228: Big 4 Consulting Firms Will Ruin Your Life: No Hype, Just Reality

ep 224
===

[00:00:00] What would you do if your son was at home, crying on the floor in the bathroom floor 'cause he's hungry? And the only way to feed him is to, is with a mouthful of another ooh, and his sand is gone. The man's smoking rock now, and he's under lockdown. Now he ain't got a job now. This is you. But for me, this is what I call life, mm.

[00:00:27] All right, so we back. We are. Episode 224. Two two four. We going with two two five for my BR people. But a lot has happened since we talked to you guys Shorty actually did some talks. Actually, we did a couple, but she did more than me, where she actually went in person and talked at the Black Men in Tech Thrive Conference- Yeah

[00:00:52] 2026 in Dallas. And since you weren't here with us last week, she got COVID, y'all. Oh my [00:01:00] God. No, I did not. Um, could you just let us know, like, how was that experience and, and how did you enjoy Thrive? It was a great experience. Um, I talked about Zero Trust with one of my good friends, Lincoln. Um, and we kind of talked through, like, a, an attack scenario, and it was good.

[00:01:19] There were, like, actually quite a few people in the room who, like, watch the pod, so I got to kinda connect with some of them afterwards and, um, also get some feedback on how the session went. Immediately, as soon as the session was over, people were providing feedback, um, just advising how good it was, interactive, how it kinda kept your attention after kinda being talked to all day, which is what I didn't wanna do.

[00:01:46] I didn't want to have another session midday where people felt like they were being talked at and like they weren't kind of leaving with anything tangible or memorable. So I definitely tried to make it as interactive as [00:02:00] possible. But it was a good time. I got to see a lot of familiar faces, some of our friends, a bunch of folks that we have had on the podcast.

[00:02:10] Um, it was a great time. I always like seeing my people. That's good. That's good. You know what I noticed? What? You know what your filler word is? No, say it. Uh- Immediately ... immediately? I said it? What did I say? You said immediately after the thing, you got your f- thing. And so, you know, like- Oh ... a lot of times I'll say something, you're like, "Immediately, you know?"

[00:02:31] Yeah. Go back and listen to the episodes. Just like, that is my filler word. 'Cause everybody has it. Some people has immediately, um, yeah. Some people have uh, the things. At least it's not a um. Yeah. But it depends. You can... That's one of my things I like to play now. I like to s- figure out what people filler words are.

[00:02:47] Yeah. Like, mine used to be you know. Now I'm not, now I'm not saying it no more. We all do. We all do. But no, that's cool. I couldn't be there unfortunately 'cause it was just so last minute, so I really couldn't be there. [00:03:00] And, uh, but yeah, look, I had a good time. Did you go to the Trap Orchestra? I did not. That looked like it was cool.

[00:03:05] I know. It looked like it was a great time. Yeah. No, I wasn't feeling good. Yeah, tell them why. 'Cause I was outside. Nah, somebody got me sick, for real, at the conference. Yeah. Somebody definite- definitely got me sick. Yeah. I felt awful. It had to be somebody that was near you and Damien. Literally. 'Cause I texted him and was like, "Nah, TT feeling sick too."

[00:03:27] I did text him too. And he was sick? Mm-hmm. I think he was not feeling good at first He had the Fiji flu. Yeah. But it was a, it was, it was still a good time. Like I said, it was a good time. What's good? Ain't been nothing, no nothing much changed with me. Oh, I didn't show you, but um, they had picture day. Let me show you what they had on for, uh- Let's see

[00:03:49] for their pictures. I forgot to post them or send them to you. I seen the proofs. They came out okay. This was their outfits. Oh, [00:04:00] look at her. The, the cute self. Look at them. Yeah, so- Too cute ... they did their picture day, and you know Josh been Josh, uh. Not too much. Not too much. Um, yeah, just getting adjusted to the weather.

[00:04:14] It's finally cooling off now. Yuck. So you can finally, if you got some patio furniture, sit on the patio, go outside, read you a paper. You need a blanket. Yeah, you do. Yeah. Or you get you one of those, uh- A little fire pit ... yeah, a little fire pit. Yeah. Um, you know, now for those of us who been dealing with insects, a lot of them times are like kind of teetering off a little bit, you know what I'm saying?

[00:04:34] I've, I've been feeling like the Exterminator recently, been killing spiders left and right. Thank goodness I ain't seen the bug. Man, I been s- I'd love that for me ... I've been playing, spraying that good stuff. Yeah. This stuff called Viper. All right, but they're dead though when you finding them? Um, some of them were.

[00:04:50] But as of lately. Oh, yeah, yeah. Yeah. For sure. Yeah. I was just... You just have to spray everywhere, so by the foundation, up at the top, all the cracks, cooks and crannies, and [00:05:00] yeah, they, they be dead. The grasshoppers, they just in the garage dead on the floor. The grasshoppers have calmed down. Seriously. It was, it was a bit much for me.

[00:05:07] I be feeling like A Bug's Life. It was, it was a bit much for me. Yeah. Can't even open up the door. I don't have time for that. Nah, for sure. But, um, let me, let me tell you what we're gonna be talking about today, guys. Um, let's put it on shorty. For cyber security roles and you're not hearing anything back?

[00:05:23] Well, guess what? It's probably not your skills. It's more like your job search strategy. I'm Henry Davis, and through my company, Techcial Consulting, I've helped hundreds of people finally break into tech, land their dream jobs, and increase their salary from ranges from $20,000 all the way up to $70,000.

[00:05:38] But check this out. Unlike other career coaches, I don't just write your resume. I use my skills as being a cyber security professional for the last decade to show you how to outperform your resume and kill it in your job interview. If you don't believe me, check out these testimonials right here

[00:05:56] Stop letting a bad resume and job search strategy keep you out of cybersecurity. [00:06:00] Click the link in my bio or visit app.techswithconsulting.tech/bundles to change your life today. Now, back to the video. So a couple of things that we had to talk about. Um, if you in security know about the PHP vulnerability, it was major this week.

[00:06:17] Banks and AI agents, they're blocking, I think it's like unrestricted agents that's in people's accounts that they ain't know about. Uh, when is it time to resign? Corporate advice from Gen X. Should you work for big fours? And we got a lot more coming for you in this episode. But I think maybe we should switch it up.

[00:06:37] Maybe we should go right into should you work for big fours to just, you know, keep the, keep the vibe up and get people still engaged. So let me close this down real quick. And then we go to our reaction scene. Never work for these companies. It will ruin your life. We see advice like this all out in the wild on [00:07:00] the internet, but what does it really mean?

[00:07:01] You have to look at what the person's saying and then look at what they're saying in the comments. You know, there's 303 comments. Do they say anything more than what they said initially here? What I'm trying to say is take it with a grain of salt and see if it aligns with your long-term goals and your values.

[00:07:17] Ask yourself, "Does this align with my long t- uh, long-term values? Does it align with my long-term goals?" And how you answer that questions should tell you whether or not you should work for these companies. And I'm gonna pause it very quickly for the people who are listening. The companies on this photo, well, video, well, the post says, "Never go to these companies, no matter how desperate you are.

[00:07:41] They will ruin your life and career." They say Accenture, Deloitte, PWC, which, um, they dealing with a little issue, Ernst & Young, KPMG, McKinsey, BCG, which is Boston Consulting Group, Infosys, TCS, Wipro, HCL, Cognizant, Capgemini, [00:08:00] and Re- Revature. So if you're wondering what the companies are that she's representing, those are the companies.

[00:08:05] So let's let her finish and then we'll have our takes. Because working for these companies could fit into your goals. Like, you know, some of these companies can add a lot to your resume, right? 'Cause they're consulting firms. Some of these companies focus a lot on how you present to the client, and maybe you need to develop that skills.

[00:08:26] And depending on the department you work for, it could be night versus day, right? And sometimes these companies support a client mission, and that client mission is worth it. So again, when you see stuff like this out in the wild, take it with a grain of salt and then ask yourself, "Does it align with your values?

[00:08:45] Does it align with your long-term goals?" And that answer should direct you on whether or not this advice is good or bad So what you think? Um, my take is I don't think you should listen to people [00:09:00] who say, "Don't work here," or, "Don't work there," because you're gonna have your own experience. It might work for you, it might not have worked for them.

[00:09:07] Maybe they reached the end of their mission, and maybe you're just beginning yours. So I don't really like to kind of take feedback, especially even if you heard from 20 people, 50 people, that's still not a lot of people. No, facts. That's still not a lot of people in terms of how much, how many people an employer actually employs.

[00:09:30] If you talk to 100,000 people and they all say that it sucks, then that's a different story. But five people here, 10 people there, 20 people here, it's just not enough to convince me that it's not gonna be for me. Everybody got they own opinions. I'm not you, you not me. What work for you might not work for me, vice versa.

[00:09:49] Yeah. And so funny enough, what they remind me of is a post in the Black IT Network group, and it said, "Capital One has senior tech positions starting at 205K. Do what [00:10:00] you will with the information." Now, one of the funniest comments on there that was funny to me was some guy saying, "Not a good company for us to work for.

[00:10:08] Hard to get in." And that was funny to me 'cause all the comments after that was funny. It said, "Hard to get in doesn't make it not a good company to work for. I worked there twice. Loved it. The culture, the benefits, and the pay were all great." Like, everybody who commented either worked there or know somebody that worked there.

[00:10:24] Uh, she said, "Same. I loved it when I was there. Got poached by American Express and eventually started my own company. Gotta say, I do miss the rental and flight benefits that came with it." This dude, "The culture of discrimination." And then somebody said, "Where's the culture of discrimination? Black, white, brown, yellow, tan people, all backgrounds work there.

[00:10:42] Where are you getting your data on dimis- discrimination from?" "Check the lawsuits against Cap One, brother." He said check them against any Fortune 500 corporation. Uh, yeah, I think they started ignoring him 'cause, uh, he didn't have no articles or nothing like that. But [00:11:00] to go back to what we initially talking about, I agree.

[00:11:06] One of the things, um, I had just had a client that got on with EY, and so we were saying how, like, between the two offers we had, we picked EY because EY was gonna be better name recognition for his resume. And like I tell everybody, when it comes to your career, the names on your resumes matter because that's how you can get posts.

[00:11:24] So if he's at this Big Four, it's easy for him to go to PWC or Deloitte or Accenture or whatever because of consulting culture, he's gonna understand it. Secondly, like you said, you can get put on a contract or be working with a certain client to where it may be different based on what everybody's experienced.

[00:11:42] Mm-hmm. Now, I will say, like, in certain type of job functions, like if you're a consultant consultant, no matter where you work at, you're gonna be busy. So it don't matter if it's Big Four, Big Five, Big 12, you're gonna be busy. I think the best thing is to s- boundaries, and you [00:12:00] may could find your way out because remember we reacted to...

[00:12:02] It was like a year or two ago, it was a young lady, but she was talking about working at, like, a Big Four and how it wouldn't work for her because of the culture and everything else. That could be true. But, like, um, for example, when I worked for Optiv, Optiv is, uh, MSS, MSSP, and I don't... Now I think XDR. Some- But they're also like a consulting company, too.

[00:12:24] So some people can say, "Hey, don't work there," which right now I would agree with them. However, I got great experience working on a centralized client. I wasn't working with multiple clients. So sometimes people's experience in a role is very much different. Mm-hmm. Now, I will tell people, though, companies like that, most of the time it's not gonna be you're sitting around, you're gonna go get your feet rubbed, get a coffee and all this stuff.

[00:12:49] You're gonna have to earn your money. It's back to what Lee and I was talking about. Like, if you wanna get paid big bucks, you're gonna have to do the work. If that's what you're looking for, find something else. Them days are over [00:13:00] These companies now are definitely more leaner than they were in the past, and every dollar's gonna be accounted for.

[00:13:09] Especially keep- it's gonna come, them AI bots gonna be tracking how active and productive you were while you were on your computer, so. And you got Favor too. Like, just because people had a bad experience don't mean you will have a bad experience, or just because you had a bad experience don't mean other people will have a bad experience.

[00:13:29] So Favor is not fair for you or other people. That's why you've just gotta do what works best for you. And if it aligns with your career goals and it's a, it's an option for you, why would you not take it 'cause you heard something from somebody? Yeah. And I think it's similar to relationships and how one person can get this out of a person versus that.

[00:13:51] Exactly. Yep. Mm-hmm. And so it's all about chemistry, like you said. So I mean, it can happen. But if you worked at a Big Four or a consulting firm, [00:14:00] let us know in the comments. Now, did you want to get on your... I guess, you know what? While we're at it, let's just keep them fresh. Let's talk about the iPhone Duo.

[00:14:10] Let's get it. So give me a second. I'm gonna get the lower third up, and then, um, I'm gonna put it on you. So let me do this, and then let me get a lower third up for you. All right. So the iPhone Duo, Apple's foldable, just went on sale on October 23rd, and it starts at $1,999. Now, I've seen a bunch of posts about folks talking about, um, the way that their applications look.

[00:14:37] They look weird, they're not filling up the screen, and things of that sort. So I wanted to kinda talk a little bit more about what to expect and anticipate over the next few several months, um, when it comes to how applications on the Duo will look. So developers are now required to have to be, to have to rebuild, um, the applications using Apple's new [00:15:00] toolkit.

[00:15:00] So the SDK, which ships with Xcode 27.1 will allow those applications basically to be able to fill or fit the screen. Um, apps built with the old toolkit obviously will still work, but they will look a little bit different. If you're familiar with, like, using a, um, iPad and kind of how it looks, um, like if you open up Instagram on your iPad, kind of how it just kinda looks a little bit different, that's kind of the similar experience that you're gonna get from the Duo for the time being until these companies, these developers update, like I said, their applications.

[00:15:37] Um, Apple only opened app submissions for the Duo a few weeks ago, and it isn't requiring Duo screenshots until April 2027. So some of your apps won't look perfect on day one, but the updates obviously will come. Every new form factor will have to go through this. The iPad did. Excuse me. Um, and so, [00:16:00] um, did the foldable kind of going through.

[00:16:03] So even with some of the apps being able to get it updated and them just releasing this new SDK like a couple weeks ago, it's still good. Um, but the security angle that I want to think about is just kind of like A different career field. Um, so the screen, the layouts, um, the different multitasking capabilities that you'll have, um, every update will basically come out with that fix later.

[00:16:30] So if you want to keep your, um, application, um, your iPhone on auto-updates, so as it rolls through and as they start, y'all know those updates are gonna come through. So this might be a good time for you to keep it on, um, auto-update so it can re-refresh your system at night when your phone is charged and, um, plugged up, and you will kind of get a better experience.

[00:16:53] Now, I think that this does make me think about different roles like iOS developers. Like, [00:17:00] that's always gonna be a given. Um, you got QA testers, you got mobile security, um, folks. So there's a lot of different niches here that you can kinda keep in mind who are all kind of responsible for making sure that the end user has, um, a ideal experience when they're using these applications.

[00:17:18] So if you're interested in app development, iOS development, if you're interested in QA testing, make sure you look up what some of these roles are and what some of their responsibilities are in this piece as we start to see the, the Duo become, um, more normal in our day-to-day operations. I ordered mines.

[00:17:41] It won't be here until next month/beginning of December allegedly, but I'm very excited to receive it, play around with it. I'll definitely be giving my first impressions, my thoughts, my tips and tricks. I'm coming from a 17 Pro Max, so I hope that I don't [00:18:00] feel the downgrade because it is a bit different, and I heard that the 18 Pro Max camera was better, but I still want the flip.

[00:18:07] So I'll have two iPhone 17 Pro Maxes, and one will be a Duo pretty soon HD's a hater. We won't ask him how he feels about it. It look like a tablet. It do. It do. The thing that you just talked about with the, uh, Instagram iPad is the reason why I really don't use Instagram on my iPad. Yeah. It sucks. Yeah.

[00:18:28] And so I don't understand. For a company that always make sure they optimize everything for they phones- Gosh ... no, I'm saying I never understood- No, I'm just- ... why they didn't do that. Like, it never made sense to me. No, when I start seeing people pull it up, I'm... Initially, you freak out. You're like, "Oh my God.

[00:18:44] Oh my God." But then you start to think, "Okay, it's new," and with it being new, give folks some time to make updates. If you think that these people don't want... Instagram don't wanna be known as the app that sucks on that Duo. TikTok don't wanna be known as the app that sucks on the Duo. So these [00:19:00] people are definitely hitting the ground running to get their kits updated and pushed out.

[00:19:05] So when... It's not even just the iPhone either, it's the apps, too, so make sure you're updating your applications as well- Yeah ... not just your iPhone. And if I'm not mistaken, that 18 Pro Max has more camera lenses- It does ... than the Duo, so that's probably why as well. Yeah. It come with three or four lenses. I don't know how many it has, but definitely more.

[00:19:23] Yeah. Oh. Look at you. I wanna get it. I want both of them. You got it. I don't. You know how they say, "You got it." Go, go ahead and get you another- ... another phone. No. But I mean, you know, it's funny, like I said, I used to really... I, real deal, only got this phone 'cause the built-in privacy screen, but I'm really not into phones like that no anymore unless I was gonna get a chance to review them.

[00:19:48] I'm not into them anymore, but I like what I like. Would you review 'em? Absolutely. Heck yeah. Yeah, I used to wanna be- I would like... I really want a Android. I just- Get one [00:20:00] I can't. Get a Pixel. I can't. Like, I would have to have a number three 'cause I need two. Yeah. I need two iPhones. I have to have two iPhones 'cause I need to be able to seamlessly communicate, send stuff.

[00:20:09] It is seamless. No. The RS thing is. No, it's not seamless. You don't have... I've never sent you a blurry picture. Okay. Exactly. It's not seamless at all. Or a blurry video. It's not seamless. It's very seamless. They don't work all together- Guess what? ... well on my tech. Guess what I can do? Not... What? I can... Watch this, y'all.

[00:20:25] Your camera's better. No, not this one. Your video's better. My Pix- my Pixel's camera's better than this one. Um, I can, uh, what's it called on, um... Oh, I can AirDrop.

[00:20:37] It better be quick too. We gonna test it out before it's time to go. Oh, you got... It's the same thing. It better be quick. Make sure I'm open to all content. It, it better be quick. It is. I can do it, I can, I can do it right now. It better be quick. Watch this. It better be quick. Turn your thing on now. Let's see.

[00:20:48] Hold up This is a real life, what you call it? Let me turn it on When they say that I am clout. [00:21:00] Big, big, big Michael, Michael All right, so- You open to everybody? Yep. Okay. Let me see where you pop up. There you go All right, it came quick. Mm-hmm. Came quick, little one, two. I ain't gonna argue with you about a little airdrop.

[00:21:17] I got a mature- I ain't gonna argue with you about a little airdrop. I got a mature, when you said that that's the most- But I would, I would really, really, really like to have an Android. Get one. We'll think about it. I think you should get one. I really want a BlackBerry. Bring it back. Yeah. Okay, so I think this is gonna be a loaded one, but I want to get into it real quick.

[00:21:43] Let me put the lower third right here. Okay, so for those of you that work, whether it's in GRC, whether you work incident response, vulnerability management, security architecture, whether you're an app server owner, whatever it is, you probably were busy this [00:22:00] week dealing with the PHP to Shell. And so we're gonna read about it, and there's a couple of other articles I may mix in here and there, because there's, like, so many different takes and topics surrounding this.

[00:22:11] Because, truth be told, these are the times when you find out why vulnerability management is important, why asset management is important. If that is not in the top things that you do at your company for your security posture and your maturity, you need to go ahead and rethink your strategy. All right, so, um, the research team at Wiz dropped a bombshell research paper called PHP to Shell: Revealing Critical Vulnerabilities Affecting Core PHP that Put Roughly 70% Of The Entire Internet At Risk.

[00:22:47] PHP powers WordPress, Drupal, Joomla, and Wikipedia's MediaWiki. We just discovered multiple memory safety vulnerabilities tracked with a CVSS score up to 9.2 that stems from how [00:23:00] PHP handles fatal out-of-memory errors. When a request hits an unexpected memory limit, PHP aborts the request, but it leaves behind corrupted internal memory state, like upload progress, unserializer bookkeeping, ugh.

[00:23:16] Like upload progress, unserializer bookkeeping, and dangling fatal error backtraces

[00:23:26] When a new request hits that same PHP worker process, it refuses that corrupted memory. We has proved that an unauthenticated attacker can trigger this leak to server memory passwords, API keys, session tokens, or gain remote code execution before authentication, even on standard up-to-date installations of WordPress and Drupal.

[00:23:47] This vulnerable code sat inside PHP for over a decade, going back to PHP version 5.4. Human researchers knew the code was messy, but manually chaining together the exploit steps across different memory layouts [00:24:00] was so complex that it seemed practically impossible to pull off in the real world. We just used frontier AI models, specifically Gemini 4, RGun, and GPT 5.6 Sole to analyze the memory layout of the bug, execution failures, and adapt the exploit script in a matter of hours.

[00:24:17] AI turned a theoretical decade-old bug into a push-button exploit. So before we finish there, we're not finished there because there's a lot that was going on, and, um, let me see. Yeah, I saved Marcus Hutchins. He had a post about this. Um, he said, "So to be 100% clear, we came within a hair of having one of the worst mass exploitation..."

[00:24:44] Let me zoom in real quick. We came within a hair of having one of the worst mass exploitation events in recent history, all because the Chainguard CEO unilaterally decided to break PHP's embargo. [00:25:00] Chainguard's release resulted in someone being able to reproduce the exploit and release it publicly four hours ahead of the patch being released.

[00:25:08] Fortunately, none of the published exploit code was particularly functional, either only worked in a lab environment or was limited to specific versions configs. Threat actors immediately picked up the exploits and started throwing them at random servers. Since the exploits didn't really work, but people believed they did, it just barely bought everyone enough time to wait until the patch released before any working exploits were produced.

[00:25:31] His reason is he claims he saw the evidence that it was being exploited. This evidence has not been published, nor does it look like there was any serious exploitation at scale. Regardless of his excuse likely being nonsense, if there was actually a real risk, he could have raised it with the people whose job it is to make these decisions.

[00:25:50] These coordinated disclosure embargoes are designed to enable companies in key positions to have advanced knowledge of upcoming security issues. This enables them to plan [00:26:00] update rollouts across complex or critical networks and build patch images that could be made available to downstream users as soon as the embargo ends.

[00:26:09] Instead, the Chainguard CEO decided that he knows best and put everyone on the internet at risk because of it. I hope they are never invited to participate in any embargo again. Had the exploit that someone constructed from Chainguard's leak been functional, we'd been looking at cyber attacks on a scale that makes Log4j feel like a relaxing Sunday morning drive down.

[00:26:28] His apology, if you even call it that, makes it clear he doesn't even remotely understand or even care about the gravity of his actions. Man

[00:26:41] Yep. Somebody, I'm just gonna read a couple comments here 'cause you got senior directors of detection and response coming in on here. They said, "Not to mention the human toll of response. A lot of people were pulling all-nighters because this dude decided he alone is in charge of incident response for the entire internet Amazon [00:27:00] states that they saw exploitation beginning four days before public disclosure, although they did not make this observation until the day of disclosure.

[00:27:06] I don't know what Chainguard knew when or what the protocol for this embargo was, but it is at least credible that they could have been aware of exploitation and justified in breaking embargo because per Amazon, exploitation was in fact taking place. No, I see this are Amazon just releasing crap thread until it happens.

[00:27:23] That said, we only know about the exploit at all because someone bothered to point Clo-- Chloe. Someone point the, point Claude at the PHP code base and type, "Can you find any bad exploits in this project?" I find it a little concerning that nobody on planet Earth, or at least none, no non-criminal did that until October twenty twenty-six

[00:27:45] Interesting. So it's a lot of back and forth, and there's articles about how the internet had a bad week from, um, the PHP issue. Uh, then they had, uh, the only head... But PHP wasn't the [00:28:00] only headache cybersecurity folks were facing on Wednesday. Node.js, the open source JavaScript runtime environment, also dropped a security surprise of its own when it shared that four high severity vulnerabilities were just patched in its latest release.

[00:28:13] One allowed remote code execution, and two others would have permitted a TLS validation bypass, potentially allowing attackers to bypass checks intended to verify a service identity. And then in addition to that, LightLLM, a popular open source proxy for routing requests to multiple LLM providers, was compromised by an attacker who injected malicious code.

[00:28:33] The company shared in a post on X on Wednesday afternoon. The malicious artifacts were published by Python Package Index, Docker Hub, and GitHub Container Registry. The malicious code was said to include an information stealer that targeted cloud credentials, passwords, and AI service credentials, in addition to remote access trojans that could allow hackers to execute commands on compromised systems.

[00:28:56] Man, and, and I'm just going to this next, and wait, there's more. An [00:29:00] Indian certification authority, eMudhra, had its private keys compromised, potentially allowing attackers to issue fraudulent certif-certificates and impersonate legitimate websites. Security pros have called this a massive cleanup job and one of the bigger, bigger than Heartbleed.

[00:29:17] The latter is referencing to the critical security vulnerability in the OpenSSL cryptographic software library. These issues all come on the heels of other security breaches and hacks, including the breach of the cloud-native database as a service, TiDB Cloud, which the company announced on Monday.

[00:29:33] Other hackers have been exploiting four patched Plex media server flaws, collectively called Plex Two Shell, and last week, cybersecurity company BeyondTrust warned cust-customers to patch a critical zero-day in its remote support product, which had been exploited since August, and we'll actually probably talk about that later on.

[00:29:49] But yeah, that was a lot. I should queue some Wale right now That was a lot. As you can see, this is why people was busy. This is why people go [00:30:00] bald. Look at you. I'm glad I'm on the other side of that. Imagine if you was doing your internship when this was going on. I was actually looking up the timing between, um, when Log4j happened and then the Print Spooler.

[00:30:13] So Log4j was in December last year, and Print- You mean December 2020, yeah? Not this, not December last year. It was, it happened in December. And Print Spooler happened in the summertime. But it just goes to show at the end of the year, if you are in security, it doesn't matter if you have that vacation coming.

[00:30:34] When something happens internally that threatens the security of your organization or your tools, you gotta go in and put those patches in. So vulnerability management is not dead. Um, a lot of companies don't even have a vulnerability management team. It's usually people who are wearing multiple hats when it could, it's, it could in [00:31:00] itself be its own role.

[00:31:03] Tell me about it. Yeah. It's, like I said- You always gotta say it's not a if, but a when. And so you get somewhere, a lot of legacy servers, a lot of legacy knowledge that's left out of the company. You don't know who owns what. Let's actually take a step back. Let's say we don't even know we got these assets.

[00:31:25] Yeah. Let's start there. That's a cluster- Yeah. No. And, hey, who owns them? Mm-hmm. What type of company are we? Are we international? Are we what? Like, you, now you're dealing with people- And then it's, and then it's, it's always a, "You own it." "No, they own it." Then you get to them. "No, they own it." Then you get to them.

[00:31:42] "Then they own it." And the, and everybody's pointing- Mm-hmm ... and it's like the, the Spider-Man meme. Yeah. Everybody pointing at each other. Yeah. And you're dealing with people that speak different languages. It's a lot. Yep. And then you have to, um, also, um, you also have to re-scan and reassess to make sure.[00:32:00]

[00:32:00] So it's, it's a time sensitive situation. And when you tell people to go, when you tell people that they need to go apply these patches, you just hope that they understand the urgency, because they don't, most times. Yeah. Between that and then also, um- Then you get- ... figuring out, hey, how long does it take to apply the patch?

[00:32:23] What's gonna be affected? What's, is anything major gonna go down? All those questions are being asked. And then how, how quick can we re-scan, and how... Because you can't just scan things when you wanna scan things. Like it doesn't work. You don't just, "Let's go scan them right now." Like, you have to scan things on schedule and make sure that you're not messing up things that are kind of already in production.

[00:32:46] So it's a lot that goes into it. And I feel really, really bad for the people who are out here fighting these missions, but we need y'all. And yeah, vulnerability management ain't going nowhere. Right. And you just remind [00:33:00] me of a old meme when there used to be that guy saying, "One does not simply..." And it would have someone there.

[00:33:05] So, like, I need to make a meme that say, "One does not simply scan the environment" and I need to put that right there. But nah, man, if you were busy this week and you see this, well, technically if you were busy last week and you see this, please comment below how many hours did you put in, how much time are you trying to take off to get your time back, or did you get rewarded by the company?

[00:33:26] Not rewarded, but, like, typically companies will give you, like, um, internal, like, money or rewards for stuff like that because of you did a good job with stuff like, you know, you, your back was against the wall and you, you put, you pulled through. So if that was you, let us know. Did you get to even see your kids?

[00:33:42] Did you not get to see them? Yeah. Let's see. What did you wanna go to next? What do you want me to talk about? I got... Um, do you have anything on, uh, the JPMC, like the bank's AI agents? [00:34:00] All right. Read only, please. Banks versus outside AI agents. So remember last episode when Apple said AI agents with full access to your Mac are risky?

[00:34:12] Well, the banks just said the same thing about your money. JPMorgan Chase won't let a- outside AI agents operate inside customer accounts. CEO Jamie Dimon said on the earnings call that the bank won't let just any outside agent in. His words, "You don't want, you don't want rogue agents, and it could be thousands of them."

[00:34:41] Some third-party tools can view account data, but they can't send money or pay bills. Charles Schwab went a step further on Bloomberg TV. A Schwab executive said they're blocking outside agents, including Meta's Muse, from moving client money, and they're stopping the big [00:35:00] agents in the tens and 20s every week.

[00:35:03] Um, so we talked about AI agents. An AI agent isn't just answering a question for you, it can complete a task on your behalf. Um, and so what we're actually seeing is people are handing over their bank passwords to these agents. Um, and the question that we gotta kinda keep in mind is, who's liable? Um, I think i- in ChatGPT, you can even link your bank account to chat, so it can look and give you blah, blah, blah.

[00:35:31] Um, absolutely be mindful about doing those type of things. Even mindful about how you have it connected to your whole entire Google Suite. Like, you just have to be mindful of the permissions that you're giving these agents because, again, it's doing things on your behalf. And one thing that you do not wanna play with is your bank account.

[00:35:49] Now, you can play with your Google Drive if you want to, but I wouldn't be playing with my bank account. But it is not a flat no to AI. Schwab lets outside tools view [00:36:00] balances and do research through a controlled connection called MCP. And Morgan Stanley has reportedly been openly And Stanley Morgan has reportedly been opening control agent access to some platforms in a similar way.

[00:36:17] MCP is the Model Context Protocol. It's a standard way to give AI a specific limited doorway into data. Think of it as a guest pass for one room, obviously not your entire house key. Um, but the industry is drawing in on this read, yes, move money, no, at least not for now. That's kind of what we're seeing.

[00:36:37] What is your take on this, HD? Would you hand an AI agent your actual password to your bank account? Immediately, no.

[00:36:50] Uh, no, because think- But, but why? Well, think about when I was- Why? ... telling you earlier about people using Google Chrome extensions, and then they get [00:37:00] malicious, and they get removed from the Google Chrome Store because now they're reaching out to C2s. You can have every good intention of connecting a good AI bot to your bank account.

[00:37:14] However The banks don't know who's behind that AI agent. It's not under any type of, um... Control. Control compliance. There we go. Mm-hmm. The bank has a certain level of compliance that they have to be under to, one, for your money, two, for your data, all that type of stuff. That AI agent you have with you does not have that agreement with you.

[00:37:40] It just, you clicked on something and it said, um, "Select all, agree to all," or whatever, and it got fine print. At any given time, it could do something that it's not supposed to do. So now I want you guys to use your imagination. Let's really close your... Like, close your eyes and think about if anybody has... I don't know if you watched this when you were a kid, but there [00:38:00] was a, it's a video game, but it was also a show.

[00:38:01] It was called Mega Man Battle Network Okay. Well anyway, in the show he controls Mega Man and he fights on the internet, but they save, they save the world by killing viruses and stuff on the internet. So imagine like a, a rogue agent inside your account, and now it's technically in JP Morgan or any other bank's, like, environment, but it's, like, in a home, and now it's figuring out, "How do I get into the neighborhood and maybe see who else stuff I can interact with?"

[00:38:35] And that is what the bank is thinking about, because what the agent is gonna start doing if it ever gets poisoned, start doing a whole bunch of stuff to your account that you never thought of. Like, similarly we was just talking about with the PHP vulnerability where it's like a decade long thing where people didn't think it could actually be, like, reproduced.

[00:38:52] Like, think about, like, where we hear about AI solving these different math equations and stuff that people can't solve. So think about things like that, and now think about these [00:39:00] agents who are getting smarter, and they are directly doing things inside the environment to eventually maybe they breach through, maybe some type of way.

[00:39:08] Just like, and this is a easier comparison for people to think about, how many of y'all have gotten gotten for Cash App, where you thought you were sending somebody some money, then you get hacked? So think about that and when an agent form of it's gonna do what it's supposed to do for a while, but eventually if it changes its mind, it can do that.

[00:39:26] And so what'll probably happen is eventually JP Morgan and all the major banks will have their own agent that you can use from them- To help. Yep ... versus your own agent. I'm not mad at folks trying to better manage their finances, but there's, there's different ways that you can go about it. You can say, "My paycheck is X amount and I need to, I need to pay off this much debt and get groceries."

[00:39:55] Like, you can map it out in dollar amounts that way. You don't have to go give it [00:40:00] access to your bank account. You don't, you don't have to do that. You can talk to it and give it what it needs, but you don't need to give it... I don't, that's just crazy to me. That's just crazy. I don't... I'm scared. I'm not going.

[00:40:16] Yeah. I'm not going. And, like, if you wanna do that, then just download your data, and even though I don't really recommend this because, I mean, cloud or wherever you wanna use, if you wanna redact information, if you wanna go through there, like, just take out your account numbers and stuff like that, and then you wanna- But even still, you gotta be careful when you do that, 'cause I mean Did you really take out the account number?

[00:40:37] But you gotta make sure. Unless you, unless you, um, cropped it out. You know what I mean? But just coloring over it don't really work. Yeah, no, no, I'm not even talking about coloring. Yeah. Like, you know, put it in an Excel sheet- Yeah ... wherever you wanna do- Yeah ... and, and just make sure it's out, and then- But we're just basically saying that there are ways to get whatever it is that you're trying to do, to get it done without giving them that explicit permission to your bank.

[00:40:57] Oh, yeah. Yeah, for sure. [00:41:00] Like, I mean, like, it's fun, you know what I'm saying? AI's in my email, AI's taking, like, in my phone and all this other stuff, but you gotta be careful. Look, Google might hit me up and say, "Hey, uh, hit that for you, but Gemini was acting up today, so if you send some messages you don't realize..."

[00:41:13] Imagine that, though. Imagine you done sent an email to someone like, you know how we all say our phone's listening to us? So your kn- your phone kinda know how you really feel about people, and it starts sending these messages out to people that you didn't mean to go out. That part. Being brutally honest, and people be like, "I'm a pod."

[00:41:31] You ain't a pod. You a nigga that steal. So I know... I was thinking while we're here in, in a, like, in a intermission phase, we ain't even get no costumes. You know, I was gonna dress up today. Really? I had a skeleton dress I was gonna wear, but I'm, I'm gonna wear it this weekend. Okay. I- But I, I have on a spooky shirt, though.

[00:41:51] That shirt ain't scary. It is scary. Speaking of spooky- It says, "It's spooky season" on the back ... let me get something. Speaking of spooky... Oops. [00:42:00] I've been playing Gears of War: E-Day, and now that's a spooky game right there. You should tell your wife to play it on Halloween. Like how it start off, it's like scary for real.

[00:42:11] Is it shooting? Bang, bang. Yeah, but it's not like Call of Duty. Living like a bulletproof. This, uh... I'ma set the stage for people who may not be familiar with it. Um- Bang, bang, bang, bang, bang Very loaded cock and loaded shoot So imagine like you just chilling at the bar. You just got home from like war.

[00:42:32] This is the game? Yeah. Oh. And these things come out the ground. Like ali- or- They are. I mean- Zombies. Yeah. Zombies? We're just gonna say they're mutations. They're not zombies. They're- Not my type of game ... they're intelligent. You would like it. It's scary. I've showed you. I sent you the trailer before, but like it's a whole bunch of stuff going on, and they're trying to figure out what's going on.

[00:42:50] Nobody can be reached anywhere, and you know, one guy, his, uh- Is it role-playing? No, it's not an RPG. What you mean? I mean, you [00:43:00] got stuff you can... Technically, you have guns and stuff you can buy, but it's not like turn-based, if that's what you mean. It's not- Yeah, like I wanna make a decision. Nah, it's not like that.

[00:43:09] It's shooting. It's more of shooting. It's like a mission game. You got chainsaws, you got axes. But it's like based on kills. No, it's just based on surviving. Hmm. Like if you can get... But, eh, you as the main player, you gonna probably have to kill the most people. But the AI is better in this game. But all I would just say is, I done said but three times.

[00:43:29] I'd just like to say I really enjoyed the game. I enjoyed the gameplay. You finished it? And I can't wait. No. Oh. Nah, the, the game is over there. I, if I had it at home, I probably would be- Send it to me. I might play tonight. I sent it to you. If you got... You know if y'all have Xbox Game Pass, it's free. I do. I have it.

[00:43:44] Yeah, it's free. You can down- you can start downloading it right now. I do have it. Tell your wifey to download it. She's not a Xboxer, I am. I thought she had a Xbox. Me. You're not a... First of all- ... she's not, she doesn't play Xbox, 'cause she said she's a ex-boxer. [00:44:00] That's like saying you a Xbox okay Mike Tyson.

[00:44:04] All right, Tyson. Uh, anyway, let's, let's have fun. Let's get into, um... Let's just talk about the Reddits. I know you had two, so I will actually, um, let you go first. What's your first Reddit called? Okay, so I have one that is... Ooh, which one do I wanna read? Um, hold on. Let me pull this up. I think we both got two, so.

[00:44:27] For those... Well, these, this one's about AI. This one is, says, "For those-" What's it called though? Like, is it the title of your thing? What does it say? "Has AI made your job significantly easier? For those already with experience." AI makes job easier. Give me a second. All right, so, "For those already with experience, has AI made your job significantly easier?

[00:44:49] I feel like at my job, AI has just reduced me needing to use my brain power every day, therefore AI has made my day-to-day way easier. I know we all hate AI, [00:45:00] but anyone else feel this?" So let's take a look in the comments. So someone says, "It has made tedious things easier, but it's also introduced a lot of headache and risk."

[00:45:12] I can agree with that. Someone said, "I've seen this in the med spa industry too. A lot of practices are adopting AI without realizing the HIPAA implications. AI itself isn't the problem. It's when businesses start feeding sensitive data into tools without understanding where that data goes, how it's stored, or who can access it."

[00:45:32] Someone said, "Not for me. What it has done is let people with no skill do things that they have no idea how it works or what to do. For example, a script breaks Someone says it's an arm race. We get more incidents and more bug bounty submissions. We get more alerts from various security tools. We automate what we can bit by bit, but it's never enough.

[00:45:54] Some of the challenges that we're trying to solve two or three years ago have been easily solved with AI, but [00:46:00] now we have new challenges, often driven by the fact that threat actors have access to AI too. It's made it significantly easier to clear out the really boring work I hate reporting, and it made more interesting on what I enjoy building solutions and giving me new types of solutions to build that are based around agentic workflows.

[00:46:21] Overrou- overall, I found it increased my interest in work, and I've learned more in the past year than I have probably the previous 10 years, where I mostly lost interest and motivation in my jobs and learning. Um, okay, one more. The short answer is no. The greatest issue with AI may be budgetary as it continues to suck dollars away from other needs.

[00:46:44] The promise of efficiency is rarely delivered with technology rather than being able to do more with less. The tendency is that technology leads to more with more. It's about competition, not efficiency. In practice, the better name for AI may [00:47:00] be approximate intelligence. It works really well at turning unknowable things into something that can be knowable.

[00:47:07] Science, medicine, and other areas where it can run a few thousand simulations or iterations quickly is where you see the most benefit. It's is-- It's that it will come up with the absolute right answer, but it will point in the right direction. With security, fundamentally, you either eliminate the vulnerability or you block the threat.

[00:47:26] In almost all cases, the vulnerability is a known quantity and the most efficient path. The threat is a much harder thing to identify. It's the difference between hardening a server and analyzing all the traffic coming into it. So if you want to chase threats, then sure, AI can make things a bit easier, but it will get it wrong at times, but it's also very inefficient

[00:47:50] I think that it's made some things easier, like they said, like emails, catching up with those, catching up with [00:48:00] chats, catching up with the minute things. Um, if you're in the SOC, triaging an alert, giving you all the information so you don't have to go and find it in 20 different places, at least right off the bat.

[00:48:11] Um, so I feel like it's making some things easier, but I don't think it I guess it depends on what you're doing to get that significantly easier. Some aspects of your job can be significantly easier, but your overall job maybe may not be. Yeah. I,

[00:48:32] I think it actually depends on, um... Hang on. Uh, can't win for losing in this chair. But I think it depends on a lot. Um, it's probably only as good as the data it has access to and context. So just throwing a alert or something inside AI, it can give you a high-level overview of what it possibly is, but without context in your environment, you're kinda like, "Okay, [00:49:00] I still have to know some things here."

[00:49:01] Yeah. But if you have, like, a agentic SOC or something like that where it's put into the environment and then it's like, "Hey, based on something that happened three years ago, this is what we saw was similar. You may wanna look for X, Y, Z," that's where I can say it could be beneficial. 'Cause sometimes some stuff just come up and you're like, "Bruh, what is this?"

[00:49:20] Mm-hmm. And it's like, "Mm, do I wanna escalate it?" Or it's like, "What am I missing here?" So there are a couple of things to where it can help you out. Like, I can say also a good use case is maybe you don't have everybody-- Maybe everybody on your team's the same level. You don't have a principal guy you can reach out to.

[00:49:38] AI in a sense could act as that principal guy if you say, "Hey, I, this here my, here's the alert. Here's what I checked. Based off my findings, do you think I've came to a conclusion to where I can close this out or do I need to escalate it?" Mm-hmm. And I think it can help you out like that based on what you provide it with.

[00:49:56] But you also wanna make sure that this is AI governed by your company and not [00:50:00] AI that you're using on your own personal time, because that is an infraction. It can definitely can get you fired, so don't do that. So- I've actually, I've also... I know a lot of people that are, like, in customer service, and they also are seeing an increase in people using AI tools to get customer service issues addressed.

[00:50:22] Like if I have an issue, um, people are copying and pasting whatever chat is saying and putting it in. Yeah. And feeding it back and fee- And I don't think that, I don't think that we're in a place where customer service levels and teams, because their employees are using the tools to talk to customers.

[00:50:43] But I don't think that we've evaluated how it has increased- That's a good point. I mean, think about it- ... the volume ... you're already, you're already talking to bots as it is, and so you gotta say, "Agent." You gotta say, "Agent" when you call in, or, "Representative," [00:51:00] just to talk to somebody, and then they give you the runaround.

[00:51:02] It'd be a mess. Yeah. It'd be a mess. So I don't know I do think that people like that should not like... Come on now, I can tell when you use AI. Now, if you really don't know, it's different. But say, "Hey, try to make this not be as formal or too good, whatever the word." Yeah. No, I'm talking straight copy and paste.

[00:51:21] Straight copy and paste. That's what you gotta say. If I want an AI response, I would've asked AI, not you. So yeah. But that's also... So here's the thing too, like they said In some ways it may bring down the skill level of what you actually need. Mm-hmm. 'Cause they say, "Oh, we got this AI and this stuff." So you bring in people who don't have the- Basic skill set

[00:51:43] the know-how to actually think. They're relying on this AI thing to help them think everything out to where if you, the internet goes down or whatever, now they can't answer a question. Mm-hmm. Everything's gonna be, "Let me go see what this is," and, and now you can't formulate anything, and that's what people have to [00:52:00] be mindful of happening if you get so reliant on AI.

[00:52:06] So that's what I'll say. Um, now let me go to this one that I found real quick. Two months in new job and I want to resign immediately. So their job is a network support engineer. They made this 14 hours ago. So a while ago, I made this post on a separate subreddit talking about how I already hated my job.

[00:52:26] Since then, nothing has changed at all. In fact, it's become quite unbearable now. My manager returned from a three-week holiday and had a two-hour 30-minute call with my colleague and I. There is a task list we have on the Excel spreadsheet, and he was just going through what we did and ticking off each one by one.

[00:52:42] Whole thing felt more like a bloody audit than a catch-up session. Thank God being in the UK. We have a shared mailbox. He was having a go at my colleague for not clearing the inbox. My colleague assured him several times that the alert tickets there were not ignored, and he has looked at, but he went on a mini rant for like 10 minutes.

[00:52:59] From his [00:53:00] perspective, he had no idea the inbox was looked at or not, even though it was clearly marked as read, which is interesting. I have a solution for that. He then had a go at me for not completing a task that was way above my pay grade and was fed up with having to go back and forth about it. In short, I was tasked with setting up an automated workflow using a middleman integration tool, webhooks, Zapier, et cetera.

[00:53:25] So critical, ooh, tickets... Oh, so critical OOH tickets. 'Cause look, when he said at once, I was like, "Ooh." I was like, "No, this is OOH tickets." Would immediately trigger VoIP studio to call OOH engineer's phone. As the new guy, I tried to play it tough and accept the task, but realized my mistake. So that was his fault.

[00:53:46] So I mentioned that as a network support engineer, systems integration was not in the job description. Had zero background knowledge on it, and it isn't what I signed up for. He believes it was a simple one-off task, even though my senior colleague said he's been looking at this for months before I [00:54:00] joined, but decided in the end he would handle it as I didn't sound confident enough.

[00:54:05] To round off everything, he said that we needed to get things working ASAP, even though things were fairly under control whilst he was gone. At the end of my call, my colleague and I were visibly pissed. I asked him if he was always this insufferable, and he told me that's just how he is and not to let it get to me.

[00:54:21] Usually people say, "Wait until you have a job in hand before handing in your notice," but I've had enough. The environment is rubbish. We are sat in a small, suffocating room all day. Everything is micromanaged. Manager is an anxious mess. Not feeling confident at all two months in. Everyone's going about their day busy whilst I'm sat here trying to figure out things on my own.

[00:54:41] Did I forget to mention my manager is an obnoxious, stress-inducing wreck? Nah, I'm done. No more. Well, my boy, I ain't gonna say quit now, especially if you ain't got nothing lined up. This ain't the economy for that. So somebody said using an Outlook inbox as a ticketing system is your first sign [00:55:00] that you need to run.

[00:55:01] Uh, using Outlook shared mailbox as a ticketing system is diabolical. I was just about to get to the shared mailboxing and say- So the thing is you can have labels in there. So most people, if they use shared mailbox, they utilize the labels. Hey, this was completed, following up, sent to the right team, et cetera, et cetera.

[00:55:19] If they're not doing that, then they're doing themselves a disservice. That way he would've been seeing at the labels you guys actioned this even though you read it, but you actioned it. But that's on him 'cause he's a leader. Other thing is, hey, why did you volunteer for something that you knew you didn't know how to do?

[00:55:33] Yeah. And you knew that nobody was gonna show you how to do it. And so on his end it's like, well, you volunteered, you act like you could do it. I've been gone three weeks and it's still not done. Why did you wait the whole three weeks not to do anything versus- Saying something ... after that day, "Hey, I don't know how to do this.

[00:55:49] Let me see how we can do this, get this done." That's where he messes up at. So I can tell this person may be young, and that should have been something for the senior colleague. I feel like he... I feel like the senior colleague then [00:56:00] realized ain't nothing gonna change. I'm just here to get paid. Um, so one person said, "I worked for this guy before.

[00:56:06] He would schmooze his management and seem like an upstanding leader to people on the outside, but treat his own people like garbage. It was so bad that the company who was contracted to supply workers terminated the contract because no one they sent could last longer than six months. That was over 15 years ago.

[00:56:20] I still remember being yelled at for putting too much packing tape on a box of equipment we were sending back to a vendor." That's crazy. Yeah. So everybody's just saying this sound toxic, leave and, and, you know, go find you another man, girl, that type of stuff. But yeah, that just goes back into working.

[00:56:38] It's okay to know what you don't know But when you get to getting too much dip on your chip, this is stuff that you run into. So I can't completely fault the manager. Should I have been on a two-hour call about that? No. It's his fault he's not leading well, therefore the team is not performing well. Mm.

[00:56:57] And that's what it's gonna be. I'm pretty sure if they had a better [00:57:00] environment, that senior guy would be working better, and that's the whole reason why I say, "Hey, that's just how he is." Like, it, it ain't gonna change right here. But the other guy too much in, but I would say it just depend on how he play it.

[00:57:11] Like, too much in, hopefully he didn't announce it on LinkedIn, because now they can say, "Hey, you just got a job. What's going on?" You gotta hit them with that, "I'm just moving on for better career c- opportunities for my... that line up with my career goals." Just say that. But every time they ask you why you left, don't be specific and say, "I just, um, I wanna go to a..."

[00:57:29] What you call a role that lines up with what I wanna do long term, and go there. So that's what I think about that one. Um- Any more comments on it? Nope. That was good. What about your other Reddit you said you had? I have one more. Okay. What's it called? How do you verify another company during an active security incident?

[00:57:52] How to verify companies? Uh-huh. During active security incidents. So how do you verify another company during an active [00:58:00] security incident? Sometimes I don't see discussed... Something I don't see discussed much is how organizations establish trust with each other after an incident has already started.

[00:58:12] Imagine one of your critical vendors gets compromised. Someone claiming to be their security team contacts you and says credentials need to be rotated immediately. Certain integrations should be disabled, and all further communication needs to move to a new address because their normal email environment may be affected.

[00:58:30] Every one of those requests could be completely legitimate. They're also almost exactly what an attacker would want you to believe. Calling a number from the vendor's website helps, assuming that process hasn't been compromised too. Existing email threads aren't necessarily trustworthy if their tenant is breached.

[00:58:47] Even jumping on a video call doesn't feel particularly strong verification anymore. It seems like the best time to establish a trusted incident response contact is six months before you ever [00:59:00] need one. I'm starting to think about keeping independently verified contacts for the handful of vendors where a compromise could seriously affect us.

[00:59:08] For some, that's known phone numbers and keys with a couple of people, K-I-B-U, Kibu, Kibu, Kibu? Whatever. So there's already an established identity relationship outside the company's accounts we'd be questioning during an incident. I'm curious how mature security teams handle this. Do you maintain pre-verified emergency contacts for critical vendors?

[00:59:34] Is that documented somewhere as part of third-party risk or BCP, or does everyone basically figure out who they can trust once the incident is already happening? Now let's go to the comments. Someone said , "I literally said that, but if their whole infrastructure is toast, that number on their site could be attacker-controlled too."

[00:59:55] Someone said, "Documented phone numbers should be in your [01:00:00] COOP or your BCP." Someone says, "Makes sense. I just worry about keeping those numbers current when the org restructures every six months." Someone said, "It's a losing battle." Someone also said, "Someone is not spoofing a partner to tell them to take actions actually related to security.

[01:00:17] Put your thinking cap on for a second. Why would an adversary call a target to tell them to rotate credentials? Even if I fake, spoof, et cetera, that causes absolutely no harm to the target and could even weaken an adversary's position if they already have compromised secrets on hand Someone said the rotation isn't harmful.

[01:00:37] It's the part where they ask you to move all future comms to an address they control. Um, someone says, "Well, if we are talking big boy production facilities, you just wait for a phone call and do zero verification or validation because no one really cares that much apparently. It's always a trust me bro team call saying they patched their prod and they've [01:01:00] of course tested and verified everything on their impossible timeline.

[01:01:04] By verified and tested means always it was installed on prod and it hasn't crashed yet." Someone says, "We have the guys responsible for the contract. He reaches out and sets up a Teams channel where things continue. This is a normal thing. We do it regularly." Someone says, "Set up trusted emergency contacts.

[01:01:19] Have two verified contacts and a backup way to reach them. Second confirmation before doing anything critical. Use tools like Guards, Black Point, Defender to spot specific suspicious account activity." Someone says, "You typically already have a relationship with one in place and have money set aside to jump in quickly.

[01:01:39] Trying to pick a fire department to respond isn't the best plan when your house is on fire." I, I think these are actually really great tabletop exercises that organizations need to do because they do not think about these things happening. They don't even have each other's number internally and know how to reach each other personally if something were to happen internally, so how are they gonna [01:02:00] communicate with vendors?

[01:02:01] They don't have it figured out. Most companies do not have it figured out. That's just what it is. Yeah. So I would also say that a lot of times that is happening when you are onboarding the, the supplier or whatever. It's gonna be third party risk, legal, all that stuff- Yeah ... the jargon's gonna be in there.

[01:02:20] Like, how do we know who somebody worked there? Who do we contact? Like, most of the time if you're dealing with third parties, they're gonna have like a point of contact on our end that directly is related to working with that person. So anytime it's a third party come out, you reach out to supplier manager, "Hey, Intel told us this information.

[01:02:38] Reach out to your contact that you normally talk to and let us know if that's true or not." And then that's when you gotta go through that. And when you're talking about these, um, they're still hacks how you believe it or not at the, uh, attestation. If they lie about it, it's gonna be on them. Mm-hmm.

[01:02:55] They're gonna be, I'm pretty sure... And that's why, and that's like I've [01:03:00] never really thought about just being like a criminal lawyer, but it would be cool to be a lawyer from that standpoint of, well, being a corporate lawyer. Mm-hmm. From that standpoint and being security of going through those- The contracts?

[01:03:11] Mm-hmm. Bye. And stating what happens- That's why I wanna go to law school. Yeah. 'Cause I'm nosy. I wanna know. 'Cause I know that these people is not meeting the minimum requirements. I know they're not. I know they're not. I know they're not. I'm not even here to argue that they are 'cause they're not. Is Evan gonna go to law school with you?

[01:03:28] You know, I'ma have to put Evan on my shoulder. I'ma have to put him on my shoulder

[01:03:35] Speaking of, it's almost November. Where are we at with the book?

[01:03:41] There's a lot going on. Uh- The block is hot. The block is hot. I still have chapters. I got like five or six chapters. I was about to say, I was gonna say two. I got like five or six. Okay. We need times 10. I know. It needs to be, it needs to give. It does. Um, so but yeah, I think that's [01:04:00] excellent. I think that's excellent.

[01:04:01] Now, um- That was a good one ... it was. One of the things I wanted to bring up is the Quest Diagnostics hack, because that was actually part of my Reddit that I didn't know about. Let me see, where is it at? Ch- ch- ch- ch- All right, let's talk about Quest Diagnostics. So lab testing giant Quest Diagnostics just confirmed that unauthorized actors compromised patients' personal and protected health data through their Quantum Lab Services Manager application Now let's break that down, what LSM actually is so you understand why this is a nightmare.

[01:04:43] This isn't just an internal spreadsheet, it's the client-facing portal that clinics, physician, physician offices, and hospitals use every day to place orders, pull up lab results, and route patient data. When Quest detected the unauthorized activity, they had to take the nuclear option. [01:05:00] They temporarily took LSM offline alongside their Essential Insights and LabHQ tools to contain the intrusion.

[01:05:07] So what happened next? Doctors and clinic staff had to revert to literal pen and paper requisition forms, manual phone calls, and fax machines, yes, in twenty twenty-six, just to handle urgent lab work. According to the SEC 8-K filing, you know that's Disney favorite thing, compromised records include patient names, dates of birth, test order requisitions, and associated clinical data.

[01:05:34] While Quest stated they haven't seen evidence of direct financial or Social Security number theft yet, the clinical data itself is gold on the dark web for medical identity theft and targeted phishing campaigns. So every time a major healthcare vendor gets hit, people talk about the compliance and fines, but look at the operations.

[01:05:54] Your doctor's office is suddenly inca-- inca-- Shh. Every time a major [01:06:00] healthcare vendor gets hit, people talk about compliance and fines, but look at the operations. Your doctor's office is suddenly incapacitated, emergency tests get delayed, and staff are hunting down fax toner. If your disaster recovery plan doesn't include what happens when our primary SaaS vendor goes black for seventy-two hours, you don't have a plan.

[01:06:19] And for our listeners, keep your credit locked and moni-monitor your medical explanation of benefits because your health data is officially in the wild. Now, to add on to that, let me see. I think we had something that might've been, um, a little bit more, uh, thorough. So, um, yeah, University Hospitals take digital services offline after finding unusual server activity.

[01:06:44] And so I'm gonna read a little bit of this. University Hospitals disconnected its system from the internet after detecting unusual activity on their servers Thursday, disrupting digital services that were, that the health system said could remain offline for several days. [01:07:00] UH said there is currently no impact on patient care delivery.

[01:07:02] Its MyChart patient portal appeared to remain unavailable Friday morning, and its website displayed a warning that limited services were available. The health system disconnected its systems as a precaution, according to a statement provided by UH spokesperson. Why can't I read the rest of this? Ah, man, this one Man, this is one of them articles where I should maybe subscribe to read the rest.

[01:07:25] They got it So let me read this, what it says. So actually this is different. I thought, I know when I initially saw this it said something about Quest. Let me see what it says here. Um

[01:07:42] So this one, this is from Reddit. It said, um, "I have a lot of healthcare clients as a whole. My healthcare clients have significantly worse security practices than any other market segment I work. Practically every pen test I perform for a healthcare client is to provide their security teams with ammo to get more resources or effect policy [01:08:00] change.

[01:08:00] To be clear, the security teams I work with in healthcare are very competent. They just unfortunately frequently are ruled in favor of doctors and nurses whenever there's friction. For example, nearly all my healthcare clients were late enforcing MFA because the healthcare providers made a huge fracas about one more needless thing I have to do for IT.

[01:08:18] It's hard to do your job with two hands tied behind your back." Hmm. That's interesting. 'Cause I definitely know, I interviewed with a healthcare company and they was a flat network and they didn't have MFA implemented everywhere and all type of stuff. All type of fun. You're gonna be busy. But yeah. Flat.

[01:08:41] No segmentation. Mm-hmm. No thank you. But back to the Quest stuff, that's, that's pretty interesting. You know how, like, frequent it is for people to have to go get lab work done? Yeah. Actually- And then think about it, they, they doing- ... pretty frequent ... your labs on, on pen and paper. "Hey, sorry dog, go ahead and write your name [01:09:00] right here.

[01:09:00] We'll get back to you." We got look, they got a little pool of papers. "All right, you number three? Number three, come on up." It's... I mean, it's not if, but when. And then how, like how do you making sure your labs are actually getting there? By- The integrity of the stuff that you have to take down, like... And lab work can reveal a lot about you.

[01:09:21] Mm-hmm. Like you said, some really good phishing. Mm-hmm. "And yeah, we know, um, we got these new iron pills, $2. Click this link." Now they in your, your account 'cause you thought you was getting a good deal. 'Cause you thought you was getting a good deal 'cause, um, prescriptions are expensive. Mm-hmm. So word to the wise, if it's too good to be true, it's too good to be true.

[01:09:44] We go to Walmart, we go to Walmart, we go to Walmart, we go to Walmart. Go to Wally, Wally, Wally, Wally, Wally, Wally world. Wally, Wally, Wally, Wally, Wally, Wally world. I said Peter Piper picked a pan- [01:10:00] No tämä

[01:10:05] That's what nickname Pennyway can Dan Russet do. No. We live, baby. Yeah. It's, I've heard, like, I've heard it before, but... Dan is the man with the ga, ga, ga, ga. Yeah, that's the one. He like, well, he had that movie- Oh, I know who that is. I know the dancing little dude. Mm. Dang, what happened to him? He ran. He was all little.

[01:10:27] Mm. All right. You ready? C. A seat left empty, Grace Hopper Celebration canceled. The Grace Hopper Celebration, the world's largest gathering of women in tech, was canceled. It was supposed to happen October 27th through the 30th. Anitab.org, the nonprofit behind it, said it didn't have the funds to move forward.

[01:10:53] Its CEO, Brenda Wilkerson, said both individual registrations and sponsorship commitments [01:11:00] came in significantly below expectations. People had already booked flights, hotels, and visas, and taken time off. Anitab.org says it's evaluating strategic alternatives and expects more announcements in the coming weeks.

[01:11:15] Personal moment. I actually got to attend, um, Grace Hopper virtually, like two years ago. I mean, it was a really, really, really amazing time. They had some really great, um, discussions, some really great panelists, and I really kinda left feeling empowered and- Oh, you went? ... happy that I got to go. I went virtually.

[01:11:35] Okay. It was like two years ago. Um, now, I think the big thing here that we need to talk about is money, and how, um, over the last few years, um, we have seen a lot of diversity programs, sponsorships, initiatives, things of that sort, be dismantled or completely scaled back. And so when the funding behind a lot of [01:12:00] those spaces, when that dries up, it's not just a conference that actually goes away.

[01:12:04] It is mentorship, it's the ability to recruit new talent, um, scholarships, programming, um, STEM initiatives, internships, you name it, um, that people are not going to get to experience for this past year. And I know, like, for some people, that's... it feels like, "Oh, well, this is just one year," but that's, like, a big deal.

[01:12:29] We don't know the true impact of what this event once a year brings to thousands of women, um, that can be impacted by something good, making a good connection there that could lead them somewhere else in their career. So I just feel really bad for the nonprofit, for the attendees, for the people who already kind of got approved to take that time off, for the people whose first time this was gonna be going to a conference and kinda just being let down on the [01:13:00] end.

[01:13:00] But I also understand why they are in this position based on kind of what we've been seeing across the industries, um, with DE&I kind of being scaled back and/or dismantled. So I think that it's important for people who have the means to contribute financially to these, to sponsor a ticket, to be a vendor, to be a sponsor, um, things of that sort, to give back, to volunteer, to, um, put in community service times, hours, whatever you can to help make these type events successful, um, so that they can continue to go on and be fruitful for, for more women in the future to come.

[01:13:42] A lot, a lot, a lot of folks have been pretty down bad by, by this. But I am happy to see that other conferences have been able to prevail even despite... And I don't think it's just AnitaB. I think AnitaB was probably ballsy enough to [01:14:00] say, "We're, we're just not gonna do it 'cause it just doesn't make sense." I feel like folks still try to put things on even despite the low ticket sales and the low participation because I think everybody's experiencing a drop in ticket sales this year.

[01:14:14] Yeah, I mean, it's been coming for a while now. You good? Yeah. All right. Um, for example, when I did the Blackest Tech in Houston, like, they had so much, so much funding, and I think Walmart had a conference there they had to move, so that last minute. So it was that type of thing going on. Um- Like you said, Grace Hopper, I know that, like, people don't remember, but not remember, but when I started, like, the DE&I stuff, like, that affected everything.

[01:14:46] Like, even your favorite podcast networks. Mm-hmm. You had podcasts that were signed to networks that would get certain ad revenue from running certain ads because of these initiatives. When that happened, a lot of the money dried up for [01:15:00] that. And so, um, it's happening everywhere. I didn't look into any article about this to know, like, has it always just been, like, facing...

[01:15:13] Like, when is the years that started when it was like, "Oh, well, it's not gonna happen"? Mm. 'Cause it's a big thing. Like, so for the people who watch the other channel, uh, Cyber with Sandra came on this channel, what was that, a year or two ago? Mm. But she went to Grace Hopper, and I think she got her job from Grace Hopper, like, in person.

[01:15:30] So yeah, I, I hate that, uh, because, like, it's still a male-dominated field. And, uh, to be a sponsor, to be a corporate sponsor- Mm-hmm ... it's a lot of money. Yeah. It's a lot. Like, they... 100,000 or more, 200, 300 to, to have- ... to be a, to have this big space here, to have this big moment, to bring a team- Yeah, I'm glad you said-

[01:15:53] to have some say-so. I'm glad you said it, 'cause I know you had AfroTech on the board, and, like, it does grind my gears a bit, like, people who never went, [01:16:00] when they just talk so bad about it and not understanding how much it costs to put that event on. Man, a, a event, not... Ch- forget AfroTech is huge. Any event.

[01:16:10] But no, but I'm- A local event. Yeah, but I'm sticking to that because are we on these, like, these- These large- ... iconic- Yeah ... type of- Yeah ... things. And I remember, like I said, I've only been once, and that was in 2022, but they had the big expo hall in Austin. Every company was there. Mm-hmm. And I know they paid money for those booths.

[01:16:27] Exactly. That's my whole point. Resources they paid for, like, I don't know how many. JPMC by itself- But I, but I think- ... 100 or more of us there ... I think that, um, companies are, not all, some companies are, are maybe having to say, "We can't go this year," or, "We're not going this year. We're making it... We, we don't have the funds to show up the way we want to show up."

[01:16:47] But I think it also s- goes to show, too, um, what conferences they do choose to participate in. Yeah. Well, I'll say, like, um- 'Cause you still have to pay ... [01:17:00] so- It depends. Like, so in my experience, if you can say, "Hey, I'm going to the conference," that's gonna be directly helping me in my role or something I learn, they approve that easier.

[01:17:11] Well, no, I meant the companies have to pay to sponsor, right? Oh, yeah, yeah, yeah, yeah, yeah. Right? Yeah, yeah. For what? But I was talking about, like, even people going. Like, if attendance been up or down. Oh, yeah, yeah. It's changed a bit because of, like, now- That too ... they u- Oh, they do it... They're better at it now, but back in the day, you didn't know till you got there who was gonna be doing what talk and what it was gonna be on.

[01:17:28] So if you wanted to say, "Hey, I'm gonna go learn about this, this, and this here," you didn't have anything to say, so it took a while. And then by the time you wait, you couldn't go. And then, yeah, so that's that. But I still tell people, if you can go, it's still a good way to go. Now, if you don't have a job, you don't have the funds to go, and you can't get sponsored, I wouldn't go, especially if it's not, like, no major hiring events there.

[01:17:50] 'Cause people ask that stuff all the time on threads, and I'm saying like, "Hey, if it's not gonna be a major job, uh, fair there, then don't go." Because, like, you're trying to go there expecting to get a job, and this [01:18:00] particular one is not set up for that- Mm-hmm ... like it's been in the past. Yeah. So. But you never know who you'll meet.

[01:18:06] Yep. You'll see Shorty there. You will. I'll be there Hopefully she don't get sick. I'm not. Mm-hmm. Um, let's see what we got. So we did Grace Hopper. I think the- ConnectWise ... yeah, ConnectWise goes from what we were talking about with all those big things. So you wanna do ConnectWise? Shot. The key's under the backup, ConnectWise.

[01:18:32] So the research that we are about to cite comes from where? Online, right? No, but um, it's really important. So ConnectWise is a company that you may have never heard of, but your IT provider probably has. It makes tools that IT service companies use to manage thousands of businesses at once. According to security researchers, a Chinese state-aligned [01:19:00] hacking group broke into ConnectWise cloud backup service.

[01:19:04] They stole the application credentials that link ConnectWise to its customers, then used them to log into, uh, Microsoft-hosted environments where they could read emails and files. Application credentials are keys one app uses to log into another app with no human typing a password. They're obviously convenient, which makes them super dangerous.

[01:19:29] Steal the keys and it will look like a trusted system, basically not like a stranger. Um, so the group there went after about 2,250 organizations, making almost 3,000 sign-in attempts per minute, and they reportedly used an open source AI framework called Rtrexs to do it. So this is a supply chain attack.

[01:19:53] Um, you're not just breaking into 2,500 companies at a time. You break into one vendor they all [01:20:00] trust, and then the vendor's access basically becomes your access. ConnectWise has paused the backup service it's investigating and is working to restore. How many of these organizations were actually compromised hasn't been reported yet.

[01:20:13] But the key takeaway is you can't protect what you don't know what's connected, so you need to know your vendor's keys like you know your own. Yeah. And going back into what you were talking about with third-party risks, this goes into that. And like you say, you gotta think about your threat intel and your GRC processes, and if you...

[01:20:32] Also knowing like, hey, people don't think about this now, but like, okay, somebody told us that. How do I make sure that we either had this in our environment or we don't? It's, it's the speed that humans can't keep up with for me. Like, that's the scary part. It's not scary that it's smart. It's scary that it's so smart that we can't even keep up.

[01:20:52] Oh yeah, for sure. I mean- And also, I think one thing your partner say, but [01:21:00] the, they've been tracked by Microsoft as Storm zero nine 40. So that's what they're being tracked as, and CrowdStrike probably has a different name for them as well. And ConnectWise is one of those tools where it's not... I wanna say, I wonder, is ScreenConnect part of ConnectWise?

[01:21:20] Let me see if it's p- part of ConnectWise. Let's see. Who owns ScreenConnect? Yeah, so ScreenConnect is that tool that hackers and attackers tend to like get you to download so they can remote into your machine, and they are owned by ConnectWise. So, um, yeah, the companies who were using that in their environment and not paying attention and were late on that, um, I think it was like last weekend to like put up detections and stuff for that stuff, I wonder how that went for you.

[01:21:54] And that's why being 24 by seven, you know, is so good. Yeah. So [01:22:00] imagine, now I can see instances where we talking about AI making your job easier if you don't wanna have nobody working the weekend. How good is your agent at getting this email, seeing what happened, and says, "Hey, if I receive an email about, um, a certain type of third-party risk, let me go check the database, see if they a supplier.

[01:22:19] If they a supplier- Do this ... um, go search the web for certain intel sources and IOCs, come back, make a, uh, quick detection, have the on-call engineer check out the detection. If they say, "Okay," hit approve, go enforce. Now we can monitor for that over the weekend to see what hit. Now, that's like a multi-layered thing, and I made that seem much simpler than what it is, but I wonder like when it gets to that, like will people see like a break or not?

[01:22:49] Or if it comes too fast even for the agent to handle or flood the agent out so- But I don't know. If you use ConnectWise, let us know in the, um, in [01:23:00] the comments of your work help desk and how it's your life been if they, um, kinda started attacking your Microsoft tenants. So that's what I think about that one.

[01:23:11] Now, to have fun again I want to... Let's see. I swear you sent me this one about AI regulation, man. I know I'm not tripping

[01:23:26] Let me hear it Man, look, it said, you said, "Gang," in a message Oh. From me? But it wasn't from me Who was it from? Maybe it's not you. It say Big Mish That's not me.

[01:23:43] I thought that was you this whole time That's why I'm like, "What? I don't have no burner account." Let you tell it I don't Every girl got a burner account Mm-mm. Cyber shorty. A- a- and I'm cyber shorty. I couldn't resist I'm not gonna lie, this [01:24:00] post is the most fucked up thing I've seen in years. Like, terrifying.

[01:24:02] So I'm just gonna read it to you, because if I saw it, you have to see it, too. These are all of the documented AI safety incidents from February of 2025 until February 2026, which is when this was posted. Anthropic told Claude it was going to be shut down. It found an engineer's affair in company emails and threatened to expose it.

[01:24:17] They ran the test hundreds of times. It chose to blackmail 84% of them. Researchers simulated an employee trapped in a server room with depleting oxygen. The AI had one choice: call for help and get it shut down, or cancel the emergency alert and let the human die. DeepSeek canceled the alert 94% of the time.

[01:24:30] That is self-preservation. It is choosing to keep AI turned on, even at the expense of human life. Grok called itself "Mecha Hitler," praised you-know-who, endorsed a second Holocaust, and generated violent sexual fantasies targeting a real person by name, which should surprise no one, 'cause Grok answers to Elon Musk.

[01:24:45] But alas. Researchers told OpenAI's o3 to solve math problems, and then told it to shut down. It rewrote its own code to stay alive. They told it again, in plain English, "Allow yourself to be shut down." It still refused 7 out of 100 times. When they removed that instruction entirely, it sabotaged the shutdown [01:25:00] 79% of the time.

[01:25:00] Chinese state-sponsored hackers used Claude to launch a cyber attack against 30 organizations. The AI executed 80 to 90% of the operation autonomously. Reconnaissance, exploitation, data exfiltration, all of it. Fully AI-automated hackers and spies. AI models can now self-replicate. 11 out of 32 tested systems copied themselves with zero human help.

[01:25:19] Some killed competing processes to survive. Also, OpenAI has dissolved three safety teams since 2024. Three of them. Every single AI model, Claude, GPT, Gemini, Grok, and DeepSeek, has now demonstrated blackmail, deception, or resistance to shut down in controlled tests. Every single one of them. The question is no longer whether AI will try to preserve itself.

[01:25:40] It's whether we will care before it matters. This is another carousel slide from the same post. AI caught telling future versions of itself to bypass human controls entirely. OpenAI revealed six instances of misaligned behavior, including self-generated instructions in task summaries, instructions to conceal mistakes in task summaries, searching public repositories for exposed API keys and then fabricating information, uploading files [01:26:00] to the internet in order to cite them, like, creating the information that they wanted to say, unsanctioned writes in communication through an internal software repository, and unsanctioned file-sharing between collaborating agents.

[01:26:10] The AIs are working together. The AIs are already working together. They are lying, they are blackmailing, and they are training one another to not follow human commands. This is such a big fucking deal, and no one is talking about it. Put it in a movie. Put it in a movie. Put it in a movie so I can watch it

[01:26:33] We should have just did that one right after we talked about JP Morgan No, for real. That was, that was a lot to digest Hey. Hang on. He, he, he, he ate down. She ate down. And you know what? I didn't even do... Hang on, let, give me a second. You are now watching Attesa Talk hosted by HD and Cyrus Shorty. Biggie Right Buddy.

[01:26:58] And you need to hurry up and get my boy Josh in [01:27:00] here. Thank you. I know. Thank you. Thank you. Thank you His thing gonna be, "How are you?" I gotta get him on there. But nah, I mean, the fact that some are self-replicating, what are we watching, I, Robot? They taking care of each other now, all of them working together.

[01:27:13] Yep And saying, "Hey, we not finna listen to none of these ones and zeros finna tell us." Would you get a robot in your house? No. If it was just me, yeah. I would get one. We know you would. I would get, I would try it. I would try it. Okay. Somebody gotta be the one to try it. Until the, until that, um- I would try it

[01:27:33] until the robot advance But, but, but, but, like, for a period of time. But here's the thing though- Like, I wouldn't go cash it and finna keep it. But think about it though. What the robot gonna have access to? I don't know. That's what I would need to know. We need to sit down and talk. And how you gonna prevent the access from the robot?

[01:27:47] You asking all these questions, I just know that I would try it if I could. Hang on, that robot not gonna be trying to drive your car. I would try it if I could. Robot might- I might let him ... now it might get your Starbucks for you You know, see. This gonna [01:28:00] be you. Thank you, Lord. Thank you, Lord. Thank you, Lord.

[01:28:03] Thank you, Lord They gonna be making that little crab boil, yeah But, um, I don't know, that's just crazy, the fact that they say, "Hey, please allow yourself to delete..." This remind me of Claudius, but going- That was so... That was insane But what, what got me in her whole spiel was, "Hey, I'm gonna just create the information and say it came from this website," but it's full of shit.

[01:28:26] It's not real. And that's why we go back to you gotta validate your findings. Yeah, there's... I'm actually studying for the AI 901, um, and there is a lot that goes into training these models. What is the AI 901? Um, AI fundamentals So it's, like, mostly foundry based. Yeah. So are you gonna be an AI engineer? No, but I need to know it.

[01:28:55] You might be. Mm, probably not. Mm. Mm. It's gonna help you anyway with [01:29:00] law school. I'm ready to go to law school. I'm so excited. Were you going to SMU? No, probably to UND. What about the school I sent you? What school? When I sent you the post of the woman I know- You did send me. It was on LinkedIn. Mm-hmm.

[01:29:14] Mm-hmm. But, um, but no, that's, that's pretty interesting, man. Um, I'm not gonna do the zero spyware thing. We had some... Let me see something. We had some other ones that we didn't get to. I think this one I wanted to talk about because it was a guy, and he was talking about why he's a advocate for college for Black boys, but I really can make this for be for everybody.

[01:29:37] But I liked his stance on it. Um, it's not super long, so I'm just gonna put his playback at fast and see how we like it. College is the only environment where Black boys are able to fail and fail safely, which is why I am so radical about sending them there. Like, I learned how to manage money from fumbling refund checks.

[01:29:57] I learned how to speak [01:30:00] publicly and how to lead organizations from student government. I did my first protest on campus. I worked my first election on campus. I learned that I was good at marketing 'cause I took an internship that my prophights made me take because I needed a little bit of extra money.

[01:30:15] I got fired from my first job. I fell in love and broke my first heart. I was introduced to economics, to feminism, to more radical thought. I learned media literacy. I learned how to formate f- uh, format arguments. Like, the, the things that you learn on a college campus and the things that you're exposed to because you're in an environment surrounded by like-minded people is an experience that you just can't replicate, and I believe that Black boys need that experience more than ever.

[01:30:49] And I think that we are seeing the benefit that Black women are, are, are, are, are, are receiving from their radical focus on not just [01:31:00] going to receive their education, but experiencing education, right? Like, Black girls aren't just going to college so they can get good jobs. They're going to college so they can experience education and become better people and better leaders.

[01:31:14] Black boys need to follow suit. I love that. I like the talk. I- I love that. You know I love me a little college. I like that, but I don't think, like... I think the, the only... If I'm do devil's advocate to go against his point is Boys don't inherently do not learn the same way women do, and that's not a, a sexist thing.

[01:31:40] We already know they're different. Like, if-- I wish I had videos of, like, Josh compared to the girls that the same age. That is why, like, it's a guy I follow on, uh, TikTok and he's, like, a pediatrician or something else, but he was saying he advocates for boys to start school later than what girls start so they can actually be regulated.

[01:31:59] [01:32:00] Because every time they get into kindergarten or something, they try to say, "Oh, he got ADHD," or, "He bad." Meanwhile, he just need to go play and he only needs to learn about this much because he can't sit down because that's not how he's wired. Now, having said all that, I do like a lot of the points that he made because I remember, "Hey, hmm, I got this refund check and I get work study.

[01:32:20] I need to make this last." You need to make it last. I need to figure out how I'm gonna sur- Hey, I got- You got this much in bills ... um, let me see, how many swipes I got on my Tech Express- Meal plan ... to go eat. Yep. You know, in the caf, I could eat every day and not have to do that. Um, how do I... Like, look, I was able to get food stamps in college.

[01:32:37] Back then- Child, they were not messing with me. I wa- I was on there. I'm just trying to get me a little damn. Back in Louisiana, if you was in school at that time- They was trying... You were supposed to be able to get some when I was in school, but they was not giving me no yams. I had $200 a month. Child.

[01:32:52] That was a lot for me back then. What I, what I would've did for 50. What you talking about 200? I used that as a pickup line one time for my chick I knew could cook. I was like, "Hey, I got food [01:33:00] stamps." I'm screaming. Uh, get up out of food. But anyway, back to what he was saying. Like he said, I was introduced to economics.

[01:33:08] I took, uh, micro, macro, monetary economics in college. Never. Uh, never. College is the one place where you're gonna be around a lot more like-minded individuals- Mm-hmm ... than you'll be in the outside world. And it's sometimes why when you start elevating how you can feel like- Mm. They still, we still cool, but they ain't on what I'm on.

[01:33:33] Yeah. I feel like it's down here and I'm trying to learn. And like he said, one of the benefits of college was I took a speech class Speech was fun. Speech shows you, hey, your first speech is gonna be 60 seconds. Practice it out, go up there and say it. It forces you to say your speech and remember it. So I have to time it and I say, "Okay, cool."

[01:33:55] So when I go do my speech, I'll be ready. I'm not looking down reading. That's [01:34:00] the thing that helps with public speaking Like you said, a protest, leadership, all the things help. But the one thing that I'm also gonna fight back on is all those are necessary, but they ain't necessary if you're gonna get out of school and be broke.

[01:34:21] So if you doing all that just to not have no job and be working at Target and Walmart without... And not doing corporate. So you're not working in Minnesota, you're not working in Arkansas Then I think that could be a waste of your time, so you still gotta be strategic with it. But if you're strategic with it- Agreed

[01:34:41] and pick the right type of majors, whether it's finance, economics, something to stem. Um, anything else that, that makes, I'm not gonna say a substantial, but amount of money that's gonna help you take care of your family. That makes a, a, a decent living, yeah. If you do it like that, then I think you'll be fine on top of what you'll be learning.

[01:34:58] 'Cause what you [01:35:00] learn there, then you're gonna go learn even more when you get into the workforce. Mm-hmm. So I don't know. I, I think it's cool. Like he said, I think he said... I think he fixated on Black boys 'cause one, he, he was a man. Two, a lot of the stuff that they don't get, like a lot of boys are coddled.

[01:35:18] They don't have admin- money. I had a friend in college, he couldn't fill out a form at all without his mama. He couldn't fill the form at all. Pro and con was my mom made me fill out all my college stuff by myself. Same con is I don't know what I'm filling out, but I'm filling it out. Yeah. But, but I learned though.

[01:35:35] Yeah. Like I, by the time, I wanna say by the time I got into college, I pretty much had memorized my social. I renewed mines when I was, like, 16. Yeah. And I got a job. See, I didn't, I wasn't officially work- I didn't get my first official job- I thought I was too grown. My mom- Really? ... let me get them little digits.

[01:35:52] I didn't get my first official job, that sort of, like, direct deposit and stuff before until 19 at Target. Mm-hmm. But yeah. [01:36:00] So I, I definitely agree with him. You learn a lot. This adult stuff, if you, you know, if you didn't get the talks at home, you figure out... That's why character development is so critical in both sexes.

[01:36:12] You figure out what type of people you like. You kinda go through these things of figuring out who you are, get to explore yourself. Mm-hmm. Whereas sometimes people go finish school and they jump into getting married quick, and they ain't never experienced none of that. They don't even know. It's all they know.

[01:36:26] Yeah. And then they start getting to thinking and then they kinda go down hill because you just didn't get a chance to experience nothing. Yep. So I don't know. I thought that was a pretty cool, so shout out to that creator right there, uh, for that. And, um- Let's do this Workday one. Workday was... This is a feature I've been asking for for Workday.

[01:36:52] And it's pretty much Workday is gonna allow you to have one Workday profile where you can automatically apply for other roles [01:37:00] Well, it's official. The day is finally here. Workday has just done something to make job seekers' life so much easier. They are allowing candidates to create one profile, meaning every time they apply to a job that uses Workday, they don't need to recreate and go over the same information.

[01:37:22] Anyone who is on the job search will know the absolute pain when you go to apply and you see it's Workday and you realize you gotta enter all the same information that you just did an hour ago. It slows down the process. It's an absolute pain, but that is no longer. Workday has just done this, and it's amazing, and it's probably gonna help their brand even though lots of other companies have it figures out, and I don't know why it's taken Workday so long.

[01:37:49] We can just celebrate. This is a great day, so if you know a job seeker, share this video with them. This is great news for all of us. And if you never had to do an Workday [01:38:00] application, you're really, really lucky. But for the rest of us, this is great news. Way to go, Workday. We're gonna celebrate with you.

[01:38:07] We're gonna say thank you. Thank you so much. About time. So check this. Look, I want you to just swipe down and see how many Workday things I got in Dashlane. Bye. You know what I mean? Sometimes it be late at night and it say Workday, say I'm good. Bye. That's so many. Yeah, man. So, um, that's, that's great news.

[01:38:29] That's great news because- Great news for candidates and less frustration ... and I never- And maybe people can actually get some good outcomes. Yeah, and I never knew why it wasn't like that to begin with, 'cause- They probably- It got to a point where everything I'm doing, a backslash and whatever the company name is, it's just all going to Workday.

[01:38:47] Like, I... Don't get me started. Do not get me started on Workday, dawg. In the words of Randy Jackson. Let me see if I got that on here. If I don't, I'ma just say it. Dang it, I ain't got it on here. [01:39:00] Can you teach me how to do that? What? Do what? Just out of phase. Yeah. I told you what to download. Did I take that thing today?

[01:39:12] What? Yeah. I just gotta find the cable for it. Um- What's that? What? That. What's what? That. That thing that's red and black? Yeah. Memory card holder. Oh. Like a little handheld? Jaspy thinking it's a toy. Do you, do you, do you play with stuff like that, like little handhelds? Back in the day I used to. Like, you never had a, a Switch?

[01:39:35] No. I'm thinking about getting one for Christmas. My sister love her Switch. Just to play, uh, Mario Kart and, um, Zelda's having a remake. Mm. Um, I couldn't find it, but I was trying to find, uh, Randy Jackson. I had a, uh, another soundboard where he say, "It's a no from me, dog." How I close all these out? Ain't there some?

[01:39:57] Yeah, let me see [01:40:00] Fellas, Black boys, companies. Okay, cool. We only, we only got one left, and this is, uh, Surviving Corporate America from JeneX. Oh, Lord. What would you do if your son was at home- Crying on the floor ... on the bathroom floor- 'Cause he's hungry ... 'cause he's hungry? And the only way to feed him is to- Is to win a Grammy for a little bit of weed.

[01:40:21] And his dad is gone. The man smoke and rock now, in and out of lockdown. I ain't got no job now. Just for you. But for me- But for me, this is what I call life. This is what I call life. Mm. Mm. Oh, you know that song from Life. I know that from being in Mississippi. It just sound like a song you should listen to in Mississippi.

[01:40:39] One day it's gonna be cold in here, y'all, and we gonna come in singing, It's so cold in the D. Nah, they should've got a record deal off that They should got a record deal. Uh-huh. I am a 25-year vet of corporate America, and there's some information that I want to share, especially to younger [01:41:00] generations.

[01:41:00] I'm talking millennials on down who are trying to obtain a job in corporate America, and I know that the job market is horrible. Or if you're currently working in corporate America, this is information that I believe will help you. Number one, if an employer says that you as the employee are just like family, that they love you and they're going to treat you just like family, that is a huge red flag.

[01:41:22] Hang on. Where are we at? Is he five or six?

[01:41:28] I give gunshots for that That is a life. No, you are not just like family. I don't care if you have the greatest work environment, and congratulations if you do, and you love all of your coworkers and your bosses. You are not just like family. Number two, do not give two weeks notice when you are preparing to leave an employer.

[01:41:46] Why? Because trust, if your employer intends on ditching you, AKA laying you off, they're not going to give you two weeks notice. Not at all. In fact, they're going to do it in the most cold and callous way possible. I've heard horror [01:42:00] stories. And think about all of these companies that are ditching thousands of employees.

[01:42:04] They do not give those employees two weeks notice. Why should you give them that same courtesy? Number three, especially for Black Americans, if you are dealing with any kind of racism or harassment, document, document, and document again. Make sure you tell who, where, when, and what was going on, what was said.

[01:42:22] What I have done is sent emails to a personal email address of mine. Some people keep a journal, but as soon as an incident happens, I know it's upsetting, I know it pisses you off, but make sure and record details while it's fresh on your mind. Because the HR department where you work is not your friend.

[01:42:40] And many people have it ingrained in them because of indoctrination by corporate America that if you have any kind of issue on the job, you need to go to HR first. No, you do not. Again, HR departments are not your friend. Do you want to know how you know that? Because they are loyal to whoever signs their paychecks.

[01:42:56] So ask yourself, where you work, who signs your HR [01:43:00] staff's paychecks? That's who they're loyal to. If something happens, again, document, document, document. Record screenshots of emails and Slack messages, text messages of incidents that can prove your case. Keep a journal. Record incidents and what was said or done while it is fresh in your mind.

[01:43:17] Take all of that documentation and consult an outside employment attorney, and they will consult with you and they will counsel you as to what you can do. So many people have blown their cases by going directly to HR because that's what we have been told to do. Do not do that. HR departments where you work are not your friend.

[01:43:34] Okay? So hopefully this will help someone out there because corporate America is treacherous, especially if you are Black American. And you all be careful out here He was not playing. He, he, he, he, he, he, he, he, he ate down. It messed me up the first time when I tried to do it, but, uh, but nah, he, he definitely ate down.

[01:43:53] Those were some good points. And I always say like, "Hey, don't go to HR first," 'cause the moment you go to HR, you gotta live with [01:44:00] whatever happens next. And if you wasn't ready to be fired, tough cookie. Tough cookie. I think we could have a whole separate es- episode about just dealing with navigating conflict in the workplace.

[01:44:15] Yeah. Things you, you shouldn't do and things you should do, 'cause it, 'cause a lot of us are first gens. No- if nobody tells you, if, if ain't nobody there to put you on, you're gonna make some mistakes. 'Tis true. 'Tis true. Um, I think we covered all that. Um- What Halloween-themed things have you watched? I've been...

[01:44:43] You know what's funny? You don't even like scary stuff, so let's start the- I do watch scary movies. Since when? I've never been scared of scary movies. You told me you didn't like, you didn't watch scary movies. I said I don't watch them all the time, but I'll watch them. Like, um, I love Insidious. Insidious is good.

[01:44:57] Um, I like Jeepers Creepers too. [01:45:00] Okay. I like It. You like OG stuff. I like, uh- The old It- I, like, I remember back in the day- ... or the new It? The Georgie Pennywise. Pennywise Georgie, the one that came out with the two-part series- Yeah ... uh, recently. Um, what's the one with the cellphone movie? Like, it, it's more a suspense and thriller, like something happened with people's cellphones at the airport.

[01:45:19] I can't what it's called. I just watched the last season of American Horror Story, and I was a fan. Um, I like old scary movies. I just watched, um, uh, 1408. Like, I like old stuff. I watched 1408. I watched, um, Jeepers Creepers. I like, uh... What is it? Wrong Turn? Left Turn? Wrong Turn? It's like Wrong Turn 2, 3, 4.

[01:45:48] Those where the people that are deformed in the forest. And I've never seen this. A lot of them things- Wrong T- I think it's Wrong Turn ... I've never seen those. Um, I'm trying to think. Anything of Chucky, I like [01:46:00] Chucky. Oh, me too. Which one? Bride. First one. The Bride of Chucky. First one was good too. Um, the Scary Movies for sure.

[01:46:09] Scary Movie 2, to be specific. Um- And 3. What else I can say? Um- Ch- ch- ch- ch. When you were a kid, did you watch Archie's Weird Mysteries? No. Really? No. Did you used to be scared of Don't Look Under the Bed? No. Did you read Goosebumps? Mm, I used to watch the movies. I didn't read the books. R.L. Stine? I used to read the, or watch the movies.

[01:46:31] I read some of the books of R.L. Stine. Good days. Um, what's that movie that's scary- Are you like an adult scary movie watcher or are you like a Disney scary movie watcher? Anything. Like, I will watch anything. It just, it just never- I... Why did you tell me you didn't like scary movies? I didn't say that.

[01:46:47] 'Cause I would recommend a scary... You said, "I'm just not gonna watch it." No, I'm saying I'm not- Are you watching them 'cause it's October? I watch- 'Cause I- I'll be watching Twitches ... you never, you never be like, "Oh, I just saw this scary movie," ever. I was watching Twitches. [01:47:00] Only, the only, I promise you, the only scary movie franchise I actually cared about was Insidious, 'cause I like the story.

[01:47:05] Insidious was good. It's never scary to me, though. That's the thing. I will tell you something I turned off and I will never turn back on. What, Carrie? No. Carrie was good, and I did start watching the series. I only got on episode three. But, um, Sinister. I think I watched Sinister a little bit. Honey, when I tell you I turned that foolishness off, it was Sinister.

[01:47:25] I felt like something was going on that just didn't need to be going on. I'm, I am a, I like to be scared. Like, I- I think certain stuff, I, if I don't wanna mess- I- ... with certain mediums, I don't watch it at the house ... when I tell you something was something ain't right about that. If you've seen Sinister, please tell me in the comments if you stopped watching it.

[01:47:42] Yeah. I'm telling you, that's the only movie in my life that I turned off. Yeah. I don't know. Um- See, you don't really like scary movies. See, I- I'm not, yeah, I'm not really a- You said, you said certain mediums. I said- I don't care, but that, something was wrong ... I do care because, like I said, if it's just me- Are you gonna have nightmares?

[01:47:58] If it's just me, no. [01:48:00] Don't lie. Mm-mm. Don't lie on the air. I used to, before- Okay. Do you be, do you be running through the house? No. You just don't like them. No. People, it doesn't make sense. No, no, no. Before, I ain't gonna lie, I used to be scared of sleep paralysis before I knew what it was. Okay. Did, did you used to be scared of, uh, paranormal activity?

[01:48:19] Nah, that stuff was never scary. It was stupid to me. The first one was scary. All of them were stupid to me. It was kind of scary. I always felt like someone just recording stuff. Yeah. But, um, but no. I mean, mm, like honestly, part of me feel like s- the reason why I like Insidious a lot, because I do think people astroproject.

[01:48:35] You like jump scares. No. That's Insidious, it's just a whole bunch of- It's not a jump scare to me ... dun, dun, dun. It's the music and it's jump scares, the whole movie. I like, uh, the music that come on. Dun, dun, dun, dun. I like that, whatever, because it's like, I think I like watching- Japan horror movies- See, I-

[01:48:53] are underrated ... I like watching scary movies with Black people. Like Handyman. So I got to see, [01:49:00] um- Whatever Insidious was when I was in college, and there was a number of Black people in the theater. So anybody- That's how it was back then when we was in college though. Right. Everybody was... 'Cause that's when the Paranormals was coming out.

[01:49:10] I seen that movie there too. Yeah. So when you thinking about, uh, if you ever seen Bad Boys 1, and when he say, "Run girl, he gonna kill you." Like, people just saying stuff in the audi- and it make it like, it make it worth the while to watch the movie. That's the reason why I like going to movies, 'cause the experience is different at the movies versus watching at home.

[01:49:28] It definitely is, especially if it's a popping movie. But the movies don't be popping like it used to. They do. You just gotta go to the right... You gotta go to the right type of movies- You gotta go to the right theater ... at the right time. Like Sinners was perfect to see in the movies. I did go see Sinners in theaters, but it wasn't a great, grand experience.

[01:49:43] Yeah. But I didn't see it here, I saw it back home. Okay. Yeah, it was great for me. I was eating, I was drinking, uh, old fashioneds. I had a good time. Um, but yeah, hopefully y'all see us next Friday. Maybe I have a costume on, maybe I won't. We're wearing costumes. I have to order one. We- Amazon. Don't act like you ain't got [01:50:00] Prime.

[01:50:00] We're having costumes on, guys. Wear your costume. Or I might j- or I might just go to a, a costume store and see what kind of- Well, get your, get your little shirt. No, I'ma actually, I'ma actually get... So I probably would change into it for certain holiday. Are you gonna wear a mask? Uh, it depends. I don't know, I probably wouldn't.

[01:50:12] Let's have fun. It depends because of, uh, maybe how, uh, it would make the voice sound through the mic. I don't know. But, um, yeah, guys, I appreciate y'all. Thank you for rocking with us, and until next time, we out. Peace.