Aceiss: Cybersecurity Is a Business Problem

Lloyd O'Connor (00:00)
I was asked by one executive, they said, you know, I spend, a billion dollars a year on protections, can I build a deep enough moat that will...

Lloyd O'Connor (00:06)
guarantee that it will never happen. I said, sadly, that's not the case. The attack surface or the risk surface is so enormous and there are so many different ways in which an adversary can penetrate that surface.

Lloyd O'Connor (00:19)
You just have to work on a different mindset to best protect your company.

Michael McLaughlin (00:38)
Welcome to the Stack to Street Podcast. I'm Michael McLaughlin. This show puts finance and technology in the same room. A billion dollars a year on cybersecurity and still no guarantee? So what should a business leader do? My guest is Lloyd O'Connor, founder and CEO of Aceiss He helped pioneer Chase Quick Deposit and worked on cybersecurity at JP Morgan and Barclays.

Michael McLaughlin (00:59)
Lloyd's argument is that good security requires more than buying technology. Executives need to know what systems they have, who or what has access, and who remains accountable. That's complicated enough when you're managing people. AI agents make it harder. We discuss practical steps businesses of any size can take, why agents raise the stakes,

Michael McLaughlin (01:16)
And the two questions Lloyd says every executive should ask. Here's Lloyd O'Connor.

Michael McLaughlin (01:22)
Welcome Lloyd. It's really good to see you again. how have you been?

Lloyd O'Connor (01:23)
Hey, thanks. Thanks, man.

Lloyd O'Connor (01:25)
Yeah, everything's good. Enjoying the Connecticut fall. So it's a beautiful day. It's great to catch up.

Michael McLaughlin (01:32)
since we got together last time again in Connecticut on a beautiful day, a lot's happened around the concept of cybersecurity. In fact, just yesterday I woke up to an email that said one of my service providers had been hacked and my API keys have been exposed, which is not

Lloyd O'Connor (01:48)
Mmm.

Michael McLaughlin (01:49)
unusual. I think, you know, hacks are occurring all the time. But what was a revelation to me was that I've now got this

Michael McLaughlin (01:57)
problem of hidden access, which, you know, you're so expert at, and I now have to figure out which of my applications have been exposed.

Michael McLaughlin (02:05)
I thought I'd start off the conversation with, you know, tell us about

Lloyd O'Connor (02:07)
ok

Michael McLaughlin (02:08)
your background and then let's get into what you mean by hidden access.

Lloyd O'Connor (02:11)
Yeah, well, thanks for that. As many people say, misery loves company, so you're not alone. The issue of hidden access. So just kind of take a step back on the topic. I've had an interesting career having worked for JP Morgan and Barclays. And my introduction to cybersecurity occurred in 2013. The firm, JP Morgan at the time, had an incident and myself and a few colleagues had to go and investigate the problem.

Lloyd O'Connor (02:41)
We looked at the problem and it kind of surfaced something which is kind of an endemic problem across all industries and it's really about companies have limited visibility into who has access to their systems.

Lloyd O'Connor (02:56)
comes a bit of surprise because there's no shortage of investment in tools and technologies. Organizations of any size and scale struggle to establish who have access to their systems, which you may think is weird, but it's true. Because if you think of sophisticated, well-run companies like JP Morgan, they have an enormous amount of staff. They have a topic which is called joiners, movers, and leavers. So there's a lot of people

Lloyd O'Connor (03:27)
coming and a lot of people going and they get permission and sometimes they revoke sometimes they're not revoked and interestingly there was an incident that I was involved with where

Lloyd O'Connor (03:42)
the company was using a third party piece of technology that was run by somebody that was less sophisticated and they were compromised and that's how the adversaries managed to find their way into the company itself. So the issue of access is nothing new, it's a difficult topic to solve for and again, it's not a question of sophistication of the company, it's not a question of hard

Lloyd O'Connor (04:12)
work It's just a tough and tricky problem to solve at its fundamentals. But one of the most important things I've learned having put together defense programs at JPMorgan and subsequently Barclays, as they say, no good deed goes unturned, is that cyber security at its essence is fundamentally a business problem.

Lloyd O'Connor (04:41)
And the great news is I've had the good fortune to work for these two sophisticated companies who had tremendous investments both technically but also from a leadership standpoint where the business units took ownership for the topic. So the executive sponsorship and clearly defined accountabilities at these firms

Lloyd O'Connor (05:04)
was first class and they aligned incentives with security outcomes. So in my experience, those were really positive outcomes of how to best defend a company. It's not just a technical problem, it's a leadership and an attitude to solving the problem. So that's kind of a little bit of background of me and my experiences to date.

Michael McLaughlin (05:27)
one

Michael McLaughlin (05:27)
of the things that you had a hand in helping develop years ago, is the ability to take a photo of a of a check with your iPhone and

Lloyd O'Connor (05:34)
Mm-hmm.

Michael McLaughlin (05:35)
have that sort of miraculously turn into

Lloyd O'Connor (05:37)
yep

Michael McLaughlin (05:37)
a deposit in your in your account.

Michael McLaughlin (05:39)
So so talk to us about that story.

Lloyd O'Connor (05:41)
Yeah, so that was really an interesting development. I just happened to be the guy on the spot to solve the problem, but the real history of that was, you know tragically came out of the events of 9-11 where money supply...

Lloyd O'Connor (05:58)
back then was principally transacted by checks, And what the powers that be at the time recognized that

Lloyd O'Connor (06:05)
paper couldn't move because everything was kind of the transportation, everything became a real problem to kind of transact payments via checks. And so there was a legislation that came from, you know, those who write policy that banks had to digitize their

Lloyd O'Connor (06:26)
paper checks. I was kind of given the task of trying to solve that problem. And we had to move as quickly as possible to, you know, getting these checks deposited.

Lloyd O'Connor (06:36)
I took it upon myself, having worked in the software industry, to say, well, there has to be a better way to do this. And I took a page out of the Amazon one-click shopping experience, and I said, wow, that's like amazing what the Amazon company has managed to accomplish. Let's do that.

Lloyd O'Connor (06:56)
There was met stunned silence, I said. So a few of us got together over a period of a couple of weeks, locked ourselves in a room and...

Lloyd O'Connor (07:06)
and came up with the notion of just photographing the check. And why was that? We said, well, the device already exists. So we didn't create anything terribly spectacularly new. What was the tricky part was all the backend. What do you do when you capture the picture? How do you make sure it's a bona fide check and not some kind of

Lloyd O'Connor (07:29)
odd thing

Lloyd O'Connor (07:29)
We just leveraged everything that existed in the world at that point. Cameras, phones existed, cameras were available. It was all about the back end and being able to qualify the legitimacy of the image and qualify the quality of the image, on and on and on. All of those important control steps had to be in place to ensure that we were transacting in a very safe and secure way.

Michael McLaughlin (07:55)
I love that background because it just gives us so much material to talk about. in addition to finance leaders, we also have smaller business leaders

Michael McLaughlin (08:02)
whomightnot have the infrastructure to to own the cybersecurity or own the defense mechanisms and also push the business forward.

Lloyd O'Connor (08:10)
Mm-hmm.

Michael McLaughlin (08:10)
So I wonder how we can make this topic economical for for all users and not just the most powerful users.

Lloyd O'Connor (08:17)
Yeah, I think that's a great question, a great lead in, because in my travels over the last decade and a half, what I've discovered, even for the least sophisticated type of companies, is if a company just adopts basic cyber hygiene, they have a higher probability of avoiding a bad outcome.

Lloyd O'Connor (08:44)
And the basic principles have been well documented by people far smarter than myself. And it boils down to, in my experience, three simple things.

Lloyd O'Connor (08:55)
The first one is hygiene maintenance in itself. Now, I think we've all learned recently about that French incident where refrigerators were breached and the product was ruined. And that breach allegedly was as a result of a failure to patch their systems. Now, patches are distributed to consumers like ourselves with our iPhones or companies have running software. So

Lloyd O'Connor (09:26)
The thing with a patch at its basic level is solving a problem.

Lloyd O'Connor (09:32)
the provider knows there's a problem and they're issuing a patch not just to improve the system but to actually defend yourself. So maintenance and kind of patching is a very basic cyber discipline that people should do irrespective of the size of the company. Arguably the bigger the company the harder it is to do quite honestly. So if you think of the big finance firms who run thousands of applications running multiple different types of software keeping them

Lloyd O'Connor (10:01)
all current and up to date is the Lord's work. It's a heavy lift and it never ends, it's ongoing. maintenance is a big, big deal. The second discipline at its most fundamental level is understanding who has access to your systems. Again, it seems dead obvious, right?

Lloyd O'Connor (10:25)
But if you're running a large financial service, you so many people coming and going, keeping that current and record up to date.

Lloyd O'Connor (10:34)
across thousands of systems is a daunting challenge. It's very, very difficult. But again, with the right executive sponsorship, there's a high probability that you can do that. If it's important to the business, then it gets done. But again, it's not something that's very glamorous, quite frankly. Third

Lloyd O'Connor (10:53)
thing is most companies don't know what normal operations look like. If you don't know what normal looks like, you don't know what abnormal looks like. So if you have problem, it's like ouch, right? You didn't expect it to happen. those three things, I think, to your earlier question, it's not a size issue, it's an attitude. Basic cyber hygiene would be my advocation

Michael McLaughlin (11:17)
well, executives are always presented with spreadsheets with their staff names down on the rows and then across the top are applications and there are yeses and no's that fill in the spreadsheet, and the boss, is presented this spreadsheet by the

Lloyd O'Connor (11:34)
hmm

Michael McLaughlin (11:34)
IT department and the boss is to review it and decide

Michael McLaughlin (11:38)
should permissions be revoked or or added to, et cetera.

Michael McLaughlin (11:41)
But Lloyd, let's talk about the thousands and thousands of non humans that have access to applications across the stack. Agents.

Lloyd O'Connor (11:51)
Yeah, well, if we're going to pivot into the world of agents, if you thought you had a problem with human access, know, the prospect of AI agents just amplifies the existing challenges that you're faced with. The current governance systems that people have invested in over the last couple of decades are not designed to cope with this kind of velocity that's coming at them.

Lloyd O'Connor (12:17)
You know agents operate at what's called machine speed. And as a consequence, they can work together, they legitimize permissions, and they interact with multiple systems with varying degrees of human intervention, as you've probably seen with some of the breaches that have occurred very recently.

Lloyd O'Connor (12:42)
Now the worry is if an attacker, and I think we saw something perhaps with Meta, I think something occurred where attackers started a password reset on a chat bot, I believe, and that caused all manner of problems for the company.

Lloyd O'Connor (13:00)
manipulating an agent and compromising credentials just tips everything over because it's all moving at high speed. It turns an existing access weakness into a much larger problem. the trick is it's not just a question of more identities. It's the combination of a broader reach and the autonomy that these actions and interconnected systems have becomes a very scary proposition.

Lloyd O'Connor (13:30)
I'm very sympathetic to companies that are kind of advocating no agents but ironically the fundamentals of cyber hygiene are non-different right you have to the critical gaps are visibility knowing what's going on control and at its essence is accountability

Lloyd O'Connor (13:56)
you've got to know who's in charge of the agent and what their span of control, legitimate span of control is and how to manage that. That's kind of what this new dimension of risk is introduced to the risk landscape for business managers and companies.

Michael McLaughlin (14:14)
So what would you say to banking executives who are caught in this problem right now where their customers want to use consumer agents to do

Lloyd O'Connor (14:22)
Mmm.

Michael McLaughlin (14:24)
their banking for them? So right now you might be able to just type into Grok or into Meta Muse,

Lloyd O'Connor (14:30)
Yeah.

Michael McLaughlin (14:31)
hey, transfer a thousand dollars from my checking to my savings account. And banking executives are now saying, hold on, we're not allowing

Lloyd O'Connor (14:35)
Yep.

Michael McLaughlin (14:37)
agents in yet.

Lloyd O'Connor (14:39)
Yeah, I think that's probably a moment in time. It's like the use of the internet. If you cast your mind too young, remember 75 years ago when emails first happened, you know, there was great trepidation about...

Lloyd O'Connor (14:53)
transact not payments or anything valuable but just transacting via email was a worry to everybody because you moved from one device to electronic communications and so the the defenses weren't really in place to manage email when email first you know reared up so I think it's analogous to that and then the next inflection point was the internet right so you had email then you had the internet and now you've got agents so I think it's a maturity thing it's a moment

Lloyd O'Connor (15:23)
in time, I don't think it's like the gates close and you can't come in. I just think it's buying companies time to put the right level of protections and visibility, not to dwell on the topic, to know whether this is a genuine request or something that's kind of dodgy.

Michael McLaughlin (15:45)
Yeah, but for me it's not so much visibility as it is accountability. So I said earlier about the owners of the agents. And it

Lloyd O'Connor (15:52)
uh-huh

Michael McLaughlin (15:52)
seems that you know, the banking customer has

Lloyd O'Connor (15:56)
Yep.

Michael McLaughlin (15:56)
to own the agent that they employ to make that bank transfer. And if

Lloyd O'Connor (15:59)
Mm-hmm. 100%.

Michael McLaughlin (16:02)
they instruct the agent to make the $1,000 transfer, but they fat finger the zero and it turns into ten thousand.

Lloyd O'Connor (16:08)
Mm-hmm.

Michael McLaughlin (16:09)
and which which causes an overdraft, let's say.

Michael McLaughlin (16:11)
they have to be responsible for that. and I think that's the issue right now at banking firms they would potentially have losses that they'd want to put on the consumer, but the consumer generally doesn't get those kinds of losses put on them.

Lloyd O'Connor (16:25)
I think that's right and you know a real practical example which was probably 15 years prior similarly the advent of multi-factor authentication. Customers didn't want to do it. They absolutely didn't want to do it and so when a fraudulent transaction occurred because they failed to implement multi-factor authentication the liability rested. withthem

Lloyd O'Connor (16:53)
So that when that happened, my own experience of that, customers very quickly adopted multi-factor authentication. So to draw a parallel with what you're talking about, agents and their boundaries and who's accountable, if you kind of...

Lloyd O'Connor (17:10)
think of it in that terms, know, 10, 15 years ago, the advent of multi-factor, who's accountable at the end of the day, if the client customer elects to use a piece of compute to do their work for them, then they are on the hook to do it. And I think that's only reasonable.

Michael McLaughlin (17:26)
it seemed to be okay for leaders and bosses to be able to grant and revoke access to their employees but

Michael McLaughlin (17:33)
When the business also has hundreds, let's say, of functioning agents across their

Lloyd O'Connor (17:37)
Mm-hmm.

Michael McLaughlin (17:38)
workflow, the leader has to own those as well and has to own them over a long period of time when things change.

Lloyd O'Connor (17:43)
Yeah if you just assume an agent is a human, I think that's the best way to treat them because you need to be able to control your human access, but machine to machine access and the agent access is just another dimension of complexity. I think the big difficult or the challenge with that, again, is the speed of change that can be introduced innocently. And that's kind of what's got everybody on edge. You know, when listen to some of the recent

Lloyd O'Connor (18:13)
outreach by the providers saying that they're very worried about the portend of a bad, you know, very catastrophic outcome.

Lloyd O'Connor (18:20)
I think that's not without good reason because again, the systems that have been put in place to defend companies are static. They were designed for a static world, truth be told, you know, the protection systems and the belief that there is one technology can stop a breach. Well, that's just fantasy. I think companies have to consider what is more realistic is

Lloyd O'Connor (18:50)
you're going to get breached. think if you come in with that attitude and you've got the right protections around that condition, I think you have a better probability of safeguarding your company.

Michael McLaughlin (19:03)
you're going to get breached. what can firms do to improve their visibility?

Lloyd O'Connor (19:08)
so if we assume that no organization, and I was asked a question by several organizations, I said, no organization.

Lloyd O'Connor (19:17)
can guarantee it will never be breached. If we start with that's the premise. And then that's why cyber strategies need to extend beyond prevention to include detection, rapid containment, which is a critical thing, and effective recovery.

Lloyd O'Connor (19:35)
when I talk to executives, that's kind what I recommend to them. So as I was asked by one executive, they said, you know, I spend, a billion dollars a year on protections, can I build a deep enough moat that will...

Lloyd O'Connor (19:49)
guarantee that it will never happen. I said, sadly, that's not the case. The attack surface or the risk surface is so enormous and there are so many different ways in which an adversary can penetrate that surface. You just have to work on a different mindset to best protect your company.

Lloyd O'Connor (20:10)
And the fundamentals of that, it sounds easy to do those three things, but there are kind of like half a dozen things that would really help an executive kind of frame that out somewhat. So maintaining visibility, what does that mean? It says know your systems, basic principle. Do you know how many systems you're running? If you asked most people, they wouldn't be known. They'd ask the IT department. Now that's fine from a...

Lloyd O'Connor (20:38)
a basic point of view, but if you think of your time in the business world of running financial products, on those desks there's a lot of products that are handcrafted that the IT department have no idea exist. I'm sure Michael you're aware of it. I think one firm called the UDTs

Lloyd O'Connor (21:01)
It's user developed tools, right? They are software in themselves. They are another opportunity for adversaries to use those as mechanism because typically they're not as well protected as some of the main payment systems or trading systems, but they're an aperture for an adversary. So maintaining visibility, know your systems, who has access, what are the AI agents that are allowed to travel across those systems. No, I won't bore you to

Lloyd O'Connor (21:31)
on practicing cyber hygiene but yes you should be doing that. There's a topic called least privilege. What that means is

Lloyd O'Connor (21:40)
make sure people only can touch the systems they're to touch. So an example, and you know, from your background and my experiences, we often had people in finance that were given permissions to be on the sales desk. And those permissions were appropriate for the job. Now, sometimes the salesperson transitions, as you know, into a trading role. Different set of permissions, but the first set of permissions need to be stopped.

Lloyd O'Connor (22:09)
So you don't want people to have both trading and sales permissions, because that could end up in a bit of a pickle for the company. So least privilege, I think, is a topic that people should kind of practice and make sure they have that right. Monitoring behavior, as I said earlier, do you know what normal looks like? If you don't, then that's not a good thing, because you won't spot abnormal.

Lloyd O'Connor (22:34)
And last is respond quickly. I think we talked about before, you know, the way a submarine is built, it's compartmentalized. So it has a leak in one area. That leak doesn't form a contagion across the whole platform and sink the submarine. So you want the ability to detect the leak, shut the leak down and make sure it doesn't run rampant across the rest of the platform.

Michael McLaughlin (22:57)
with the rise of agents, it seems like it's just

Lloyd O'Connor (23:00)
Yep.

Michael McLaughlin (23:00)
gonna get more expensive and more complicated. So the submarine is getting bigger and getting more nuclear with

Lloyd O'Connor (23:06)
haha

Michael McLaughlin (23:07)
with more departments.

Michael McLaughlin (23:09)
What does it mean for the firms that are not quite nuclear submarines, but they may be thirty foot yachts, How do

Lloyd O'Connor (23:15)
Yeah.

Michael McLaughlin (23:16)
how do they afford and how should they put in place these visibility systems?

Lloyd O'Connor (23:20)
running a company myself, we were incredibly disciplined about thinking where do our biggest risks exist? So companies that write or use software.

Lloyd O'Connor (23:34)
typically house that software in a repository somewhere. There are many, probably the most famous is GitHub, it's enormous. You've got Bitbucket, you've got GitLab, you've got various repositories and they're analogous to a bank vault where you keep your most valuable asset, your source code. And so what I've advised many companies is step one, protect your source code.

Lloyd O'Connor (24:01)
If you fail to protect your source code as has happened, there are only two realistic outcomes. You will either be out of business, which is a desperately bad situation obviously, or, which is what happens typically, you will get a ransom demand to bring your systems back.

Lloyd O'Connor (24:22)
So the size of the company, if you're a 30 foot boat versus a submarine, irrespective, I would recommend to companies of any size is protect your source code as a first action. If you've got protections around that critical asset, then when you're confident that the technology provides you that level of near real time visibility of what's going on,

Lloyd O'Connor (24:50)
You can then move that capability across other valuable technologies that you would be using to run your business. So you may be comfortable as a business owner to lose email for a day because it's not catastrophic because you can pick up a phone or do something else in the interim while that system's recovered. But if you're running like an options trading desk or something of similar sort and you lose that for a long period of time, that's a

Lloyd O'Connor (25:20)
that could be catastrophic. So to answer your question, it's not a question of size, it's a question of looking at the risks that you run as a business owner, picking on the thing which you believe to be the most risky thing and solve that problem first because you can't solve for everything because I think it's just you know it's not practical to try and solve everything at one go, it's just too big of a task.

Michael McLaughlin (25:48)
Right, so level one, protect your source code. And let's say your source

Lloyd O'Connor (25:51)
Yep.

Michael McLaughlin (25:52)
code's in GitHub. the first thing you should probably do is ensure that it's has multi factor authentication on your GitHub login.

Lloyd O'Connor (25:58)
Yep, and GitHub is a great platform. They put a lot of protections in place. so should, your company should avail themselves of those capabilities straight away.

Michael McLaughlin (26:10)
tell me about your phrase that I've heard you use a few times, you can't protect what you can't see.

Lloyd O'Connor (26:15)
Yes.

Michael McLaughlin (26:15)
Because it sounds like visibility

Michael McLaughlin (26:17)
is is, nine tenths of this problem.

Lloyd O'Connor (26:20)
Yeah, I'd say in the incidents that I've been involved in, the breaches I've had to solve, the fundamental problem is a lack of visibility as to what's going on.

Lloyd O'Connor (26:33)
If you think about in large companies, I'd use that as a metric, they run thousands of systems. Many of those systems have been built over decades. The people who built those systems could have retired, could have moved to other companies. So people's understanding of who actually has access to those systems becomes tricky because the technology could be written in a language that...

Lloyd O'Connor (27:02)
It's long forgotten, people don't know it. It's kind of like a black box in many ways. And getting to discover what's actually happening in that application from an access point of view is historically, I would say, has been an incredibly labor intensive exercise.

Lloyd O'Connor (27:24)
And I think the data point that one of the firms shared with me, they said, in order to define access permissions around one application, it took them four months. Now.

Lloyd O'Connor (27:36)
four months at some cost because a lot of people are involved in that understanding. And if you apply four months against a lot of applications, that turns into a generational effort if time stood still, right? So those technologies and those methods of, I kind of delineate between.

Lloyd O'Connor (27:59)
carbon and silicon. Carbon are humans, silicon is compute. Using a carbon footprint, that's going to take you forever. So what our firm has done, recognizing that this is a problem across all industries, is develop technologies that can do that discovery in near real time.

Lloyd O'Connor (28:19)
So we have, not as a big advertisement here, but we have running on GitHub at the moment, a very simple service. It's installed in a couple of minutes and it allows the end user to discover what is actually happening in their repositories on that platform.

Lloyd O'Connor (28:37)
So you can look at the number of bots that are accessing it, the number of third party people who have permissions to access your repo So we have developed that and patented that technology to do that level of discovery of visibility rapidly rather than the historic practice of human efforts. it's very much a silicon approach to solving a carbon problem.

Michael McLaughlin (29:01)
the business will be supportive of all of these efforts so long as you don't slow the business down.

Lloyd O'Connor (29:07)
Yeah, and that's really what was the genesis of, know, the company's formation. we've talked to enough customers, we have hands on experience of the problem, which is a real asset. not kind of guessing and hoping we actually have lived the problem, which is a great unique attribute in forming a company. we know how hard it is and the points you're making is absolutely valid. You need to make this as simple as possible so that people can get their day job done.

Lloyd O'Connor (29:36)
because their day job may be nothing to do with this but they want the problem solved quickly and effectively.

Michael McLaughlin (29:44)
we need agents.

Michael McLaughlin (29:45)
we need them internally to do coding tasks, to do manual workflows that become more efficient with an agent. And customers are gonna want agents because they're growing accustomed to

Michael McLaughlin (29:55)
asking questions in natural language to Google Gemini and getting really good packaged answers.

Lloyd O'Connor (29:59)
Yep.

Michael McLaughlin (30:00)
the comment to you is gonna be, Lloyd, we need agents, we need these processes. make the visibility and accountability problems go away.

Lloyd O'Connor (30:08)
Right, yep.

Lloyd O'Connor (30:10)
There's no doubt, we have built the technology to solve that particular problem. And it's a question of attitude. And we believe, you know, looking through the world from our lens is, it's...

Lloyd O'Connor (30:25)
it's going to happen whether it's using our technology or somebody else's technology. That problem is foundational given what you've just described. Agents like email and the internet are not going away, so you just have to put yourself in a position to manage those new emerging technologies to protect yourself on the downside.

Michael McLaughlin (30:48)
if you're going

Michael McLaughlin (30:48)
into a large bank or even a small bank, what are the one or two questions that you ask the technology and info security teams that you meet with,

Lloyd O'Connor (30:57)
The first question I would ask is do you have an inventory of your technology? That is first principle. If you don't have an inventory, then you have no shot at protecting your company. That is foundational.

Lloyd O'Connor (31:14)
Second question, foundational to anybody, is going back to the access question. Do you know who has access to these systems?

Lloyd O'Connor (31:25)
That's the tougher question. Well, they're both tough questions, depending on the size of the organization. And I know some of the regulatory bodies are pretty hot on these topics. But it's gathering that information is the Lord's work for a lot of companies, because they're not on the front foot in that conversation.

Michael McLaughlin (31:43)
So where do people learn more about Aceiss

Lloyd O'Connor (31:46)
Just go to aceiss.com there's a small little one minute video snippet there, you can get a sense of what it is we're able to do and what the technology does in trying to help solve this particular very important problem.

Michael McLaughlin (32:01)
And what about Aceiss on GitHub?

Lloyd O'Connor (32:04)
Yeah, just go to the GitHub marketplace and literally within, if you have a GitHub administrator, they can connect to the service in a couple of minutes and get results pretty soon thereafter. I mean, it's important to note, know, companies typically are very leery of...

Lloyd O'Connor (32:25)
bringing technology inside their companies. There's lots of vetting processes that have to go through. The good news with Aceiss the way we've designed it, the GitHub offering doesn't actually come into your company. It sits outside of your company, so there should be no concerns. The data we surface, however, the near real-time data, the company can elect to bring that into the company or not. That's a choice. So it's non-invasive to the enterprise or the company.

Lloyd O'Connor (32:54)
but it does surface that near time visibility that you need to manage your estate.

Michael McLaughlin (33:01)
Yeah, that's great. So detection, containment, and recovery. Not to mention visibility.

Lloyd O'Connor (33:05)
Yep, that's the headline. You've got to start with that, but yet

Lloyd O'Connor (33:09)
know your inventory, step one, then figure out who has access, and in order to do that you need those different attributes to protect yourself.

Michael McLaughlin (33:18)
Well, Lloyd, I'm probably gonna have to call you after this podcast and see if you can help me get my inventory in order. I've gotta make sure I understand who has access. I'm learning and I hope everyone else that's had a chance to listen to this podcast has learned and I really wanna thank you for your time, Lloyd.

Lloyd O'Connor (33:31)
Yeah, I appreciate it Michael and hopefully if any questions just let me know. It was brilliant talking to you. Thank you.

Michael McLaughlin (33:36)
All right, Lloyd. Bye bye.

Lloyd O'Connor (33:38)
Bye, take care.