Episode 02 – MDR

Podcast Guest Introductions

Charlotte
Hi, and welcome to our latest podcast episode. I’m your host, Charlotte. And today, I am here with Jan and Simon, and we’re here to talk about managed detection response.

But before we get started, why don’t you guys just introduce yourselves for the audience?

Simon Driscoll
Yeah. Hi. I’m, Simon Driscoll. I’m a security specialist specialist working with, a range of our clients across the UK public sector, supporting them overcoming their challenges with security and, and also, specialist within the service models that we do as well.

Charlotte
Great. Thank you.

Jan Bervar
My name is Jan Vervaro.

I’m the owner of Concha MDR Services and a security architect at Conscia Group.

Charlotte
Lovely. Great. Well, thank you both for being here.

So as I said, we’re here to talk about managed detection response, which is a more modern approach to managing infrastructure security.

So before we get going, why don’t we set a little bit of context for people with the audience around obviously, we’re talking about managed detection response, which is a more modern approach for managing security. So what are what are the main differences between that and the more traditional approaches, particularly for the public sector?

Jan Bervar
Yeah. I think the, traditional approach is focused mostly on prevention.

And this is also, I think, for us, our mindset is like a more appealing option that we want to prevent all cybercrime or the actions of cybercrime. And preventive options that we had basically involved blocking attackers, kind of preventing access to resources.

And in the past we kind of forgot. There is another approach called detection and response, which is, much less intrusive. It’s based on monitoring access and then responding when we determine that certain access is malicious.

And perhaps it led ten years ago when the number of attackers were smaller, the business models of cybercrime were not flourishing as today. Preventive models were actually successful to a certain degree. But with the advent of modern cybercrime and the obvious success of modern cybercrime, it has been proven basically that the detection response is more or less the only tool which can address the gray zone in which the attackers are operating today.

Simon Driscoll
Yeah. An ultimate is about the speed at which we as defenders can respond to to attacks. So certainly at the moment, the sophistication of attacks.

We’re seeing, you know, adversaries being able to execute their their strategy and their plans very quickly. Mhmm. So we need to rethink the way that we defend as organisations to be able to to counter that threat.

Charlotte
Yeah. And and I guess they’re a lot sneakier about how they do it as well. And and and the more, like on a previous episode, we were talking about things like hybrid working and so that the the attack surface is much larger and more complex, which I’m sure adds adds to to that need.

Jan Bervar
It is. But do you know there’s this, classic asymmetry in, in in the cyber warfare where the attackers have a very easy job of finding that one vulnerability, which will which will enable them to enter our environments. You know, the assume breach mentality which we must have. On the other hand, we as defenders have hundreds of thousands or millions of vulnerabilities we have to patch. And this kind of asymmetric setup is something which really makes it difficult for us to maintain a preventive stance. We simply have to assume that they will enter. But the idea is, of course, as soon as they enter, we’re able to stop them.

Charlotte
Yeah. I suppose there’s a there’s a good analogy there around credit card fraud, for example, isn’t there, or financial fraud and how that over the last thirty years has evolved as an financial fraud and how that over the last thirty years has evolved, hasn’t it? For the same reason, because attacks got more sophisticated, and more varied. So I guess it’s a similar type of scenario.

Jan Bervar
Yeah. Mostly, it is the cybercrime getting the right business models. You know, so it started with DDoS like years ago when they simply did extortion tricks, basically saying we will disconnect you from the Internet if you don’t pay us this amount of money.

This progressed into ransomware, which obviously is an availability threat. So basically we will make your data unavailable or your process unavailable if you don’t pay us this amount of money. And now we’re getting more and more, into data exfiltration. Basically when data is stolen and, classic ransomware is only a backup option.

So if you’re not paying for us not to publish your data then we will also make your data unavailable. So this kind of progression is really interesting to see and based on the amount of money involved today I think the cybercrime is like the third most profitable industry in the world. Mhmm. It obviously pays off.

Charlotte
Yeah. Yeah. For sure. So, so thinking about those more traditional approaches of prevention versus detection, What what are the decisions that people in the public sector need to make? Because, obviously, they don’t have unlimited resources, and and they’ve gotta try and do both, I’m I’m assuming.

So what what what I guess, what are the main considerations that they need to think of when when either deciding what that balance is or either or?

Jan Bervar
I think the, main problem with investment is that we’re still investing in prevention.

But getting diminishing returns, you know. So because prevention is about reducing your attack surface and the more you invest, the more you will reduce it. But the amount of reduction will be less less and less and less. Right? So this this kind of investment I think is very inefficient compared to investment in detection response when you have a whole umbrella of, basically a threat detection and response available immediately. Right? And, we have seen a lot of customers investing in advanced technologies which are used only perhaps like one or two percent of their capability.

Therefore, making the whole prevention focused investment program, extremely, I think, inefficient.

Simon Driscoll
Yeah. It’s a common scenario that we see certainly within public sector, whereas you say, you know, money is is, you know, restricted.

Resources are very tight. I mean, most of the the organisations that we work with have very small teams. They’re lucky to have analysts, yet they’re investing in tools that they think are going to improve their performance in that in that security area. Inevitably, the it’s a it’s a diminishing return because Yeah. You need the you need that right combination of technology investment, resources, and the know how to be able to do that. So most organisations attempt to go down that road, but, unfortunately fail.

So, again, think rethinking that in terms of how you can drive that better efficiency, where your biggest return is gonna come from, often is looking at, maybe stepping back, not not, investing in siloed tools, but looking at it more holistically and as part of a service type model.

Jan Bervar
Yeah. If we were sure if we think about the, dual nature of controls today, so preventive versus detection and response controls, we see a lot of organisations investing in preventive controls for years until finding out that they can invest no more or basically they can get no more benefit from them. And then only going into a detection response space. While we think that detection response should be done as soon as possible, you know. Regardless of your current preventive controls, regardless of your current attack surface reduction, you should be very early investing in detection response because you will cover an enormous amount of threat landscape with a combined performance of detection response and prevention.

Simon Driscoll
I was gonna also say it’s looking at, you know, cost predictability as well. Yeah. You know, most organisations, most CFOs are asking their teams now to provide that predictability across a longer term. And that’s really hard to do, when you can’t predict where the adversaries are going to, you know, innovate and and drive change.

And again, that’s another reason why you can get into this sort of sinkhole of investing in internal capabilities that you’re constantly having to evolve and change.

And it becomes that sort of ever decreasing money pit, where you don’t actually achieve the outcomes that you’re trying to do, which ultimately is keeping your business safe.

And that’s where, again, that this type of model of looking at a managed detection approach can be really effective and provide that cost predictability.

Charlotte
Yeah. And because to your point, yeah, and you’re it is it’s gonna happen. Like, you can’t one hundred percent prevent it. So you you kind of need that alongside it.

And it’s on a previous episode, we were talking about, also what you do when when there is a breach, because a lot of organisations, as we were talking about, very laser focused on prevention, but sometimes don’t always think about what happens if if there is a breach or how they’re gonna detect if there’s a breach.

So it’s it’s having that trifecta, I guess, isn’t it, in place?

Jan Bervar
Prevention is black and white. Right? So you either have malicious activity or you have non malicious activity. This is where how we decide.

And typically it’s machines deciding that. It’s machines creating those controls of blocking or not blocking certain activity. The problem is there is a huge amount of gray space between those two extreme extremities and the attackers are exploiting that gray space when it’s not possible to decide whether something is good or bad. Right.

And that’s the gap of preventive controls. And the problem is if the attackers get in, they will typically stay in for weeks or months before getting detected. And that allows them allows them to do a lot of damage. Right?

And the promise of MDR, managed detection response, is that we will spot them within five or ten minutes when the fire is so small.

Charlotte
Because I I’ve read quite a bit that it’s often a third party organisation that alerts the organisation that’s had the breach to the breach. So that’s that’s a really important point.

Jan Bervar
It is either the criminals alerting you that they have you all of your data or your business partner or customers alerting you. But, yeah, of course, the promise of MDR is that we are able to detect this within five or ten minutes and immediately take action to stop it, to contain it.

Simon Driscoll
Yeah. I mean, the the latest index reports and the latest UK government breach survey report sort of validates and backs up that view that, organisations at the moment are only really around thirty percent effective in terms of actually identifying quickly their their threats. So that leaves a huge void of threats that are going undetected. And, I mean, it still amazes me, but, you know, the latest stats out from, reports from IBM, Microsoft, Cisco, you know, leaders in the in this space are all validating the fact that, the time to detect a breach at the moment is still out at, you know, over two hundred days.

And when you think that the, you know, the the criminals are working to minutes in terms of their time frame, that is a a daunting prospect for for anyone.

Charlotte
So it’s quite a quick win then, isn’t it, if you adopt that MDR approach to sort of I guess it’s quite a high priority above the sort of prevention activity that they’ve probably been doing.

Jan Bervar
I personally I’ve been in this business for, like, twenty five years. I think I’m working within this space of MDR, and I think this is currently our most powerful control to address specifically criminal activity.

We also have to understand that criminals today are very fast. They will get in within, you know, minutes and I think the average time for them to obtain the gold keys to all of your data is about ninety minutes. Right? So from the initial access to getting to the to the, key to all the doors is about ninety ninety minutes.

The problem for attackers is, of course, after they have the key, they have to find the doors and they have to find where the data is. And that takes days, weeks, months sometimes. And that’s why it takes a breach a while to develop fully. Right?

So, we can if still if we if we can stop them after ten minutes, we will even prevent them, from getting to the keys. Right? But, typically, attackers still need a certain amount of time to fully develop the, activity which will allow them to damage you to the extent which, which creates their business model possible.

Charlotte
Okay. So MDR can limit the amount of damage that happens as a result of a breach as well as detect it.

Jan Bervar
That’s that’s the, in essence, the promise of MDR. So, you know, if, if a breach is allowed to develop, it will it will eventually burn down the whole house. We are basically the the the people waiting with a glass of water to put out the fire when it’s really, really small. And that’s the kind of the idea of catching the breach in the very initial phases. When the attackers enter your environment, we’re there to basically contain them.

Simon Driscoll
Yeah. We talk a lot about and and more and more organizations now are aligning to the MITRE ATT and CK framework, which is really looking at, how a an an attack escalates from initial reconnaissance through to the the criminal achieving what they want to achieve. Mhmm. And the promise of detection is is catching that at a very early stage, within that MITRE ATT and CK framework, which limits the amount of of exposure, obviously, the business has, but also utilises more techniques at the defender’s, sort of side to to to help that.

Jan Bervar
Yeah. If we have the right visibility.

Simon Driscoll
If we have the right visibility. Absolutely.

Charlotte
A big if. So, so in terms of the public sector, not just in the UK, right, because I know, obviously, the UK is part part of our focus here today, but also the wider European market.

What are the drivers that you know, what’s moving the public sector towards this MDR? Obviously, we’ve talked about the big issues there. But from a from a from a smaller driver, what what’s driving them in this direction that you’re seeing, or what’s preventing or blocking them?

Simon Driscoll
Well, of course, the you know, an overarching theme there is is is the the budget that is available for them to spend Mhmm. On security. Unfortunately, security is still seen as an IT problem, where that mindset needs to change to, it being a business problem, which is, you know, partly having ownership at a leadership level, around security and it being taken almost as a line of business. Mhmm. So I think that’s one of the, the things that that sort of needs to needs to change.

Depending on which sector you look at within, within public sector, so education, for an example, again, this is being driven by what we’re seeing in the sector, with student intake and, you know, which drives revenue for the for the organisation.

And when that student intake is down, there’s more pressure on budgets and resources. So, we see a lot of, focus now on needing to leverage more from what organisations already have, and looking at the tools that they have in order to to affect better outcomes.

Charlotte
Mhmm.

Simon Driscoll
So this is one of the the main reasons why, certainly, you know, in education, for example, universities are looking at how they can maximise what they already have. Yeah. Looking at the gap between where they need to get to to affect those really good outcomes. And and often the answer there is partnering with somebody that can help fill that gap because like most areas, cyber skills are are in in shortage Mhmm. Especially in in public sector where the there’s a pay gap difference between the private sector. So organisations are struggling to find those resources.

So there’s, you know, that’s probably one of the main reasons why, we’re seeing this uptake in a in a more of a service model.

Jan Bervar
Yeah. Detection response, if it’s such a great solution, right, or a great approach, why does not everybody do this already? And the answer is you need five to eight people, at least for the smallest of organisations to provide this function internally because you need to do twenty four seven observation, twenty four seven expert investigation and response. So you need five to five to eight experts at the minimum to actually provide the service.

Charlotte
Because it’s not just about the automated detection.

Jan Bervar
It’s about interpreting it.

All about human investigation mostly. Right? And and this requires expertise. And most companies, if they have access to five to eight experts, they will typically use them in different capacities, not only security.

That’s why we do the m any in MDR. Right? Manage detection response. This is the really important part. And practically no commercial organisation apart from the biggest banks perhaps. And even the biggest banks will actually seek assistance from commercial MDR providers for certain areas for detection. Nobody’s doing this in house except the security organisations like the army and the police.

Charlotte
Because it’s so specialist, I suppose, isn’t it? You know?

Jan Bervar
It’s very specialist.

And there’s a huge lack of expertise in the market. You cannot buy those experts readily. Yeah.

Simon Driscoll
And and it’s also really important that those resources are available twenty four seven, because, you know, your criminals are not, are not gonna just act in in normal working hours. Yeah.

Jan Bervar
In fact, they will avoid They will avoid that.

Exactly.

Charlotte
For obvious reasons, I suppose.

Simon Driscoll
Yeah. But to deliver a twenty four seven service is is really expensive. Yeah. Probably out of the reach of most, public sector organisations. So really, the only choice or the sensible choice is to look at how like, back to what I was saying earlier. Mhmm. You know, looking at what resources you have available and how best to extend and leverage that, the help from from third parties.

Jan Bervar
Yeah.

Looking at all organisations, I think ninety five percent or more of them will be looking at external.

Simon Driscoll
Yeah.

Jan Bervar
Well, outsourcing of detection response. So MDR is will be the preferred solution.

Charlotte
Yeah. Because it as well as being helpful and access to skills, it must be more cost effective because you’re not having to employ seven or eight people full time just solely dedicated to that capability.

So where where does, without going down a zero trust rabbit hole, because we’ve got another episode assigned to that, where does that fit in all of this? Because, obviously, this has emerged as a much more modern trend, in cybersecurity.

So where does it sit in the context of MDR?

Jan Bervar
Well, I’ve been in this industry for, like, twenty five, thirty years, and zero trust for me is just the rehash of an old concept of least privilege, you know. So the idea that you should assign somebody the smallest amount of privileges required to do a certain task. And that that kind of makes things simple, all the interactions simple, and that is kind of the essence of good security.

The problem of course is that, in the preventive model of security this is next to impossible because it’s really hard to describe the minimum set. And if you describe the minimum set, everything which happens outside of that is prevented, actually blocks business and so on.

But in the detection space, any kind of deviation from the least privileged model is simply an alert. It is not a blocking action. That’s why detection can be really really successful with the so called Whitelisting models or the Zero Trust models when we describe the activity or learn the activity which is the least or the simplest activity, and then alert on it. So this is one thing which is really important.

The second thing which I want to stress is that, Managed Detection and Response today has an R in it, response. And, most of the modern providers should, in my opinion, focus on the response. Which means that if the attackers are really fast, the provider should respond to the detection actions and not escalate this to the customer because we’re losing valuable time. But response means that the provider has certain rights to actually act inside the customer’s environment.

And that also brings the Zero Trust mantra in front because, the provider, if they’re allowed to do a lot of aggressive actions in the customer environment, they could also abuse those actions being hacked or in any way being used as a supply chain risk, for example, by the attackers.

And that’s why I think that the interface between the MDR provider and the customer should be minimal as well. So we should have as MDR providers absolutely minimal access to the resources of the customer, and all the actions that we do should be reversible. So we are not able to somehow do irreversible damage to the customer environment if we make a mistake or if we’re, for example, hacked.

Charlotte
Interesting. And and I guess the alerts, just to go back to your point quickly about that it generates alerts, that’s again where the manage bit comes in because there could potentially be thousands of alerts, I’m assuming. And and being able to, work your way through those alerts and understand which ones are important.

Jan Bervar
That used to be the problem with old technologies. So, so in the in the old days, most of the MDR or managed SOC, as they were called, the solutions were based around the Centimetres system. So security event and Information Management, which is extremely false positive prone and generates thousands of alerts per day. Right?

And that caused base this that has caused basically what we call analyst fatigue. People, a lot of analysts churn. So people not wanting to work with this technology or in this space. And as we have transitioned to more modern technologies, which are called XDR, Extended Detection and Response, we’re seeing, basically a decrease in alerts by an order of magnitude.

So we are basically seeing much less alerts, much more, quality in those alerts. And people actually, wanting to work with those technologies because they uncover truly malicious activity. So it’s rewarding to work with those technologies. Yeah.

So this problem has kind of gone away if you are using the right technology which gives you the right visibility. And that is one of the biggest, I think, differences between a traditional MDR or managed SOC provider and a modern one. The choice of technology as which is the primary visibility technology underlying the MDR service.

Charlotte
Interesting. And and and that kind of ties back to a point you mentioned, a few minutes ago around leveraging tools. So, do you think that public sector organisations are getting the most from the tools that they have, before they leap into investing in new tools?

Simon Driscoll
Well, in in one word, no. Yeah.

Charlotte
End of podcast.

Simon Driscoll
I mean, there’s there’s a huge opportunity there as well for organisations because, you know, one thing certainly in public sector is some of the big vendors, you know, have have provided access to those those tools through the suites, that that those organisations have access to.

And, you know, what we’ve definitely seen and probably one of the areas that keeps us most busy is helping organisations understand how they can optimise those tools to best effect. We see some good practice, but there is room for improvement for sure. So I think that is definitely an area of of focus. Again, it’s back to that view of leveraging what you have, getting the best out of that. And, of course, to, you know, to take full advantage of an MDR type service, those tools need to be optimised in a certain way, to integrate into that platform. So, again, that’s another sort of important area for, I think, partners like ourselves to work with organisation to help them get ready for that type of, transition.

Charlotte
Yeah. Because the people who were there, may not even have been the people who bought those tools. Yeah. So they may not necessarily even understand the potential that sits within them.

Simon Driscoll
And and and as we’ve discussed, you know, threats are always changing and evolving, and policies are always changing. And leadership teams are, you know, are are new are coming in with different ideas. And business models are changing. You know, if we take the the pandemic, you know, that’s completely transformed the way that we now think about work and and learning.

And so that that has to then translate into a change of policy and reshaping of the tools that you have again, which I think organisations struggle for all the reasons we’ve talked about. The resources aren’t there. You know, time is a is a is a major factor here for for most public sector organisations. So, again, the support that we provide as a partner is really important there to help, organisations optimise these tools and get the most out of them.

Jan Bervar
I absolutely agree. So also also the efficiency or the focus of technologies gets different with different time periods. After COVID, for example, mobility is everything. So networks are not very good any more at observing things.

They’re nice at limiting connectivity but the data is travelling around, the users are travelling around. So end point security, cloud security, identities become a much more important observation point for us compared to traditional topology restraint ways of working. So this is a very very important shift which is coming. And in the past, you know, we have been kind of on this roller coaster ride, like saying endpoints are important.

No. The network is important.

Now we’re getting more and more close to data, closer to processes, closer to users, when we want to do security, especially detection response.

Simon Driscoll
Yeah. I mean, the endpoint is becoming critical now because of the way that we now work. There is less reliant on the network. People aren’t going into a physical place to work any more.

They’re directly accessing the applications that they use within, you know, their their environment. And and therefore, there’s a shift in the way that we need to think about security. It’s back to that sort of traditional versus modern route. Firewalls, MFA, all will all have their place.

But, as we’ve as we’ve seen, you know, threat actors and criminals find ways around those tools. Yeah. And I you know, there there’s a stat again that’s come out of the the recent cyber breach report from the UK that showed we’ve seen a seventy one percent year on year increase in invalid stolen credentials being used as the entry point into an organisation.

So, again, you cannot rely on those traditional methods to detect that. You have to think outside the box, and you have to extend your, you know, your capability beyond that.

And, again, MDR is a great way to be able to to support that type of model.

Jan Bervar
Yeah. But we do have to distinguish between, you know, the mobility of the workforce, the the, the people Yeah. And the digital parts of our society which are tied to our locations. So, you know, all the industrial stuff, all the health care stuff, this is typically very much bound to a particular physical place. And in those cases, we have typically a different set of, technologies and different approaches to manage that. So in IT, a lot has changed. In the other aspect of digitalisation, things are still still pretty much fixed.

Charlotte
And, and that kind of brings us on neatly to, the last part of the podcast we were gonna talk about, which we we have managed to avoid the c word up to this point, which is compliance.

And, obviously, a lot of public sector organisations are highly regulated.

So I thought it would be good to finish maybe with three or four points on how MDR can help the public sector meet those compliance obligations or demonstrate that they’re working towards those.

Simon Driscoll
Yeah. Sure. I mean, again, depending on which part of the the public sector you work in, you will have different sort of governance and compliance that that is is relevant to you. You know, we see a lot of focus around cyber essentials, and, obviously, the government, as part of their UK strategy up to twenty thirty has built the cyber assessment framework, which is now driving a lot of change, around, the surgeons that they’re sort of putting on on organisations.

You know, and then and in health, we see the DSPT, the, data security protection toolkit, which is a list of assertions that organisations can align to to say, do they meet certain criteria? And and actually, when you look at so what we started to do as an organisation is map against that, to help organisations see against all these assertions, how can a service like MDR, for example, help meet specific criteria. And there’s a lot around things like vulnerability management, that can be automated through an MDR approach to speed that up. And again, that’s a that’s a big drain on resources for an organisation to be able to, manage their patching and their vulnerabilities.

And and that is an area that can be taken away and managed much more effectively through a third party, potentially. The speed at which effectively through a third party potentially. Mhmm. The speed at which we can detect those problems.

So there’s a lot of assertions now in the compliance around your ability to be able to detect these threats much quicker.

And again, that is something that we’re we’re helping organizations understand how they can align to, to compliance. I think, generally, we need, you know, we need to be doing more around compliance because, yeah, as you say, they are heavily regulated in in public sector, but not necessarily mandated to keep up to date with those, those rules. And I think there’s been a lot of leniency provided because of the economic changes that have happened with Brexit, with the pandemic, with the financial crash, all these these big, you know, economic, sort of paradigm shifts have have effectively given people more time to to look at compliance. So I think we’re gonna see that change, over the next sort of, six to twelve months.

Certainly next, February when the the new, CAF guidelines are gonna come into effect. I think that’s going to mean that organisations need to start looking at that and aligning to it a lot stronger. And, again, MDR is a great way to to effectively meet a lot of those assertions. Tick a lot of boxes, kill two birds with one stone. Yeah. You know, it’s a good way to look at it.

Jan Bervar
Yeah. Yeah. I also think that one of the goals of compliance is to establish a better digital hygiene, you know, in general. And, an often overlooked feature of MDR as well.

You know, MDR is about observation, investigation, response. But the observation itself gives you an insight into the customer’s environment. And basically through observation you can also learn what are the potential changes that you have to make to get better digital hygiene. So having an MDR is not simply about, you know, making sure that all the attacks are small or all the instances are small but also giving you, a roadmap, so to say, of the changes, but backed by hard evidence what we have seen in the environment to actually establish a path to a better digital hygiene.

So I think this is kind of a less obvious, but I think perhaps even more important part of MTR services.

Charlotte
Yeah. Because it will really help them direct their resources, won’t it? You know, where resources are are in short supply, it gives you that priority list.

Jan Bervar
Yeah. You’re not guessing what should be the next control in your environment. Preventive control even. Right? So MDR through detection and response can actually help you establish a better preventive strategy as well and not invest in things which will improve your stance by zero point five percent, but actually make a difference.

Simon Driscoll
And and, again, an MDR service isn’t just about that tool set, the resources to detect threats. It’s the surrounding elements around that. It’s it’s the changing culture that can be affected through adopting that type of service. Mhmm. And it’s a lot of the surrounding services that support an MDR, things like offensive security services, red teaming, and doing a lot of the planning.

Coming back to the compliance question, there’s more focus now on on readiness, and organisations being able to respond to an attack. Yeah. So instant response readiness. Yeah.

And that and and I what I have seen in the market is definitely, a big focus on disaster recovery. How do we make organisations more resilient Mhmm. To be able to recover from that? And again, taking this sort of service approach model can help, address a lot of those sort of software areas around around the the core security capability as well.

Jan Bervar
Which I think brings us to one of the most important things of this this podcast, which is that preventive security was about technology. And the new models of security are about people. You know, detection, response, threat intelligence, offensive security, it’s all about expertise used against the criminals because in, in the long run, it’s a battle of a battle of humans against humans, you know. Yeah. So it it’s something which, is hard to do. But I think by outsourcing it to the right expert group, I think it becomes reality.

Charlotte
Another set of humans who can-

Simon Driscoll
Exactly.

Superhuman. Yes. Exactly.

Charlotte
Exactly. Well, thank you both so much. That’s been really interesting. And I think, again, has given some quite practical advice.

I think there’s definitely an argument there for, bringing in that detection response alongside your prevention measures because, as you said, towards the end, it can help focus your investment in that area, and you you come out of that ever decreasing value cycle. So brilliant. Thanks for all your insights. Nice to see you, though.

Thank you.