Security Confidential S9 E8 Peter Warmka

Manoj Tandon: This is your host, Manoj Tandon. Welcome to another episode of Dark Rhino Security Confidential. Today we have another fantastic guest. We’re honored to have Peter Warmka.

Peter is a keynote speaker, author, cybersecurity insider threat consultant, founder of The Counterintelligence Institute, and an honest-to-God retired senior intelligence officer with the CIA. He’s the first one we’ve had on the show that we know about. His specialization was clandestine human intelligence collection, and we’re looking forward to the insights that he’s going to share with us that relate back to all the work that we do in cyber, intelligence gathering, and the human factors that affect all of this.

Welcome to the show, Peter. Thank you for joining us.

Peter Warmka: Thank you very much for the invitation. It’s a great pleasure to be here. I’m very excited to talk about the topics I have a passion for.

Manoj Tandon: Oh, that’s great. Well, you know, we have to start with one thing. We talk a lot about careers on this show, and often it’s because there are a lot of people who are looking to transition into cyber. We don’t want anyone to think that they can’t do it. If there’s a will, there’s a way to make it happen.

We can talk about cyber careers, but one thing we don’t know anything about—if you can enlighten us—is how do you become a CIA intelligence officer? What’s the career path for that?

This is more curiosity than anything else. Do you apply for it, or how does this work?

Peter Warmka: Well, it’s an amazing, fascinating question with fascinating answers. It’s not one single answer because I don’t think I’ve ever come across an individual whose path into the CIA was identical to mine or to someone else’s.

Sometimes you might apply. You can go directly to their website and apply. Other times, there could be a spotter maybe at a university, whether in the United States or overseas, who says, “Hey, this person might be a really good candidate for recruitment into the Agency.”

The spotter will highlight this individual and the Agency will contact them. In my particular case, which is unique, I never thought or had interest in working for the federal government, let alone the CIA.

When I got my graduate degree, I started looking for positions. I got an International Management degree from Thunderbird, and I started looking for opportunities in the realm of business. I wanted to work overseas.

I started working in a bank in Miami, and my goal was to go overseas. So I started over time to apply for other positions that would hopefully take me there.

There was a position advertised in the Wall Street Journal at that time that was really fascinating. It seemed to hit all the boxes that I would check as far as an opportunity for working overseas, working in an environment having a background in economics, business, foreign language, and having lived or traveled overseas. It sounded like a perfect fit, so I sent in my resume.

I got a response back asking for my authorization to forward the resume to one of their government clients. I thought this was kind of hokey. I didn’t act upon it; I put the letter under my night table.

Later on, my wife said, “Whatever happened to this letter?”

I said, “I didn’t respond because it just seemed like a really strange, hokey thing. I don’t want to work for the government.”

Then she said, “Well, why didn’t you send it in and respond to it?”

Because I had to sign authorizing them, right? And I said, “Okay.” I sent it in, even though it was after the 20 days you had to send it.

Two weeks after that, I’m coming home from work and my wife tells me, “They called you from Washington.”

I said, “Who?”

They wouldn’t say, but they were going to call back at 6:00 PM. In those days, we had landlines, not cell phones. I get the phone call right at six o’clock, and we were on the phone for a good hour and 15 minutes.

They identified themselves from the get-go as the CIA. We had a nice chat, more one-sided, asking questions of me, I think to see whether or not there was anything in my background that could pose a problem from a security standpoint of being able to pass a background investigation and be able to get a clearance.

It was intriguing, and they asked if I would want to pursue a potential opportunity. They said they had a lot of different positions for individuals to work overseas, not just domestic. I said sure, I wanted to.

They forwarded me a packet of information, literally in a manila envelope probably about four inches thick, with everything you can imagine. I filled all that out and I sent it in, and then I was called to Washington for a series of interviews.

I really found the prospective job fascinating. Even though I never thought about working for the government and did not pursue applying for the Agency, they basically got to me in another fashion. They use those types of techniques.

I wouldn’t be able to give you the percentage of what percent actually applies directly. There are quite a few people that apply and never hear back, but that’s how I got in.

Manoj Tandon: That’s so fascinating. Tell us a little bit about how you ended up in the human intelligence business. You’re working in banking, you have a management degree, and now you’re into human intelligence gathering. Was that a choice? Like when you join the Army, you get a roster of positions that you can get into, or is it something that they assign to you and you develop?

Peter Warmka: Well, I think a lot of that is based upon their assessment of you.

They have a lot of assessment tools, and I think at the end of the day they look at a number of things which could make you attractive as a potential human collector.

We have people on the other side that are involved in analysis, collecting open source, and using intelligence to write products for the consumers of intelligence. I would not have had any interest in that.

Naturally, they never really told me I could choose this or that; based on their assessment, they found that I would be a good candidate for their human program.

It requires somebody who is interesting. You would think that we would be very extroverted, but I found a lot of people in my cadre that do this are sort of on the border between introverts and extroverts.

It’s amazing; why, I do not know, but we’re kind of on that border. I think I’m more of an introvert with tendencies at times to be extroverted and outgoing, but only if I have a specific target or mission.

I don’t like to go out in general to social events or cocktail parties. I don’t like it; it exhausts me. I’d rather stay at home reading a good book.

But if I’m told, “Hey, there’s this event, and we want you to go because there is a particular target or two there—try to meet them,” that just totally changes things.

Then I go in there for the hunt. I’m focused, I look for the target, and I find a way to begin to speak with the target and develop the onset of a relationship potentially with that target.

You just turn it on or turn it off, for me at least.

Manoj Tandon: So let me ask you one of the stupidest questions, but I know listeners are going to be wondering this:

How hard is it to convince someone to do things in our interest that may put their life in jeopardy in the nation where they’re working or are a part of?

Peter Warmka: That’s a very good question; it’s not a stupid question.

It’s not very hard.

Surprisingly, it’s not very hard. Part of it depends on the culture from which this individual is coming.

There are some places in the world where it’s very easy, and other places where it’s more difficult and takes longer. What is crucial, though, in most cases is developing the relationship with that individual that you’re trying to recruit to the point that they trust you more than anybody else.

They trust you more than their family members, more than their significant other.

If you’re not building this trust with that individual, it’s very difficult to pitch them and have them say yes—unless they’re pure mercenaries.

If what you’re giving them is, “This is what I want you to do, and this is what I can compensate you with,” that’s very rare. That’s the type of individual you have to be very careful with because if they’re mercenaries, they’re working for you one day and they’ll throw you under the bus the next for someone who is paying more.

Most of our recruitment cases, and all of mine, dealt with building that trust with an individual over time. Just as importantly, it’s getting to know them—getting to know their motivations and their vulnerabilities.

Really know what buttons to push to get them. Manipulation sounds like an ugly word, but we all manipulate people. Our children manipulate us; that’s the best example there is.

But it’s manipulation. As an intelligence officer, your goal is to recruit an individual who can provide you with or facilitate access to that intelligence that you need for your country, for its national interests.

Of course, you don’t want to put your source—the individual you’re trying to recruit—in harm’s way. You want to protect them, and we use a lot of different measures to protect them.

Unfortunately, there have been cases—I have not been involved in any, fortunately—but there have been cases when individuals have suffered consequences.

Manoj Tandon: I think that goes without saying. I forget the gentleman who wrote the book The Puzzle Palace, but he talked about this quite a bit. It just goes with the territory. If you do enough cases, a couple are going to go bad.

Peter Warmka: But we try to do everything possible to protect the individual. It’s not only to protect them, but to protect our sources and methods and the information that we’re acquiring.

Sometimes we have to train them. Some people are automatically very savvy when it comes to understanding security, what they can and cannot do, and what measures they need to put in place.

Others are coachable. Sometimes we have to teach them, “This is how we’re going to conduct our meetings or how we’re passing that information to us from them.”

We make sure it’s done in such a way that it’s very secure and they don’t have to worry. If we follow these security protocols, they really don’t have to worry that they’re going to be compromised.

We measure that risk. There are times when the risk might be too high and we say, “No, we’re not going to pursue this because it’s too risky for you.”

Or if they say they can do something, we’ll have them explain to us how they are planning to do it and walk us through that. If they’re doing something that we feel is just way too risky, we’ll say, “Stand down from that.”

Security is always in our minds, and especially for me. I’m really happy that nothing ever happened in the cases that I ran regarding jeopardizing the security of individuals who worked for me. That to me is very important, because I would feel very bad if something had happened.

Manoj Tandon: I can completely understand. I think everyone could.

So now you’re out, you’re retired, and you started the Counterintelligence Institute. It sounds like you got right back in the game. What is the mission there? What are you guys doing at the Counterintelligence Institute?

Peter Warmka: Well, you’re right. When I retired, I thought I was really retiring. That was my plan.

But then I started to hear about all these data breaches that were taking place worldwide against every type of organization. They were just growing in quantity and quality.

What really struck me, according to reports like the one IBM puts out annually, is that over 90 percent of successful data breaches start or are initiated with some form of human hacking or social engineering.

I need to change these terms. Human hacking is more understandable than social engineering. If I ask people, “Do you know what social engineering is?” they say yes, and then I start asking questions and they have no idea.

It’s amazing that people still don’t understand what social engineering is about. I call it human hacking because it’s more graphic in the sense of understanding that we’re trying to hack into the mind of an individual.

Manoj Tandon: That’s a rabbit hole I think to go down, because there are levels of human hacking.

I remember seeing when we were researching you that you did a TED Talk where you actually went through someone’s trash and pulled out everything. You got to know who their doctor was, what prescriptions they were on, and what their love interests were—everything from the trash.

People, don’t throw out your trash!

I would imagine that’s an extreme level. If you’re really targeting somebody, when IBM put out that report, they probably didn’t say what kind of hacking or what level of engineering was being done on that targeted individual.

Peter Warmka: It’s across the board. There are so many different things.

Today, the biggest form of data breaches caused by the human factor is through phishing.

Manoj Tandon: By quantity, yes.

Peter Warmka: But what I focused on, especially as a former intelligence officer, is this sort of threat. The threat actors are various: whether it’s an intelligence service, a criminal group, an industrial competitor, an activist, or a lone wolf.

At the end of the day, the really professional ones are going to take this to a much higher level than the basic phishing campaign where the same email goes out to thousands of people.

They are going by a certain percentage that’s going to take the bait—no pun intended. It works at that level.

But if we’re talking about the average data breach, in 2022, the cost for an average organization was about 4.6 million, and for a U.S. organization, it was 9.6. That’s average.

Manoj Tandon: That sounds about right. We have a presentation slide somewhere that’s right in that ballpark.

Peter Warmka: What’s even scarier is that the vast majority of data breaches are not reported. We’re just seeing the tip of the iceberg when we talk about what this is costing our economy or a nation.

Why would a company report a data breach if they don’t have to? If they legally have to, that’s one thing.

Manoj Tandon: They find ways not to do it.

Peter Warmka: So there’s a lot more problems with this than people are aware of.

This is a growing problem. I think one of the reasons it continues to grow is technical controls and technical deficiencies. But in my opinion, one aspect not given enough attention is that many of these breaches happen because of the manipulation of insiders.

You’ve probably had individuals on your show who talk about insider threats. Some companies are focusing on it, and others are still a little bit behind.

But even those that are focusing on it, I think a lot of the focus is on the internal threat that is created internally, and not looking at the threat that comes from outside the organization.

These external threat actors target the insiders and turn them into threats. They would not be threats otherwise, but because they are targeted and manipulated, they become threats.

Manoj Tandon: You’re one thousand percent correct on this. You’ve hit a bit of a nerve because it’s something we talk about a lot with our clients.

We always say that cybersecurity is not a technology problem; it’s a business problem of human behavior.

You can put all the technology in the world out there, but if I walk in through your front door and you open that door for me and even lay out the red carpet, what good are your controls? There’s umpteen examples of it.

I think you used one about a woman who liked puppies, and she got socially engineered.

Give us some—when people think of this—I’m going to ask you about some techniques and approaches. When people think of insider threats, they often think this must be an evil person who has ill intent towards the organization in their heart. That’s not necessarily the case.

Peter Warmka: You’re absolutely right.

I want to start with a quick mention: I think one of our problems in this industry is using the term “cybersecurity.” We should probably get rid of it.

It tends to make us believe that it’s something intangible that is through the networks and technology.

Manoj Tandon: What would you use?

Peter Warmka: I would use the term “data security.” Because there’s so many other ways I can get into an organization and obtain a considerable amount of information, and it will never appear as a data breach. It was never through the networks.

There are other ways to get the information than hacking into a network. Those things are typically not discussed.

Even if you look at a typical cybersecurity certification program, how much of that is devoted to social engineering? Very little. It’s given very little importance.

To me, it’s just amazing because this is such a growing problem. You hear people talking about the human factor, but within the training of our future experts in this industry, they don’t seem to be getting enough attention on this aspect.

Manoj Tandon: Let’s take a little side detour here.

Personally, I am on the advisory board in the Computer Science department at Slippery Rock University for the cybersecurity program. We’ve actually had these exact discussions about what you’re talking about:

A lot of it is on technology, but where is getting into the mind of the hacker? Where is understanding your adversary?

I think the challenge there is that as technicians and technical operators, that is not within our frame of reference.

If you were going to have our modern cybersecurity or information security professionals get into the mind of a hacker, what elements would that training involve? What do they need to learn about?

Peter Warmka: Okay, there are a lot of different motivations for a hacker.

One could be revenge. That’s one of the biggest motivating or most powerful factors in recruiting somebody to breach the security of their organization: They want to get revenge against their employer. It is very strong.

Another one is ego. They believe they’re smarter than anybody else. The fact that they’re able to outsmart anybody else in their company or organization is very strong. It fulfills the sense that “I’m very smart.”

Another one, if we’re dealing with an intelligence service, is loyalty or patriotism. Just as I and my colleagues were very patriotic—it’s at the core. We are doing this for our nation.

If you’re dealing with Chinese, Iranian, or Russian services, patriotism is also a strong motivating factor for them.

There is the joy—somewhat similar to ego—of having a challenge. Hacking is a challenge. You want to see if it can be done. Can you get in somewhere and show them?

It requires a lot of creativity. You’re going against harder targets, and it’s satisfying when you accomplish that.

There are people who get turned on by pure manipulation. They love the fact that they can manipulate vulnerable people. They don’t care about what happens to that organization or what happens to that individual they may have manipulated.

Probably across the board, one of the most important motivations is money, especially if you’re dealing with criminal organizations.

Manoj Tandon: In our experience, especially with phishing, ransomware, and extortion, it’s no different than robbing the stagecoaches of yesteryear. Money is definitely number one.

Peter Warmka: Money is usually the strongest, but it’s often combined with some of these other factors.

Even with the sources we would recruit, it was hardly ever just money. Some other aspect combined with money makes it even stronger for that individual to undertake a hack.

I think these are the different psychological factors. Identifying them for specific cases is not easy, but having an understanding of why an organization would be targeted is important.

What’s the motivation? Are they trying to get this information for their country? Are they trying to get money? Or is it someone trying to get back at a particular organization?

Manoj Tandon: When you put it this way, Peter, it expands the field of vulnerabilities exponentially.

I’m going to generalize, but most organizations, when they’re thinking about risk, are thinking about how it will affect them legally and financially. Whether that’s a disruption in their revenue stream, lost sales, or production, or they’re thinking in terms of the loss to their brand.

But they’re not assessing if they may be a conduit to something much bigger.

I want to be careful because I don’t want to inadvertently give away approaches. If I want to get to a bigger fish, they might be pretty solid. I don’t want to hurt them just now; I want to lie low, spread my tentacles, and wait for the opportune time.

Maybe I’ll sell that intrusion to somebody on the black market. That conduit may be a much smaller player that is easy to get to and not even thinking they have human vulnerabilities.

Peter Warmka: You’re absolutely right. We refer to them as hard targets versus soft targets. Those big fish are considered harder targets. Hopefully, they should be harder targets.

But soft targets are organizations that think, “Hey, why would anybody target me?” They don’t realize they can be a conduit to that larger fish because they have some relationship.

At least in 2021, 52 percent of data breaches of harder targets actually utilized the softer targets.

Manoj Tandon: That’s incredible.

Peter Warmka: Someone utilized a vendor that had a relationship with that harder organization as a conduit to get there. It’s a growing problem.

That number should give anyone pause for concern and make them think about third-party risk in very different ways.

Just think about the Panama Papers.

Manoj Tandon: I’ve heard the term, but what’s the whole story?

Peter Warmka: It’s a law firm based in Panama that had branches throughout the world. They specialized in setting up offshore companies to hide the true owners of money.

This organization was either hacked or someone from the inside provided the information. It disclosed so much information about top political figures around the world.

People don’t think of hacking a law firm, but if you do, you have access to some of the most important information their clients provide. It’s not only getting the information the firm has, but leveraging access through that law firm.

You have law firms, consultancy firms, CPA firms, and staffing companies. Think about your outsourced IT management firms. How many clients do they have access to?

Recently, Okta got hacked because they had a contractor whose laptop was compromised.

When I speak about this topic, I say no one should consider that they would not be a target. We are all potential targets and we can all potentially be utilized to get to the bigger fish.

We have to have our guard up and institute security awareness for our employees. It’s not just what can happen to us, but how we can be used to create a bigger problem.

Manoj Tandon: How do you protect against something this broad? You mentioned employee awareness, but how does an organization actually do this?

Peter Warmka: I focus on security awareness. There are two big areas where we need to educate the company and their employees.

One is the information they put out there in the public realm, both as companies and as individuals.

I show many examples of things people and companies put out there that can be leveraged by human hackers to make them more vulnerable.

Companies don’t realize how that information is being utilized. Whether they’re putting it on their website, their social media, via PR announcements, or employees posting pictures of themselves in the workplace.

Manoj Tandon: Please give us some examples.

Peter Warmka: The first phase of human hacking is collecting that open-source intelligence—OSINT.

I want to maximize my potential success and minimize compromise. It’s like kidnapping: You’re going to study that target and know their every movement to decide where to intercept them.

In the same way, we’re going to use OSINT, which is so readily available. I could be in Beijing on my laptop in a Starbucks and start collecting from your website.

I’ll give you a few examples. I can go to Glassdoor. Everyone goes there to vent. I can learn what the morale is within a company. Are employees happy, or do they feel like management sucks and the benefits are terrible?

Where people are unhappy or disgruntled, it’s much easier to target them and motivate them to take revenge.

I’ve found detailed floor plans uploaded to the internet. I’ve found employee benefit packages and IT user guides. You’d be amazed by what you find in a PDF search of a company.

Pictures of employees in the workplace with their badges, what’s on their computer screens, and the peripheral equipment in the background.

From those badges, we can actually manufacture fake ones for flash purposes.

For me, the most important aspect of OSINT is identifying potential insider candidates. In the old days, trying to find out who’s who and getting a hierarchical diagram was very difficult.

Now I can just get on the internet. What do you think is the number one place to identify insider targets?

Manoj Tandon: I would go to Instagram and Facebook and see what people are interested in.

Peter Warmka: The first stage is LinkedIn.

LinkedIn is a golden resource. You can plug in the name of the company and “People,” and that pulls up all the people who have had that company in their history.

You can whittle this down to a very manageable target list of individuals. From there, look at their academic and professional background, certifications, licenses, and even volunteer work.

Then we go to Facebook and learn about your hobbies, interests, favorite restaurants, where you travel, and who you travel with.

Go to Instagram and learn about your pattern of life. People take a picture and say, “I’m here.” I learn your routine.

That gives me an opportunity to predict where you’re going to be if I want to “bump” you.

Then I go to Twitter; I love it because I get into your mind. What are your political leanings, religious convictions, and pet peeves?

My favorites are LinkedIn, Facebook, Instagram, and Twitter. I use those four to target and assess individuals, learn their motivations and vulnerabilities, and create a personality assessment profile.

You’re younger than me. I’m a vintage. I remember the world before the internet. Back then, only a couple dozen close people really knew you.

Manoj Tandon: In my case, being a podcast host doesn’t help the situation.

Peter Warmka: After the collection phase, I develop a variety of different ploys and social engineering techniques to manipulate them.

Manoj Tandon: At that point, you would go into the phase of crafting the compromise plan?

Peter Warmka: It could be anything. It could be approaching you with a spear-phishing email on a topic you care about. We can create that message for one specific individual.

If the average breach costs millions, we can invest a little time to target specific individuals.

We can befriend you on LinkedIn or another platform. Connecting online in those platforms can carry a malicious link or attachment.

Manoj Tandon: Doesn’t that give up your identity?

Peter Warmka: Fake profiles are so easy to set up. I come across them every day. LinkedIn today has almost 800 million profiles.

If even five or ten percent are fake, think about how many that is. I’m not exaggerating; there’s a lot of fake profiles.

In my training, I run through how easy it is to set up these profiles so that they are very difficult for LinkedIn’s algorithms or even a savvy person to detect.

Manoj Tandon: What should you be looking for when you get an invitation from someone you don’t know?

Peter Warmka: This is changing. Before, I would mention the photograph.

You could do a reverse image search, and if you see that image under someone else’s name, that’s a red flag.

Or if the profile is not well-written because the person isn’t a native English speaker.

Or it’s too perfect—someone has cut and pasted the narrative from other personas.

But now, advanced AI technology changes the game. With computer-generated pictures being almost flawless, we can create a new profile where the picture can’t be discovered as belonging to someone else.

Via ChatGPT, you can create narratives that are really well done. People are already using these tools to enhance the appearance of fake profiles.

You have to be very careful with incoming requests. Don’t go by the fact that they have over 500 connections; that doesn’t mean anything.

If they have dozens of endorsements, that doesn’t mean anything either—people will endorse people they don’t know just to be helpful.

If I wanted to target you, I might put the same university you went to in my fake profile. If I put some other commonality in my profile, you’re more likely to connect with me.

When I begin a dialogue, we’ve already developed rapport. If you’re from Ohio and all of a sudden you’re in Wyoming and see a car with Ohio plates, you automatically feel a connection because you have a commonality.

People developing fake profiles do the same thing. They could be using you to gain access to a “bigger fish.”

If that target sees that you are already a mutual connection, they’re more likely to accept.

Don’t go by contacts, mutual connections, or endorsements. None of these validate whether a persona is real. We have to be much more savvy and do more due diligence.

Manoj Tandon: You can’t trust anything! LinkedIn is a platform people rely on in a professional environment.

Peter Warmka: People tend to get a little paranoid when I speak about these things. I say a little bit of paranoid skepticism is healthy.

We have to turn that into how we’re going to act. That doesn’t mean we should be suspicious of everything and refuse every connection.

We should try to judge whether this is a person we want in our network. What’s more important is what happens next.

The danger isn’t being in the network of a malicious actor; the danger is when we’re approached and asked to do something.

The arc of human hacking comes to the threshold when someone is asked to undertake an action: whether it’s providing information, clicking a link, opening an attachment, or transferring money out of an account.

Manoj Tandon: We’ve had clients who got social engineered to the point where they willingly sent funds. The actors looked at how purchase orders were structured and created a legitimate-looking person to pay.

Organizations followed through as a matter of course.

Peter Warmka: One of my favorite techniques is vishing—voice phishing.

A social engineer will utilize the telephone and pretend to be whoever they want to be. To advance their credibility, they will spoof the caller ID.

They might pretend to be in a position of authority and ask the recipient for information. The person sees the caller ID and trusts it.

They might use that to call in pretending to be the boss and instructing an employee to make an urgent transfer.

The next level, which has happened over the last few years, is deepfake voice cloning. It’s not only the caller ID; it’s also the voice.

You see the number and it’s the boss’s voice. In 2020, a bank manager transferred 35 million dollars because they believed it was the voice of the client giving instructions.

Many of these aren’t reported, of course, but this is where we’re going.

Manoj Tandon: This is incredible. There are so many more topics here—we haven’t even scratched the surface and we’re already at the hour.

We have to have you back because we didn’t even get to “Protect, Verify, and Trust.” I absolutely want to talk about your book. It’s coming out in a couple of weeks, right?

Peter Warmka: Actually, the book is out already and available. I have a copy here: Confessions of a CIA Spy: The Art of Human Hacking.

People might think it’s fiction because of the cover, but it’s not. I wrote this based on what I’ve seen working as an intelligence officer: the psychology behind how we target an organization, identifying insiders, sizing them up via motivations, and knowing how to leverage that.

I talk about this in the world of human hacking today, no matter who the threat actor is. I provide tips about how individuals and organizations can protect themselves.

When I speak to organizations, we talk about security awareness training, which we’ll talk more about when you have me back.

Manoj Tandon: We definitely want you back. We had 15 questions and only got through three.

Peter Warmka: Often, security awareness training is just a “check the box” compliance exercise. Companies do it for insurance purposes, and employees see it as watching cheesy videos.

But things are changing rapidly. One way to get employees on board is to offer this for the benefit of the employee, not just the company.

If they understand how they are vulnerable, they can protect themselves against identity theft and bank hacks. They see the value, and that carries over to the organization.

Manoj Tandon: That’s a really cool concept. If you make the individual more secure and form an individual habit, that might be the best way to form a corporate habit.

Peter Warmka: They’ll see it as benefiting the organization because they understand the value.

Manoj Tandon: That’s fantastic. That’s worth the price of admission.

Peter, you’re a little scary but fantastic. We need to get you back for a fascinating conversation.

How do people get a hold of you if they want to reach out or schedule training?

Peter Warmka: The best point of contact would be my website: counterintelligence-institute.com.

Or you can search for my name, Peter Warmka, on LinkedIn. My website also has additional information, videos, and information about my programs.

I’ll forward you a speaker one-sheet that shows all this.

Manoj Tandon: We’ll put it in the show notes for sure. It’s fascinating. I think people could really use the advice you’re offering.

The insights are eye-opening as to how large the vulnerabilities are when you look at human hacking beyond technical aspects.

Peter, thank you. It’s been a beautiful conversation.

Peter Warmka: Greetings to all your listeners. I look forward to another opportunity to speak.

If you have questions, forward them to me or the host. We’re going to be back together very shortly.

Manoj Tandon: Absolutely we are. Thank you so much. Take care, everybody.

Peter Warmka: Take care. Have a good day.