Fooling Your Friends to Make You Both Safer

0:00With the Spark Cash Plus card from Capital One, you earn unlimited 2 % cash back on every purchase. And you get big purchasing power, so your business can spend more and earn more. Stephen, Brandon, and Bruno, the business owners of SandCloud, reinvested their 2 % cash back to help build the company's retail presence. Capital One, what's in your wallet? Find out more at CapitalOne.com slash Spark Cash Plus. Terms apply. I always appreciate when thoughtful and luxurious design can help change the way a space feels. That's why I love how the 48-inch panoramic display stretches across the entire dashboard in my Lincoln Navigator SUV.

0:39It helps make it easy to stay connected while giving the cabin an open, expansive feel. Whether I'm juggling errands or just enjoying some quiet time, this feature brings a fresh perspective and helps elevate even the everyday moments. Visit Lincoln.com to learn more.

1:24different way. Modafinil works by stimulating multiple receptors in the brain associated with wakefulness, including dopamine, serotonin, norepinephrine, histamine, glutamate, and orexin. It's a more complete solution that gives you 10 to 12 hours of steady focus and energy. To learn more, go to mod.com. Fill out your intake form, meet with a licensed provider, and if approved, Mod Alert ships straight to your door. Go to mod.com to get started. That's M-O-D dot com. When demand slowed for HydroJug, Amazon Ads rising star Hayden Wadsworth pivoted. When our bank account hit near zero, my brother Jake and I had one last shot to save HydroJug.

2:08So we engineered the Traveler, a leak-proof, cup holder-friendly Tumblr. Amazon Ads enables a business to be able to expand their product shelf because of the visibility and the reach you can get. Each week, our new-to-brand customers make up about 95 % of all of our sales. Watch HydroJug's story at advertising.amazon.com slash rising-stars.

2:39This is the DT &S Weekend Edition, gratefully provided to you. And thanks for your support of this show. And this is part three of our October spooky cybersecurity awareness special. In parts one and two, we talked about what social engineering is, whether it was at the bars, on the streets or otherwise, what you needed to be able to do to resist it in the past, and why you still need to have those skills. And then last time we talked about what's changing now, the scampocalypse as the world of technology and large language models and machine learning and automation and simulation have changed the playing ground so that your old signals are not necessarily as reliable as they used to be.

3:25And this week, Brian Brushwood joins us once again to talk about what we can do about all of it. Brian Brushwood, welcome back. Thanks for doing this, man. Oh, my gosh. You know, it's interesting. We foreshadowed this moment, I believe, one full year ago. As we record this right now, I think I was fresh back from DEF CON where I had only just started poking around saying in every other adversarial deceptive art, there is some kind of there's this structure that we're about to talk about. Is anybody doing this? And I think I was at my fevered pitch, like somebody who just discovered a new religion.

4:01Yeah. And now you've gone to having a full wolfmasking.com website. You're preaching the good word about like, hey, man, you need to build up your reps. So let's start there. You know, what is the difference between what we do now? What are the things that we need to learn now that weren't good enough in the past? Okay. Well, what's interesting is like a lot of very true things, what I'm describing doesn't seem that extraordinary. And it seems like, oh, you're just copying blankety blank from another domain. So in this case, I was just lucky enough that I was in the right place at the right time.

4:38And I spent one week immersing myself in magic cultures, asking, what are you guys seeing in the world of AI deceptions? And I got a lot of answers. But one thing that I noticed was the moment one magician started talking about a new type of deception there at the bar, immediately, this whole anti-fragile network would spark up. somebody would overhear say, oh, did you hear what so-and-so tried with it? Have you tried it with the blue deck? Oh my God, you know, if you combine this with so-and-so, you get blah-de-blah. And I realized that that kind of, because magicians are addicted to new types of deceptions, we have no barriers.

5:13We want to be fooled. We're all chasing that high and there's no stigma, no downside to being fooled. That's what Penn & Teller's Fool Us is all about. It's not that they hope that they'll never be fooled, they're desperately hoping to be fooled. So if you think of magicians as a set, and if you think of deceptions as a pathogen, magicians have no PPE. We want to put every filthy deception in our mouths and spit it into other people's eyeballs. But along with that comes the fact that as a group, magicians are practically immune to deceptions. Any one magician can be fooled by a deception, but as a group, they are the gold standard.

5:54Just imagine if you could have that kind of immunity to deceptions inside of an enterprise organization. So magicians are doing the chickenpox party for deception. That's correct. That's correct. And again, it's a problem because a talented magician will create a new deception, bring it to market, and two to six weeks later, it's totally burnt. They can't sell it because magicians have not only learned it, they've tried it, they've gotten bored of it, and they can't be fooled with it anymore. Now, meanwhile, and part of the reason that magic has hit that level of maturity is because in 1584, the first magic book was ever published, The Discovery of Witchcraft by Reginald Scott.

6:37That was the beginning of magicians sharing their deceptions and, you know, wallowing in the pathogen. Meanwhile, when I went to DEF CON just afterwards, DEF CON, of course, number one cybersecurity spot. It's like Dragon Con for cyber deceptions. But cybersecurity as a crime is only 30 years old, which means there's a lot of structures that it has yet to grow back into. When I would ask people at DEF CON, what do you hear about AI deceptions? I was stunned by how highly siloed the information trading was. people would kind of obliquely reference different companies that they work for, or they would talk in riddles about the specific deceptions being used.

7:22And I was left with the impression that this was a very brittle environment. It's one in which there were huge stakes for being fooled, and one in which things needed to speed up and they needed rapid iteration. So when I asked around at DEF CON, the number one way, And again, this makes sense when it comes to first generation solutions is that they're doing essentially defensive driving videos. You watch a video, then you take a quiz. Then you have hypothetical knowledge. At some point you're tested. And if you fail, your punishment is you watch a video and take a quiz. And we keep on doing that because that is something measurable.

8:03We can have a checkbox to say, did you watch the video? Did you pass the test? Well, then what else can we expect to do? But this is where we enter the world of core inner reality, self-perception of ourselves, whether or not we bother to buckle our intellectual seatbelts. For example, imagine that you have a whole fleet of trucks and you know that seatbelts keep everyone safe. But the problem that you have is there's a bottom 20 percent. You're at risk drivers who have heard all of the warnings to buckle your seatbelt, but it's just not getting through to them. How do you get these people to engage in what's universally considered the best practices?

8:46How do you build an airbag? Now, just like actual airbags, they're a lot more expensive than seatbelts, but you don't need them for every single vehicle, right? You just need the ones for people who are habitually not buckling up their seatbelt. So in this case, if we just take what seems to be working in the world of magic and apply it into the world of cybersecurity deceptions, a lot of things reveal themselves right away. If we are talking about we want none of our frontline defenders to ever lose a chess match. So we're going to teach you all of the book openings. We're going to teach you all of the defenses and give you hypothetical knowledge.

9:28The next step is we'd probably have you play a few games of chess. If we're teaching Krav Maga, we would watch all the videos. MMA, we would learn all the punches and kicks and what. At some point, we're going to put you into a pit against somebody else because you must do the reps because hypothetical knowledge is the realm of system two thinking. And when you have plenty of time to engage in the deep logical cognition, you're fine. But of course, scammers don't play that way. They rely on those cheap punches. Remember our Daniel Kahneman, our thinking fast and slow. System one thinking only runs on memories and associations of what you yourself have lived.

10:11That's what we want to bridge. So the first step, just like any pathogen, is exposure. Now, you don't want to expose somebody to a dangerous pathogen, but you do want it to be the exact same shape as the dangerous pathogen, just with no stakes. And so that's what I've done, putting together wolf masking. Essentially, the metaphor that I got from so many people when I asked about, what are you doing about the AI apocalypse? They would describe, essentially they talk about their employees the way the way I might talk about sheep in a pen or eggs in a basket something where you've got this secure walled off environment your precious eggs are in there and then now you got this big gnarly AI that's supercharging the pathogens and meanwhile so you're having to extend the gates you're putting chain link fence up you're trying to block everything out.

11:05But eventually, this is all, think of PPE, if we're going to do virology as a metaphor. Your PPE is strong, but when - PPE being like your gloves and your masks and your protective equipment. Got it. Exactly. But we're not thinking about the fact that our teams are immunocompromised. Nobody is building up natural defenses because the way you do that is by having done the reps. Right now, somebody begins their current training with the role of hypothetical victim. They go through the training and they emerge with a new role of hypothetical victim. And their whole job is to think about all the ways bad guys can get inside the house.

11:50Meanwhile, I had a former bad guy here on campus, and I was so proud of all the security cameras and door locks I had or whatever. And then he said, yeah, but what if somebody went to the other neighborhood across the way and then belly crawled up seven acres of the back property and approached from the back? You don't have any cameras there. And I said, why did you ask that? And he said, because that's what I do. That phrase is the magic phrase, because that's what I do opened up in my mind possibilities. If I wanted to teach you how to bring that security, rather than tell you all the ways bad guys could get inside your house, I might say, hey, Tom, let's go to Justin Robert Young's house.

12:31He's out of town. Let's go steal a cookie. And I'd take Tom over there and I'd say, go ahead, get in. And Tom would say, well, how do I get in? I don't know. How are you going to get in? Maybe he tries a few windows and then finally finds one that's open, goes and gets a cookie. Great. Let's go to my place. Oh, Brian, all of your doors and windows are locked up tight. How are you going to get in? But I did notice that the UPS guy, nobody bothered him when he went in and out. I'm going to put on a UPS guy's costume. So he does that and gets inside Brian's house. Now we go to the third house. I say, what about this one, Tom?

13:00Tom says, oh my God, this house is Swiss cheese. I could go in this way. I could go in that way. The neighbor doesn't even care about that. That's your house, Tom. That's what it feels like when you have access to that phrase because that's what I do. A little bit of mild, safe sandbox, fast role play, modeling as the attacker creates a mental model that lives in that system one thinking that is automatic and always on. Episode prep gets messy when research, Slack threads, and script trackers are all in different places. That's where ChatGPT work comes in. Give it the goal and connect to the tools where work happens, like apps and files, and it can help pull the pieces into a draft you can review without you having to re-explain the project at every step.

13:49For example, ChatGPT work can gather team feedback from Slack and use it to suggest updates to a project brief in Google Docs. You stay in control reviewing the draft and deciding what moves forward. Put ChatGPT to work on your most ambitious ideas and projects. Get started at chatgpt.com by selecting work mode. Available on Plus and Pro plans. Being a serious business owner takes hard work, patience, and a drive to keep moving forward. So it's important to find a serious business card that goes the extra mile. With the VentureX business card from Capital One, you earn unlimited double miles on every purchase.

14:28And with big purchasing power, you can spend more and earn more. This is your sign to take your business to the next level. The Capital One VentureX Business Card. What's in your wallet? Terms apply. See CapitalOne.com for details. You save. You invest. You keep an eye on spending. So why do your finances still feel so complicated? Quicken helps you put the whole picture together and make sense of what to do next. Connect accounts from more than 14 ,000 financial institutions and see how all the different pieces of your financial life fit together. With Quicken, you can make sense of your options and decide what to do next.

15:03Quicken. Know what to do next. See how at Quicken.com. Mod.com is changing the way people battle excessive fatigue. Ever hit a wall in the middle of the day and a third coffee just doesn't do it anymore? Here's what's actually happening. Coffee only briefly blocks adenosine, the chemical that tires you out. When it stops working, your system is flooded and you crash. Modafinil is a prescription treatment that works in a completely different way. Modafinil works by stimulating multiple receptors in the brain associated with wakefulness, including dopamine, serotonin, norepinephrine, histamine, glutamate, and orexin.

15:44It's a more complete solution that gives you 10 to 12 hours of steady focus and energy. To learn more, go to mod.com, fill out your intake form, meet with a licensed provider, And if approved, ModAlert ships straight to your door. Go to mod.com to get started. That's M-O-D dot com.

16:07500 orders a month was manageable. 5 ,000 is madness. Embrace intelligent order fulfillment with ShipStation, the only platform combining order management, warehouse workflows, inventory, returns, and analytics in one place. What used to take five separate tools ShipStation does in one. automate fulfillment and rate shopping to ship up to 15 times more with up to 90 % savings. Go to shipstation.com and use code audio to try ShipStation free for 60 days.

16:39Yeah, this really brings up the phrase treating the disease, not the symptoms. The previous training was telling you, don't click that suspicious link. Don't install suspicious software. but it wasn't really helping you identify things that are suspicious. The assumption is, well, you'll know that it's suspicious. And what you've been telling us over the past two weeks is we know less now about what is suspicious than we ever have because the suspicious people can look perfectly normal. And you do have to click on links sometimes. You do have to install programs. You do have to answer the phone and talk to people.

17:20And so what I love about what you're saying is you need to practice being able to tell the suspicious from the non-suspicious. Think about that. We practice all the time recognizing threats. How many times do we drill telling somebody no? There are these red team penetration testers who get paid gobs of money to come in and bully their way into somebody's room and stick a USB in a drive and said, gotcha. Now, of course, that's terrible and you don't want that to be possible. However, what did you expect? This person has never defended an actual attack before. And even better would be if they performed an actual attack.

17:59Again, if I'm a CEO, I don't want anybody off playing games or wasting time. This is why you want to be extremely time sensitive about sandboxing your events. But no matter what the deceptive pathogen is, there are four steps. I'm doing the second year of this program with Clemson University. Last year, it was a pilot program. This year, we're expanding it. We have a control and a test condition. We intend to get data that shows that using wolf masking by actually playing as the predator creates a deeper understanding and a more intuitive, locked-in, defensive posture. So in other words, I, the person learning how to tell the suspicious person, get to pretend to be the suspicious person?

18:40Exactly. Exactly. And now in doing so, you build a memory set. And what's great is, of course, it's very intimidating to tell people you're going to get good at writing. Let's take phishing, for example, writing phishing emails. But if you break it into itty bitty pieces, in other words, just like I taught magic at a magic camp, you got to get people over the hump. You have to get them from zero to one. So what I do is I tell people, hey, we're going to write the world's easiest phishing email. All you're going to do, you're going to send it to brian at schwood.com. And then the title is going to be, uh, uh, my first phishing email.

19:14And it's going to say the following here is a serious document, serious document.pdf sincerely yours, serious man.fr. Great. You did it. Now at this point, that's looks like a serious document, but of course we're going to make it not a serious document. If it was a real bad guy, it would be a threat. But instead I just want you to go find a silly, hilarious dog picture, Extra bonus points for creativity on this one. So now everybody's like, well, I don't know much about fishing, but I know funny dog pictures when I see them. And just like that, boom, all of a sudden I got 80 emails in my inbox from all of these 18 year old children who had never written a fishing email and now they had.

19:51And so some of them were very obvious, freemoneyifuclick.com. And then some people would link to the website instead of the image. And all of those people, this is the important part, Tom, They got corrected by me, not by a system, not by a synthetic shit checklist. But instead, I wrote all of these emails back saying, you did really great. That was a really creative thing. But here's how you do the proper hyperlinking on all that, which brings us to day two. Day two, we're going to enhance. This is the next week. These are 15 to 30 minute lessons. So we began by celebrating the parts that people had control over.

20:30We began with the first 15 minutes. Yes, we talked about who got it right and who got it wrong, but we spend most of the time talking about the creative wacky gotcha images that everybody did. Psychologists call this the nurtured heart approach. Basically, if negative reinforcement isn't working, what you have to do is alter the monetary supply of praise. So for 15 minutes, everybody who their hilarious image got featured feels the warm glow of the spotlight. Everybody who doesn't thinks maybe I'll try a little bit harder this time. And in the second lesson, that's when we talk about those psychological backdoors.

21:05That's where we talk about, I want you to actually try to fool me, Brian Brushwood, not a hypothetical target. When this happens, people got really good. They started writing emails that said, Mr. Brushwood, I really enjoyed your presentation. My uncle runs a cybersecurity conference. Would you like to be the keynote speaker? Just click on this Google Calendar app and then a gotcha image. Another one might say, oh, did you notice that this was on over your shoulder? Or this one said, there's a security incident. Look at this suspect image. Is this you, sir? They found my old promo photo, right?

21:38By owning the task, even in a playful way, they're deepening their sense of identity. And we're getting access to that most intimate of thinking spaces where they think about who they are, what they're capable of. We're getting closer to unlocking that magical phrase, that's what I do. Finally, in the third step, we come back. We again spend 10 minutes praising the ingenuity and cleverness of all of these pretexts. We don't even call them pretexts. We're like, you got me. That was so clever. Good story. And then suddenly they're punching up each other's methods, coming up with even better ones in anticipation of the third step, which could be the end if it's in a corporate event.

22:17Everybody writes an email to fool their coworkers because you don't know much about Brian Brushwood, but you guys know a lot about each other. You know what all your anxieties are. You know what pressures you're under. You know what thing might be able to slide in and not get noticed. And at the end of that, at that point, if you're an enterprise organization, imagine that could be the end because you now have a real-time heat map of everybody's anxieties, all of the exposed levers that outsiders can pull on you. In the case of the Clemson students, they came back with accusations of academic fraud, use of AI, loss of parking privileges, because they're$300 passes.

22:58And most importantly, the one that snuck up on me, one third of them were about FAFSA requirements, student aid deadlines. That was a latent, wide point of anxiety that might've been totally invisible. Now, if you're an enterprise organization, to get that level of understanding, you'd have to hire a fancy red team penetration tester who would work from the outside in. But by setting up these incentives, the only way you can deceive someone else involves tattling on yourself. So all these students are tattling on their biggest anxieties, which could be incredibly valuable. And then finally, we get to the third part, defense and awards.

23:37This is where everyone's told, okay, you've made your attack email. We're going to send them out to each you guys. We're going to pair you up randomly. If you fool somebody for each person you fool, you'll get one point, but you'll be the target as well. And for each person you catch in the act of getting you, you'll get two points. And then the winner will get a big, fat, fancy reward. So now for one week, and again, safe, sandboxed, and bounded, they know to be on the lookout for gotcha images. They don't want to click on it and see that gotcha image. And so now the number one side effect, Tom, of us playing this game was that people with false positives, or in the case of phishing emails, they caught actual phishing emails that were attacking the university and they were reporting them thinking, oh, I'm just trying to win this.

24:27Yeah, yeah. Being a serious business owner takes hard work, patience and a drive to keep moving forward. So it's important to find a serious business card that goes the extra mile. With the VentureX business card from Capital One, you earn unlimited double miles on every purchase. And with big purchasing power, you can spend more and earn more. This is your sign to take your business to the next level. The Capital One VentureX Business Card. What's in your wallet? Terms apply. See CapitalOne.com for details. Support comes from WISE, the smart way to manage the currencies you need around the globe.

25:03Fed up with losing out to hidden fees when you send money abroad with your everyday bank? Choose the smart way. WISE, you can count on the exchange rate you'd usually find on Google. No unwelcome surprises. Plus, ditch that where's my money feeling. Most transfers arrive in under 20 seconds. Join millions saving billions on hidden fees. Be smart. Get wise. Download the wise app today. T's and C's apply. So in other words, the thing that everybody desperately hopes for, that people stay vigilant, becomes a side effect of this process. And on the other side of it, you are not handed the role of a hypothetical victim, just like all the other trainings.

25:46Instead, you are a former predator. You are an experienced deceiver. I got to work on that, that, uh, those initials there. But the important part is that they have access to that phrase. That's what I'd do. And keep in mind, that's just for phishing. Let's say next quarter, you wanted to do a different one. Let's take whatever's in the headline. Let's say it's voice phishing, fake emails, the same game, zero to one. We're going to learn how to use 11 labs and make an alien voice. Now we're going to enhance it. We're going to steal the voice of your CEO. Take about 30 minutes. We're going to do player versus player.

26:23You're going to order a pizza pretending to be somebody who you're not. It's going to feel electric and exciting, but secretly the stakes are going to be zero. And then finally defense. You'll have to catch the bad guy in a lineup at some point when it sneaks up on you. All of these, whatever the deceptive pathogen is, my job is simply to defang it like a flu vaccine, predict where the meta is headed, and just run whoever the bottom 20 % is that are having trouble, give them a high-calorie, exciting adventure, and let them emerge the other side, having played as the predator. One of the things I loved about this idea when you first told me about it is it gets you in the habit of avoiding something that is harmless, right?

27:08A picture of a funny dog or something like that because you don't want to be on the record as being caught in that PVP game, which means you're now avoiding real ones too because you're teaching yourself not to click, not to fall for it, not to answer, not to give the information, whatever it is. That kind of practice is something that people never get. They get told, don't do this. They never get taught. They never experience it the way you've been talking about it. And I think that's invaluable here. What is the key to making that work? You've given us a lot of the keys along the way, but if somebody's saying, look, Brian, this is great.

27:54I'm going to recommend this to my company, but I also want to do this with my family at home. Can I pull it off that way? Well, eventually, I can see after everything in order, of course, I'm going as fast as I can. Once we have the data that shows that there's a profound difference between conventional training methods and this one, which, again, maybe for some reason, cybersecurity is different than self-defense or cognitive defense or any other metaphor that you want to put in there. But I suspect not. Once we have the data, we'll be able to do enterprise cases. And eventually, what I would love, what I am most concerned about are our aging elders who right now, if you are a member of Gen Z, like the two of us, we are very busy.

28:38Gen X. Oh, sorry. Yeah, sorry. I know you want to be a member of Gen Z. Yeah. Oh, man. I don't know if I would fit in with Gen Z right now. If you're a member of Gen X, then you probably have aging parents and you are their only technological point of contact. So right now, when they get something that they think may or may not be a scam or is on the cusp, you're the only one that they know to call. And they know they have a limited number of coupons to make their questions your problems. they don't have anybody else to call. And so after a little bit, you just end up kind of caught in a web of convenience and eventually a lot of money goes away.

29:18So what I can picture is wolf masking cohorts for retirees. So Gen Xers, you could almost, there's a little bit transactional way to think of it. It's almost like insurance for your inheritance. None of us want to find out that our parents got scammed and that we're not going to receive as much as we thought. And I can imagine a situation where cohorts of 100 elders at a time come into Zoom meetings. They go through a little wolf masking exercise, one, two, three, four. After a month, they've now done phishing. Now we'll do other things. But most importantly, the real value is that cohort now becomes their own point of content.

29:57They discover the joys of being part of a Discord community. Remember what I said. It's very difficult to penetrate the five-member node network of the Brushwood family because all of those connections are strong. If your parents were part of a cohort of 20, 30, 50 other folks who they could name by name and they're establishing status by saying, oh, look at this one I caught, or this guy, this guy didn't even try to hide the fact that he, you know, I right-clicked on this, look at the mime pathway or whatever technical mumbo-jumbo. The point is, they now have somebody who isn't you that strengthens them.

30:37The reason Penn and Teller are so difficult to fool is not because they're good magicians. It's because there's two of them. If it was only Penn Jillette, you would triple or quadruple the number of times he got fooled. Same thing for Teller. But the two of them, just with two nodes in that network, get closer to that magical, unfoolable gold standard that is the entire set of magicians writ large. The one thing I want to really remind people listening to this is it's very easy, at least for some of us, to say, like, right, other people get fooled. And the thing that has been impressed upon me by every top tier reporter in the technology world who's ever gone into reporting on scams is they come out more scared of getting fooled themselves once they see what's happening out there.

31:27And so you really need to remind yourself, I also can and probably will get fooled at some point. And so building up these kinds of defenses and awareness, I think, is incredibly important. Do you play with this with your family at all? Do you do this internally? I mean, I'm too busy trying to codify what has been largely intuitive. You know, we certainly are a very playful family that does a bunch of bits. We love mind games, you know, basically the equivalent of, you know, the circle game where you try to trick someone into looking at the circle and you get to punch them in the arm or Rick rolling.

32:07As a matter of fact, if there's anything that gives me confidence that I'm onto something here, it's that if you open up an original copy of Dungeons & Dragons, page one by Gary Gygax, he says, hey guys, Dungeons & Dragons is just let's pretend with rules and dice. All I'm doing with wolf masking is rickrolling with rules and dice. I am respecting the company by keeping it safe, bounded, exciting, high energy, dopamine, and exciting, but also bounded and sandboxed So it's not a distraction. It's an inoculation. Yeah. This is incredibly valuable. Thank you for sharing so much of this with the audience.

32:45If you want to leave people with one thing to think about or one thing to know, what would it be?

32:53Don't wait. Don't wait. Because the bad guys have already started. And what I hear from a lot of people, the number of meetings I've had that are very similar to this series that we've done, there's always an aha moment. and then their mind encounters all of the friction and difficulty around that stuff. Does it work with the so-and-so system or blah, blah, blah? The wonderful news is that doing something doesn't require any change in your current organization. It is unbelievably short. What I have proposed, for example, there's one enterprise company that's like, we love it. What technical demands do you have?

33:31And I said, it's one thing, but it's very important. Just one internal email address. That's it. That's all I need. Yeah. And you are the dungeon master in the Gary Gygax example. And you need the good DM if you want it to be a good campaign. You know what? That's a good way to put it. We're in stage two of this. Stage one was, I write the words Al Gore. That's where I ran around banging the drum about the scampocalypse. And I showed off my hockey stick graph of fraud. Now we're in phase two because before Gary Gygax could sell monster manuals, he had to do a bunch of playing of Dungeons & Dragons to figure out the best practices.

34:08And all of it just revealed itself. Oh, it turns out 72 races of elves is too many. And three is too few. Oh, I guess we should lean on Tolkien and all that stuff. After playing the game and doing the reps, Gary Gygax was eventually able to make it scalable, which I expect to happen depending on how fast. I burned through these pilots. What right now is a high-touch, high-energy, Brian writes a lot of carefully thoughtful things. Eventually, that becomes a data set one year from now, which becomes an LLM to encourage anybody to play this at home. And you don't need me. This is not rocket science.

34:45Yeah. But until such time, where should people go to find out more about this and maybe get in touch with you? If you want to book my keynote, my flagship keynote talk, it's very good, Social Engineering 101. Just go to scampocalypse.com and fill out some information. Tell me about your event. You can write me directly at brian at schwood.com. Essentially, there's two faces to this. If what you like is if you appreciated the way I've said all this stuff, I'd be happy to give this talk at any event that you have. I have a very, I don't know if you've heard, but I've got a pretty good stage show.

35:17So then meanwhile, if you're a believer and you want me to start leading exercises inside your organization to toughen up your defenses, let's talk about wolf masking. Just head on over to wolfmasking.com. It looks very corporate. Fantastic. Brian, this has been so much fun sitting here and playing around with this idea that is fun to play with. It's fun to think about and also worthwhile. It's going to protect people. So thank you for doing that. Thank you so much for the opportunity, Tom. I know I sounded like a raving madman one year ago, but all the bricks are falling into place. No, absolutely.

35:54Appreciate it. And thank you, everybody, for joining us and supporting the show. If you haven't already, you can support the show directly at patreon.com slash DTNS. It's what makes it so that we can do these kind of episodes. And of course, we're always breaking down the news of the day, which we do Monday through Friday. So be here for that as well. Have a great weekend, everybody. I hope you had a good Cybersecurity Awareness Month.

36:23The DTNS family of podcasts. Helping each other understand. Diamond Club hopes you have enjoyed this program.

36:35With the Spark Cash Plus Card from Capital One, you earn unlimited 2 % cash back on every purchase. And you get big purchasing power so your business can spend more and earn more. Steven, Brandon, and Bruno, the business owners of SandCloud, reinvested their 2 % cash back to help build the company's retail presence. Capital One, what's in your wallet? Find out more at CapitalOne.com slash SparkCash Plus. Terms apply. Your daily supplement routine doesn't need to be managing a handful of different bottles. Onnit's Total Human brings key research-based vitamins, minerals, herbs, and amino acids together in convenient day and night packs.

37:15One all-in-one product designed to make supplementation easier. The day pack supports cognition, focus, and cellular energy production. At night, the night pack helps you wind down and supports a calm, relaxed state. Less time managing your supplements, more support for your day and night. Shop Total Human now at onnit.com.