We often frame cybersecurity as an endless reactive process. We’ve heard the term cat and mouse game between attackers and defenders. It’s a viscious cycle. Is there any way to end it?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and Steve Zalewski. Joining us is our sponsored guest, Rob Allen, chief product officer, ThreatLocker.
Join the conversation on LinkedIn
Huge thanks to our sponsor, ThreatLocker
Full transcript
Intro
0:00.000
[David Spark] We often frame cyber security as an endless reactive process. We’ve heard the term cat and mouse game between attackers and defenders. It’s a vicious cycle. Is there any way to end it?
[Voiceover] You’re listening to Defense in Depth.
[David Spark] Welcome to Defense in Depth. My name is David Spark. I am the producer of the CISO Series. And joining me as my cohost, one of my favorites… I’ve been saying it about all of you, because you are. One of my and our audience favorites – it’s none other than Steve Zalewski.
Steve, say hello to the audience.
[Steve Zalewski] Hello, audience.
[David Spark] And please use that same tenor when you meet Steve in person. He appreciates it.
[Steve Zalewski] Absolutely.
[David Spark] Our sponsor for today’s episode is ThreatLocker – allow what you need, block everything else by default including ransomware and rogue code. We’re going to talk more about that later in the show. And our guest today is going to help us with today’s topic, who is from ThreatLocker.
Before I introduce him, let’s talk about today’s topic. So, choose your favorite metaphor for cyber security. Cat and mouse, Sisyphus pushing a rock up a hill, the endless game. Each one seems hopeless, and you’re never making headway. Steve, you had posted this on LinkedIn.
You were wondering if there was any way to break the cycle and these metaphors of the hamster wheel of progress. Is it possible for cyber security not to be in an endless reactive cycle? Don’t answer. Don’t answer, because your answer… I had pulled the plug on the speaker when you were answering.
You were fine, Steve. Now, let’s bring on our guest. One of our sponsored guests who we adore having on our show. The chief product officer over at ThreatLocker. He now has a chief podcast officer T-shirt. It’s none other than Rob Allen. Rob, say hello to the audience.
[Rob Allen] Hello, audience.
[David Spark] I can’t remember who said it, but someone was telling me how much they loved you on the show, Rob.
[Rob Allen] It must have been everyone, David.
[David Spark] You’re right. I think it was everyone. I think it was one person that came and spoke to me representing everyone.
[Rob Allen] Yes, speaking in the capacity as a spokesperson for everyone. Yes.
[David Spark] Well, audience, listen up. You’ll find out why Rob is one of everyone’s favorite guests.
Can anything be done?
2:22.693
[David Spark] Venkat Paruchuri of Deloitte said, “Most modern attacks perpetrate through insecure code – whether that is technical, schematic, or logical gaps. Therefore to the extent that code can continue to be written in vulnerable ways and compiled and shipped, and run on Infra that can be vulnerable to and connected by vulnerable protocols with humans who could be compromised, we will continue to see this cycle.
It is the vulnerability of stack, vulnerability at depth…” That’s an interesting way of looking at it. “…that needs some thinking.” And Ross Young of CISO Tradecraft said, “New technology is usually built by developers, not penetration testing experts, so the code has weaknesses in it.
As a result, code attackers can find ways where developers took short cuts to get in. We may get to a place where all code is tested by LLMs with every code weakness test going forward.” Steve, Venkat, and Ross pretty much said as long as the world of vulnerabilities exist, this cat and mouse will always exist.
What do you think?
[Steve Zalewski] The first thing I’ll say is security, when we think about it, application security is one of the domains. So, the first thing I’m going to say is so for the domain of application security, they’re absolutely right. What I would look at that is AI has an advantage for us potentially, is we have to take security… And we talk about shift left.
We talk about baking security in. We talk about AppSec and developers. But what I’m hearing now is how are we secure at inception. How do we take the concept of security now and actually take it out of a conscious effort and make it an unconscious effort at the inception of the development process where the developers aren’t developers anymore.
And so what I really like about this is exactly what Ross said, which was LLMs and AI may actually be an opportunity for us to weaponize defense much more affectively than the bad guys have been able to weaponize it for offense.
[David Spark] So, what do you think here? A lot of this kind of leans into a lot of ThreatLocker’s philosophy, which is deny anything that could be potentially vulnerable, which kind of is anything that you don’t normally approve, out. And so both Venkat and Ross are just saying the world of vulnerabilities exists.
They’re just there.
[Rob Allen] Yeah, I agree wholeheartedly. I don’t think there’s a simple solution to it. I don’t think it’s as simple as running things through an LLM and checking if it says things are okay. Because, again, they miss context and nuance so often. But work on the assumption that things are vulnerable.
Everything that runs in your environment makes you more vulnerable. Every port that you open to the internet makes you more vulnerable. And act accordingly. Which is why default deny… And going back to your metaphor question from earlier on, and cat and mouse and everything else.
The rate at which ransomware or malware, any sort of rogue code is being produced is accelerating with these tools. I saw a statistic recently that something like 560,000 new pieces of malware are released every single day. 40% of them show signs of either being written by or improved by AI.
How do you keep up with that? The short answer is you can’t. It’s not possible. It’s never been possible to keep up with that. Because if your strategy is purely reactive, if your strategy is find the bad things and stop them or shut them down when they’re running then it’s doomed to failure.
Because nobody knows all the bad things. So, that’s why flipping the model on its head and saying, “Look, instead of allowing all these things to run and trying and hoping that we might detect all of them if they’re bad, just block everything by default.”
[Steve Zalewski] That was beautiful. He goes, “Just block everything by default.” I’ll tell you what. My kids are never going to leave the house, and they’re going to be phenomenal adults.
[Rob Allen] That sounds like a tremendous strategy.
[Steve Zalewski] So, there you go. You know what I mean? And this is where I was joking with that. Is as a security practitioner, I’d say I could make sure the problem would go away if you would only do what I say. And the problem goes away.
[David Spark] No, you can limit the environment is what it is. The example I can also give is you know all these credit bureaus by default leave your personal information available for anyone to check. Anyone at any time. But the only time you need it is when you have a credit check.
So, that’s the only time you need it. Nobody else needs it. So, why keep that darn things open all the time? It’s kind of the same philosophy. By the way, you can freeze your account.
[Rob Allen] It’s actually work to do it. I got a notification last year. I had been here for three months. I’d had a social security number for three months, and I was told that it’s been exposed in a data breach. So, I had to go through quite a significant amount of work to get my credit file locked.
[David Spark] But the thing is the same thing with the credit bureaus are also true with software. It’s in the credit bureau’s best interest to leave that information open because they want people doing credit checks, and looking, and gathering this information.
Same thing with software makers. They want their software used as much as possible. I get it. It’s from their interest, not maybe necessarily your interest.
[Rob Allen] But just back to Steve’s point about the whole kids and never allowing them outside, etc. There is an important proviso to the deny by default, which is permit by exception. So, the deny by default is what’s going to keep you safe. The permit by exception is what allows businesses to continue to operate.
This problem won’t change on its own.
8:11.800
[David Spark] Archie Jackson of Forcepoint said, “To break this deadlock, we must change the structural economics of the game. Move beyond reactive patching, transition to memory safe architectures and secure by design principles mathematically eliminates entire classes of vulnerabilities.
Attackers rely on static infrastructure, leverage AI to dynamically randomize network topologies. Human cognition cannot scale to AI attack volumes. Shift AI from mere detection engineering to executing machine speed isolation. And lastly, assume breach.
Use immutable infrastructure to instantly evaporate and replace compromised environments rather than trying to clean them.” Victor Font of Cyber Governance Center said, “Attackers win when we define security as detection velocity. That guarantees a permanent cat and mouse cycle.
The shift happens when organizations reduce structural attack surface.” Like what you were talking about, Rob. “…instead of chasing adversary sophistication. Most incidents still succeed because of unclear risk ownership, excessive access, unmanaged dependencies, and delayed remediation.
The exit from the hamster wheel is not better chasing, it is architectural simplification, enforced governance, and consequence backed accountability.” I think Victor’s comment is right up your alley. Especially the line of architectural simplification.
That’s what you got, right?
[Rob Allen] Victor could not be more right. There is only one way off the hamster wheel. I mean, there is only one way to win the game, which is not to play. So, as he said, if you are constantly trying to keep up, you are going to fail. The fact is the velocity of attacks is increasing.
The sophistication of attacks is increasing. So, again, trying to keep up with those things. Trying to respond to those things is doomed to failure. So, again, I hate to say it, but there’s a pretty simple solution to it, which is rather than trying to identify everything that’s bad, if you block everything except what’s needed then you’re going to block all of the bad things, no matter how well engineered, no matter how AI augmented, or improved, or iterated they are.
You’re going to stop them all from being able to run. So, the answer is not detection or more detection, the answer is more control.
[David Spark] Let me qualify that. It’s not all. Essentially you are greatly reducing the attack surface.
[Rob Allen] Massively so, yes.
[David Spark] Yes. Don’t create this permissive environment, which is not in your interest but actually in the interest of the software makers because they want everything to run everywhere for everybody.
[Rob Allen] But can I just make one point? Which I think was the previous comment about everything should be secure from the ground up, and operating systems should secure, and everything should be secure. I mean, have you ever met Microsoft? Because that, quite simply, is not going to happen.
They literally have designed and built their operating system so they can run MS-DOS programs from 25 years ago. When you’re carrying that legacy technical debt of trying to make these things that were written years and years ago still work on your up to date operating system, you’re affectively doomed to failure.
So, it’s not a surprise. I mean, look at your average patch Tuesday. How many critical vulnerabilities are fixed every patch Tuesday? Before I got on this call, I had a Windows update that I had to run on my machine. A security update. Are you going to tell me that Microsoft aren’t using AI at some stage in their development?
Whether it be writing the code or checking the code? They absolutely are. But when you’ve got that much technical debt that you’re trying to write and operate systems around, it’s just never going to work out well. So, as I said, there is a solution to it, which is rather than trying to keep up, block by default, permit by exception, again, solves that problem.
[David Spark] Steve, I want you to also address Archie’s comments here, where he’s got a lot of different theories of dealing with different aspects about move beyond reactive patching, don’t have static infrastructure, don’t think that humans are going to deal with AI attacks.
What are your takes on this?
[Steve Zalewski] So, one of the things we’re talking about here or one of the themes from the LinkedIn post is I said, “Look, we are in an arms race.” And then you heard Rob use the phrase “attack surface.” We have to understand the attack surface. It’s an arms race.
And then we hear things like, “Well, cat and mouse,” or hamster wheel. We’re kind of talking apples and oranges. So, if we’re going to talk about the realization that this is weaponization and an arms race, and what do we do? What are our tools that we’re giving our defensive perimeter?
And then we talk about hamster wheel and things like cat and mouse. I’m like, see, this is where we’re having a problem. Because we’re not agreeing on what the underlying issue is and what we’re doing. Now, what I like about Archie, distributed, immutable, ephemeral – three very powerful words.
Distributed, don’t put it in one place. Make it hard to find because it’s in a bunch of places. Immutable, make it hardened so it’s very difficult to change. And ephemeral, don’t make it exist for longer than it needs to, so it’s very hard to find the thing to attack.
Awesome. If I’m waging war, those are amazing things. As opposed to security is confidentiality, availability, and integrity. Blend those two. I think that is what Rob was talking about, and we’re talking about is now we’re starting to have a good conversation, understanding the different perspectives and trying to find what the right blend is.
Sponsor – ThreatLocker
14:04.428
[David Spark] CISOs don’t lose sleep over the malware they see. They lose sleep over the things they trusted that they shouldn’t have, because that’s how modern breaches happen. Not through zero days, through everyday tools doing things no one realized they could do.
And that’s exactly the problem ThreatLocker eliminates. ThreatLocker enforces default deny at the point of execution. Rob just brought this up. If it’s not approved, it doesn’t run, period. Just as simple as that. Your attack surface collapses from an everything on the end point to only what you say is allowed.
And the real power – ThreatLocker controls how trusted tools behave. PowerShell can’t start scraping credentials. Chrome can’t start launching scripts. Your remote monitoring and management tools or RMM can’t suddenly turn into an attacker’s remote access platform.
CISOs say the same thing. “This is the first time I’ve actually felt control instead of alert fatigue.” Now, if you want to shut down entire categories of attacks, not react to them like cat and mouse…avoid that…ThreatLocker built a resource hub just for security leaders.
Go to threatlocker.com/ciso. Easiest way also to let them know that you heard about them from the CISO Series. Again, threatlocker.com/ciso. If you want fewer surprises, you should start right there.
What’s the ROI?
15:35.068
[David Spark] David Sledge, CISO over at Secure Seed Capital, said, “Instead of just trying to detect more, why not refocus on driving up attacker friction? If we lean into temporary identities, just in time access, and constant revalidation, we break their ability to scale.
The win isn’t hitting zero attacks, it’s making the payout so uncertain and the effort so high that their business model falls apart.” And this, I would say, is a pretty basic philosophy of cyber security leaders. David goes on to say, “We can’t outrun the adversary for forever, so we might as well change the terrain they have to run on.” And lastly, Richard Wilder of Trace Systems said, “The real shift comes from changing the economics of attacks through prevention and structural controls.
Historically, we made progress by eliminating entire classes of risk, memory exploit mitigations, reduce classic exploits, TLS limited passive interception, sandboxing to reduce impact. MFA raised the bar on credential abuse. The next phase should focus less on detecting everything and more on removing attack surface…” Right up your alley, Rob.
“…through OS guardrails, identity centered controls, micro segmentation, crypto agility, and continuous validation.” Although not the same way of doing it, but definitely reducing attack surface. Richard goes on to say, “MITRE ATT&CK shows that most modern attacks reuse the same techniques.
Instead of detecting each instance, we should make those techniques fail by default.” Aw. So, that’s interesting. Let’s just go back to, Steve, I’ve heard this from many security leaders, that the way to build your security program is just make it very hard and expensive.
With AI, how is that changing? How can you keep making it hard and expensive? For the attackers, that is.
[Steve Zalewski] Yes. Now we’re getting to the crux of the issue. It’s like, “What’s the ROI?” And I love this. Survival of the fittest I’m going to argue. So, a little maverick thinking here for you guys and Rob. Which was what David and Richard to a certain extent are saying is, “Look, make it hard enough that the attackers will go kill somebody else, and your business survives because you have sufficient controls that they’re going to find somebody else to put out of business.” And that’s how you win.
There’s nothing wrong with that strategy. Because you could argue survival of the fittest is those organizations, those businesses that don’t want to invest in security are going to be put out of business. And so pretty soon, all we have left are all the companies that have invested in security.
Like not bad. Nothing wrong with that. The question is do we have the wherewithal as a security village to allow some of our businesses to die because they choose not to make good decisions. And I think that’s where then the other half comes in and says, “No, no, no, we can’t do that.
We have to protect everybody. We have to democratize.” And I think the ROI here is coming back to survival of the fittest versus democratization of security for the advantage of everybody.
[David Spark] Your thoughts on this, Rob? About sort of building a tough environment for attackers to succeed.
[Rob Allen] So, one of my favorite… And we’re going back to the idea of analogies. But one of my favorite examples to use… And it’s on this very subject. So, we often talk about making your organization a hard target for cyber criminals and how if you do that then the likelihood is they will move to other targets.
They will pivot. One of my favorite analogies is the one of the two guys that are running away from a bear, and one stops to put on running shoes. And the other guy says, “Why are you putting on running shoes? You’re not going to outrun the bear.” And he said, “I don’t need to outrun the bear, I just need to outrun you.” And that is a sad fact in this situation, this example.
Because they are looking for easy targets. I mean, what does an easy target look like to an attacker? It looks like somewhere where ideally they’ve got admin privileges. But the fact is if software can run freely, if they can run anything they want within that environment, that is the definition of a soft target.
Now, if you make their life difficult, if they can’t run their scripts, they can’t run their programs, they can’t run their tools, then all of a sudden it becomes a lot of effort and a lot of work. And realistically in most cases… Now, not all cases but in most cases they are looking for low hanging fruit.
There are exceptions to this. So, if you’re government, for example, or if you’re targeted by somebody state sponsored, or hacktivists for that matter, then that’s a whole different ball game because they are literally after you and nobody else. But in general terms for 99% of cyber attacks, they are not after you specifically.
They’re after somebody like you. They’re after low hanging fruit. And as I said, if you make their lives as difficult as possible then the likelihood is they will move on to other targets. Now, Steve’s point is an interesting one, which is that just means that somebody else is going to get hit.
And I did actually come across an interesting… I don’t know if it’s a story or a piece of information, but I was speaking to somebody last week about this. They were working on their incident response. And long story short, the insurance company paid out.
They paid the ransomware gang hundreds of thousands of dollars. And I’m like, “Why did they pay out?” And it comes down to very simple economics from the insurance company, which is our payout amount is X. If the cost of business downtime, which is Y, is greater than X then it makes sense for them financially to pay it out.
Now, that goes against everything I believe in, everything I stand for, everything I think is right. But from the insurance company’s perspective, it’s a very simple mathematical calculation, which is, “X is less than Y. So, therefore, we’re going to pay X.” Now, that propagates the problem.
It just means that somebody else tomorrow is going to get hit because it’s worth these bad guys’ time and effort because they’re going to get paid. Somebody is going to pay them. And so sometimes you do need to look beyond the short-term with these things.
But that’s just an interesting story relevant to Steve’s point about you’re just ensuring that somebody else is going to get hit.
Is anyone happy with this solution?
21:51.545
[David Spark] Soumen Bhattacharya of Capital One said, “My take is a bit optimistic on this one. With AI, enterprises are better placed to build bulletproof security. If non-technical/non-experts are able to leverage AI to build tools for attacks, technical folks and experts should be better placed to build bulletproof defenses, write/generate code preventing vulnerabilities, continuous intelligence scanning, and testing of the code, SOC empowerment through AI, automated remediation of the vulnerabilities, network security through AI.” Well, that seems very hopeful, I think.
But Eyal Worthalter of Marvell Technologies said, “The most honest, strategic framing for cyber security: we’re not trying to end the race, we’re trying to make attacking your environment more expensive.” What we have been talking about. “Cryptography taught us that architectural shifts can create asymmetric advantages.
Are there equivalent architectural shifts in security – zero trust, identity centric models, something new – that could create that kind of durability? Or are we just building faster hamster wheels? The goal was never to stop the arms race, it was always to be on the right side of the cost-benefit equation.” Rob, this is what we’ve been hammering really at the end of this show here in the last segment is, first of all, there is always going to be attackers.
They’re always going to look for holes. Just don’t make it easy and cheap for them to do it. I think that’s the basic philosophy. Yes, Rob?
[Rob Allen] Yes is the short answer to that question. But, again, the point is there are other strategies. I mean, first of all, on the AI question, I’m far from an AI skeptic. I’ve used these tools. I’m not going to go as far as to say I’ve fallen in love with Cloud Code, but I am starting to fall in love with Cloud Code.
These tools are amazing. Now, there is a difference between saying these tools are amazing and thinking these tools are going to solve all of our problems. Because, quite frankly, I don’t believe they are. I’ll give you one small example, which is we have used AI in one small part of our platform, which is categorization of websites.
Unknown websites. So, we’ll basically send it off and say, “Look, categorize this. Is it pornography? Is it…” Whatever the case may be. “Is it guns?” I mean, you name it. So, classify website. Now, what we’ve found in that is that the mistake or the error level was somewhere between 10 and 15%.
So, for every hundred websites, 10 to 15 of them would come back miscategorized and sometimes badly miscategorized. Now, if you apply that… And the question is often asked of us, “Well, why don’t you use AI for decisions in your zero trust and your deny by default?
Why don’t you say to AI, ‘Is this thing, or is this thing bad?’” And, I mean, the fact is if you’ve got a 15% error rate versus default deny, that’s catastrophic. Incredibly dangerous, and incredibly bad, and absolutely not something [Inaudible 00:24:52] But equally, anything that’s not zero trust is worse than default deny in terms of decisions made and potential decisions to be wrong.
So, as I said, AI tools are incredibly powerful. Thinking that applying them to this problem is going to solve the problem for everyone across the board is… I think anybody who believes that is going to be sadly disappointed.
[David Spark] Steve, your final take on how we’re looking at the economics of cybercrime?
[Steve Zalewski] Yeah. It’s interesting how this show went from very up to being very somber. When it got to the ROI and kind of the hard reality, defense in depth… Even David, you can hear, he’s like, “So, this isn’t fun anymore. This is hard decisions, and there’s no good answer.”
[David Spark] Well, the cat and mouse game really boiled down to it’s about the economics of cybercrime.
[Steve Zalewski] Yes. And that’s why really I’m starting saying is I want to thank the audience and those that answered. Because I said, this was not a glib conversation. This was not a cheap, easy answer. We really went at a hard problem, and thank you.
Now, here’s my positive side of this to add on the are we happy with the solution. I’d say two things. One of the things that Rob talked about is deny everything and allow what you need in attack surface. And I think what we’re really saying here is we’ve got to be smarter about protecting what’s most important and be willing to give up some things.
We can’t prevent the child from falling and scraping their knees and elbows. We have to be good at putting the band aids on, patting them on the head, and saying, “Live and learn.” So, we’ve got to be good at what we need to ultimately defend in our company.
We can’t defend everything. That’s a good thing for us. That’s resiliency. That’s something we’re appreciating. We’re getting better at. With regards to AI, I think what we’ve got here is the rabbit and the turtle. The bad guys have weaponized AI much quicker and much more affectively than we have weaponized it for defense.
But I fundamentally believe that the value of AI and being able to introduce security at inception across the stack for the businesses has a higher potential. And I think ultimately we actually are going to have a better defensive perimeter…it’s going to be a few years…than we had before AI.
That’s my story, and I’m sticking to it.
[David Spark] I’ll accept that story.
Closing
27:25.684
[David Spark] And we’ve come to the portion of the show where I’m going to ask both of you…and I’m going to start with you, Rob…which quote here was your favorite, and why? And remember, there was one early on I know you liked a lot.
[Rob Allen] Well, David, this is a very unfair question because it’s like choosing between all of your favorite guests.
[David Spark] And hosts.
[Steve Zalewski] Thank you. It’s me, okay?
[Rob Allen] We all know that, Steve. We all know that. But yeah. And I’m actually deeply suspicious that some of these quotes may have been made up by you specifically, David, to make me feel better. But if you’re asking me to choose my favorite child amongst the comments, I think you’re right, Victor has won.
He said, “A shift happens when organizations reduce structured attack surface instead of chasing adversary sophistication.” That is my favorite quote.
[David Spark] It’s a very good quote. I agree 100%. It’s right up your alley. All right, Steve, your favorite quote and why.
[Steve Zalewski] That was a good one. So was Richard Wilder’s, I think. But I’m going to go with David Sledge. “Instead of trying to detect more, why not refocus on driving up attacker friction. If we lean into temporary identities, just in time access, constant revalidation, we break their ability to scale.” And I think that was where I was going, which was we have the opportunity with AI to set a higher bar, and we need to focus on what’s most important to protect in our company, not try to protect everything.
[David Spark] Very, very good. Well, that brings us to the very, very tail end of the show. This has been a very good show. Thank you very much, Rob. You are always a fantastic guest. We love having you on.
[Rob Allen] You’re kind, David. Too kind.
[David Spark] I am kind. You need to let more people know that, Rob. By the way, I got to thank your company, ThreatLocker. Remember, ThreatLocker, allow what you need, block everything else by default. Very much in tune with what we’re talking about today, including ransomware and rogue code.
Go to threatlocker.com/ciso. Did you hear what I said? Go to threatlocker.com/ciso. Get the tools you need to get out of the darn cat and mouse game. Steve, thank you. Rob, I’m going to let you have the last words. Anything more you would like to say about ThreatLocker?
I believe you’re always hiring. You guys have moved to a bigger location, correct?
[Rob Allen] We have. We have. That big building behind me, it’s not that one, it’s just beside that. But yes, we are in the process of moving across the road. So, yes, we are very much always hiring. We are ramping up hiring, if anything, because we now have space.
Threatlocker.com/careers.
[David Spark] And can people contact you directly if they see something they really like? And they said, “I heard you were on the show.”
[Rob Allen] Yes, of course they can. Send it to davidspark@ciso-dev.davidspark.dcgws.com, and you can pass it on to me.
[David Spark] We’re going to link to…
[Laughter]
[David Spark] …your profile on LinkedIn, and people can email you directly.
[Steve Zalewski] That’s right.
[David Spark] And, by the way, what I suggest our audience do is when you do email Rob, begin with a compliment about how much you like him on the show.
[Rob Allen] Oh, that would be clever. Yeah. Yeah. That would be a winning strategy. But, no, I don’t have any Zero Trust Worlds to tell anyone about except for Zero Trust World 2027, which feels like it’s just around the corner. We do have fun and interesting new products that we released at this Zero Trust World, Zero Trust Network Access and Zero Trust Cloud Access, which I’m sure we’re going to talk about at some stage.
As you said, threatlocker.com, threatlocker.com/careers, threatlocker.com/everything. Check it out. Check us out. And thank you very much.
[David Spark] As always to our audience, we greatly appreciate your contributions and for listening to Defense in Depth.
[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cyber security. This show thrives on your contributions. Please, write a review. Leave a comment on LinkedIn or on our site, CISOseries.com, where you’ll also see plenty of ways to participate including recording a question or a comment for the show.
If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.