Motley Fool Money - More AI = More Cyberthreats

Episode Date: May 5, 2024

The number of data compromises last year increased by 78% from just 2022, according to the 2023 Annual Data Breach Report. One primary reason for this increase? Artificial intelligence. “This Week in Tech” co-hosts Tim Beyers and Tim White discuss the rise of cyber threats, and what it means for companies like Microsoft, Crowdstrike, and Zscaler. They also discuss how these breaches work, and what you can do to protect yourself and your family. Members of any Motley Fool Service can watch “This Week in Tech” at 10:00 am ET on Fridays, or any time at the Fool Live replay hub: https://www.fool.com/premium/live/replayhub?cat=fool-live-full-shows  To become a Motley Fool member, head to www.fool.com/signup Companies mentioned: MGM, UHC, MSFT, NVDA, CRWD, OKTA, ZS, T, DDOG, ACN Host: Tim Beyers Guest: Tim White Producer: Ricky Mulvey Engineer: Tim Sparks Learn more about your ad choices. Visit megaphone.fm/adchoices

Hi everyone, I'm Charlie Cox. Join us on Disney Plus as we talk with the cast and crew of Marvel Television's Daredevil Born Again. What haven't you gotten to do as Daredevil? Being the Avengers. Charlie and Vincent came to play. I get emotional when I think about it. One of the great finale of any episode we've ever done. We are going to play Truth or Daredevil.

What? Oh boy. Fantastic. You guys go hard. Daredevil Born Again official podcast Tuesdays and stream season two of Marvel Television's Daredevil Born Again on Disney Plus. Nothing is more difficult as a techie than trying to convince a VP of software who wants to get a bonus that you should spend a whole lot more money replacing routers that work perfectly fine, but literally can't be patched anymore and probably have been taken over and are being used as a botnet to attack yourself. You really have a difficult time doing that, and those sorts of infrastructure upgrades, I think, in this year in particular, are extra difficult because every CEO has been absolutely wild on spending everything they can on AI. instead of on infrastructure upgrade.

I'm Mary Long, and that's Tim White, a techie at the Motley Fool. He and Tim Byers are co-hosts of This Week in Tech, a show on Motley Fool Live, our members-only live stream channel. About a week ago, my colleague Ricky Mulvey asked Tim and Tim if they wanted to do a show about the ripple effects of AI, the consequences we aren't thinking about. They came back with one word, cyber war. On today's show, the Tim's walk through the implications that artificial intelligence has on cyber threats, and what that means for you.

You as a citizen, an internet user, and an investor. As a heads up, today's show runs a little bit longer than our normal weekend shows. So, as a result, we won't have a show tomorrow. Enjoy today's conversation, and we'll see you Monday, fools. The cyber wars are heating up, and I'm going to see you up with a statistic that you pulled down that I think is appropriately terrifying if we're talking about cyber war. According to the 2023 annual data breach report, the number of data compromises in 2023, This is 3,205. That's how many there were.

Increased by 78 percentage points compared to 2022. That was 1,801. So, this sets a new record for the number of data compromises. Tracked in a year, that's up 72 percentage points from the previous all-time high. That was in 2021, and that was only 1,860. So I have heard you say this multiple times here, Tim. So headline number one here is the cyber war is, no longer a cold war. It is a hot war. That's right. For a number of different reasons, including

AI throwing fuel on the fire here. What was just a whole bunch of disinformation campaigns that were spreading across social media across the whole world, some relatively isolated ransomware attacks have become an increasingly vicious series of ransomware attacks, including really ugly ones like the Colonial Pipeline in 2021, the AT&T breach, which they still don't have a cause for, and a bunch of others, including MGM being down for a week due to these. And the big story of this year, United Healthcare now reporting almost a billion dollars and damages from the ransomware attack that had their payment processor down for almost a week. So let's park on that United Healthcare story for a second here.

just to underscore the gravity of what we're seeing at the moment, before we came on air, you were talking about how the executives from United Health Care are sitting in front of Congress and giving testimony. And I find it fascinating what they said about this, that a little bit of arm-waving, everything's fine. And I want you to give the reaction to listeners to what you said about this. Yeah, I mean, his statement was all of our systems are now protected by two-factor authentication, two-factor authentication, meaning that code you get when you try to long into your bank's website that says, hey, you need to enter this code to prove it's really you.

Just the fact that they didn't even have that, which is basically table stakes level of security now, really, I think underscores how ill-prepared most companies are for the hot cyber war that is coming, especially from state-sponsored actors. So what does that mean? And that means that governments are paying hacking groups like Russian groups Cozy Bear and a few others, including Alpha V, to perform hacking and ransomware to get millions of dollars to feed back into Russian government activities as well as other governments, right? And this is now a big business. So you've got a combination of old-fashioned espionage slash let's ransom other governments to get money because we're under sanctions. and Nakatomi Plaza-style diehard criminals who are just trying to break into whatever vaults they can

and make it look like terrorism and get as much money as they possibly can. And I think it's really important to contrast the fact that the people who are fighting this in the U.S. on the government side, the U.S. Air Force just had to implement adding warrant ranks to their cybersecurity groups in order to be able to pay these people something even remotely close to what they would get working for a big corporation. And so it's really hard when the folks who are in other countries are sitting there rolling in millions of dollars and as much drink and anything else that they could possibly get. And our U.S. agents are barely able to get paid what they would make as a starting person in a company. It's fascinating that you contrasted two counterparties, but both have huge implications on where we're at. And we're going to get to state-sponsored cyber hacking in a moment here.

But if we could stay on this for just a minute, just to kind of characterize what we're dealing with, you have on the one hand, I'll use a character that's very well-known, state-sponsored, Vladimir Putin, you know, in Russia. But then we also have the anonymous hacker, the Hans Gruber, that is just like, this is just a really sophisticated theft. and Hans is really interested in your crypto accounts and would love to steal your Bitcoin, as well as empty your bank account. So I think the big question is, why are we suddenly seeing, like in this year alone, massive data breaches, and then last year, 75% more than the world record of data breaches. Why is this accelerating? And I think a big piece of it is AI, right? So AI has two pieces in this story. One is that it's used by cybersecurity companies to try to detect threats, weed them out, find when there have been breaches.

On the other hand, it's being used by these hacking organizations to train their hackers faster than ever, as well as to create really good copy that you could send to someone in a fishing style attack. So you would suddenly get an email from someone that looks really legit. It's full of all the words that has something to do with your company, and you click on a link and boom, you're hacked. In addition, Microsoft's new vocal AI trainer, which can simulate anyone's human voice, now needs only two seconds of audio to replicate your voice. That's, I mean, that's terrifying. But this is, when we've talked about security in the past, so we'll park on this for a second, humans are the problem. In most cases, with cybersecurity, humans, you and I and others, we are the problem in the sense that we can be easily fooled. by whether it's an email fishing attack, whether it's a phone call that says, hey, you know, I'm here with, you know, your mom, and they're trying to get in, and they've been told that, you know, you need to give some other piece of personalized information.

And so this data collection to build a profile by which security systems get breached is increasingly sophisticated. And your point is a good one, that to the degree that an AI, instead of actually stealing the data from, say, you or me, the AI actually constructs the data to plug into a system to do the theft is so like a simulation of my voice or yours is a little bit staggering here. Right. You really just need to convince someone to give you the information that they shouldn't be giving you. Yeah. And that's why the industry is moving towards something that you might have heard called P. PAS keys, which is really using just biometrics on your local machine. So you have to hit your fingerprint reader every time as opposed to even getting that two-factor authentication message because that's even one layer more of proving it.

And it eliminates passwords from the equation so you can't accidentally give you someone your password. The best you could do is accidentally use your thumbprint. And the PASCII system is basically built to make that impossible. Right. So we talked a little bit about state-sponsored actors here. So let's move to that. What makes the cyber war hot right now is that you do have states that are essentially funding, plundering activities. You pointed this out here, Tim.

There was something that Jensen Wong, the CEO of Nvidia, said, not that long ago, a couple of months ago, said that there will need to be sovereign AIs for nations around the world in order to protect themselves. they're going to need essentially the, I'm making this up, but essentially, you're going to need a United States cyber force, Tim. That's what we're hearing from Jensen Wong. Do you buy that argument? I do. And I think the U.S. government buys it too because the U.S. Army has now announced a move to Agile Software Development after literally an entire lifetime of only doing

what we call waterfall software development where you very slowly plan everything out and deliver it. They no longer can keep up with the rapidity. that AI can generate new threats against them, and this must move to a completely different model. And like I said, the Air Force now working really hard to retain cybersecurity professionals working for the U.S. government. I mean, when we look at this, it does increase the amount of danger that we face as not just, you know, a country, but just as individuals, walking around people how much danger there is. And I think one of the undertones here, Tim, is we may not understand how much Joe and Jane average are involved in the cyber war. The collateral damage is the people who are, I'll just make something up here, suffering identity theft, for example. That seems like collateral damage of the cyber war.

It does. And again, we were talking about that as what I think is the cold cyber war, right? is disinformation campaigns, identity thefts. That's what builds up all this profile and this data that then can be fed into AIs to generate actual, like, hot cyber attacks. So, for example, Cozy Bear, which is one of the Russian state-sponsored hacking groups, had all these tools they have been developing for years based on identifying tiny breaches in, like, old routers that people haven't upgraded, and that people include small companies and so forth, right, not just people at home. And various other ways that they have identified over.

time to get into places. But they hadn't really used them. But then when the war in Ukraine started, they basically unleashed everything and tried very, very hard to take down the Ukraine government entirely. And we're not nearly as successful as people had expected them to be because Ukraine was very prepared for this. But at the same time, that really turned the war hot. And now you've got Chinese hacking groups like Storm 558 that have cracked into Microsoft

exchange mailboxes, including U.S. government officials. Yeah. When we talk about what makes the cyber war hot, do you think it's fair for me to differentiate between – you talked about the Cold War being like identity theft, things of that nature, damaging, heartbreaking, but not a hot war. The hot war here, from a cyber war perspective, is using those types of tools but to take down things like physical infrastructure, attacking a power plant, attacking a banking system. really what we're talking about with a hot war? It is, but even the hardest ransomware, like the pipeline one that I talked about before, where no oil is going through here. If you stop the colonial pipeline, you are basically completely shutting down parts of the energy sector in the United States. Same thing with power grids, very vulnerable to cyber attack. That has been known for a while, and so a lot of preparation has been made, but probably not enough.

And like I said, the United Healthcare system, which is responsible for keeping a lot of people in this country alive, was very vulnerable, it turns out, and so vulnerable that now there are probably going to be a whole lot of lawsuits about how that payment processing being down for as long as it was directly affected people's lives. Yeah, I would absolutely believe that. Before we get into, we are going to make some specific stock picks here at the end, Tim, but I want to focus for a second on where one of the broad opportunities might be, which is in infrastructure. So as we've been talking about this, you mentioned this. You kind of touched on it where there may be some old equipment that is vulnerable. And we're talking about, again, power plants, other institutions that are running old systems, old equipment, out of date, haven't been patched. And those are ripe targets in a cyber war.

How much do you think of the standard practice of, I know, I mean, you've been a techie for well over 30 years here. There is a principle in tech, Tim, where if something works, if an existing system works, and it just works and it works really well, there is a real resistance to upgrade that. How much of that contributes to the vulnerabilities we're seeing? Quite a bit. I mean, nothing is more difficult as a techie than trying to convince a VP of software who wants to get a bonus that you should spend a whole lot more money replacing routers that work perfectly fine, but literally can't be patched anymore and probably have been taken over and are being used as a botnet to attack yourself. You really have a difficult time doing that. And those sorts

of infrastructure upgrades, I think in this year in particular, are extra difficult because every CEO has been absolutely wild on spending everything they can on AI instead of on infrastructure your upgrades. So you've got another impact from AI here is all the money sloshing over into buying a bunch of Nvidia GPUs to run models on instead of upgrading all that network equipment that might be vulnerable. Is a way to think about that is maybe an analogy here is we are spending all kinds of money on making better missiles and not nearly enough on missile defense. Or not even nearly enough on keeping the bridges up so that you can drive your missile trucks It's really a classic infrastructure problem, right?

Infrastructure that works is really hard to justify spending on. Yeah. So state-sponsored attackers are a real big problem here. There's a lot of collateral damage. Aging infrastructure is a big issue here as well. Let's talk about just the text. Sort of draw some context around the quality of these attacks and what kind of attacks we're seeing. So we mentioned some.

Ransomware is a type of attack. A distributed denial of service attack is another very common one. It's been around for generations. Spoofing attacks, fishing attacks. Let's kind of define some of these so we know what we're talking about. Yeah, so ransomware is essentially someone breaks into your network. So they somehow get access to your network. And let's use a very specific example in the case of the MGM hack from last year.

Someone called the help desk at MGM. So they got the number of the help desk, and they had some names of real people. Again, this is all where that fishing and stuff comes through early in the game. So they called and said, hi, I am so-and-so VP. I got a new phone this weekend, and I need to reset my two-factor authentication. Can you go into the Octa system and reset the two-factor authentication for my phone to use this new phone? And they're like, sure, sure, of course, sir, we can do that. And they had some security questions, but not nearly enough, right?

And so they did that. And the two-factor went away from the real person's device and onto now this hackers' device. That person had access at a pretty high level to OCTA, so they were able to not only get in to their account, but then get into a lot of other people's accounts and then reset all those other accounts so they couldn't be logged into. So at this point, you have a whole bunch of people who can't log in to do their job, and then they start changing the passwords of everything else. And now no one can get in to do their job, and they start shutting things down like the badge. system, so no one can badge in to get into the building, and so forth. And then they say,

hey, by the way, company, we have now taken control of you. And if you would like control of your company back, please pay us X million dollars, and we'll talk about it. And then they start encrypting everything. So even if you get to passwords reset and get in there, now everything is encrypted and you can't get to your data. So ransomware is really about locking down your infrastructure and then ransoming it back from you. Yeah. If we are, if we're talking about, if we're talking about other types of attacks, like, let's say a distributed denial of service attack. This is the old-school blunt force attack that really came about from the earliest days of the internet. We take over a number of idle machines that happen to be connected to the

internet, and then we point them at a series of IP addresses and say, go throw as much traffic as this series of IP addresses as humanly possible because we want to take down. X website. Right. So you have a whole bunch of computers that are connected to the internet that haven't been upgraded. They're still running Windows XP, for example, the classic example. And maybe it's your grandma's computer. Maybe it's a library computer in a small town, right? It could be a lot of different examples. Microsoft didn't start providing their own antivirus until 2008. Yeah. So there's a whole lot of computers running in that sort of 98 to 2008 time frame that are vulnerable to this kind of attack by default. And they get taken over. Someone goes in and

installs a piece of software on them that lets them use that computer for whatever they want. And so they basically just web browse to a website with hundreds of thousands of these zomified computers and hit a website all at once to prevent that website from doing its normal thing of trying to serve traffic. Sometimes this can be a ransomware thing where they say, hey, we're going to keep doing this in pounding your website until you pay us. Or sometimes it's just like a punishment, like they're mad at some company or whatever, and they'll just, they'll do this.

And that's more the Hans Gruber thing for the most part. Yeah, I want to park on this for a second because it does bring up something that Microsoft has said. And I think you and I have been fairly clear that Microsoft is one of those companies that is definitely playing in the security space, but also because they might have the most to lose because there's so much old Microsoft equipment out there. I want you to comment a little bit on what Microsoft has said about their commitment to security. I mean, what do you think about Microsoft saying security above all else here? Well, I mean, first of all, Satya Nadella didn't say this until mid-April of this year. The CEO of Microsoft was like, hey, you know, whatever, we're going to spend all of our money on AI. Right.

It's the same exact issue. We're going to spend all of our money on AI. We don't care about security. Oh, a whole bunch of government accounts got hacked. Oh, oh, no. Like every email in the world is now on the dark web. I'm sure that's nothing to do with us. Oh, wait, it is everything to do with us.

So I think it's a little bit frustrating that it took him that long to say that they are going to be putting security above all else. And I also have heard many CEOs and leaders say that, and they don't believe it for a second. So talk to me about what would be the right step forward. So if you wanted to put actions behind those words from Nadella, what would be the first thing that you would want to see Microsoft do? I would want to see a really strong focus on core infrastructure security, right? This is something where they are one of the big three cloud providers, public cloud providers, Microsoft Azure. So if you are trusting Microsoft Azure with your company stuff and they can't even protect their own stuff, that's a bad look for Microsoft as well as being dangerous for a lot of customers,

because Microsoft Outlook is an extremely dominant platform. I'm going to give you an alternative here, which is, I would like to see Microsoft take some of its balance sheet capital and go around the world, everywhere where there is a Windows XP machine and say, don't even worry about it. We will fund your upgrade to the latest Microsoft equipment, and we will take your XP software machine for free, and we'll recycle it just because we don't want to be liable for you getting hacked,

especially, and I'm thinking about healthcare systems in emerging economies, Tim, that are still, you know, hospital, life-saving machines in hospitals that are running on Windows XP. That is terrifying. And it's extremely common because a lot of the devices that they are connected to are old devices that were donated. They were hand-me-downs from other places. And they weren't upgraded because they moved on to something completely new. I think that would be interesting. I think you might end up with a little bit of the Indian government paying a dollar for every cobra head problem where suddenly people are like digging Windows XP devices out of the trash to come and be like,

here, please take this. But I think it would be excellent to see that kind of initiative, even if it was a little difficult to administer. Yeah, no question. There would be a little bit of fraud that's cooked into that. But what do you think, so on a related topic, and then we're going to move on to maybe some stocks that we think, my profit here. But let's talk about Apple, which took a little bit of the opposite approach by warning. I'm curious if you think it's either premature or too late, but essentially saying, hey, you know what? There are mercenaries out there that are coming for your Apple device. Look out.

I mean, they took a little bit of the opposite approach here, Tim. Yeah, I think the good news, bad news for Apple is that they were a very early victim of this cold cyber were, where celebrities, phones were being hacked, photos being stolen, that sort of thing. And so Apple, I think, quite a while ago got the message that they need to be a leader in the security space. And that was after, of course, unfortunate incidents, but they woke up and I think have stayed pretty aggressive on cybersecurity. And so, yeah, they issued warnings to people in dozens of countries that there are people

coming for your phone. We have blocked it, but please be careful, be extra secure, that sort of thing. we can detect that they are coming for you in particular. Yeah. I mean, it is fascinating. I wonder if we're going to see on future versions of iOS that you will get, I mean, if you have an iPhone, you probably get an annoying number of alerts and pop-ups that show up on your phone. Will one of those pop-ups, Tim, be your phone has been targeted?

And we can detect that there were three failed attempts on your phone. within the last 24 hours, upgrade your software now, or buy the extra protection layer delivered to you by iCloud on Apple today. Apple has thus far resisted playing the pay-for-security card, although I mean, I wouldn't be surprised if it happened eventually. But what they do already do is my Safari tells me, hey, the passwords you have stored in Safari, these 20 have been found on the dark web. Please get them upgraded immediately.

So they are already pushing warnings like that. So I think it's definitely possible to see those kinds of warnings, but it's probably a little late. Yeah, I think you're probably right here. Okay, I'm thinking specifically about the AT&T data breach here when we talk about companies that may be poised to be important in the era of the digital cyber war, the hot cyber war. And the reason I say this is because the AET&T data breach, I think, is particularly infuriating for a number of reasons. But I'll give you the top one from my list here, Tim, is that AT&T still does not know the source of the attack. Still, to this day.

Correct. So the information they're guessing is around five years old, but they still have no idea where it came from. They did finally, after months and months, this year, acknowledged that, yes, it's a real. data at a real breach, and they reported that to the SEC. It is, it's very frustrating. So it does, there's elements of this that I think are common, but also a real cautionary tale. One of the things we know from cybersecurity research is that cybersecurity attacks when they are successful, what ends up happening is an attacker gets into a network and tends to lurk

and sit there and try to steal their. very, very slowly until they are discovered. And then once they're discovered, they move fast because they're going to get stopped. Right. So in the case of the United Healthcare attack, that's exactly what happened. They believe that the attackers were in the network for at least several days before the ransomware began, certainly enough in modern eras to take a whole lot of information before they start playing the ransomware card. Right.

Exactly right. So given that this is the context of what we're seeing now, let's talk about some companies that might be useful, important, and maybe even, you know, interesting investments for those investors who are thinking about, what do I do, how do I make my portfolio reflect this state of things in the cyber war era? So I know we've each got some names here. I'm going to start us off with one that there are the usual names, right? We've both talked about Crowdstrike and Z-scaler. So let's just get those out of the way. Those are partner companies. One, exists at the edge. They tend to guard your device. Now, they also do more than guard your device, but that's CrowdStrike. They

have an agent on your phone, on your computer. They are monitoring for the influx of information that's coming to your device and then taking actions based on that. In some cases, preemptive actions. Then you have the zero trust provider that is Z-scaler. And these two share data between each other, Tim. These do seem like they're going to become increasingly important in the cyber war era. Agreed is because more and more of companies' infrastructures in the public cloud. So in the case of Z-scaler, you can't just rely on a firewall between you and the world to protect you because your stuff is out on the public internet, in some public cloud. So you need to create a way for people to access that securely and essentially assume that every single point of the

way you need to validate again who they are. That's what the zero trust is about, right? so that you don't just say, oh, they got in the firewall, they're good now. It's like, no, every single step of the way between them and whatever they're trying to access, you're going to validate that they are who they are. Yeah, I kind of, by the analogy I've used for these two is Crowdstrike is like the bouncer outside the bar, and Z-scaler is the bartender who is checking IDs inside. But they partner up quite nicely. Let's talk about some others here that we think might be interesting here.

I asked you, and I'll tee you up for this, I wonder if there is, to use an old 90s film reference, the Pulp Fiction, my favorite Harvey Kytel character, Winston Wolf from Pulp Fiction, the cleanup guy. I clean things up. I think there's going to be some interesting work that's being done around cleanup. when disasters happen. Collateral damage happens in the cyber war here, Tim. Who do you think is the best company that is going to fill that Winston Wolf role here? Yeah, so just to be some numbers around this, United Health is estimating it's going to be $600 million to do the cleanup of their data breach.

And I think that's very conservative. I think it's going to be a lot more than that. So obviously their own people, some very private security consultants, folks that they have engaged already, that might be their security provider, Crowdstrike, or whatever. But I think there's probably room for some consultants here to come in and try to figure out how to do things like actually implement two-factor security on everything, right? That sort of thing. And that's where like an Accenture, I think, could be coming in

and help plug those goals or at least put together a plan on how to do so. Yeah. Would you imagine, it certainly seems like it. There would be some companies that either we don't know about yet that are, still private, or there are companies that just haven't been born yet that are going to do things like maybe more advanced. I mean, I guess this would be a consequence of AI. Is there some AI modeling around cybersecurity testing, prevention, maybe some amount of very active cybersecurity that is responsive based on what you can see in a network?

Well, I mean, this is the year where every single SaaS provided, right, software is a service provider is adding AI to their product, right? Yeah. So if you have a product you're already using to monitor your log files, so these applications generate tons and tons of logs, if you're using something to monitor your network, those things are all going to get AI level ups this year. And that could be a big player. So if you've already using like a data dog to look at your logs, we're going to see AI

enablement there as well. Yeah. I mean, and it's interesting that you bring up data dog because they are a company that observes what's going on in a network, they already do have some security level products that they've introduced. But certainly, that seems more important than ever. I want to see what's going on in the network, and then I want to be able to take action on it. This seems like a particularly interesting way to think about a tool that would be useful

when you are operating in a cyber war era where the table stakes are just so high. Yeah, for sure. I still worry about all of the technology that is too old, too lame, too dumb, right? It's not smart technology that's easy to monitor. That's sitting around in tiny data centers in the middle of nowhere, right? So, for example, every one of those microwave towers that you see in the planes here, and out of Colorado has got a little tiny data center attached to it. And those things don't necessarily get upgraded as often as you'd like because they're often owned by small regional. governments, right? They don't necessarily have the money to upgrade that equipment. So it doesn't really matter if you've got the best crowd strike and Z-scaler in the world if you're operating equipment that's just too dumb to be monitored by that. So how much if you were, if you were going to, I mean, our show is very much about reckless predictions here. If you had to, if I asked you to make a reckless prediction around how much, when we're talking about cyber war protection, how much investment goes into modern

tools, like say a crowd strike and a Z-scaler, and how much goes into old-fashioned boots on the ground, upgrading old equipment type of security. What do you think the ratio is? What's the split? Is it 50-50? What do you think? Well, I think to kind of circle back to where we opened this conversation with, which is that most breaches are caused by human error, I would spend 25% of my money on education. That's part of the reason we want to do the show is that people need to understand that this is no longer sort of an annoying thing that happened to someone who knows someone who knows someone. This is going to happen to you at some point, right?

And it may not happen to you directly. You may not have your own accounts hacked. You may not have your own identity stolen. But your health care company could get hacked and that all your records are stolen and that could then build up a profile on you that's used in a later attack. So I'd spend 25% of my money on education. If I was a company on my own employees, for example, to make sure everybody's aware of the kinds of attacks that they could be experiencing.

And then I would spend another 25% on the most urgent infrastructure upgrades, really old routers, really old operating systems, anything that really just can't be monitored or can't be dealt with. And then I'd spend that last 50% on the most modern security edge stuff, which is things like CrowdTrack Z-Scaler, even Octa if you're not using something like that right now. Yeah, I mean, it's interesting. All right, let's end on this maybe a bit of a personal,

personal advice or personal bugaboo about if you are getting attacks or maybe fishing attacks, what do you do about it? What's your best tip? And we'll each give one here, your best tip for protecting yourself in the cyber war era. Well, my best tip is use a password manager, right? Because password managers are what allow you to use pass keys, which I talked about earlier, right? So that, again, you're using a single cryptographic exchange between you and Gmail.

for example, instead of using a password. And that cryptographic exchange is protected by biometrics on your device. So that's the first thing I do. Use some sort of password manager. I like one password. You might like a different one. But use some sort of password manager would be my first tip. And then second, it'd be convince your relatives to use a password manager too

instead of keeping their passwords on a sheet tack next to the phone. Yeah. I'll go with default to no. default to no. Just keep that phrase in mind. Default to know. So if you get any email that you don't understand or looks a little funny or like, I don't really know what this is, the delete key is your friend. You get a phone call that you don't know what it is. If you pick it up, and I will do this, I've done this. I'll pick up a call and I can immediately tell it's a fishing attempt. And I will just say, no AI calls, please hang up immediately. Or just don't answer. Do not feed the beast. If you default to know, then you are more likely to actually be dealing with data that is legit, and you can protect yourself a little bit easier here.

You're going to miss some things, but you will also protect yourself much better. Sure. And I'll bring in a final tip here from our producer, Ricky, who basically said, have some sort of family password, right? So because of this AI voice cloning, because of these fishing attempts, and everything else. And even if you default to know, like Tim said, if someone calls you back three times and you're like, okay, fine. And they're like, you know, we have your grandma being held hostage or something. It's very useful to have some sort of family password that would have to be

given for you to believe that's real. Members of any Motley Fool service can watch this week in tech with Tim Byers and Tim White on Motley Fool Live every Friday from 10 a.m. to 11 a.m. Eastern. And anytime on the replay hub. To become a Motley Fool member, head to www.fool.com slash sign up. We'll also include a link in the show notes. As always, people on the program may have interest in the stocks they talk about. And the Motley Fool may have formal recommendations for or against, so don't buy ourselves stocks based solely on what you hear. I'm Mary Long. Thanks for listening. Again, we're off tomorrow, but we'll be back on Monday. See you then, fools.