WEBVTT 1 00:00:04.250 --> 00:00:08.892 They're calling it Black October, the worst month in cybersecurity of all time. 2 00:00:08.912 --> 00:00:10.553 There's Armageddon on the internet. 3 00:00:10.573 --> 00:00:14.374 We're gonna figure out today whether it's really all that bad or not. 4 00:00:14.434 --> 00:00:18.716 Joining me on this stream today, we got Hari, the CEO of Cantina Security. 5 00:00:18.796 --> 00:00:19.957 Hari, welcome to the live stream. 6 00:00:21.677 --> 00:00:22.858 Yeah, thank you, David. 7 00:00:24.073 --> 00:00:27.314 And joining Hari is Odysseus, CEO of Filings. 8 00:00:27.475 --> 00:00:28.815 Odysseus has been on the podcast before. 9 00:00:28.855 --> 00:00:32.077 Every time there's a security conversation, we tap in Odysseus. 10 00:00:32.137 --> 00:00:37.619 Odysseus, I would say good to have you back, but actually in these circumstances, maybe not. 11 00:00:38.419 --> 00:00:39.800 But either way, good to talk to you, my man. 12 00:00:40.720 --> 00:00:41.601 Yeah, thank you so much. 13 00:00:43.102 --> 00:00:48.167 Okay, so I want to learn a little bit about what your guys' last two days have been like. 14 00:00:48.187 --> 00:00:49.729 You guys are both security experts. 15 00:00:50.109 --> 00:00:53.452 It's the worst week of cybersecurity, apparently, of all time. 16 00:00:55.534 --> 00:00:56.315 Are you guys busy? 17 00:00:56.395 --> 00:00:59.538 What is it like to be in the world of security right now? 18 00:00:59.618 --> 00:01:00.319 Hari, I'll start with you. 19 00:01:02.141 --> 00:01:05.864 As I'll give you an answer that you're probably not expecting, which is... 20 00:01:07.824 --> 00:01:11.246 I think the public incidents have been very alarmist. 21 00:01:11.486 --> 00:01:13.887 People hear about all these incidents in the public. 22 00:01:14.287 --> 00:01:17.469 But the reality is that this has been going on for the last, I would say, 18 months. 23 00:01:18.049 --> 00:01:20.690 The number of incidents have been going up by a lot. 24 00:01:21.091 --> 00:01:23.312 Many people do not report incidents in the public. 25 00:01:23.732 --> 00:01:28.874 It's just that with the PHP one, with some of the healthcare ones, it's a big story. 26 00:01:29.475 --> 00:01:29.635 So... 27 00:01:31.429 --> 00:01:39.533 Taking a step back, we started seeing that agents and alums were starting to get really good at cyber last year. 28 00:01:40.014 --> 00:01:44.936 So back in, I would say, February, we started seeing this change. 29 00:01:45.677 --> 00:01:56.423 And we started seeing both offensive and defensive actors starting to use this newfound capability to build products and also to disclose security issues. 30 00:01:57.947 --> 00:02:08.790 There was an uplift in cyber ability around January where the model started getting very good, where the economics was cheap, where now you can blast it on many companies and make disclosures. 31 00:02:09.390 --> 00:02:11.551 We did that a lot starting this year. 32 00:02:12.691 --> 00:02:18.432 This year, right now, it's just a tipping point where many companies are starting to show up in news. 33 00:02:19.093 --> 00:02:20.093 This is nothing new for us. 34 00:02:20.934 --> 00:02:30.109 The last few days, we alerted a few of our customers with the PHP incidents because we had products that would enable them to scan their service area. 35 00:02:30.130 --> 00:02:34.157 So nothing new to us just because we have been seeing this for the last 18 months. 36 00:02:35.240 --> 00:02:41.103 Nothing new to you guys, but nonetheless, something just feels different in the last week. 37 00:02:41.183 --> 00:02:54.110 Maybe it's a little bit of what you said, Hari, of just the Twitter phenomenon of casting doom upon something, of inciting doom is very viral, so maybe that's what's different. 38 00:02:54.170 --> 00:02:58.532 Odysseus, what would you have to add to why this week feels so different than the wins previous week? 39 00:03:00.210 --> 00:03:05.173 I think it's the tipping point is, as Harry said, in the capabilities. 40 00:03:05.573 --> 00:03:14.157 Like probably we saw last year with a lot of social engineering attacks where the deep fakes was the first like big change in capabilities. 41 00:03:14.297 --> 00:03:16.078 But that was like more targeted, I would say. 42 00:03:16.638 --> 00:03:19.840 And crypto obviously was a great target for that. 43 00:03:20.140 --> 00:03:22.361 And now we're actually seeing that it's actually very cheap. 44 00:03:22.881 --> 00:03:25.824 to like blast that on the internet and just scan everything. 45 00:03:25.984 --> 00:03:32.250 So security through obscurity is like breaking down in, you know, real time right now. 46 00:03:32.791 --> 00:03:33.592 And that's what we're seeing. 47 00:03:35.514 --> 00:03:47.990 I've got this tweet from somebody who works at Anthropic, Anthropic security researcher person who says, as bad as things have gotten in the past four days, they are going to get a lot worse before they get better. 48 00:03:48.770 --> 00:03:51.073 Security leaders never let a crisis go to waste. 49 00:03:51.173 --> 00:03:53.336 Please go to your boards and ask for help right now. 50 00:03:54.838 --> 00:03:56.159 Is it going to get worse? 51 00:03:56.259 --> 00:03:59.944 Is this just kind of just like the first time this has emerged in the public zeitgeist? 52 00:03:59.984 --> 00:04:02.326 And actually, this is going to escalate. 53 00:04:02.647 --> 00:04:05.250 So next week or next month will be worse than October. 54 00:04:05.530 --> 00:04:06.211 Hari, what do you think? 55 00:04:07.052 --> 00:04:07.772 Oh, absolutely. 56 00:04:07.792 --> 00:04:08.033 So... 57 00:04:09.526 --> 00:04:19.650 With a lot of the AI capabilities, it's like there is this exponential where either the capability or the cost keeps going down. 58 00:04:20.170 --> 00:04:24.352 So every time you have a, the capabilities are already there. 59 00:04:24.712 --> 00:04:25.572 It's now the economics. 60 00:04:25.732 --> 00:04:30.514 How do we do this at a scale where it's so cheap to hunt on every website? 61 00:04:31.534 --> 00:04:33.717 This is starting to inflate. 62 00:04:34.318 --> 00:04:39.864 The same thing that we could do in January, it's now 15 times cheaper, like 15x cheaper. 63 00:04:40.144 --> 00:04:41.946 That's our internal efficiency gain. 64 00:04:42.667 --> 00:04:46.871 And this will continue to get 10x cheaper in every 6 to 12 months. 65 00:04:47.091 --> 00:04:47.392 So... 66 00:04:48.788 --> 00:04:54.893 The way to think about it is that the scope has gone up where hacking in the past was a bespoke skill. 67 00:04:55.293 --> 00:05:04.640 So to hack a company, you needed to have a lot of talented people that would then spend weeks, months, maybe years trying to hack a company. 68 00:05:04.660 --> 00:05:08.183 And then you need to have profit at the end to hack it. 69 00:05:08.744 --> 00:05:10.065 So it was never scalable. 70 00:05:10.725 --> 00:05:15.229 Hacking has now become scalable where you can build a factory where you can give it a website. 71 00:05:15.249 --> 00:05:17.871 You can give it bankless.com and we'll go hack it. 72 00:05:18.351 --> 00:05:28.679 You don't even have to think about cost because it will cost like $10 as opposed to like two weeks of human time where now you need to think about ROI. 73 00:05:28.819 --> 00:05:31.542 What do I get from hacking bankers? 74 00:05:31.582 --> 00:05:40.308 So right now, the unfortunate reality is that you can build a factory that will like churn in exploits and no humans need it. 75 00:05:40.649 --> 00:05:42.130 And the economics is falling to zero. 76 00:05:43.201 --> 00:05:43.381 Yeah. 77 00:05:44.001 --> 00:05:56.287 And I think this is also why now the attention is turning away from, you know, crypto and like just in, you know, broad web too, because before in crypto, it was a very clear target, right? 78 00:05:56.327 --> 00:06:01.250 If you had something, it was a very clear money to be made at the end, right? 79 00:06:01.930 --> 00:06:03.291 So the economics made sense there. 80 00:06:03.491 --> 00:06:06.012 And in web too, it was like more difficult, right? 81 00:06:06.032 --> 00:06:07.673 It was not clear how you would monetize. 82 00:06:08.133 --> 00:06:09.854 But now that it's actually so cheap, right? 83 00:06:10.514 --> 00:06:11.675 You don't need to answer that question. 84 00:06:11.795 --> 00:06:13.916 You just do it and you'll figure it out at the end. 85 00:06:15.676 --> 00:06:19.238 Well, you guys aren't really reassuring me in any particular way. 86 00:06:19.278 --> 00:06:20.619 This kind of sounds bad. 87 00:06:21.219 --> 00:06:26.561 Maybe we can start trying to talk about the scope of the actual harm being caused here. 88 00:06:26.581 --> 00:06:29.142 Because it's a little bit confounded. 89 00:06:29.583 --> 00:06:34.025 There are a ton of vulnerabilities being found and disclosed. 90 00:06:34.105 --> 00:06:35.305 That's not inherently bad. 91 00:06:35.805 --> 00:06:37.946 There are some exploits actually happening. 92 00:06:38.426 --> 00:06:39.447 That's bad, but... 93 00:06:39.927 --> 00:06:43.469 They're not exploits like crypto, where if a crypto exploit happens, people lose money. 94 00:06:43.529 --> 00:06:45.810 So that's also not necessarily what's happening. 95 00:06:46.231 --> 00:06:48.992 It's kind of muddy as to what's going on. 96 00:06:49.292 --> 00:06:53.595 How do we understand or measure the actual harm that's happening right now? 97 00:06:56.416 --> 00:07:00.338 I mean, at the end of the day, what is the value of data? 98 00:07:00.438 --> 00:07:01.839 What is the value of reputation? 99 00:07:01.859 --> 00:07:02.980 What is the value of money? 100 00:07:03.680 --> 00:07:03.900 And... 101 00:07:06.217 --> 00:07:08.378 all of them are getting targeted today. 102 00:07:08.598 --> 00:07:20.120 So if you have valuable data in an application you're using, like maybe your dentist, maybe your dentist has information about you that you don't want to be on the internet, or maybe the dentist doesn't want to leak their customer data because of liability. 103 00:07:20.720 --> 00:07:27.082 So what's happening is it has become so cheap to hack these companies that people would just do it. 104 00:07:27.322 --> 00:07:27.442 And, 105 00:07:28.520 --> 00:07:31.442 the way to make money is often by threatening these companies. 106 00:07:32.042 --> 00:07:35.605 Hey, I will breach your database if you don't pay me X, Y, Z money. 107 00:07:36.285 --> 00:07:40.588 And that's a very, that has become a scalable, uh, cyber crime motion today. 108 00:07:41.168 --> 00:07:42.129 So in the past, uh, 109 00:07:43.558 --> 00:07:45.300 You have to think about cybercrime as a business. 110 00:07:46.061 --> 00:07:50.125 These criminals need to make money, and these criminals need to make money. 111 00:07:50.145 --> 00:07:52.548 You need to have scalable unit economics. 112 00:07:53.188 --> 00:08:03.699 So in the past, while crypto was a big target because the money at the end was very high, like North Korea funded their nuclear missile program with crypto hacks because there was a lot of money to be made. 113 00:08:04.860 --> 00:08:07.861 But if you hack a dentist, there's not much money to be made. 114 00:08:07.941 --> 00:08:15.304 And the resources that you need to hack a doctor or a healthcare company was so high that the ROI wasn't there. 115 00:08:15.784 --> 00:08:18.485 And the highest ROI in the past was phishing. 116 00:08:18.865 --> 00:08:28.209 So you find a way to get past your email filter, your message filter, and you just blast millions of emails, millions of messages, and... 117 00:08:28.949 --> 00:08:36.417 Out of the million people, maybe 1,000 will click at it, and maybe out of the 1,000, like 100 of them would give you data that is now worth threatening them. 118 00:08:37.498 --> 00:08:43.584 Now the same threat actors are now shifting to hacking, or they are using zero days. 119 00:08:43.604 --> 00:08:48.349 They find zero days that are out there that are not getting fixed by companies 120 00:08:48.950 --> 00:08:51.353 to just scalably hack, and now they have data. 121 00:08:51.733 --> 00:08:54.056 And with that data, they can chat on the companies. 122 00:08:54.156 --> 00:08:56.819 I will breach this if you don't pay me XYZ money. 123 00:08:57.160 --> 00:08:58.421 We've seen that across the board. 124 00:08:58.441 --> 00:08:59.603 That is going to keep increasing. 125 00:08:59.743 --> 00:09:02.586 So there is economic value to it. 126 00:09:03.407 --> 00:09:07.091 And even at a, you know, bigger political level, you know, if you... 127 00:09:08.072 --> 00:09:11.933 Just think about if the database of like JP Morgan is getting leaked. 128 00:09:11.953 --> 00:09:12.653 I'm not saying it will. 129 00:09:12.993 --> 00:09:14.573 Just think about it at a political level. 130 00:09:14.613 --> 00:09:16.594 That is going to be a political catastrophe. 131 00:09:16.834 --> 00:09:27.236 Like if the entire, like some of the largest banks in the world have their records leaked, you know, you can think about the second and third order effects. 132 00:09:27.436 --> 00:09:34.398 Like that would change the politics of that country because, you know, that is exposing people's finances. 133 00:09:34.678 --> 00:09:34.978 So, yeah. 134 00:09:36.159 --> 00:09:40.688 And there is true economic damage to these incidents. 135 00:09:42.849 --> 00:09:43.089 Yeah. 136 00:09:43.369 --> 00:10:00.415 And I think a very easy to grog example is how, um, leaking, uh, databases like that of, you know, Ledger back, I think in 2021, um, or other databases were actually linked to, you know, the rent attacks, right. 137 00:10:00.435 --> 00:10:06.177 Where you identify who are the high net worth individuals and then you go after them, uh, personally. 138 00:10:06.237 --> 00:10:06.457 Right. 139 00:10:06.497 --> 00:10:06.857 And I think 140 00:10:07.557 --> 00:10:14.607 That's like part of why it's hard to quantify because the second and third order effects is not always obvious, the connection. 141 00:10:14.687 --> 00:10:24.241 That they found this data and then they connected with other data and then they were able to perform a personal attack to actually trade millions, either in crypto or some other valuables. 142 00:10:25.830 --> 00:10:29.271 So the main thing I'm hearing from you guys is that data is going to be exposed. 143 00:10:29.671 --> 00:10:40.293 And honestly, if you asked me about, like, if you asked me before all of this, if you asked if my personal data was out and available on the internet, I would probably say, yeah, it probably is, like statistically speaking. 144 00:10:41.414 --> 00:10:50.376 So I'm not, me as an individual, I don't know if I'm more worried about even more of my personal data being on the internet because it was already like that. 145 00:10:50.456 --> 00:10:51.656 I take the point that, like, 146 00:10:52.316 --> 00:10:55.937 JP Morgan doesn't want its data out there and it's a company that it needs to protect. 147 00:10:55.957 --> 00:10:57.938 So its concern is to protect its data. 148 00:10:57.978 --> 00:11:00.779 And then, you know, most companies' concerns are about its data. 149 00:11:01.299 --> 00:11:04.961 But me personally, the individual, I'm a hair less. 150 00:11:05.521 --> 00:11:06.921 Does that resonate with you guys? 151 00:11:07.282 --> 00:11:08.722 How would you respond to that, Hari? 152 00:11:09.783 --> 00:11:11.403 I mean, that's a great question. 153 00:11:11.423 --> 00:11:13.784 I've heard this objection from other people. 154 00:11:14.364 --> 00:11:20.366 But I do think like there are multiple things happening at the same time that this time it's truly different. 155 00:11:20.807 --> 00:11:21.347 And, you know, 156 00:11:22.522 --> 00:11:23.543 We build an AI product. 157 00:11:23.563 --> 00:11:24.743 We build an AI security product. 158 00:11:25.084 --> 00:11:35.789 And one of our AI engineers, he did this demo to somebody in the office, which is, he asked this JCPT, tell me everything it knows about him. 159 00:11:36.349 --> 00:11:37.030 This person's JCPT. 160 00:11:38.030 --> 00:11:56.718 And then it listed out information about his compensation, who their romantic partners are, a lot of deeply personal information about this individual that when he read that, he was shocked how much his AI agent knew about him. 161 00:11:57.258 --> 00:12:04.801 So I think this is truly different where people are giving up a lot of data to the new products and products. 162 00:12:05.397 --> 00:12:11.769 agents will then use all this data together to do malicious things for you. 163 00:12:11.789 --> 00:12:16.358 Like, you know, if an agent had access today with all of your data, like... 164 00:12:17.363 --> 00:12:19.365 it can now do things that it couldn't do in the past. 165 00:12:19.425 --> 00:12:28.553 You know, in the past, somebody still had to, like, look at all this leaked data, understand, like, how can they, like, you know, do something to David with that data? 166 00:12:28.613 --> 00:12:29.594 And that was too expensive. 167 00:12:29.634 --> 00:12:30.635 Now it's, like, prompts. 168 00:12:30.855 --> 00:12:32.396 Like, hey, here's David's data. 169 00:12:32.977 --> 00:12:39.983 I want you to write this precise email that will make him, you know, do something that, you know, he otherwise wouldn't do. 170 00:12:40.864 --> 00:12:43.226 And you can now scale that to millions of people. 171 00:12:44.187 --> 00:12:44.347 Hmm. 172 00:12:46.484 --> 00:12:47.522 Yeah, like I think 173 00:12:48.673 --> 00:12:55.317 Yeah, like a very, I think we've seen recently is the elder scams, right? 174 00:12:55.337 --> 00:13:05.003 When they call elder people and they say that, you know, your son or a relative is like in police custody or, you know, they owe money in taxes or whatever. 175 00:13:05.023 --> 00:13:07.064 And then they convince them to give them money. 176 00:13:07.484 --> 00:13:09.705 That's something we're seeing, right? 177 00:13:09.725 --> 00:13:17.470 So now imagine that they can do that in a way that is 100% believable because they have all this information about you. 178 00:13:18.613 --> 00:13:24.500 And I can convince millions of people, billions of people who are not aware of what AI is capable. 179 00:13:25.181 --> 00:13:26.102 So they're more gullible. 180 00:13:26.923 --> 00:13:31.349 And I can convince them to, you know, exfiltrate money from them, right? 181 00:13:31.629 --> 00:13:34.313 At a scale that is industrial for the first time. 182 00:13:34.712 --> 00:13:51.801 I've been trading crypto for almost a decade, and I've used so many different wallets, exchanges, aggregators, or front ends, and I'm basically always looking for the same thing, just one interface with a deep liquidity across a bunch of chains and assets where I can access markets like perps, earn yield, trade confidentially, and still control all of my funds. 183 00:13:51.921 --> 00:13:52.902 And I've never really found it. 184 00:13:52.922 --> 00:13:56.944 And I'm just always switching wallets, juggling gas fees, or getting eaten by slippage. 185 00:13:57.124 --> 00:13:59.946 But near.com feels fundamentally different to me. 186 00:14:00.026 --> 00:14:04.369 I can do anything I want from any chain and keep all of my activity confidential. 187 00:14:04.469 --> 00:14:06.590 Crypto, tokenized assets, perps, payments. 188 00:14:06.770 --> 00:14:08.851 I can even earn yield confidentially. 189 00:14:09.031 --> 00:14:12.133 One account, over 30 chains, confidential by default. 190 00:14:12.253 --> 00:14:14.014 It's the way that crypto ought to work. 191 00:14:14.155 --> 00:14:19.678 And it's powered by Near, which has moved over $30 billion cross-chain, uses post-quantum signatures, 192 00:14:19.818 --> 00:14:22.521 And that's run over five years on mainnet with zero downtime. 193 00:14:22.701 --> 00:14:26.024 Near.com is the best way to be on-chain and be in control. 194 00:14:26.225 --> 00:14:31.570 Get 20% of your trading fees back on near.com using the bankless link in the show notes, not investment advice. 195 00:14:31.810 --> 00:14:35.254 Dollar Stable Coins taught Latin America how to store value on-chain. 196 00:14:35.414 --> 00:14:40.016 RIPIO is taking that same idea and bringing it to the currencies people actually use every day. 197 00:14:40.156 --> 00:14:52.121 With wrapped fiat, RIPIO is putting more than a decade of experience powering crypto infrastructure for leading companies across Latin America behind a suite of six local currency stablecoins covering Argentina, Brazil, Mexico, Colombia, Chile, and Peru. 198 00:14:52.221 --> 00:15:00.304 Each is pegged one-to-one to its local currency and fully backed by reserves held in regulated financial institutions with independent attestations published for each token. 199 00:15:00.384 --> 00:15:03.385 But wrapped fiat is not just designed to sit there, it's built to move. 200 00:15:03.525 --> 00:15:10.248 The suite is live across 10 EVM chains with liquidity and integrations already spanning platforms like Morpho, Uniswap, and Chainlink. 201 00:15:10.448 --> 00:15:19.752 Users can move between local payment rails like Pix and Spey and matching wrapped fiat one-to-one in real time with zero fees on both on-ramps and off-ramps and no FX conversion. 202 00:15:19.892 --> 00:15:21.833 Local rails in, on-chain in the middle. 203 00:15:21.973 --> 00:15:26.935 And for builders, Ripio offers APIs, webhooks, widgets, and a sandbox just from day one. 204 00:15:27.115 --> 00:15:30.637 Start building with wrapped fiat today at platform.rippio.com. 205 00:15:33.120 --> 00:15:48.230 So it sounds like the default scenario moving forward is that everyone's records, individual records, my health records, I don't even know where my health records are, who has them, but they're going to be made, exploited and made accessible to the internet. 206 00:15:48.610 --> 00:15:51.492 And that's kind of the default for just data broadly. 207 00:15:51.532 --> 00:15:52.093 It sounds like, 208 00:15:52.913 --> 00:16:08.663 The default path, the assumption that in a short order here, most data will be made exploitable, vulnerable, and accessible by like open weight models because the internet has been built on sticks and duct tape. 209 00:16:09.264 --> 00:16:12.026 And now we have AI breaking all those things down. 210 00:16:12.066 --> 00:16:14.187 And so data is now just free on the internet. 211 00:16:14.227 --> 00:16:16.589 Is that kind of the default future that we have? 212 00:16:17.329 --> 00:16:18.670 That is the worst case. 213 00:16:18.710 --> 00:16:21.071 That's the worst case. 214 00:16:21.191 --> 00:16:22.972 Like, look, I don't want that to happen. 215 00:16:22.992 --> 00:16:28.436 I want you to do it to be only with the people that you want to have access to. 216 00:16:28.456 --> 00:16:30.497 Okay, so we're not there yet. 217 00:16:30.517 --> 00:16:33.659 So the Armageddon on the internet has not created that environment. 218 00:16:33.759 --> 00:16:36.760 That is the trajectory that we are going towards if we do nothing. 219 00:16:37.060 --> 00:16:37.421 Correct. 220 00:16:38.261 --> 00:16:38.501 Okay. 221 00:16:39.222 --> 00:16:39.502 Okay. 222 00:16:40.022 --> 00:16:41.363 Okay. 223 00:16:41.503 --> 00:16:44.165 How much time do we have before that happens? 224 00:16:44.185 --> 00:16:44.845 Okay. 225 00:16:46.527 --> 00:16:51.489 So there is this fun way to think about the time. 226 00:16:51.629 --> 00:16:53.050 It's often called like zero day clock. 227 00:16:53.270 --> 00:16:58.612 So how long do you have until you need to fix zero days in your environments? 228 00:16:59.493 --> 00:17:02.554 And in the past, it would be like months, years. 229 00:17:03.014 --> 00:17:04.755 So you had time to fix these issues. 230 00:17:05.555 --> 00:17:07.936 These days, a zero day clock is negative days. 231 00:17:08.317 --> 00:17:10.217 So that's what it's done. 232 00:17:10.237 --> 00:17:13.839 The clock has hit zero and you are on borrowed time in this present moment. 233 00:17:14.039 --> 00:17:14.799 Correct. 234 00:17:15.620 --> 00:17:26.345 So if you are a company that has customer data, repetition worth protecting, money worth protecting, you need to act today. 235 00:17:26.605 --> 00:17:30.387 You need to have acted like six months ago, but the best time to act is today. 236 00:17:30.927 --> 00:17:33.568 So you are living on borrowed time. 237 00:17:34.528 --> 00:17:36.709 Otherwise, it's almost irresponsible. 238 00:17:36.769 --> 00:17:39.931 You have a duty to your customers to protect that data. 239 00:17:44.483 --> 00:18:10.662 there was a tweet from Nikita Beer that I like that says that even your company your engineers are mentioned as IT department you don't have to worry about security incidents because they have already happened I'm looking at a chart here from a 0x Osprey can you guys just kind of walk me through what we're looking here on this chart and why it's significant today 240 00:18:12.065 --> 00:18:15.609 So this is a great job to showcase what we're dealing with. 241 00:18:16.210 --> 00:18:23.298 So if you have a software, there is a way to disclose to the public that, hey, there is a vulnerability in the system. 242 00:18:23.718 --> 00:18:27.022 So anyone using the software or asset dependency, they can fix it. 243 00:18:27.302 --> 00:18:27.462 So 244 00:18:28.728 --> 00:18:41.076 these are called CVEs, so, like, vulnerabilities in your system that people are disclosing, and oftentimes the next step is, oh, upgrade your packages because, you know, we have the CVE in the system in this version. 245 00:18:41.196 --> 00:18:47.219 This is a chart of, like, the cumulative, well, the CVEs that are getting published, like, I think, 246 00:18:48.828 --> 00:19:12.913 every day and there are databases that publish this oftentimes it's very common in open source projects for closed source projects it's a lot limited they don't necessarily always talk about it but companies like apple will always assign a cve for important fixes in their software so this is a chart and as you can see it's becoming exponential lately you can see that there was 247 00:19:19.095 --> 00:19:22.579 there is clearly like a delay in disclosures. 248 00:19:22.779 --> 00:19:24.341 So like a lot of the changes we're seeing 249 00:19:25.722 --> 00:19:30.945 Those were initiatives that started like six months ago that are now showing up in the public. 250 00:19:32.046 --> 00:19:34.447 But what's really happening is that the cost is going down. 251 00:19:34.628 --> 00:19:37.970 So security has become an economics problem. 252 00:19:38.490 --> 00:19:45.034 Like you can convert a lot of cyber risk into what is the cost of doing this hacking? 253 00:19:45.314 --> 00:19:50.097 And that is going to zero, which means like number of hacks are going to infinity. 254 00:19:51.198 --> 00:19:51.398 Yeah. 255 00:19:52.745 --> 00:19:59.707 And also, I think we're, uh, because of the speed, uh, of like, how is this identify vulnerabilities in the past? 256 00:20:00.167 --> 00:20:05.128 You would say, okay, you know, we found something and then you would give time for people to upgrade and then you would disclose it. 257 00:20:05.808 --> 00:20:13.270 Uh, but now the moment you say something exists and somebody can just point their agent to, you know, PHP and say, find me the vulnerability. 258 00:20:14.050 --> 00:20:15.651 And now they can, right? 259 00:20:15.671 --> 00:20:16.911 So, um, yeah. 260 00:20:19.639 --> 00:20:21.603 you don't have the space to allow people to upgrade. 261 00:20:21.963 --> 00:20:28.736 The moment that people are informed that something is possible, they can immediately go after it. 262 00:20:30.343 --> 00:20:31.183 Yeah, yeah. 263 00:20:31.203 --> 00:20:40.508 So for the listeners who are listening to this in the RSS feed, we're just basically looking at a chart that is mostly flat, and then it slowly slopes upward, and then it goes vertical. 264 00:20:40.888 --> 00:20:46.291 And I think what Odysseus and Hari are saying is like, it's also vertical, but it's vertical but lagging. 265 00:20:46.351 --> 00:20:49.873 So today it's even more vertical than the vertical that we see on the screen. 266 00:20:50.713 --> 00:20:53.235 Uh, the only, humans can't keep up with this. 267 00:20:53.655 --> 00:20:56.397 The only way to combat this is with AI. 268 00:20:56.637 --> 00:21:02.200 And so our AI defense has to go, it has to be faster than AI offense. 269 00:21:02.860 --> 00:21:06.763 Uh, so the defenders have to be moving as quickly as, or faster than the attackers. 270 00:21:07.463 --> 00:21:08.744 Is that feasible? 271 00:21:09.024 --> 00:21:10.385 Can we, can we do that? 272 00:21:10.925 --> 00:21:15.268 Where is the balance of power between offense and defense these days? 273 00:21:16.948 --> 00:21:18.329 That's a great question. 274 00:21:18.730 --> 00:21:26.056 And unfortunately, for the next, I would say, 12 to 18 months, it's going to be largely dominated by offense. 275 00:21:26.376 --> 00:21:31.060 So the best way to understand what you need to do is to attack yourself. 276 00:21:31.600 --> 00:21:34.202 And so in a safe way, attack yourself. 277 00:21:35.318 --> 00:21:39.140 from the external surface as if like an attacker would attack yourself. 278 00:21:39.580 --> 00:21:41.862 And now we have a product that does that. 279 00:21:41.882 --> 00:21:43.723 So we have a product called Apex. 280 00:21:43.783 --> 00:21:44.963 It's an offensive security agent. 281 00:21:45.564 --> 00:21:47.064 It can take in your websites. 282 00:21:47.104 --> 00:21:48.025 It can take in your source code. 283 00:21:48.065 --> 00:21:52.747 It can take in any information that you have and it will simulate an attack. 284 00:21:53.028 --> 00:21:56.209 So it will try to attack you, show you like all the ways it finds to breach you. 285 00:21:56.810 --> 00:21:59.991 And the best thing you can do is fix all the ways that it finds to breach you. 286 00:22:01.052 --> 00:22:03.273 So that's going to be a lot of the work next. 287 00:22:03.393 --> 00:22:04.594 One is attack yourself. 288 00:22:05.234 --> 00:22:06.474 fix the things that it finds. 289 00:22:07.435 --> 00:22:26.821 But I think there is a silver lining here where you can now, you know, what's happening with software engineering is software engineering is becoming almost like a, you know, industrial where people talk about software factories now, as opposed to like people, you know, writing software in an office. 290 00:22:27.221 --> 00:22:28.662 Software is getting built in factories today. 291 00:22:29.382 --> 00:22:34.647 What's going to happen in the next, I would say, two years would be security will also make a similar shift. 292 00:22:35.047 --> 00:22:37.690 Like we will have security factory for every company. 293 00:22:38.210 --> 00:22:45.197 So it's constantly looking out for ways to breach you, but also like proactively finding ways to fix the breaches. 294 00:22:45.857 --> 00:22:46.438 But yeah. 295 00:22:46.938 --> 00:22:50.159 Next few months, next 12 months, attack, attack, attack. 296 00:22:50.979 --> 00:22:52.439 Fix all the things that it finds. 297 00:22:53.019 --> 00:22:59.160 Make it extremely expensive for the attackers to attack you by attacking first and fixing all the findings. 298 00:22:59.780 --> 00:23:03.161 If the cost to attack you is like a dollar, like you will get attacked. 299 00:23:03.301 --> 00:23:07.401 Like make it like $10,000 and most people like would not attack you. 300 00:23:08.302 --> 00:23:12.182 Most people are not going to spend $10,000 scalably to attack a random company. 301 00:23:12.222 --> 00:23:13.463 They will spend a dollar. 302 00:23:13.503 --> 00:23:14.063 That is a given. 303 00:23:15.643 --> 00:23:16.023 Interesting. 304 00:23:16.043 --> 00:23:16.143 Yeah. 305 00:23:17.166 --> 00:23:18.406 Yeah, amazing product. 306 00:23:18.466 --> 00:23:20.187 We were using it at Phylax as well. 307 00:23:20.307 --> 00:23:21.007 We're very happy. 308 00:23:21.508 --> 00:23:22.628 It's very impressive. 309 00:23:23.408 --> 00:23:35.313 But I think this highlights also something that, you know, why I think it will be, you know, 12 months, as Harry's saying, or more, is not because the capabilities don't exist, like products like Apex exist. 310 00:23:35.893 --> 00:23:39.054 You know, we're a startup, we're using it, we don't have any bureaucracy. 311 00:23:39.614 --> 00:23:43.436 But in big organizations where humans and bureaucracy is the bottleneck, 312 00:23:44.596 --> 00:23:46.517 it will take a lot of time to adapt to that. 313 00:23:46.577 --> 00:23:51.620 And I think that is why it will take so much time for all these things to be fixed. 314 00:23:51.640 --> 00:23:55.722 Because suddenly, you know, crypto was always the dark forest. 315 00:23:56.062 --> 00:23:59.704 And we were, you know, grew up in that environment. 316 00:23:59.724 --> 00:24:01.485 We evolved in that and we understand that. 317 00:24:02.065 --> 00:24:03.826 But the internet was never a dark forest. 318 00:24:04.126 --> 00:24:06.167 Like security through obscurity worked. 319 00:24:07.467 --> 00:24:09.268 Laziness is a human attribute. 320 00:24:09.869 --> 00:24:12.850 And suddenly, you know, within a few months, it was a human attribute. 321 00:24:13.045 --> 00:24:18.488 Now the whole internet is a dark forest and organizations and people are not used to that. 322 00:24:19.409 --> 00:24:27.253 And suddenly they have to, you know, it's, you have a tanker, a huge ship and you have to turn it while you're being attacked by small speed boats. 323 00:24:28.274 --> 00:24:29.475 No bureaucracy, right? 324 00:24:31.929 --> 00:24:47.763 I would say like that's a great point probably like a very fast and drawn very cheap drawn that's like the way to think about it you know you have this machine and the swarms of agents that are cheap are coming for you and I wanted to I wanted to 325 00:24:49.304 --> 00:25:02.169 I think Odysseus touched a very important point, which is like, most people remember like the crypto hacks from the 2020, the 2021 era where every week there is a big incident, somebody lost $1,000. 326 00:25:03.009 --> 00:25:06.731 And people would always like make fun of the industry for being insecure. 327 00:25:07.551 --> 00:25:13.113 And the reality was that like the entire software industry was insecure. 328 00:25:13.574 --> 00:25:16.655 It's just that crypto had very high incentives for people to hack. 329 00:25:17.359 --> 00:25:20.101 It was the economic variable that was different. 330 00:25:20.301 --> 00:25:22.022 And also everything was public. 331 00:25:22.362 --> 00:25:22.822 Yeah, correct. 332 00:25:22.902 --> 00:25:25.003 And now the economics have changed. 333 00:25:25.404 --> 00:25:31.707 And, you know, welcome to the 2020 crypto where you see like a big incident every week. 334 00:25:31.747 --> 00:25:35.550 That is a new reality for the real world. 335 00:25:36.070 --> 00:25:39.752 And, you know, in some way, like, you know, you have moved through this in a different era. 336 00:25:41.884 --> 00:25:49.129 My spinal reflex is to like look at crypto and be like, yeah, this is bullish because this is the environment that crypto was born in. 337 00:25:49.249 --> 00:25:51.191 Like this is we are home here. 338 00:25:51.731 --> 00:25:56.755 Like you guys, you know, non-crypto securities, like you are in the room with us now. 339 00:25:56.995 --> 00:26:00.478 And we were raised in the darkness, you know, something to that effect. 340 00:26:01.038 --> 00:26:13.885 I don't know if that actually means like crypto prices go up, but it does make me feel some sort of comfort that like blockchain systems were born in adversarial environments and now the world is an adversarial environment. 341 00:26:15.106 --> 00:26:18.608 Is there a more bullish take than that or is that about as bullish as it gets? 342 00:26:21.529 --> 00:26:26.792 I think you hit an interesting point where I always tell people like, you know, like, 343 00:26:28.036 --> 00:26:31.539 you know, we are a security company and our job in the past was to secure money. 344 00:26:31.859 --> 00:26:34.661 And securing money is the hottest thing in the world. 345 00:26:34.721 --> 00:26:35.782 It's like fucking insane. 346 00:26:36.782 --> 00:26:42.527 With maybe the sole exception of like government to government cyber, which is a, you know, all different industry. 347 00:26:43.387 --> 00:26:50.337 And if you are in this circle of protecting money, this is easy. 348 00:26:51.638 --> 00:26:51.879 Yeah. 349 00:26:52.219 --> 00:26:54.462 So now a lot of the job is a scale. 350 00:26:54.582 --> 00:26:59.549 So how do you make sure that every single company on the internet can have the same level of 351 00:27:00.797 --> 00:27:04.781 like protection that some of the largest like crypto companies have. 352 00:27:05.362 --> 00:27:10.487 That that's like one way to think about it, but also the large companies in crypto, they also need to invest. 353 00:27:10.907 --> 00:27:13.390 Nobody's only the paranoid survive. 354 00:27:13.610 --> 00:27:18.274 And like you need to invest in cyber today across the board. 355 00:27:19.155 --> 00:27:23.179 But I do think there is a like philosophically and, um, 356 00:27:24.040 --> 00:27:34.137 from an operation perspective, like there is an embedded advantage to companies that were built in this, like really offensive environment that has become commonplace. 357 00:27:35.343 --> 00:27:37.204 So that was going to be one of the questions I have. 358 00:27:37.264 --> 00:27:40.386 It's like, what about my crypto that I have stored in Coinbase? 359 00:27:40.626 --> 00:27:42.267 Like, is Coinbase vulnerable here? 360 00:27:42.627 --> 00:27:48.490 And I guess interpreting your answer is like, well, they are vulnerable in the sense that, like, the cost to attack has gone down. 361 00:27:48.510 --> 00:27:49.511 That's true for Coinbase. 362 00:27:49.531 --> 00:27:51.092 Like, the economics of that doesn't change. 363 00:27:51.512 --> 00:27:56.455 But the Coinbase incentive to defend has been way higher for a lot longer. 364 00:27:57.115 --> 00:27:59.356 And so, yes, Coinbase should be concerned. 365 00:27:59.436 --> 00:28:01.898 But their starting point is fundamentally different. 366 00:28:02.778 --> 00:28:08.443 And so my money in Coinbase is probably not any weaker today than it was a week ago or a month ago. 367 00:28:09.083 --> 00:28:14.207 But also, nonetheless, it is still up to Coinbase to be very on the ball with advances in security practices. 368 00:28:16.464 --> 00:28:18.564 Yeah, I would lean into that. 369 00:28:18.605 --> 00:28:32.868 Like if you look at, let's say, Coinbase and JP Morgan or like a large financial institution, in some way, Coinbase is better prepared to defend than your bank. 370 00:28:33.528 --> 00:28:42.150 And people often assume that, you know, the traditional financial institutions don't have to worry about cyber risk because you can always like pull back money. 371 00:28:42.190 --> 00:28:42.870 That's not the case. 372 00:28:43.050 --> 00:28:45.471 Like, you know, you... 373 00:28:47.232 --> 00:28:53.457 people build payment rails and abusing the payment rails are like there's real risk at place. 374 00:28:54.217 --> 00:29:06.807 And if you study North Korea, before there was internet banking, they have found exploits in ATMs and they use that ATM exploits to withdraw money. 375 00:29:07.888 --> 00:29:09.389 Somebody gave this example where, 376 00:29:10.150 --> 00:29:12.251 they found a way to exploit target gift cards. 377 00:29:12.592 --> 00:29:17.015 And then they were able to use the gift cards to like, you know, get money out of the system. 378 00:29:17.135 --> 00:29:27.161 So in some way, like the legacy companies that never had to worry about this intense cyber pressure, they are more at risk than the Coinbase. 379 00:29:27.322 --> 00:29:27.462 And, 380 00:29:28.851 --> 00:29:30.312 I know the Coinbase team pretty well. 381 00:29:30.352 --> 00:29:31.492 They are preparing. 382 00:29:32.733 --> 00:29:35.254 They need to keep investing in cyber. 383 00:29:35.895 --> 00:29:40.737 But your money is safer in Coinbase than, you know, target gift cards as of now. 384 00:29:42.298 --> 00:29:43.479 I hope that was always true. 385 00:30:00.853 --> 00:30:05.760 Bankless, on the other hand, has spent almost a decade building one of the deepest archives of crypto data anywhere. 386 00:30:05.900 --> 00:30:12.130 More than 2,000 podcast transcripts, 10,000 articles, and countless conversations with the people actually building this industry. 387 00:30:12.330 --> 00:30:15.595 And now we've structured all of that data into the Bankless MCP. 388 00:30:15.815 --> 00:30:23.301 So you can go and connect it to your Claude or ChatGPT and suddenly your AI can answer your crypto queries with the entire Bankless archive behind it. 389 00:30:23.421 --> 00:30:29.265 And every new Bankless article or episode gets added automatically so the context keeps staying up to date. 390 00:30:29.526 --> 00:30:33.449 The Bankless MCP is exclusively available to Bankless premium subscribers. 391 00:30:33.669 --> 00:30:37.792 So you can go to Bankless.com, upgrade to premium and connect the MCP in just a few minutes. 392 00:30:37.872 --> 00:30:42.796 And all of a sudden, your crypto queries to your AI, LLM, whatever you use, will get a thousand times better. 393 00:30:42.916 --> 00:30:43.576 So go check it out. 394 00:30:43.676 --> 00:30:44.877 There is a link in the show notes. 395 00:30:44.917 --> 00:30:49.120 And once you become a Bankless Premium member, you can hop into the Bankless Discord and let me know how you like it. 396 00:30:49.520 --> 00:30:49.760 Cheers. 397 00:30:50.061 --> 00:30:50.721 Some exciting news. 398 00:30:50.801 --> 00:30:55.544 We are launching a new podcast to help people figure out the crypto cycle, how to navigate it. 399 00:30:55.624 --> 00:30:58.326 The best crypto cycle investor I know, his name is Michael Nato. 400 00:30:58.406 --> 00:30:59.447 He runs the DeFi Report. 401 00:30:59.507 --> 00:31:04.270 This is the guy that sent me a sell alert before the 1010 price drop happened. 402 00:31:04.470 --> 00:31:06.912 His cycle analysis has been absolutely on point. 403 00:31:06.992 --> 00:31:08.333 I've been following him for years. 404 00:31:08.513 --> 00:31:11.935 And this year we started recording weekly podcast episodes. 405 00:31:12.075 --> 00:31:19.838 Each one, we get into his portfolio, what he's holding, the market structure, entry targets, fair market value of Bitcoin and Ether, and where we are in the cycle. 406 00:31:19.938 --> 00:31:22.339 There's new episodes that are released every Wednesday. 407 00:31:22.419 --> 00:31:23.139 They're 30 minutes. 408 00:31:23.199 --> 00:31:23.679 They're short. 409 00:31:23.699 --> 00:31:24.339 They're punchy. 410 00:31:24.459 --> 00:31:26.840 I think this crypto cycle is harder to navigate than most. 411 00:31:27.080 --> 00:31:28.321 So let's do it together. 412 00:31:28.461 --> 00:31:29.681 Go subscribe to this podcast. 413 00:31:29.741 --> 00:31:32.322 Search The DeFi Report wherever you get your podcasts. 414 00:31:32.382 --> 00:31:35.463 YouTube, Apple, Spotify, or find a link in the show notes. 415 00:31:35.583 --> 00:31:37.144 There's a new episode waiting for you now. 416 00:31:37.364 --> 00:31:41.226 Is there like a silver lining in the fullness of time here? 417 00:31:41.746 --> 00:31:49.550 Because we've known that in like modern day software that's built by humans, that runs on the internet, it has been full of holes forever. 418 00:31:49.650 --> 00:31:55.173 Like the internet is built with sticks and duct tape and like paper mache because humans wrote it. 419 00:31:55.213 --> 00:31:58.054 And as Odysseus mentioned earlier, humans are lazy. 420 00:31:58.114 --> 00:32:00.515 And so therefore the internet has been built in a lazy way. 421 00:32:00.535 --> 00:32:04.357 And we've only really needed to secure it on an as needed basis. 422 00:32:04.557 --> 00:32:06.358 And that's not the environment that we are in anymore. 423 00:32:06.398 --> 00:32:16.362 So like, say we get through this period, call it, I don't know, 18 months, I think, Haru, you said 18 months of turbulence in terms of internet cybersecurity. 424 00:32:16.982 --> 00:32:23.145 But then on the end of it, doesn't that mean we have like completely secure software for the first time ever? 425 00:32:23.705 --> 00:32:26.426 And if once we get to that point, what do we get? 426 00:32:26.927 --> 00:32:28.207 Is there like silver lining there? 427 00:32:28.347 --> 00:32:34.490 Or is it just like, oh, we just, no, we just get to be back in a normal environment and we get to proceed forward 428 00:32:34.510 --> 00:32:35.091 I don't know. 429 00:32:35.111 --> 00:32:37.295 Is there some sort of silver lining in the fullness of time here? 430 00:32:37.315 --> 00:32:41.963 This is, I'll let you go for it. 431 00:32:44.783 --> 00:32:46.305 Intuitively, I would say probably yes. 432 00:32:46.445 --> 00:32:52.311 So, you know, probably we will, you know, it will not be better, but it will be back to normal, I guess. 433 00:32:52.791 --> 00:32:58.337 So right now it's, you know, right now it's a full on, you know, scale invasion. 434 00:32:59.618 --> 00:33:08.146 And after the bloodbath, it's going to be back to regular, you know, hand to hand combat between attackers and defenders on more or less equal grounds. 435 00:33:10.378 --> 00:33:12.579 But there's going to be first the bloodbath. 436 00:33:13.959 --> 00:33:16.720 I think for me, I have two conflicted opinions. 437 00:33:17.441 --> 00:33:22.603 One, agents doing cyber will make software better, period. 438 00:33:22.783 --> 00:33:28.125 After 18 months, the software we will be building would be way safer than anything in the past. 439 00:33:29.266 --> 00:33:31.847 But people need to think about this new... 440 00:33:32.887 --> 00:33:36.509 like the next attacker is an agent, like, and they are not going away. 441 00:33:36.710 --> 00:33:41.252 Like, it's like this alien species that's now going to live among us. 442 00:33:41.573 --> 00:33:44.835 So I don't think people have really mixed 443 00:33:45.563 --> 00:33:47.483 taught enough about like what does it mean? 444 00:33:47.904 --> 00:33:54.945 Like do you want to live in a world where one mistake and you're done because there's always like this persistent pressure on you? 445 00:33:55.625 --> 00:33:57.726 I don't think the world was built that way. 446 00:33:57.846 --> 00:34:00.607 Like the world is always built for, hey, people are safe. 447 00:34:00.907 --> 00:34:03.127 Like most people are not criminals. 448 00:34:03.987 --> 00:34:14.990 But now, you know, highly scalable agents that can attack you at any point if you make one mistake, that's a very different world that we will be living in. 449 00:34:18.881 --> 00:34:21.984 All right, guys, I feel sufficiently informed. 450 00:34:22.124 --> 00:34:34.294 Do you guys have any just like general advice for just individuals like me or listeners of this podcast who own crypto assets or whatever, just have data or individuals who live in the modern era? 451 00:34:34.854 --> 00:34:38.918 What behaviors or activities are you guys doing as a result of this? 452 00:34:38.958 --> 00:34:41.640 Anything that the individual should know and learn from? 453 00:34:44.582 --> 00:34:48.865 So broadly speaking, this applies to crypto and non-crypto. 454 00:34:49.986 --> 00:34:51.748 Think about all the products that you're using today. 455 00:34:53.249 --> 00:34:53.889 Reach out to them. 456 00:34:54.830 --> 00:35:00.434 Ask them like, hey, what are you doing to protect my data, my money, my reputation? 457 00:35:02.075 --> 00:35:09.081 And if you don't like the answer, then you should think about like moving your data money out of the system. 458 00:35:09.101 --> 00:35:09.901 Yeah. 459 00:35:10.902 --> 00:35:16.831 it is almost irresponsible for companies to not take actions to protect their customers today. 460 00:35:17.572 --> 00:35:19.375 And you need to look out for it. 461 00:35:20.457 --> 00:35:22.259 It's also now your responsibility to make sure that 462 00:35:23.479 --> 00:35:27.941 your data, your money is living in products that are responsible. 463 00:35:29.082 --> 00:35:43.669 So that is the number one thing I would say, like do like a personal audit of what are the products you're using, what are the services you're using, where's your data, where's your money, potential reach out to them, look at their public work that they're doing. 464 00:35:44.469 --> 00:35:49.412 If their security program is the same as before, leave. 465 00:35:50.332 --> 00:35:51.633 If they haven't changed, like, 466 00:35:52.638 --> 00:35:54.603 It's coming for them, unfortunately. 467 00:35:55.365 --> 00:35:58.332 So that's what I would recommend as every consumer. 468 00:35:58.532 --> 00:36:01.379 Look at everything where you put your money in. 469 00:36:04.955 --> 00:36:11.281 For me, it's all about redundancies and blaster radius. 470 00:36:11.301 --> 00:36:16.906 So you assume you are going to be exposed to an incident, like with Railway, for example. 471 00:36:18.688 --> 00:36:27.556 So assume that the services you're using are exposed and they're going to be infiltrated and then have a lot of redundancies such that 472 00:36:28.518 --> 00:36:33.849 a lot of organizations have to fail at the same time in order for you to lose money, right? 473 00:36:33.869 --> 00:36:39.299 So to give an example, you know, if you have, you know, self-custody, for example, 474 00:36:40.757 --> 00:36:43.440 Maybe you want to use a ledger, but also use an iPhone. 475 00:36:43.580 --> 00:36:46.062 So you have like two supply chain attacks that need to happen. 476 00:36:46.483 --> 00:36:49.686 And also the safe transaction supply chain has to be infiltrated. 477 00:36:51.147 --> 00:36:54.050 And also, you know, maybe add some other measure, right? 478 00:36:54.070 --> 00:37:00.236 So it's like building these defenses and assume that any service you're using will probably be infiltrated. 479 00:37:00.517 --> 00:37:03.700 And if it does, then how exposed are you going to be? 480 00:37:06.184 --> 00:37:13.350 That does feel a little bit daunting because I just think about like, okay, I have assets here, I have assets there, I have assets there. 481 00:37:14.151 --> 00:37:18.895 That's a lot of things for me to vet, to kick the tires of, and I'm not technical. 482 00:37:19.495 --> 00:37:20.216 I'm not technical. 483 00:37:22.317 --> 00:37:23.018 How do I do this? 484 00:37:30.304 --> 00:37:32.226 I'm not sure there's a good answer for that. 485 00:37:32.626 --> 00:37:33.667 Yeah. 486 00:37:33.887 --> 00:37:34.488 Probably... 487 00:37:36.295 --> 00:37:49.111 Yeah, in terms of like self-custody assets, I think if you have, I think the best setup is if you, yeah, you use like probably something like an iPhone with biometrics to secure the keys. 488 00:37:49.251 --> 00:37:52.234 And then if you have multiple of these, then, you know, 489 00:37:53.463 --> 00:38:00.130 If there is a supply chain attack on Apple, there's a lot more to be worried about than your assets. 490 00:38:01.011 --> 00:38:01.731 I see. 491 00:38:02.832 --> 00:38:10.580 One pragmatic tip I can give in that context is we have disclosed a lot of security issues on the internet. 492 00:38:11.821 --> 00:38:12.842 Many crypto companies do. 493 00:38:14.114 --> 00:38:22.964 And based on some of the incidents we have seen, maybe don't click on links that you feel are a bit sketchy. 494 00:38:23.804 --> 00:38:27.148 That is like the common way to escalate. 495 00:38:27.448 --> 00:38:31.533 So careful clicking links that should like, 496 00:38:32.685 --> 00:38:35.066 especially with self-custodied, you need to have a trigger. 497 00:38:35.326 --> 00:38:37.367 You need to like take an action. 498 00:38:37.867 --> 00:38:44.650 It's very rare that without any trigger, well, it's possible, but it's very, very much more difficult. 499 00:38:45.351 --> 00:38:50.293 So if you're using a wallet somewhere, like you need to drive an action there. 500 00:38:50.433 --> 00:38:52.534 So try to minimize that. 501 00:38:53.834 --> 00:38:59.957 And more importantly, like reach out to these companies, tell them like, hey, what are you doing? 502 00:39:00.957 --> 00:39:12.360 like at the end of the day, like they are respond, they have a responsibility to like, if every, if every individual is responsible for securing the software that they're using, like that's, that's not how it works. 503 00:39:12.380 --> 00:39:19.623 You know, like that, most people are not technical and we need to build products for everyone in the world and make sure that that is secure. 504 00:39:19.783 --> 00:39:24.044 So the responsibility lies in the, the builders. 505 00:39:24.684 --> 00:39:25.965 And yeah. 506 00:39:26.565 --> 00:39:26.785 Yeah. 507 00:39:27.665 --> 00:39:31.889 Maybe for the foreseeable future, like, you know, stop clicking on a random link. 508 00:39:33.390 --> 00:39:36.833 And maybe for the foreseeable future, consider not self-custodied. 509 00:39:37.153 --> 00:39:49.324 Actually, maybe it's worth breaking up your assets into multiple exchanges where not only you delegate the security to a professional team, but also they have, you know, cyber insurance. 510 00:39:49.444 --> 00:39:52.606 So, you know, that if anything happens, they have some kind of liability. 511 00:39:53.427 --> 00:40:00.352 Although I think we're going to see a lot of cyber insurance carriers failing over the next few months. 512 00:40:01.113 --> 00:40:13.161 There was a very interesting data point where in 2024, Lloyd's, which is the biggest car in the world, said that LLMs will create more cyber risk. 513 00:40:14.062 --> 00:40:15.463 And, you know. 514 00:40:16.358 --> 00:40:22.042 the premiums of cyber insurance actually have been falling consistently since 2024. 515 00:40:22.442 --> 00:40:26.685 So I think actually we'll see a lot of these carriers failing. 516 00:40:26.885 --> 00:40:37.191 So that's even not a, you know, silver bullet, but probably not self-custarding for the next 12 months seems a good idea. 517 00:40:37.211 --> 00:40:38.092 Mm-hmm. 518 00:40:40.198 --> 00:40:49.025 It would be good, I think, in that case, to just have productive, proactive conversations, proactive statements from anyone who is a custodian. 519 00:40:49.065 --> 00:40:54.149 So like Coinbase being the big one, for me personally, Infinex, for example, is a wallet that I use. 520 00:40:55.570 --> 00:41:03.337 But anyone who holds customer assets, I would like to see them make a tweet saying, hey, the Internet's scary, but we are on it. 521 00:41:04.498 --> 00:41:11.064 And there's somebody whose responsibility it is at these companies to think about these things and to protect user assets. 522 00:41:11.104 --> 00:41:18.110 I think that would be a very refreshing thing to see from some of our biggest crypto companies and custodians in this space. 523 00:41:18.710 --> 00:41:20.231 So Odysseus, Hari, thank you. 524 00:41:20.251 --> 00:41:21.351 I feel much more informed about this. 525 00:41:21.371 --> 00:41:25.733 So thanks to you for coming on this live stream and just informing me and the Bankless audience about exactly what's going on here today. 526 00:41:28.634 --> 00:41:29.255 Thank you so much. 527 00:41:29.835 --> 00:41:30.315 Yeah, thanks. 528 00:41:30.415 --> 00:41:31.896 Bye-bye. 529 00:41:32.256 --> 00:41:36.938 Hari, Odysseus, before I let you guys go, you guys are both have security startups. 530 00:41:37.418 --> 00:41:39.279 Who are your best clients? 531 00:41:39.339 --> 00:41:44.521 And if people are just like looking for extra help, what kind of clients do you guys work with at most? 532 00:41:44.541 --> 00:41:46.242 Hari, I'll start with you, and Odysseus will go after you. 533 00:41:46.723 --> 00:41:49.844 Yeah, so we work with some of the largest crypto companies. 534 00:41:50.325 --> 00:41:55.647 I miss as a customer, like Robinhood Crypto and Mastercard, they're all our customers. 535 00:41:56.087 --> 00:42:02.830 But increasingly, because now the tools to secure companies are the same, they're agents. 536 00:42:03.250 --> 00:42:06.271 They're agents that you built and models that you built. 537 00:42:06.291 --> 00:42:07.252 Yeah. 538 00:42:08.748 --> 00:42:09.948 it has become very similar. 539 00:42:09.968 --> 00:42:11.589 So we now work with healthcare companies. 540 00:42:11.849 --> 00:42:15.650 We are securing some healthcare technology companies and their patient healthcare data. 541 00:42:16.471 --> 00:42:21.232 We're securing some AI companies that are now increasingly pulling in a lot of data. 542 00:42:22.753 --> 00:42:24.013 Remember the chat GP example. 543 00:42:24.033 --> 00:42:24.073 So 544 00:42:26.734 --> 00:42:27.615 Yeah, reach out to us. 545 00:42:28.315 --> 00:42:30.998 We send disclosures to many companies. 546 00:42:31.718 --> 00:42:36.783 We have this factory that can, as I mentioned, can churn out exploits. 547 00:42:37.403 --> 00:42:41.687 The best way to defend is to attack yourself and fix everything that it finds. 548 00:42:42.187 --> 00:42:45.790 We're very happy to support companies for free. 549 00:42:46.030 --> 00:42:48.893 It's very cheap for us to send you disclosures. 550 00:42:49.093 --> 00:42:49.894 So reach out to us. 551 00:42:50.094 --> 00:42:50.974 Reach out to me on Twitter. 552 00:42:51.935 --> 00:42:53.176 We'll send over disclosures. 553 00:42:53.256 --> 00:43:00.400 And if you're a larger company that feels like stress, like we have resources that can help you in this terrible era. 554 00:43:01.921 --> 00:43:02.942 Odysseus, who do you work with? 555 00:43:04.002 --> 00:43:07.026 Yeah, so we work with, right now we work with the linear ecosystem. 556 00:43:07.046 --> 00:43:11.251 So we're protecting the ecosystem there, the L2 from ConsenSys. 557 00:43:11.411 --> 00:43:14.575 So you have a protocol there, we'd love to help you set up. 558 00:43:15.055 --> 00:43:17.118 And we're about to launch a new network. 559 00:43:17.138 --> 00:43:21.543 So follow us on socials and you'll see where we make our technology available. 560 00:43:23.268 --> 00:43:42.761 And yeah, it's interesting seeing how redundancies are starting to pop up and customers are very interested in having like this, you know, completely orthogonal circuit breaker from a different organization, different code base protecting their assets such that two systems have to fail at the same time. 561 00:43:45.031 --> 00:43:46.212 Odysseus, Harry, thanks for coming on. 562 00:43:46.252 --> 00:43:50.974 It's nice to know that crypto has been kind of on the ball on some of this stuff just by necessity. 563 00:43:51.014 --> 00:43:53.096 And now it's the rest of the world's turn. 564 00:43:53.636 --> 00:43:56.978 I do feel a little bit more prepared having talked to you guys and also being in the crypto space. 565 00:43:56.998 --> 00:43:59.719 So thanks for coming on and educating me and everyone else. 566 00:43:59.779 --> 00:44:00.920 Bankless Nation, you guys know the deal. 567 00:44:00.940 --> 00:44:02.341 Crypto is risky. 568 00:44:02.901 --> 00:44:03.962 You can lose what you put in. 569 00:44:03.982 --> 00:44:04.682 This is a frontier. 570 00:44:04.702 --> 00:44:06.843 It's not for everyone, but we're glad you're with us on the bankless journey. 571 00:44:07.244 --> 00:44:07.644 Thanks a lot.