shankar Then that is a different side of direction you take. Or am I really trying to get visibility, get the vis- the risk strategy, but also reduce it? That is a very different kind of methodology and process you follow. When you start with a solution and not a goal, you're going to land on a solution, and then you're not going to realize where you have to head next because that was your goal, to buy the solution.

Shankar Whereas when you start with the goal saying, "I really want to reduce risks in my environment. I want to make us more secure," then you can work backwards, and those organizations are more successful because then you can ask the question, "Okay, I'm buying a solution. Who's going to implement it?

Shankar Who's going to operationalize it? Where-- What is the process I need to implement? Do I need to get a service on top of it? Do I actually need to train certain people? And then whom am I going to train over time, or am I going to get a managed service provider?" So I think the analysis paralysis occurs when you think of the solution as the goal in itself [00:06:00] rather than the goal, which is very different.

Shankar And if you start with the end objective in mind, saying, "I want to meet this audit. I have an, audit that's coming up in one year. I got to meet the audit because maybe I get my CNL certification. And to meet the certification, I need five items. I'm gonna get the solution. I'm gonna put this person who's gonna write a nice report."

Shankar Now I don't see-- Now we don't see the analysis paralysis because they had a goal in mind, they met the goal. Now, what happens after they meet the goal is another question, then they need to have a next set of plans, right? But at least if you have a goal, then everything is driven towards the goal. So when we talk to customers, we don't-- we, we say, "Okay, you want to buy a solution, but what are you trying to achieve?"

Shankar That is a very key question we ask vendors, and that is something, one of the reasons we have very high customer satisfaction because customers see that, and then they implement our solution, and they get value out of it. So the goal is important, and as long as the goal is there, I think everything else falls in place.

Shankar But when the customer says, "I don't know, I'm just buying a solution because my manager told me to," then you know you're gonna run [00:07:00] into a problem. 'Cause now where-- what is the person going to do next is unclear at this point in time.

Craig Yeah, I, I think that I would say you're right. And, and we try to take kind of the same approach.

Craig What is that agnostic pr- approach? So technology aside, what's the client trying to solve for? what are they, what is the end result that they're trying to achieve, that goal? And how can we pair partners, technology, people, process, and time to that equation, if you want to look at it from a basic foundational standpoint, to get to that goal?

Craig And it does, it removes a lot of those obstacles, I guess they would be.

Shankar 100%. Because when you think of it in goal, you'll realize that there are multiple elements that need, that are needed to get to the goal. You need the technology in place. You need to have a process. And you can have service partners who do the process for you, but you need to understand that it's going to be vital.

Shankar Or maybe you already have a [00:08:00] process in place, and that's fine. And then you maybe need to have some training, because there's a people element of it. And so if you don't have a goal, then you have a solution, and then you have nobody to use it, and then you don't know how to leverage it, and that's where the pa- paralysis and the projects get stalled.

Craig Industry standpoint, are there certain things that you guys are seeing where organizations are really struggling as a hurdle, where they're, they're not grasping certain concepts, whether that is remediation. we look at it, we walk into a lot of facilities that are very large flat networks. They don't have what I would call the CPWE Purdue model layering, and there is no segmentation.

Craig There is no firewall in place. There is no DMZ. That's one example. Another example is, where [00:09:00] maybe they have visibility. They're looking at only north-south traffic, and none of the east-west traffic is in their purview. Are there certain areas, aspects that you've looked across the verticals that organizations really could use some guidance or support with?

Shankar Yeah. So I see two big topics that customers really struggle with. I think some of the east-west that you said and north-south I think are absolutely true, but I call them a second level of detail that they s- struggle with. But even above that, I see a first level of, detail of, of concept that they struggle with.

Shankar One is what I call exposure. So when you look at a large organization, you have visibility. They all understand the concept of visibility. I need visibility of all assets. But then they say, "How am I reducing risk?" And they say, "Let's just take all my devices and break them up into enclaves and so on." Right?

Shankar But the problem is, where is your exposure the highest? You have all of these PLCs and HMIs and workstations, but where is an attacker most likely to take advantage? [00:10:00] Where is the vulnerabilities the most? You have all this legacy in your environment, which are the ones which are the most critical? That is the concept of exposure, and knowing the concept of exposure allows you to slice and dice the problem because if you try to eat the entire elephant at once, you're not going to get there.

Shankar So you got to slice it, and then they struggle with slicing. And because they don't get, get around the concept of exposure management and slicing, they then struggle with the project itself because they now have a goal, but they don't know how to make the small steps to get there. You're not going to make one jump to the goal.

Shankar So that's the first concept I see customers struggling with. So now they have the goal, they have the people, they have the technology But then the little steps, what are the little steps? What are the five steps to get there? They're not able to break it down because they don't really sometimes grasp the concept of exposure.

Shankar So that's number one. The second piece, is, the, the second piece is going to be around, segmentation itself. So when they start in segmentation, I think they don't clear, quite grasp the concept. So there's a lot of nuances here. Segmentation is a big topic. They don't grasp a lot of concepts around that.

Shankar They [00:11:00] don't get the concept of not solve, like you rightly said, Craig. They don't grasp the concept, for example, of identity-based, because a lot of them still think in terms of segmentation as static rules. I'm gonna take my PLCs and I'm gonna put them in this bucket. I'm gonna put them... But networks are connected and constantly evolving, so you need to do identity-based, which is constantly changing, and it keeps up your network on a continuous basis with the change.

Shankar You need to include device context in it. You need to include risk in it. And all of these worlds are tied together. Segmentation is not in a standalone, and then its visibility is not in a standalone. So I do think that the segmentation concept is at a high level understood, but it's not fully grasped in their heads.

Shankar Like, they think of it as a one and done, put a policy, and let's just do it in six months and never have to look back again. And it's a lot more nuanced and complex than that.

Craig it is. So where do you see AI playing into this? And the reason I ask is, it-- AI [00:12:00] is everywhere. AI is helping us protect against the bad guys.

Craig AI is helping the bad guys be quicker at defeating us. AI is everywhere, every corner you turn. It's helping become more efficient. It's helping become more autonomous. It's, it's the new buzzword. So how do you see that playing into the controls and IoT space as we are trying to help organizations better understand what they have and how to secure and protect it?

Shankar Yeah, it's a great question. I mean, AI is the big topic everywhere. recently somebody in Anthropic said, "You're gonna be-- The world will end in four years in AI." So AI is everywhere, right? so I would say, with AI, it's both an enabler and a disruptor. It's both a risk and an enabler or, like, it both, it both...

Shankar Because the thing with AI is all of these critical infrastructure verticals we are in, [00:13:00] whether it's manufacturing, healthcare, energy, AI can help you get a lot of efficiencies out. Like, you can figure out, like, when your equipment is failing. You can do a lot more with AI. You can figure out how much to route your supply chain through.

Shankar When you have all this material you're generating, how do you best make your, manufacturing plants more optimal? procurement can be more optical-- optimal. But with-- And so that's the beneficial ben- that's the benefit of AI, and same with healthcare. There's a whole bunch of benefits in healthcare and same with energy.

Shankar So AI is an enabler, but AI also introduces a ton of risk to them in two ways. One is the same AI that actually is doing all this work for you could, one, hallucinate. One, that is a problem. We have all heard, all heard about AI hallucination. The second thing, the AI itself could be attacked and go rogue.

Shankar So for example, imagine AI that's hallucinating, and it's going rogue, suddenly starts accessing other processes, gathering data from them, and sending the data to some third party which you don't even know it's doing, and it looks, it's looking like a trusted IP communication on your firewall, and

[00:14:00] it's just sending it out.

Shankar So AI is hallucinating, accessing resources it should not be, and it's doing things that nobody expect it to do. How do you really control that? so that's become... that is a problem. And then you also have AI-driven attacks, that actually people are using AI, and in fact, I just-- just an article two days ago in some journal, I forgot, but it said that people used to have an army of resources to launch a nation-driven state attack.

Shankar Now people are not to launch that kind of sophisticated attack, you don't need an army of people. You need one or two people with a series of agents. Each agent does one step in the exfiltration process, and you can launch an attack. So attacks are becoming easier to launch. And so in this world of AI where AI can both be an enabler, make your business efficient, make your processes efficient, the same AI can hallucinate and gather data from systems it should not be, or an attacker can use AI to attack it.

Shankar And so segmentation is a definite answer to a lot of these problems because it creates those enclaves in your network. But, you've got to-- for that reason, you've got to think about mitigation a [00:15:00] lot more carefully now than ever before because now you're introducing AI, which can do things which you never imagined before, and it can act at speeds which you never thought before.

Craig Which is crazy when you think about it. you look at the, the hockey stick of, of where technology is going today versus 20 years ago, 15 years ago, at... And it's just, it's- I wouldn't want to be raising children in today's society. Just gonna throw that out there. it is what it is, but it's scary.

Shankar Look, I am raising kids in today's society, and it is scary, I'll tell you that. So I completely agree.

Craig I, well, I give you kudos, my friend. So from a technology standpoint- I know that OT assets are different than IT or IoT assets. When we look at manufacturers that have a mix on their plant floor, do you see [00:16:00] gaps in the way that they're gathering data and treating IoT assets, meaning printers, cameras, stuff like that, versus a traditional true OT asset, a PLC, an HMI, an engineering workstation that may be 25 years old versus something that is two years old that is connected to that network that has a firmware but maybe not an operating system?

Shankar Yeah. Great question, and I think the answer on whether there's a gap, how first, how they gather data and the gaps in visibility does depend on the maturity of the organization as itself, organization. Because I have to start there because the more mature the organization, the more thoughtful they are in how they're doing it.

Shankar The less mature, the less thoughtful, right? It's expected. So I would say if you look at broadly, the way it should be done and the way, depending on where in the maturity curve they fall, they would follow some of it, all of it, is

[00:17:00] you ideally need a combination of processes and technology to really address the challenges and gaps in OT and IoT visibility.

Shankar So for example, most of your legacy OT devices, you cannot query them, you cannot ping them, you cannot scan them. If you do that, you're going to disrupt your operations. That is the last thing you want. But if you lay, take an IT workstation or server, then you can query them, and you can... And that information doesn't even need to be queried because the information is already present in a different system.

Shankar Maybe it's present in your active directory, maybe it's present in your DHCP server. So you can query that information out from other places without having to go deep in your network. And then there are these IoT devices, cameras, printers that you mentioned. Some of them fall in the mix. Some of the older cameras, you can still query them using a manufacturer-specific API, and then some, newer ones you can gather on the network.

Shankar So when you look at organizations, the more mature ones, they don't have a single vanilla approach to everything, and they won't say, "I'll just put span traffic to... I'll just send you all the traffic, you figure it out." They give you integrations with other [00:18:00] systems. They allow you to query certain kinds of systems.

Shankar And the more mature products, like one of the things we do is, depending on the nature of device we decide, the system automatically decides what is the most appropriate. Should I just gather traffic? Do I have a specific manufacturer API? Can I query this information from a different system? and larger, not larger, necessarily, more mature organizations understand it, so they give you a lot more integrations.

Shankar They ask you to work with other systems. They actually give you the span traffic. They expose their network to you, and the solution can intelligently decide. Whereas the less mature organizations will say- I'll just send you s- whatever traffic I can on the network, and then you figure it out. And then now you're like, "What are all, what about all these gaps?"

Shankar And they're like, "It's your problem." And, "No, it's not our problem." So then you become into this, in this loop. But, and the last thing I would say, there's this concept you mentioned about north-south and east-west. For readers who are not aware, north-south is traffic that traverses the network, east-west that stays within the LAN or within the network and drops.

Shankar The more mature organizations also realize that if you have to get that kind of traffic, you've got to get the flow data from the [00:19:00] switch, and they have a provision to do that. Whereas the less mature will say, "I don't know what flow is, and I'm not going to send it to you." So there is this east west, north-south which is both required from a visibility perspective, as well as segmentation and exposure.

Shankar And this is even more critical as the challenge in OT/IoT, where there are processes that terminate within a particular LAN because they never need to go out. So getting that east-west traffic visibility is required for, right from visibility exposure to segmentation, and more mature organizations also have ways to get that in the form of flow traffic to use a combination of SPAN, TAP, flow, integrations, and then active querying where appropriate.

Shankar And that's the real way to solve it, and that's what more mature organizations do versus, I would say, the less mature.

Craig So when you look at a, let's call it a more mature organization, do you see those in certain industries? Do you see them in certain size? Or how... W- what are you running into? 'Cause,we see [00:20:00] different, kind of across the board, I was talking to one of the organizations today, very mature, very well thought out, have a great plan in front of them that they're executing on now, a true traditional NIST framework defense in depth across multiple technologies. No silver bullet. There is... Because they recognize that's not gonna fix it.

Craig but again, it's a, it's a fairly large organization. It's a private company, not a public company, but it's not a Fortune 10 company either. So I wanted... I'm just curious as to what you're seeing. Are, are there certain gating factors that really kind of drive that from a, an organizational maturity?

Shankar It's a great question. And I would say is obviously it does, it varies. I mean, this problem is spent across, is spent across organizations across sizes, first of all. So just because you're a larger organization, as a general caveat, doesn't mean you're more mature. [00:21:00] Just because you're a smaller organization doesn't mean you're less mature.

Shankar We have seen small organizations who are very mature, and we have dealt with very large organizations whom we look at and say, "How is this even working right now, given the environment?" So we have seen both sides of the spectrum. Having said that, in general, the more well-funded the organization, the more resources they can hire.

Shankar And even if they're not mature, they're able to actually bring in resources faster when they actually are in a more better state financially, when they're in a better state financially. So their journey, whether they're mature or not, today is less material on how fast they can get there, and do they have the appetite to get there.

Shankar And I would say the better performing organizations financially are in generally a better state because either they have started the journey of analysis or they haven't, but they understand the problem. And even if they don't, they have hired somebody who's going to look into the problem, and then they have given them the flexibility to go get the resources, the technology, the processes, the people, whatever they need to get them there faster.

Shankar [00:22:00] And then working with such organizations, it's easier because even if they're on the journey, they are evolving so fast that you can actually get there very quickly. And so it's less of a problem. So I would say rather than the size, the financial. So if you're, we're a small organization doing well financially, we find they also have a lot of resources to invest for their size proportional.

Shankar So I would say more than the size, we have seen there is a correlation between financial performance and maturity in some ways because the more, well, like better off they are financially, the more they have the ability to invest in other areas like this because it protects their core business, and they understand the nuance, and they have the luxury of doing that because they understand how critical this could be.

Craig Yeah. I, I would, I would agree with that. so part of the, part of that, the, where I would say maybe not so much is sometimes when they've got enough money it hides mistakes, and they [00:23:00] don't often look at it where a, a scrappier company may say, "You know what? We can't afford not to do this.

Craig We need to make sure that we are leveraging everything that we need to do." So it's... I see both sides of that.

Shankar Yeah, 100%. And Craig, I think I should probably nuance a little more. I think on one axis there is financial performance. The other axis is the maturity of the management itself. Because you can have companies making a lot of money-

Craig Of the management, yes.

Craig Correct. Yep

Shankar Yes. You can have companies making a lot of money, and the management says, "Why should we spend it anywhere? Let's take it all and put it as profits, and show this amazing, and get this amazing stock price. Let's not spend it anywhere." So I think I should probably, rephrase and caveat this.

Shankar There, there is a second dimension of people. So you're absolutely right, and people could decide that I'm just gonna spend very little on this, or I, I'm gonna spend a lot, but I'm just gonna throw money and not think through this, and just be done with the problem. So I think the management understanding of cyber and processes is also very important.

Shankar And just [00:24:00] money in the hand of someone who doesn't know how to spend it could also mean throwing it without getting outcome. So I agree with you completely, right? There is a people and there's a thing, and it's a two by two axis, and you have to people, good maturity, good management with, with financially they have the maturity and they have the money, now you'll get more maturity.

Craig Yeah. it plays into culture as well. the, the organization has to truly believe what they're doing is for the right reasons, not just a check the box.

Shankar Yes. 100%. 100%.

Craig Good. let's shift gears just a, a little tad. we've seen some, over the last several months, consolidation within the market.

Craig We've seen, obviously, you've... You look back a couple years, or I guess a year at this point, you had Nozomi being bought up from Mitsubishi. You had, recently you had, Dragos and Accenture. Before that you had Harmos and, ServiceNow. So you look at those organizations being... which were

[00:25:00] traditional OT play, kind of, they're being brought into the IT fray, Look at Cisco, they bought Century. Or you look at Microsoft, they bought CyberX. You got... So now you have these large IT organizations seeing the value in protecting and securing the OT space.

Craig Do you think that helps the industry, or do you think it hinders the industry?

Shankar So first of all, I think the first good thing is that everybody recognizes that OT, IoMT, IoT, all of this is becoming more mainstream. So I would say that is a general good thing for the industry because, that actually helps the industry in some ways because it bring more awareness to the problem.

Shankar There are still a lot of organizations who haven't done anything. When more people talk about it, it's only better for everybody, So I think that way, you're really helping the industry. and then there are a lot of other things that are happening, right? [00:26:00] I think there's a lot more focus on the goal and the outcome when larger organizations come in.

Shankar There's a lot more convergence on IT/OT, which is actually important to make cybersecurity really operate because these devices interact with each other. And there's a lot more, like, focus around making sure that I'm getting the right solution for my environment. Where I think it would, it would hinder, and we have yet to see, we have to wait and see how this plays out, is if these organizations who bought them try to fold OT, IoT, and IoMT as just a small piece of the problem and IT is the major piece.

Shankar Because then what happens is there is, like, there are entire GDPs, there's a, there's a large percentage of a GDP depends on manufacturing, energy, healthcare. There's whole vertical cities. And if you deprioritize those devices and say, "Yeah, those are just, you can put it on the side and just focus on your IT, that's where the attack comes from," you have gone back two steps instead of going forward three.

Shankar And I think that is the potential risk 'cause the bigger organization has always thought about it in IT terms, and now they just [00:27:00] added it in as a marketing thing, but they're not really spending time, effort, and money on it, and this becomes, like, the little thing that runs on the side, and you lost the value that you created.

Shankar That could become a hindrance, but overall, right now, there's more awareness. People recognize it. It's becoming mainstream, so that's definitely positive. But that's the risk in the long term of what could happen.

Craig Yeah, that's, that's my fear, is that some of the organizations will lose their identity and be...

Craig and won't have the same value because now they're- If I were to walk down 10, 10 manufacturing facilities and I were to choose controls engineers, plant manager, process control, true OT people, and I were to ask them, "How has Accenture helped you this week or this month?" Nine out of 10 would say, "Who's Accenture?"

Craig They wouldn't recognize it. The same with ServiceNow. They wouldn't know what it [00:28:00] is. They... and I just, I hope that for the OT industry as a group, that we can somehow maintain those identities and those organizations truly promote that OT difference and bring that forward, and they capitalize on the momentum of bringing more awareness.

Craig I just, I just don't know. I- it's, I see... I see it both ways. I see the IT bringing the people to it, but I also see the OT losing identity when they get sucked into an IT organization.

Shankar 100%. And so I've seen that already happen with a couple of acquisitions that have happened, by the way, over the last few years.

Shankar But without like knowing the in- the internal culture and dynamics of each of these organizations who have been acquiring the last couple of years, I don't want to make a statement what they will or will not do, but there's always a risk, and that's the fear I [00:29:00] have and which is what you're rightly pointing out as well.

Shankar So I agree with you.

Craig Great conversation. If we were to look and try and choose one or two, pieces of advice for organizations that are kind of going down this path that where you think that you make it help them if they're... That you see other organizations struggle or where there are gaps that really need to be focused on.

Craig If you could give a couple pieces of advice to the listeners, what would you tell them? What, how would you guide them to be better?

Shankar Yeah, I would say first advice is, first thing at the highest level, cybersecurity and physical safety are all linked together. That's the first piece.

Shankar Because people still think of them as independent buckets, but they are tied at the hip, and sometimes people don't grasp the very nuance that they are all tied together. They are all... Cybersecurity is patient safety. Cybersecurity is operational safety. Cybersecurity is plant safety. So that's number one.

Shankar Number two is, I would [00:30:00] say, start with a goal in mind. Because most people start with a solution in mind. You got to start with a goal in mind. And then when you have a goal, then you, why, you ask why is that goal important, and you work towards the goal. That's number two. And the last thing I would say is a lot of focus has been, over the last many years, only around visibility.

Shankar "Oh, let me just get visibility, and then I'll be good." But you got to think of the point as two buckets, visibility and mitigation, because visibility without mitigation is not going to land you anywhere, and mitigation without visibility is dangerous because you're going to land in, in a very dangerous spot.

Shankar So you got to think in terms of both dimensions, visibility and mitigation. And if you have a goal, you understand they are critical for your operations, and you think in terms of the overarching fact that I need the visibility and mitigate, I think largely you will land fine, and you'll make a lot of progress.

Craig Makes a lot of sense. Makes a ton of sense. Shekhar, thank you so much. I think it's been very valuable to the listeners. Your knowledge is, is immense. And, I appreciate your time [00:31:00] today, your thoughtfulness and, and, and coming on the show. I appreciate it.

Shankar It was a great, great discussion.

Shankar I really enjoyed the back and forth discussion, Craig, so thank you for the insightful talk today.

Intro - Outro Thanks for tuning in to the Industrial Cybersecurity Insider. To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know.

Intro - Outro Thanks again for listening. See you next time.