Security Confidential S15 E1 Stephen Kowski

Manoj Tandon (00:01.244)
Hello everyone, this is your host, Manoj Tandon Welcome to another episode of Dark Rhiino Security, Security Confidential. Today we have a really awesome guest with us, Mr. Stephen Kowski. Stephen has spent a lot of time in cybersecurity in various areas, which he’ll enlighten us on, but he is absolutely a cybersecurity expert. He has a robust career, over two decades in the business.

He’s been implementing comprehensive cybersecurity strategies, ensuring robust protections for organizations against all kinds of cyber threats. And his expertise is risk management, compliance, incident response, and innovative security solutions. And he’s been involved with a lot of leading tech organizations as well. Stephen, thank you so much for coming on the show. We’re honored to have you here.

J Stephen Kowski (00:56.449)
Manoj, thank you very much. I’m extremely excited. I’m gonna have to work really hard to live up to all that that you just threw out there to everybody, but extremely happy to be here. I know Dark Rhiino, I know you, you guys have, you do incredible work for your clients and so excited to chat with you.

Manoj Tandon (01:15.132)
Yeah, you know, we’re and we’re we’re really excited to have you and for our audience just full disclosure Stephen is a partner of ours in the company and we do work together but he is awesome and what he does is awesome. That’s why we work together with him. So,

J Stephen Kowski (01:36.673)
Maybe I can give you just an inch bit of that. I’m at Slashnext. I’m their field CTO. So, evangelizing the product technically, right? Helping people understand what it does, how it works, those types of things. But hopefully, I can kind of share some other things.

Manoj Tandon (01:56.284)
You know, I was going to ask you, Stephen, you know, field CTO. I’ve never heard that title, man. I mean, what? CTO, yes. Field CTO is like, you know, field marshal or it’s like brings a special character to the role.

J Stephen Kowski (02:00.161)
Yeah.

J Stephen Kowski (02:14.817)
Yeah, it’s a little bit of everything, right? On the go -to -market side, right? I’m helping a little bit of product marketing, a little bit of solution architecture with clients. They even let me go out into the real world, not just here remotely, and talk to folks at different conferences or just at Gartner last week, meeting and greeting people. So yeah, it’s…

It’s ambiguous, the role. So we’re still trying to figure it out every day. So, but yeah, it’s exciting. It gives me a lot of opportunity to help in a lot of different ways slash next and plug in, because I have a lot of different kind of weird, you know, my resume, you wouldn’t look at it and go, there’s a traditional cybersecurity guy. Like, so I think this role is kind of neat there.

Manoj Tandon (03:06.428)
Well, give us that origin story. What did you start life off as?

J Stephen Kowski (03:11.201)
well I was a huge nerdy kid. I probably won’t shock anybody. But yeah, I started out eight, nine years old building websites, AOL, way back in the day. Yup, and yeah, absolutely. And my parents kind of saw a passion there and they…

Manoj Tandon (03:16.7)
No, that’s awesome, go for it!

Manoj Tandon (03:25.276)
And you’re well.

You’ve got mail.

J Stephen Kowski (03:36.129)
There wasn’t a lot around, so I ended up at community college with 30 year olds learning at websites. And then finally they found this like almost like a computer camp, but you know what we were actually there to do. I found a couple friends that were more interested. One kid brought in from his father or something, a USB or some kind of drive. I don’t even know if we were using USB keys at that time, but with.

We called it wares at the time, crackers. And the only thing that probably still makes sense, there’s Trojan viruses that we would launch on ourselves, each other, play pranks and all that. And frankly, I never really, that was my kind of very first exposure to any of that stuff. And I just kind of kept going.

Manoj Tandon (04:15.452)
man.

J Stephen Kowski (04:27.233)
Up until, you know, at home when my father got a letter from the ISP for alleged things that they found, may or may not have found, I can neither confirm nor deny, but there’s a lot more oversight and restriction on the computer use for a time. But yeah, anyway, went to, so eventually found myself working.

Manoj Tandon (04:43.228)
You

Manoj Tandon (04:49.084)
yeah!

J Stephen Kowski (04:54.497)
Yeah, so the background, just so you’re aware educationally, is I have two electrical engineering degrees and a degree in law. I’ve never done any of those formally.

Manoj Tandon (05:02.396)
That’s an eclectic combination. Yeah, I was gonna say you don’t do any of those two things now, do you?

J Stephen Kowski (05:08.001)
No. So they are handy. They’re handy things on the technical side, very technical, very able to understand these technical concepts. But then, you know, when you talk, you know, privacy, compliance, all those fun things, right? Really, that’s some of the legal language. I was just translating a contract for somebody last week. So what does this actually mean, Steve? Can you, you know, so it’s helpful in those cases, but.

Yeah, for me, it was, I was kind of in an IT architect role. We had just migrated probably, I think it was 70 ,000 mailboxes from on -prem exchange to the cloud. And, you know, we were operationalizing that role, that architecture role and that architecture team, because the primary kind of goal of it, it, you know, kind of completed all the different strategic projects.

And then, you know, the CIO sat down with me and asked me, what do you want to do? You know, as you kind of look out and I kind of look back to, you know, a decade ago when I was getting in trouble and said, you know, I keep reading all about this cybersecurity stuff. It’s got to be something to that. And, you know, I know we have a team, so I’d love to see if there’s opportunities there. And it kind of went along from there. I got in.

My friends over at OffSec gave me some training on web app pen testing. I got into secure coding practices and then I always stayed very involved in kind of the messaging. So I, because I was doing night school with the lawyers, they, I spoke their language. So discovery, e -discovery, those kinds of things was kind of a natural fit for them. I could speak their language and also, you know, be a go -between to help them get, you know, whatever they need for various cases.

Manoj Tandon (07:04.156)
So, you know, I gotta ask a question, two questions actually. So first with the background in electrical engineering, why not go for a chip manufacturer and you could have been in Nvidia and been retired a long time ago or, you know, and in law join a prestigious law firm and handle.

these cybersecurity cases where there’s money, they’re a wash in cash. So I, or in fact, that’s three questions now that I have, or because you started in that era of AOL, why not just jump right out and start your own cybersecurity company from day one and have become someone like a trusted sec is today?

J Stephen Kowski (07:54.497)
I frankly been thinking about these questions for a long, long time. I know I wish I had the foresight to kind of see what it would become. You know, I just followed kind of what my own curiosity. That’s where I think, yes, there are bigger, better things out there potentially. The chip one is very easy. I did not study semiconductors. I studied power storage. So.

Most of my knowledge is used in social media debates with people saying they don’t, you know, ridiculing electric vehicles and they don’t really understand, you know, some of the basics. But so, I mean, at the time, you know, really and truly the only person in that game was Tesla and they were all set on the number of people applying there. If I wanted to move to Detroit, you know, I could do that, but I just.

I was born and raised in Florida. I wouldn’t survive. It wouldn’t end well for me there in Detroit. So yeah. Yeah, absolutely. I’ve never, I don’t know what shoveling snow, that experience, I don’t have that. So you may know more about it than I do up there in Ohio.

Manoj Tandon (08:55.356)
that temperature doesn’t work, huh?

Manoj Tandon (09:11.388)
But, you know, on the, since you brought up electric vehicles, you know, you probably saw that BlackBerry’s CEO, the board let him go, right? And his whole thing was taking the company in the direction of securing electric vehicles. I mean, that’s what BlackBerry is spending a lot of dollars and cents on that. Is there something to that?

J Stephen Kowski (09:41.825)
I mean, securing everything.

Manoj Tandon (09:42.396)
Was he on the right track or just your own opinion?

J Stephen Kowski (09:48.161)
I think we should very much think about the security of these vehicles, how they’re all going to be connected, right? I mean, in fact, to be honest, most of them already have been connected for a long, long time. OnStar gives the police kind of quite a capability. If you call up and you say the right things, some of these operators can even shut down the car mid -drive. So with those tools,

Manoj Tandon (10:03.548)
yeah.

J Stephen Kowski (10:17.809)
certainly need to be securing those things so that bad actors don’t get access to that. I mean, I know that there are bug bounties held by like Tesla, for example, you go to, I think Defcon a couple years ago, I was there and they were trying to, anybody that could get the horn to like start playing a random song or something like this, they’d give them the whole car. So I think there’s definitely really everything that’s going to be connected to any kind of network. And even those things that are, are air gapped, right? Need to be.

kind of evaluating that security and making sure that you’re doing your due diligence, right? Anything can be broken. Anything made by a human can be broken by a human, I guess is the old rule. So, sorry, go ahead.

Manoj Tandon (11:03.612)
No, I was gonna say, I’m so glad you said that. Because you know, that gets to, there’s a myth in our industry that you spend money on tech and you have 100 % cybersecurity. Right? And I kid you not, I mean, you look at the amount of spend that’s done on pure tech, but what you just stated is the crux of the matter, right? I mean, if it’s made by a human,

J Stephen Kowski (11:07.329)
So.

J Stephen Kowski (11:18.273)
Yeah.

Manoj Tandon (11:33.148)
a human being who is imperfect, which all human beings are, they can’t yield a perfect product. There’s gonna be no such thing as perfect security, unless you disagree, of course, but that was.

J Stephen Kowski (11:47.873)
I don’t think there’s, yeah, I don’t think there’s a, we’re always trying to get better, right? I think better is the aim. You know, there’s not a, there’s no finish line, so to speak in cybersecurity, right? It’s always something where you’re constantly trying to catch more, do more with less. But yeah, I don’t disagree at all. Like there’s no perfect cybersecurity. There’s no perfect.

implementation and even if there is hypothetically right there’s some other weak element in the chain right like even if you had perfect kind of email security right well people just move to the humans the people interacting they just moved outside of that product altogether right I can compromise people instead of the actual security tool so I mean just an example right absolutely they’re down for what two weeks right I hate you

Manoj Tandon (12:38.012)
Which is what happened at MGM.

Manoj Tandon (12:44.412)
Yeah.

J Stephen Kowski (12:45.985)
Loose it was a hundred million or something like this. I can’t remember. It’s a huge.

Manoj Tandon (12:47.932)
some, it was a nice number. I could have retired. But that’s something really critical to understand. And you and your role as a chief technology officer illustrating that hopefully people will understand it. Because we always state that cybersecurity is a business problem.

J Stephen Kowski (12:56.289)
Definitely.

J Stephen Kowski (13:08.609)
I hope so.

Manoj Tandon (13:14.14)
It’s not an IT problem. And as a business problems go, you’re really not going to solve it. You can manage it properly.

J Stephen Kowski (13:20.769)
Right. Yeah. I think there’s no, there’s no, right. It’s, it’s, it’s more about risk mitigation and business risk than it is about, like, you’re going to achieve some perfect security panacea. Right. Like the, the, the most secure thing is to close up shop and be out of business. Right. Like that’s, there you go. That’s, but I mean, that’s not really helpful to shareholders and that type of thing. Right. It’s, it’s kind of always, you know, if we want to get really, really secure.

We just stop doing things and stop interacting with people and stop, you know, like that’ll make us very secure, but it won’t make us very profitable. So you always have to kind of find that balance of like, what risk are you willing to take? What are you willing to do or not do from that perspective? So, and I mean, that goes, I mean, that’s not far from, sorry.

Manoj Tandon (14:10.748)
You know.

Manoj Tandon (14:15.324)
No, go ahead. Please finish your thought. Yeah, that’s not far from.

J Stephen Kowski (14:17.889)
no, I was just going to say that that’s not far from kind of how you look at it in a lot of different arenas, right? Because I did that legal piece, right? You know, there are places where law is quite clear and someone might still want to move forward with something, right? And even though knowing, hey, well, it could in certain areas, it could be looked at this way or it could be looked at this way.

You give a problem to a lawyer, to 50 lawyers, you’re going to get 50 different opinions, right? That’s the rule they teach. So in that case, there’s, again, a concept of business risk that when you have these differing opinions, you still have to decide, is it worth the risk? Are you going to go down that pathway? And security, there’s a lot of parallels there from a risk perspective.

Manoj Tandon (15:07.324)
So when you’re looking at product design, are you folks conducting a risk analysis as to what this will impact before you even start on the product? Or how does risk play into product design, I guess?

J Stephen Kowski (15:26.753)
Yeah, good question. I don’t think we always are, you know, looking at risk first, but it’s very, very soon, right? I don’t know. It’s the absolute first we’re thinking about what kind of what’s the market asking for? What are our customers, partners? What are they looking for in terms of outcomes? Right. And what are the challenges they’re facing? Right. That’s that’s really the number one. And then very quickly, how do we

implement those kind of solutions in a secure way, both from external threats, but also internal threats. So looking at that from that perspective, always looking at, you know, so permissions in a privacy world, right? Can we eliminate the ability to even look at permissions? Do we even need that access? Is there a way to prevent us from even seeing certain things? Right. And then that’s the best again.

To the analogy about closing up shop like if we don’t have the data hard to have a risk there So if we can do that great, otherwise you really want to try and think through the entire lifecycle of that You know in that case data, right who handles it what goes on with it? How do you obfuscate it? How do you secure it in transit at rest all those kind of fun and exciting conversations that we have But from a product design standpoint

Manoj Tandon (16:28.444)
Right.

J Stephen Kowski (16:50.689)
risk is always kind of at the forefront of our mind. I think the only thing that might supersede it at times is kind of what are our customers and partners trying to get from us.

Manoj Tandon (17:04.028)
Which then gets to the question, you know, a lot, and this is just speaking experientially or anecdotally, I should say, we’ve never done a formal survey. I don’t think there’s been one done across the industry on it, but it seems that the risk conversation a lot of times is somewhat of a nebulous thing inside these companies, because nobody understands.

what they really want to protect. I’m saying that and it’s gonna be in public now, but it really seems like, you know, when you go in and have a conversation, well, we wanna do email security. Why? Well, because we hear phishing is a big, big problem and it is a big problem, okay? But then you get back to, well, what part of your environment or what vulnerabilities,

J Stephen Kowski (17:56.033)
Yeah.

Manoj Tandon (18:03.804)
do you think you have in your organization that are exploitable from mail that make it the number one priority versus another set of vulnerabilities that what are your crown jewels that can affect your crown jewels? And I don’t know that those conversations really take place in a formal manner in a lot of customer organizations. You want them to, but they…

J Stephen Kowski (18:30.529)
It’s.

Manoj Tandon (18:32.412)
doesn’t seem like they do, because when you ask the questions, there’s a lot of blank stares.

J Stephen Kowski (18:38.657)
You see that sometimes. I’m not and and also some of the time it’s the people that are having those conversations may or may not be the people in the room with you. So right oftentimes you have folks that are maybe I don’t want to say the wrong resources but they’re resources that aren’t you know that you wouldn’t typically have that conversation with them that those conversations may happen at a higher level. I know

from a legal, the CIO, the kind of the leadership in technology spaces, they know the kind of information assets they’re trying to protect. Whether they have a good exact list, right? And where it all is located, that’s where I would challenge some of them. They may or may not have that. So they generally know they have a problem, but sometimes can’t articulate where that problem is.

Right. Or that, that concept of unknown unknowns. So that’s, you know, for us, we frequently find while we’re doing evaluations of our tool, right. It’s one of these things of, Hey, did you know the CEO is being impersonated and, and, somebody from the finance departments talking to them, that attacker, you know, like, and.

Manoj Tandon (19:59.612)
Give us some stories here. That’s, yeah.

J Stephen Kowski (20:05.377)
yeah, I mean, so this was, I have two of them I can give you. One was, I think this was one to two weeks ago where we caught and we frequently catch these where I think some of the worst ones were clearly like they’re fished. They’re just mid flight of being fished where you see them interacting with the attacker. So we had someone, CEO,

And they do this, I don’t know if you’re familiar with the term 3D phishing, but they do this quite a lot. So yeah, so it’s immersive multi -channel phishing, right? So as we put more and more and more resources into email, right, attackers recognize that and they, well, we’ll go like Cisco, Uber, right? We’re gonna get you with a text message and then try to pivot into some other system and find another way in.

Manoj Tandon (20:40.26)
I’m not, please. Yeah, what is 3D fishing?

Manoj Tandon (20:48.316)
Okay.

J Stephen Kowski (21:03.137)
Right? And so leveraging, you know, we saw a tissue from Microsoft talked about quite a lot. What was it? Blizzard storm or something like this. I can’t remember. But but them coming in through other vectors that aren’t email. When we when we talk fishing, sometimes folks just narrowly focus on the email. This happens to be an attempt at that 3D fishing was the CFO or sorry, CEO is being impersonated.

Manoj Tandon (21:13.404)
Yeah.

J Stephen Kowski (21:30.945)
I have an urgent thing, I gotta get this thing paid. Because of, I can’t remember the horrible outcome that if they didn’t get it paid. But this person started responding like, and they said, yeah, send me your cell number. I wanna go through the details and make sure that it’s really, really clear. So this is something that we captured in email. And then the email trail kinda goes dead. So luckily,

they were evaluating this, I don’t know, lucky or good, they happened to be evaluating this as this thing came in and we were able to say, hey, you may wanna ask this person, right? What phone call they got recently and if they’ve sent out this money, because pretty sure this is not legitimate, right? Like we, that’s one of the ones where they’re extremely appreciative, right? And that was a quick.

frankly, they very much wanted our tool in place quickly. And instead of just showing them what is out there, but also remediating it kind of instantly as it comes in. So as they’re trying to move, that’s a classic one where give me your WhatsApp, give me your cell phone number, give me something like that, and they want to move you outside of that controlled environment.

Manoj Tandon (22:30.588)
Yeah.

Manoj Tandon (22:47.1)
So what did the Slash Next technology do that identified this?

J Stephen Kowski (22:53.569)
Yeah, so for us, we do a couple different things in email. This one didn’t have a URL. If it did, we have kind of a really exhaustive process we do with URLs. But this one was all a malicious intent -based attack, so a BEC assistance scam specifically. We have purpose -built models for various kind of attack types that we see out in the wild. I think we’re at like 23, 25 something now.

Manoj Tandon (23:12.892)
Okay.

J Stephen Kowski (23:23.425)
In BEC, we have similar ones from SMS and all that. But we look at the language, right? We understand within an environment as it’s kind of learning, what does good communication look like, right? Understanding what are the words being used? What are the things that we’re trying to invoke, right? I’m always gonna try to get out of the user, try to excite them. wow, a thumbs up, didn’t know that that could occur here.

Manoj Tandon (23:48.028)
I didn’t see, I didn’t know that we had that functionality.

J Stephen Kowski (23:52.545)
I’m starting that off. But it’s always going to be a, I’ll try not to talk with my hands now, but it’s always going to be a user that, you know, some trusted authority, whether that’s a human being, a person, a company, whatever, right? They’re gonna come to you, it’s gonna be urgent, it’s always urgent, and there’s always a very, very simple direct ask, right? In this case, right, I need some help sorting out a payment, right, and give me your cell phone number, right? So we understand that,

from a social interaction perspective, this email address, we never see that interaction with this person. They’re coming from some other third party. Why isn’t the CEO messaging from inside his own organization? He never has emailed this person. Like even if you don’t go based on the email address, go by the display name, never emailed this person, no history of that ever. And then kind of looking at,

using generative AI to see kind of is this a generative based attack? Is this an attack that’s similar to other ones we’ve seen? Right? Wrapping all that, the natural language understanding, the social interaction, and some of the generative AI intelligence all in one kind of package, we could tell what this was and really identify it as malicious and identify it to them just in time. So.

Manoj Tandon (25:20.572)
Wow, that’s a lot of tech you guys have built into Slash Next. So are you guys primarily then looking at emails or you know what, let me rephrase it. Why don’t you just tell us what are all the things that you folks are trying to solve with Slash Next?

J Stephen Kowski (25:41.825)
What’d you say you do here? So yeah, we are a messaging security platform, multi -channel kind of messaging security platform, right? Focusing on email, browser and mobile, right? So ultimately we know that all the kind of attacks are gonna come in one of those three kind of vectors at this point, right? You’re going to get people, we hear reports of folks getting phished on LinkedIn.

Right? We just talked to a customer yesterday who their big issue was their executives being hit up on LinkedIn with these random things. Teams, right? Slack, any of those types of things, right? Ultimately, they’re trying to drive you to some sort of malicious page, drive -by download, credential harvesting page. So we have a browser extension there. The email piece protection that we just talked about, we plug into the graph API with Microsoft.

So we immediately kind of get notification as the message has been delivered and kind of seen by Microsoft. And we immediately analyze it and rip it out of the mailbox if we find it to be malicious. And then finally on the mobile side, we are doing two things really, which is mobile messaging protection and specifically smishing protection. So those.

You probably have one of these recently that UPS or FedEx notification text that you didn’t know you didn’t order a package.

Manoj Tandon (27:16.54)
Yeah, that’s so common anymore. It’s like when the real people actually send that, it doesn’t even get looked at.

J Stephen Kowski (27:23.681)
Well, I’m here to tell you it’s been delayed. And if you could just fill out this URL with some of your information, we’ll be able to get it right to you fast. So we get that. We get your CEO reaching out via text. great. Glad you’re part of the team. Can you call me here in a minute? All that kind of thing. As you said, a lot of tech. So trying to not boil the ocean here too much, but give you a decent picture. Email, browser, mobile.

really put a bubble around the user and try to protect them anywhere they could be phished. And that’s really our kind of unique focus. And really, beyond that has been efficacy, right? We’ve really gone above and beyond to be kind of hyper accurate relative to the market. And we’ve seen a lot of folks…

really understand and value that kind of capability. I’m not gonna say perfect, right? As we were talking about earlier, nothing’s perfect, but when we get independent tests done with us and others, all of those we’ve come out on top. So still more work to do, there’s always work to do, but yeah, I wonder, is there a particular area that’s curious to you?

Manoj Tandon (28:26.812)
Right.

Manoj Tandon (28:42.3)
So.

Yeah, it is. The whole AI space. So if we’re using things like ChatGPT to create phishing emails, right? How do you spot that? And, you know…

Are we getting into a bot versus bot? My robot is better than your robot or whose robot’s better than the… Because it seems like these natural NLP engines have gotten really, really good. I mean, they’re… And the ChatTPT has only been out for less than a year, right? I mean…

J Stephen Kowski (29:30.561)
I think end of very end of 2022, but like largely 2023 was people just figuring out. And I think that’s what we’re all kind of figuring out this out as we move along. but we were an early adopter, right? Cause we felt like this could help us get a higher level of accuracy and other kind of data elements that we can see, you know, how it’s less about attribution. It’s more about making a decision and seeing, you know, how does a.

Manoj Tandon (29:35.388)
Yeah.

J Stephen Kowski (29:59.617)
generative AI, if I was on the other end of this and I was trying to create this malicious phishing mail, given everything I know, how would I position it? What would I, as that LLM, create? And looking at those kind of outputs and giving ourselves a supplementary data set that otherwise we wouldn’t have. Because these kind of terms, zero hour,

You know, sometimes they’re now, we used to call sphere phishing, right? They’re outdated. Now everything’s just phishing, right? Like we can give them fancier terms, but at the end of the day, it’s coming so fast and changing so rapidly that it doesn’t, you know, it doesn’t do it justice. So these generative AI tools, I think we’re using generative AI to fight generative AI. Absolutely. You know, bot versus bot. I don’t know if it’s exactly like that.

Manoj Tandon (30:30.972)
Yeah.

J Stephen Kowski (30:55.457)
because they’re not talking to each other, but I think you’re hitting the nail on the head. We definitely have some tools now that can give us an idea of, you look at Worm GPT, Fraud GPT, our research team found these things for the first time and started to publish them. So it’s unfortunately very easy to create this stuff, so much so that when we talk to members of the government, right, the…

you know, high level leaders, they’re telling us like, we really can no longer tell just by looking at it alone. You know, what is a fish and what is it.

Manoj Tandon (31:29.052)
Yeah, which is what, is there something like if a human being that goes in and says, okay, you know what, I’m going to send Stephen a phishing email, all right? So I’m going to go on your Facebook page or Instagram or read about your history or read about some of the talks you’ve given and then really compose something that is based on things that you have said and you are likely to have done.

that’s a human being versus a chat GPT type thing. I don’t know how it composes that same message, but is there a, can you first of all spot the human one that this is BS? And if you can spot the NLP one, the natural language process generative one, what, how do you attribute it that it is NLP generated? There’s a couple of questions in there. Yeah.

J Stephen Kowski (32:23.105)
Yeah, so yeah, I’ll do my best. I’m gonna pull those apart. So I think it’s less, I really don’t, we’re not so concerned, right? Attribution’s less of a concern, right? Stopping someone from interacting with a message with a malicious intent is the concern. So, right, whether, you know, chat GPT came up with it, whether, you know, someone wrote it manually, right? It really, it’s less material.

to us than actually identifying it as malicious. But I mean, those elements we’re going to be looking at that language. We’re also going to look at you. We really have to know you as a person to some degree and the people that you interact with, what you normally say, and also what people say to you to do that, to understand and identify bad behavior and malicious intent from that. The generative AI pieces are really

right, giving us insight on, you know, I use a common example to explain it, right, which is your head’s down, you’re working on something, right, someone comes up to you and starts talking about who knows what. They ask you a question, Manoj, I need to understand more about this bill. And so, but you’re not really paying attention yet. They haven’t gotten your attention. They just blurted this out, right? So you stop what you’re doing. You look at them and go,

Manoj Tandon (33:27.388)
Okay, please.

J Stephen Kowski (33:51.521)
What are you talking about? Say that again. And inevitably when they say that again, right, they use a slightly different wording, slightly different phrasing, right? It’s not exactly what they said. And right, if you get enough, if you ask them to repeat it 30 different times in 30 different ways, you would eventually get a very, very, very clear idea of what’s going on there. And an idea of the weather and what kind of request this is, what they’re really after. And really that’s…

For us, how we utilize generative AIs, understanding how an attacker might use a worm GPT, might use a dark bird or a fraud GPT, and compose one of these things. Because you’re right, it’s super easy. But I would say the concepts utilized to fight it are not that foreign to you. You do them every day, most likely, in your personal life and professional life.

Manoj Tandon (34:48.956)
But that requires paying attention to it, right? So like when you said you have your head down and you’re working on something, the email comes in, you’re just like, okay, I’m gonna get this off my plate. I know this answer. You don’t even, you don’t go and check the header, where it originated, you know, what. You don’t do any of those things. You just, yeah, I know. Send. I’m done.

J Stephen Kowski (35:15.329)
Exactly. Yeah.

Manoj Tandon (35:16.476)
Right? So it’s that, and I don’t think it’s possible to pay that level of attention to all these emails. So you need a system out there like what you guys are doing, which is going to automate.

J Stephen Kowski (35:28.513)
I think it’s more of like, it’s also a question of what do you want your people to be doing on a day -to -day basis? Like, do you want them, you know, frankly, we’ve trained them up so well that, you know, what we hear is, I’m overwhelmed now. I get lots of submissions. People are kind of, I’ve heard it over and over from friends and family, even at their work. I’m terrified to even look at my email sometimes. I don’t know what’s going on in there. And then, you know, occasionally I click on something and now I…

Now I have some compliance officer telling me I failed something that, you know, and so it’s just easier for me to try not to interact with it at all. So like you’re creating this, it’s this weird environment in email now, where people are, you know, what do you want them to be doing? And frankly, you need tools that are going to get all this stuff out of their way so that they can just work effectively on the actual job, that they were hired to do. So.

Manoj Tandon (36:27.356)
Well, let’s go to another part of the email thing then, which is, okay, you folks yourself probably do email marketing. Most companies do some form of email marketing. Is that marketing at all any effective anymore now with tools like slash next and?

J Stephen Kowski (36:43.329)
Yeah.

Manoj Tandon (36:51.132)
and other platforms out there, are they negating all of it? Because they’re saying, you know what, this is all garbage. We don’t… I’m curious, what are you seeing with that? Does this change how we reach out to people?

J Stephen Kowski (36:59.329)
Yeah.

J Stephen Kowski (37:04.609)
I think it can for sure. I do know that there are, right? So what we get, what we see often is, you know, in some of the larger segs, you know, some of these older technologies where there’s just not a lot of levers to pull. So, you know, you get in this teeter totter of like, we make it very, very secure and then it’s so secure. It’s also throwing off a bunch of stuff that you maybe wanted to get or not secure enough. And now you’re getting, you know,

everything you expected and way more that you didn’t want. So, I mean, I think that that’s where we have tried to build. And this is something that literally release in the process of releasing now. It’s our spam and gray mail protection. So that increasing user productivity is the goal there and building specific models because it’s hard sometimes even with that, you know, is this a legit marketing email or is this actually there’s some hidden URL here that’s

As I try to unsubscribe, now I’m being pulled in deeper to the hack or the attack or whatever that is. Is it effective? I know that it’s still effective, but I do see, we see in proof of value concepts where other tools will grab our mails, will grab really anything because they’re just so aggressive that ultimately these folks don’t want to be yelled at by their senior leadership. They…

And so in some of those cases, yeah, some of this stuff is being eliminated. But what we want to do is really try to understand what is normal and what they expect to receive and what good communications look like, right? As opposed to just filtering everything else that came from an external person, right? You may have a vendor you work with a lot that you want to receive their messages and their company’s announcements. You know, Monoja.

Our email is to you, frankly. I’m hoping that you’re getting those. And those aren’t being eliminated. Is it dead? I don’t know. I don’t think so, to be honest, because I think it’s some of the older tools, you had to drop a very large kind of bomb where, frankly, you needed a scalpel. And because the technology didn’t exist for that scalpel, now you can get a lot more nuanced.

J Stephen Kowski (39:28.737)
Right. And the machine learning can be a lot more accurate, right. As opposed to a policy based kind of approach. If I see this, then do that.

Manoj Tandon (39:32.284)
And well, and you know what? It’s interesting you say that because there’s been a couple of health care providers that that we know they actually you’re exactly right. They needed a scalpel, but they just nuked everything. Right. And you have to you have to tell them that you’re sending them an email and they have to whitelist your email in order for it to even come in.

Okay, now the net result is they get very few emails, right? They’re only getting emails from their known universe, but then they’re missing out on everything that’s happening and developing out there.

J Stephen Kowski (40:02.561)
that.

J Stephen Kowski (40:21.825)
Yeah, no, I think.

Manoj Tandon (40:22.3)
in the world, right? You’re you’re you’ve isolated yourself to a point that you’re an island and you no longer know what’s going on out there. I mean.

J Stephen Kowski (40:30.209)
Right, this is the, this is that we talked about it earlier, right? They’re in the midst of kind of closing up shop there, like in some sense, right? From a business perspective, right? Communication wise, they’ve largely closed up shop, right? And they are getting a lot less risk, but they’re also, there’s a lot of opportunity they’re missing out on, you know, folks that legitimately maybe could save them money, could save them time, right? Any number of different kinds of things that they might need or might want.

Manoj Tandon (40:38.908)
Right.

J Stephen Kowski (40:59.713)
they’re not going to get exposed to. So it’s always a challenge, right? What’s the best thing for each organization? And for me, I think that if you invest in the right tools and the technology and the processes, don’t need to close yourself off to the world. It’s kind of disappointing in this day and age that we need to make those kinds of decisions, but I have to deal with the way the world is, not the way I wish it to be. So.

But I hear you.

Manoj Tandon (41:32.7)
it’s a complex topic. I mean, that bank in Hong Kong that got ripped off for 25 million with a deep fake, that just, I don’t think we’ve lit the candle on what’s gonna happen out here with fraud and with AI entering the mix and how it’s gonna evolve. I can’t imagine what’s gonna happen. I just can’t. But I think, I wish I could, cause then I’d start a company.

J Stephen Kowski (41:38.721)
Mm.

Manoj Tandon (42:01.308)
Dude, bruh.

J Stephen Kowski (42:02.049)
I think, well, I mean, yeah, on that one, as much as, as much press as that has gotten, to be honest, there’s been, you know, multiple major phishing attacks that like the technology it’s, it’s neat, it’s interesting, but frankly, the tools that attackers and threat actors have now, they’re doing really well with, like, I don’t know that they necessarily need a lot of extra tooling to have, you know, a lot of extra impact. They’re, they’re doing a pretty darn good job.

If you look at any of the FBI or Verizon reporting on it, right, it seems to unfortunately go up every single year, year over year. So, but yeah, you’re right. There’s a lot out there and changing fast, very fast.

Manoj Tandon (42:36.38)
always.

Manoj Tandon (42:45.02)
Yeah, and mobile devices, I mean, there is so much of a gap there. Like mobile is an easy vector to exploit to get in. And I think it’s one of the hardest ones to actually shut down personally. I mean, what are your thoughts on that?

J Stephen Kowski (43:03.553)
Yeah, I think that when we have this conversation because we protect mobile all the time, it’s an attacker, a threat actor, they don’t really care who bought the phone. They don’t care who’s managing the phone, whether it’s managed, whether it’s BYOD phone or any of that, right? They don’t care if you have a work profile on it or not. They don’t care if it’s segregated. They couldn’t care less about any of it. All the…

things that we sit and agonize about, you know, from a funding and from a privacy and all that. Nobody out there that’s on the other side of that, you know, conversation cares one iota. All they need, all they need to do and want to do is get a footing, right? And then pivot into other things. So for us, we do have kind of the two variants, right? For the privacy conscious folks are personal, right? Everything is processed on the device with minimal impact.

from a battery perspective and everything is processed on that client side. It doesn’t report home to us. And even some of the organizations, they have to make a choice, right? And they don’t like that. But if they install this privacy focused version, they’re going to, even they’re not gonna see it, right? So they don’t always love that. That’s why we have that business profile. This is for the environments that are managed, controlled, right? And…

can deploy them via UEM or MDMs, right? So I think in all honesty, whether or not you want to manage it, don’t want to manage it, you have the funding or not, like attackers are going after it, full stop. Like I literally see it every day. I hear it every day. And everybody has this problem looking to solve it. So, you know, you ignore it to your own peril.

Manoj Tandon (44:31.964)
Right.

J Stephen Kowski (44:55.841)
Right? Like it’s, it’s not something that’s going to get go away and it’s going to get worse over time. Cause there’s a lot of data on that thing.

Manoj Tandon (45:03.388)
it’s rich. It’s rich in accessibility. It’s rich in data. It’s just, I mean, it’s huge, right? I mean, it’s the means by which you can defeat MFA. It’s so many things that you can do if you compromise someone’s mobile device. So I have to ask you here the last question on…

J Stephen Kowski (45:09.953)
Huge.

Manoj Tandon (45:28.156)
Have you become a target personally by bad actors because you’re involved in trying to stop some of their main means of revenue?

J Stephen Kowski (45:38.049)
I would assume so. I mean, it really, I was always a target before it, right? Like, so everybody is kind of a target, whether or not they like that idea or not.

Manoj Tandon (45:46.684)
Yeah, but some people have special status.

J Stephen Kowski (45:49.441)
yeah, I don’t know if I’m that honored yet. but I, you know, I know that this goes on. I do the best I can, to, to stay aware and also to, you know, make my family aware as well, you know, about the real world threats. but yeah, I mean, I encounter huge amounts. Yeah. People send stuff to me, all the time trying to get me to react and respond. So I definitely see it.

it’s luckily, haven’t really had any major issues with any of it so far, but I mean, I don’t typically, right. The, the people that you’re really worried about, they’re the ones that aren’t typically coming after you. right. It’s, it’s kind of like, do I walk around the street and worry about a black belt ninja coming in, you know, karate kicking me in the face? Like not typically it’s, it’s pretty unlikely.

that doesn’t mean I don’t, you know, protect myself and have, you know, a plan in place. but I, I typically don’t, see these kinds of problems so much. And that’s also the benefit of, of this. When we buy, you know, and when we give this away slash next, we also, you know, if, if executives and folks need have family, they want to cover, right. I’m able to give this to my mom.

tons of attacks have been mitigated to her, right? I’m able to give this to my wife, put it on her phone, tons of SMS messages get mitigated by her. So for me, slash next has been very generous, but like we do this for all of our customers if they want an option, because right now they probably have no option, right? Delete it and hopefully it doesn’t happen again is kind of, that’s the hope. And for us,

Manoj Tandon (47:35.996)
They have none. Yeah.

J Stephen Kowski (47:44.097)
we’re giving them kind of a couple different ways to mitigate this and at least reduce some of the attacks that they’re going to see. So.

Manoj Tandon (47:52.476)
So Steven, in this last couple of minutes here, anything you wanna plug, any appearances, things, anything you wanna plug out there, let the audience know about it.

J Stephen Kowski (48:02.913)
I think that most likely we’re always running some form of webinar. Our CEO does some great ones. He just did one with the FBI a week and a half ago. So I wish we had had this a little sooner. But I think we’re gonna be getting out to some more regional events over the summer and in the fall. I would say, follow us, social media, LinkedIn. As you know, you get lots of.

interesting stuff from slash next on on that channel, but the only thing that I would plug frankly is the one thing I’m gonna throw a little bit more tech at you before I go which is our browser protection and the threat Intel feed that we offer right which is Red teams blue teams they can they can subscribe to it as well

Manoj Tandon (48:44.028)
Okay.

J Stephen Kowski (48:56.161)
This is one thing I neglected to mention. It’s the largest kind of threat intelligence database and really, really helpful for hosted trusted infrastructure. So if folks are interested in seeing that, right, get a kind of 48 hour advantage on any given URL, right? That’s something we can help with because we’re a first party provider of that intelligence as well. But yeah.

Manoj Tandon (49:02.076)
Wow.

Manoj Tandon (49:18.94)
Wow, fantastic. This has been great, Stephen. I mean, we didn’t even get through most of the questions, but that’s okay. They’ll give us a reason to connect again. And as Stephen said, you know, I’m going to shamelessly say, please like and subscribe so we can keep generating this content and having great guests like Stephen on and…

J Stephen Kowski (49:22.625)
I think that’s it for slash next right now.

Manoj Tandon (49:44.411)
keep the education rolling in cyber. But Stephen, thank you so much for being here. You were fantastic.

J Stephen Kowski (49:51.457)
Thank you very much, Manoj. Appreciate you and good luck to you and the Dark Rhiino team. Really appreciate you guys’ partnership.

Manoj Tandon (49:58.812)
Thank you.