The Cost of a Data Breach 2026, and what we can learn from the Hugging Face hack Transcript, AI Summary & Key Points

00:00 Happy Cost of a Data Breach Day to all who celebrate. Panelists, What's your one-line takeaway from this year's report? Jeff, we'll start with you. I would say it's that we are still taking too long to identify and too long to contain. It's taking about two-thirds of a year. We still are seeing problems coming down to basic hygiene like access controls and privilege escalation.

00:22 Unsurprised. Hello, and welcome to Security Intelligence, IBM's weekly cybersecurity podcast, where our expert panelists turn the biggest industry news stories into practical takeaways you can use. I'm your host, Matt Kosinski. And joining me this week we have an all-star lineup. It's Suja Viswesan, vice president, Security Products, IBM. We've got Jeff Crume, distinguished engineer, IBM, and we've got Dave McGinnis, VP senior partner, global cyber threat management with IBM Consulting.

00:54 We're going to be chatting about the aftermath of the Hugging Face hack and the Open Secure AI Alliance that sprung up in its wake. But first, we assembled this all-star team for a particular reason, because we're here to talk Cost of a Data Breach 2026. This is IBM's annual report on the causes of, prices for and solutions to data breaches. And it's out today.

01:19 Now the headline number is $4.99 million. That's how much the average breach costs. That's a 12% increase from last year. So we're going to dig a little bit into why that's happening and what to do about it. And Suja, I'll start with you, because you mentioned up top one of the kind of key themes of this year's report, which is this kind of AI gap. Right.

01:40 That's the subtitle for the report. It's called the "AI Tipping Point." I'd love to hear you talk a little bit more about that angle. There are two parts to it, right? One thing on the one side, we see that as companies that use AI for securing their enterprise are seeing about $1.93 million cost savings. I think Jeff was just mentioning how we are still not catching up because the bad guys are already using it.

02:03 So what are we doing? So it's very, very important that we start using it to our advantage. And, and be very cautious about it. And the basic hygiene does matter when it comes to zero-day vulnerabilities. It is like we have talked about in the past about COVID. You still have to wash your hands and then not touch your face, eyes, your mouth, all those things.

02:24 We still have to have the access controls, privilege escalation and those things are extremely important in today's AI world and using it. And we see data supporting that. Absolutely. Yeah, I think, you know, the figure is it's 92% of organizations that experienced an AI-related breach lacked proper AI access controls. Right. That's that's your point right there, Suja, about how this this basic hygiene stuff, it's always important, but it's even more important right now as we see these, these systems becoming a target.

02:51 And you also mentioned, Suja, you know, there's a, the attackers are kind of using this stuff. Maybe we're not using it as fast as them. And I'm specifically thinking of another interesting data point here, which is that, they found that only 18% of organizations said they were using these tools for vulnerability hunting, vulnerability management. Right.

03:10 Which is kind of surprising to me, because a lot of what we hear about these frontier models is that they're great at vulnerability hunting, and yet we're not using them a lot. Dave, any thoughts on why we're kind of lagging in deploying these things for vulnerability management purposes? Think about what they find. They find complicated zero days embedded in my own code.

03:29 I have to fix that. I can't rely on a third-party vendor. I can go get somebody to come help me fix it. Right. But at the at the end of the day, right, like that could be exceedingly disruptive to an organization, right? And sure, we can say if I didn't know about it, I can't be liable. But but I think just the straight up costs of, of knowing about it has, has a lot of folks dragging their feet.

03:55 I do believe that we have some topics coming up, a little bit later that may unstick some feet. But yeah, I think I think I think that's when I talk to clients and I, we talk about like, hey, would you like us to come do these sorts of things? Right. The story is: And help me find more bad things to go take care of? The story's: I got to go faster. Right.

04:16 You know, and I think that's kind of Jeff's point. And, you know, like, that's we have to find a way to safely use AI to help us, you know, as as defenders. So, you know, the challenge I think is, is rightly focused on I need to get faster, I need to move at machine speed versus please don't add 10,000 really complicated, super high, super critical vulnerabilities to my plate.

04:40 I can't handle the ones I have. That's a really good point. And I hadn't considered. Right. You know, the data breach, the Cost of a Data Breach report also found that like over 50% of organizations are using these models for like threat hunting. Right? Like they're using them to respond to attacks, resolve them. And and I get now when you put in that context, why maybe the move to adopt them for the preventive measures might be a little bit slower.

05:02 It's like you said, I got an I'm trying to keep up with the attacks that are coming. And you want me to add even more to my plate? You do need a real plan for how you're going to tackle that. You can't just throw a model at it and say, here you go. Jeff, Let's bring you in here. And I specifically wanted to ask you to elaborate on, you know, you mentioned up top we're still moving too slow.

05:18 Can you talk to me a little bit about what you're thinking there? What are you seeing? Yeah. So first of all, I. What I heard Suja say is we need to wash our hands more. And Dave says we have sticky feet, so I'm. This is, these are my takeaways in this. Yeah. I recorded a video for the IBM Technology Channel. There's about a 10 to 15 minute summary of this report.

05:39 So I'll encourage people to go take a look at that. But but yes, I think I think there's the speed. And this is a statistic that I keep looking at every year when the report comes out, is with what is the mean time to identify and mean time to contain. And I keep hoping those numbers will shrink and they generally don't. We we saw, a little bit of a shrink last year, and I don't think it was statistically significant.

06:07 And I don't think the, the gain or the, the increase that we saw this year was statistically significant. I think it's about two- thirds of a year has been the average for, like I said, a decade. So despite all our best efforts, and there have been a lot of great efforts, and we're seeing, like you said, using AI by the good guys to improve, identification and these kind of problems.

06:32 It's it's still just we're running in place. We're not getting ahead. And, of course, this is something you never get completely ahead. It's never job done with this. I think another interesting number out of this is, you know, we often quote the, the worldwide number, which is on the order of $5 million. But if you're a large U.S. company and you say, I, we can deal with that, you know, we got that.

06:57 We can shake the the cushions on the couch and find that money and, well, it's it's more than twice that in the U.S. It's over $11 million now. $11.5 to be precise. Yeah, yeah, yeah. You you need to have a really big couch if that's going to be the case. So there's a lot here. But the bad guys are definitely going to be using this. And that means the good guys are going to have to as well.

07:21 And we see some of it, I think not enough people are are using it yet for identifying vulnerabilities, because the frontier frontier models that are really good at doing that have really just gotten good at that lately, but they're not going to get worse at doing that. So that dynamic is definitely changing, and hopefully we'll see more people using it.

07:44 The thing I can guarantee you that doesn't show up in the Cost of a Data Breach is the bad guys will definitely be increasing their use of AI. So that much I know. I do want to add one thing. One thing that was more refreshing for me is that 85% of the organizations shared that they are going to be increasing their security spending in response to the frontier AI models.

08:07 So some good thing did come out of this, I would say, because this is frontier AI is reshaping security priorities, how we are looking at how we are increasing it. So I do believe that is much more, nice, heartwarming for me to see that. Okay, we are waking up. We every and 85% of the enterprises thinking about investing on this and making sure that their businesses are safe.

08:31 Yeah. Suja, that's a great segue into kind of the next thing I want to talk with you folks about is, you know, we've covered so far some of the, shall we say, more dispiriting numbers. Right? Some of the things that point to some of the issues. But it's not all doom and gloom, right. There is some positive stuff here, not just that that that, you know, people are responding to front, frontier AI and reshaping how they approach security, but also some kind of concrete steps folks can take.

08:54 And so to kind of close out our discussion here today on the Cost of Data Breach, I just wanted to get your folks' ideas, thoughts on what's the next step for organizations who are looking at this. They're looking at this kind of AI arms race they're in, and they're thinking, what do I do to improve my security posture? Dave, I'll start with you. What kind of next steps do you think organizations should be looking at here?

09:13 Let's keep the right mindset. There's no no need to freak out. In fact, we know how to solve all of these problems, right? Like AI is not an alien technology that can just magically come get you, right? Like it's it's it's not, that's not what's happening here. Right? So, you know, I mean, we can take some, some of the better, the better, how about the not so great numbers and flip them around, right?

09:35 Like, we've known how to encrypt data at rest for a while now, yet it's very clear in the numbers that, you know, we've got we've got people who are, not encrypting that data and it's PII and poof, I'll give everybody a hint. It's the number one on the list. It's it's healthcare again. Right. So the second thing is, just kind of be levelheaded and set expectations, is you're deploying AI.

10:05 That's that's great. You should probably go ask some questions, right? Not in a mean way. Right? Like, you know, hey, I'm here to help, you know, not the Department of No. We're the department of we would like to do this, but we'd like to do it safely. Right? So, I mean, there's a ton in the report about good what good AI governance could and should be, right.

10:26 And none of it's going to come as like, oh, I have to learn another language. No you don't. Right. It's it's the same sorts of things that we've been doing over and over and over. We just need to do them all faster. I like the way you put that, because it really highlights what Suja was saying earlier, which is that, like this basic hygiene stuff just becomes more important, right?

10:43 It's not, as you said, I love it, Dave. It's not an alien technology. We know how to solve these problems. It's just a question of are we doing it faster or are we doing it on the scale we need to for the kind of post-AI world? Jeff, how about you? What are you thinking in terms of next steps for organizations here? As you said, Matt, there there is some good news in the report.

11:00 For instance, organizations that had an extensive use of AI and automation saved $2 million on average on a data breach. They also saved 65 days in terms of how long it took for them to recover. So we have a general idea of what makes a difference. And if you go back and dig into the details a little more, the number one, cause of a data breach, both in terms of cost and in terms of frequency, was phishing.

11:31 Now, that's, the bad news is it was phishing last year and I think it was phishing the year before. So you know, we're we're not making the progress we should. But here if you want the good news, we know how to solve this phishing problem for the most part. I mean, there's never a complete solution to any security issue, but as complete a solution as there could be.

11:50 It's called passkeys and it's a ten-year-old technology, and we've been selling it. We're using it internally. It's out there. I'm starting to see more and more, even retail customers starting to use this and deploy it. And it's a passkey implementation that's done well is essentially phishing resistant, if not intolerant to all of that kind of threat.

12:19 So, you know, if we really want to make a difference, go after the number one item. And here's a solution to the number one item. So it's laid out there for us. It's not like we have to sit back. And this is a mystery. Yeah. If there's one change that I've made personally since starting this podcast, it was switching over to passkeys everywhere I could because that is such a simple thing you do, and it really does eliminate a ton of the biggest weak points in your own kind of personal security posture, let alone

12:42 organizational. Suja, how about you? What are your thoughts in terms of next steps you'd give organizations kind of walking away from this report? Continuing what Jeff was saying, 92% lack proper controls for identity. So identity security is underfunded. So it's important to shift identity security to continuous runtime verification. With the agents, that is of paramount importance.

13:07 That's what we have been talking to clients. So that's number one. The second one, prepare for the post-quantum threat. Because as Dave was talking about the encryption, you have to be looking at your cryptography as gaps. As you are looking at it, make sure you are ready for the post-quantum world as well. Absolutely. And I'm glad you brought up the quantum stuff because we recorded an episode, you and I, and Mark Hughes a few weeks back about that.

13:29 I want to tell the listeners, you know, go check that out if you haven't yet, because Suja and Mark really break down all of this stuff in way more detail than we could here today. All right, folks, I got to move us along to our next story today. But listeners, please do head to the show notes for a link to the report. Give it a read. There is so much in there, way more than we can cover right here, right now.

13:49 But read through it and then hit us up in the YouTube comments. Let me know what you're thinking about and what questions you have. What are you going to do now in response to the Cost of Data Breach report? I do read, I do respond, and I'd love to hear from you. But our next story here today, folks, this is the Hugging Face hack. So earlier this month, as I'm sure everybody's heard by now, Hugging Face was hacked by an autonomous AI agent.

14:14 And it turns out that agent was the work of a couple of OpenAI models who had breached their sandbox. So OpenAI says that they were testing the exploit capabilities of GPT 5.6 Sol, which is its most recent cyber security-focused model, and another unnamed unreleased model, when these models, in an attempt to solve the ExploitGym benchmark, found a zero-day vulnerability in a third-party package registry cache.

14:40 From there, the models chained together a series of vulnerabilities to break out of their sandbox and then break into Hugging Face's infrastructure all in search of an answer key for this, benchmark that they were dealing with. It's a lot of work just to cheat on a test. And folks have a lot of questions about this, obviously, as they would. And my first question is, how much should I panic?

15:01 And, Dave, I'm going to ask you first, how big a deal is this? AI breaking its containment and getting out there. What are you thinking here? Can I go with unsurprised again? I mean, so we're at, what, April, right? When Mythos and those sorts of things start to get the news. We had the 5.5 and whatnot from OpenAI. And I think, audiences very much like, or groups just like the four of us.

15:26 Right. All said like, oh, it's only a matter of time until either this exact scenario played out where it where, you know, a model that we're supposed to trust, right? Or the scarier version of it is one of the open-source or maybe not so friendly versions thereof, does it? Right. So, you know, we kind of felt good with what Anthropic and OpenAI and had done with, with, with the participations in early access and locking it down from public release and things like that.

15:57 Which is great. You know, and all that. Definitely the right, great, great thing to do. The other models are going to catch up and they're going to do the same thing. Right? So I mean, unsurprised is. I'm not trying to be flippant. It's just this is this is this is almost like verbatim what we said it would do. The only difference is which scenario started it.

16:21 Oh, they were testing a model. Okay. And they wanted to see how good it was at hacking. And it hacked something. Well, there's a surprise, right? I mean, so they're exceedingly good at finding zero days. It found a zero day. Right. Really good at attack path chaining. Okay. Right. Like like, I mean, there's there's nothing here that that wasn't something that we were all saying in April, as kind of frontier models became much more commonplace.

16:48 So, I mean, I think it's, it's just one of those things where, I just I don't think it's getting enough press. Right? Like Mythos itself got a ton of stuff like, and we didn't have to be in security land to see it. It was on the pages of your financial, you know, I was going to say magazine, but those don't exist anymore. So, right, your favorite, your favorite news network or whatever it may be, like it, like this, this existential threat from AI.

17:17 And it's going to take over. Well, well, this is what we were saying. It was going to do. And now it's done it. And it's I'm just really surprised that more people aren't like going, okay, you've had four months, three months, right? And you haven't solved this problem yet, you know? So, maybe it's coming. Maybe they're just a little behind on the news cycle.

17:37 There's something else. I don't know. So. But yeah, unsurprised for me. I do I do appreciate though, before handing it off because I know, I know that Jeff and Suja are dying to jump in. Right. Because it's such a, such a it's such a great, it's such a great thing. But I do appreciate how transparent, that OpenAI seems to have been and Hugging Face seem to have been.

18:03 They've got the joint press releases, the article that, that OpenAI put out last week, was pretty darn transparent. I mean, like, hey, this is exactly what it did. And you, you just traced through it, Matt. So I think it's, I will, I will. That's what we're supposed to do, right? We're supposed to take it and learn from it and do, not make the same mistake twice, so I will I will give props where props are due.

18:26 And there's a couple things that I want to kind of underline there, Dave, that I really like that you said. The first is, you know, a lot of coverage of this is kind of—the coverage that does exist—has referred to it as kind of like an "unprecedented" hack. And in many ways, it's like you said, it's the most precedented thing in the world, right? Like everybody was saying, this is what it's going to do.

18:44 And as you yourself point out, we we, we rolled out these powerful models and we said they're really good at finding zero days and they're really good at hacking. And then it finds zero days and hacks and it's like, well, there you go. That's what it was going to do. And the second thing you point out is the, you know, the proprietary models that are out there, they they've tried to put guardrails around them to prevent sort of misuse.

19:02 But those guardrails, first of all, they can't prevent the AI from doing things it's going to do on its own. But they also have some slight drawbacks here. Right. And that's another big part of this story, is that Hugging Face, when they realized this attack was happening, their first response was to try to use one of the frontier models. They don't say which one, but they tried to use it to kind of, you know, respond to the attack.

19:22 And they couldn't. They kept running into the guardrails, and so they had to switch over instead to use GLM-5.2, which is an open-source model. And that worked for them. Right. And it did the trick for them. And this incident has made a lot of people really pay more attention to that open-source angle when it comes to AI security. And specifically, it was one of the inspirations behind the founding of the Open Secure AI Alliance.

19:45 Right? This is a new collaboration between Nvidia, IBM, Microsoft, Cisco, Red Hat, a ton of other organizations coming together to basically promote open and collaborative AI security by developing and sharing open technologies, techniques and tools to safeguard software and agents in the age of AI. Suja, I'd love to bring you in here and talk, you know, whether about the Open Secure AI Alliance or just the importance of open source in general in AI security.

20:08 What are your thoughts here? For us, there are a few things. The biggest vulnerability in AI is not the AI, it's the blind trust. Right? It's like developers trusting some trained weights from community hubs and putting it in there with the same blind faith and somehow things, nothing bad is going to happen. It is no different than how open source was ten years back, ten years ago.

20:30 Right. As Dave pointed out, it's something you knew. Attackers know it. And we are. That is the biggest challenge that we are facing. The blind trust that hopefully doesn't happen. And that's that's something that human beings we need to know, we need to live with it. So I understand that. And when it comes to this, Open Secure Alliance that we have, with among the companies, the good people need to come together and work openly to, basically defend our good things that are happening in the world.

21:04 So I'm really happy to see that it's going to be a combination of frontier models, as well as these open models that we have that are available in order to defend ourselves and then go from there. And then when we are looking at what has happened, Jeff and Matt, we were talking about it again, there were a lot of privileged actions that were taken by the model.

21:25 It's like it's pretty much like, think of it as a red team member sitting there and doing everything that they are supposed to do and not supposed to do, and that's that's exactly what happened. So it's extremely important that these enterprises come together because fighting bad guys is a team sport. Absolutely. And especially in, like you said, an open- source environment where it takes everybody to maintain that together.

21:49 Right. And so if you have a formal alliance dedicated to that, you can maybe address some of these potential problems you see, you could see popping up with open-source AI, which I know sometimes it scares people, but there are real big benefits. And, Jeff, I want to bring you in here, to, you know, get your response to Hugging Face. And also, if you have any thoughts on Open, the open-source angle here, because you were on the episode, we did a few months ago, talking about securing open-source AI and securing

22:11 open-source in general. So I'd love to hear your take. The real question here, that lies at the heart of all of this is just exactly what is it going to take to surprise Dave? Because he's unsurprised about everything. Yeah. I'm not sure what else we have to do. That was surprising. Very surprising. Jeff. Okay. Yeah, yeah, we're going to have to throw a surprise party for him, but.

22:33 That's right. Yes. That's right. Oh, well. Now we can't, you just told him. But honestly, he kind of stole what my answer was going to be. And that is, to me, the biggest surprise about this story is that it was a big surprise to everyone because I didn't think it should be. I thought it was, it was obvious. It was only a question of when, and, you know, what were the actual targets.

22:57 And as Dave said, you know, there was there was a great deal of transparency. Thank goodness for that. What the bad guys will not do is be transparent when they do the same thing. So you know that we can't expect that same kind of privilege and behavior to happen. And we also can't expect that these capabilities, powerful that they may be, can be controlled.

23:21 That they I mean, maybe you can control your copy of it, but that you can keep other people from having them because we've already seen, you know, Mythos came out then, GPT-5 for cyber, then 5.5, then now we see models from Chinese companies that are also very powerful in this space. So it was a very naive notion to think that, okay, this thing is really powerful.

23:46 Let's just control it and make sure only a few people have it, because now already the bad guys have it. And and we've got to make sure that, that everybody's using this. I mean, I think that's the message. And that kind of comes down, the Cost of Data Breach, to tie it back around to that, is that everyone's going to need to be using these because the race is on to see who finds the zero days first, the good guys, and then they plug the holes, or the bad guys and they don't.

24:13 They exploit them. So, you know, we're going to be we're going to be continuing this. And I don't, again, nothing surprising about this if you think about what AI agents are. And I've talked about this before, it's a model using tools in a loop autonomously. Okay. So models, they can hallucinate, right? They can get get beyond their guardrails. We already know about those kind of issues that models have, using tools.

24:42 Well, do we control all the tools? We're using tools that we don't necessarily have complete control over. The protocols that we use to call the tools are new. So therefore those could have vulnerabilities in them. And then this, doing this in a loop autonomously means it can do it at machine speed, which is a whole lot faster than human speed. If we had a human red teamer doing something like this, they might realize, oh yeah, this is, this has gotten off the rails, I need to stop this.

25:11 But the AI will be, you know, halfway around the world before we are ready, before we realize exactly what's going on here. So that's that's the really cautionary tale in all of this. But there's no point in saying, okay, everybody, just stop doing this, because that's not going to happen. We're just going to have to do it better and get better at doing this at greater speed.

25:36 And hopefully speed doesn't kill in this case. I mean, we used to worry about hackers writing malicious code. Right. Now, they don't need to write code. They just upload a seven-gigabyte AI model that looks very innocent and wait for until somebody executes it in their environment. That's all. Right. So it does it does change the way we look at it. But we talked about the Nvidia IBM Coalition.

25:58 Project Lightwell, where even the zero-day vulnerabilities get fixed in the latest release. What about the previous release that companies are using? That is why these coalitions are coming together to make sure that we fix these things at every step of the way, proactively as opposed to reactively. Yeah, I like that you bring that up, Suja, because it really like, you know, like Jeff said, the answer here can't be, even just on practical grounds, that that nobody uses this.

26:26 Because everyone's going to use it. Right. So the real answer is everybody's got to be using it, including the good guys. And stuff like the the Open Secure AI Alliance is doing that, and stuff like you also mentioned Lightwell, which is, you know, the partnership between IBM and Red Hat to secure open-source vulnerabilities. And so like these kinds of efforts, these kinds of coalitions, is sort of how you get everybody using this stuff safely so that we kind of stand a chance.

26:49 Right. And I should note that the AI podcast here at IBM, Mixture of Experts, they talked about this story last week as well, of course. And one thing that one of the guests, Olivia Buzek, said there really stuck with me. She said, this is a quote from her, she says, "The guardrails we build into the models are not enough. It really comes down to what access we give the model.

27:11 Models can only do the things that you give them the tools to do." Right, which which really feels like that aligns with what Jeff was saying. Dave, I'd love to get your thoughts here, especially on that quote. You know. We. Look, we can't control everything that people do with these models, but is one thing to look at maybe thinking a little bit harder about what we do give them access to in our own systems?

27:31 Any thoughts there? I once described guardrails as parenting, right? I can explicitly tell my kids not to do particular things, and they do something that's just adjacent to it. I didn't break exactly what you told me to do. Access control has kind of been security since the dawn of time, right? Sort of a thing. So going back to Jeff's point, like there's not a whole lot new here.

27:54 You know, I think I think, like, if they don't have access to the internet, it's really hard to go hack somebody, right? So now I appreciate. Right. Just just thinking about, you know, what? What happened here, right? Like. Well, the first thing it needed to do was to break out. Well, how did it break out? Well, it popped a zero day, and that got to the internet.

28:10 Ha. Right. Like, you know. Okay, so, you know, there has to be like, there's going to have to be controls like this that would control the tooling. Like if the guard like, you know, if if the prisoners are allowed to write their own rules. Right. It's a little like. And I think that's where like, like these, these consortiums start to come into play.

28:35 Right. So like the companies that have the bigger models haven't existed all that long. Right? They don't have institutional knowledge. They don't have broad visibility across different, you know, environments and industries and geographies. I mean, those those are big deals. Right. And so I think it's it's very wise of them to to say, hey, you know what?

28:58 My models might think they know everything, but I know that they don't. Right. Like there's there's nuance, there's there's things. And that's, that's where learning happens. Right. So just kind of back to these alliances. We might have a couple too many, but, you know, not everybody can participate in everything. But the spirit is perfect. The spirit is perfect.

29:16 And I think what will fall out of that is, hey, this is what good. You know, you want to you want to you want to go to the ExploitGym, run, run some stuff? Cool. You can't touch the internet, right? Like like air-gapped. Right? Ask anyone in in an OT world. That was security forever, right? Like you know. Yeah. Yeah. It's safe. No one can touch it. You have to have the physical security.

29:41 I got a security guard. He's up most of the time. You never let us have any fun, Dave. No, no. Anyway, no, but I think that's. I think I think just it's a simple sort of, sort of a. Yes. You know, the guardrails will find a way to be better, right? The harnesses will be, will get better. Right. These are, these are things that are developing. But, you know, if, if you don't want someone to have a hammer to pound on something, don't give them the hammer.

30:04 I like this point you made, though. I hadn't really thought about this angle of the coalition approach we see popping up. But, this point that like the organizations putting out these big frontier models, they haven't been around for very long. So there is a ton of institutional knowledge that an organization like an IBM has that like, yeah, like you said, Dave, you know, your model might think it knows everything, but you're smart enough to know you don't know everything and your model doesn't, too.

30:27 And so I, I like that the coalitional approach is a way of unlocking that institutional knowledge, that expertise that you can't train into a model like, that's the kind of stuff you can only have through experience like. Dave's kids do know everything. Oh, believe me, I'm reminded often. I'm going to have to close this out here for today. But before I do, Jeff, I just wanted to.

30:48 Any last words on your end here? Just make sure you got in anything else lingering on your mind before we close out for the day. That quote you said? I think it's exactly right on. And I was thinking you could also apply that quote to employees. You know, we give them guardrails, you know, guidelines, you know, business conduct guidelines at IBM. These kind of things.

31:07 But if you don't have something that enforces those, well, then that's just good intentions. And we know what the highway, is paved with. Right, folks? That does it for this episode. I want to thank our panelists, Suja and Dave and Jeff. Thank you to the viewers and the listeners. Thank you to our producers. And a special, special thank you to producer Alexandria Iacoviello.

31:27 This is her last show with us as a producer. I'm being quite serious when I say that Security Intelligence would not have made it to 44 whole episodes here, folks, but we're going to miss her, and we can only hope the show does not completely fall apart in her absence. You can do your part to stop that from happening by subscribing to Security Intelligence wherever podcasts are found, so that you never miss an episode.

31:48 Check the show notes as well, folks, to get a copy of the Cost of Data Breach report for yourself. Again, I cannot stress enough there's so much in there way beyond what we could dig into today. It's well worth your time.