How do you answer “How safe are we?” in a way the board can act on?

What question does the board ask?

0:03 All right. Hey. Hi everybody. We’re just starting. While we do so, I’m going to give some time for people to, you know, come in. So the water’s fine. So if you want, just go to the chat room and tell us where you’re from. I’m going to start first. Hi, I’m from Austin. Oh yeah, I forgot to use howdy. I’m sorry. I forgot that I’m supposed to. I’m legally mandated to say howdy. Howdy. Okay. So, I think we have some people here already. I can see the water warming up. So, let’s start right now with cyber metrics that matter answering how safe we are in this crazy world we live in with AI. And to start that, I’m going to walk backwards.

0:55 So okay every time I start a conversation about cyber metrics folks I start with this banner and there’s a reason for that metrics they are important but doing the ones that matter ask us to not be in our heads as cybersec pros it’s much more about being the hats of people who consume those metrics in our case I’m going to use as example the board because I feel like it’s the least common denominator of or highest actually of how good metrics should look like. The board comes to the CISO to the security leader and asks how safe we are. Super open-ended question. There are three reasons that makes this challenging. The open-ended question is happening because security must take care of everything that’s touching critical data processes confidential stuff and this is distributed hyperdistributed by nature from shadow IT to everything else. You got to go everywhere to answer this question. The second one is labor intensive because of all these silos and all the places where your data and processes are at the moment. Answering this question requires your teams to really work hard towards it. Bring raw data and have you or someone else condensing that into something that will actually cater to who’s asking this question who has a lot more to take care of sales, marketing development. There’s a lot of questions to be answered. They need the cognitive load to be not required for them. They just want to know how safe we are and with consequences because you answer that well. You get the resources you need to run security. Well, I’m talking not only dollars but also support from other teams. Hey, you got to help remediate this security team sport. And if you don’t do that right, security suffers dearly. Your peers, your teammates, your directs. This is a question you can answer well every three months.

2:48 But then it comes AI and AI brings something extra to the table which is frequency and risks. Actually two things. The first one is frequency. People the board everybody they’re starting to see time compression events. They’re like, “Hey, actually we need to be much more diligent about security.” So that how safe are we is getting asked every day. It’s getting asked continuously. The word is changing. The time is compressing. And the second one is AI introduces risk horizontally and vertically. Horizontally I meant your company is adopting AI. They are adding Claude. They are adding OpenAI and that presents a risk with agentic execution. Execution without humans in the loop. It might hallucinate might throw your data elsewhere and also every piece of asset in your organization whether it’s software whether it’s SaaS apps they’re starting to incorporate AI functions and being autonomous by themselves which also creates risk.

3:55 And when you think about these scenarios the system simply breaks because now you need to answer these questions on metrics that matter point blank and this is what we’re going to explore today we’re going to go to three things. Let me see if I can make this disappear. Nice. The three things we’re going to explore is are first where and why it breaks. Second, how to fix it no matter your stack. So, I want to give you frameworks and things you can walk away with. I know what to do. I know which areas are relevant to my organization and my situation. Last but not least, also a game plan with an example that’s inclusive of AI. So you’re not knowing just what’s the problem, how I think I’m going to fix it, but you walk away with steps and a framework you might to execute on it.

4:38 Also of also always worth saying the resources have all of this. So if you need to walk away if the conversation is not interesting, you can you can get those you can keep going and I’ll be grateful I saved you time. But if you stick around, my promise to you is that active listening will give you the fundamentals. For me it’s not only about these three steps. For me it’s important for us to remember that you accrued wisdom of doing cyber for many years in your company and that knowledge especially the knowledge of essentials the fundamentals of scoping what to protect well making calls on risk decisions, playing even the political games of like hey mobilizing getting other teams to work on security those are extremely important. So stick around, do that active listening. I know asking for this time is crazy like in this economy like we have we have we have Instagram, we have YouTube Shorts, but I swear it’s worth your time. But if not, of course, you got to go slides are available. You can always just, you know, have a look at those later.

Where do security metrics break, and why?

5:46 Okay, let’s begin. First item, where security metrics break and why? There are many different reasons, but I want you to pay attention on the top three that I feel like will greatly simplify our conversation and help us drive through. So, sorry the mouse is distracting. The first one is scope security is hard. We already talked a little bit about that, but I’m going to show you an example and give you perspective and give you a tool you can speak to your peers in a reasonable fashion. Why? The second one’s the checkpoint frequency. We already touched that, but I’m going to bring you a little bit more into what I meant by that. And the third one is the language of risk. Speaking risk to different levels requires a reduction in cognitive load that security needs to be extremely good at and maybe copy the playbook from other departments.

6:42 All right, first the scope. The scope of security is incredibly hard because guess what? It’s everything that touches your data and processes. And I want you to walk away with this. If there’s one thing that I felt like I helped you is when you have this conversation with other peers, think about this board and C-suite level. You have security, you have sales, you have marketing, you have development, engineering.

7:07 Sales needs to tell like how well sales is doing. They just go to one place, Salesforce. They see the revenue, they see the forecasting, and they can answer fairly quick. Hey, we’re doing this. This is going well this not marketing same thing Marketo developers engineering same thing GitHub and Jira maybe two systems HR, Workday and Great Place to Work surveys you it’s it’s everywhere and it’s distributed by nature because the data goes to different places business adopt new technology security must inherit risk with grace and actually have an opinion how safe we are what are the risk and this is goes in everywhere it’s Not only that it’s going everywhere to answer these questions, it requires not only taking stock of what you have is actually understanding in depth the risk picture of it. So when you ask a question like hey how safe our devices are. For example, you got to check multiple different states to see where this is because one system will hold information about the user who uses that device that presents a risk factor. The other is the device itself through your endpoint protection. And all of a sudden, you are on this game of going everywhere to understand and answer that open-ended simple question.

8:19 And as soon as you start seeing those security is always about having more that you can chew. That’s the game of risk, right? The only way to not have that to be zero backlog is literally to not have a business to run. So whenever you have the risk you need to prioritize to the frame that the board understands not only a security score it’s understanding the business context in the where this thing is happening to be to make sure it’s safe enough the scope is hard.

8:54 Second one we mentioned checkpoint frequency. So you look at frequency it’s tricky. It used to happen every board cycle or C-suite cycle call it quarterly business review maybe and that was fine that was good but as the time progresses the question and the anxiety about security is starting to turn up and now all of a sudden you need to answer this question point blank. And that changes because the way you used to do security in the past of like hey to answer this question we got to answer once a quarter go push silos let’s do it changed the game now it needs to happen instantly.

9:31 And the third one language of risk the board point of view when you have all these departments all together sales financials marketing security is that they want insulation of concerns.

9:42 What I mean by that when the CFO is asked Hey, how we’re doing financially. He doesn’t talk about RPO. He doesn’t talk about EBITDA. He talks about, hey, this is the level of cash we have in the bank. We’re making more. We’re making less. We will need to cut here. We need to do that. So, the conversation is pointed at the primary goals for security. That is mitigate risk, stay compliant, limit financial impact. And the better you work, the tighter to the level of the messaging, the better will be your results. And of course this changes depending on which level of the organization you’re speaking to. So metrics that matter depends on the eye of the beholder and failing to do so creates horrible bias that greatly affects your organization culture and the security culture. So the messenger are extremely important.

What should a security team accept first?

10:41 Okay, you know the three reasons where and why it breaks. Now let’s move over. Let’s talk about solutions. Okay, enough of problems. I already have many in my life. How do we solve for these issues? I’m going to present you a few perspectives and frameworks and tools to help you out. There are three of those I’m going to walk through. This is big picture stuff for the trees of course. So, it goes to tactics, but I’m also going to provide links.

11:07 Before we do that, I want us to breathe and recognize a couple of things that help us greatly direction where we’re headed. The first one is recognizing that security grows linearly. Security work and risk grows exponentially. This always been the case. It will continue being the case with technology innovation. And that mentality forces you to think more intentionally about automation and leverage in treating security as team sports.

11:39 The second one is cyber security is part of a zero sum game. We know in our departments that in security that invest in security is important to the business but the business has limited resources and then there are competing areas with compelling reasons for the company to invest money on. I’m going to point out some examples here. Sales and marketing they’re like hey let’s expand let’s create more business and that might be fairly important for the company strategy and sometimes might be more important than taking care of risk or people hey or people they work so hard let’s cut them more checks first yes let’s go but the second one yes this is what we are competing against in security and even these boys here now there are token costs now we need to pay the machines. And that creates a different bar for security. So, when we make metrics that matter, it’s about convincing the business it’s actually important to invest in security even though they’re even more attractive, easier to do levers here.

Which three moves fix it?

12:49 That leads us to the bar of strategy and the way we got to think about this. So, I want to give you three frameworks and three ways we should use those as tools to implement the solution to the problem. The first one business-centric metrics we need to speak to the language with the least amount of cognitive load from our peers so they understand the problem quick the importance and give you the resources you need.

13:11 Second one clear risk transfer risk transfer is extremely important and greatly misrepresented and misused on security. There will be always more risk than what you can do and then you need to clear and transfer those risks right failing to do so everybody thinks security hey if it’s wrong it’s security game on let’s adopt AI like crazy and that’s not the right way of thinking about it so we got to be extremely intentional of driving accountability when we don’t have the tools to address risk.

13:46 And the third one instant feedback loops that point blank question how safe we are AI I included needs to be answered instantly which there brings confidence from the peers asking and also turns them into agents of security because the fairly next thing you do is triggering in how you can help us. So fairly important things to do and also notice that I didn’t touch AI here. I’m going to touch within those because guess what AI is just upping the end tip on these things and make them more important than ever.

What are business-centric metrics?

14:24 All right, let’s go. First thing you got to think about when implementing the solution, business-centric metrics. You got to speak to the language of your customer, not yourself framing security. There are two frameworks that help greatly here. The first one is that I really like is Henrik Parkkinen. He’s a cyber security leader. He wrote an amazing blog that’s aging like the finest wine in my opinion. It’s it’s from a couple of years ago. It covers key performance indicators, key risks, and key control indicators. And it helps you understand which message goes where in the org chart. And the second one is from Gartner. It’s called outcome-driven metrics. What that gives you is kind of a bingo card to which places you need to implement those instrumentations. This not including AI. So I would add AI as an extra one on top of it but helps you understand how complete you are on those metrics you are serving to your different stakeholders.

15:24 There are way more frameworks trust me for measuring what a business is right like great example FAIR. I love this specific framework. It’s an attempt on trying to tie a financial dollar signal to everything in risk. I like those a lot. I feel like it’s evolutionary state if you do the basics right. I don’t want you to get lost in bike shedding by trying the most excellent framework. So remember crawl walk run FAIR is awesome and you should use it but you should set yourself in position to take maximum value of it.

16:00 Okay remember I mentioned Henrik’s fundamentals. Reason I like is because he finds places for things that we care about and he in a certain way he says like what message goes where. So what you’re seeing here above the fold is the KPI the key performance indicator and the way you can walk away with it is that KPIs they’re a great way of communicating to areas outside security how safe we are we how safe is security oh based on our KPIs the governance the incidents the awareness the SLAs we’re doing well in this way we’re not doing well in this so this is a great way of staying you put to keep the main thing the main thing to this audience. Then it goes down like why what are the risks that are leading to us driving this performance and this al of course includes like external items entering in which are key risk indicators. So key risk indicators are the things we’re protecting against and they help a lot of us tracking that.

17:09 And then to address risk we need controls. Key controls indicators they tend to be more tactical more to the IC level but they are important because they help you build the confidence to say we’re addressing risks right because we are implementing MFA everywhere so these are extremely important to help formulate a pyramid of everybody’s working on the same heartbeat so individuals have a way of seeing their performance in IT and security here under dress leaders get a way of seeing the risk program owners go all the way up to the CISO to the board level to the C-suite. They can see the performance indicators in a clear delineate fashion. Also, Henrik does a great job of saying things like, hey, do not overflood with metrics. Got to be extremely important of keeping just a few metrics for each which are important less cognitive load. Remember, better metrics.

18:08 Second one, Gartner cyber security business value benchmark. Outcome driven metrics. There’s a lot of words here. You’re gonna have the slides. What I want you to walk away with is what frameworks like Gartner does. They give you a list of things that you need to check out for. So whether you’re applying the Henrik stuff, whether you’re remixing your own way, remember your listener, the person on the receiving end of the metric is the most important person. These are the 16 places you should be looking at. This is from 2023. Of course is missing new factors which I include secure AI extremely important and proactive security measures because the time is compressing there’s no more time to handle vulnerabilities after they show up you preemptively need to implement security controls these two extremely important today.

18:58 The right framework for you word framework work we work in cyber we know how frameworks goes they are guidelines and suggestions But whatever you’re going to select, remember the northstar, which is your customer language with getting them up to speed and bought into security with the least amount of brain power required, which means that speaking to them in technical terms will not help. So this is attachment for you. You can read it later, but shows you how you can frame things in a way that’s more strategic versus technical.

How does security transfer risk clearly?

19:33 Cool. Second item, clear risk transfer. Guess what? You present metrics. They are compelling. There’s still that bonus check to cut to everybody or that extra investment to do in security in IT or in sales or in R&D. There will always be residual risk.

19:57 There will always be risk to share with people. Security is a team sport until you compete for resources. And you need to create nobody will ask you, hey, create a metric that holds me accountable. You need to create those and you need to push the organization towards giving this to you. Otherwise, you are the silver bullet for security. Everything that goes wrong is always your fault and that’s unfair. Going to show you two that I hope give you ideas to, hey, I can actually use that to create leverage and create the support I need.

20:27 First one, gamification. I love this one. It’s my favorite. The way it does is like this. You have a lot of stuff you need to fix in security and you have owners and there’s always this tension of like hey owner you need to pick up your stuff and remediate you need to patch systems you need to do this you need to do that and using good gamification charts help you have that conversation without having that conversation what I mean by that how safe we are oh this is how we’re doing above the fold those KPI metrics this is how we’re doing as a team and let the fires burn. What happens here is implicitly there is a provoke or a conversation about risk relative to each other. Departments are competitive. They want to do well and what you’re giving them is the chance to compare one against another. This might trigger a question of hey it I know you’re doing identity. We invested a lot of money on these systems. I’m starting to see that high risk is bumping up relative to the grand total you have. Why? That helps you. Things like this help you say like, “Hey, there are these problems without owners. Oh, tell me more security like where do you need help? Are those yours? Those should have an owner.” SLA violations also do the same thing. So these things they incentivize good behavior. They turn the system into self-healing in the sense that everybody needs to answer their questions. You don’t even need to trigger those. If by just showing and having that seed planted you might get the behavior you need.

22:01 Also changes the perception of security because gamification fun right not Department of No, it is the department of hey let’s do it responsibly which includes as an owner you want to push better technology and AI we need to stick around to doing this in a responsible fashion steering is the name of the.

What is a protection level agreement?

22:28 All right. Another thing that I find extremely awesome as a best practice is this thing called protection level agreements. Protection level agreements is the way you tell your boss that for this level of funding I’m going to go up to this level of protection. If the protection level agreement is different, then if it’s because of budget, it’s your fault and you need to address that in a graceful way. I’m going to show an example of what I mean by that. But it’s important for security to think PLAs, not SLAs. SLAs are analog kind of did I did I close this ticket in the time.

23:06 PLAs are important because there are two ways of transferring risk. Let me show an example here. Let’s call hey you got a project and you need to reduce the time to patch critical assets like there’s a patch available, we need to compress that timing how we going to compress and then they ask you and the first thing is the benchmark hey this is where we stand today it takes 14 days it cost us $100 per year and I file P4 tickets and I praise I I pray I ask people and they optimistically handle that when they have time. This is too risky. We need to do something else.

23:46 Then you shoot for good security. And you ask something that might be completely unreasonable to the business. Give me 100,000... $100 million. I’m going to hire everyone to handle all the tickets. We’re going to just have P1 tickets for all these problems. We’re going to do great. Then reason comes in. Hey, yeah, we would love to do that, but we don’t have budget. So, you’re going to get 100K. Tickets are treated this way and they’re treated by these people.

24:13 This is the SLA. Oh, sorry. This is the point in time. And you’re like, okay, this is a PLA boss. Whenever this is done before 7 days, I wasn’t instrumented or funded to do this, right? Whenever this goes after 7 days, it’s my fault or fault of the process. What you’re doing here, you’re setting a baseline in which the risk is not yours. The risk is a business decision of investing 100k instead of $100 million. This is risk materialized and if it’s before the PLA business decision after the PLA failure in execution.

24:54 Now why this is important this transfer risks you’re no longer the single person to point a finger or the silver bullet for security in the company. You will be help you will be needed to deal with this. Don’t get me wrong, but at least you’re not dealing with the pressure or with the guilt, the implicit guilt of something you’re not even instrumented to solve.

25:19 And also the beautiful thing about risk materialize is that you’re not only transferring the risk but if you transfer that and you have benchmark of other companies which by the way are standardized on PLA as well. It helps you give your teams your board your bosses a way to justify hey companies similar to mine they invest on double the time to fix. Even though I invested double, my security is twice as better as others, this happened. It’s a risk of running a business. That’s it. It makes defensible for investors. It makes defensible for the company. You’re not being just a bad guy of delegating risk. You’re giving your team, your board resources to defend the decision. That’s the second one. I know I’m going through a lot. We’re going to go into solutioning pretty soon. This is the last part and then we’re going to go into solve the problem.

Why do feedback loops have to be instant?

26:15 Third, instant feedback loops. Remember that question, how safe are we? That’s something that you need to answer now point blank. If it takes you Oh, wow. The label is wrong. Hold on, hold on, hold on. Let me change this. PDCA. Okay. Back to the show.

26:39 You need to prepare to answer this question point blank not only to the stakeholders but also even to make your systems better. So Imagine when I think about this I think engineering principles. So if you are constantly every day compiling that dashboard the cyber metrics that matter you can every day look at what’s deviating how to do better and actually do things better. Extremely important to think any place where you’re seeing manual human interventions, silos, information that’s getting clogged or decision that you need to come in and digest versus being prescribed to something so basic how safe we are. You need to handle that is the rule of the game right now. Time is compressing. Your checkpoints on how safe you are needs to compress to that same time or even less.

What does the crawl, walk, run plan look like?

27:34 Okay, finally now number three. Let’s solve this problem. You told us how. You told us where. Now, how do we need how do we solve this? Especially in this age with AI like give me the AI ready stuff. The stuff that will help me.

27:52 First attachment to this presentation. There’s a crawl, walk, run plan here. What I wanted to give you here is instruments where hey, I sit in this place. There are silos everywhere. I need to solve for these problems like I need to start simple proof the model and keep going from there. This is a crawl. Crawl is about eliminating the choke points that prevents you from having that instant loop PDCA. It’s about eliminating silos of visibility, reducing that feedback loop, establishing ownership rules so you can actually get some help from other teams as well. Remember that gamification board extremely crucial to give you time and breathing room to build the crawl. So fairly important to do this. It’s going to help you a lot.

28:33 Then it comes the second part which is walk. You can implement some of the walk by the way at the first step. I’m not saying hey don’t build a dashboard but if I were to productize I would say like kind of the urgency is calling for eliminating silos as soon as possible. But this is an easy walk as soon as you have the silo solved like it greatly eliminates the biggest time suck of doing this work today.

29:01 Walk is all about having the language of risk tighten up here. What I’m saying is not only about building a dashboard, it’s actually testing with the person who consumes that message and actually see if that would make the conversation move from hey tell me more about this and then you don’t answer and then you need to go back to the drawing board and lost momentum into more like how we can help you. So that’s the bar you need to ask yourself if your metrics that matter are delivering and this is AI included. Hey, this is our AI surface. This is the risk we’re taking by adopting more AI. Okay, how I can help you?

29:39 Last but not least, programmatic risk reduction. You’re seeing those things you need to create the rituals in which you’re up taking from them and making the system better. It’s not only having a PDCA loop, but actually feeding back and making things better, making teams work diligently towards security and also invest in proactive security in preventing issues before they pile up. Even pile up in your dashboard.

How does this look in Axonius?

30:07 I’m going to show you an example on how I would solve this with Axonius. One thing I want you to keep in mind is these principles I mentioned, they work no matter your stack. These are fundamental problems of security. It’s just that I bet my career in Axonius. I love the software we built so much. Yeah. So much so I bet my career here. But I want you to think as an engineer back in your shop like how you could use it.

30:34 Okay, first quick intro about Axonius. We bring information across all your systems to the same place. That’s it. That’s what we do at first. And that allows you of course when you think about metrics not having the silo problem. All the information is in the same place constantly updated. So I have that full PDCA and also I can act on those things from the same place because we help you process and prioritize risk and unify the operations. We integrate with everything you have. So you don’t need to run the silos or CSV exporting port or trying to make sense of things. It all sits in the same place and I’m going to show you how it feels like to do that when you have a system.

31:15 So, okay, first I’m going to enter the Axonius dashboard and we’re going to revisit this soon. But what I want to show you is first how we work because I think it’s important. So, the way Axonius work is that we connect to all the systems that you have across your infrastructure. That includes things that are typically security like Check Point, Cisco and weird things that are not security but they are important to paint the picture of risk like Expensify. Wait, what? My expenses? Zoom and Anthropic Claude like why do you need those things? Well, what’s going on? This security. The reason why we do that is for two.

32:02 The first one, remember that risk is everywhere you have systems. Yeah, it allows you to see all of that across 40 different asset types in your state. And that’s important because it helps you solve fundamental questions on how safe we are that we asked ourselves like which systems are missing my most essential security controls. How do we answer by that is not because this system here in this example CrowdStrike will tell you that no is by what we call process of negative space or elimination for this specific device. CrowdStrike does not report the existence of it but 10 other systems are seeing this thing every day and saying hey actually this thing exists [demo asset details omitted], and I see that frequently so by seeing those things we can answer these questions and start seeing the KPIs that matter to answer your question how safe we are that’s applied across everything you have including SaaS, including AI and I’m going to show you an example in a second.

33:18 But back to what we talked about, it might be related to running all the systems that are expensed but don’t have my SSO. So this is another way of spotting risk and spotting gaps in coverage. And a fairly important one when you think about metrics that matter. So this process hold that in your brain. That’s the basis of talking about cyber metrics that matter. So let’s go and explore some of these metrics in real life.

33:58 So all right, I’m going to show you a few examples on what you can do with these metrics in mind. Remember the core functionality or the core way you can think about this is risk on the eye of your listener, not yours. Here’s an example of Henrik’s key control indicators. We’re seeing all the endpoints, the managed and the unmanaged. We’re seeing which the completeness of our CMDB. What systems are missing endpoint protection. So these are the control indicators I implement to reduce risk. This is my organizational risk. This one is not compelling compiling. I’ll check it out later. But I want you to pay attention to this one. High, medium, low risk. This is defined by rules that I have in my organization which are simply framed in a way where I know which controls to implement to reduce this overall risk.

34:49 Then there are the performance indicators. Remember the number that serves above to the board whether it is my overall risk score the key coverage of the most important investments I have. This is all sitting in the same place. A conversation can happen this way depending on who I’m speaking to in the language that will support that conversation.

35:12 Now let’s show that in a different spectrum. AI is being used in many different ways. Remember horizontally and vertically. I’m going to show you vertically here in do horizontally with a quick query that exemplifies what we’re saying and that can be turned into a chart. So okay, AI adoption. How is my company adopting AI? Here I can see vertically which of my SaaS applications have AI functions [demo counts omitted] and the same for other things in my inventory. Then how’s this AI being used across all the systems I have? Hey, here is a system. It’s providing suggestion. Humans are in full control. Here’s agentic human in the loop. Okay, humans has to approve an execution. These are things that can run automatically and nobody’s looking at by the way expenses is like if you expense a software that does that. Why you’re seeing as expense AI capabilities same thing native augmented connectable native things like Claude Code it’s native and provider models maybe hey actually for me it’s important to not bleed context to a third party vendor like [a third-party model provider]. I don’t want my LLM going there and as you go into those you can investigate which apps are providing those.

36:35 So this is a way of looking at it the other way you can look at you can build your own chart based on filters that you can create. Like me find here a good one. Users that do not have Claude but they have they use computers with software installed. That is equals Claude Code. So this is a way of finding shadow AI usage of a solution in this case Claude within your organization. Even though you have MDM controls, you have other things those might not be enforcing the rule sometimes and this is one of the patterns you can do and this can become of course a dashboard.

37:39 Last but not least, I have another example here to trigger your mind and trigger a curiosity on metrics that matter which is that gamification component that like let’s get the help we need instant zero time. You already saw that in the screenshot. But what we have here is that all the security findings we have in this organization [demo count omitted]. These are CVEs, non-CVEs, systems missing MFA, systems missing endpoint coverage. They are all listed with different owners and then owners can see the risk accord. Example here: [demo team counts omitted]. This is a great way of delineating risk caring conversations and this is the executive part where they see all the things but remember the idea of carrying a narrative that’s compelling that also must be transferred to the way you’re presenting this to different stakeholders.

38:39 Let’s say the board meeting has ended and corporate field felt a little bit on the spot like hey you put us in a bad place like it wasn’t fun tell us why you can dig into that risk you can open that and remember that complexity of finding what is the risk that’s the gets derived for you in a human language hey this is the risk percentile but this is problem that’s publicly exploited. And by the way, even though there is CrowdStrike, the overall ZTA score is pretty low and this is exposed to the internet. So these are the ways you can frame a risk in a reasonable fashion to a stakeholder where they’re like, you know what, that actually makes sense. I’m sitting behind.

39:30 So back to the system here and to the demo. What I want you to remember are the principles. When you look at these things is what you’re starting to apply is the fact that first there are no silos. All the information sits on the same place. The second one is there are the language of risk derived for you. You can use dashboards. You can build your own and you can cater to your organization what’s the best metric that will work for them. All these dashboards you saw there completely customizable and shapable to the way you want to present. And also incentivize the help you need whether these are resources or people remediating issues.

40:15 And last but not least on programmatic risk reduction. I forgot to show you this but everything you saw there is live and regularly updated. So it’s not only to the information you see but also to how often that’s updated. So this is updated daily with snapshots of your security state with deltas so you can see the evolution over time and also you can implement that PDCA you need to have that daily snapshot how safe we are cool that was an example again you should thinking about implementing those because cyber metrics that matter today they’re not only about the right message to all the systems but also with a strong feedback loop so you can act.

How did the webinar close?

41:08 Cool. There are many reasons you should think about using a solution like us or think about automating that with some help. These are some of the ones that we like on ours personally the reason why I bet my career in this company. But now I’m open for specific questions you might have. So let me see if there are any in the chat room. All right. Doesn’t seem like we have any quiet audience folks. Or maybe I’m not pulling the question board. Okay. If you have any questions, of course, we’re always available to answer those to you. But there’s one couple of things I want to tell you before we can leave this webinar.

42:11 Also, of course, this week is launch week at Axonius. And guess what? I didn’t show you anything AI on purpose to how you can use things because we launched two things that are amazing. The Axonius MCP and also the Axonius AI agent. And all these things that I showed you, you can actually prompt your MCP and get those answers that you want, whether those are KPIs, KRIs, and KCIs. And with all of that, guys, that’s it. We completed our webinar. You can get all the resources in the in the meeting room. Here we have a resources tab. The slides, I kid you not, I really love the way they frame stuff. So, have a look at those. And if you have any questions again, I’m stick around a little longer. Thank you.