Black October! What Is Happening to the Internet? | Hari Mulackal & Odysseas Lamtzidis

0:04 They're calling it Black October, the worst month in cybersecurity of all time. There's Armageddon on the internet. We're gonna figure out today whether it's really all that bad or not. Joining me on this stream today, we got Hari, the CEO of Cantina Security. Hari, welcome to the live stream. Yeah, thank you, David.

0:24 And joining Hari is Odysseus, CEO of Filings. Odysseus has been on the podcast before. Every time there's a security conversation, we tap in Odysseus. Odysseus, I would say good to have you back, but actually in these circumstances, maybe not. But either way, good to talk to you, my man. Yeah, thank you so much.

0:43 Okay, so I want to learn a little bit about what your guys' last two days have been like. You guys are both security experts. It's the worst week of cybersecurity, apparently, of all time. Are you guys busy? What is it like to be in the world of security right now? Hari, I'll start with you. As I'll give you an answer that you're probably not expecting, which is...

1:07 I think the public incidents have been very alarmist. People hear about all these incidents in the public. But the reality is that this has been going on for the last, I would say, 18 months. The number of incidents have been going up by a lot. Many people do not report incidents in the public. It's just that with the PHP one, with some of the healthcare ones, it's a big story.

1:29 So... Taking a step back, we started seeing that agents and alums were starting to get really good at cyber last year. So back in, I would say, February, we started seeing this change. And we started seeing both offensive and defensive actors starting to use this newfound capability to build products and also to disclose security issues.

1:57 There was an uplift in cyber ability around January where the model started getting very good, where the economics was cheap, where now you can blast it on many companies and make disclosures. We did that a lot starting this year. This year, right now, it's just a tipping point where many companies are starting to show up in news.

2:19 This is nothing new for us. The last few days, we alerted a few of our customers with the PHP incidents because we had products that would enable them to scan their service area. So nothing new to us just because we have been seeing this for the last 18 months. Nothing new to you guys, but nonetheless, something just feels different in the last week.

2:41 Maybe it's a little bit of what you said, Hari, of just the Twitter phenomenon of casting doom upon something, of inciting doom is very viral, so maybe that's what's different. Odysseus, what would you have to add to why this week feels so different than the wins previous week? I think it's the tipping point is, as Harry said, in the capabilities.

3:05 Like probably we saw last year with a lot of social engineering attacks where the deep fakes was the first like big change in capabilities. But that was like more targeted, I would say. And crypto obviously was a great target for that. And now we're actually seeing that it's actually very cheap. to like blast that on the internet and just scan everything.

3:25 So security through obscurity is like breaking down in, you know, real time right now. And that's what we're seeing. I've got this tweet from somebody who works at Anthropic, Anthropic security researcher person who says, as bad as things have gotten in the past four days, they are going to get a lot worse before they get better.

3:48 Security leaders never let a crisis go to waste. Please go to your boards and ask for help right now. Is it going to get worse? Is this just kind of just like the first time this has emerged in the public zeitgeist? And actually, this is going to escalate. So next week or next month will be worse than October.

4:05 Hari, what do you think? Oh, absolutely. So... With a lot of the AI capabilities, it's like there is this exponential where either the capability or the cost keeps going down. So every time you have a, the capabilities are already there. It's now the economics. How do we do this at a scale where it's so cheap to hunt on every website?

4:31 This is starting to inflate. The same thing that we could do in January, it's now 15 times cheaper, like 15x cheaper. That's our internal efficiency gain. And this will continue to get 10x cheaper in every 6 to 12 months. So... The way to think about it is that the scope has gone up where hacking in the past was a bespoke skill.

4:55 So to hack a company, you needed to have a lot of talented people that would then spend weeks, months, maybe years trying to hack a company. And then you need to have profit at the end to hack it. So it was never scalable. Hacking has now become scalable where you can build a factory where you can give it a website.

5:15 You can give it bankless.com and we'll go hack it. You don't even have to think about cost because it will cost like $10 as opposed to like two weeks of human time where now you need to think about ROI. What do I get from hacking bankers? So right now, the unfortunate reality is that you can build a factory that will like churn in exploits and no humans need it.

5:40 And the economics is falling to zero. Yeah. And I think this is also why now the attention is turning away from, you know, crypto and like just in, you know, broad web too, because before in crypto, it was a very clear target, right? If you had something, it was a very clear money to be made at the end, right?

6:01 So the economics made sense there. And in web too, it was like more difficult, right? It was not clear how you would monetize. But now that it's actually so cheap, right? You don't need to answer that question. You just do it and you'll figure it out at the end. Well, you guys aren't really reassuring me in any particular way.

6:19 This kind of sounds bad. Maybe we can start trying to talk about the scope of the actual harm being caused here. Because it's a little bit confounded. There are a ton of vulnerabilities being found and disclosed. That's not inherently bad. There are some exploits actually happening. That's bad, but...

6:39 They're not exploits like crypto, where if a crypto exploit happens, people lose money. So that's also not necessarily what's happening. It's kind of muddy as to what's going on. How do we understand or measure the actual harm that's happening right now? I mean, at the end of the day, what is the value of data?

7:00 What is the value of reputation? What is the value of money? And... all of them are getting targeted today. So if you have valuable data in an application you're using, like maybe your dentist, maybe your dentist has information about you that you don't want to be on the internet, or maybe the dentist doesn't want to leak their customer data because of liability.

7:20 So what's happening is it has become so cheap to hack these companies that people would just do it. And, the way to make money is often by threatening these companies. Hey, I will breach your database if you don't pay me X, Y, Z money. And that's a very, that has become a scalable, uh, cyber crime motion today.

7:41 So in the past, uh, You have to think about cybercrime as a business. These criminals need to make money, and these criminals need to make money. You need to have scalable unit economics. So in the past, while crypto was a big target because the money at the end was very high, like North Korea funded their nuclear missile program with crypto hacks because there was a lot of money to be made.

8:04 But if you hack a dentist, there's not much money to be made. And the resources that you need to hack a doctor or a healthcare company was so high that the ROI wasn't there. And the highest ROI in the past was phishing. So you find a way to get past your email filter, your message filter, and you just blast millions of emails, millions of messages, and...

8:28 Out of the million people, maybe 1,000 will click at it, and maybe out of the 1,000, like 100 of them would give you data that is now worth threatening them. Now the same threat actors are now shifting to hacking, or they are using zero days. They find zero days that are out there that are not getting fixed by companies to just scalably hack, and now they have data.

8:51 And with that data, they can chat on the companies. I will breach this if you don't pay me XYZ money. We've seen that across the board. That is going to keep increasing. So there is economic value to it. And even at a, you know, bigger political level, you know, if you... Just think about if the database of like JP Morgan is getting leaked.

9:11 I'm not saying it will. Just think about it at a political level. That is going to be a political catastrophe. Like if the entire, like some of the largest banks in the world have their records leaked, you know, you can think about the second and third order effects. Like that would change the politics of that country because, you know, that is exposing people's finances.

9:34 So, yeah. And there is true economic damage to these incidents. Yeah. And I think a very easy to grog example is how, um, leaking, uh, databases like that of, you know, Ledger back, I think in 2021, um, or other databases were actually linked to, you know, the rent attacks, right. Where you identify who are the high net worth individuals and then you go after them, uh, personally.

10:06 Right. And I think That's like part of why it's hard to quantify because the second and third order effects is not always obvious, the connection. That they found this data and then they connected with other data and then they were able to perform a personal attack to actually trade millions, either in crypto or some other valuables.

10:25 So the main thing I'm hearing from you guys is that data is going to be exposed. And honestly, if you asked me about, like, if you asked me before all of this, if you asked if my personal data was out and available on the internet, I would probably say, yeah, it probably is, like statistically speaking.

10:41 So I'm not, me as an individual, I don't know if I'm more worried about even more of my personal data being on the internet because it was already like that. I take the point that, like, JP Morgan doesn't want its data out there and it's a company that it needs to protect. So its concern is to protect its data.

10:57 And then, you know, most companies' concerns are about its data. But me personally, the individual, I'm a hair less. Does that resonate with you guys? How would you respond to that, Hari? I mean, that's a great question. I've heard this objection from other people. But I do think like there are multiple things happening at the same time that this time it's truly different.

11:20 And, you know, We build an AI product. We build an AI security product. And one of our AI engineers, he did this demo to somebody in the office, which is, he asked this JCPT, tell me everything it knows about him. This person's JCPT. And then it listed out information about his compensation, who their romantic partners are, a lot of deeply personal information about this individual that when he read that, he was shocked how much his AI agent knew about him.

11:57 So I think this is truly different where people are giving up a lot of data to the new products and products. agents will then use all this data together to do malicious things for you. Like, you know, if an agent had access today with all of your data, like... it can now do things that it couldn't do in the past.

12:19 You know, in the past, somebody still had to, like, look at all this leaked data, understand, like, how can they, like, you know, do something to David with that data? And that was too expensive. Now it's, like, prompts. Like, hey, here's David's data. I want you to write this precise email that will make him, you know, do something that, you know, he otherwise wouldn't do.

12:40 And you can now scale that to millions of people. Hmm. Yeah, like I think Yeah, like a very, I think we've seen recently is the elder scams, right? When they call elder people and they say that, you know, your son or a relative is like in police custody or, you know, they owe money in taxes or whatever.

13:05 And then they convince them to give them money. That's something we're seeing, right? So now imagine that they can do that in a way that is 100% believable because they have all this information about you. And I can convince millions of people, billions of people who are not aware of what AI is capable.

13:25 So they're more gullible. And I can convince them to, you know, exfiltrate money from them, right? At a scale that is industrial for the first time. I've been trading crypto for almost a decade, and I've used so many different wallets, exchanges, aggregators, or front ends, and I'm basically always looking for the same thing, just one interface with a deep liquidity across a bunch of chains and assets where I can access markets like perps, earn yield, trade confidentially, and still control all of my funds.

13:51 And I've never really found it. And I'm just always switching wallets, juggling gas fees, or getting eaten by slippage. But near.com feels fundamentally different to me. I can do anything I want from any chain and keep all of my activity confidential. Crypto, tokenized assets, perps, payments. I can even earn yield confidentially.

14:09 One account, over 30 chains, confidential by default. It's the way that crypto ought to work. And it's powered by Near, which has moved over $30 billion cross-chain, uses post-quantum signatures, And that's run over five years on mainnet with zero downtime. Near.com is the best way to be on-chain and be in control.

14:26 Get 20% of your trading fees back on near.com using the bankless link in the show notes, not investment advice. Dollar Stable Coins taught Latin America how to store value on-chain. RIPIO is taking that same idea and bringing it to the currencies people actually use every day. With wrapped fiat, RIPIO is putting more than a decade of experience powering crypto infrastructure for leading companies across Latin America behind a suite of six local currency stablecoins covering Argentina, Brazil, Mexico, Colombia, Chile, and Peru.

14:52 Each is pegged one-to-one to its local currency and fully backed by reserves held in regulated financial institutions with independent attestations published for each token. But wrapped fiat is not just designed to sit there, it's built to move. The suite is live across 10 EVM chains with liquidity and integrations already spanning platforms like Morpho, Uniswap, and Chainlink.

15:10 Users can move between local payment rails like Pix and Spey and matching wrapped fiat one-to-one in real time with zero fees on both on-ramps and off-ramps and no FX conversion. Local rails in, on-chain in the middle. And for builders, Ripio offers APIs, webhooks, widgets, and a sandbox just from day one.

15:27 Start building with wrapped fiat today at platform.rippio.com. So it sounds like the default scenario moving forward is that everyone's records, individual records, my health records, I don't even know where my health records are, who has them, but they're going to be made, exploited and made accessible to the internet.

15:48 And that's kind of the default for just data broadly. It sounds like, The default path, the assumption that in a short order here, most data will be made exploitable, vulnerable, and accessible by like open weight models because the internet has been built on sticks and duct tape. And now we have AI breaking all those things down.

16:12 And so data is now just free on the internet. Is that kind of the default future that we have? That is the worst case. That's the worst case. Like, look, I don't want that to happen. I want you to do it to be only with the people that you want to have access to. Okay, so we're not there yet. So the Armageddon on the internet has not created that environment.

16:33 That is the trajectory that we are going towards if we do nothing. Correct. Okay. Okay. Okay. How much time do we have before that happens? Okay. So there is this fun way to think about the time. It's often called like zero day clock. So how long do you have until you need to fix zero days in your environments?

16:59 And in the past, it would be like months, years. So you had time to fix these issues. These days, a zero day clock is negative days. So that's what it's done. The clock has hit zero and you are on borrowed time in this present moment. Correct. So if you are a company that has customer data, repetition worth protecting, money worth protecting, you need to act today.

17:26 You need to have acted like six months ago, but the best time to act is today. So you are living on borrowed time. Otherwise, it's almost irresponsible. You have a duty to your customers to protect that data. there was a tweet from Nikita Beer that I like that says that even your company your engineers are mentioned as IT department you don't have to worry about security incidents because they have already happened I'm looking at a chart here from a 0x Osprey can you guys just kind of walk me through what we're looking here on this chart and why it's significant today So this is a great job to showcase what we're dealing with.

18:16 So if you have a software, there is a way to disclose to the public that, hey, there is a vulnerability in the system. So anyone using the software or asset dependency, they can fix it. So these are called CVEs, so, like, vulnerabilities in your system that people are disclosing, and oftentimes the next step is, oh, upgrade your packages because, you know, we have the CVE in the system in this version.

18:41 This is a chart of, like, the cumulative, well, the CVEs that are getting published, like, I think, every day and there are databases that publish this oftentimes it's very common in open source projects for closed source projects it's a lot limited they don't necessarily always talk about it but companies like apple will always assign a cve for important fixes in their software so this is a chart and as you can see it's becoming exponential lately you can see that there was there is clearly like a delay in disclosures.

19:22 So like a lot of the changes we're seeing Those were initiatives that started like six months ago that are now showing up in the public. But what's really happening is that the cost is going down. So security has become an economics problem. Like you can convert a lot of cyber risk into what is the cost of doing this hacking?

19:45 And that is going to zero, which means like number of hacks are going to infinity. Yeah. And also, I think we're, uh, because of the speed, uh, of like, how is this identify vulnerabilities in the past? You would say, okay, you know, we found something and then you would give time for people to upgrade and then you would disclose it.

20:05 Uh, but now the moment you say something exists and somebody can just point their agent to, you know, PHP and say, find me the vulnerability. And now they can, right? So, um, yeah. you don't have the space to allow people to upgrade. The moment that people are informed that something is possible, they can immediately go after it.

20:30 Yeah, yeah. So for the listeners who are listening to this in the RSS feed, we're just basically looking at a chart that is mostly flat, and then it slowly slopes upward, and then it goes vertical. And I think what Odysseus and Hari are saying is like, it's also vertical, but it's vertical but lagging.

20:46 So today it's even more vertical than the vertical that we see on the screen. Uh, the only, humans can't keep up with this. The only way to combat this is with AI. And so our AI defense has to go, it has to be faster than AI offense. Uh, so the defenders have to be moving as quickly as, or faster than the attackers.

21:07 Is that feasible? Can we, can we do that? Where is the balance of power between offense and defense these days? That's a great question. And unfortunately, for the next, I would say, 12 to 18 months, it's going to be largely dominated by offense. So the best way to understand what you need to do is to attack yourself.

21:31 And so in a safe way, attack yourself. from the external surface as if like an attacker would attack yourself. And now we have a product that does that. So we have a product called Apex. It's an offensive security agent. It can take in your websites. It can take in your source code. It can take in any information that you have and it will simulate an attack.

21:53 So it will try to attack you, show you like all the ways it finds to breach you. And the best thing you can do is fix all the ways that it finds to breach you. So that's going to be a lot of the work next. One is attack yourself. fix the things that it finds. But I think there is a silver lining here where you can now, you know, what's happening with software engineering is software engineering is becoming almost like a, you know, industrial where people talk about software factories now, as opposed to like people, you know, writing software in an office.

22:27 Software is getting built in factories today. What's going to happen in the next, I would say, two years would be security will also make a similar shift. Like we will have security factory for every company. So it's constantly looking out for ways to breach you, but also like proactively finding ways to fix the breaches.

22:45 But yeah. Next few months, next 12 months, attack, attack, attack. Fix all the things that it finds. Make it extremely expensive for the attackers to attack you by attacking first and fixing all the findings. If the cost to attack you is like a dollar, like you will get attacked. Like make it like $10,000 and most people like would not attack you.

23:08 Most people are not going to spend $10,000 scalably to attack a random company. They will spend a dollar. That is a given. Interesting. Yeah. Yeah, amazing product. We were using it at Phylax as well. We're very happy. It's very impressive. But I think this highlights also something that, you know, why I think it will be, you know, 12 months, as Harry's saying, or more, is not because the capabilities don't exist, like products like Apex exist.

23:35 You know, we're a startup, we're using it, we don't have any bureaucracy. But in big organizations where humans and bureaucracy is the bottleneck, it will take a lot of time to adapt to that. And I think that is why it will take so much time for all these things to be fixed. Because suddenly, you know, crypto was always the dark forest.

23:56 And we were, you know, grew up in that environment. We evolved in that and we understand that. But the internet was never a dark forest. Like security through obscurity worked. Laziness is a human attribute. And suddenly, you know, within a few months, it was a human attribute. Now the whole internet is a dark forest and organizations and people are not used to that.

24:19 And suddenly they have to, you know, it's, you have a tanker, a huge ship and you have to turn it while you're being attacked by small speed boats. No bureaucracy, right? I would say like that's a great point probably like a very fast and drawn very cheap drawn that's like the way to think about it you know you have this machine and the swarms of agents that are cheap are coming for you and I wanted to I wanted to I think Odysseus touched a very important point, which is like, most people remember like the crypto hacks from the 2020, the 2021 era where every week there is a big incident, somebody lost $1,000.

25:03 And people would always like make fun of the industry for being insecure. And the reality was that like the entire software industry was insecure. It's just that crypto had very high incentives for people to hack. It was the economic variable that was different. And also everything was public. Yeah, correct.

25:22 And now the economics have changed. And, you know, welcome to the 2020 crypto where you see like a big incident every week. That is a new reality for the real world. And, you know, in some way, like, you know, you have moved through this in a different era. My spinal reflex is to like look at crypto and be like, yeah, this is bullish because this is the environment that crypto was born in.

25:49 Like this is we are home here. Like you guys, you know, non-crypto securities, like you are in the room with us now. And we were raised in the darkness, you know, something to that effect. I don't know if that actually means like crypto prices go up, but it does make me feel some sort of comfort that like blockchain systems were born in adversarial environments and now the world is an adversarial environment.

26:15 Is there a more bullish take than that or is that about as bullish as it gets? I think you hit an interesting point where I always tell people like, you know, like, you know, we are a security company and our job in the past was to secure money. And securing money is the hottest thing in the world. It's like fucking insane.

26:36 With maybe the sole exception of like government to government cyber, which is a, you know, all different industry. And if you are in this circle of protecting money, this is easy. Yeah. So now a lot of the job is a scale. So how do you make sure that every single company on the internet can have the same level of like protection that some of the largest like crypto companies have.

27:05 That that's like one way to think about it, but also the large companies in crypto, they also need to invest. Nobody's only the paranoid survive. And like you need to invest in cyber today across the board. But I do think there is a like philosophically and, um, from an operation perspective, like there is an embedded advantage to companies that were built in this, like really offensive environment that has become commonplace.

27:35 So that was going to be one of the questions I have. It's like, what about my crypto that I have stored in Coinbase? Like, is Coinbase vulnerable here? And I guess interpreting your answer is like, well, they are vulnerable in the sense that, like, the cost to attack has gone down. That's true for Coinbase.

27:49 Like, the economics of that doesn't change. But the Coinbase incentive to defend has been way higher for a lot longer. And so, yes, Coinbase should be concerned. But their starting point is fundamentally different. And so my money in Coinbase is probably not any weaker today than it was a week ago or a month ago.

28:09 But also, nonetheless, it is still up to Coinbase to be very on the ball with advances in security practices. Yeah, I would lean into that. Like if you look at, let's say, Coinbase and JP Morgan or like a large financial institution, in some way, Coinbase is better prepared to defend than your bank. And people often assume that, you know, the traditional financial institutions don't have to worry about cyber risk because you can always like pull back money.

28:42 That's not the case. Like, you know, you... people build payment rails and abusing the payment rails are like there's real risk at place. And if you study North Korea, before there was internet banking, they have found exploits in ATMs and they use that ATM exploits to withdraw money. Somebody gave this example where, they found a way to exploit target gift cards.

29:12 And then they were able to use the gift cards to like, you know, get money out of the system. So in some way, like the legacy companies that never had to worry about this intense cyber pressure, they are more at risk than the Coinbase. And, I know the Coinbase team pretty well. They are preparing. They need to keep investing in cyber.

29:35 But your money is safer in Coinbase than, you know, target gift cards as of now. I hope that was always true. Bankless, on the other hand, has spent almost a decade building one of the deepest archives of crypto data anywhere. More than 2,000 podcast transcripts, 10,000 articles, and countless conversations with the people actually building this industry.

30:12 And now we've structured all of that data into the Bankless MCP. So you can go and connect it to your Claude or ChatGPT and suddenly your AI can answer your crypto queries with the entire Bankless archive behind it. And every new Bankless article or episode gets added automatically so the context keeps staying up to date.

30:29 The Bankless MCP is exclusively available to Bankless premium subscribers. So you can go to Bankless.com, upgrade to premium and connect the MCP in just a few minutes. And all of a sudden, your crypto queries to your AI, LLM, whatever you use, will get a thousand times better. So go check it out. There is a link in the show notes.

30:44 And once you become a Bankless Premium member, you can hop into the Bankless Discord and let me know how you like it. Cheers. Some exciting news. We are launching a new podcast to help people figure out the crypto cycle, how to navigate it. The best crypto cycle investor I know, his name is Michael Nato.

30:58 He runs the DeFi Report. This is the guy that sent me a sell alert before the 1010 price drop happened. His cycle analysis has been absolutely on point. I've been following him for years. And this year we started recording weekly podcast episodes. Each one, we get into his portfolio, what he's holding, the market structure, entry targets, fair market value of Bitcoin and Ether, and where we are in the cycle.

31:19 There's new episodes that are released every Wednesday. They're 30 minutes. They're short. They're punchy. I think this crypto cycle is harder to navigate than most. So let's do it together. Go subscribe to this podcast. Search The DeFi Report wherever you get your podcasts. YouTube, Apple, Spotify, or find a link in the show notes.

31:35 There's a new episode waiting for you now. Is there like a silver lining in the fullness of time here? Because we've known that in like modern day software that's built by humans, that runs on the internet, it has been full of holes forever. Like the internet is built with sticks and duct tape and like paper mache because humans wrote it.

31:55 And as Odysseus mentioned earlier, humans are lazy. And so therefore the internet has been built in a lazy way. And we've only really needed to secure it on an as needed basis. And that's not the environment that we are in anymore. So like, say we get through this period, call it, I don't know, 18 months, I think, Haru, you said 18 months of turbulence in terms of internet cybersecurity.

32:16 But then on the end of it, doesn't that mean we have like completely secure software for the first time ever? And if once we get to that point, what do we get? Is there like silver lining there? Or is it just like, oh, we just, no, we just get to be back in a normal environment and we get to proceed forward I don't know.

32:35 Is there some sort of silver lining in the fullness of time here? This is, I'll let you go for it. Intuitively, I would say probably yes. So, you know, probably we will, you know, it will not be better, but it will be back to normal, I guess. So right now it's, you know, right now it's a full on, you know, scale invasion.

32:59 And after the bloodbath, it's going to be back to regular, you know, hand to hand combat between attackers and defenders on more or less equal grounds. But there's going to be first the bloodbath. I think for me, I have two conflicted opinions. One, agents doing cyber will make software better, period.

33:22 After 18 months, the software we will be building would be way safer than anything in the past. But people need to think about this new... like the next attacker is an agent, like, and they are not going away. Like, it's like this alien species that's now going to live among us. So I don't think people have really mixed taught enough about like what does it mean?

33:47 Like do you want to live in a world where one mistake and you're done because there's always like this persistent pressure on you? I don't think the world was built that way. Like the world is always built for, hey, people are safe. Like most people are not criminals. But now, you know, highly scalable agents that can attack you at any point if you make one mistake, that's a very different world that we will be living in.

34:18 All right, guys, I feel sufficiently informed. Do you guys have any just like general advice for just individuals like me or listeners of this podcast who own crypto assets or whatever, just have data or individuals who live in the modern era? What behaviors or activities are you guys doing as a result of this?

34:38 Anything that the individual should know and learn from? So broadly speaking, this applies to crypto and non-crypto. Think about all the products that you're using today. Reach out to them. Ask them like, hey, what are you doing to protect my data, my money, my reputation? And if you don't like the answer, then you should think about like moving your data money out of the system.

35:09 Yeah. it is almost irresponsible for companies to not take actions to protect their customers today. And you need to look out for it. It's also now your responsibility to make sure that your data, your money is living in products that are responsible. So that is the number one thing I would say, like do like a personal audit of what are the products you're using, what are the services you're using, where's your data, where's your money, potential reach out to them, look at their public work that they're doing.

35:44 If their security program is the same as before, leave. If they haven't changed, like, It's coming for them, unfortunately. So that's what I would recommend as every consumer. Look at everything where you put your money in. For me, it's all about redundancies and blaster radius. So you assume you are going to be exposed to an incident, like with Railway, for example.

36:18 So assume that the services you're using are exposed and they're going to be infiltrated and then have a lot of redundancies such that a lot of organizations have to fail at the same time in order for you to lose money, right? So to give an example, you know, if you have, you know, self-custody, for example, Maybe you want to use a ledger, but also use an iPhone.

36:43 So you have like two supply chain attacks that need to happen. And also the safe transaction supply chain has to be infiltrated. And also, you know, maybe add some other measure, right? So it's like building these defenses and assume that any service you're using will probably be infiltrated. And if it does, then how exposed are you going to be?

37:06 That does feel a little bit daunting because I just think about like, okay, I have assets here, I have assets there, I have assets there. That's a lot of things for me to vet, to kick the tires of, and I'm not technical. I'm not technical. How do I do this? I'm not sure there's a good answer for that.

37:32 Yeah. Probably... Yeah, in terms of like self-custody assets, I think if you have, I think the best setup is if you, yeah, you use like probably something like an iPhone with biometrics to secure the keys. And then if you have multiple of these, then, you know, If there is a supply chain attack on Apple, there's a lot more to be worried about than your assets.

38:01 I see. One pragmatic tip I can give in that context is we have disclosed a lot of security issues on the internet. Many crypto companies do. And based on some of the incidents we have seen, maybe don't click on links that you feel are a bit sketchy. That is like the common way to escalate. So careful clicking links that should like, especially with self-custodied, you need to have a trigger.

38:35 You need to like take an action. It's very rare that without any trigger, well, it's possible, but it's very, very much more difficult. So if you're using a wallet somewhere, like you need to drive an action there. So try to minimize that. And more importantly, like reach out to these companies, tell them like, hey, what are you doing?

39:00 like at the end of the day, like they are respond, they have a responsibility to like, if every, if every individual is responsible for securing the software that they're using, like that's, that's not how it works. You know, like that, most people are not technical and we need to build products for everyone in the world and make sure that that is secure.

39:19 So the responsibility lies in the, the builders. And yeah. Yeah. Maybe for the foreseeable future, like, you know, stop clicking on a random link. And maybe for the foreseeable future, consider not self-custodied. Actually, maybe it's worth breaking up your assets into multiple exchanges where not only you delegate the security to a professional team, but also they have, you know, cyber insurance.

39:49 So, you know, that if anything happens, they have some kind of liability. Although I think we're going to see a lot of cyber insurance carriers failing over the next few months. There was a very interesting data point where in 2024, Lloyd's, which is the biggest car in the world, said that LLMs will create more cyber risk.

40:14 And, you know. the premiums of cyber insurance actually have been falling consistently since 2024. So I think actually we'll see a lot of these carriers failing. So that's even not a, you know, silver bullet, but probably not self-custarding for the next 12 months seems a good idea. Mm-hmm. It would be good, I think, in that case, to just have productive, proactive conversations, proactive statements from anyone who is a custodian.

40:49 So like Coinbase being the big one, for me personally, Infinex, for example, is a wallet that I use. But anyone who holds customer assets, I would like to see them make a tweet saying, hey, the Internet's scary, but we are on it. And there's somebody whose responsibility it is at these companies to think about these things and to protect user assets.

41:11 I think that would be a very refreshing thing to see from some of our biggest crypto companies and custodians in this space. So Odysseus, Hari, thank you. I feel much more informed about this. So thanks to you for coming on this live stream and just informing me and the Bankless audience about exactly what's going on here today.

41:28 Thank you so much. Yeah, thanks. Bye-bye. Hari, Odysseus, before I let you guys go, you guys are both have security startups. Who are your best clients? And if people are just like looking for extra help, what kind of clients do you guys work with at most? Hari, I'll start with you, and Odysseus will go after you.

41:46 Yeah, so we work with some of the largest crypto companies. I miss as a customer, like Robinhood Crypto and Mastercard, they're all our customers. But increasingly, because now the tools to secure companies are the same, they're agents. They're agents that you built and models that you built. Yeah. it has become very similar.

42:09 So we now work with healthcare companies. We are securing some healthcare technology companies and their patient healthcare data. We're securing some AI companies that are now increasingly pulling in a lot of data. Remember the chat GP example. So Yeah, reach out to us. We send disclosures to many companies.

42:31 We have this factory that can, as I mentioned, can churn out exploits. The best way to defend is to attack yourself and fix everything that it finds. We're very happy to support companies for free. It's very cheap for us to send you disclosures. So reach out to us. Reach out to me on Twitter. We'll send over disclosures.

42:53 And if you're a larger company that feels like stress, like we have resources that can help you in this terrible era. Odysseus, who do you work with? Yeah, so we work with, right now we work with the linear ecosystem. So we're protecting the ecosystem there, the L2 from ConsenSys. So you have a protocol there, we'd love to help you set up.

43:15 And we're about to launch a new network. So follow us on socials and you'll see where we make our technology available. And yeah, it's interesting seeing how redundancies are starting to pop up and customers are very interested in having like this, you know, completely orthogonal circuit breaker from a different organization, different code base protecting their assets such that two systems have to fail at the same time.

43:45 Odysseus, Harry, thanks for coming on. It's nice to know that crypto has been kind of on the ball on some of this stuff just by necessity. And now it's the rest of the world's turn. I do feel a little bit more prepared having talked to you guys and also being in the crypto space. So thanks for coming on and educating me and everyone else.

43:59 Bankless Nation, you guys know the deal. Crypto is risky. You can lose what you put in. This is a frontier. It's not for everyone, but we're glad you're with us on the bankless journey. Thanks a lot.