Digital Trust in Practice: Compliance, AI, and Human Factors with Sandeep Pauddar

In my family, we have a code. So if somebody calls

with an urgent need for help, we first have to ask for that code.

And this came off a real incident that happened last

December. I was in Austria for an audit, and my son, who is here

in Texas, he got a call saying, son, I've been in an accident.

So he hung up, called me back. He said that, Dad, it

was your voice.

Hello and welcome back to Data Driven, the podcast where we explore the emerging

industry that is artificial intelligence, data science, and of course, it's

all not possible without the importance of data

engineering. Fortunately, my favorite data engineer in the world

cannot make it today, but I am gonna carry on without

him. Today we have an interesting guest, and, uh, he's been

super patient because of scheduling snafus on his end, my

end. We've had a lot of those. I am speaking today with Sandeep Padar,

and, uh, he is Head of Digital Trust at DQS.

He is coming to us from deep in the heart of

Texas at, uh, the Dallas-Fort Worth Metroplex. Welcome to the

show. Thank you for having me, Frank.

Hey, no problem, no problem. So what is digital trust

to you? What does that mean? So

in the past, in the realm of compliance,

people were chasing different standards based on what

the requirements were there. There could be regulations requiring a certain

standard. There could be clients' contracts requiring

certain regulations. And this was all

piecemeal. Now, as the effort grows and

multiple dimensions come together, use of AI models, AI

data, various regulations from different agencies and

clients, and then of course the important

dimension of security, they all come together. It becomes

overwhelming to do this piecemeal, and it's best

to aggregate this together. in one cohesive compliance

effort. And this is what we are calling digital trust.

That makes sense. Do you think, it may be too early to ask this question,

but based on what you said and kind of reading the tea leaves

and reading the room, I could easily see there being a need for a

chief trust officer at some point in the future at the C-level. Do you

think, is that looking too far ahead or

just right on target? You are so right. We are there now.

You are correct. So more and more organizations are having these questions.

How do we face all these compliance dimensions and how do we fulfill our

requirements? I have written a white paper recently on the

top of this topic, and we have some webinars coming up as well where we

address this very same topic for different verticals, not just

for IT companies or AI companies, but say

for example, we have a webinar coming up on medical devices

because every sector is facing the same difficulty. So I

fully agree there is need for a dedicated

organization led by a compliance officer in

digital trust. I can see that. And, and,

and you're right, when you mentioned medical devices, there's obviously a certain level of trust

in there. And trust, because to me, and you kind of said

this in the intro, When you describe what you do, like, the AI is

part of trust, identity is part of trust,

obviously cryptography, security, all that stack, right? So there's a

security probably foundation of that. What else,

like, what else would be involved with trust? So

it varies from sector to sector. There are so many

verticals that share the same foundation of using

AI responsibly and ethically because everybody is using it.

And of course, they have the responsibility to protect their data.

So security is another dimension.

The 3rd dimension that varies a lot is regulations. Every

sector, every vertical has their own set of regulations to meet,

and therefore the mix of standards that will go into their

compliance there Integrated management system would

be different.

So is this rolling out

in some industries more, right? So you obviously have regulated industries, right?

Healthcare, finance, I would assume. You mentioned healthcare. I'm assuming finance is going to

be a big player in this, but also public sector, right? I mean, defense

and anything related to government, I would imagine, would really

require Well, requires is a loaded word—

demand or need some level of

enhanced trust. I fully agree, and

we cater to a very diverse set of

verticals. We have aerospace audits, we have

automotive industry, food, environmental health and

safety, quality, and all of these verticals

now need to address the data security

regulations around data security regulations around AI use.

And then depending on the geographical area which they are

catering to, the flavors would change as well,

whether you are, you are complying to

European Union AI Act or whether you are in California

or Texas, and then you have to look at the state-level AI

regulations. Right. And the regulation market

is getting far more complicated, right? Obviously, everybody knows the

European Union. I know Switzerland has their own scheme,

but also at the state level, at the second-level government, right? In the United

States, California. I know that different states have different— you said

that's Texas. I think Maryland is— I live in Maryland, which is why I'm bringing

it up— is also bringing up a lot of these types of

regulations too. It sounds like this is getting

It's a growth industry, isn't it? Or a growth concern.

It is. The rate of change of information, data,

knowledge is increasing. So

vulnerabilities are increasing as well. And then everybody has the

responsibility to, to address it. It's a make or break

situation for many organizations. And you know what's

interesting? This seems inherently cross-discipline and

cross-functional. Isn't it? That is correct. Yeah.

Because it seems to me like a lot of this is going to be—

and I'll ask you questions about like how

best— obviously there's no best way, but obviously

just as soon as you say regulation, that translates to a

legal department, right? There's also a security

aspect, right? So that's IT operations aspect. There's also, you

know, as AI gets looped into this, there's going to be

veracity kind of concerns and, you know, model provenance and

kind of the— it sounds like this is inherently going to

involve at least 3 departments, probably more. But off the top of my

head, I see the legal department get involved, IT operations, and however

organizations break out their AI people, right? And data engineers

obviously need to be a part of that. Shout out to you, Andy. But what

How is that going to be structured? Because lawyers don't like to share the room.

IT operations don't like to share the room. AI people certainly do

not like to share the room, right? Or share the mic, as it were. How's

that going to work out? Like, is this going to fall under compliance? Is this

going to fall under each individual business unit? Or it really depends

on the problem and the regulations? You said

it right. And what a wonderful question it is, because I get this question all

the time. clients get a requirement from somebody

to come up with a certificate, and they come to us,

and their first thought is that information security

is IT's responsibility. So they bring IT people

into the initial call, and that's when everybody learns

in the room that information security is everybody's

responsibility. These standards that we typically

TISAX for automotive industry.

They are organization-wide regulations or standards.

So it's not just IT, but we look at the

overall awareness about information security throughout

the organization. We are talking to

legal, like you said, we are talking to procurement.

How are you securing the information that you are sharing with your vendors?

HR, how are you hiring people? Are you conducting background checks

and stuff like that? So it's, the controls

of these standards are organization-wide, and information security is

everybody's responsibility. It's in some industries

which are a little bit behind the curve. It's

an awakening for them. How do they—

what's that awakening process look like? Aside from being painful,

right? What do they kind of— do they

get a cease and desist letter? Do they get an

RFP or an RFI and they have to fill out sections of

the form where it's like, what's your compliance controls? Like, how does that look like?

How do they go from, we don't need this, to, we really need this, we

need this yesterday? I agree with you. So

in short, I could say that it's a culture that needs to

be developed in the organization, and it's

the top management or leadership that defines that culture.

So as we audit hundreds of organizations through,

through the year in various different sectors, we can see the difference.

Some organizations have a very robust, mature

information security culture, and that is driven by the

interest and commitment from their top management. And some others

are not at that level yet, and it's very clear that the top

management has not awakened, or they are not forcing it as

much through policies, processes, and their involvement,

not just yet, but it's coming to every sector.

Is there, like, an ISO standard for this yet, or

is that in process? Or I know there's like Six Sigma, there's ISO

9000. I know those are different animals, but you think that—

is there a standard like that in the works, or is there already one?

information security, which is organization-wide, we have had

and it addresses various aspects of the organization end to

end, and involvement and

commitment of top management is addressed at the foundation of

the standard. So that's one. But for different

industries, there are specific standards, such as for

automotive, there is a standard called TISAX, which is governed

by a German company, ENX, and it is

tailored to information security within the

automotive industry. At the design level, there's another

gaining momentum in addressing all the current requirements because the

automotive sector is realizing that vehicles

are becoming intelligent and they're holding and transmitting a lot

of data. So information security has to be

considered in the design of the vehicle itself so

that it can receive over-the-air updates securely, for

example. So these are the 3 that, that come to top of my

27001, TISAX, and ISO

21434. Interesting. And

ChatGPT obviously was released to the world in end of

2022, so they probably didn't factor that into. And

obviously it's a fast-moving field, right, this AI

thing, um, as it were. Uh, there's agentic, there's a

lot of debate about this. How long does it take for a standards

body to agree on, like, and coming up with a certification?

And it seems to me like there's a tension between the

technology releasing capabilities and

the standards body taking a certain amount of time to come up with

criteria? That is such a good question, such an

interesting topic for me. So the latest version of

has to consult with a lot of different sectors

to distill the requirements into the standard. It takes time. It

takes time to review it. It takes time to get the feedback and then

finally release the standard. So it's an inherently very

involved process across all of the verticals.

Therefore, it takes time. But you are so right. This field

is changing so fast. The standards need to keep

up with it. So ENX, that

publishes the TISAX standard. They have come up with a

scheme to revise their standard every year,

not at a very large scale, but fine-tune it every

year based on the best practices that are needed. So this is very new.

From next year, they are going to have an annual release of their

catalog, which is called TISAX Catalog, and they are going to

fine-tune it based on the requirements and

best practices in the automotive industry. That's

a good hybrid approach because you want the standards,

you want the standards to change relatively slowly, but you also need them

in this ridiculous pace of innovation, which who knows how long

this might be the new normal. This might just— the AI bubble may pop

and we'll all be like scrambling for the pieces in a couple of

months or whatever the doom people say, right? AGI

may come out last week, if you believe everything

Sam Altman says. So I think

it's a clever strategy because the standards have to be some kind of

baseline in reality, right? It has to be like a true

north, right? It has to be the standards. And by definition, they're not

supposed to change that often, but they also have to adapt. So

that does seem like an interesting tension. And was it I

wonder, I guess we'll see how it all plays out, right? Is

this a good idea or not? It's a

challenge to strike that balance. I mean, anyone who has

looked in their car glove compartment for a

USB charger knows that the struggle, and

that's only between what, 3, 4, maybe 5 different

formats to look for a phone charger. You don't want the

standards changing that much. Right? You don't want— if you're old enough

to have been in this industry long enough, you probably have a drawer of wires

and obscure connectors ranging from the old PS/2

port to RS-232 and

the printer parallel port. Those were standards too,

but you can't— if you have too many standards, they defeat the purpose.

That's cool. What is the biggest challenge that you see in

your customers and in your space about,

do they acknowledge that they need to have some kind of control

around this space? Do they understand the

concept of digital trust? Do they—

I imagine it's a spectrum, but where do you find most people?

Yeah, some industries are more mature than others.

So obviously technology based

industries, highly technical markets, they are more

mature in this area because they see it on a daily

basis. But some other older industries, they are

having a hard time catching up. The progress is there, of course,

but as, as this field grows, and I mentioned

multiple dimensions, AI is everybody's business. Right. If you are

not producing, you're not providing AI, then you are at least using it.

How do you make sure that your employees are using it in an ethical and

responsible manner and not exposing yourselves to any legal

ramifications later? AI technology is growing, models are growing, and

these models— some people say that they are producing wrong outputs, some people

are very happy with how they're using it. Where's the difference? The difference

is that AI readiness is

a metadata problem. Everybody is struggling to make sure

that the data that goes as an input to the model is

correct. It's unambiguous, it's truthful.

Otherwise, you cannot trust the output. Right. So that's one part

of this puzzle. Various industries are struggling at a

different level and meeting the requirements at different level. Of

course, all of this is based on regulations and requirements. So

contractual requirements are telling people what to do. Or

federal or statutory requirements are telling

people. In this industry, people don't take

proactive approach to do the right thing unless somebody's

requiring it. So, European Union, I

mentioned the AI Act earlier. It's a good example, but

you might remember GDPR. When GDPR came through European

Union in the beginning, All the member

countries had a different flavor to implement. They

all had their own individual requirements, and that's how it combined.

Same thing is happening with the AI Act. So all member

countries are going to have a little bit variation in how they

implement and require the AI penalties and

how they enforce it. In the US, same thing

at the federal level. We moved back

from regulations a little bit so that innovation could take place, but then

different states are requiring it at different levels.

So this is a nightmare for a

company that's trying to fulfill the requirements, and they have,

say, worldwide business. They are catering to European Union citizens

as well as they have Asian markets and United States. So

they have to have, like you said, a dedicated

group, a dedicated leader who can ensure that they are

meeting the regulations. And

that group has to have pretty wide authority over product.

It sounds like— I like to put on my optimist hat and my

rose-colored glasses, but I also know that only goes so

far, right? It sounds like there's going to be a lot of

territorial arguments over

this, and I foresee a lot of

internal inside of companies like fighting over this, right? So

I mean, it makes sense. You have to have board-level buy-in on this

to tell the kids to not— to stop fighting with each other

and get something done. Have you seen that happen, or

are people mature enough not to get into these little territorial arguments?

I see different interpretations of this and different

implementations. So in short,

what I recommend to various organizations is that we have to

take all this together. We have data protection,

cybersecurity, AI governance, and

these all need to converge into the

enterprise risk model together. We cannot have separate risk,

risk registers and separate risk analysis for

various different dimensions. So they have to converge

as the overall

enterprise risk function instead of 3

different dimensions that are treated differently.

That way, an organization can holistically address

all of these issues. and move forward in a, in a

continuous improvement, productive way. Otherwise,

it becomes very challenging to merge it all together. Yeah,

I mean, that makes sense. That makes sense. Do you think that

all of these regulations— I have mixed feelings about this because I think

regulations are important, but I think you could make that— I can

go either way, right? Do regulations encourage innovation? Do they

stifle innovation? I think the answer is kind of

nuanced, but I want to get your take on this, right? Because like you said,

no one does this because they want to do it. They do it for compliance

reasons. It's not— it's driven by legal and

contractual obligations. What's your take on that?

It's a question that everybody is struggling to answer depending on which

geography you are in. Different cultures, different countries

have a different balance. Some want to be more

forceful in the regulations. Some others want to let the

innovation run free till we run into certain pitfalls. And

then as a knee-jerk reaction, as a, as a reactive

way, regulations come up. But most important thing

is to have a good balance. Regulations will always come

after the innovation comes. So innovation will always precede.

Yeah, it's What would be your advice to

smaller companies and small founders, right? That they're kind of—

what would be your advice? Obviously, if you're starting a medical

device company, you know you're walking into a

regulatory— I don't want to say minefield, but you know regulations are going to be

part— regulatory compliance is going to be a big part of your workday.

Every day. But what about,

you know, AI startup founders,

right? Like, obviously they— I would imagine— well, I

to be at least in the back of your mind, right? Uh, it's not

like social media had the clean, wide-open spaces for

as long as they did. I think those days are over. What would be your

advice to someone who's starting a company and they think, I

don't need to worry about this regulation stuff?

I see it across various industries all the time.

Clients come with all types of questions and thought process.

Some want to be overambitious and achieve it all, and

some don't really understand how many requirements

would be there in front of them. So in general, I

always say keep it simple. Identify the

minimal set of requirements that they need to meet because it does

not have to be overwhelming to the organization. And then

a continuous improvement process is important.

You cannot reach maturity in the first attempt. So what we

call it as a PDCA cycle, or Plan, Do,

Check, Act cycle. which can have different frequencies

for different standards, but that cycle needs to be in place.

So keep it simple, start small, and then mature

that management system into a highly

mature compliance system depending on what their

requirements are.

Interesting. So it shouldn't be this big scary thing you ignore,

or your big scary thing you're— this big scary thing you ignore, because that sounds

like Bad idea, right? But like, what—

so you're saying that they should embrace it and understand it, don't fear it?

Exactly. Open communication is also important. Many

organizations come to us with questions that, oh, we have this requirement,

but we don't know what to do with it. Of course, we cannot consult

and implement it for them because then we will not be able to go back

and audit it. We show them the roadmap and then they can go

find consultants in the area. figure it out and then come back

to us for certification audits when they're ready.

And is that what your company does? DQS? DQS is

a global organization. We have offices in more than 60 countries.

We have more than 2,500 auditors,

and wherever clients are, whatever are their compliance

needs, we can definitely help them with the certifications.

Oh, very cool. And not just the digital

trust aspect of it, right? Like everything. This is just one vertical. Yes,

that's right. Okay. Interesting. Interesting. Have you

noticed any patterns yet? You know, any patterns of,

do companies, obviously not giving any names, do people fail around the

same things or it really runs the gamut of what's possible?

Like, you know, like, oh, they left credentials out on an

open server or something like that, right? Or is there very, is

it specific? specific to what people are doing? Is this specific to

the industry? Like, are there any common, common, like, if

you had to come up with a list, what they call listicles, like the top

10 things everyone's doing wrong, right? Like, what would that be?

I agree with you. So in different sectors, in

different verticals, we see different weak areas.

And this aligns with many annual reports that you see from,

say, Verizon or FBI, they

issue annual cybersecurity reports, and you see

that people are the weakest point. According to the latest

FBI report, more than 2/3 of data breaches

occur when somebody falls prey to a phishing

email. So people need to be more aware. The security

dimension is challenging as well. It's changing

quite a bit. The attackers now use AI. So in the past,

we could tell a phishing email because of the poor grammar or

misspelled names and the words. But now they're using AI

to automate and scale their attacks in a very efficient way.

So it's a cat and mouse game. We have to make

sure that our employee base, our contractors play base, our vendors

are keeping up to the challenge. So that's, that's one big area.

If you ask me to name the top area, I would say

information security awareness is the topmost item.

It's always the social engineering, the human element that breaks first.

Yes, sir. You know, that it's, it's, I don't think that's

changed for a couple of decades,

actually, you know, in terms of the social engineering aspect is

something that, yeah. And I think you said it like, We need more

education around that, right? I know a lot of companies, they do

intentional red teaming. When I was at Microsoft, I,

you know, I got caught up in, not caught up, but I got, they had

like an internal like phishing attempt. And

because I was looking at the email on my phone, I

didn't see that it was obviously a bogus link. And they, you know, when you

click on it, it says you got caught. Like, was kind of like, it was

kind of like, oh yeah. So like to this day, like if I ever get

an urgent thing, I'm like, All right, I am not touching this link with my

phone. I'm gonna mouse over it with, you know, on my

computer, which is interesting. I think that is also, I know it sounds

stupid and it'll probably sound absolutely crazy, but if phones had the ability,

the phone apps, when you click on a link, you would get some metadata

about it. I think that would go a long, obviously if you know to look

for it, right? Like it would go a long way to stop it, right? 'Cause

like when I did look at the, when I went back to my desktop and,

you know, looked at the message inside of, browser, I could

see it was obviously going to, you know, some bogus site.com or something like that.

But yeah, and the way these are written,

they give a sense of urgency. So you want to— you can't—

it almost is like if you wait until it's too late, until you wait until

you get to your desk, that alone is a flag right now.

I kind of think about that, you know, fool me once, shame on you. Fool

me twice, you know, shame on me. But I

have noticed that some companies will intentionally do these.

And so I think that's actually a useful exercise right there, right?

Because it becomes a teachable moment of this was not—

it's kind of like the broadcast messaging. If this were an actual emergency,

right? If this were an actual phishing attempt. But

you're right, and AI is getting better. And most people, when they hear about how

AI is getting better at these phishing attacks, They think, oh, it's a

3D-generated real-time voice of somebody or

avatar of somebody, but it doesn't have to be. If the

grammar's— if it's written persuasively and the grammar doesn't

look off, that

alone could do it. And that's just basic LLM stuff.

It is. And don't feel like the Lone Ranger. I had to

take remedial training earlier this year because I clicked on a phishing link myself.

So, you know. what you said. It's just,

it's so persuasive, and there is this sense of urgency, and

then you are multitasking so many things, and then you

happen to open that email. Yeah, that's— it's funny. And then

in my current job, there's often the saying of,

if you get an email and it says so-and-so asked

for this, call them up. Because

it's probably bogus. That's the best remedy.

Yeah. There have been a couple of—

I haven't failed a test since the one I was at Microsoft,

at least that I know of. I could have clicked on a not test,

but I think just admitting that you were caught in that,

you had to take remedial training. I got caught up in something and I

think taking away the shame of even smart people get caught up in

because these things are getting better and they're using AI. Right.

And they don't have to mimic your voice. Right. It's funny, the other

day, it was like about a month ago,

my wife texted me on Signal, which she never does.

Right. And she wanted to know the password for one of my accounts.

And I was about to give it to her and I'm like, wait a

minute now. So I called her up.

and spoke to her directly. And she goes, why'd you call me to get this?

And she works in cybersecurity, right? So like, that's her business. I was like, well,

you reached out to me on the channel you never do, and you asked for

a password. That immediately made me suspicious enough to call

you and find out verbally it was you. And at first she was

annoyed, and then she stopped and she's like, no, you're right.

And it's not just the enterprise either, right? I mean, this, These phishing scams can

affect you personally too.

Yep, yep. In, in my family, we have a code. So

if somebody calls with an urgent need for help, we first

have to ask for that code. And this came off a real

incident that happened last December. I was in Austria for an audit,

and my son, who is here in Texas, he got a call saying, son,

I've been in an accident. So he hung up and he called me back.

He said that, Dad, it was your voice. Wow. Frank, your

voice, my voice, we are on the web, so it's very easy to emulate that.

Right. It's that we've given it all the training data and we can't get it

back. Yeah, yeah, yeah. No, I mean, that's a great idea, the code

word. It's funny you mentioned that because one of my

youngest son's daycare, there's this a code word that you have to give

them for certain transactions or certain kind

of like changes to the schedule. And I was like, first I was

like, well, that's unusual. And I'm like, no, that's actually quite brilliant. It is.

Yeah, yeah. Because I can easily imagine somebody's voice getting

cloned. And yeah, I mean, it's,

it's, I would say we live in dangerous

times, but I think The dangers always evolved, right? We're not worried

about Vikings raiding our villages anymore, but we do have to

worry about someone doing some kind of weird crypto scam. Or,

you know, one time, a long time ago, I

had my own server in my house that I had exposed to the public internet,

and I took the password protection off it temporarily, and then I forgot.

And long story short, within couple of weeks, my

internet connection ground to a halt and I'm like, what's going on? And I

did some traffic sniffing and hey, there's a lot of FTP traffic

and I saw my hard drive was getting full and I'm like, what's going on?

And it was basically all these PS2 ROM files.

Basically people were using my open server as a place to pirate

PlayStation 2 games. This was a while ago. So

even I got caught up in that, right? Like the whole

convenience, lack of convenience is a security feature.

And I was, I was talking to some security people on, on the Impact of

the Quantum Computing show, Impact Quantum, and he

said like, if it's convenient, it's not secure. I think that was basically what he

said. And I was like, he's right. Yeah. Ah,

I wanted him to be wrong, right? Because we all love the convenience of

you scan your fingerprint or whatever. And I'm not saying

that's not secure, but having the knowledge of a PIN, even though

that's not perfect, as inconvenient as

it is for it to ask you a PIN every time you want to restore

a password or show a QR code or give it a random number,

semi-random number, it's inconvenient. But that inconvenience

is a mark of security. Very well

said. Yeah. And then Amplified over the whole organization

to convince everybody to make sure that this culture is

required. How do you— that's a good question. So,

so how do you get people to a culture of security?

I don't want to say culture of security, but security awareness. Is it training?

You know, what is it? I

think training and testing both are very important.

So having campaigns to train people with the latest

threats, what are the best practices today, because they

keep changing. Right. And then making sure that that

training took place, that training reached the

recipient. So test them through, like you said, phishing

campaigns or a variety of other means

to ensure that we have enough evidence to show that

100% of the people who have access

to confidential data are aware and have

completed the latest training requirements.

Interesting. It all gets back to people, doesn't it? Or the old

people, process, and things, right? You know, the fundamentals.

As much as things change in the day-to-day in technology, it's just the fundamentals always

come back. You're always going to have people, right? You're always going to

have processes, and you're always going to have things, whether those things

are logins or agents doing things

autonomously. It just seems like there's a lot

we can learn from the history of it, if that makes sense.

Yep. Interesting. We're getting close to

the top of the hour. What would you tell—

what do you tell customers who are skeptical? Because I'm sure you still

encounter that. And it's probably different in different industries, right?

Obviously, if you're in finance or healthcare,

although that's probably— that probably leads to a type of complacency that's

dangerous, doesn't it? It is a

difficult concept for some organizations, right? And

it's just, it's mind-boggling. I know organizations

who have had

scare who have had

ransomware across their whole network,

and yet they do not see the point of why they need to

implement a management system to address information security.

So even an adverse

experience in the past is not sufficient to implement it for some

organizations. Others are proactive, and they want to make sure that

There's no impact to their reputation. There's no financial

consequence. There's no legal consequence. So they go ahead and

implement it. So the culture varies quite a bit.

Have you noticed any patterns of

people in this industry tend to be very much on point,

or is it kind of evenly distributed across that spectrum? Some

industries are more mature than others. I think that if you look at the

annual reports from Gartner or

FBI, sometimes they have these charts depicting different

sectors and state and local governments always come

at the bottom of the list. Interesting.

I guess that's a list no one wants to be on.

But then you're right, like, I guess some people

or some organizations never learn, even if after they've had a breach or after they've

had an incident. Although,

from what I've seen, and I can't share too much about this, I suspect that

there are insurance companies that, I guess, offer some kind of protection

against this. And then part of the remediation, they'll pay out the policy

and you're like in typical insurance, the fee goes up, but you also

have to implement certain very specific training and changes to

company policy in order for you to for them to still

insure you after an incident. I would imagine that that

helps. Folks listening can't see the air quotes,

but I've seen that happen.

Can't say where, but if you use LinkedIn, you probably figure out—

LinkedIn and Google, you'll probably figure out who I'm talking about. But

the— what fascinates me is

the human element of what makes

someone proactive voluntarily and what makes

somebody complacent in spite of the evidence,

in spite of experience. I mean, that's obviously not a technical question, and

this is probably something that digital trust alone

can't— I don't know. It just fascinates me, that human element of what makes

some people and some organizations

overly compliant versus what makes them,

for lack of a better term, complacent in spite of evidence.

I think whoever figures that one out has the next billion-dollar business, right?

Totally. Because you could teach people who are

complacent to a self-destructive degree, you can kind

of hypnotize them or snap your fingers and they'll be

closer to Reasonable. You're right. It's a

complex puzzle. And it's always the people, right? Yes.

Even in this age of AI, this age of data,

people still have the agency to be

stupid or ignorant or willfully— like, there's

ignorance and then there's willful ignorance, right? Ignorance is, I think you can

excuse to a certain degree, but willful

ignorance of, oh, now we had that happen already. It won't happen again.

Right? Thinking that lightning doesn't strike twice. This isn't

lightning. That's true. And then, you know, you have to

get— we have to give grace to people who are working in different areas of

the organization. Some are more technically oriented and some are not.

So it's obvious that groups which are

not more technically oriented, they are not keeping up with the latest threats.

It takes additional effort for them to go read up on what are the

best practices today. That's fair. That's fair. But I, and

I would imagine that the, the

bad actors know that and they're probably being

targeted. So it's almost like an ethical, almost an ethical

responsibility for the organization to take care of them,

right? Because the, you know, what did they say? The, the slowest antelope

gets eaten, right? Right. I think it's, I think

it's ethical for, you know, the, the, the the organizations to

be mindful that they're going to have some slow antelopes, if you will,

right? And you have to teach them how to protect

themselves. That's where leadership or the

commitment of leadership comes in, not just with information

security training and developing the information

security culture within the organization, but also the other question

that we were addressing a few minutes ago. Why are some industries more

prone to getting certifications and creating these management

systems and some others are willfully ignoring it. And that is

also, if I'm allowed to point fingers here, I would point fingers at

the leadership again. 100%. Well, I mean, the leadership's—

leadership in any organization, commercial, private,

anywhere, combination thereof, their job

is to lead, right? And if they don't lead,

things will happen more on their own. Exactly.

The stars are not going to align that things are going to magically work out.

It might every few billion years, but it's not going to happen on a regular

basis. So if you are in leadership, part of

that is you have to take on the

responsibility. I've had this

argument with one of my sons where it's like, well, it's not my fault that

happened. It's not your fault, but it's your responsibility to make sure that

doesn't happen. Right? You know, clean up the mess or do this.

Like, you know, it's not your fault, you're not being blamed, but it's your responsibility.

And I think, I think a lot of organizations have lost the sight of that

in their leadership, right?

Um, one of the things that really changed my mind on

that was Extreme Ownership, and it was by, I think, Jocko Willink, former

Navy SEAL guy. And it's an audiobook. So

Audible is a sponsor of the show. So if you go to thedatadrivenbook.com,

You'll get routed to Audible. You get one free audiobook on us, and I highly

recommend that one. It basically mentions, like, you know, that's where

I might have gotten that line where it's not your fault, but it's your responsibility,

right? So if you take responsibility for things, even if they're not really your

fault, you're going to end up in a better place, right? And I think

organizations have to really take that to heart. They should take it to heart

on everything. Should, right? But when it comes to IT security and, and,

and matters like this, they definitely need to, because if they don't, no one

else is gonna. Yep. All right, I'll

get off my soapbox now. That was wonderful. I'm thinking

of finding that audiobook and listening to it, so thank you for pointing me

to it. Oh, no problem, no problem. It's, it's a really good audiobook. Do you

have any audiobook recommendations, or— Not in this area.

Okay. Very dry area, so— Fair enough.

But there are a lot of good, uh, AI training,

especially. I was just looking at Claude.ai

recently, and they have Claude Academy, which is free for people to

learn how to, how to use AI responsibly

and ethically. That's a good point. I've heard

about Claude Academy, but I've not looked at it. So one of these afternoons when

I have a free calendar hour or 2, I'll definitely take a

look at it. But where can folks find out more about you and

what you're up to? Reaching out to DQS is the

best option. We have a lot of webinars, we have white papers

on our website, and as,

as I gather more and more questions, I am available

for individual conversations as well as group

conversations during one of the webinars. And that's

dqsglobal.com. You're right, thank you for saying

that. Yes, dqsglobal.com. Cool website too.

And you're right, it's not just about

information security. It seems like you cover all kinds of different certifications

yeah, very cool. And now I see how to spell TISAX,

T-I-S-A-X. That's cool. Oh, and it's

interesting because I'm looking at the site and like there's a lot of certifications out

there. And there were things I'd never even heard of.

Yeah. Just ISO has more than 60,000

standards published. And then there are others outside of

ISO. Wow. I'm impressed.

I'm impressed. So definitely check it out, dqs-global.com.

And any parting thoughts?

Thank you very much for having me. I encourage everybody to visit our

website and Feel free to reach out to me with any and all

questions. And we'll make sure to put your LinkedIn profile in

the show notes as well, in case they have any questions directly. And with that,

we'll let the outro music play.