We have to apply a mix of different technologies, including cyber technologies, to
begin shaving off our common fool product. Welcome everyone to the Industrial Security Podcast.
My name's Nate Nelson. I'm here with Andrew Ginter, the vice president
of Industrial Security at Waterfall Security Solutions, who's going to introduce the subjects in
guests of our show today. Andrew, how are you? I'm very well,
Thank you, Nate. Our guest today is Leo Simanovich. He is
the vice president and global head of Industrial cyber and Digital Security at Siemens Energy,
and our topic is AI in the energy transition. You know, the
energy transition is decarbonization, AI and industrial security. When we're looking at the
energy transition, then, without further Ado, here's your interview with Leo.
Hello Leo, and welcome to the podcast. Before we get going, can
I ask you to say a few words about yourself and about the good work
that you're doing at Siemens Energy. Andrew, it's great to be with you.
Thanks so much for the opportunity at SEAMS Energy. I leave the industrial
cyber practice and I've spent building I've spent about ten years building this business.
It's been a wild ride a lot has change in the space and we've innovated
brought awesome products to market. And before that I was with a large consulting
firm was Alan Hamilton, where I did cyber risk analytics for large utilities.
Semens Energy has been on the journey. We became a standalone energy technology company
covering the energy value chain as a spin out of larger Semens and we're hyper
focused on the energy transition and at the core of that transition is the need
to decarbonize, digitize and decentralize and that is all enabled by digital technologies and
of course getting cybersecurity right. So we as a company have built a practice
focused on operational technologies and industrial cyber and it is a practice that helps our
customers get a better handle on their industrial cyber programs and it helps them get
a better undertanding of their risk and helps them ultimately reduce their risks. It
is just too important If we don't get it right, the consequences for the
environment but also for operations and abilities to deliver energy or just too great.
Our topic today is artificial intelligence and of course industrial security in the energy transition.
Can you start us at the beginning, I mean everybody vaguely understands the
need to decarbonize. What does you know? What does the energy transition mean
to you and to you folks, For us as a company and for me
personally, it is an existential challenge. We talk about they need to decarbonize,
and the abstract we know that we need to reduce our combitenty for the
print. What does that really mean? Well, we have a world out
there that's pretty complex. You got a bunch of old stuff that is agent
and it's built on fossil generation. You have renewables, and then of course
you have the push to electrify everything. And what that means is that we
have to apply a mix of different technologies, including cyber technologies, to begin
shaving off our cove and for predut so we work with customers to help them
rationalize what they do with their existing fleets and how they can maximize efficiency,
how they can install additional capacity that is cleaner, and ultimately innovative technologies like
hydrogen that are going to be groundbreaking. It's an above kind of it's an
all of the above approach that we need to take to go after this problem,
and it really requires a partnership between us and our customers. So that
makes sense sort of in the abstract. Can you give me some examples.
What what kind of you know, physical technology systems are are you folks working
with? Yeah. The way to think about it is by looking at different
parts of the energy value chain. So there's all in gas, there's power
generation, and then there's the transport and of course distribution of energy. This
oil oil and gas or it's electricity. We play in all in all the
parts of the of the energy value chain. UH in upstream where oil gets
taken out of the ground, we need to do a better job of not
releasing carbon into the atmosphere and there one of the big challenges, of course
is the flaring of gas. The other is what happens with on site power
generation. So our technologies help capture carbon also produce on site generation, so
we're not we're not burning burning diesel fuel. For example, we can install
you know, small small wind micro grids UH that can produce energy right there
on site. We can combine UH an offshore platform with UH with with with
wind together and we do that in the north Sea in in midstream. Of
course, it's it's about a more efficient way of transporting right and delivering electricity
and oil and gas. And there we've gotta we are delivering next generation compression
equipment and ultimately, you know, energy's gotta get to homes, and we
have to have a grid that doesn't lose power as as that electricity gets gets
transported. So we deliver software, We delivered transformers, and we deliver metering
equipment to help our customers utilize their electricity in a in a more efficient way.
So you know, when the sun shines, it's great, and you
know, we we can deliver electricity straight to homes and the wind blows.
But sometimes you know, uh, the weather doesn't just doesn't cooperate. So
we uh, you know, we have capture electricity through storage by applying the
latest and greatest battery battery applications to help capture electricity in using when it's needed
most something that surprised me in Leo's answer. I had assumed that Semen's energy
was all about, you know, the power grid and windmills and solar panels
and and you know it is all that. But the examples that that he
gave here were also in oil and gas. You know, oil doesn't it
isn't found in convenient locations. It's found generally far away and you know,
off the grid, and so you need power out there. So you know,
they're talking about about windmills and solar panels and whatnot out in the boonies
to support these remote installations in addition to you know, all of sort of
the the expected. So it was it was broader than I expected. Our
topic is AI and eventually industrial security in the energy transition. Can you talk
about AI? I mean there's you know, chat GPT has been all the
buzz. I have a chat GPT account myself. I've been playing with it.
Is that what we're talking about when we're talking about AI? Or you
know, is AI a bigger picture? Yeah, you're right, there's so
much hype around AI. For for a very short word, there is so
much that so much confusion that comes with it. I think for your listeners,
they probably know AI as the latest and greatest innovation, which is CHATGBT.
We all use it to ask a question, we all use it to
plan our dinner menus, or to help plan the latest thing, greatest trip.
The reality is that in industrial contexts, artificial intelligence has been used for
some time to do things like help us find the UH the biggest reservoir of
oil out there, or to help us deal with the problem that I talked
about around kind of weather patterns and anticipating what those look like and optimizing the
energy sys them to store electricity. Those applications of artificial intelligence, which is
which is all about control and dispatch of energy, right, have been around
for some time. They've been narrow and very specialized. What's different well with
UH, with scalability of compute which is getting cheaper and cheaper, with advances
in UH large language models, we can now drive optimization in that energy system
which is getting more complex. We talked about it being old, we talked
about it being new, We talked about it being more complex. We talked
about the need for energy increasing, especially in the developing world. Right.
So that's that complexity now needs to be optimized so that you as a consumer
get the best price for your killer whate hour and commercial and industrial companies are
able to utilize energy when they need it at the best rates. Artificial intelligence
can do that now. From a security perspective, AI has a ton of
problems. Italian I've seen an explosion of companies and capabilities all right, and
you know we are the Industrial Security podcast. Can you can you connect the
dots for us? What what are we worried about security wise? If we're
using AI to you know, manage demand, to manage to manage power from
a security perspective, there are two lenses through which we need to look at
AI. The first is AI from a business perspective, an operational perspective,
what is it doing to deliver electricity? But the other is how can that
AI be manipulated, hacked and what can the bad guys do to cause damage.
In the old world, much of energy production was air dept but increasingly
with the need to digitize and drive better efficiency, better asset management, right,
we are seeing what we have seen is an explosion of connectivity. And
some of that connectivity, of course, can can be managed smartly with data
diodes companies such as Waterfall, which have an excellent product, but some of
it needs to be managed in a very different way and this is where atificial
intelligence comes in. The bad guys are using it to craft malware that is
smarter and it can cause more damage. They're using it also to get into
energy systems and this is a product of nation states and makes subtle changes.
Here's what fundamentally, and this is very important for listeners to hear, Here's
what fundamentally is different, how the game is changed. Malware used to be
all about digital manipulation of networks or endpoints. Now physical world commands are combined
with digital commands. And guess what happens when you can create a piece of
malware that tells a determined to spin faster, which tells electricity to flow into
a different direction. And if you could do that at scale across multiple points
in the system, that leads to those safety in catastrophic events that we all
have feared. We've seen something that's come out in news lately with with hackers
getting into the US grid using the latest and greatest malware, which we have
not seen previously before. And I bet a lot of it crafted using AI.
Andrew in theory, I can imagine AI playing an important part in cyber
attacks. But the point that Leo's making there, it doesn't necessarily seem contingent
on AI that one would make, say a highly spreadable malware that causes physical
consequences. Yeah, I mean, you know, back in the day,
this was thirteen fourteen years ago stucks med hit. It was the big news
back then far as I know. You know, that kind of code would
have been written by hand, and common wisdom back then and even today is
that writing that kind of code is very difficult. It takes it takes an
expert, you know, in sort of stepping back for a moment. In
terms of attacking industrial sites, you know, the sort of the common terminology
is there's stage one attacks in stage two attacks. Stage one is where you
get into the IT network with a phishing attack or with you know, a
a fake website or something. And you know, ais like chat GBT have
been described by researchers as a useful tool for generating phishing emails for you know,
for generating credible written content to you know, deceive victims. That's stage
one. Stage two, producing the code that's going to connect to the PLC
and you know, create a new firmware for the PLC that bricks the PLC.
That's has been seen as much harder, and you know, there's research
going on in the space. I cannot name names at this point, but
I have been talking to people in private who are looking at using AI for
stage two attacks. And the question they're asking, is, you know,
bluntly, can a script kitty, you know, someone who knows almost nothing
but knows how to use AI, can a script kitty produce let's say,
stocksnet is the question, and thus far the answer seems to be no,
you actually have to know what you're doing. But the bad so that's the
good news. The bad news is that the research thus far suggests that if
you know what you're doing, AI can speed up the process of creating a
credible stage to attack enormously. We're talking huge advantages for the adversary here.
It's a tricky thing because on one hand, it just seems so obvious that
in the near future attackers will be able to write that stage two now we're
using AI. But on the other hand, at least from what I'm hearing,
and I'm not out in the field every day practicing this stuff, so
I can't say, but AI has been one thousand percent more useful for cyber
defenders thus far. I mean, whether it be anti virus detection response,
what have you. We've been using AI in a way that attackers just haven't
for a while. So the notion that this is some big problem that's awaiting
us sort of. It's it's the reality versus the theory for me, am
I wrong, No, there's there's all sorts of stuff going on, you
know. Fundamentally, in the stage two world, the question is one of
writing code. And there's a huge industry out there in the world for writing
good code, writing word processes, writing operating systems, writing web servers.
So there's a huge industry focused on producing and optimizing AI that will produce code
more efficiently for all of the world's software vendors. And again I haven't been
tracking this, but you know, just to give you sort of one example
a taste of what's possible. You know, I'm aware of you know,
chat GPT has its limitations. Like I said, I've been using chat GPT.
It makes stuff up, it's you know, it has limitations. But
here's the thing. There's a lot of different AIS in the world, and
what we're seeing increasingly is these ais, in a sense daisy chain together.
Now again I haven't done this to a degree, I'm making this up,
but imagine an AI that's focused on understanding, you know, written documents about
you know, PLC communication protocols and turning them into code. And it produces
crappy code, and then you pump that code into an AI who's that's focused
on detecting common programming errors. And then you pump the output of that,
you know, into an AI that's focused on using that knowledge to correct the
programming errors given the original specifications, and you pump that into an AI that's
focused on you know, it's optimized for packaging code into modules into downloadable components,
and you pump those modules into an AI that's focused on integrating the components
into a comprehensive you know, this is happening. This kind of thing is
happening, and these ais are are not static chat GPT is not the end,
it's the beginning. And so in my estimation, the job of creating
stage two attacks is getting much easier over time. So that's scary stuff.
I know, there's a lot of researchers out there playing with the stuff,
and you know, if the good guys are playing with it, you can
be sure the bad guys are playing with it. You know, can you
go a little deeper, what's possible? Your imagination can run wild. But
what we have seen in working with our customers is the use of AI to
develop malware that is frankly smarter, more tune, but that combines different elements
of the attack leading to consequences faster. And what I mean by that is
if you can begin to manipulate a particular process or a particular piece of equipment
above a PLC, right, and you can use do that using digital commands,
and you can combine to your point about kind of using multiple dimensions of
attack, combine multiple processes together, then damage can be can can occur at
a greater scale, and it can occur much faster. Believe it or not,
it's easy to trip a power plant it is and have determined shut down.
There are a lot of safety mechanisms to to manage human error. For
example, it's a lot harder to manipulate a turbner or an oil refinery to
cause a boom event or a safety of that. Right, Tricking those safety
mechanisms is what AI is really good at, because it now is able to
play the chess game on not just kind of a one dimensional level or two
dimensional level, you can play it on a three dimensional level, moving multiple
pieces all at this engine. How are we doing on the defensive side?
What are we doing about this? What should we be doing about this.
The consequences are real, and unfortunately we will not only see more and more
times, but we will see those attacks feature an AI element, and this
worries both customers and regulators that I talk to. They recognize that the playing
field is changing, that this technology in the industrial context again we're not talking
about RGBT UH is accelerating and because of that, we need to get a
better handle on it. So the White House with its latest AI guidance UH
and its cybersecurity strategy had specifically called down the dangers of AI when applied to
industrial control systems. More broadly, there's recognition for UH for better visibility in
better tooling on the defensive side. So the regulators now are saying, you
know what you know. It used to be the cloud in operational contexts was
a was a dirty word how you take operational data APT But if we're going
to compete with the bad guys, then we need to have the same levels
of compute. And so the regulators are now issuing guidance around cloud and emerging
technologies, and specifically the thing that they're calling out and this is we where
we semen's energy have been hyper focused they are calling out the need for visibility.
This is very important because if you don't have basic visibility and understanding of
your environment, then it's very very hard to know a whether you'd be an
attacked, be going after those attacks at speed and then c being able to
recover from them. And what we know for a fact is that AI is
going to increase the speed of the attacks, and we on the defensive se
I need to increase the speed of our response. We just need to play
faster if the threat is increasing because of AI. Basically we should expect most
cyber attacks to become more capable, or expect the high end to become more
capable, and sort of everything trickled down. It sounds you know, I
interpret what you said. Correct me if I'm wrong, as we need our
defenses to become more capable pretty much across the board, and I have heard
recently, I think Sands put out in twenty two you know a top five
security controls for industrial control systems sort of the not here's everything you have to
do, but here are the biggest gaps on average, and one of them
was incident response. It does no good to detect incidents if you can't respond.
You know, it has some value preventing the incidents, but you can't
always prevent everything, and so you need a detection capability, you need a
response capability, and it's important that we get all this right. We've got
to fill in the gaps to make our systems more capable. You know,
I'm putting words inarm us, but is that? What is that what we're
hearing here? We have chased the capability of detection for some time. Our
approach at Semen's energy has been different. We recognized a long time ago that
you need to look both at the physical and the digital worlds together as a
unified threat stream, that there needs to be context and smarter and more proportionate
response. So our our approach has been uh to get out the context you
need to get an operational data. The challenge, of course has been that
when you have operational data, what to do with it. IT teams are
not well prepared to interpret that data to know what's a threat and what's not
a threat, to understand when to take action or recommend action to the plant
operators. So being able to translate between the IT world and the operational technology
world in a way that helps explain consequences is key because shutting down a planet
is very very expensive. And yet the cost of an average industrial cyber attack
and the energy sector, you know, can can be from anywhere from a
million to six million a day. It's a lot of money. And so
we have to somehow plenty this balancing act between taking proportionate response and taking some
response that's informed by operational contents, right, and getting more speed, uh,
and being able to detect and recover. So what else a you know,
we're talking about AI, Andrew and what what does this all all this
mean for AI? Right? And and what it means is that actually AI
is really good at finding the needle and haystack in our world. You know,
we built a platform that has monitoring and detection is really good and we
have you know, large scale models that help detect that that that subtle change
in the process and correlated against you know, your NetFlow data to say some
we see something is weird, but would you do about it? Right?
How can sequential is it? We have to understand how that potential particular threat
could cascade through the environment and at a system level, what the impacts could
be. So and this is where AI can have a really important role to
play because we can look at you know, multiple misfirings as you may call
them, or multiple alerts at different parts of the system, or how quickly
something is propagating. So I can be really powerful in all this context.
But taking the right approach that combines the physical and the digital world together,
right, using AI smartly is key. And yet let me just let me
pause in just a second. And yet we have energy companies, right,
they're just getting basic visibility, they're just getting their asset inventories there, just
beginning to pipe data into into their songs. Well as the bad guys right
have have built a full stack of you know, of of malware factories that
are AI driven. We have to get faster, uh at becoming more mature
around this topic of detection. So Leo has been talking sort of at a
very abstract level here. He's talked about you know, he's talked about finding
a needle in a haystack, and I like, you know, I like
that analogy. We have had other guests on talking about anomally based intrusion detection
and you know, correlation of alarms, uh and using AIS in all of
that. So we've actually had people on talking about AIS but using different words.
You know, if you have I don't know, a gigabit per second
of network packets in an industrial network that you're watching, there's a haystack,
you know, a gazillion package coming by every second, and the AI is
asking the question, are any of these messages? Are any of these patterns
of messages indicative of an attack? And you can do it signature based,
you can say I recognize that message, that message is always an attack and
rais an alarm, or you can do it anomaly based, which is looking
at sort of patterns of messages and saying, this is an unusual pattern,
no idea what it is, raising alarm, It might be an attack because
it's different, because it's unusual. So, you know, this kind of
AI has been used forever. The same thing's been used in SEMs. In
security information and event management systems. In your security operation centers, they get
millions of alerts of you know, syslog messages, millions of messages per day
from you know, one hundred and fifty of your plans, and again they're
looking at this haystack and saying, do any of these messages add up to
an attack? I mean, some of them are obvious. You are under
attack exclamation mark, you know, out of one of your intrusion detection systems,
but others are you know, Fred here just logged in from India.
He lives in North America, and he logged in ten minutes ago from North
America as well, and you can put together, you know, weirdness like
this. So you know, we've been talking about this for for some time
now, we've never gone into detail. I would I would welcome a guest
coming on talking about how the AI under the hood of correlation engines and anomaly
detection engines actually work. I mean I've heard words like Baysian and I have
no idea what they mean. So you know, I'd love to have people
on someday explaining how those AIS work. But you know, the whole the
whole concept of AIS on the defensive side, finding needles in a haystack.
Yeah, this is this has been done for a while, and it's it's
going to get you know, bigger. There's going to be more of this.
So that's a great introduction. You know, we we see the application,
we see the problem. You know, we see some some hints towards
solutions. Let me let's get specific. I mean siemens energy is active in
this space. Can you say a few words, what do you guys have,
what do you guys do? What? What can people call on you
for? You know, in this in this problem area. Well, we
we've been on a journey in our thinking around operational technology. AI has really
evolved, you know, a bit of self reflection. We seemens it was
our pocs that were impacted by stuffs. Now we saw the subtle manipulation of
process and that event was a wake up call for us to get serious about
industrial cyber and operational technology. This was a while back, of course,
a lot of what are the bridge? Yes, we had to get serious
about product security. We hired almost two thousand people around the world to support
US product security managers, folks in incident response, folks that deal with vulnerabilities
and guess what. The world around us at the same time was changing,
and it's changed a lot. It's become more digital, as we've talked about,
it's become more interconnected. We've become more dependent on our customers, and
we recognized that it wasn't just about securing the box. What we needed to
do was secure the operating environment, the whole operating environment, whether it was
our stuff or somebody else's stuff. The customer just needed help and they were
figuring things out at the same time as we were. We just had a
little bit of a head start. So we developed a pract in industrial cybersecurity
focused on this problem with visibility that I've talked to you about. We recognize
that that going after the visibility problem from a technology perspective doesn't necessarily make us
sifferent, because everybody talks about their latest and greatest silver bullet or their best
detection box. What we saw is that there was also a human capital challenge
in this space, that there were enough, not enough folks cross trained in
control systems, in networking, in security, and now increasingly in data science.
Those folks are still very rare. So what we've done is we've built
a business and a practice in this space. What we offer to cause customers
is fundamentally we are the trusted advisor. We don't know, we don't have
all the answers, but we'll figure it out together and we'll be there with
you along for the ride. Because as digital technologies get introduced, as there's
a lot of hype around AI. As the threat landscape changes and the number
of attacks increases exponentially, we will be there as we have for one hundred
and twenty years. And so we've built a consulting practice, a managed service
practice. We built the proprietary technology around detection, but ultimately what we do
is we build bridges between IT teams and O team teams to work with one
another because IT is going to take that into disciplinary approach and we hope to
be in the center of it helping in the customers. We've talked about the
problem, We've talked about some solutions. If we're starting at zero, I
mean, we've got an energy customer. Do these customers know how much AI
they're using? Do they know how much AI is coming after them? You
know? Do they know how much trouble are in from both ends of it?
And you know, whether they know it or not? Sort of what
are the first steps? How do they get started dealing with this this new
threat A There's a lot of hype around it, and I think there's general
awareness within security teams, both on the I T side and the OT side
that AI holds a lot of promise but could also be used for very very
bad things. On the OT side. In particular, I said, there's
a lot of skepticism. And the reason is is because plan operators need to
uh uh be able to unlock the black box that AIRE present. They need
to understand it. Maybe it's an engineering approach and engineers need to kind of
understand what's happening. You need to be able to understand the methods. You
need to be able to kind of trace the logic. And so when I
talk to security folks within plants, they're they're skeptical of the latest and greatest
tools, and they want to know, how do you detect something? What
is this basian belief? It sounds very fancy, But if I can even
do the basics, why should I go after this problem? So there's both
skepticism and desire. And there's one more thing, which is the chief digital
officers, chief innovation officers. The boards are telling security teams you got to
you got to give me use cases around it, both from a business side
and the security side. And I know some customers that need to deliver a
use case a week to the board. That's how closely it's being monitored.
If you think about that, you know, so sleepy giants are that have
been doing things the same old way, extracting pumping oil all the ground,
but the last fifty years the same old way are now being called to innovate
in this space. And then there's kind of the middle of the pack,
folks that are that fear they're going to be left behind. And then there's
the small the small guys. And by the way, those are represented.
If you look at the United States right, thirty five hundred utilities, once
you get outside the to top two hundred, everybody's small kind of mom and
pomp community distribution facilities, power plants. Those folks you don't even know how
to get started. And to get to your question of how you get started,
I think the basic question that one should be asking is first and foremost,
what is important to me? What are the assets that are key that
I need to get a handle on be being able to understand the risk,
understand the vulnerability, understand the exposure, monitor it, and then build an
AI layer around it. And by the way, those two things are very
closely correlated. The assets that are really important to be monitored, assets that
could benefit from applications of AI, assets that attracted the back guid and assets
where a security AI use case is really valuable. So the first step is
asking what's important. The second step is figuring out what data needs to travel
to be able to get a basic context. And then the third step is
the step that I call kind of advanced detection, where AI needs to play
a role in understanding not just basic characteristics of a particular process or a particular
asset, but kind of three dimensional behavior of production, right, and the
manipulation of that to cause that boom event that you and I Andrew talked about.
So Leo, this has been enlightening, a little distressing, but enlightening.
Thank you for joining us up. Before we let you go, can
I ask you to sum up for our listeners. What what what should we
be taking away from all this complicated space? Well, first of all,
it's not all doom and gloom. There's a lot of anxiety around this top,
but it's definitely a journey. There are trust to partners that can help
you don't get wrapped up in the hype and the chase for the use cases,
just because the board is asking take a more measured approach to get a
basic handle in your environment. Hey, I will come there. There are
steps that you can take both around the business side, the operational side,
and the security side to to measure where the AI can benefit you. It's
not the it's not a down the line thing. However, most folks will
say I'm not mature enough and therefore I should not dabble in it. The
reality is this technology is getting too good and the gap between the defenders and
the attackers is really widening, and so time short. So don't wait to
get you know, other aspects of your OT cybersecurity program n begin to dip
your toes into this space. Start by building some of these detection models.
Start by picking assets that are important to you and getting a better understanding of
their behavior. And then ultimately look out for the regulation that's coming down the
pipe and work with your suppliers to make sure that you can demonstrate that you're
taking smart steps to better prepare yourself for what's going to be an exciting future,
in one where I think ultimately good guys will win. Andrew, that
was your interview with Leo Somanovic. AI is a big topic in cybersecurity everywhere
today. Do you have any final thoughts about the subjects To close out our
episode. Yeah, I mean, you know, thinking about this a couple
of things. One is that you know, historically, five years ago,
AI was sort of the anomaly. There was a little AI and the detection
algorithm. There was a little bit of AI sprinkled here and there. Increasingly,
you know, AI is everywhere, and you know, in the industrial
space, I think we all need to get used to the thought that AI
is our future. You know what is what's the number one investment that people
make routinely in industrial processes? Well, you know that engineering teams make routinely,
they make investments to make the process more efficient. One of the ways
you make processes more efficient is that you make decision making about the process more
efficient, more accurate, more effects the faster. I think AI is essential
in that process. AI is going to be essential to all of us to
be making our processes more efficient. And this is just on the you know,
the the in a sense, the mechanical side, just you know,
doing things on the cybersecurity side, you know, the bad guys, I'm
sorry, they're investing in making their attacks more efficient as well. And so
on the defensive side, Yeah, we've been doing stuff in sort of intrusion
detection for a long time. I think we need to get used to We
need to invent ways to use AI to make our defenses more efficient. Everyone
is, you know, bad guys and good are using AI to make everything
more efficient. I don't think we can ignore this anymore. I think this
is you know, this is this has to become sort of the common language,
the common wisdom of the space going forward. So, you know,
I'm grateful to Leo, and you know I look forward, fortunately or unfortunately
to you know, thinking about AI a lot more in the years ahead.
Yeah, it feels like a topic that we might have more episodes about in
the next few years than we have in the past few even though we have
covered it at times. Anyway, thank you to Leo for bringing that up
with us. And Andrew is always thank you for speaking with me. It's
always a pleasure. Thank you, Nan. This has been the Industrial Security
Podcast from Waterfall. Thanks to everybody out there listening.