Submit Podcast or Channel

Black October! What Is Happening to the Internet? | Hari Mulackal & Odysseas Lamtzidis

October 24, 20260 comments♥ 0
00:03 They're calling it Black October, the worst month in cybersecurity of all time. There's Armageddon on the internet. We're going to figure out today whether it's really all that bad or not. Joining me on this stream today, we got Hari, the CEO of Cantina Security. Hari, welcome to the live stream. Yeah, thank you, David. And joining Hari as Odysseus, CEO of Filix. Odysseus has been on the podcast before every time there's a security conversation.
00:30 We tap in Odysseus. Odysseus. I would say good to have you back, but actually in these circumstances, maybe not. But either way, good to talk to you, my man. Yeah,
00:40 thank you so much. Okay, so I want to learn a little bit about what your guys' last two days have been like. You guys are both security experts. It's the worst week of cybersecurity, apparently of all time.
00:54 Are you guys busy? What is it like to be in the world of security right now? Hari, I'll start with you. as I'll give you an answer that you're probably not expecting, which is, I think the public incidents have been like very alarmist. People hear about all this incidents in the public. But the reality is that this has been going on for the last, I would say, 18 months.
01:18 The number of incidents have been going up by a lot. Many people do not report incidents to the public. It's just that, you know, with the Ph.P. one, with some of the healthcare ones, you know, it's a big story. And so taking a step back, like we started seeing that agents and alums were starting to get really good at cyber last year. So back in, back in I would say, February, we started seeing this change. And we started seeing both offensive and defensive actors starting to use this new found capability to build products and also to disclose security issues. there was an uplift in cyber ability around January
02:01 where the model started getting very good or the economics was cheap where now you can blast it on many companies and make disclosures. We did that a lot starting this year. This year is just right now just a tipping point where many companies are starting to show up in news. This is nothing new for us.
02:21 The last few days, like we alerted a few of our customers with the PSV incidents because we had products that would enable them to scan their service area. So nothing new to us just because we have been seeing this for the last 80 months. Nothing new to you guys. But nonetheless, something just feels different in the last week. Maybe it's a little bit of what you said, Harry, of just the Twitter phenomenon of casting Doom upon something,
02:49 like inciting Doom is very viral. So maybe that's what's different. Odysseus, what would you have to add? to like why this week feels so different than the wins previous? I think it's the tipping point is as Harry said in the capabilities. Like probably we saw last year with a lot of social engineering attacks where the deep fakes was the first like big changing capabilities. But that was like more targeted, I would say.
03:16 And crypt obviously was a great target for that. And now we're actually seeing that it's actually very cheap to like blast that on the internet and just scan everything. everything. So security through obscurity is like breaking down in, you know, real time right now. And that's what we're seeing. I've got this tweet from somebody who works at Anthropic, Anthropic security researcher person who says, as bad as things have gotten in the past four days, they are going to get a lot worse before they get better. Security leaders never let a crisis go to waste. Please go to your boards and ask for help right now. Is it going to get?
03:55 get worse? Is this just kind of just like the first time it says emerged in the public like ice and actually this is going to escalate so next week or next month will be worse than October? Hari, what do you think? Oh, absolutely. So with a lot of the
04:11 AI capabilities it's like there is this exponential where either the capability or the cost keeps going down. So every time you have a the capabilities are already there. It's not the economic.
04:25 How do we do this at a scale or, you know, so cheap to like 100 on every website. It's starting to, this is like starting to inflect or the same thing that we could do like in January, it's like now 15 times cheaper, like 15x cheaper. Like that's our internal like efficiency gain.
04:42 And this will continue to like get 10x cheaper in every 6 to 12 months. So the way to think about it is that the scope has gone up where hacking in the past was a bespoke skill. So to hack a company, you needed to have a lot of talented people that would then spend weeks, months, maybe years trying to hack a company, and then you need to have profit at the end to hack it.
05:08 So it was never scalable. Hacking has now become scalable, where you can build a factory where you can give it a website, you can give it bankless.com, and we'll go hack it. You don't even have to think about costs, because it will cost like $10 as opposed to like, two weeks of human time where now you need to think about R.O.I.
05:28 What do I get from hacking banklers? So right now, the unfortunate reality is that you can build a factory that will like churn in exploits and no humans need it and the economics is falling to zero. Yeah. And I think this is also why now the attention is turning away from
05:48 crypto and like just in, you know, broad web two because before in crypto It was a very clear target, right? If you had something, it was a very clear money to be made at the end, right? So the economics made sense there, and in Web 2, it was like more difficult, right? It was not clear how you would monetize. But now that is actually so cheap, you don't need to answer that question.
06:11 You just do it and you'll figure it out at the end. Well, you guys aren't really reassuring me in any particular way. This kind of sounds bad. Maybe we can start trying to talk about the scope of the actual harm being caused here. Because it's a little bit confounded. There are a ton of vulnerabilities being found and disclosed. That's not inherently bad.
06:35 There are some exploits actually happening. That's bad. But they're not exploits like crypto, where if like a crypto exploit happens, people lose money. So that's also not necessarily what's happening. It's kind of muddy as to what's going on. How do we understand or measure the actual harm that's happening right now?
06:53 I mean, at the end of the day, like, what is the value of data? What is the value of reputation? What is the value of money? And all of some are getting targeted today. So if you have valuable data in an application you're using, like maybe your dentist. Maybe your dentist has information about you that you don't want to be on the internet. Or maybe the dentist doesn't want to leak their customer data because it's liability. So what's happening is it has become so cheap to hack these companies that people,
07:25 would just do it. And the way to make money is often by threatening these companies, I will breach your database if you don't pay me X, Y, Z money. And that has become a scalable cybercrime motion today. So in the past,
07:42 you have to think about cyber crime as a business. Like, you know, these criminals need to make money. And these criminals need to make money, you need to have scalable unit economics. So in the past, well, crypto was a big target because the money at the end was very high.
07:57 Like North Korea found up their missile program, nuclear missile program with crypto hacks because there was a lot of money to be made. But if you hack a dentist, there's not much money to be made. And the resources that you need to hack a doctor or a healthcare company was so high that the ROI wasn't there. And the highest ROI in the past was fishing.
08:18 So you find a way to get past your email filter, your message filter, and you just blast millions of emails, millions of messages, and out of the million people, maybe a thousand will click at it, and maybe out of the thousand, like 100 of them would give you data that is now worth threatening them. Now, the same threat actors are now shifting to hacking, or they are using zero days that they find zero days that are out there
08:46 that are not getting fixed by companies to just scalably hack, and now they have data, and with that data, they can chat on the company, I will breach this if you don't pay me, you know, XYZ money. You've seen that across the board, that is going to keep increasing. So there is economic value to it. And even at a, you know, bigger political level, you know, if you just think about if the database of like JPMorgan is getting leaked. I'm not saying, whoa, just think about it at a political level.
09:14 That is going to be a political catastrophe, like if the entire, like, some of the largest banks in the world have their, you know, records leaked. You know, you can think about the second and third order effects. Like that would change the politics of that country because, you know, that is exposing people's finances. So there is true economic damage to these incidents. Yeah. And I think a very easy-to-grog example is how leaking databases like that of, you know,
09:51 ledger back I think in 2021. or other databases were actually linked to, you know, the rents attacks, right, where you identify who are the high net worth individuals and then you go after them personally, right? And I think that's like part of why it's hard to quantify because the second and third order effects is not always obvious the connection. That they found this data and then they connected with other data
10:17 and then they were able to perform a personal attack to exploit, you know, millions, either in crypto or some other valuables. So the main thing I'm hearing from you guys is that data is going to be exposed. And honestly, if you asked me about, like, if you asked me before all of this, if you asked if my personal data was out
10:35 and available on the internet, I would probably say, yeah, it probably is, like statistically speaking. So I'm not, me as an individual, I don't know if I'm more worried about even more of my personal data being on the internet because it was already like that.
10:50 I take the point that, like, J.P. Morgan doesn't want its data out there and it's a company that it needs to protect. So its concern is to protect its data. And then, you know, most companies' concerns are about its data. But me personally, the individual, I'm care less. Is that resonate with you guys? How would you respond to that, Harry? I mean, that's a great question. I've heard this objection from other people. But I do think, like, there are multiple things happening at the same time that this time it's truly different. We build an AI product. We built an AI security product.
11:25 And one of our AI engineers he did this demo to somebody in the office, which is he asks us JetipT, tell me everything it knows about him, this person's Jetipete. And then it listed out information about as compensation, who their romantic partners are, a lot of deeply personal information
11:49 about this individual that when he read that he was shocked how much his AI agent knew about him so I think this is like truly different where people are giving a lot of data to the new products and
12:04 agents will then use all this data together to do malicious things for you like you know if if an agent had access to day with all of your data like it can now do things that it couldn't do in the past, you know, in the past, somebody still had to, like, look at all this leaked data,
12:23 understand, like, how can, how can they, like, you know, do something to David with that data? And that was too expensive. Now it's, like, prompts, like, hey, here is David's data. I want you to write this precise email that will make him, you know, do something that, you know, he otherwise wouldn't do. And you can now scale that to millions of people. Yeah, like, I think, yeah, like, I very, I think, I think, I think, I think, I think, I think, think we've seen recently is the elder scams, right? When they call elder people and they say that, you know, your son or a relative is like in police custody or, you know, they owe money in the taxes or whatever and that they
13:05 convince them to give them money. That's something we're seeing. Right. So now imagine that they can do that in a way that is 100% believable because they have all this information about you. and they can convince millions of people, billions of people who are not aware of what AI is capable, so they're more gullible,
13:26 and they can convince them to, you know, exploit the money from them, right? At the scale, there is industrial for the first time. I've been trading crypto for almost a decade, and I've used so many different wallets, exchanges, aggregators, or front ends, and I'm basically always looking for the same thing, just one interface with a deep liquidity
13:44 across a bunch of chains and assets where I can access market. like perps, earn yield, trade confidentially, and still control all of my funds. And I've never really found it, and I'm just always switching wallets, juggling, gas fees, or getting eaten by slippage. But neer.com feels fundamentally different to me. I can do anything I want from any chain and keep all of my activity confidential. Crypto, tokenized assets, perps, payments.
14:06 I can even earn yield confidentially. One account over 30 chains, confidential by default. It's the way that crypto ought to work. And it's powered by NIR, which has moved over $30 billion, cross. chain uses post-quantum signatures and has run over five years on mainnet with zero downtime. NIR.com is the best way to be on chain and be in control. Get 20% of your trading fees back on NIR.com using the bankless link and the show notes, not investment advice.
14:31 Dollar stable coins taught Latin America how to store value on chain. Ripio is taking that same idea and bringing it to the currencies people actually use every day. With wrapped fiat, Ripio is putting more than a decade of experience powering crypto infrastructure for leading companies across Latin America behind a suite of six, local currency stable coins covering Argentina, Brazil, Mexico, Colombia, Chile, and Peru. Each is pegged one-to-one to its local currency and fully backed by reserves held in regulated financial institutions with independent attestations published for each token. But wrapped
15:00 fiat is not just designed to sit there, it's built to move. The suite is live across 10 EVM chains with liquidity and integrations already spanning platforms like Morpho, Uniswap, and Chainlink. Users can move between local payment rails like PICS and SPA and matching wrapped Fiat one-to-one in real time with zero fees on both on ramps and off ramps and no FX conversion. Local rails in, on chain in the middle. And for builders, Ripio offers APIs, webhooks, widgets, and a sandbox just from day one. Start building with wrapped fiat today at platform.rippio.com. So it sounds like the default scenario moving forward is that everyone's records,
15:39 individual records, my health records, I don't even know where my health records are who has them, but they're going to be made, you know, exploited and made accessible to the internet. And that's kind of the default for just data broadly. It sounds like the default path, the assumption that in a short order here, most data will be made exploitable, vulnerable, and accessible by like open weight models because the internet has been built on sticks and duct tape. And now we have AI breaking all those things down and so data is now just free on the internet. Is that kind of the default future that we have? That is a worst case. Like that's what's the worst case. Okay. Prevent. Like, look, I don't want that to happen. I want your data to, you know, be only with the people that you want to have access to.
16:29 Okay, so we're not there yet. So the Armageddongetta on the internet has not created that environment. That is the trajectory that we are going towards if we do nothing. Correct. Okay. Okay. Okay. How much time do we have before that happens? So there is this, you know, fun way to think about the time. It's often called like zero-day clock. So how long do you have until you need to fix zero days in your environments? And in the past, it would be like months, years.
17:02 So you had time to fix these issues. These days, the zero-clock is negative days. So that's what it's The clock has hit zero and you are on borrowed time in this present moment. Correct. So you, if you are a company that has customer data,
17:20 you know, repetition worth protecting, money worth protecting, you need to act today. You need to have acted like six months ago, but the best time to act is today. So you are living on borrowed time. Otherwise,
17:35 like it's almost irresponsible. Like you have a duty to your customers to protect that data. Yeah, there was a tweet from Nikita Beer that I like that says that even your company, your engineers are mentioned as IT department. You don't have to worry about, you know, security incidents because they have already happened. I'm looking at a chart here from a Zero X Osprey. Can you guys just kind of walk me through what we're.
18:07 looking here on this chart and why it's significant today. This is a great chart to showcase like what we're dealing with. So if you have a software, there is a way to disclose to the public that, hey, there is a vulnerability in the system. So anyone using the software or as a dependency, they can fix it. So these are called CVEs. So like vulnerabilities in your system that people are disclosing. And oftentimes the next step is, oh, upgrade your packages because, you know,
18:37 we have the CVE in the system in this version. This is a chart of like the cumulative number, well, the CVEs that are getting published like I think every day. And there are databases that publish this. Oftentimes it's very common in open source projects. For close source projects, it's a lot limited. They don't necessarily always talk about it. But companies like Apple will always assign a CVE for important fixes in their software.
19:06 So this is a chart. And as you can see, it's becoming exponential lately. You can see that there was a jump a year ago. That's when the capabilities started emerging. Right now, there is clearly like a delay in disclosures. So a lot of the changes we're seeing, those were initiatives that started like six months ago that are now showing up in the public.
19:31 But what's really happening is that the cost is going down. So security has become an economics problem. like you can convert a lot of cyber risk into what is the cost of doing this hacking and that is going to zero which means like number of facts are going to you know infinity yeah
19:51 and also I think we're because of the speed of like how is this to identify vulnerabilities in the past you would say okay we found something and then you would give time for people to upgrade and then you would disclose it but now the moment you say
20:07 something exists and somebody can just point their agent to, you know, P. HP and say, find me the vulnerability. And now they can, right? So it's, you don't have the space to allow people to upgrade. The moment that people are informed that something is possible, they can immediately like go after it. Yeah, yeah. So if the listeners who are listening to this on the RSS feed, we're just basically looking at a chart that is mostly flat and then it slowly slopes upward and then it goes vertical. And I think what Odysseus and Hari are saying is like it's also vertical, but it's vertical but lagging.
20:46 So today it's even more vertical than the vertical that we see on the screen. The only, humans can't keep up with this. The only way to combat this is with AI. And so our AI defense has to go, it has to be faster than AI offense. So the defenders have to be moving as quickly as or fast. faster than the attackers. Is that feasible? Can we do that?
21:10 Where is the balance of power between offense and defense these days? That's a great question. And unfortunately, for the next, I would say, 12 to 18 months, it's going to be largely dominated by offense. So the best way to understand what you need to do is to attack yourself.
21:31 And so in a safe way, attack yourself from, the external surface as of like an attack or word to attack yourself. And we have a product that does that. So we have a product called Apex. It's an offensive security agent. It can take in your websites. It can take in your source code.
21:48 It can take in any information that you have. And it will simulate an attack. So we'll try to attack you, show you like all the ways it wanted to breach you. And the best thing you can do is fix all the ways that it finds to breach you. So that's going to be a lot of the work next to online. Attack yourself. fix the things that it finds. But I think there is a
22:08 silver lining here where you can now, you know, what's happening with software engineering is software engineering is becoming almost like a, you know, industrial where people talk about software factories now as opposed to like people,
22:24 you know, writing software in an office. Software is getting built in factories today. What's going to happen in the next, I would say, two years would be security will also make a similar ship. like we will have security factory for every company so it's constantly looking out for ways to breach you but also like proactively finding ways to fix the breaches
22:45 but next few months next 12 months attack attack attack fix all the things that it finds make it extremely expensive for the attackers to attack you by attacking first and fixing all the findings if the cost to attack you is like a dollar like you will get attacked like make it like 10,000 thousand dollars and most people like would not attack you uh most people are not going to spend $10,000 scalably to attack a random company they will spend a dollar and that is a given.
23:15 Interesting. Yeah. Yeah. Amazing product we were using it at the file likes as well. We're very happy. It's very impressive. Um, but I think this highlights also something that you know why I think it will be you know 12 months as harry saying or more is not because the capabilities don't exist like products like Apex exists. You know, we're a startup, we're using it. We don't have any bureaucracy. But in big organizations where humans and bureaucracy is the bottleneck,
23:44 it will take a lot of time to adapt to that. And I think that is why it will take so much time for all these things to be fixed. Because suddenly, you know, crypto was always the dark forest. And we were, you know, grew up in that environment. We evolved in that and we understand that. But the internet was never a dark forest. Like security through obscurity worked. Laisiness is a human attribute.
24:09 And suddenly, you know, within a few months, now the whole internet is a dark forest. And organizations and people are not used to that. And suddenly they have to, you know, you have a tanker, a huge ship and you have to turn it while you're being attacked by small speedboats. No bureaucracy, right? Mm-hmm. I would say, like, that's a great point.
24:34 Probably like a very fast and drawn, very cheap drone. That's like the way to think about it. You know, you have this machine and the swamps of agents that are cheap are coming for you. And I wanted to, I think, I think Odysseus touched a very important point, which is like, most people remember, like, the crypto hacks from the 2020, the 2021 era were every week there is a big incident. and somebody lost $100,000. And people would always make fun of the industry for being insecure.
25:07 But the reality was that the entire software industry was insecure. It's just that crypto had very high incentives for people to hack. It was the economic variable that was different. And also everything was public. Correct. And now the economics have changed. And, you know, welcome to the 2020 crypto where you see like a big incident.
25:30 every week. That is a new reality for the real world. And in some way, like, you know, you have moved through this in a different era. My spinal reflex is to, like, look at crypto and be like, yeah, this is bullish because this is the environment that crypto was born in. Like, this is, we are home here. Like, you guys, you know, non-crypto securities, like, you are in the room with us now. And we were raised in the darkness, you know, something to that effect.
26:00 I don't know if that actually means that crypto prices go up, but it does make me feel some sort of comfort that like blockchain systems were born in adversarial environments and now the world is an adversarial environment. Is there a more bullish take than that? Or is that about as bullish as it gets? I think you hit an interesting point where, and I always tell people like, you know, we are a security company
26:29 and our job in the past was to secure money And securing money is the hottest thing in the world. It's like fucking insane. With maybe the sole exception of like government to government cyber, which is a, you know, all different industry. And if you are in this like circle of like protecting money, like this is like easy. And so it's now a lot of the job is a scale.
26:54 So how do you make sure that every single company on the internet can have the same level of like protection that some of the largest crypto companies have. That's like one way to think about it, but also the large companies in crypto, they also need to invest. Nobody's...
27:12 Only the paranoid survive, and like you need to invest in cyber today across the board. But I do think there is a, like, philosophically and... From an operation perspective, like there is a competitive advantage to companies that were built
27:28 in this, like, really offensive, of unwindement, that has become commonplace. So that was going to be one of the questions I have, is like, what about my crypto that I have stored in Coinbase? Like, is Coinbase vulnerable here? And I guess interpreting your answer is like, well, they are vulnerable in the sense that like the cost to attack has gone down.
27:48 That's true for Coinbase. Like the economics of that doesn't change. But the Coinbase incentive to defend has been way higher for a lot longer. And so, yes, Coinbase should be concerned. but their starting point is fundamentally different. And so my money in Coinbase is probably not any weaker today than it was a week ago or a month ago, but also nonetheless, it is still up to Coinbase
28:11 to be very on the ball with advances in security practices. Yeah, I would lean into that. Like if you look at, let's say, Coinbase and JP Morgan or like a large financial institution, in some way, Coinbase is better prepared to offend. and your bank. And people often assume that, you know, the traditional financial institutions
28:37 don't have to worry about cyber risk because you can always, like, pull back money. That's not the case. Like, you, people build payment rails and abusing their payment rails are like there's real risk at place. And if you study North Korea, before there was
28:57 internet banking they have found exploits in ATMs and they used that ATM exploits to withdraw money somebody gave this example where they found a way to exploit target gift cards and then they were able to use the gift
29:14 cards to get money out of the system so in some way like the legacy companies that never had to worry about this intense cyber pressure they are more at risk than the Coinbase and I know the Coinbase team pretty well, they are preparing.
29:32 They need to keep investing in cyber. But your money is safer in Coinbase than target GIFCODS as of now. I hope that was always true. Bankless Nation, we've built something for you. Introducing the Bankless MCP. Chat ChbT and Claude are great at a lot of things, but ask them anything beyond the basics of crypto
29:53 about protocol mechanics, tokenomics, or just what happened last week in crypto, and the gaps will start to show. The problem is context. Bankless, on the other hand, has spent almost a decade building one of the deepest archives of crypto data anywhere. More than 2,000 podcast transcripts, 10,000 articles, and countless conversations with the people actually building this industry. And now we've structured all of that data into the bankless MCP.
30:15 So you can go and connect it to your cloud or chatDBT, and suddenly your AI can answer your crypto queries with the entire bankless archive behind it. And every new bankless article or episode gets added automatically so the context keeps staying up to date. The bankless MCP is exclusively available to bankless premium subscribers. So you can go to bankless.com, upgrade to premium, and connect the MCP in just a few minutes. And all of a sudden, your crypto queries to your AI, LLM, whatever you use, we'll get a thousand times better. So go check it out. There is a link in the show notes.
30:44 And once you become a bankless premium member, you can hop into the bankless Discord and let me know how you like it. Cheers. Some exciting news. We are launching a new podcast to help people. We'll figure out the crypto cycle, how to navigate it. The best crypto cycle investor I know, his name is Michael Nato. He runs the DeFi report. This is the guy that sent me a sell alert before the 10-10 price drop happened.
31:04 His cycle analysis has been absolutely on point. I've been following him for years. And this year, we started recording weekly podcast episodes. Each one, we get into his portfolio, what he's holding, the market structure, entry targets, fair market value of Bitcoin and Ether. And where we are in the cycle, there's new episodes that are released every Wednesday. They're 30 minutes. They're short.
31:23 They're punchy. I think this crypto cycle is harder to navigate than most. So let's do it together. Go subscribe to this podcast. Search the DeFi report. Wherever you get your podcast, YouTube, Apple, Spotify, or find a link in the show notes. There's a new episode waiting for you now. Is there like a silver lining in the fullness of time here?
31:41 Because we've known that in like modern day software that's built by humans, it runs on the internet. It has been full of holes forever. The internet is built with sticks and ducts. tape and like paper mache because the humans wrote it and as odysseus mentioned earlier humans are lazy and so therefore the internet has been built in a lazy way and we've only really needed to secure it on an as needed basis and that's not the environment that we are in it anymore so like say we get through this period call it i don't know 18 months i think uh how are you said 18 months of turbulence in terms of internet cyber security but then on the end of it doesn't that mean we have
32:19 like completely secure software for the first time ever. And if once we get to that point, what do we get? Is there like silver lining there? Or is it just like, oh, we just, no, we just get to be back in a normal environment and we get to proceed forward? I don't know. Is there some sort of silver lining in the fullness of time here? This is our let you go fight.
32:44 Intuitively, I would say probably yes. So, you know, probably we will, you know, it will not be better, but it will be back to normal, I guess. So right now it's, you know, right now it's a full on, you know, scale invasion. And after the bloodbath, it's going to be back to regular, you know, hand-to-hand combat between attackers and defenders on more or less equal grounds. Okay. But there's going to be first the bloodbuff. Yeah. I think for me, I have two conflicted opinion.
33:17 One, agents doing cyber will make softer or better. like period. Like after like 18 months, like the software we would be building would be way safer than anything in the past. But people need to think about this new, like the next attacker is an agent. Like, and they are not going away. Like it's like this alien species that's now going to live among us. So I don't think, I don't think people have really taught enough about like what does it mean.
33:47 Like, do you want to live in a world where one mistake and you're done? done because there's always like this persistent pressure on you. I think I don't think the world was built that way. Like the world is always built for, hey, people are safe. Like most people are not criminals. But now, you know, highly scalable agents that can attack you at any point if you make one mistake, that's a very different world that we will be living in. All right, guys, I feel sufficiently informed.
34:21 Do you guys have any just like general advice for just, individuals like me or listeners of this podcast who own crypto assets or whatever, just have data or individuals who live in the modern era. Any sort of any, what are your, what behaviors or activities are you guys doing as a result of this? Anything that the individual should know and learn from. So broadly speaking, this applies to crypto and non-crypto. Think about all the products that you're using today.
34:52 Reach out to them. Ask them like, hey, what are you doing? to protect my data, my money, my repetition. And if you don't like the answer, then you should think about moving your data money out of the system. It is almost irresponsible for companies to not take actions to protect their customers today, and you need to look out for it.
35:19 Like it's also now your responsibility to make sure that your data, your money is living in products that are responsible. So that is the number one thing I would say, do like a personal audit of what are the products you're using, what are the services you're using, where's your data, which is your money, potential reach out to them,
35:41 look at their public work that they're doing. If their security program is the same as before, believe, like, if they haven't changed, like, it's coming for them, unfortunately. And so that's what I would recommend as every consumer. Look at everything where you put your money in. For me, it's all about redundancies and blast radius. So you assume you are going to be exposed to an incident, like with railway, for example.
36:18 So assume that the services you are using are exposed and are going to be infiltrated and then have a lot of redundancies such that a lot of organizations have to fail at the same time in order for you to lose money, right? So to give an example, you know, if you have, you know, self-castity, for example, maybe you want to use a ledger, but also use an iPhone. So you have like two supply chain attacks that need to happen.
36:46 And also the safe, you know, transaction supply chain has to be infiltrated. And also, you know, maybe out some other measure, right? it's like building these defenses and assume that any service you're using will probably be infiltrated. And if it does, then how exposed are you going to be? That does feel a little bit daunting because I just think about like, okay, I have assets here, I have assets there, I have assets there. That's a lot of things for me to like vet to kick the tires of and I'm not technical.
37:19 I'm not technical. How do I do this? I'm not sure there is a good answer for that. Probably, yeah, in terms of like self-castery assets, I think if you have, I think the best setup is if you, yeah, you use probably something like an iPhone with biometrics to secure the keys. And then if you have multiple of these,
37:51 then, you know, if there is a supply chain attack on Apple, there's a lot more to be worried about than your assets. I see. One pragmatic tip I can give in that context is we have disclosed a lot of we disclose a lot of security issues
38:09 on the internet, many crypto companies do. And based on some of the incidents we have seen, maybe don't click on links that you feel are a bit sketchy. And that is like the common way to escalate.
38:27 So careful clicking links that should like especially by self-custodying you need to have a trigger. You need to like take an action. It's very rare that without any trigger. Well, it's possible but it's very, very
38:42 much more difficult. So if you're using a wallet somewhere like you need to drive an action there. So try to minimize that. And more important, reach out of these companies, tell them like, hey, what are you doing? Like at the end of the day, like, they have a responsibility too.
39:04 Like if every individual is responsible for securing the software that they're using, like that's not how it works, you know, like that most people are not technical. I mean, you need to build products for everyone in the world and make sure that that is secure. So the responsibility lies in the builders. and yeah, maybe for the foreseeable future, like, you know, stop clicking on random language. And maybe for the foreseeable feature, consider not self-custodined. Actually, maybe it's worth breaking up your assets into multiple exchanges where not only you delegate the security to a professional team,
39:47 but also they have cyber insurance, so you know that if anything happens, they have some kind of liability. although I think we're going to see a lot of cyber insurance careers failing over the next few months there was a very interesting data point where in 2024 Lloyd's which is the biggest car in the world said
40:08 that LLMs will create more cyber risk and you know the premiums of cyber insurance actually have been falling consistently since 2024. So I think actually we'll see a lot of these careers failing. So that's even not a silver bullet, but probably not self-castodin for the next 12 months seems a good idea. It would be good, I think, in that case, to just have productive, proactive conversations,
40:45 proactive statements from anyone who is a custodian. So like Coinbase being the big one, for me personally, Infinex, for example, is a wallet that I use. But anyone who holds customer assets, I would like to see them make a tweet saying, hey, the internet's scary, but we are on it. And there's somebody whose responsibility it is
41:07 at these companies to think about these things and to protect user assets. I think that would be a very refreshing thing to see from some of our biggest crypto companies and custodians in this space. Odysseus, Hari, thank you. I feel much more informed about this. So thanks you for coming on this slide stream and just informing me and the bankless
41:24 audience about exactly what's going on here today. Thank you so much. Yeah, thanks. Bye-bye. Harri, Odysseus, before I let you guys go, you guys are both, have security startups. Who are your best clients? And if people are just like looking for extra help, what kind of clients do you guys work with the boast? Hari, I'll start with you and Odysseus will go after you. Yeah, so we work with some of the largest crypto companies. My business is a customer, like Robin Hood crypto and MasterCa, they're all customers. But increasingly, because now the tools to secure companies are the same, they're agents, they're agents that you built and models that you built, it has become very similar.
42:10 So we now work with healthcare companies, so we are securing some healthcare technology companies and their patient healthcare data. We're securing some AI companies that are now increasingly like pulling in a lot of data. I remember the chatchebeat example So yeah reach out to us We send disclosures to many companies We have this factory that can You know as I mentioned like can churn out exploits
42:36 The best way to defend is to attack yourself And fix everything that it finds We're very happy to support companies for free Like it's very cheap for us to send you disclosures So reach out to us you talk to me on Twitter, we'll send over disclosures, and if you're a larger company
42:54 that feels like stress, like we have resources that can help you in this terrible an era. Odysseus, who do you work with? Yeah, so we work with, Randa, we work with the linear ecosystem, so we're protecting the ecosystem there,
43:08 the L2 from Consensus. So you have a protocol there would have to help you set up. And we're about to launch a new network, so follow us on socials and you'll see where we make our technology available. And yeah, it's interesting seeing how redundancies are starting to pop up
43:28 and customers are very interested in having like this, you know, completely orthogonal circuit data from a different organization, different code base protecting their assets, such that two systems have to fail at the same time. Odysseus, Harry, thanks for coming on. It's nice to know that crypto has been kind of on the ball on some of this stuff. just by necessity and now it's the rest of the world's turn. I do feel a little bit more prepared having talked to you guys and also being in the crypto space. So thanks for coming on and
43:58 educating me and everyone else. Bankless Nation, you guys know the deal. Crypto is risky. You can lose what you put in. This is the frontier. It's not for everyone, but we're glad you're with us on the bank's journey. Thanks a lot.