PANEL | Identity in Motion: Navigating AI-Driven Shift in Access and Security Resilience

Excellent. Welcome, everyone. So, as we were putting together some of the concepts for this, we have combined, you know, experience in our careers of, you know, nearing a hundred and ten years. And all of that is Nelson's. So as we're sitting here and Matt and I are getting younger. We have some good topics and we wanna talk about some really good elements about non human interaction. We wanna talk about following AI. But most importantly, we wanna give you an opportunity because this is your time as well to ask questions. So if you do have something, jump out of your chair, run up to the front, raise your hand, do whatever, and we'll include you or just shout from your seat. And as I mentioned, we do have some good topics. Again, I'm Matt Sickles, industry strategist at CDW. I cover the financial and the health care verticals. As my experience is exceeding thirty five years, my very first exposure to identity management was SunOS four one three with yellow pages and this. So going back several decades dealing with the nightmare of coming up with identity. And as we are handed off some of our thoughts, Nelson and Matt are both going to answer a trivia question first to see who gets to go first. Neither of them know what this trivia question is nor what topic it's on. So I'll start it out real quick and then we can jump right into the fodder. Okay? Nelson, Matt. Knowing that there are 10 mammals that cannot jump, seven of them being herbivores, two of them being omnivores, and one being a carnivore, name one of the mammals that cannot jump. Sometimes the simplest, the obvious answer is the I'm gonna go elephant. Elephant. Great answer. Okay. And by the way, the two carnivores, excuse me, the two omnivores are the opossum and the hard shell opossum, the armadillo, and the carnivore, the whale. There you go. You were gonna go for the whale. So, Matt, with you. Gonna jump into the AI stuff. But the reason I asked a fun trivia question like that is, we all have our own ideas about solving identity problems. Right? We know how to fix these issues. We have done this for our entire career. It is convincing everyone else to follow the journey with us. It's getting that institutional knowledge and some of the challenges out of the way so that we can do it. Matt, I know that you have a really good kickoff topic, so give a brief introduction and we'll go from there. Sure. Matt Harper. I am also an industry strategist. Been with CDW for a little over a year now and I'm coming from the energy sector. So I work with our energy and utilities clients across a variety of topics. Obviously, a lot of security topics, artificial intelligence we use into everything. One of the things that that I see that continues to to pop up in what I'll call industrial, so heavy manufacturing, things that start with raw materials and and make power. Identity is not one thing. Identity is five different systems for very different purposes. So a large percentage of it might fall in your traditional active directory environment, might have some kind of IDM tool, might even have some great governance. But then you also have something separate for third party contractors. Something maybe that's customer facing. Maybe something that is is off the record. So the special access for the executive team, things like that. And so one of the challenges we have with aligning our environments to get ready for what's coming next in in these advanced technologies is, you know, for years we've been telling people, you have to have good data, you have to have clean data, you have to have governance models. For years we've been telling people to eat their vegetables and brush their teeth. And how many people are doing it? Not many. And so we continue to see that while some areas of these heavy industrial companies are super advanced, some areas are way back in the past. And so you have this dichotomy of of ready to go and ain't there yet. So Nelson Carrera. Again, I'm a healthcare industries industry healthcare strategist with CDW. And, like my counterparts here, I support mainly healthcare. I do cross into other verticals sometimes because the conversation is very similar, especially when it comes to zero trust and identity. So like Matt just mentioned, healthcare has a lot of the same problems. Health care, there's multiple levels and we usually, we talk to our customers in different in three levels. Right? We have the rural or the small health care organizations, community based. We have the mid size, which are about twenty, thirty thousand employees around that size, and then the enterprise, which are really large. Enterprise, we have less problems talking about identity assurance and maturity because they already are on that path and they have enough resources to support all of the pieces necessary to fill those gaps. But below them, we have a lot of different challenges in the fact that healthcare still doesn't even understand the amount of identities in the environment. When we talk about nonhuman identities, it's not just the agentic coming at us, it's all the the service accounts. So that's all the things that bind the connectivity between all the different third party and other organizations that they connect to. You think about fire. Fire is one of those things that actually send or h l seven. Those are connective, data sources that go to different parties. What are the what are the accounts that are being used there? Normally, they're static, which makes it really difficult in in the age of agentic to protect all of those things. A lot of organizations don't even know what they have from an inventory perspective. So that's an area of focus that we're always talking about is visibility and how do you know what what do you have today? How do you protect it? Right? So we're pushing our partners to kinda think in that in that mode as well until uncover what's unknown, and then you can actually figure out how to protect it. So using AI to our advantage, what are some of the elements that we can focus the energies on? So in health care, we know that the funding has been cut. We're now looking at average losses per annum that are acceptable, minus 1%, minus 3%, and that's going to be acceptable in health care. In financial, they're looking at record profits with some of the new rates that are coming in and some of the burden that is put on the in betweens. Right? It's the full have and have nots. How can AI help us here so that we can take advantage of some of the large language model theories that have come about where agentic modeling can come in and help us identify some of these gaps? You mentioned one of the things about entitlements, and then we also take a look at impersonation. All of these elements in identity are stalwarts. These are the impact that are not going to allow us to do zero trust and no trust compute environments. We have to have an identity for every object, every person, and every device, and that's going to be a big impact. So, Matt, what are some of the things that AI is poised to help us with not get in our way, and where can we take advantage of that? You know, I think there's a number of areas that we continue to to have surface that, you know, some of them are very basic like digital assistance. Everybody has some kind of co pilot that's helping helping them. I think if you if you really put some effort into it, there's a lot of the wasted administrative tasks that can be focused in there. I also think there is a ton of opportunity, particularly in like commodities companies to to look at ways to analyze your portfolio and then maximize the return on the investments you're making with your capital investments based on return that you can start getting a lot more granular because you're not paying an accountant for every turn of that data now. You're being able to run it through multiple times. Certainly, security is a place where, you know, you might not be able to replace people to do the responses and things because that gets to be particularly complex. But you can accelerate things. And I I think one of the big opportunities is for people to not look for the 100% solution, but there's a lot of places where you can get an 80% solution by leveraging AI. Still You're gonna have a human in the loop or as one of the speakers said this morning, human in the room or us alongside. But if we don't start trying it, if we don't start investing in it, just from a capital or a dollar standpoint, but from an attention unit and learning it. I think, you know, there will be haves and have nots that get left behind. And then you've also got the ones that are making the investment and not getting the benefit out of it versus the ones that are really focused on the business outcomes. And then they will do better. So Nelson, with oil and gas right now, you know, claiming the lion's share to the news media. Right? The price of oil per barrel has now come close to $100 a barrel. We're seeing Brent crude come up, and so that is literally hot and cold running money. Right? So we have the refiners, we have the industry that is the investment life cycle. Healthcare is at a disadvantage of this. They no longer have funding. They're operating at a loss, and they're losing a lot of institutional resources that are going away. The money's not there. So what they're doing is they're hopping over to financial. They're going to oil and gas. They're going to other industry. Where can we take advantage of some of these new systems and these systems of record like, you know, AgenTik AI and even generative AI to replace those gaps in well founded resources that are now missing from the rosters in the healthcare space? Well, it's funny. I know healthcare is one of those areas that we think foundationally, they're not really ready for agentic, but when you talk to any healthcare organization, they're ready to move forward 100%, right? Because they're, again, they're looking for those efficiencies. You think about things like the big bill. The big bill was a massive disruptor when it comes to finance and healthcare. And so everyone's looking for an efficiency and everyone's looking to increase clinical workflow, increase rev ops. So they're looking for ways to bolster what they do today and gain those large ROIs. The problem is security and IT are screaming and saying, slow down, slow down, we're not ready. I mean, vulnerability is a huge one, right? We look at mythos and what that did. That was a massive disruptor in every single sector. I mean, healthcare can't, they're still struggling when it comes to just pushing patching, right? Just getting patches out at a scheduled time. Again, healthcare is one of those businesses that are running 20 fourseven. They don't wanna go down. They don't wanna have any outages. And so that becomes a really difficult, it becomes even more difficult now with the advancement of AI because it moves so much faster. Right? The ability to really slow that down is gonna be, it's gonna be extreme. So with healthcare having operational technology, operational medical technology, other industries, oil, gas, and others focusing on that OT basis, we've seen that drive from information technology wanting OT to become more online. But there's risk to that. It doesn't matter what industry we're in, the more that we bring an omnipresent risk and threat to by enabling its access, we're now challenged to be able to get things into a similar same stasis. As we're moving forward to this, are we making some of the right choices, or are we making poor decisions thinking we need to enable these systems, make them more interoperable, or should we just leave them well alone? Great question, Matt. The I mean, I think the answer is both. So I'm seeing some really interesting things being done in with with our industrial clients, with friends and colleagues in the space where they are able to leverage the AI technologies to materially impact, positively impact field operations. Now what they're largely doing is they're largely using that data for decision support, changing set points on things, pressure, pump volumes, things like that. I think one of the key distinctions, particularly in the sectors I work with, is remembering that a lot of these OT systems are life safety systems. And so really understanding what what the well, two things. First is being very specific about what you're unleashing AI against. And then second is understanding, you know, the the myriad of outcomes you could get based on the instructions that you're giving them. But what I'm seeing largely is that that they're moving forward, but they're moving forward in a way where they're largely analyzing data, getting that decision point, and then using more traditional automation to go back and and take the action, the agentic action piece of it. So it's not fully autonomous yet, but you can see the next step very closely. So that human in the loop is really, you know, omnipresent. Everyone's thinking about that. The human in the loop, the human in the room, those are concepts that we can't forget. Right? We have to keep that as one of our four thoughts. And if we're not taking advantage of that, we're going to get challenged. You know, as we look forward to 01/19/2038 at 03:14AM UTC, who's aware of that date and time? The end of epic time, the end of Unix time. Right? We now have buffers that are going to fill up on 32 bit registers. And it's a really interesting problem. Some are calling it the next y two k, and some are saying, oh, it's not gonna be a big deal. Now, in operational technology, how many devices do we have that are counting forward from 01/01/1970? Do we even have an inventory of those devices? Do we know if GPS satellites that are part of the stratum, you know, chain of custody to keep time are going to pay attention to that? These are all great things to look at, but we're going to have to use some of our advanced intelligence, not just artificial intelligence, to be able to pull those together. So with that concept of bringing advanced intelligence, and that's that blend between artificial intelligence and the human in the room or human in the loop. So Nelson, from your perspective, are we seeing across your industry and other industries at least an awareness that there has to be a blend of these approaches so that you are not only focusing on the return on investment, but also remembering that this can be for a period of time a return on expense? Oh, absolutely. I mean, one thing that we're seeing so clinicians are really hesitant with AI, right, in many cases because again it touches the patient. But we're seeing a ton of adoption when it comes to things like computer vision, ambient listening. Right? Those are things that are now being put into every patient room. And again, a lot of that has to have the human as part of that entire conversation. You look at California. Ambient listening is a much difficult a much more difficult conversation in California because right now, they have that two party rule. So they are now pulling these things out of the room or they are turning them off because they have to worry about every single person walking into a patient room. It's not just clinician and patient, it's every guest, every every worker, everyone has to consent to any conversation being recorded. That makes things much more difficult. And so I think AI is absolutely part of the conversation and needs to be injected, and a lot of that's gonna require good security, especially when you're starting to add a lot of different agentic models. Right? I see agentic being one of those things that are gonna be infused in things like patient discharge. So again, patient discharge needs to have guardrails. You can't just give that agent access to the entire patient library, right, because it can go off the rails and essentially expose all of those. During that discharge, you have to just say, here's the patient you need to go through and and complete these routines for or these steps. And then has there has to be sign off from the from the nurse. Right? So those are things that are being put in place, but again, it's kind of a crawl, walk, run model as opposed to here's a model, an agentic model, and go and do all these things. Right? The the clinician part or the nursing piece of this is is really good, right, because it helps with the whole burnout conversation. That's one of the things they need to alleviate from a from a nursing standpoint. But on the provider side, on the clinician, or the physician I should say, they're a little bit slower in adoption except for the, at least on the decision making, right? The decision making, they still wanna have all that power. They will though use it for documentation because, again, they wanna be able to go home at a reasonable tower, at a reasonable time. So I see both AI being well adopted in many cases, but then there is some hesitancy. And again, there's always security in mind when putting these things in place. Yeah. So identity becomes part of your personality. Right? And that persona that you are now putting on top of you yourself as the identity factor. Show of hands in the room. Who believes that they have never had a piece of personally identifiable information breached and is now available on the public Internet? Please raise your hand. Alright. *****, okay. You're in the EU, you don't count. Okay. Alright. So see, EU is perfect and we are still learning, and I get that. Okay. Now, show of hands, and please be honest, how many of you in the room believe that your PHI, your personal health information, has never been breached and has sanctity? Okay? You haven't been to a doctor in forty seven years. Okay. I get it. I get it. That's right. So we all are assuming compromise. Right? And Mickey was talking about that this morning. Assume breach, assume compromise. None of our data is private. If we thought our data was private, show of hands in the room, how many of you have had a hallucination within your world over the last thirty days where you have been talking with a significant other, having have a conversation on the phone, or just having an outright, you know, conversation to the wind and all of a sudden it showed up on your search engine or anywhere else in your technology. Look around the room, hands are up. Okay? This is a thing. Right? Things are always listening. Nelson was talking about ambient listening and the way that the multiple party conversations. Do you agree when you get a smart home assistant that it is always listening? Yeah. Do you agree that when you turn on the I almost said it. You know, on your phone. Yeah. That was close. Right? We could have really had fun with that for a second with a microphone. But if we talk about these things, these are all agreements that we have made in our terms of service and the usage agreements. Everybody remembers the, you know, tall tale and the, you know, urban legend back in the nineties about Microsoft having a terms of service agreement where you send a self addressed stamped envelope and you actually got money sent back. That was real. Okay? That was actually a thing. They used to hide Easter eggs in terms of service just to see who was reading them, to see who would send in an envelope to get, you know, something. And we have now, we just check boxes. Right? We don't even read what we're agreeing to. How many of you, show of hands, look around the room after I ask this question, when you go to the doctor, read word for word, paragraph by paragraph, section by section your privacy agreement notice that you sign annually at your doctor. I do. A couple. Yeah. We're nerds. I'm good with that. Okay. That's totally cool. That's totally cool. So with that in mind, and we're taking a look at all of these threats and where we're coming from here, how is identity and the source of truth for identity going to be reconciled? What are some of the things that we can do right now? What are takeaways that everyone in the room I think the foundational thing that I see in in every role I've started where I've led a team is clean up. The problem is this big. If you can start by making it half that size just by a little bit of hygiene, and then figure out how you're gonna prioritize that. I mean, the the challenge is is the identities are growing faster than the governance efforts that we're putting behind to to to create the structure. I mean, we we started having this conversation many years ago when we were talking about things about like RPA and cloud and getting ready for these technologies where we had this foundational need for good data, for clean identities, for clear permissions. This one's gonna get away from us folks if we don't spend a little time on it. And so I think the hygiene is is the foundational step. I would love to see investment in startups and new technologies. They're gonna come use the technology we're trying to get ready for to actually help us get ready. That, you know, that's kinda what I'm looking for in the market. Now, who's gonna govern the the governance tool? It's kind of a never ending thing, but it it has to start. And I think going back to the point of having a discrete purpose for your agentic, you know, service that you're creating, your agentic capability, I think that gives you a starting point. Let's build all the let's clean up all the things around the business outcome we're wanting so you can start to move forward. You can't just always I mean, we can't be the little Dutch boy holding back the damn forever. It's just not gonna work that way. Find something that allows for progress, meaningful progress, but also meaningful governance. Same question, same takeaways. I agree with a lot of things you're saying. Governance is a conversation we're having with every single customer. And in the past, that wasn't the case. Right? Now everyone is really focused on AI and really what they're focused on is the data behind it. And what's protecting it is mainly identities, right? I see identities as the base for zero trust. It is one of the pillars and I think it's one of the most important. Because really, what most threat actors do today with before AI became such a big threat was they were logging in. Right? And so identity still need to be paramount when it comes to protection. So the maturity of every identity assurance program needs to really move forward. One of the things we talk about outside of the cleanup aspect, is really important, and even as far as like consolidation of on prem DCs, right, things like that. That needs to be done. A federation is a big one in improving the posture of of identities. So we're adding things like identity verification. So add an IAL two or IAL three measure. That's something that we're constantly talking to our healthcare organizations to not only protect the workforce from like a help desk perspective, but also the patients. Right? When they're logging into portals, those portals, I mean, that's where a lot of fraud happens outside of just the theft aspect of it. So verification is really important and making sure you have a good grasp of all of your all of your connective tissue. Like I mentioned before, things like, you know, fire connections or even APIs from a cloud perspective. Also add that rotational aspect of of credentialing. Right? The service accounts don't get enough attention in terms of changing those passwords, adding additional measures. Again, there's a lot to unpack here, but again, I think there are certain steps you can take in that maturity and really understanding where you're at in that journey is important. Okay. So as promised, and you've heard that, you know, both Matt and Nelson have an extreme amount of experience in this area. What questions do you have for them? Let's go ahead and do a little bit of a sanity check. Raise your hand if you feel comfortable about, saying it out loud. I'll bring a microphone to you if you want it to be amplified. Anybody have a question at this point? Not one question. Nobody. Oh, we got one in back. Got one in the back. Alright. I guess my question's about governance of AI agents' identities when we install them using our own identity and they just masquerade as us. Right? So I guess the question kinda becomes, I mean, isn't this a compromised access? Isn't this sharing access inappropriately? I mean, sir certainly, we have policies that govern AI, so I I understand it's sanctioned. But at what point do we bring governance to this model and and understand accountability and auditability and so forth? One second. Yeah. Think I would go on that, you know, to start. I would go back to the point I was making about being purposeful about what you want the AI to do. I equate how how many of you your identity process is, hey, I want this person's access to be just like Bob's access. And that's that's the model you have. Okay. You're you're loaning your driver's license to your buddy and you know they're gonna go out drinking and, you know, it's it's an easy thing to do because you know what your permissions are and you're but I I think it's probably a slippery slope because there's there's a lot of crossover there, particularly in what we saw with, like, Hugging Face. What is it gonna do on your behalf with your permissions? And so I I think I would be very careful and create unique identities and permissions for for, you know, the purpose the business purpose that you're looking for. But the reality is we're we're human, we're gonna take shortcuts, so Yeah. I agree with I agree with Matt on that as well. The other the other thing I would say is treat your treat all these agentic identities as privileged accounts. Understand what they're doing. Use some kind of system that actually does check-in, check out, and do those rotation of passwords. Make sure you have full visibility on where they're going throughout the ecosystem because, again, if you're plugging them into an LLM that has access to some MCP server that now has access to 10 different things, it's really important that you understand what that looks like because, again, it can get out of control really fast. So, again, I would just use kind of one of those least privilege models, and least privilege is always the best thing you should be thinking about when giving access to any kind of identity, whether it's machine based, human based, whatever that looks like. Yeah. And think about layering on observability as soon as we do that trusted platform access. As soon as you have that least privilege model in place, we need to have observability so that we can look at those behaviors and we can now tie those to what is normal, what is the new normal. And if we see a deviation from that, that may be an exception or something that we need to now investigate even further. So if we're looking at these intelligence factors, going back to Hugging Face and looking at the presentation at DEF CON, and now the note that they are being acquired by NVIDIA. I'm sure they all woke up crying with the extra commas in their bank accounts the next morning when that happened. Right? So that exposure of what happened to them in the race condition, and that's exactly what it was. It was a race condition, an unexpected outcome of a sandbox. And this was something that now is a great time for us to learn about. We're getting some of these early indicators of excessive access and compromise. And if you read some of the detail of it in, you know, in basic summary, it said it figured it out on its own. Right? And when we hear statements like that of it figured itself out and it was able to make progress in going somewhere, I think that's a great approach to this, is we have to be very cautious, very careful, and we need to put that extra checkpoint on top of it. We're not doing anything wrong right now, but we have the opportunity to go very wrong. But think about it. We have had very poor practices. We've had bad hygiene in place. And look at all of the organizations sitting around you that may be running an Active Directory that is a result of an in place upgrade from a Windows NT four o PDC BDC. That is a fact. Right? These are systems that are now thirty plus years old in totality. These may be one of the oldest systems in place in a lot of organizations, so we have to be very cautious and careful. Any other questions? I would just add real quick. If you do create a new agent, let the CERC know about it and say I plan on running it from here. It's touching this. Does that make sense from what I'm saying? So that way when things don't look normal, the CERC knows they can shut the sessions down immediately. Does that make sense? Oh, absolutely. No. I I definitely agree with that comment. I mean, that's something that most organizations aren't even thinking about today. So great comment. Yeah. I think you make an important point there because there there's a life cycle aspect to this and, you know, one of the biggest cleanup things that I've done recently was all the guest accounts that end up in your SharePoint and OneDrive and stuff. Those things all have permissions and often, you know, people change roles and you have these all these groups and services and capabilities that nobody at your company actually is a member of the group anymore. It's all the third parties. And we're gonna end up doing the very same thing because the reality is we're gonna have to commoditize the creation of these agents. We're gonna have to commoditize the creation of the identities that run the agents and give them to our citizen developers, to our business units, to things like that. We aren't gonna be able to to be the gate check forever. So learning about that fast, learning you know, fail fast, learn fast, that's gonna be super important. I think managing that life cycle, setting expiration dates, setting some kind of review process on the front end will save us a lot of headache on the back end. I also think that if you take anything away from what you're gonna learn here today and tomorrow, really take a lot of this information back to your executives. Because again, identity is one of those things that are top of mind for everyone in security. I I in one of the last sessions, saw it was a 141 to one machine identities per human. Think about that. Right? That explosion is only going to accelerate if we're not careful. So we really have to understand what we're what we're using all these identities for and how to protect ourselves. Every industry is at risk. I mean, I talk about this from a zero trust standpoint and even I mean, healthcare and, gas and oil have a problem from an IOMT or IoT perspective. And there's all kinds of old credentials out there. Right? Now you either have to figure out how to protect all those all those identities or you have to or you have to wall them off somehow with segmentation. So all of these conversations are happening or going back to the building blocks of zero trust. The problem is we need to accelerate really fast. Yeah. That acceleration factor is now stymied and halted also by, you know, things that we have in our culture. And this has to be a culture shift as well. We've tried that before. We've seen what the impact was when we went down that path. It's not always the popular approach that's going to fix this, and we have to go from our brown field to a green field in some way, shape, or form. You need to come up with an intermediary to be able to find a set of controls that are going to be effective for your organization. I know that when I walk into a credit union that has, you know, $2,000,000,000 in deposit compared to a credit union that has 20,000,000,000, and then an investment bank that has all the money that you could ever dream of putting on a piece of paper. And you know what? They don't have the same problems. And you take some of these problem sets to certain organizations, certain industries, and it's not an issue to them. They don't have these problems because they have solved this so long ago, and their policy taxonomy is so strong. We heard earlier about having policies. We assume the policies are well written, in place, and written at the right level. Well, from a policy taxonomy perspective, that is a policy, a standard, a procedure, and a guideline that is not only understood, comprehended, but well adhered to. You know, Matt, I'll leave this one to you. And are we seeing that policy taxonomy an improvement that is not just preventing AI, but making some of these identity choices for us through good governance and good regulation within the organization, or is it just back to the rote check this box? I think we're I think we're well, again, it's I feel like an attorney up here saying it depends. Or consultant. Yes. I'm learning to be a consultant. That's awesome. The you know, there are organizations that are doing a very good job of of trying to think ahead and plan for these things. Largely, it's defensive still. And and that's where I think it'll be interesting to see it turn the corner where people start getting enough of getting their feet under them enough that the governance and the policy piece is to, you know, to unleash the promise of AI. But right now, it feels like it's a very defensive posture. Governance is a is a dirty word. It's a, you know, it's a roadblock to getting to getting things done. I think there's a couple of things that that I've seen happen. Nelson's mentioned identity as a piece of Zero Trust. How many of you started a Zero Trust initiative? How many say think you have a Zero Trust thing? A few. How many of you started that as an infrastructure project to replace your VPN? Yeah. Almost nobody in my industry starts it as an identity project. And so, now you've got a couple of different problems. You've got zero trust that is not connected to identity anyway. You've already spent the capital that you got for the big infrastructure project, and you still haven't solved the problem that's gonna allow you to adopt the next set of technologies. I think that conversation with whoever leads your infrastructure organization right now or yesterday will will help you get down the road because these things have to walk hand in hand. And then the policies need to be built in a way that that's, you know, thinks not just about how are we gonna stop people from doing things, but how are we gonna make the right thing to do the, you know, the easy thing to do also the right thing to do. You know, how are we gonna minimize friction as we go forward? Because if you, you know, how many there's all these memes where they have a nice sidewalk and everybody cuts across the corner. That's gonna be the same event in this in this journey. So if you can get ahead of that just a little bit, it'll solve a lot of problems for you in the future. Yeah. What I would add to that is education being one of those big aspects that organizations have not caught up, not only from their technology teams, but you they haven't really pushed it out to their end users. In some cases, I see, like, the blocking. Right? Blocking of ChatGPT and all of these things. They cannot prevent users from using AI today. They're doing it on their phones, they're doing it on some other way, and the problem with that, if you if you go into a block first model and folks have to work around it, that's when the data leakage happens. So I would implore everyone here to really focus on educating your end users as to the capabilities of what AI can bring and start to do things like AI hackathons. Right? I I'm starting to see a lot of organizations run like a month long AI hackathon to figure out way use cases that they can actually solve for using specific a a AI or agentic models, generative AI, whatever that looks like, NLP. And so that really gets everybody, the whole community involved in those things, and so education just starts to trickle throughout the organization. And we just got the five minute warning. So, any other questions from out in the audience? Any questions or a topic that you wanna make sure that, you get, answered? I'm running. I'm running. I'm running. It's like SpongeBob SquarePants. You know, I heard you say something about education and I wonder if have a 50,000 person organization and you put them all through fifty hours of training saying, don't click on an email, I bet you I can get one of those people to click on an email. Like, I I I and and so I wonder we need technical controls because you can train people's brains out and somebody's gonna click. Yeah. So you're just highlighting you can't fix stupid. Thank you. That's very good. Matt. It's it's See? There you go. Nelson? I I think the answer is you I mean, it doesn't mean you don't try. The the one size fits all approach where we may we made everyone suffer for a half hour to an hour every year to go through security training was probably not the right way. But then we spent 50 to $100 on the tool to do it, so we have to use it every year till we feel why don't we get a little more focused? Again, find the business problem you're gonna solve with AI or the results of the hackathon. Go train those people. Let them tell the story of why governance is important. Let them tell the story of what the business outcome they got is. Create, you know, create a little momentum with success and then go out. I think the big bang approach on this is not going to work because the distance between the people that are already in it and using it and your lay people who are gonna be laggards and not look at it, the distance between those folks is is growing faster than we can we can try to fix it. Alright. So real quick, Nelson, final thoughts and final parting words. I mean, I I again, I I love everything that's been set up here. I think from a health care perspective and even I I work in higher ed in k through 12. Right? And one of the things you really have to understand is who are you supporting? What are your personas in your organizations look like? Figure out who those are and work your way into getting down to applying all of those security measures that are needed. Least privilege. Again, and I won't say secure them to death because in healthcare, number one, we have the issue of making sure that the user experience is is paramount. Right? Because I I've had clinicians in my past knock on my door and say, hey, it takes me this long to log in. What are you gonna do about it? You're gonna pay me for my time spent? And I'm like, oh, no. We need to fix that experience while we add those security measures. That's why things like passkey and and different IAL measures and giving the ability to move while they while they're secure are so important. But I think this was a great conversation so far. Hopefully, you all are in alignment with me. My final thought would be bring people, process, and technology along at the same pace. We aren't gonna tech our ways out of this. We're it's gonna be a lot of change management. It's gonna be a lot of communication and storytelling. And I remember when, you know, I had a job with people with or they were leaving the job because PCs were coming in. I don't wanna use this infernal thing. It's gonna be here long after us. So make the investment, you know, the the call out for the people. Good process, not over process. Yeah. So is, you know, the final themes and as we're talking about this, everyone's experience and mileage are gonna vary. Right? We all have to come up with something in our organization that meets the lexicon of where you're coming from. It has to fit within the budget, and the technology has to be balanced with that oversight and governance. It is also going to have to be something that's durable because the rules are going to change. And we know that as rules change, we have to adapt. So make sure that as you are making those changes, show your work. And make sure that as we are all going through some of these fundamental challenges, we look at it not only as that expense variable or the investment variable, but what's right to do. All of you in this room are agents of change for this problem. And if we don't take advantage of it right now where it is an omnipresent threat and theme, we're going to be sitting here in the next fifteen years trying to solve for x again. So I appreciate everyone's time on behalf of Matt Nelson, and, you know, grab one of us for further conversation. Thank you so much, and I feel like this has been a good discussion. So thank you all.