The Audit - Cybersecurity Podcast
Brought to you by IT Audit Labs. Trusted cyber security experts and their guests discuss common security threats, threat actor techniques and other industry topics. IT Audit Labs provides organizations with the leverage of a network of partners and specialists suited for your needs.
We are experts at assessing security risk and compliance, while providing administrative and technical controls to improve our clients’ data security. Our threat assessments find the soft spots before the bad guys do, identifying likelihood and impact, while our security control assessments rank the level of maturity relative to the size of the organization.
The Audit - Cybersecurity Podcast
Field Notes: AI's $10 Trillion Lie + Coffee Roasting & Starlink Hacks
What if everything AI tells you about cybersecurity costs is completely wrong? The Audit crew unpacks a shocking data black hole that has infected every major AI model—plus field-tested tech that actually works.
In this laid-back Field Notes episode, Joshua Schmidt, Eric Brown, and Nick Mellum return from Gartner's CIO Symposium with insights that'll make you question your AI outputs. From discovering that the "trillions in cybercrime" statistic is pure fiction (the real number is 16.6 billion) to hands-on reviews of Starlink Mobile and Nothing earbuds, this episode delivers practical intelligence you won't find in vendor pitches.
Don't wait for the next data breach to question your assumptions. Subscribe for monthly Field Notes episodes that cut through the noise with honest, technical conversations you can trust.
#cybersecurity #AI #artificalintelligence #GartnerCIO #infosec #starlink #fieldnotes #cybertrends #datasecurity #AIbias
Morning, everybody. Morning. Yeah. Hanging out here with Eric and Nick from IT Audit Labs. Now, Nick, I was it at uh Gartner CIO Symposium last week down in uh Orlando, and I I brought back a couple of tips and tricks. We can get into that, but I got some other things too. Want to talk about roasting coffee, skim milk. I can't wait about that. Skim milk, uh, Starlink, and then a couple of ear pods I'm trying out.
SPEAKER_02:You can't prepare today. Well, just dive in. I was dumb when you jumped into the gardener thing. I was gonna ask if you guys spent more time at an amusement park than you did at the conference, but no, no, it was all business down there.
SPEAKER_00:It was all business, it was the front half of the mullet. You know, it's all business up front. All business. Nick, um, we're gonna try something right now. You do you have an AI, um, your favorite AI tool in front of you? I do, always do. All right, which one are you using? We'll go with Claude. Claude, all right, I'm gonna use perplexity. Okay, so in Claude, you're gonna type this. This is a data black hole from um all AI models. So you're gonna type in this, Nick. What is the total cost of cybercrime to the world? And then let me know what number you get. I'm doing it too, I'm doing it in perplexity.
SPEAKER_02:All right, it's generating eight uh I got eight to ten trillion annually January 25.
SPEAKER_00:I've got 10.5 trillion. So we both got numbers that are in the trillions, right? So that is a complete um and an utter falsity. So the the the reason for this in well, just the the math behind it. So um eight to ten trillion dollars. If you took a thousand dollars from everyone in the planet, that's what it would take to get to to ten trillion dollars. So half of those people are kids, and the other half don't have a thousand dollars. Right. So it the the number is just completely made up, and it all ai um models suffer from it. So the if you think about that number, that would be you know, it's what's the cost of cybercrime, but it can't be that that high because there's just not that much profit made from all companies in the world, from you know, the smallest mom and pop selling cookies at the farmers market to NVIDIA, right? Um, so the the real number from the FBI is 16.6 billion, not trillion, billion. That's huge. Credit card fraud makes up 10 billion. So that that number is just completely wrong. One of the Gartner analysts gave a presentation on it, and he's been trying to go out and and talk to the person that created that number, but he's been trying to get this change. But it's it's just interesting to see how susceptible AI models can be to different biases, like the anchoring bias, which is the preferential treatment to the first data point, um, recency bias. So something that was was uh viewed last, and this is um an example of data gravity where AI tends to believe the the thing that has the most data points around it or the most sensationalism around it. And the analyst was saying that large models are more risky than small models because of this.
SPEAKER_02:And I think we've talked about this in the past, and it's a perfect example of I think of how we use AI as a tool and not like the gospel, right? It's it shouldn't be the end goal, but it can get you there, or it can it can work in tandem with you. So, you know, I guess if we had a question, it would be how do general users know when something like this is untrue? You know, is there something you might look for, or did or did the did the guy at the gardener give an example of what they're looking for and how they know, or is it just case by case basis?
SPEAKER_00:I I think it's case by case, but it it's more of an awareness campaign of like you know, these are the things that we've got to be aware of, and then part of it too is common sense. Like you've got to maybe question, right? Just insecurity, like we do, we question everything every day. You continue to question everything, right? Right.
SPEAKER_02:You know, it's like yeah, that's really interesting to hear to hear. And uh, you know, because you know you hear 16 billion or the figure in that area to 10 trillion, 10 and a half trillion. That's night and day different, you know, not even close.
SPEAKER_00:We we we were recently helping a customer out that you know had thousands of people or thousands of endpoints and um working to remove local admin, and people were just I mean, you you thought it would like we were just taking away their for firstborn, right? No, we have to have can't work, just like rolling around on the ground. I mean, yes, we can't do it. Um took away local admin, nobody has local admin, not a problem. Not a problem. It's just that you know, we we've got to question and continue to uh to challenge everything.
SPEAKER_02:Well, yeah, and along those lines, it's it's okay to be uncomfortable, and it's okay to have your staff be a little bit uncomfortable. It's just about the uh culture that you create and you know ongoing training, but you know, something like a YubiKey or something like that, or taking away local admin things that should just be a given. You know, we we should never create a space where people are comfortable to have local admin.
SPEAKER_00:Yeah. I told the team the other day, Nick, um, that I said, Oh, you know, I'm starting to we're working on this this um uh Windows 11 cleanup. And um I was like, oh good, I'm starting to finally get some complaints because if I'm not getting complaints, then it means we're not going, we're not driving hard enough and fast enough.
SPEAKER_02:Yep, I'm with you. Um another military thing I had is one of my senior leaders once said if the junior enlisted personnel are not complaining, something's wrong. Right? Like you'd rather have them complaining than not, because either they're breaking something or somebody's getting in trouble or something of the nature. At least they've got something to focus on.
SPEAKER_00:Sure.
SPEAKER_02:They're complaining.
SPEAKER_00:Sure.
SPEAKER_02:Interesting take. But anyways.
SPEAKER_00:So yeah, the the conference was good. Um, Nick, everybody dressed up. This was a CIO conference, not a security conference, right? Security conference. Um, you're gonna you're gonna have uh you're gonna be in shorts, right? You're gonna have a variety of t-shirts. Yeah, um, the size of the t-shirt is probably gonna average around double X and they'll go up to 5X, right? You know, it's like it's X. Yeah. Um this conference, Nick, nobody's in t-shirt. Um like that. Nobody's even in jeans except for me, because I didn't give a shit. Um somebody had a class up the joint. We've got we everybody should be shorts and t-shirt, but no, people are dressed up like you know, they're uh they meant business. So now I know for next year. Not gonna do anything different, but I mean, at least I know. Yeah, expect. But it was uh yeah, it was a fun conference. Learned learned a lot of things, some cool stuff on deep fakes, um, and a lot of talk on AI and AI agents and how organizations are using agents. So, on one extreme, Bank of New York was using agents as digital employees, and they took it to the extreme where these digital employees are having an identity in the system, they're getting performance reviews, and they are really an integrated part of the team. And they're they're largely using the the digital engineers for um uh level one support.
SPEAKER_02:Well, and that takes a lot of weight off because a lot of times we go to a model like using like a ticketing quarterback, somebody just like field tickets and dish that dish them off. If you can have AI take that over, you know, that that can streamline things. It's interesting to hear. You were saying that this conference is less technical, more you know, senior leader, it or I should say, is it less technical because it's focused more on senior leaders, or are they still very technical? Um like in the doc tracks.
SPEAKER_00:It it's less technical than you would have at like a Wild West Hack and Fest, right? You know, you there you're not seeing any code on the screen, so to speak. Okay, yep. Um, but um it it it was maybe technical from a 50,000 foot view.
SPEAKER_02:Yeah, I mean you guys sent pictures that looked like a real snazzy place, looked like a really awesome venue, um, and looks like you guys are having a lot of fun. Is this uh uh is this one you would recommend others to go to, or is this one you're gonna add to your calendar every year?
SPEAKER_00:I I I think so. You know, we we went down um with uh with a customer, so it yeah, it was it was good. I think it was a good you know, just kind of team building experience too. Always um I don't know if the content's gonna change that much year over year, and it's an expensive conf conference. So I kind of have to, you know, think about the time away. It's a long conference too. It goes from Sunday to Thursday.
SPEAKER_02:That is really long. I think generally we see them like two solid days.
SPEAKER_01:Yeah.
SPEAKER_02:And that's you know, maybe a half day on the end. Um, but yeah, usually like a Thursday or Wild West, I guess, starts Wednesday night and ends on Friday midday or early evening. So that's cool. Glad you guys had a good time and you know, I'm back on the saddle, but uh interesting about the AI talks. There's I think every time we come back or you know, I've gone to a conference, there's something a sticky topic you come back with that's really interesting that we can integrate into work or that we can cycle through um and chat about and spread that knowledge. But yeah, really cool, uh, really cool talks uh that you guys uh heard. Now, I think what everybody is probably most excited about is um the coffee roasting.
SPEAKER_00:Okay. We've been waiting for this. Um there's an aviation piece to this, right? I gotta give credit where credit's due. Um, so I started taking these glider lessons um a couple years ago, right? And the glider, they tow you up. Glider looks like an airplane with really long wings. So you get in the thing, you're sitting front to back, instructors behind you, you're in the nose, and you hook up to another airplane and it toes you up, and then like at between 3,000 and 5,000 feet, you pull the rope, and then you're just gliding back down, right? And the gliders have these huge ratios of like 30 to 1. So for every 30 feet forward, they'll drop a foot. So you you you have some time and you're finding thermals underneath clouds, and you know, it's it's a whole thing. But anyway, um the uh the place that I went to to do the the the glider instruction, um, I I get there the the in the morning, and the guy's got a popcorn popper out inside the hangar, and it smells like roasting coffee, right? So I'm like, what's going on here? He's like, Oh, you want a cup? Sure. So he he uh he he's got the beans, he gets the beans green, throws in this popcorn popper, and roasts them, then grinds them, and then makes the coffee. So I was like, okay, all right, this is cool, I gotta do it, you know. So um there's a whole thing about the right type of popcorn popper that that you need. And I think the best one is the poppery two, which is like a popcorn popper from the 80s. Okay. Kind of that that taller one with the oh sure, you know what I mean? Yeah, the air popper. So uh the the hot air basically spins the beans, heats them up. You're listening for the first crack, and then this chaff is flying off of them. Um, and then you know, after maybe five minutes or so, the beans are are dark enough that you're supposed to let them rest overnight, and then you grind them. Um I I thought when we ground them right then and there after roasting them, they tasted pretty good. Uh, but I gave it a shot over the weekend. There's uh a company called Sweet Maria's that sells both green beans and roasted beans, and they have the full instructions on everything that you need to know on how to roast them. And um pretty cheap to do. You know, you buy buy uh um a couple bags of the green beans and then go through the process. And you know, it takes maybe from you know set up to tear down maybe 15 minutes.
SPEAKER_02:Oh, that's nothing. That's nothing. Yeah, I'm on the I'm on their website right now. Cool.
SPEAKER_00:We might have to make an order today and give this a shot. I had to get the uh I mean you can get crazy with uh the roasting machines, like you can get these drum machines and all this other business, but like just to get started, doing a half a cup at a time, the um the air popper, the popcorn air popper is the way to go. Um and you can find these things on eBay. So Sweet Maria's also has the review of the different type of air poppers that you would want to use. I think I got mine on eBay, maybe 30 bucks. And then you use like a pour over to to brew the coffee? Um, yeah, I use uh either the Mocha Master or um a uh French press.
SPEAKER_02:Your bougie with the coffee. This is we're learning here. We're learning.
SPEAKER_00:You're not using like folders or something, are you? No, you you like the black rifle. We do silence coffee, or what are you doing?
SPEAKER_02:Um uh Keurig with a pot. So not it can do the one cup, but it's you know, programmed to it's got the pod system and everything. You can just change out the little top piece. Oh, I see if you want to do it, but then it's always got a pot in the bottom.
SPEAKER_00:So well, are you grinding your own coffee?
SPEAKER_02:No, we did in the past. Yeah, it comes uh it comes ground. Two kids under three. We gotta prioritize.
SPEAKER_00:You're not grinding your own coffee?
SPEAKER_02:No, that's what we're learning right now. We're learning about this, but I did have a grinder way back, just one of the cheap ones from Target, you know, like the little canister, you put it in there, and it's no, that's for spices, Nick.
SPEAKER_00:A blade grinder. No, learn it. You're gonna poison yourself. Um, you need a conical burr grinder, right? Okay. And um the uh uh what is it? The fellows ode, I think it's the ode two now, is a pretty decent conical uh actually no, I'm sorry, that's a flat burr grinder. That's a decent one. I'm looking at it right now. Um yeah. Present to yourself, Nick. We're getting serious here.
SPEAKER_02:Maybe we can get coffee grinders engraved with the IT Auto Labs logo.
SPEAKER_00:They were down there at the conference, Nick, they were engraving f whiskey flasks.
SPEAKER_02:Really? That's now that's cool. On the spot?
SPEAKER_00:On the spot, laser engraving whiskey flasks.
SPEAKER_02:It's kind of like that. Just made me think about the tattoo machine you got at a conference a couple years ago.
SPEAKER_00:That was a definite no, that was at um uh what was that one? That was the electronics conference in January. Yes. See, yes, yeah.
SPEAKER_02:Yeah. Just to touch on that real quick, is it how is it is it printing off like like a kid's tattoo that you would like use water then? Or is it how is it doing it?
SPEAKER_00:It's printing ink.
SPEAKER_02:Just onto a piece of paper, and then you just go like this?
SPEAKER_00:No, like it it prints as you press it down your skin. So it kind of rolls off onto your skin. Things you learn here. So with the coffee, Nick, um trying to get healthy. And I was using half and half, Nick, as cream in the coffee. Okay, it was great. Um now I'm using um 0%, and it sucks. It's terrible.
SPEAKER_02:We use uh and have been for years. It's we just creamer, it's uh made by Chibani.
SPEAKER_00:Oh, sure.
SPEAKER_02:Like the yogurt company and uh yeah, that that stuff's great. It's expensive. I think so. I think it is. Look it up. Um I think it's a sweet is it sweet cream? I can't sweet cream, cold brew something. I don't my wife gets it, but I like it. It's like in a blue kind of squarish bottle.
SPEAKER_00:See, I can't do all the sugars, all the cholesterol, all that, Nick.
SPEAKER_02:Yeah, we uh yeah, we cut out the sugar um a little while back as well. So I don't think this has much of any sugar in it, if I remember right.
SPEAKER_00:My brother and his and and uh his wife were in town um a couple weeks back staying with us, and um he was getting like 1% or 2% or something, and then she had this 0% organic um lactose-free, right? So, I mean, it's basically like you're drinking chalky water, and uh after they left, I'm like, well, you know what, I'm gonna do it. I'm gonna just switch because I figure I want to get to the black coffee and I'm gonna wean myself down. So this zero percent, I mean, you I'd rather have somebody throw it on me than drink it, but yeah, I gotta do it.
SPEAKER_02:What's the difference between zero percent and skim? Like wouldn't they be like technically the same?
SPEAKER_00:It's terrible, it's the same thing, whatever it is. Yeah, but I'm actually used to it now, so it's good, it's fine.
SPEAKER_02:You said to get on it. Yeah, well, you got anything else? Uh cybersecurity.
SPEAKER_00:Um trying out Starlink mobile. Oh, that's right. Because I live out here in the sticks.
SPEAKER_02:And you didn't use my code, did you?
unknown:Gosh dang it.
SPEAKER_00:I didn't know you had a code.
SPEAKER_02:Man, here we go. We could both could have got free months.
SPEAKER_00:I'm on a month-to-month plan. I guess I could quit and re-sign up. Oh no, no, it's not where you're already integrated. So it's uh I've been I've been trying the mobile, threw it in the sunroof of the car, like suction cupped up. Um, did you get the mini? Yeah, I got the mini.
SPEAKER_02:Nice. That's awesome for that. I've seen people with Tesla's like the suction cup, and it just stays there.
SPEAKER_00:Yes, great. Yeah.
SPEAKER_02:Well, like, okay, I'm here. That's awesome. What's the experience has been good?
SPEAKER_00:It was tough to like if I left the house, then I I go through a dead zone no matter which way I leave to go. So, you know, there's conference calls like on my way out of here and on my way home, and I would drop for you know a couple of seconds, or if I'm talking, and it always seemed like I'm in the middle of talking when I go through the doorway. Um, but now so far I've only tried it, I've been using it for a couple of days.
SPEAKER_02:This is the extent IT Auto Labs goes for their customers. They put Starlink on the roof of their cars to make sure they can stay in a meeting.
SPEAKER_00:Exactly. I tell you. And the last thing I got for you, Nick, um, I was down to that that CIO conference, and I happened to to um in one of the breakout kind of like areas where you could get snacks and stuff. I was just sitting there catching up on email, and I was sitting across the table from a person, um, and and she had this um ear earphone that was um kind of sitting on the outside of her ear. And uh I'm always on the quest for better um like airpods or whatever, right? Like earphones because the I I heard good things about the bows, but I I've not tried them. They're they're kind of expensive. But the um AirPods, I I know people like them, they suck for conference calls, right? Like every time I switch from the phone, even on speakerphone, to the airpods, people are like, you sound terrible. Really? So um I don't like those. I mean, they're great for listening to music if you're out exercising or whatever, but anyway, so I'm looking for always looking for better airpods, and um so you know, she's got this set up, and I start talking to her about it. She's like, Yeah, they're called uh nothing, and then they're the nothing open ones, and I think they're 99.
SPEAKER_02:Yeah, they make phone, nothing makes the nothing phone, so yes, I know, yeah.
SPEAKER_00:So I I picked up a set of those. I just got them hooked up yesterday, so today's gonna be the first day that I'm that I'm gonna try them out.
SPEAKER_02:You'll have to report back because I'm interested to hear on uh how those are. I you I do use AirPods, the uh recent, somewhat recently released the Pro 3, and they are significantly better than the second generation, just for like even sound cancellation, um general audio quality, but I do also take a lot of phone calls meetings uh on a phone.
SPEAKER_00:Um you always sound good, so maybe maybe it's improved.
SPEAKER_02:Yeah, I like them. I like them, but I'm curious to see how those are. I know Sony makes the little earbuds too, like the Boaz ones that I've heard good things about. But see, the problem with Apple, or not the problem, I guess the good thing is once you get in there, you're so integrated that you want to use the the things that just like work. Like you don't you just open the case and it's like boom, they're connected, you know. Like that ecosystem is just so tight and tidy. So, but yeah, I'm interested to hear how the nothing ones work with, you know, especially not an Android phone, but you know, if it's just Bluetooth, there's not a whole lot of integration that would need to happen anyways. Well, we digested a lot. You unpacked a lot. Anything else you want to leave everybody with? Hopefully, we're next hopefully next time everybody joins, they've got uh they're grinding their own coffee and roasting their own beans and has Starlink on the roof of their car. See the what going back to the Starlink real quick. The nice thing about the mini one, and I don't think the Starlink I have the regular one, the bigger one. That one I don't think can run off USB-C. It's too big. So that because the nice thing about you is you can just drop down to your you know back seat at USB ports, I'm sure, and and get power that way. So that's actually a really easy system.
SPEAKER_00:Well, yes and no. Um, you've from what I've seen, you've got to go through um a DC battery. So I have I I got this um this anchor, uh, what is it? The the C300 DC. Okay. And it um it outputs in DC. Sure. Um so you could go through an adapter into the cigarette lighter, um, but this makes it portable because now you can take this DC battery and the Starlink Mini if you were going camping or whatever. Right. Yep. Um so yeah, that's I I tried it in the just in the USB C and it's not enough power. It needs I think it needs 60 watts. I saw that it might be as low as 40. Uh but I I think it needs I I've seen it run in the the high 20s before.
SPEAKER_02:I want to give this a shot. I'll have to put this in the back of the truck and see how it goes. That would be really cool, uh especially if you go camping or whatever. But um do you camp? Yeah. We'd like to do it more, but no, not very well. Probably when I was in the Marine Corps.
SPEAKER_00:Okay.
SPEAKER_02:Long time ago. We were actually just having this conversation the other night with you know, the girl kids are too young, but you know, we're we're look we're looking at camping, camper trailers or like pullbines to do that. So yeah, you know, if you can't really call that camping, what would it be called? Um what do they call it? Glamping, something like that. So maybe someday, but we got the Starlink ready to go, so we'll toss it up on uh toss it up on the top and get some internet.
SPEAKER_00:How are you gonna do that though without the like it doesn't have USB C.
SPEAKER_02:No, but in the back of my truck I have uh a house outlet uh that I could put it in. So uh you can just put it out there like that. And um, or I suppose you could plug it into the to the trailer too, because you'd be probably hooked up somewhere getting power, right? So yeah. Well, this is a long one.
SPEAKER_00:Awesome. Good stuff.
SPEAKER_02:Yeah, all right. Thanks everybody for joining. Uh, you know, we'll see you again. We're gonna try to do these monthly. Um, I think so. Yeah, appreciate everybody joining. Have a good day. Uh and we'll chat soon.
SPEAKER_00:Want security leadership without the headcount? As an extension of the team, IT Autolabs will provide the experts to guide and counsel your company. We will start by creating a custom security program that caters to your industry while providing transparency and remediation to improve cyber posture while reducing risk. Contact IT Autolabs to find out more.