AI phishing vs traditional phishing: Cy Khormaee on Beyond the Inbox

In this episode

• Why security awareness training alone cannot keep up with AI-written phishing
• How hijacked accounts and sites made phishing delivery cheap
• Identity, behaviour and content: how AI agents investigate an email
• Why detection rules fall behind, and what small security teams can do

Speakers

Cy Khormaee, co-founder, AegisAI

Aaron Daily, host, Beyond the Inbox

Transcript

Machine transcript from Riverside, recorded 27 Oct 2026, with live audience questions.

0:01 Aaron Daily: Morning, Cy, how are you?

0:02 Cy Khormaee: Morning, good to see you, Aaron.

0:03 Aaron Daily: Good to see you too. Hey, thanks for joining our little beyond the inbox, as I'm like liking to call it. Uh really appreciate it. And I think today, you know, we're really want to talk about AI security, fish and email. It is Cyber Cybersecurity Awareness Month. And I think as we come to an end, it's gonna be a great kind of segment into the holidays as we're really seeing our uh inboxes getting flooded with email phishing attempts and know as traditionals we would probably be able to find it and see it as a security admin. But then secondly, if we go into the AI style of things, where are we at now and how difficult is it to see it? But before that, like, you know, can you kind of like, you know, let's go from the top or start the very beginning. Like where, you know, where'd you grow up? you know, what was the moment that you knew this was going to be your path going forward?

0:54 Cy Khormaee: Yeah. well first of all, thank you so much for having me. always good by the always I always love the Star Wars figurines, big Star Wars fan too, so it's cool cool to see those.

1:00 Aaron Daily: Thank you, thank you. Thank I appreciate it.

1:03 Cy Khormaee: but yeah, just grew up grew up in rural Oregon. Um, you know, spent a bunch of time tinkering on computers, I'm sure most folks did. one of the first security incidents I think I handled was uh I deployed my first Unix box and you know, Unix starts with all the ports open and I got hacked, you know, I think between grabbing a sand finishing the build and grabbing a sandwich. I like, wait, what is this? And so I just think that was one of those, you know, fascinations that's carried through my whole career. And then getting to spend time at Google, you know, fighting real state sponsored actors was really just that next level where you kinda get a little bit drawn into this infinite chess game that is the you know, red team versus the you know, blue team forever. And uh it's it's intellectually challenging. The mission matters a lot and it really helps people's lives. And and actually I think this is timely too. I always joked that uh Cybersecurity Awareness Awareness Month was perfect because it was timed just before all the IT folks go home for cr Christmas and Thanksgiving and get asked to solve all their families' IT problems.

2:08 Aaron Daily: Yeah, no, absolutely. I think uh, you know, it's interesting you say, uh, you know, I think uh, you know, let me ask you this question. And I think this is gonna be a really relevant question to a lot of the admins out there and even the end users. Is like awareness training today, like the difference between it is today where it was, let's say 10 years ago or five years ago, like is it working to the end users? Like how difficult is it gonna be for someone like myself, right, who is definitely an end user, right? I'm not the guy. Who's behind the scenes? I'm the guy who's gonna click the link, possibly. But you know, I've been trained well enough that hopefully that doesn't happen to me. And you know, is it working, I guess, for for the general public? Are we seeing some really improvements? Is it is it more like just tick the box for insurance purposes? Like kind of take like help us understand that a little bit or help me understand that.

2:57 Cy Khormaee: Yeah, it's it's a great question. And look, I mean, training is definitely progressively getting better. I think the question is, how is it comparing against the advantages that AI provides now in generating these attacks? I think if we're all all the back all the way back to the Google days, you know, Google really never believed that training was the answer. We always believed detection was the answer because we knew that you could always fool a human. Even even you, even me, folks are like fairly well trained in this space. Given enough effort in reps, you will 100% fool them. There's just kind of just a pure matter of time and probability to get there. And now you can see some of these more sophisticated tactics become used by AI adversaries. So creating this perfect email. That by the way, it's not just perfectly written, it's researched everything about who you are. It's understanding these relationships. It's using hijacked accounts. We'll get into this with you know the PHP Touchell issues. In order to uh attack you. So you're gonna get an email from someone you trust that matches exactly what you'd expect them to say, with just a couple nefarious details slipped in. And that can all be done at mass scale. In fact, actually, in a couple of days, our our folks at uh Unprompter are gonna do a little workshop on exactly how this works. But that's the world we live in today where fishing is perfect, and it's perfect at a cost of just a few pennies. And The question I would ask then is like, okay, if phishing is perfect, how could you ever train even look, I've spent a decade in the space, even someone like me to spot it versus your average employee? And and my positive would be it's probably a losing battle. Like probably not going to train a human to be smarter than the AI's ability to fake an email.

4:47 Aaron Daily: Yeah, no, I mean great points. I mean, and you mentioned you worked at Google or you mentioned Google a couple of times. Like, is this like if you want to talk us through the origin of Aegis, like where do you guys come from? Like how many people are on, you know, are you more uh engineer based, sales based? Like kind of help us understand the Aegis in itself, like what are you guys doing that's gonna be more advanced, I think, than we're looking at traditional vendors and how they're doing things versus, you know, how you guys are doing things. That would be great.

5:13 Cy Khormaee: Yeah, and look at also how it relates to this fishing training problem. Again, you know, you think back to the original origins of kind of fishing. That's been a problem, but it's been the number one threat for the last, I don't know, 30 plus years. Every time we pull open the Verizon DBIR, uh, it's always the top threat. I think they start calling it pretexting now, just to give a new name for the same threat, but it's it's still the same thing.

5:33 Aaron Daily: Sure, sure. Yeah.

5:35 Cy Khormaee: And so if you go back then, maybe training was really effective as a deterrent 20 years ago, right? But then as it got smarter, you saw things like fish kids come out. Or more advanced compromises. And you could use things that we used at Google, like basic behavioral-based matching and rule-based systems in order to spot and stop these attacks. And that was effective for a time, especially when people were doing these mass attacks where you had time to observe, you had time to react, and stop them. But now we're in an era where the attacks again are kind of n of one, right? So Every attack can be unique at a very low cost. Every attack can use compromised infrastructure. And so a lot of those old rules we used to rely on are breaking. And that really is the nexus of why we created Aegis. Is we saw this new wave of attacks coming, powered by AI that was unique. It was N of one. And we said we should leverage, we must leverage kind of our knowledge of this technology, these transformer models in order to stop it. And that really is the team. So what's really unique about our skill base is, you know, Google's been working in transformer-based models since 2017. And most of the folks on our engineering team have come from those areas where they've been working on security with transformer power detection models since 2017. So I think for a lot of folks in this world, AI and LMs are relatively new as of the last couple of years. For us, we're coming on year 10, not year two, of kind of experience with these. And that really is the next to the team. And it really is this strong, you know, engineering-driven culture where, you know, we've got a lot of our technical leadership from Google and Meta and Amazon and some of our kind of hedge fund and crypto friends. So we really sought to find the very best in AI talent because we believe that moving forward, this is a kind of AI versus AI arms race. And so we need the best. kind of researchers and scientists to really create an AI lab that's going to combat these incoming threats that, you know, f traditional training, traditional filtering rules are just not going to match.

7:43 Aaron Daily: Yeah, no, those are like really great points, I think, as we as we move forward in the in the years to come and the things are moving fast, right? It's like it's like a never ending battle for admins. It's like rules, rules, rules. You know, I gotta adjust, I gotta just adjust, and they're just getting piled on top of one another and and so forth. I think, you know, with this with the AI and how fast it's moving, you know, how are we gonna keep up? Right. And I think that's when we look at like the LLM models, the agentic AI. You know, I know right now like the big thing is like the P that was the PHP shell. thing that just happened, like, you know, I I know that's a huge thing. And, you know, kind of talk to us a little bit more about that. And that that would be like really, I think a lot of interesting facts. Because as a as a as a reseller, right on my end, you know, we talk I talk to clients all the time. We talk to uh CISOs, we talk, you know, just anybody you can talk to at this point. But that's always the question, you know, with this PHP thing, like we're really kind of, you know, it's bogging us down. We really have to check everything, double check, triple check. Like kind of like let's talk about that a little bit. That'd be kind of really I think kind of really help put perspective too on what's really happening out there in the wild, right, with the Gentec AI.

8:45 Cy Khormaee: Yeah, totally. Let me let me share a few slides if you don't mind. Cause I think these really

8:47 Aaron Daily: Yeah. Yeah, for sure.

8:48 Cy Khormaee: speak to the emerging risk. I think the first thing that we're really, you know, we're seeing just broader awareness of this is a lot of the folks that you work with have already been breached, generally speaking. Kind of maybe an exercise we can all do is, you know, pick up your phone and look at the last 10 people you're t you texted. Are you aware what their security posture is? Like what do you think the probability they've been breached is? And then if they've been breached, would you trust a message or action they asked you to perform? A lot of times when we do this kind of question in a room, we'll see, you know, most of the hands go up because it's true. Like there's no way for you to know the security of your vendors. And so you presume that they're safe, or you use that assumption that I can trust someone communicating with me as safe, you're almost certainly going to be wrong. And again, it's just a matter of time and scale. And that's really where, again, a lot of these. Systems fall down is when there is hijacked trust, when someone has compromised another trusted entity and use that to deliver a message. Because if you again think about these old filters where they're very based on seeing an attack and solving it, it doesn't work if the behavior matches. It doesn't work if the identity matches. It'll pass all of the controls because it looks the same. And what tools are not yet doing, and really what Aegis is one of the few that is. capable of is doing an investigation every time. So we dig into every attack, we make those assumptions. It is true kind of zero trust detection analysis, which prior never really existed in the space. And as it relates to specifically PHP2 shell, what we see is all of these websites are compromised. And so the supply of compromised vehicles has now like almost become free. And that's really going to be the fallout from this attack that we're going to see is that yes, there's a whole bunch of compromise. Look, it's a really tough week last week for everyone across the security world. Patching,

10:47 Aaron Daily: Sure, sure.

10:48 Cy Khormaee: but again, not just patching their systems, also worrying about who are their vendors, who are their downstream folks in the supply chain that maybe have been patched. So whatever

10:56 Aaron Daily: Yeah, yeah.

10:57 Cy Khormaee: worries you all had as a security team, amplify it now across your vendor risk. And an example that we saw with Recapcha back in 2017 was. There were so many data breaches over that period of time. I think there was like a billion credentials lost every quarter. It

11:14 Aaron Daily: Lock

11:14 Cy Khormaee: meant that passwords basically stopped working on the internet. Because if I get a billion fresh consumer passwords every quarter, I'm gonna guess other people's passwords. Again, question for the audience is how different are your passwords between work and home? How different are your passwords between different accounts? Imagine if I got 20% of your passwords, could I guess? The next few, again, I think for most people they would say, yes, that's definitely a risk. And then we had to put this control in for recapture, where recapture, in this case when we worked on it, was a solution that was looking at the behavior of someone entering a password on a page and determining if they're adversarial or benign. And you had to add that layer because the core control broke. And the same thing is happening with email today, where the core control, we could trust, you know, SPFD can DMARC or trust a sender is completely broken. And if we presume that it's not, it is, you know, just an a di huge risk to the organization. We must assume everything has been breached and we must analyze each email from the ground up. So that's really, you know, where we see the journey of PHP two shell going next.

12:20 Aaron Daily: Yeah, yeah. I think, you know, from a uh a perspective, on a bars perspective, we you know, and as in business in general, you know, we used to say, it's coming, you know, you you know, you're probably breached, you don't even know it. It's gonna it the wave is coming. Well, the wave is here and it's already flooding, you know, the

12:36 Cy Khormaee: Yeah.

12:37 Aaron Daily: the city as we see in Southern California. Like the rains are just coastal floodings everywhere. I think that's we can certainly put that in an email perspective too. I think, you know, the the threat vector, this is the still the the biggest threat vector. Right. I mean, we put layers and layers and layers and layers behind the the the castle in front of the, you know, the moat, the drawbridge and so forth and so forth. But then at the end of the day, it's one click. Right. And so I think, you know, that is always going to be the biggest issue. As a matter of fact, when you said something about uh the the passwords and MFAs, well, a client of mine was at DEF CON right after Blackout this year. And he literally uh told me, I went into a room, sat there, and you could buy old passwords. from anything you wanted, terabytes full of stuff, as much as you wanted. And it's, you know, how many of those are good? It doesn't matter. All they need is one. You know, it's like they do ninety five percent of their stuff is research before they actually, you know, get in there and they sneak in like a sniper. They're not even they're not even like blunt force stack. It's like I'm gonna sneak in, I'm gonna lay there until I can, you know, do it. And I and I think like nobody wants to get the hug me face effect you know a effect, right? Nobody wants to get attacked and just like shut down. Right. And then now we're like AI battling AI. And that's just like one of the I think the coolest coolest things that we're seeing. And you know, by the way, I think, you know, we're in AI 1.0. Right? Wait till we get to like 2.0. And you know, as we move through these years, it's gonna get faster and faster and faster. So I think, you know, those are those are, you know, like, you know, what what we're seeing today is gonna be 10x faster than what we're gonna see tomorrow. And it changes on the daily. It's not even like this week it's gonna be or next year. It's like today is today. Tomorrow we have to look at something else and how we're going to be able to to to defend ourselves against that. I mean, would you kind of like like what's your thoughts on that and like just kind of how we how how as an end user like like examples of what a you know, what are we looking at? Like what should we see? What what are things that we're seeing that you're seeing in the wild a as as a CEO and and co founder of Aegis and and your engineering team versus the end users? Like how are we like how how do what are we gonna do? I guess simple answer, right? Simple question, I guess, right? Right.

14:41 Cy Khormaee: No, no. I mean simple question, hard, hard answer, right? Um, by the way, I really like the analogy of the the castle, right? Whether you can build as as a VAR, you work to build so many of these castle walls and drawbridges and locks, but if the user leaves the drawbridge down, kind of doesn't matter what you built, right? And that's where a lot of the social engineering becomes so dangerous. And maybe to explain a little bit of the history and story of how we got here is, you

15:06 Aaron Daily: Yeah, I'd love to. Yeah.

15:07 Cy Khormaee: know. Initially, like email filters got good. For people remember, you know, way back in the day, before even Gmail, spam was just really rampant, right? Really, you know, you couldn't almost use your inbox because of it. Filters got good. Filters got good enough where they're filtering out kind of not everything, but maybe 99.9% of these, you know, spam attacks. And so now adversaries focused on delivery vehicles. So they knew that you couldn't just email anyone and have them receive it. You needed a safer, more structured delivery emails. And then that forced the lures to get better. So there's these two pieces like how do I deliver it? What compromised account do I use to deliver email through? And then there's the actual content itself. And when the vehicle became expensive, the payload cost went down with AI. So now we get cheap payloads, but vehicles are so expensive because it still takes work to kind of compromise these. The problem that we're seeing now is more and more people are being compromised. And more and more vendors and more and more third parties are being compromised in supply chain. So the cost of that vehicle coming is coming down. And that was kind of the limiting factor. So now the payload is cheap and the vehicle is cheap. You're gonna see this massive spike in phishing. Again, think about, you know, you got 10 different ways someone could send you a message. You know, it could be email, text, voice, FaceTime. There's a bunch of different options. Let's say you got 10 third-party organizations you work with. And then maybe 60 behind those. And so there's now thousands of ways into any individual you may want to attack. And so we see is that when the cost comes down, so now that you know spear phishing is like subpenny, right? It's incredibly

16:46 Aaron Daily: Mm-hmm. Yeah.

16:47 Cy Khormaee: cheap. Um you're really starting to see these state sponsors not just do individualized attacks, but we call it dragnet attacks, where they're actually looking for. The most vulnerable people they can compromise across, say, all of the United States, just to build a data set or like you kind of mentioned with the password case, just kind of a list of assets they can use in an attack. And here's an example, one we even saw, we called it red tide, and it's kind of a viral session hijacking. And so if anyone saw like these kind of malicious calendar attacks, this is really the nexus of it. And yes, it's a calendar attack, but more importantly, it actually hijacks the session cookie. So it's able to use your email account to send other calendar invites to more people. And so we saw this in one user. I even saw this on my personal email too. So I saw it on both sides. And we saw this pop up in kind of four inboxes. And then just a couple days later, we saw it in 16 inboxes. And then later we saw something like 73% of the companies we serve were touched by this attack campaign. And this is a campaign where look, there's zero clicks, there's zero intervention by the adversary. But they're gaining an incredible view across the entire internet of compromised devices. And of course, we protect our customers, but if we saw it touch 73%, this thing is probably out in the hundreds of thousands of devices that are now session compromised so it can fully act on behalf of that user. And so this is really where we've moved as adversaries from seeing these precision strikes, where like when we worked on either John Podesta attack from the DNC, you know. about 10, 10, 15 years ago, it was very precision targeted. It took a took a concentrated team, focused aid actor to get that done. Again, this left picture here, this is a kind of World War I bomber trying to aim a bomb into a trench. It's very like

18:39 Aaron Daily: Yeah, yeah.

18:40 Cy Khormaee: high precision activity. And then look, airplanes and bombs became cheap and then you get strategic bombing. So just kind of run over a city and drop a bunch of TNT on top of it. This is the era we're really moving into with AI because both of those things, the vehicle and the prompt, have now become very cheap. So you're gonna the volume just absolutely spike. And the volume of not just fishing and spam, but very targeted, very dangerous AI-powered spear fishing that looks perfect.

19:08 Aaron Daily: Yeah, no, that's yeah, for sure. Like, and it's interesting because I remember you and I were on a phone call just late at night. It was like what, a Friday night, I think it was. And and we were talking about attacks, right? Like and I remember in a previous conversation, b like what, seven months ago, but since like before even RSA, right? You and I were talking about, you know, first of all, a question was always asked, like, you know, are different phishing emails designed for specific things? And I think you said, and correct me if I'm wrong, was We have a like what we found was like a base like platform of like, you know, think about building a house. Everyone has the same like base and then they just do these little variances from it, right? So everything is kind of like starts at the beginning, right? But then you, you know, in that to my comment earlier or that I just made about the our Friday night phone call, you were saying, like, okay, look, we have two different kinds of attacks, right? We have like a a distributing attack, and then we like someone's attacking the crown jewels, right? So like kind of help like people understand that because I don't think you know, in in in today's world, in a security standpoint and also in in a in a CFO standpoint, like, you know, well, a phishing attack is a phishing attack, right? It is what it is kind of thing. And you know, but like, what are the two differences between like the the the distributing and

20:21 Cy Khormaee: Yeah, a lot of it is

20:23 Aaron Daily: then like the the the the the actual going for the crown duel? Sorry to interrupt you on

20:27 Cy Khormaee: No, no, it it makes no sense. And it it's important to understand because one, you know, we we call it like advanced, you know, persistent threats, APTs, where they're just focused. Like they really have picked a target and they're going after it versus being kind of opportunistic, which you call kind of dread net. And often, by the way, one leads to the other. So oftentimes what we see from state actors is they'll dread net first. They'll just see who can I get? Who can I get around, who can I get in Southern California, right? Who who could I

20:55 Aaron Daily: Right.

20:56 Cy Khormaee: possibly Right? It's not very focused. And then when there's an operation, so like, hey, now I want to go compromise. Let's pick Aaron. I want to go compromise Aaron. Who in Southern California do I have that has a link into Aaron? And so they use the dragnet, the kind of less focused approach to build assets. And then they deploy those assets against a specific target. And some of the things that we've seen are, you know, concentrated rotating attacks on specific individuals with, for example, elevated permissions. Or we can see in the event of compromise that a bunch of other paths into the account are exfiltrated. The other really common one we see that's just a very simple example of this is spam bombing, where, you know, folks will take the exactly.

21:38 Aaron Daily: Yeah, I was just gonna say spam bombing is a perfect example of that, right? I mean, that's the thing, right? Let's spam spam create chaos, as you will, right?

21:45 Cy Khormaee: Well, they create case, but there's a playbook, right? So when it's a concentrated attack, you know, they're gonna go and sign you up for a bunch of, you know, mailers and then spam you. And then you're gonna get a very helpful call from the adversary posing as an IT person. And then you're gonna see kind of an EDR ping. And it's gotten down to a science where like in a couple of our customers, we can literally tell you that the timing is about 30 to 90 minutes from when you'll receive that phone call.

22:11 Aaron Daily: Yeah.

22:12 Cy Khormaee: And what's cool about it is we can literally tell the security team and the user, hey, you know, here's what's happening. Expect this call now because there's a playbook. And so that's really difference in sophistication of these attacks. The other way we can think about, I'll share another slide here, is,

22:28 Aaron Daily: Yeah, please.

22:30 Cy Khormaee: you know, let me go back. Like just how often these attacks are getting through. And this has been a change just over the last year. You know, it's funny we talked to, you know, a bunch of folks in the industry at, you know, CrowdStrike and Palo Alto and places like that. And and a year ago, I don't think email was a huge problem. They're like they kind of viewed as like mostly solved. Um, that has changed completely in the last year. I think just at the last, you know, Falcon, uh Mike Sinodas was was talking about the the president there is talking about, you know, how much risk they exist now because click through rates are over fifty percent and they're seeing these emails come through. And the same thing is true for Alex I was the CTO there, um One of the investors of our company said, look, like by the time it hits the EDR, by the time it hits like inside the infrastructure, it's a huge risk that we have to manage. We really need better solutions on the outside to keep it out in the first place. And this

23:27 Aaron Daily: Sure, sure, yeah.

23:28 Cy Khormaee: graph that I'm showing here is like, look, these AI generated attacks are making their way through about twenty percent more often than the human written attack. So there's a huge gap between kind of what we saw in the past and now. And Aaron, to your point. We're only seeing that escalate, right? This is the very beginning of the S curve. We haven't seen adversaries like truly tool up, but you're seeing that kind of rapidly happen just over the last, you know, six, six or seven months. And, you know, the the last thing I'll say on this is a lot of this is becoming more targeted. So again, if you think about the untargeted, is now just a way to build assets. And then they'll use those assets and deploy them to get to these, you know, targeted, um Tax. Maybe one quick example I can share too is there's a customer of ours in the crypto space, you know, run a very large, you know, crypto payments uh company, billions of dollars of value. And they went to an event in France and uh you know they got uh they used an event vendor that eventually got compromised and then used to attack the customer. And so this is a just a perfect example of where you see the asset gathering phase. Play into the targeted attack phase. And if if you're in the financial sector controlling any assets or manufacturing or anything to do with security, you know, we see this very, very frequently as a significant risk. And one where you know prior you'd have a focused team at a state actor with you know maybe a dozen people focused on a person. Now this is all doable in minutes with fairly simplistic AI. And then as it gets more complex, the attacks will become more multi-sided. You can start to create full scenarios where there's multiple people you know involved in talking about a thing in order to compromise the user.

25:14 Aaron Daily: Yeah, yeah, that's that's interesting you say that. And you know, as I as you're sitting here talking about this and you know the the amount of research they're doing and maybe they're creating like a fake domain and so forth like that, you know, a lot of my customers, a lot of my my uh people that I speak with, one of the biggest questions they're talking about right now is like shadow AI, shadow IT, and like how is can can email defense kind of do that, right? Cause I know when we talk about the old traditional vendors, right? Like one of the questions I always say is, you know. when they say, oh, well, we use AI in our in in our systems, right? Like but how is that being trained versus like the LLM model versus the ML model? But I think first and foremost, like l the shadow IT and the shadow AI, like like what how can we defend against that specifically in the email space? I I think is where I really want to kind of go down that down a rabbit hole a little bit. Cause I mean sure we could go down rabbit holes all day long, but you know, we only have what, 33 more minutes and I don't want to spend that talking about one thing, right? So I guess like, you know, let's talk about the shadow IT, shadow AI. kind of situation. And and again, my question's gonna be is, you know, is email platforms able to do this and track it all the way back to maybe like that person who was breached doesn't even know what kind of servers they're sitting on or whatever they have access to, even if it's a third party vendor, right? Like you like kind of help

26:29 Cy Khormaee: Yeah.

26:30 Aaron Daily: me understand that a little bit and help our help our viewers understand that too.

26:33 Cy Khormaee: And let me show you what that looks like because I think there's there's you kind of mentioned a few things. You mentioned account takeover, you mentioned breach, and you mentioned shadow IT. And I think it's really helpful because I'll add DLP in there. All of these fit together, right? If you

26:45 Aaron Daily: Sure, I'll absolutely yeah.

26:47 Cy Khormaee: think about fundamentally, there's identity, there's behavior, and content. And

26:53 Aaron Daily: Yeah.

26:53 Cy Khormaee: these are the three things that fit together to create risk. And so you want to yeah, I know we think about them oftentimes as separate controls, but really they're separate controls that go after the same goal. And so you asked first of all about shadow IT. And I think one of the things we can look, first of all, you can find it in email because you can actually see the sign-up emails, you can kind of see the dialogue, and you can compare that against identity, be it Okta UNTRA or you know, uh Google Workspace ID identity, to discover like is this the sanctioned version of the application? And there's even sneakier things like I don't know if folks saw the open AI kind of scams that have been going on recently. where an adversary will sign up for a fake open AI account. Let's say it's uh Borderland versus Borderland. So if it's something that sounds similar but a little bit Sorry. Nah j pick it you know Acme Corp versus Acme Corp.

27:37 Aaron Daily: Whoa whoa whoa. Sl slow it down. Slow it down on the Borderland thing. I don't wanna it's not We don't wanna we don't wanna put things out there in the in in the world, you know, in the ether in in the in the you know what I mean? Let's just let's just take Google as example.

27:47 Cy Khormaee: Of course, of course. So Acme Corp versus Acme Corp. Totally. Or Googled, right? And they'll create a fake organization and then they'll invite a bunch of legitimate employees to that fake organization. And then they'll observe the interactions between the two. And that's intact that we saw fairly commonly. That's like one that can be caught via a kind of a shadow IT product. The second thing you can look at on top of that is you know the account takeover. Where let's say someone's part of a shadow IT install that went badly and was adversarial, then you can detect, hey, like what is this client doing? We talked about those calendar attacks in the past where the session's been hijacked. The only way you're gonna see that really is by looking at the client side behavior and understanding how that correlates with past behavior and adversarial risk signals. And the last thing, which is hopefully thing you don't wanna see. Is exfiltration. So DLP. So if you almost think about it, you're literally looking at the kill chain in action here where an adversary will get them to install something maybe shouldn't through shadow IT. Then they'll perform an account takeover. Then they'll start exfiltrating data. Now, historically, these are all really difficult areas to solve because it was just like so uh So different, it was hard to capture rules. You can imagine, I'm sure everyone on the call has struggled with implementing DLP and configuring it, right? It's never been kind of an easy thing. And so for us, a lot of it can be solved with LLMs because they can have this really broad understanding of data that traditional rules just could not. And we even look at this example, we see kind of this bulk passport exfiltration where look, there's a baseline of behavior. And this is exceeding the baseline of behavior. And so there's not going to be a typical rule that's ever going to catch this. It's really a behavioral anomaly that we're able to catch by looking at the behavior of the user here. And again, that's where I think LMs and an approach at Aegis, which is look, it's LM and Agent First, is really unique, is we're able to look at things that maybe rules couldn't capture, catch what falls through the cracks, and do so with no configuration. So no one's sitting here configuring all these rules. The LM is really figuring it out for itself. And then it's correlating it across all these different data types. So again, shadow IT, account takeover, and DLP are all just steps in a kill chain. They typically would work in isolation. You'd buy a separate product for each, and the products don't talk to each other. With Aegis, all of the products are natively integrated in a first-party way. So they can identify and chase the risks through the entire attack pattern, which makes it much more probable. You'll catch that risk. at some point in the funnel because each step is more informed.

30:36 Aaron Daily: Yeah, yeah, no. I think, you know, I'm sitting here looking at your dashboard too. And, you know, one of the things that I see it's it's like smooth. It's simple, right? And I, you know, I've I'm coming across uh individuals and clients I talk to, and we're talking about email. I think traditionally like that that that that UI is very like detail oriented, right? So these guys can just pick

30:56 Cy Khormaee: Mm-hmm.

30:57 Aaron Daily: through, pick through and that can become like, you know, just a task that takes time and time and more time, right? I think, you know how are you guys are doing it in this simplified form like like show if you kind of explain to us and show us in this dashboard here like how how is your the the AI agents right are they you know how are they talking to one another like what are they doing are they doing some web crawling like it really kind of helped me help me understand that or help our viewers and and people on this call really like see a the dashboard right um how qu how smooth it is right and then like you know again I I think we're going back to the People want to see that traditional like the proof points in the mind has like their dashboards per se. You know what I mean?

31:38 Cy Khormaee: Yeah, well let me let me start the dashboard, I guess, because the dashboard is, you know, it is what it's. It's a dashboard. Comes a light

31:43 Aaron Daily: Yeah, sure.

31:44 Cy Khormaee: mode and dark mode because I think people have strong preferences. But to your point, I think one of the biggest things that we try to emphasize is that we really want to own the problem for our for our customers. We don't want them kind of having to mess around and tinker in this and configure. We really view this especially as AI evolves. You really need this like AI native model to respond in real time. It's not a thing you want teams chasing in the background trying to write detection rules to keep up. It's just it's just not gonna ever work well. And we think we've already seen it kind of fall behind. And so you look totally.

32:13 Aaron Daily: Yeah, that's that like losing battle, right? Like the it's just stack, stack, stack, stack, stack. And they're never gonna get there, right? Yeah.

32:19 Cy Khormaee: And by the way, like it's a thing we have like a lot of empathy for because you know even at Google, we felt like we were losing that battle, right? So we had 150, 160 detection engineers, we had 10,000 rules. There's a lot of energy kind of dedicated to this. And it was fine, you know, five or six years ago when you could kind of see an attack, write a rule, and you could kind of keep up with it, right?

32:41 Aaron Daily: Yeah yeah.

32:42 Cy Khormaee: Um where it became really not fine is when the attacks became N of one because you could just never keep Right. If every attack is new, the idea of detection rules pretty much just fails at that moment. And I think we're in an era now where it's very possible to do that. And it's just kind of becoming more pervasive as an attack pattern over time. So that's I think what we're really just seeing in the wild. And to your question, what we can see from the agents is how the analysis actually works. So essentially using again a series of bespoke built LLMs and SLMs and brute-based models. in order to really analyze this risk. And what we're seeing is each of these little boxes is its own little agent, right? And you can almost think about these as like a team of analysts that live in your inbox. And the first set analyst will ask questions like, hey, you know, what's going on here? What's the risk? Should should anyone else look at this? And the second sent analyst can say, hey, well, you know, I think there's a sense of conversation here. I think there's like something even more suspicious. And so calls his friend. And his friend says, well, let me actually crawl and do some uh sandboxing and really understand what's happening in this account so I can truly investigate and find that risk every time and then go through and find you know these suspicious pages and then can eventually find you know this is like a true phishing page which for us is really the end of the line because it's clear proof that this is a malicious thing. And again, this is an example kind of what Aegis does it's a relatively new approach in the market is choosing to assume nothing. And investigate every time and follow wherever the threat leads. And you know, an example here is even just, you know, some of the crawling you'll see around uh compromised documents, where uh, you know, a challenge I always like to ask folks to think about is like if someone sent a password protected document to your uh company's account, would your existing detection tool stop it? And I would kind of bet that 99.9% of folks would say no, it would not, because it's impossible. But here's an example where we have an L empowered browser that's able to go through, detect that attack, open up that document, even do things like bypass capture. So all of these roadblocks that adversaries will put into the way of security crawlers that traditionally were enough to fool them are not enough to solve kind of our Aegis Vanguard crawler. And that's really what you're seeing across our suite is look, just like kind of the sheepdog and wolf, there's all kinds of tricks that happen. There's all kinds of games that get played. We're aware of them and we're building new LMs every day and new agents every day that are gonna hunt down and find those attacks wherever they might live. And so that's really the the premise and kind of why a lot of our technology works the way it does and and why we try and kind of ensure it works well so that yes, look, there is this like, you know, cockpit dashboard you can look at if you want. But most of the lived experience of the users is just like you just don't see phishing and spam your inbox anymore. And it's really, you know. hands off. I think Aaron, you've had had a couple joint customers of ours where they've installed it and really kind of seen that value with no configuration, which is pretty nice. Cause by the way, I've never met a security leader who's like, I have too much time on my hands. I want to spend more time, you know, tinkering with this.

35:58 Aaron Daily: Right. It's like g how can I get their time back, right? Because it's like they're just never there's never enough time. It's either a large organization, a small organization, two or three people in the you know, a house or like, you know, two hundred people, there's still not enough time, right? I mean, it's

36:11 Cy Khormaee: Exactly.

36:12 Aaron Daily: it's one of those things. And I I I I really like the simplicity, right? And I you know, I as I know we're in the cybersecurity awareness month, right? We're seeing like let's talk about like awareness training and fishing, right? Like I traditionally we're seeing like almost like the same kind of content, right? Like it's Oh, it's the Amazon gift cards, it's the, you know, it's the CEO asking me to, you know, give me fifty bucks or so forth and went and lost. I'd go get lunch or something like that. And those are kind of like, you know, they're there, but I don't think, in my opinion, I don't see them as much when I'm talking to, you know, clients saying, you know, this is what we're seeing, right? It's a little bit more complicated. And you know, and and t you know, little kind of side note there is my personal belief is, you know, all this training is happening, but it again, it's it's It's not going to happen at three in the morning. It's going to be happening like five, four fifty-five on a Friday night, right? And the person who's running the front desk needs to get to happy hour with her friends and it's just click, click, click, click, click, click, click, click, and I'm out. You know what I mean? You know, it's to see that dashboard you guys have, it's like having that sock, that AI sock really sitting in your inbox that's going to really complement whoever's running your MDR or your security team, right? I mean, those are kind of where the the biggest threat vectors is in an individual that has to get out the door fast on a Friday night. You know.

37:28 Cy Khormaee: Totally, or just isn't fast enough. And we had another customer you know, you know, before they adopted us, I remember I was talking to them at a conference. They literally had to like sprint out of the room because they got called and it's like, hey, there's an

37:37 Aaron Daily: Sure.

37:38 Cy Khormaee: active compromise and kind of the his organizational posture was dependent on like his foot speed and ability to get to Wi-Fi, which is not great. Right. I he was fast, luckily. But like,

37:46 Aaron Daily: Yeah, that's not a good way to do things, but yeah.

37:48 Cy Khormaee: yeah, that's not what you want in your tabletop model, right? Um, so I think it's definitely where we want to pull the human out of the loop. Really and really make it automated and get folks to a safe state. And so for example, a lot of the integrations we have with, you know, simsore and identity systems enable us to act automatically. So we mentioned that case of spam bombing. Well, look, what will happen is we'll see the spam bomb come in, we'll understand what the attack is. Immediately the user's gonna be notified, immediately they're gonna be in a deprovisioned state, and there's gonna be a sim or a SOR ticket for the security team to be aware of and watching that. And so it's funny actually as we've seen this evolution. When we first introduced that kind of spam guard product, we just saw, hey, we could actually predict an EDR ping by about an hour before it happens. It's almost like precog, right? And I'm like, well, actually, let's not just predict it. Let's actually get the user in a safe state. So I think the first couple we predicted it. And then after that, we just didn't see it anymore because at that point the user's been notified. They've been set in a safe state from an identity and IGA standpoint. And we've notified security. So like everyone's just kind of watching that account. The guards are on high alert. And that really is enabling everyone to kind of stop the problem. And so that's been a really powerful motion um that we've really seen. I think the other thing we see with humans is just like um how difficult it's to really like set real expectations. I I think we're in training we were talking about kind of the uh the the Knicks championship thing. I just saw this this news article that was kind of interesting where they kind of framed using championship rings as fishing bait as an unfortunate mistake. And then my question though is a security per look, I know it's gotta be tough, especially for the folks who are like disappointed by not getting it. But as a security person, I think like, well, adversaries would do worse, right? And so I think the other thing we see with training is maybe it's a little bit of a false sense of security because people run fairly benign, fairly polite training. It's the same template, nine

39:47 Aaron Daily: Sure.

39:48 Cy Khormaee: to five, whatever it is. The adversaries are not gonna play by those rules, right? This is kind of extremely benign compared to, you know, the four a.m. phone call from maybe a compromised family member's phone claiming like, you know, they got hurt. Like that's the reality of what an attack looks like. It's not a polite, you know, I don't know, what I don't know what they're using these days, but like, hey, can you click on this healthcare link or can you click on this travel link? You that we've seen a million times.

40:11 Aaron Daily: It's time to register and renew, yeah.

40:14 Cy Khormaee: Exactly. And I know I know sometimes folks like to show, hey, the the the click-through rate goes down. I'm like, yeah, but Against what? Is this really against what adversaries are doing? And a lot of what we found we you at at Aegis, we build our own red teaming product as well. We can show like compromises typically 10% a week in customer accounts from black box. This is stuff that gets through all the detection layers and gets triggered by users. Um that's also look, it's it's the level of vulnerability that exists in the space right now. It also keeps us fired up and rolling because we know that there's this massive risk that everyone is exposed to. And just, you know, alongside all of the Yeah, I think everyone's worried about these AI models where if we think about, well, if AI is now able to fool all fool all humans, what breaks in the system now? And we

41:02 Aaron Daily: Yeah.

41:02 Cy Khormaee: find it's a lot. Again, it's going back to her castle analogy. Like if I can trick the guard into lowering the drawbridge, I don't know how much the rest really matters. So we really have to stop that from happening.

41:13 Aaron Daily: Sure, sure. And you know, I think um in in that example used about the the gentleman at the conference that'll run out of the house, you know, run out of there, you know, his whole reliability is on how quickly can you get on the hotel's Wi-Fi to fix this? Right.

41:26 Cy Khormaee: Yeah.

41:26 Aaron Daily: And you know, we talk about like in and how your how your bots are really almost like a security operations center, right? But you still need that human inner interaction, right, to confirm these things. But I think that gives them a little bit time, right?

41:38 Cy Khormaee: Yes.

41:39 Aaron Daily: Because it's and I would say, you know, the the smaller companies, you know, the SMBs, because you look, look, there's more SMBs out there than there are Fortune 500 companies, right? I mean, it is what it is, right? And those are probably the most susceptible because they're, you know, security is they're there, but they don't necessarily have a budget or so forth and whatnot, right? And so to have that little sock in the box gives them an opportunity to go in there to really time to do their investigations. I mean, we shut that email down just to make sure, right? Because I think and then you know. really again help compliment the the s the analysts who are on the other side, even if they're paying for a service, right? Uh and I think that's important to understand too, because in in the past, like we're, you know, that gentleman, let's say he couldn't get on fast enough, right? I mean, it just kept failing to get on there. Everyone knows we can't connect and you're like, ugh, you know, you keep cursing yourself and using words that, you know, out loud that everyone can hear, right? Because you can't get on there fast enough. And next thing you know, there's no more business, right? And then you know we look at it as like, you know, how much business are we going to lose per day? Money. Right per day, you know, and that's just a pretty easy figure to you know, number to figure out, right? Uh and then the cost, right? And and you to your point, you know, the the same old templates are being used, and and that might just be the tick the box, right? I mean, for insurance purposes, it's like, you know, you know, who you know, well, we did all our things, right? We did our training, so our shirt and now our insurance needs to pay, right? help fix this, but but no one really thinks about like the maybe it's a third party vendor. Right, that was compromised and they might have admin rights into like their website, right? And that's what they're doing. And that's kind of how they're using like a you know x company.com as their email to address to get in there. Well, you know, are they gonna be liable? And like how can we find out if they're liable to have their insurance kick off before my insurance kicks off? Right. And I think you you know, in these war rooms that are happening, like some of these admin are like, I'm not even thinking about that. I just need to get the information to the CEO, the CFO, and maybe legal take it like six months down the road, but In the meantime, I have to, you know, these are things that I think people need to be aware of. I mean, what what's your thoughts? Like, and do you agree on that? Or like well, how are it kind of take me understand that a little bit more? So when we have these conversations, especially in the var world, to, you know, to uh prospect or client, you know, that that really helped them understand these things. It's a big picture. It's not just like narrowed straight into the this is what I'm working on, right? I need to, you know, as a as a manager, I like to say, you know, you know, I'm a as a supervisor, I have to have supervision, right? I'm not just focus on my station. I'm I have to see it all, right? So I again I'm gonna kinda kick that over to you and kind of that that whole statement in question as you will.

44:11 Cy Khormaee: No, I think, Aaron, that makes a ton of sense where, you know, look, these teams struggle. They're, you know, perpetually understaffed. Like I don't think anyone I even people people cross security feel understaffed. And I think it's more desperate than ever in the S B. I think a lot of what happens in the S B too is they're so understaffed, they just have to accept very large risks for the business. Because the security game prior was a lot of like buy 10 tools and you have to spend a lot of time integrating them yourself. I think in the new world of Agentic detection. And a lot of ways show join a ATO, Shadow AT, and DLP is these should come pre-integrated as a full service. And so the expectations for these smaller teams should be: look, like we're gonna install you and you need to solve my email problem for me without me having to do a lot of the work, a lot of the ticket review, a lot of the detections, things like that. One of the things we always like to talk about is kind of why you know we believe so much in our approach of You know, this investigation, right? We kind of we do the full investigation every time. And there's two reasons. One is look, people are busy, they just don't have to do it. Second is like, we're the experts at this, right? Like, would I expect every single person, every sock at every SMB to be better than us at deciding if something is fishing or not? Like, no. Like we must be able to kind of do that for them to be successful. I think that's just like one expectation we need to set. The second is it enables stuff with just a much higher accuracy bar. So I think a lot of the things we kind of go over with customers is like how much of a difference we can make in accuracy. So we can typically detect 20% more than other vendors in an area. You've seen that live many times. But

45:52 Aaron Daily: Yeah, sure, sure.

45:53 Cy Khormaee: most importantly, our escalation rate is like five and a hundred million. And so if you think about being a very large organization like a Fortune 500, you probably don't even have 100 million emails a month. And so you may spend almost no time. you know, interacting with this tool, seeing any errors at any point in time. And so you almost think about this like this is kind of the standard. Imagine you run a 4,000 person organization, you got a hundred million emails. And you know, one in a thousand get through. If maybe think about everyone in the audience can think about, hey, in your inbox, how much spam and fishing you have right now? It's probably one or two things a week. It's

46:26 Aaron Daily: Okay, infinite. Yeah. Who knows?

46:29 Cy Khormaee: probably one in a thousand. Easily. Everyone's experienced it, you know, this week. I think again, last time I asked this in a room was like, eighty percent of the hands with I thought it was gonna be twenty percent it like eighty percent for us it's five hundred million

46:38 Aaron Daily: Yeah. And maybe the people who didn't want to put up their hand are there too, but they're just like, you know.

46:43 Cy Khormaee: No. Good news I think it's the security audience. So like everyone's like, yeah, I I I get this is a problem. Please, please fix it.

46:47 Aaron Daily: Yeah. Yeah.

46:49 Cy Khormaee: but then if you think about Aegis, it's really like five in that organization across all your this is a medium sized enterprise, right? We'd say, hey, like most people, in fact, ninety nine percent of the people in your organization have never seen a phishing or spam attack after they installed Aegis. So that's really, I think, for us, kind of the power. And look, our our end goal by the way is to be one in a billion. It's get even better. We know we can get better. We know there's a huge opportunity out there to improve with the technology. And so I think for a lot of the folks, you know, maybe my one, my one takeaway for folks is just like, hey, it doesn't, it doesn't have to be this way. It doesn't have to be this world where sorting through quarantine folders and inboxes are a minefield of danger you've got to train people against. It should be safe. Like dangerous email should be like an escalation, an RCA. Like it's really treat it seriously and kind of hold folks to that standard. rather than having your users kind of sort through all those attacks. And I think it's generally, by the way, look, I think we're really passionate about is to make people's lives better and make technology safer and easier to use. And this is really one of the the keys to doing that.

47:49 Aaron Daily: Yeah, no, I I think great points. I I would kind of listening there and and thoughts are coming into my head. And I would say that, you know, one of the biggest challenges when we talk about the amount of emails and spam that's coming in. I mean, think of them in MS an MSP who sits in small business, right? And they're doing medium small

48:05 Cy Khormaee: Mm-hmm.

48:06 Aaron Daily: business. Like they have to run so many different tenants to kind of keep up. And, you know, are they some of them are still using those traditional vendors, right? And you know, and you know I think we have to have a way for the MSP space to really to kind of get ahead of it, right? Because they don't want to have to lose a customer at the end of the day, right? And a lot of them rely on on the phishing simulations too, as you mentioned. And I saw on the dashboard earlier that you guys do have phishing simulations. I mean, how is that going to be different from I mean, I don't want to bash companies or anything, but you know, some some of the ones that are out there that have kind of almost cornered the market in the beginning. that are still doing the traditional things that you know like but I know there's gotta be different, right? And I think when I saw the DLP and I also saw, I think it was like brand compromise too, or you know, like you know although that's important, right? I mean, look, if Facebook gets breached, Facebook gets breached, we're still gonna get Facebook, right? I mean it is what it is, right? But if you know X company who is in, you know, selling something small, if they get breached, their brand is ruined and that could just tear their business. They're one day away from a bad day, right? From shutting down, is all I like to say.

49:14 Cy Khormaee: No, but look even true for for large brands, it it's funny, actually Asof who's the the current CISO at Facebook has been a longtime customer of mine, you know, all the way back to the PayPal days. So like I think he would tell you like, he really, really wants to make sure Meta doesn't get breached, because it's a it's a really critical

49:27 Aaron Daily: Sure, for sure, for sure.

49:28 Cy Khormaee: thing. I mean, can you imagine, you know, the the downfall of that? But you know, to your point, I think what's really changed is the integration where like we really think about this as phases of the game, right? Where you start with detection. It's like let's make sure the front door We catch phishing, malware, BEC, spam, ATO, all the stuff. Like catch all the stuff that's being thrown at these users. Two is manage this instant response. So we don't have that person trying to run out there and like solve stuff manually. Make it so that humans, and I love the way you said it, they're kind of a supervisor. They're not like in the trenches kind of getting it done. So we have this automated quarantine, AI red teaming, automated identity actions, all the things to go from we identified risk to making you safe. And then in this area of kind of users and training, so you know, look, can we do the threat investigations, give the intel, brand protection? So where can we see your brand on the internet being abused? Executive risk, all that kind of stuff. And again, what's really special is you know, all of this is integrated in one first party platform. I think historically you had to buy six products and spend a whole bunch of time manually integrating them, which was never going to be perfect because the products are evolving and just is really on the on the SSP or the vendor or the VAR like helped them connect these. It was just really difficult.

50:42 Aaron Daily: Yeah, there's like no silver bullet, right? And you just you have to buy a holster of bullets to get, you know, hopefully that works before you run out, kinda.

50:49 Cy Khormaee: Totally. And they never just really were connected that well. And so I think just the the big shift in the market is for us to like have them come pre-connected, all AI native by default, all self-configured by default. You know, it's just a new era in technology that's not only nice, but I think it's necessary. Maybe the other thing to think about with the SMBs is they're more under attack than ever. It used to be too expensive to really like attack an SMB. It wasn't worth it. Now that the cost of these attacks is essentially free, we're seeing a widespread attacks. Even, you know, friends of mine who are running, you know, little startups, two and three people, are seeing active waves of attack, which I never thought I would see in my lifetime. But we're we're definitely seeing that now. And so just the theme is like, you know, whatever the posture was before, we've definitely kind of got to step it up. By the way, I know we've got about 10 minutes left.

51:39 Aaron Daily: Yeah, yeah.

51:40 Cy Khormaee: Um happy to cover a couple questions as well from the audience. I see a couple popping up in the feed. Let me stop sharing here. Um, but one is just, you know, I think I saw from someone that said, you know, how do you see the job market shifting in response to attacks like PHP Du Shell and other ones that have happened before? Um, I think it's a really good, you know, question to kind of think through. Cause there's like

52:03 Aaron Daily: Uh that's a that's a that's a great question. And especially it's relevant today, right?

52:08 Cy Khormaee: very relevant. And just and I'll add on like how do we see what security needs to focus on shifting? I think there's really two things. And it kind of goes along with our talk track where a lot of the basics. So if you're like, hey, I want my job to be looking at phishing email, then like probably not a job soon. Like, you know, AI's gotten far enough, it's gonna replace that. But there are these new attacks that are happening all the time. Like, well, how do I think about downstream vendor risk? How do I think about Connecting all these tools and getting better detection. It's just the water level it's just risen. And so the security world is gonna look a lot more engineering driven and a lot more about kind of managing these more complex platforms and how they fit together and how you manage these escalation paths. And then changing that every ninety days, every 60 days. So I think that's really what we're going to see is the capabilities gonna change so much that you're gonna think about reimplementation. on a quarterly or more basis because the threats and technology just fundamentally change. Like, you know, I don't know how big the PHP foot, but I assume it's like 80 plus percent of internet, right? Like that is all vulnerable. Pro I would I would bet half of that is still vulnerable today. Right. I think that is still

53:18 Aaron Daily: Yeah, sure.

53:19 Cy Khormaee: like a persistent risk that didn't exist two weeks ago. And that's just this week. And then if you look back and hear, you know, Jason Clinton and Anthropic talk about the risk of the hugging face and AI attacks, we're like, That's another whole thing. And then, you know, later, maybe in a future conversation, we cover what does it look like when um organizations start to bring their um sorry, bring their AI in-house and start to run their own AI. Well, that's a whole other set of attacks and risks. And so that's really what I what I think about. So I think about, you know, security teams where they really want to kind of push for is expecting that pace of change and just being ready for and building really thin and shallow thin and shallow response patterns that can change really quickly.

54:07 Aaron Daily: No, and I think, you know, to that, I I think, you know, we talk about those how business perspective, uh, the biggest challenge is that any any company and IT team and security team is gonna be budget, right? It's like, what can I get from my budget? Right. I mean, I don't, you know, I like what I have, but I need to save some, you know, save something here and there. But at the end of the day, it's it's gonna come down to budget and manpower, right? Those resources are slim. What can I do? And I think, you know, we have to look at solutions that especially as we come into this AI kind of phase. As you will. And I know it's kind of been around and people called it ML, but it's not ML. It's it's a completely different animal, right? And so now now we have to look at things in a different perspective, different lens, and say, okay, what AI tools are out there? Number one, right? And what what do I need? And what I've come to find is, you know, everyone has a project, they don't know where to start. But I always say start at email because every admin knows how to deal with email. It's like you

55:01 Cy Khormaee: Yeah.

55:01 Aaron Daily: learn that in school. And I'm not even an admin, but I would say You know, that's the thing you learn like day one in school, right? And so I I think, you know, that's the easiest path to start, right? Because it's not expensive. I mean, I I would say, you know, rel depends on how many bells and whistles you get, right? Into that. And you know, try to find a platform now like Aegis. I know for you know, competitively speaking, for price point, it's it's there. And you're getting more sometimes for maybe two like SKUs that maybe one company's only doing, but you're getting the whole suite. that and I think that's important to know and people to understand that, you know, when we see AI companies like your company, you know, it's coming, it's there. We just have to really kinda understand it and start at email. Because I think that's the most important thing in my opinion. And that's my opinion. Now I the guy on the other side there's gonna be like, dude, I don't know, man. That's kinda I got but again, I think like, you know, it's still gonna be email for me every day. Every day. Every time, every

55:51 Cy Khormaee: Yeah, one thing

55:52 Aaron Daily: day.

55:53 Cy Khormaee: one thing I love about email is it's very visible to the business user. And so a lot of times, especially in smaller businesses, you're serving this like non-technical, non-security business owner. They understand email. Like they will see it every single day. Um and and you mentioned manpower. So I think the biggest thing holding a lot of folks we talk to back is I think, it's gonna be this giant project. I've got to spend a quarter, you know, installing and messing with MX records, all kinds of stuff. You know, my challenge to them is just give us five days. Like you can install Aegis. My shameless plug is you can install Aegis in fifteen minutes. A couple of days later we'll show you the report of what we found. That's all it takes to really understand your posture and and really make a justification for how to improve it. And we've had some great customers like Notion, Lane Chain, Workado, SHL, Cyderis, you know, Reflection, like a whole bunch of great AI NATO players and players in the industrial industry and medical industry everywhere across the board kind of find this out. And that's been a major unlock. So maybe in closing, you know, my my shameless ask to everyone is just, hey, you know, give us a try. You really just need, you know, maybe 35 minutes of your time and five days to run a POV. And we'll show you the risks and maybe the last thing I'll close in is like, you know, we've always found attacks in the inbox. Like every single time we've I've run dozens and dozens and dozens of these. We always find stuff. And so at very worst, you're gonna find out what threats exist in your in your uh inbox. at best we can maybe get you a a better level of detection on top of that. So you know, love for anyone who's struggling with this and and kinda resonates with some of the issues we talked about today to give us a try and and give give Aaron or I a call because we always love to chat.

57:30 Aaron Daily: Yeah, for sure. And you obviously you guys can see us at Borderland dot com. Um, to kind of look at see what we're doing. I know we got about thirty seconds left, but if I know if there's one more question that can be fielded that can take us like less than thirty seconds to answer, I know you got all those questions in front of you. You know, I'm gonna leave that to you. But I think at the end of the day, I wanna, you know, before that starts, thanks for joining, man. You know, beyond the inbox. I appreciate it.

57:52 Cy Khormaee: No, Aaron, well, thanks for having me. Always a pleasure to chat. You know, I by the way I can't wait to do this, you know, live at some point soon. So we'll have to do that next.

58:01 Aaron Daily: For sure, for sure. All right. Well, again, thanks again, man. And we'll we'll talk soon, absolutely know, as we as we go forward. And again, this has been Beyond the Unbox at Byborderland dot com. Appreciate guys. Yep,

58:12 Cy Khormaee: Thanks all. Bye.

58:13 Aaron Daily: thanks.