Episode Transcript
[00:00:00] Skip Mann: The bad guys or the attackers don't care about organizational charts. Security teams tend to separate cybersecurity, physical security, supply chain security, resilience, and operational risk. Attackers don't do that. If somebody compromises a supplier, steals credentials, introduces malicious code, or disrupts operations, you look at it, was that a cyber incident, a supply chain issue, or a resilience problem? The answer is yes.
VO: From KBI Media, I'm Karissa Breen, and this is KBKast.
[00:00:38] KB: My guest today is Skip Mann, Lenovo's Vice President of Enterprise Security Strategy, Assurance & Trust. He built the team that sits across the table from its most skeptical customers. We talk about why trust has to be proven rather than claimed, and what it means to be scrutinized harder than your competitors because of where you're headquartered and how anyone keeps up with due diligence when the technology is moving faster than their ability to check it.
VO: If you find these conversations useful, hit follow. It's the single best way to make sure the next one lands right into your feed, and it helps other execs find the show. Alrighty, let's get into it.
[00:01:20] KB: Okay, so Skip, I want to start with Lenovo operates across 180 markets with thousands of suppliers and more than 30 manufacturing sites. Now, at that scale, is trust something you can genuinely verify, or would you say every global technology company eventually relies on assumptions? It can't completely test.
[00:01:43] Skip Mann: I actually think people sometimes ask the wrong question here. I think the question is really not whether you can verify everything because nobody really can. The real question to me is whether you've built a system that can continuously validate trust. If you look at Lenovo, we operate in 180 markets. We work with thousands of suppliers and manufacturers. We manufacture products across the world. So at that scale, trust can't really be based on assumptions, but it has to be based on governance, controls, accountability, and really evidence. So this is something that really struck me during a recent trip to Australia. About three weeks ago, I met with organizations across the Australian federal government that were responsible for national security, law enforcement, defense, aviation, safety, and also census and other major public sector operations. And what really surprised me was that despite having very different missions across those organizations, they were all really wrestling with the same questions. How do we know what we can trust? How do we trust suppliers? How do we trust increasingly complex technology? And how do we trust AI? And I think in my mind, that reinforced something I believe for a long time, and that's trust isn't a marketing message. It's evidence really when you boil it down. So that's why we spend so much time focused on supplier assurance, traceability, security reviews, governance, and transparency because we view trust as being earned, right? And that's sort of the Lenovo mantra around trust.
[00:03:26] KB: Okay, so the operative word you said there, Skip, was evidence. How does someone, like, how is there evidence? Because everybody comes going to say, well, look at all these things that we're doing and there's trust and trust us and all this sort of, to some people would say, maybe virtue signaling, but I'm curious on that. And the reason why I ask you that question is because what I'm hearing now from folks like yourself is the whole trust element has made a bit of resurgence. Even like five, six, 10 years ago, everyone was talking about it, then it sort of died down. And now it's very top of mind in all of the interviews that I'm doing at the moment.
[00:03:58] Skip Mann: Yeah, so when I talk about evidence, right, and I'll frame this in terms of how Lenovo approaches this, as you look at my title, right, I'm responsible for security strategy, assurance and trust. Now, from an assurance lens, right, think about that in terms of governance, risk and compliance, but look at it through an assurance lens, right? So the way I define it is when you look at GRC, that's the minimum standard that you need to comply with, right, from a governance, a risk and compliance perspective. But when you look at things through an assurance lens, I tend to define that as effectiveness beyond compliance, right? So when you look at our GRC team that reports to me, they look at things through that assurance lens. The evidence I'm talking about is evidence from the standpoint of all the certifications that we hold, the NIST standards that we align with, and other global standards from the standpoint of geospecific things such as the European Cyber Resilience Act, the EU AI Act, NIST 2, we meet Korea standards, Japanese standards, et cetera, across the different geographies that Lenovo operates in. So when I talk about evidence, I'm talking about that hard evidence that we're aligned with those international standards, with NIST standards, et cetera. So I think that that gives you the source of truth from which our customers are doing their due diligence. And we obviously have tools that we house all of our evidence and our source of truth. And that really is where I see building that trust, right? And that's how you earn that trust from that perspective.
[00:05:34] KB: Yeah, that's interesting because I think perhaps people have just sort of said it anecdotally rather than having the facts and the evidence to back it up. Would you say nowadays people are maybe trawling through a lot of this evidence that you touched on before? Do you think it's like, even if yourself, Lenovo says it, do you think they go and do the extra due diligence on that? Or do you think they're like, okay, we understand what you're saying and enough?
[00:06:00] Skip Mann: Yeah, absolutely. I mean, our customers span the gamut from public sector to highly regulated industries like oil and gas or financial services to, you know, large enterprises to small and medium businesses in below. So I think from that perspective, right, it does not matter what size the customer is, we're finding that our customers are using those tools out there like SecurityScorecard and Black Kite and others, as well as, you know, using their own methods for due diligence and risk management essentially is what it boils down to. So yes, absolutely. I think I'd be worried if customers were not asking those hard questions from that perspective.
[00:06:39] KB: And would you also say in today's climate, customers are more scrupulous about things now than perhaps they were even 10, 15 years ago? And in particular about certain things?
[00:06:50] Skip Mann: Yeah, they are. They are. I mean, I think, you know, again, when you look at the security enterprise here at Lenovo, our security enterprise rolls up to a chief security officer, Doug Fisher, and whether it's direct reporting or matrixed across cyber and information security products and services security, supply chain security or physical security, you know, our customers are asking the hard questions across the gamut of security enterprise. So I think it ties back to the fact that we have a source of truth across all of our security functions. And I think that's what separates us from the rest from the perspective of taking that holistic approach to managing the security enterprise under one hat, filtering all of that security enterprise risk up through one senior executive up at the board level. So I think that that is what helps Lenovo in terms of the scrupulous customers out there that are doing this very, very difficult due diligence because it's not easy to really dig into a company. And I think when you look across the spectrum of the security functions, I think customers are not leaving any stone unturned. We even get physical security questions where, you know, in today's day and age, cyber seems to get all the limelight, but, you know, physical security is as important as the other security functions.
[00:08:05] KB: And would you also say because of, like you said, customers, there's no stone unturned, scrupulous, equally yourself, Lenovo is doing all the work to support that. Do you think that as a byproduct of both parties doing each of their respective roles, if they engender trust as a result of that?
[00:08:25] Skip Mann: Yeah, I would say yes. I mean, when you look at it, right, that GRC team that I lead, they are the focal point for our enterprise risk management function. So when you look at the risk across our security enterprise, all of that risk is filtering up through the chief security office here. And I think that does help us sort of holistically look at the risk sight picture across all risk and make those hard determinations around whether to remediate, mitigate, accept that risk from the perspective of our chief security officer and or our board of directors.
[00:09:01] KB: There's something else that you mentioned before around the convergence between physical and cyber equally have equal footing. So I want to talk about that a little bit more. Would you say that creates stronger accountability or one enormous sort of risk function where responsibility becomes harder to locate when something fails?
[00:09:25] Skip Mann: Yeah, I mean, if you can look at my LinkedIn, I very much am a huge proponent of operational resilience, convergence, et cetera. And I think one thing I've learned over my career, whether it was in my government roles, the military or here in the private sector, is that the bad guys or the attackers don't care about organizational charts. Security teams tend to separate cybersecurity, physical security, supply chain security, resilience and operational risk. Attackers don't do that. So if somebody compromises a supplier steals credentials, introduces malicious code, or disrupts operations, you look at it, was that a cyber incident, a supply chain issue, or a resilience problem? The answer is yes. I think it's all of them. So when you kind of tie that back to the customers, right? I mean, customers experience risk as a single event. They don't care which internal department owns it. So that's why I believe that security leaders increasingly need an integrated view of risk. I'm not saying that that doesn't mean that everybody owns everything. It really means somebody has to connect all of those dots.
[00:10:38] KB: And would you say people are connecting all of those dots? And to your earlier comment, integrated view of risk, would you say that's now more of a, not a newer function, but a way in which companies are looking at overall, including like even AI to some degree in this as well? Like I'm hearing that it's not just AI and tech and cyber and physical. It's like kind of just one whole function now.
[00:11:02] Skip Mann: Yeah. I mean, I think part of the trust function that I lead is we spend a great deal of time with our customers, partners, stakeholders, supporting government relations and such. In that capacity, we talk to hundreds and hundreds of customers on an annual basis. And I would say that you've got varying levels of that across the different public sector versus private sector versus highly regulated, etc. As a whole, organizations are moving toward that sort of integrated trust and risk-based approach to things. I think again, with every subsequent, whether it's human made or otherwise, I guess, all hazards, events, there's a lot of lessons learned that we glean from those things. And I think it all points toward the convergence of trust, the convergence of risk, etc., within organizations because you can't buy down all the risk in an organization. It's just, you just can't do it. Not only a fiscal perspective, but from an operational perspective.
[00:12:07] KB: So now I was going to go back for a moment and talk about governments. So governments view technology supply chains through a national security lens. So as a company with deep roots in China and customers worldwide, for that matter, how does Lenovo prove that geopolitical pressure can't be compromising its products, as well as data and overall decision-making? Anything that's a really important question given what's happening in today's climate?
[00:12:37] Skip Mann: Yeah, absolutely. I mean, that's the question of the day almost always for us. I actually understand fully why customers ask those types of questions. If you're deploying technology in critical environments, you have to ask those tough questions. Like I said before, I'd be really concerned if customers weren't asking those questions. What I generally tell people is don't trust Lenovo because Lenovo says we're trustworthy. Look at how we're governed. Look at our security programs that I mentioned. Look at our certifications. Look at how we manage our supply chain. Look at our transparency. Look at how we respond when issues arise. Trust isn't ultimately earned through a presentation. It's earned through the behavior over time, as I've been sort of outlining, right? So customers should evaluate every technology provider that way, in my opinion, because I think you've got to do your due diligence from that perspective. And the more due diligence you do, the more you understand whether a company actually is putting the money where its mouth is.
[00:13:38] KB: That's a good observation. But would you say, then, in terms of the behavior over time, what was what I sort of was thinking in my mind as you were talking there, because of how fast things are moving, do you think that sort of compromises people's ability to track companies like Lenovo in terms of behavior over time? And I caveat that with saying, because everyone's like, we've got to do all these things. We've got to beat our competitors. We may not have time to do all the DD in any sort of protracted amount of time. So how do people sort of manage that by not compromising on the trust, but ensuring that, of course, we're still moving to stay ahead of our competitors, for example?
[00:14:15] Skip Mann: Yeah. I mean, I think that's one of the best questions that customers can ask because too often people ask whether a company is trustworthy. I think the better question is, is show me the evidence, sort of circling back to the evidence, right? I mean, show me your governance, show me who's accountable, show me how decisions are made, show me your secure development practices, show me how you manage your suppliers, show me how you respond to vulnerabilities, show me your certifications and independent assessments. And we actually lean into these questions and these sort of levels of due diligence, because we encourage our customers to ask those hard questions, right? Some customers will want to just get on a call and do due diligence through a Teams meeting or a Zoom meeting, but I think that allows them to really hone in on whether we're just providing smoke and mirrors or actually supporting things with evidence. So again, I think what customers really want is to know that trust is not just a slogan and it's supported by evidence, right? I know I keep circling back to that, but it is so critical in this industry in today's day and age from that perspective.
[00:15:28] KB: Okay. So staying with the evidence then for a moment, would you say, and again, this is a general question, would you say that potentially there are other companies or vendors out there that aren't perhaps showing the evidence? So would you say showing of the evidence and supplying all the stuff, all the details, is that going to become very standard wave operating now? So if you want to win X deal or contract, this is part of it. Maybe in the past it wasn't as to your point scrupulous, but now it is, from what you're saying.
[00:15:54] Skip Mann: Yeah, we're absolutely seeing that, especially in some of the contractual verbiage that we're faced with, responding to with, through tenders and RFPs, RFIs, et cetera. Customers are actually building these sorts of levels of due diligence into the contractual requirements for the technology companies out there. So yes, I think that's absolutely the case.
[00:16:16] KB: We'll come back to that after a quick word from our sponsor.
[00:16:20] KB: I'm known for being direct. Let's be honest, nobody gets into technology leadership for the compliance paperwork headache. But if you're building or scaling a tech company, security frameworks like ISO 27001, SOC 2, Essential 8, CPS 234 or GDPR aren't just tick box exercises. They are business critical. That's where Vanta comes in. Vanta automates up to 90% of the work for security and compliance, helping you get audit ready in weeks, not months. It integrates seamlessly with your tech stack so you can spend less time chasing documentation and more time leading innovation. If you're a CTO, CISO or head of security, it's worth taking a closer look. Visit Vanta.com forward slash kbkast.
[00:17:15] KB: And then going back to the accountability side of things. So one thing I've observed is at the moment, it's kind of like that pass the parcel. It's a hard question to answer because there's context there. How is that conversation being held within your business? And again, I say this because we've seen cases of if something is compromised while it was the vendor's agent, for example, but we're still operating it. So is it kind of like the vendor's fault or is it kind of the customer's fault? Is it joint company's fault? What does that look like? And this is something that I'm seeing come up a lot in interviews at the moment around accountability. What are your thoughts here?
[00:17:57] Skip Mann: My thoughts here, I'll sort of hone in on the Cyber Resilience Act in Europe. It's doing just that. ENISA has come down, the European Union has come down and said, if you're producing products in Europe, you need to meet our standard for the security of those products, for supporting those products throughout the life cycle of those products. I think that's critical. So when you look at it, any technology company, anyone selling technology in Europe right now, we've got September 11th approaching rapidly where there's an element of sort of the first phase of the CRA where we have product security incident response reporting requirements to ENISA. So we're starting to see this level of detail in legislation and new acts and new laws and such throughout the different geographies that we operate. So I think this is upon us. I think there's been some discussions out there around technology companies not being held accountable. When I look at my seven years at Lenovo, we've always held ourselves to a level of accountability, probably beyond the competition because we're scrutinized so much, whether it's through our acquisitions of U.S. companies or our JVs and such. I think just we're held to a different level of accountability because we are a Hong Kong-based business entity. I think we embrace that. We embrace the culture that is Lenovo, both that Eastern and Western aspect of our culture. I think it's fantastic actually because it just makes us a lot more diverse in this technology space whereas there's a lot of technology companies that are based in specific countries like the U.S. or Europe, etc. And I don't think they get that level of diversity within their organization to understand what those dynamics are globally from the perspective of delivering technology in those, for our example, 180 markets that we operate in.
[00:19:54] KB: Then you said before, there are some companies or tech companies that have not been held accountable. So what does that look like?
[00:20:02] Skip Mann: I want to qualify that. I'm not saying that they're not held accountable. But I think when you look at some technology companies, based on the fact that they're headquartered in either the U.S. or Europe or parts of Asia, they don't necessarily get the same level of scrutiny from their customers like Lenovo does. I want to be very transparent in what I'm saying here. Being that we're a Hong Kong-based business entity, we're held to a different level of accountability. That's just the way it is. Our company embraces that fully. We have a trust team out there that is comprised of former national security types that are out there having these conversations with customers because we're held to that different standard. I see that as a very positive outcome in almost every circumstance where when I can get my trust team in front of customers that have concerns, we almost always win. I keep metrics on this stuff. I mean, it's stuff that gets reported up to our Lenovo Executive Committee, to our board of directors. And it's very meaningful in terms of how we approach things and how we're very, very transparent and open with our customers and other stakeholders.
[00:21:10] KB: So is it known perhaps in the industry that Lenovo is held to a more like higher standard, more strict standard than perhaps like you mentioned before, like U.S. and Europe in places like that?
[00:21:20] Skip Mann: Yeah, I mean, I think it is. Our customers do the due diligence. There are things out there on the internet that sometimes shed a negative light on Lenovo. I think the positive piece of this is that I haven't found anything on the internet around Lenovo, whether it's positive or negative that can't be fully explained and can't be hashed out per se with our customers and stakeholders. Again, just circling back to it where we know that our competitors are waging campaigns against us. We're not the number one PC company on earth for no reason. There's a reason for that. I mean, we're providing quality products to our customers. We're backing our products with integrity. From a security perspective, we are supporting those products throughout the life cycle from product inception to manufacturing and supply chain all the way through the end of life cycle through our product security incident response, patches, vulnerability mitigation, etc. So I do think that it is known out there that Lenovo is held to a different standard. Earlier, I mentioned that we've gone through acquisitions of U.S. businesses. So when you look at it, if you're not familiar with it, the Committee on Foreign Investing in the United States exists to review all non-U.S. acquisitions of U.S. companies. So any company that is not headquartered in the United States must pass through a CFIUS review. When in those CFIUS reviews, they're looking at that proposed acquisition through a national security lens. And in that, the U.S. federal government is doing due diligence on that particular acquisition. And then when you look at Lenovo's history, starting in 2005, when we acquired the IBM PC division, we went through a CFIUS review. We've gone through actually seven or eight of those at this point. The most recent was the Infinidat acquisition. I actually serve as the security officer for that acquisition. When you look at Lenovo, we continue to be vetted by the U.S. government through the CFIUS review process. We were held to that standard of U.S. national security. And we continue to be approved for acquisitions and investments and such when it comes to the CFIUS Committee. So again, the reason I'm saying this is that is another proof point where our competitors don't necessarily have to go through CFIUS reviews because most of our competition is either headquartered in the United States or elsewhere where they don't have those implications if they want to go acquire a U.S. business and such. So that's a good differentiator for Lenovo because we continue to be vetted by the U.S. government through the CFIUS process and we continue to be allowed to acquire new businesses each and every year.
[00:24:09] KB: I'm going to talk about products now. So as we know and as you know, security begins before the product reaches a customer, for example, and it doesn't end there. So I'm curious to know, can Lenovo prove the integrity of every component firmware update, supplier intervention throughout a device's lifetime? Or would you say there are points in that chain? No manufacturer can fully see. Now, I've spoken to people in the past, for example, like a router at home. This is just an example. People say we can do all of these components, but the actual cord, we have to manufacture in China. We can't do it elsewhere. So that's an example of one component perhaps not having full transparency. And I know that seems minor, but it's just to give a little bit more view on what I'm sort of trying to get at.
[00:24:59] Skip Mann: I think what that boils down to really is, I mean, when you look at product and supply chain, they're both integrated. They both rely on each other. I think it really boils down to supply chain resilience. I think supply chain resilience depends on visibility, preparation, and really the ability to make decisions quickly when conditions change. So when you look at the Lenovo context, we combine a global manufacturing footprint with supplier assurance, logistic security, business continuity practices, and artificial intelligence enabled supply chain capabilities. So when you look at Lenovo being recognized in the Gartner top 25 supply chain year over year, and we keep moving up in the rankings, I think this year, we achieved our highest reported global ranking of all the years that I've been here. I think that recognition is useful. But to me, the real test is operational performance across product and supply chain and manufacturing. Can the organization identify disruption, understand the impact, make an informed decision and continue supporting customers? And I think really that's where, again, circling back to resilience, that's where the resilience really becomes tangible.
[00:26:10] KB: So then when you say quickly when decisions need to be changed, so do you think as well, because things are moving so fast, it's hard for customers to keep up, keep their head above the water? Would you say that's a very big driving factor for businesses like Lenovo, for example, because even in media, it's like every day I wake up to something new out there, we can't possibly cover everything in the world because there's just so much going on. So then imagine what a customer feels like. They're not even doing this stuff each day. They've actually got to keep the lights on in their business, and there's so many changes that are occurring.
[00:26:43] Skip Mann: Yeah, I think this is where that resilience comes in. Again, just going back to using that CRA example in Europe, technology companies, they need to be accountable for what they're doing. The products that are producing, the services that they're providing, I think it comes down to the fact that when you couple just from an industry perspective, having the integrity to assure that your supply chain resilience is at the level it needs to be, the fact that you're baking in security from product inception throughout the manufacturing supply chain and lifecycle of the product. I think an example of that that I haven't shared yet is that when you look at in the US here, you've got the CISA under the DHS that we're a member of the Joint Cyber Defense Collaborative. We've signed the Secure by Design Pledge where in Australia, I met with one of the national security agencies and they invited us to some of the public-private partnerships that they offer. So it takes a village, so to speak, when it comes to this stuff where we get along very well with government agencies. I mean, we are here to support them. We sell to them. We join public-private partnerships, any chance that we can get. It's very important to have those public-private partnerships as governments are driving new legislation, acts, and things of that nature. It's very critical for private industry to be part of that legislative promulgation process to whatever extent that will be allowed because I think, again, it doesn't do anyone any good in this industry from a technology perspective to have zero-day vulnerabilities out there in the wild. That's why we have coordinated disclosure processes and things from a product security incident response perspective. Kind of circling all the way back to this, we feel it's our responsibility to ensure that customers have the evidence that they need to make those risk-informed decisions around the products and services that they're purchasing. It's critical because like you said, there are customers out there that just don't have the bandwidth to do the level of due diligence and to provide the level of scrutiny on technology companies that they probably should be doing. Again, that's why we're very open and transparent. That's why we have a trust team that is out there in the external realm, meeting with customers, partners, partnering with government relations, and really just supporting our stakeholders globally around any topic that they want to discuss. I think it's a differentiator for us at Lenovo, but I think it served us well over the last seven years that I've been here. I was the one that built this team originally, started in North America, grew globally over the course of my first couple years here. I think it's one of those things that helps us allow customers to do a little bit more due diligence with our assistance and really ultimately help their resilience from the standpoint of their technology stack that they're deploying in their organizations.
[00:29:46] KB: Then looking at assurance now for a moment, what's your view in definition of assurance? Would you say that's tandem with the trust piece as well?
[00:29:56] Skip Mann: Yeah, I think it all goes hand in hand. When you look at my remit, most of the things that are outside those core security functions, they fall up under me within the security enterprise. I think that gives me the ability to look across all of these supporting functions, whether it's promulgating our security strategy year over year, whether it's looking at GRC in the context of the greater security enterprise, not just cyber. The fact that as I defined assurance as being effectiveness beyond compliance, I think that's critical for an organization, especially the size of Lenovo, in the technology space to be able to look across using an assurance lens across all the security functions and ensuring that all of those security functions are being held to a level of accountability beyond minimum compliance.
[00:30:51] KB: So then just talking more on the evidence, now obviously Lenovo does a lot of evidence, like you've mentioned throughout today's interview. The only part that I really want to know about this as well is at what point does it become analysis paralysis? Because again, there are some people that may spend so long trying to get an outcome and then as a result, it starts to have diminishing returns. I think it's important that it ties back to my earlier question around people are short on time, they've got to move quickly. Yes, we don't want people to make ill-informed decisions, but would you say people are doing too much and therefore it's doing a disservice as a result of it?
[00:31:29] Skip Mann: I'll speak on behalf of just my own personal views. I'll use some of the security tools out there. I won't name them, but there are essentially security tools that customers can get, that organizations can get, that are almost like a security credit reporting agency level of due diligence where they're using bots and other things to crawl the web, to look at the URLs that a company owns and such, and they're providing a scorecard of where that organization sits from an A to a D or an F or whatever it is. Those get a little bit unwieldy, to be honest with you, just from a personal perspective. We've been an early adopter of those tools throughout the years. We do use them, but I think we use them as one tool in a larger risk-informed decision-making process in terms of how we do due diligence on our suppliers, how we do due diligence from suppliers that we're contracting with outside of the manufacturing and supply chain realm. I think, again, you can easily become paralyzed by the sheer number of tools that are out there to help you technologically do due diligence. I think it boils down to having those hard conversations, asking companies what their evidence is, having companies provide that evidence, contractually obligating the companies that you're contracting with to meet those certain standards. When I talk about GRC again, what we do is we use a hub and spoke model approach where we've got a hub of things, whether it's our ISO standards that we're certified to from an information security management system, from business continuity, counterfeit parts in the supply chain, whatever that may be, the NIST standards that comprise part of that hub approach, and then the spoke model where you, again, have other lesser certifications, country-specific certifications and things of that nature out there where you can provide these things to customers as they're doing due diligence and they can look that a third party has come in and attested that we're meeting that certain standard, whether it's information cybersecurity or business continuity or even automotive industry certifications that Lenovo holds from a European Union perspective. It all culminates into it's on the technology company to provide as much of that evidence as possible to the customers to understand the impact of what it would mean to contract with us, make those informed decisions, and ultimately enter into a partnership with us. I think rounding that out, again, it takes a village to get after this. We try to not paralyze our customers with sheer volumes of information. We try to be very surgical with what the customer's concerns are, what the customer needs, and what they're asking for specifically. I think in the end, it always works out from the standpoint of building that trust when it's all said and done.
[00:34:39] KB: Skip, what do you think moving forward now? I know we've covered a lot of ground on things here today, but where does your mind go for the next six months and then into the new year?
[00:34:49] Skip Mann: In the current phase that we're in from a technology perspective, being in the quote-unquote AI era, it's creating a completely new trust problem is what it's doing. I think it's magnifying existing trust problems. I think organizations are starting to ask much harder questions as we've discussed throughout this podcast. Where is the data coming from? How is it being protected? Who's accountable? How are decisions being made? How do we validate outcomes? How do we maintain appropriate oversight? I think companies that succeed with AI won't necessarily be the ones moving the fastest. They'll be the ones that balance innovation with governance. In the next six months, we'll continue to see this. From an AI perspective, I mean, you're starting to see these questions around is AI overhyped. I think we're somewhere between hype and transformation when it comes to AI. Every major technology shift goes through a phase where expectations get ahead of reality. I also think we're seeing genuinely meaningful changes in productivity and business outcomes. The question really isn't whether AI matters. The question is really whether organizations can deploy it responsibly. I see an accountability become critical. It's about AI right now. That's in the next six months, what's at the top of my mind from the perspective of especially AI governance and responsible AI.
[00:36:22] KB: That was Skip Mann, everybody. Skip's point that attackers don't care about org charts. A compromised supplier is a cyber incident, a supply chain problem, and a resilience failure all at once. And someone has to be the one connecting those dots. If you're a leader listening to this, find out who in your organization sees cyber, physical, and supply chain risk all in one place. If the answer is nobody, I'd start there.
VO: I read every reply. If you've got some thoughts on this one, send me a message on LinkedIn.
KBKast - Cyber for The C-Suite.
