We know phishing is a serious threat to all organizations. So why does it feel like we don’t have reliable metrics on how we are defending against it?

Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by David Spark, the producer of CISO Series, and Mike Johnson, CISO, Rivian. Joining them is their sponsored guest Bobby Ford, chief strategy and experience officer, Doppel.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Doppel

Full Transcript

Intro

0:00.000

[David Spark] Email phishing is solely one vector where we’re seeing intrusions. For most organizations, testing open rates on a phishing test is only one metric used to indicate a company’s resilience against social engineering attacks. Given today’s environment, is that good enough?

[Voiceover] You’re listening to Defense in Depth. 

[David Spark] Welcome to Defense in Depth. My name is David Spark, I’m the producer of the CISO Series, and joining me, doing the crossover from CISO Series Podcast all the way over. It’s quite a leap, it’s quite a journey. We were talking about travel just a while ago.

He had to make two connections to get here. It’s Mike Johnson, CISO for Rivian. Mike, I hope you’re not jetlagged. 

[Mike Johnson] It was touch and go for a while there, but fortunately, I was able to make the travel. I’m here. No problems with TSA. I’m good. It was a long trip though. 

[David Spark] You don’t have Clear to get onto our podcasts? 

[Mike Johnson] Well, just TSA Pre. I’m not quite at the Clear level. 

[David Spark] Clear. You’re not that heavy. All right. Our sponsor for today’s episode, thrilled that they’re sponsoring us. It is Doppel, the AI-native platform for multi-channel social engineering defense. And guess what? They’re responsible for our guest, who I will introduce in just a moment.

But first, I’m going to bring up a topic that is near and dear, I know, to your heart. Actually, to most of our listeners’ hearts. And that is, the question is how do you tell how well your organization is doing against social engineering attacks? Now, Mike, you have argued that measures like phishing click rates are used because they’re low-hanging fruit, they’re easy to test, and they’re easy to report.

And do these tests actually prepare your team appropriately, and can we count on the results for a measure of company resilience? Mike, I know, if anyone who’s been listening to any of our programming knows, you’re not a fan of phishing tests at all.

So, I’m going to reveal the magician’s secret here. 

[Mike Johnson] That’s shocking. Behind the curtain, I’m sure it’s a surprise to everyone. 

[David Spark] But we would like to know how our business is prepared for social engineering attacks, if not phishing tests. I mean, again, they’re easy to test, easy to report. So, what do we do to create that environment or should we be looking at it completely differently?

Your thoughts? 

[Mike Johnson] One of the biggest challenges in cybersecurity is how do we measure. We frequently are getting the question of are we secure or are we going to be compromised or are we going to be breached. 

[David Spark] And by the way, we have the debate all the time. What metric is the important one to measure? 

[Mike Johnson] Exactly. And when you look at phishing click rates or phishing response rates, a lot of that is measured, I believe, because it’s easy to measure. It’s something that you can pull those numbers together. 

[David Spark] You can make the number go up or down. 

[Mike Johnson] And that’s actually one of the problems with it is it’s not actually a good measure because it’s so easy to influence. 

[David Spark] Yeah. You can make phishing tests very easy. You can make them very difficult. 

[Mike Johnson] Exactly. Or you can choose not to do them, which is my preference, but ultimately measuring that is a very suspicious measure because of how easy it is to influence. That was really what I wanted to put out there was this is my suspicion.

What do other folks think? What do other people who maybe are doing this today, maybe they are phish testing their employees, and testing those response rates. Maybe they are doing, which I think is a better measure of, looking at the rates of reporting on actual phishes.

So, how are employees recognizing phishes and reporting them? Perhaps that is a good measure. 

[David Spark] And also outside of just email, being that it’s coming in other mechanisms as well. 

[Mike Johnson] Absolutely. And frankly, again, that’s back to where I’m suspicious of this metric because it is not representing what the actual threats we see. 

[David Spark] It’s like measuring break-ins only through your front door when you have 20 windows and 3 other doors in the house. 

[Mike Johnson] Exactly.

[David Spark] Yeah. There’s other ways to get in. 

[Mike Johnson] Yes, it turns out. 

[David Spark] All right. So, let’s bring on our guest, thrilled to bring on our guest. First time I met him was back in 2020. We did a live show together in Tel Aviv, an enormous crowd. We had 350 people. It was a total packed house. And then the pandemic decided to happen.

It was not our fault. We are not taking any blame for it whatsoever but thrilled that he’s here. He is now the chief strategy and experience officer for Doppel, our wonderful sponsor. Our sponsor guest is none other than Bobby Ford. Bobby, thank you so much for joining us.

[Bobby Ford] Hello, David. Hello, Mike. Thank you so much for having me. I’m thrilled to be here. 

Where does this effort fall flat?

4:52.586 

[David Spark] Mike McGannon of Rockwell Automation said, “Click rates for phishing campaign as a standalone metric are completely meaningless.” So, on your side, Mike. “But this is what vendors sold for years with their products. Users need to be trained on edge cases in role-based and current threat-based, not generic phishing campaigns.

Phishing team and threat intel team need to be working together to put out information on active threats they’re seeing so users are aware of them as they are actually happening.” Ah. So, kind of like what you were saying, Mike. Ian Edwards of Induction Healthcare Group said, “Phishing click rates are easy to measure and make them tempting as a performance metric.” Ah, yes.

“But that doesn’t mean they’re meaningful. In fact, they often serve more to justify the ROI of awareness training platforms than to build true resilience.”

And Farzan Karimi of Moderna said, “Click rates alone are a junk metric. What matters more is what happens after the click. Does the user enter credentials or provide an MFA code? Most phishing simulations stop at the click and fail to emulate an end-to-end attack chain.” This is interesting.

“That’s why red team-led phishing often provides much higher ROI. They tell a more compelling business impact story and validate true resilience, not just reflexes.” So, this is a good thing. It’s not just a reporting. Are there other things that we’re seeing here in terms of interactions beyond just a click, beyond just a report, Mike?

[Mike Johnson] I think that is back to one of the challenges that I have with phishing your employees. Farzan is really describing the concern I have in that it’s just a click. What happens after that? My argument is if you are compromised because an employee clicks on a link, it is not the employee who failed.

And that’s something that really Farzan is talking about here is what happens after the click? What happens after they fall for the phishing link? You have to assume that your employees are going to fall for these things. They are going to make mistakes.

[David Spark] And be able to make the right call at that point. I remember, by the way, I’m just going to remind you, there was a time you and I were doing a live recording, or just a recording in the office with the CISO of Atlassian, and just before I hit the record button, my sister called because she clicked on something she shouldn’t have had.

And it just so happened that I had the two of you there to provide advice for her, and do you remember the advice you gave her? 

[Mike Johnson] I don’t actually. I’m not sure that it was good advice. 

[David Spark] You did. You said call the help desk right away. 

[Mike Johnson] Ah. [Laughter] 

[David Spark] Which is good. Good advice. 

[Mike Johnson] Report it. Report it and ask for help. 

[David Spark] Because she felt embarrassed. So, she called her brother first rather than calling the help desk. 

[Laughter] 

[Mike Johnson] And that’s one of the techniques that attackers rely on, is they rely on people will be embarrassed. They rely on the fact that people will fall for it in the first place. And some of the challenges of phish testing your employees is it actually kind of makes them embarrassed and makes them less likely to report something.

It has the opposite effect of what you would like. More evidence of, hey, this is a bad idea. And measuring it encourages you to do more of that. 

[David Spark] All right. I toss this to you, Bobby. All through this, audience couldn’t tell, Bobby has been nodding his head continuously. Now, I don’t know if it’s a problem with his reflex, but I’m assuming you agreed with everything that was said so far.

[Bobby Ford] Absolutely agree. And I thought that I felt passionately about being like…

[Laughter] 

[Bobby Ford] You know? I thought I felt passionately about whether or not we should be measuring click rates, but I think the audience and definitely Mike is more passionate than even I am. I don’t know if I would go as far as Mike did with saying that it’s completely meaningless as a standalone metric.

For me, it’s more – and I mean Mike from Rockwell Automation – for me, it’s insufficient. And what I mean by insufficient is that when we think about the threat landscape, attackers now use multiple channels. In fact, over the last two years, if we look at some of the largest cyber incidents that happened, whether it was in the gaming industry or if it was in retail, they happened without email clicking.

These were social engineering attacks that happened via help desk. And so, if you’re only measuring email, then you’re getting an incomplete, insufficient look at whether or not your organization is secure. 

[David Spark] And that goes back to sort of the metaphor I gave of the house, just only measuring the front door, nothing else. 

[Bobby Ford] I’m going to use it. I think that was brilliant, so I will be using that. I go back to when I was a CISO at a really large FMCG organization, and we wanted to measure click rate, and we started celebrating because we got our click rate down from 18% to 7%.

And so, everyone wanted to throw a party, and I simply asked a question, “Well, how many clicks does it take to compromise our environment? How many clicks? It only takes one click. Until we get to a point where we accept zero, let’s not celebrate.” But now I think it goes even further than that.

Like I said, when you think about how hyper-personalized phishing is, how it happens across multiple channels, I don’t think anyone should only be measuring via email. And the last thing I’ll say, David, is that earlier today I was having a conversation with a CISO friend of mine.

And I said, “Bragging about your email phishing program is like bragging about your antivirus.” [Laughter] It’s sort of insufficient. Like no one goes before their boards and reports on their AV signatures and how up to date they are. Why? Because it’s an incomplete, insufficient story.

What’s the optimal approach? 

10:53.240 

[David Spark] Aman Sood of Elsvier said, “While click rate may be an outdated standalone metric,” you kind of referenced it just at the end there, Bobby, “What remains highly relevant is identifying which user or users who fall for phishing have administrative or excessive privileges.” So, ah, so we’re getting into the contextual aware like, why is this…?

So, if someone who has no access to anything keeps falling for it and essentially, they’re in the equivalent of a padded room, who cares kind of a thing. “But if there’s a pattern of failure to detect, failure to report, and those individuals hold ‘the key to the kingdom,’ that’s no longer just a training/education gap.

That’s a business risk with real consequences.” This is a great point Aman makes. And Sam Harwin said, “One of the most powerful measurements, in my opinion, is how many people report the suspicious email,” like what you said, Mike, “On a phone call, SMS, whatever, and how soon do they get a response from the security team?” Ah, this is good.

“This feedback loop is way more valuable than clicks on phishing emails.” Great points made here as well. Bobby, your thoughts. 

[Bobby Ford] I agree. They both really are good points. I like what Aman is saying about providing some context to who’s actually doing the clicking because not all clickers are created the same. [Laughter] And so, you got to give some context. And then I really like what Sam was saying, which goes back to what Mike was saying earlier, like what happens after the click.

If I were to think about the optimal approach, I sort of look at it as in what is our social engineering susceptibility score? And I’ll repeat that. What’s our social engineering susceptibility score? And what I mean by that is when I think about my organization as a whole, and I think about all of the channels in which my organization could have a social engineering attack launched against it, how do I fare?

What’s my susceptibility score? And that becomes a more meaningful metric, goes back to what Mike was saying earlier, how do we measure whether or not we’re secure? I think that if you look at it holistically, so that would be my optimal approach, looking across multiple channels, and then how do we fare?

How do we rate? 

[David Spark] And I think that speaks to what is the security culture that you have built? And I will also say that, Mike, and I know you’ve said this before, if a click brings down your kingdom, you haven’t built your security program right. So, yes, people are always going to make mistakes because they’re human beings.

But do you have other technical controls to essentially act as safety nets? Yes, Mike? 

[Mike Johnson] We usually talk about security and the concept of layers, that it’s not just one thing, and that is because we assume that there will be failures in our system. And that system, I’m using that term very loosely to include humans. They could be the human who is receiving the suspicious email.

They could be the human who is in the SOC reviewing the alert. There’s any number of humans involved and any of them can actually make a mistake along the way. So, we build our security programs with the idea of layers, that not just a single failure will result in a compromise.

So, I do think that’s key. But Bobby, I’d love to ask you a question, and I know it’s usually David asking the questions, but I like your mention of the social engineering susceptibility score. I’m scribbling notes over here. How do I measure that?

[Bobby Ford] You look at your organization, and you say when I think about all the ways an individual or an external threat actor could influence my users, whether that’s via SMS, whether that’s via social media, whether that’s via WhatsApp, help desk, however it is, and I’ve laid that out.

Then I come up with a baseline. What I mean by a baseline is I have to launch some sort of simulation against that. So, whether or not I’m sending my employees text messages, if I’m sending them email, if I’m calling up the help desk, and then once I measure the baseline, that then I figure out an algorithm that gives me a score.

So, it’s not a one size fits all. Everyone has to do it. It has to be tailored to your organization. 

[Mike Johnson] That makes sense. I’m taking notes. Thank you. 

Sponsor – Doppel 

15:21.554

[David Spark] Our sponsor is Bobby’s company. It’s Doppel. Now, here’s some things you may not know about them. And by the way, Bobby, you can’t see, but he’s showing off his T-shirt that says Doppel on it. It’s the first social engineering defense platform purpose-built to dismantle impersonation threats before they cause harm.

That’s key. While legacy tools focus on detection and alerting, Doppel goes further using AI and infrastructure correlation to link phishing emails, fake domains, deep fakes, and impersonation campaigns across channels. 

From executive protection to brand impersonation takedowns, Doppel doesn’t just flag threats. It disrupts them at the source. Every attack fuels their shared threat grid, giving every customer the benefit of collective intelligence. This is key. The result?

Faster disruption, stronger resilience, and fewer opportunities for adversaries to profit. Doppel makes digital deception unprofitable, protecting your people, your reputation, and your revenue in a world where social engineering is now the biggest threat to enterprise security.

You want to learn more, right? This is something that affects you. You got to go to their website. Go to doppel.com. Reach out to them. And when you do, let them know that you found out about them through the CISO Series. 

Why are we blaming users? 

16:44.863 

[David Spark] Matt Polak of VanishID said, “The ‘human data layer’ is the outermost and most exposed layer in every company’s defenses.” Good point. “It includes corporate information, such as work emails, phone numbers, organizational information, and locations, for example, and personal information, such as vital information, biographical information, passwords, contact information, family information, and more.

There’s so much out there. This is raw material attackers use to create compelling lures that do trick employees, even the most discerning, because it’s real and it’s personal.” It’s a good point. 

And David Stucky of Penn State said, “Social engineering meets people where they are at. It takes care to address what is important to those it is trying to influence. Social engineering does not focus on the applications, tools, mediums, technology, people are using.

How many people are email application enthusiasts? Talk to people about their actual work and the processes they use to accomplish their work. They will tell you everything you need to know to help protect their work and business practices.” So, having the conversation with how they communicate and engage, that’s actually a really good point on the protection side.

But this is a really good point. I’m going to go back to a conversation I had with a hacker, I’m going to say about four or five years ago, and he had been hacking for like 15 years. And I said, “What’s different about hacking 15 years ago to now?” And he said, “The big thing is the amount of information I know about you is so much more.” Now, I take that, and I think about AI, and I think about how fast we can operate.

So, his ability to attack me and everybody else is kind of insane now. Yes, Mike?

[Mike Johnson] Oh, and that’s how it works. Technology keeps moving. A good example that Bobby was talking about earlier is the fact that attackers are using multiple channels, and that didn’t used to be a thing. You didn’t used to be able to SMS people at scale.

You didn’t even used to be able to SMS them in general. You couldn’t send them a link because they couldn’t click on their phone to that link. Constantly, technology is evolving; therefore, the attackers’ tactics continue to evolve. I would actually say one of the bigger differences is we have built an incredible amount of technical security controls that has forced attackers to move into social engineering.

We’ve made it so much more difficult for them to compromise a website or to guess a password that they’ve had to move in other directions and they’ve had to naturally move to targeting the people directly. I think that’s one of the bigger changes over the past few years.

[David Spark] All right. I throw this to you, Bobby. This is exact conversation you and I had over at Black Hat about the fact that this conversation I had with the hacker, that is happening, but at ludicrous scale. 

[Bobby Ford] The two things that I think of immediately, David, are speed and sophistication, and when I talk about how generative AI has enabled cyber attacks, I say that generative AI has taken days and weeks and turned it into minutes and seconds.

When you think about the kill chain and you think about the cyber kill chain and you think about the amount of time that went into the recon phase, just learning about the target, that would take days, if not weeks. That now can be done in minutes and seconds, and so it’s changed the speed.

And to the point that Mike was just making with sophistication, now you can have these hyper-personalized attacks, whereas they were very generic before. Because if I wanted to do it at scale, then I had to create a template where it was like fishing, like literal fishing, and I tried to catch as many fish as I possibly could.

Now I can tailor it and make it hyper-personalized so that it knows everything about David Spark. And when you think about that level of sophistication, that’s why I don’t think that the traditional methods of education and awareness work anymore because when you think about that level of sophistication, what happens when you can’t recognize a suspicious email anymore?

[David Spark] Yeah, I agree. I want people to think back a while ago, and I’m going to throw this to you, Mike. There was a time, do you believe there was a time that you could protect yourself as a security professional and anybody else, if you were just savvy?

Like, “Oh, I’m smart enough to know this.” I think those days left many years ago. And it’s worse now. And I remember interviewing some people at B-Sides San Francisco asking security professionals, incredibly smart security professionals, “Could you be hacked?” And the overwhelming majority said yes.

And their answer was, “Just get through the people I trust – my family and friends. You could do it that way.” We’re beyond the even being smart and knowing everything is not enough to protect you. Is it, Mike? 

[Mike Johnson] No, you have to be active. It takes work now. It used to be you could protect yourself simply by not participating, by not leaving a trail or leaving a footprint. That was pretty common in the past as a method. Now you have to build your own defenses.

You have to figure out what your weaknesses and exposures are to your loved ones. One of their accounts could be compromised. Would you be able to deal with that? It’s absolutely a lot more work than it used to be because the attacks have gotten better.

What’s the optimal approach? 

22:36.541 

[David Spark] Elle McKenna said, “I actually think the best defense against social engineering attacks is to train people on what communications from security, IT, HR, executive leadership will consistently look like and then actually adhering to that.

If you pave a yellow brick road, people are a lot more likely to get their hackles up about forms of communications that don’t follow the yellow brick road.” All right. I’m going to throw this to you, Bobby. This is great advice, but what happens when a hacker finds the yellow brick road?

Then you’re in trouble, right? 

[Bobby Ford] I don’t disagree with what Elle is saying. 

[David Spark] It’s good until they find the yellow brick road.

[Bobby Ford] Until they find the yellow brick road. And again, I keep going back to the point – what happens when we live in a world when users can no longer recognize or distinguish suspicious from legitimate? 

[David Spark] We’re seeing it with deep fakes. Yeah.

[Bobby Ford] We’re seeing it with deep fakes. I think that we’re fast approaching an era where you cannot tell with a naked eye generative AI or deep fakes from legitimate actual users. 

[David Spark] Audio and video. Yes, I 100% agree. 

[Bobby Ford] And so, with that, I’ve said it before, I think the only way you can defend against AI attacks is with AI technology. 

[David Spark] I’ll throw this out. I will say there is another way, but again, this is a tough one to scale, I will say that. For example, with my company and with the family, we have a sort of a offline password, if you will. So, if something seems fishy, if that phrase or password is not used, then it probably is.

Have you done something like this in your environment, either home or business, Mike? 

[Mike Johnson] It’s something that I’ve considered. It is not something that I’ve implemented. And a challenge that I have is there’s a whole lot of footage out there of my voice. 

[David Spark] Yeah. And me too, Mike

[Mike Johnson] Exactly. So, there really is opportunity of using that against my parents. But at the same time, it then has to be within context. What is it that they’re discussing? And that’s not something I’m public about. The context of what was the last conversation I had with my mom, that’s not public.

So, I do think there’s still some challenges around those kinds of attacks. 

[David Spark] By the way, my wife has done that before in terms of when I’ve made a request, she would say, “What did we do last night?”

[Mike Johnson] Mm-hmm.

[David Spark] To make sure that I’m not a fake, and then I would answer. Yeah, so instead of using the “password,” just make a reference to something that you both know. 

[Mike Johnson] I think it can be that simple. And I think some of that is – I don’t want to put words in Elle’s mouth here – but I do think that’s what they’re talking about, of being able to understand what good looks like on a regular basis. And if something looks a little bit off, that gives you an opportunity to say, “Hey, maybe I should ask you what we did last night.

What did we have for dinner or what movie did we go to?” But if you don’t even know what good looks like, if there’s no concept of what a typical communication from the IT team looks like, if it’s different every time, that means if you get yet another one, “Oh, yeah, sure.

This is clearly from my team.”

[David Spark] So, going back to Elle’s comment, like everything, it’s layers. Having good processes that everybody knows is a good first step, but it’s not the ultimate step. So, Bobby, I’m going to let you have the last word. You’re nodding your head all through this.

[Bobby Ford] I think what we’re all saying, and it’s also what Elle is saying, is that context matters. The context matters. And so, making sure that we’ve educated our users on recognizing context. Like if your CHRO is sending you a Telegram message or sending you a WhatsApp message asking for 70,000 euro, consider the context.

Has your CHRO ever contacted you asking you for cash before? 

[David Spark] And that’s when, like I was saying with the conversation with my wife, whenever it’s a concerning question or a question where some action, which may mean finances changing or all of a sudden sensitive information is being transferred, that’s where you start asking other questions.

[Bobby Ford] Yeah, put it in the proper context. 

Closing 

27:02.459 

[David Spark] All right. This brings us to the end of the show, where I’m going to start with you, Bobby, where I ask you, of all these quotes that I’ve mentioned, which quote was your favorite and why? 

[Bobby Ford] Well, I sincerely mean this, my favorite quote has been yours, David, about the front door. Yeah, the front door and not just measuring. I mean, not just measuring the front door with break-ins, but looking at the windows and the back doors and any other ways you can get into the house.

So, my favorite quote is yours about measuring email is like only looking at the front door. 

[David Spark] I’ll take that. Thank you very much, Bobby. You see? Sometimes our guests are nice to me, Mike. 

[Laughter] 

[Mike Johnson] I think the guests do a very good job. It’s your hosts that are the ones who give you the hardest time. 

[David Spark] Andy Ellis, he also berates me plenty. All right. Which quote is your favorite and why, Mike? 

[Mike Johnson] So, I’d like to go back to what Sam Harwin wrote, and we didn’t talk about this very much, but one of the things that he mentioned was tracking the response time of the security team to the report. 

[David Spark] Oh, yeah, yeah, yeah. We brushed that off a little bit, but yeah, come back to that. 

[Mike Johnson] That’s thinking holistically about the system, not just somebody reporting, but making that actionable and what you do with that. So, I really wanted to highlight Sam’s point of that because I do think we didn’t quite give it what it was due.

[David Spark] Because it, and I should also mention one of the concerns, correct me if I’m wrong, you feel about phishing, is it doesn’t build the world’s greatest relationship between the security team and the rest of the company. 

[Mike Johnson] Phishing or phish testing. 

[David Spark] Yes.

[Mike Johnson] If somebody reports a phish.

[David Spark] That’s what I mean, phish testing. Yeah.

[Mike Johnson] Well, either, right? So, if somebody reports a phish and you don’t get back to them, like you don’t say, “Thank you, this was a phish,” or “Appreciate your diligence, but this was actually legitimate.” If you don’t get back to them, then to them, security is a black hole.

[David Spark] Why would they bother? 

[Mike Johnson] And they will stop reporting. 

[Bobby Ford] I remember when COVID first happened, having long heated conversations with other CISOs about whether or not we should be phishing our employees with fake vaccine messages. [Laughter] 

[David Spark] This has been a hotly debated subject because there’s been these really nasty fishes, which say, “Hey, if you click here, you’re going to get a bonus,” or something about your payroll or something like that. And they go, “That’s really, really mean.” And then the defense of doing that is, “Well, the attackers could do it, and we want to get our team ready.” And it’s like, “Well, but you’re also creating a pretty crappy environment too.” You are actively actually doing.

The other is just a chance. You could warn them that this could happen rather than do it to them. 

[Bobby Ford] You could do that through awareness. 

[David Spark] Right. 

[Bobby Ford] You could absolutely get the same message across through awareness. 

[David Spark] Yeah. And it’s not like your employees are criminals that you actually have to run a Scared Straight Program

[Laughter] 

[David Spark] . All right. This comes to the end of our show. I want to thank your company, Doppel, for sponsoring this episode. The AI-native platform for multi-channel social engineering defense. You got to go check them out at doppel.com. Mike, any last thoughts on today’s discussion?

[Mike Johnson] I just really appreciate you coming on, Bobby. I love your breadth of experience, former CISO, now trying to help stop a problem, help solve a problem more globally. And thank you for sharing that anecdote and being on the right side of not using COVID as a lure for phish testing people.

So, a special thank you for that. But thanks, really, for sharing your insights. 

[David Spark] Awesome. All right, Bobby, I’m going to let you have the last word. So, a few things. One, are you hiring over at Doppel? Can people contact you? You mentioned that. And by the way, we’ll have a link to Bobby’s LinkedIn profile on the blog post for this episode.

And anything else you want to say about Doppel and how our audience can get engaged? 

[Bobby Ford] Thank you so much for having me. I’m a huge fan of the CISO Series. So, being a guest here means a lot to me. 

[David Spark] Kudos to you as being an American and calling it the CISO Series because I only heard that in Australia of all places. 

[Laughter] 

[Bobby Ford] I mean, the listeners can’t tell, but I’m sweating now. And the reason why I’m sweating is because I normally listen to the CISO Series when I’m working out. So, anytime I hear David’s voice, it automatically takes my… 

[David Spark] Pavlov response, or Pavlov’s dog’s response.

[Laughter] 

[Bobby Ford] Yes, it takes my heart rate up. We absolutely are hiring, so please check us out at doppel.com and go to our hiring page. You can also reach out to me directly, bobby@doppel.com. I typically respond to most messages I get. And thank you all for giving me this opportunity.

I really and sincerely appreciate it. And thanks to the listeners. 

[David Spark] Yeah, go check out Doppel. Feel free to reach out to Bobby directly. He loves to talk about this topic. And again, sadly, you’re filling an interesting niche here with Doppel is that at this time, it’s another very needed layer. All right.

And to our audience, as I always say, and I truly, truly mean it, we greatly appreciate your contributions and for listening to Defense in Depth. 

[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site, CISOseries.com, where you’ll also see plenty of ways to participate, including recording a question or a comment for the show.

If you’re interested in sponsoring the podcast, contact David Spark directly at David at CISOseries.com. Thank you for listening to Defense in Depth.