Security Confidential S20 E4 Ryan Williams Sr.

Manoj Tandon: Hello everyone, this is your host, Manoj Tandon. Welcome to another episode of Dark Rhiino Security’s Security Confidential. Gotta remind you guys, if you love our content, hit the like and subscribe button. Chances are you have not done that because our stats tell us that a lot of you listen, but you don’t want to hit that button for some reason. So show us some love and do that. We’re all working for the algorithms here a little bit, and it allows us to bring you this great content. But without further ado, we have an awesome guest today. He is Mr. Ryan Williams Sr. Ryan is a cybersecurity and resiliency risk leader, and resiliency is a very apropos topic. We’re going to get into it. He’s an Air Force veteran with over 20 years in the service. He’s an author and founder of RAM Cyber Consulting and Assessments. He currently serves as a risk manager for a Fortune 50 financial institution and has spent years helping organizations improve cyber resilience, AI governance, and regulatory compliance. He’s also an author and co-host of The Other Side of the Firewall, where he shines a spotlight on people shaping the future of cybersecurity. So, Ryan, welcome to the show. Honor to have you here.

Ryan Williams Sr.: Thank you. I appreciate it. And it’s always great to be on somebody else’s podcast.

Manoj Tandon: Yeah, well, I’m kind of glad that I won’t have to do a lot of talking since you’re the podcast master here, right? So you can tell us a little bit about yourself. Actually, we always love to start with the origin story because cybersecurity is one area where nobody comes from the same place. So we’d love to get your backstory, how you ended up here.

Ryan Williams Sr.: Sure. I started in the military 23 years ago, I want to say. So I served for 20 years. I started in 2003. I came in and what’s called data maintenance. So we worked on hardware and switching around and things of that nature. It kind of transformed into cyber transport, is what we called it. So I was the guy who set up your small or enterprise-level networks, right? Switching, routing, all that good stuff. I did that for over half of my career. And then I was actually stationed down here in Tampa. So I was stationed at MacDill. I joined what’s called the Joint Communications Support Element, or JCSE. It’s kind of like communicators for hire, right? So we worked for three-letter agencies, Special Forces, special operations, things of that nature. And that’s when I learned the cybersecurity portion of my job to better secure those networks and really got a passion for it. So that’s kind of my background.

Manoj Tandon: That’s fantastic. What would you say are some of the most important things you learned out of your training in the Air Force regarding cybersecurity?

Ryan Williams Sr.: Really, I would say preparation. What I learned, and that still carries forward with me, is that the mission cannot fail. Even though you may have a setback, or something may change, or something may not go as planned, you have to have contingency plans and backup plans. You have to think through it beforehand and be prepared for what could potentially happen and rehearse it as you go along. So that goes into our tabletops, our exercises, our drills when it comes to cybersecurity, risk management, all that good stuff. You kind of prepare beforehand, and then obviously things come at you in all types of shapes, sizes, and directions, and you’re able to pivot from there.

Manoj Tandon: So, question for you on that. Cybersecurity is unique in that, in a traditional warfare or adversarial sense, the enemy is on one side and the defenders are on another. But in the case of cybersecurity, most often the enemy is already within, right? And how does that change the setup or the strategy? Because the traditional mission is already breached. I mean, a lot of times people are lying in wait, or they’re just sitting there, or they’ve found a source. What are your thoughts on that?

Ryan Williams Sr.: So I think that’s kind of where the industry is finally starting to catch up. When we talk about zero trust and things of that nature, it’s saying, okay, let’s pretend we’re already compromised. So let’s not trust anyone. Let’s verify everything: every resource, everything you want to have access to, every privilege. And I think that’s kind of where the industry is finally starting to catch up to where we were already in the military. At first, it was kind of cumbersome, right? It’s kind of hard to enact these things, especially when your procedures kind of outpace your technology. But as things started to evolve, we were able to start to go the route of zero trust. And I think that’s kind of where the two ends are starting to meet, where it’s like, okay, we know that the enemy has capabilities, especially our near peers, things of that nature, but just free time, right? Especially during COVID time, idle hands cause people to get kind of good at what they do when it comes to breaking into networks and stealing data and things of that nature. So now we kind of just always anticipate it. We’re like, okay, we know that they’re probably in here. How do we make sure that we keep our resources safe, or at least in a sort of zoning or blast radius where if you get one thing, you don’t get everything, right? You get one key, you don’t get all the keys to the kingdom. As well as, if you take down one system, you don’t take down the entire enterprise.

Manoj Tandon: Now that’s very logical, profound, but for most organizations, is that not super difficult to implement?

Ryan Williams Sr.: I think it’s difficult for everyone to implement because it takes, again, preparation and planning. You’re necessarily building the plane while it’s in flight, right? You have to think, okay, cybersecurity risk is akin to business risk. So you have to kind of marry the two. When you’re doing your business impact analysis or things of that nature, you have to figure in, okay, what am I liable for? What can potentially be lost or degraded, and how will that impact the customer or the client? Whether it be reputational damage, or whether it be some kind of fine coming from the government because we’ve lost Social Security numbers or credit card numbers or whatever your industry is. And you have to kind of figure all those things into the equation beforehand because you don’t want to get caught flat-footed and then have that cause a major disruption to your business or shut you down.

Manoj Tandon: I think that’s where a lot of companies fail, though, because they inherently view cybersecurity as a technical exercise, right? And they’re like, well, yeah, we’ve got some folks who handle all our cyber. But those folks traditionally don’t have a view to how the business actually generates revenue, what the economic situation of the business is, and I guess then you really don’t develop true resiliency in those kinds of environments.

Ryan Williams Sr.: No, because everyone, like you said, really gets into the weeds on the technical side of the house, which is very important, right? IT is important to the equation. But there is always going to be that shared responsibility that you’re going to have with whomever you’re trying to shift the risk to, whether it be to hardware, or to a specific person in your organization, or to a third party like a cloud provider or what have you, where you can’t shift all risk to them. So you have to think, what are my responsibilities and how can it impact our business? And I think that’s where a lot of people are not connecting the dots, or they’re starting to. I’m starting to see a lot more people dive deep into risk resiliency as well as cybersecurity risk, third-party risk management, things of that nature. But it’s not always the case, especially for the mom-and-pop shops, right? Your small to medium-sized businesses. Again, I think you just have to take a step back and think, okay, this is what I serve to a client or customer. And then how can this, if lost or degraded, impact us?

Manoj Tandon: How do you get the attention of the decision-makers to actually participate in this process?

Ryan Williams Sr.: That is the million-dollar question, right? From my perspective, it’s not jumping up and down on someone’s desk, right? You’re going to immediately cause a defensive response. So it’s more of a partnership. It’s asking the right questions so I know the why. How does our business make money? How does it do business? And then be able to come back and say, okay, these things are directly tied to those first- and second-order effects on how we make money or how we could potentially lose money. And then here are some solutions, because you don’t just want to come in with problems. That’s another lesson I learned in the military. You want to come in with a solution as well because you definitely want to either have an influence on that decision or you just don’t want a decision made for you, right? Because it could be a notoriously poor decision, but it might not be what you were looking for when it came to whatever solution that you’re trying to architect. But regardless, coming in with a solution or potential solution for the problem and saying, hey, here is how we can get at this, and this is how it could potentially impact us.

Manoj Tandon: So I’ll give you some real-world responses you get from decision-makers that are like, well, if you want to talk about cybersecurity and really get into resilience and you bring up some of these topics, a lot of times, not all the time, but a lot of times, the first reaction is: well, we already use Microsoft or Google or Amazon, or we’re using this SaaS provider or this e-commerce platform, and they already have all our security. We don’t need to do anything with cyber. We don’t have anything on-prem. I know I’m asking that because I want to make sure, because this is almost a myth-buster, if you will. Yeah, it’s in the cloud. Amazon’s going to deal with my security. They’re secure. Why do I have to care about this?

Ryan Williams Sr.: Right. Everybody’s like, “It’s in the cloud.” Cloud is just someone else’s computers. There’s going to be stipulations. There’s going to be a service-level agreement. There’s going to be a memorandum of understanding or agreement, right? SLAs, MOUs, MOAs, where you have a shared responsibility. Even though this thing has been shifted to them in the cloud, they’re only going to have accountability for a certain amount of it. So you have to figure out what does that mean? Does it tie into your uptimes, right? Are you paying for five nines, seven nines, whatever that magical number is, in case things go south? But as well as, when I am giving access or permissions to someone else, what liability am I taking on in that case? When I’m on-boarding someone and they’re coming to the organization, you want to give them least privilege, you want segregation of duties, all that good stuff, because you’re also trying to protect your side of the equation. Same thing goes with multi-factor authentication, two-factor, all that good stuff that you put on top of it. You’re going to have all these options and switches, but which ones do you switch on and which ones do you switch off? And then you have to balance the rest there. It also ties into your cyber insurance. You’ll see somebody who has signed a policy and checked all the boxes saying, like, hey, we have all these things. And then when you go in to just do a point-in-time assessment, you’ll be like, you don’t have any of these things. So if it did go awry, they wouldn’t pay out because you said you had MFA, but you don’t have MFA. You said you separated people’s privileges, but you didn’t separate people’s privileges. You had no risk roster. You didn’t have X or Y or Z. So it’s really understanding what you’re signing off on, and then how do I implement this into my company, not just to check a box, but as a culture or cyber hygiene or whatever you want to call it.

Manoj Tandon: That’s why I think the industry payout, last time I read it, was on a cyber policy could be as low as 30 cents on the dollar.

Ryan Williams Sr.: I can believe it because everybody’s taking a gamble, especially when it comes to insurance. I live in Florida, so hurricanes come through here all the time. You have to read your policy, right? What does it mean? If, God forbid, the hurricane were to rip the roof off of the house and the house were to flood, is that on me? Is that still act of God, or did I not have the proper insurance to cover the rain in the house, right, as opposed to just the roof and things of that nature? When’s the last time my roof was inspected? Because that can also come into the equation. There are things on my side as the homeowner that I have to do in order to make sure that those policies I signed off on will hopefully cover all the costs and expenses.

Manoj Tandon: Business email compromise. I don’t think most people realize that that’s not part of cyber insurance coverage anymore.

Ryan Williams Sr.: No. And again, it’s like, okay, so that would tie into, are you doing the training, right? Do you guys have cyber awareness training? Are you doing mock phishing attempts on your employees to train them or to better expose them to these things? There’s a lot of stuff that is still going to be on your plate, even if you have zero hardware in your environment.

Manoj Tandon: Absolutely. So how does a small-medium business—look, at the enterprise level, you have all these resources—but even a 600-person company is not really a big company, right? They may have a CIO or they just may have a VP of IT. They don’t have all these resources. How do they get their heads around where they start? This resiliency conversation, where does it actually begin?

Ryan Williams Sr.: Well, I like to say you kind of have to meet them where they’re at. If you’re going to go with a third party, like a consultant or assessor, what have you, hopefully you can find someone who is going to come in and actually care, as opposed to somebody who just wants to do a point-in-time and get you out the door, right? The same thing goes for when you hire, in this case, the VP of IT or whomever, right? Whoever’s going to be responsible for your security. You’re hiring somebody who is thoughtful and passionate about it and that you will listen to, because ultimately they’re going to come to you with problems. If I come in the door of a new company, you have a certain period of time where you’re trying to learn how the culture works and how everything is set up and situated, but you’re going to find things. No organization is going to be perfect. And then if I find these things and I bring them to you, can we have that conversation? On my side, am I able to explain it to you from the business side of the house because ultimately you have the checkbook? And then from your side, are you going to be receptive? Because cyber is a cost center, right? Unless you’re selling cybersecurity, it’s going to cost you something. It’s never going to give you money. It’s hard to prove that it’s saving you money unless you have a breach, right? And then it’s still going to be hard to explain, okay, how much worse could this have been? How much more money could we have lost? So it’s really having that thoughtful conversation to say, hey, we have issues and we need to elevate our posture. And here are some steps along the way to being better, because we’ll never be perfect.

Manoj Tandon: You know, Ryan, we hear that all the time. Everyone’s trying to look for that magic formula for ROI, right? They’re like, well, how do we do this? And it doesn’t exist. It’s not there. If you go with the risk-avoidance approach, you are guessing at what your cyber losses could be. Even if you go with standard actuary tables from the industry, you are assuming that a certain attack vector took place and certain losses could take place, right? What we have found, and I’d love to get your feedback on it, that seems to resonate is forget all those things. Look at if you are operationally shut down for a day, two days, seven days. That’s very easy for you to know how much money that is worth. And that should be the measure by which you are investing in your cybersecurity program. If you can afford to be down for seven days with no issues, then maybe your risk tolerance is very high, right? And you’re willing to do certain things. But if you are at any given time within 48 hours of a cash flow situation that can severely impact the business, whether that be in procuring raw materials or paying people, or as the case may be, then you have a very different risk tolerance. And that is how you should benchmark yourself for that ROI. That’s at least what we tell people.

Ryan Williams Sr.: Yeah, I completely agree. And it’s really just sitting down and having that conversation because at some point you had to have thought about this, at least on just a budgetary standpoint. But now you have to think about failure from the perspective that no one wants to think about it. Like, okay, we’re going to go down. And if we go down, this is hopefully the guardrails or safety mechanisms that we have in place to quickly bounce back. And that’s a very difficult conversation because nobody wants to concede to failure. Like, well, you have a failure mindset. That’s not good. No, I don’t have a failure mindset. I have a resilient mindset where, if the threshold is going to be seven days, I want to come back as quickly as possible. If the threshold is only a day, I want to come back in minutes or hours. But I want to be able to take that punch to the face and then quickly recover. And it’s a very difficult conversation to have. But then talk to anybody who’s had a breach or had an outage and had that pain or that pressure, and it’s a conversation they wish they had beforehand.

Manoj Tandon: Well, Inc. had a statistic on it. Sixty percent of small-medium businesses are out of business six months post-breach.

Ryan Williams Sr.: Right.

Manoj Tandon: I don’t know where they got that number, but that’s the number. So, you know.

Ryan Williams Sr.: I can believe it because you’re limited on cash flow, right? You’re not a billion-dollar, trillion-dollar company. So any excess time being down, especially if you’re serving clients in some capacity, now you have reputational damage, right? People are scared to give you their information or their money. So you’re going to have losses past the breach, and you have to kind of take that into consideration as well.

Manoj Tandon: Why do so many backups fail on restore?

Ryan Williams Sr.: From a technical perspective, like an actual backup?

Manoj Tandon: Well, yeah. I mean, I guess, because that’s what people have found. It’s well north of 70 percent of backups, when you really need them, fail to restore the systems back to where you thought they could go.

Ryan Williams Sr.: I would say from the outside looking in, because I’ve never had that be the issue. But again, I’m kind of biased to the half of my life I spent in the Department of Defense.

Manoj Tandon: Well, you guys had more backups than there were. And even in the financial sector, right? I mean, you guys usually probably test failover systems, see if you can operate from the failover, which most industries don’t do that.

Ryan Williams Sr.: Right. And I think that’s kind of the answer to the problem: are you testing them? Are you actually testing your backups? And if you have this issue during testing, then it’s like, okay, was it our standards and procedures? Was it a technical limitation? Was it the company we’re using? Right? Is it a third-party issue where we need to go to someone else to do our backups? There could be multiple reasons. But are you testing for it? Because you will definitely put somebody’s feet to the fire if you say, okay, next week we’re going down from an exercise perspective, and we better come back up on this backup or have an explanation of why we didn’t come up on this backup. It takes time, right? You have to be accountable for it. You can’t just say, okay, we can’t do it this quarter. No, you have to do it this quarter. We have to make sure that we come up. And if not, then we need to have a solution to how we can fix this. How can we be better, get well, because of it?

Manoj Tandon: See, I think this all comes back to companies misunderstanding cyber risk, Ryan. Or they’re thinking of it more as a technical risk. A lot of times the operational risk is being looked over. And that’s the catastrophic mistake, or seems like that might be the catastrophic mistake.

Ryan Williams Sr.: Right. I think it really is just getting everybody into the same room to understand. What I’ve seen in the past, when I was doing some consulting for a credit union, everybody was really good at what they did. They all had their own procedures. Everything functioned the way they thought it was supposed to function. But then when you got them all in a room and you gave them a scenario, like, okay, a hurricane’s coming, you have so many days, and each day we’re going to go through and figure out what wrinkles there are, you start to find out really quickly how they don’t communicate with each other. So it could be something as simple as we didn’t understand that these services were housed in a certain place, and if they go down, they cause this degradation, or that these services are hosted by a third party and they’re in the way of the storm. So if they go down, we’re going to lose these white-labeled services. To, hey, everybody’s going to take a run on the bank before the storm, right? Because you see a hurricane coming. So you’re like, okay, I need to have cash on hand. Everybody makes a run on the bank. Do you have trucks coming in to resupply the ATMs? Just questions that you wouldn’t think of. But then there’s someone in the room who raises their hand, and they’re like, hey, did you think about this? If I don’t get notified, there would be no money in the ATMs. Things like that. I think it’s just really getting the people in the room and then testing what you believe to be good procedures.

Manoj Tandon: Have you developed a checklist for all things to consider here, Ryan, for these businesses? Because you’re putting some pretty good thoughts out. And are they actually captured somewhere? I’m just curious.

Ryan Williams Sr.: So typically, back in my consulting days, we would capture those in the midst of the exercise. We’d add it to the inventory. Like, okay, here’s a risk that nobody thought about, or here’s a procedure that doesn’t have a trigger for this department, X, Y, and Z. And then you kind of put them all together and you give it, whether you’ve been hired to just give them the information or, hey, here are some policies or some amendments to your policies that may help you out. In my current capacity, I lead the tech controls. So it’s more of thinking of it from operational risk, technical risk. You have control surety, you have third-party risk management, so on and so forth. So it’s more of taking all that in and saying, hey, did we think of this? And if so, did we capture it somewhere? And can I see it? You know, trust but verify. And then let’s go through it to make sure it makes sense, because we may have missed something.

Manoj Tandon: Taking you back to your Air Force days, one thing I’d love for you to comment on is air-gapping.

Ryan Williams Sr.: Sure.

Manoj Tandon: You know, so there’s this idea where people just make a blanket statement: well, our OT network is air-gapped, so we don’t have to worry about it.

Ryan Williams Sr.: Right. And I would say there is the concept of air-gap and there’s actual air-gap. So it’s like, okay, you’re saying that they’re air-gapped, but at some point do they tie into each other? Are you riding the same backbone? Do you have the same demarcation point? So you’re riding the same ISP on the way out, right? Is it truly air-gapped where this thing is by itself, solo? And nine times out of ten, no. It’s not engineered to actually be air-gapped.

Manoj Tandon: I was going to say 9.9. You were just being polite. I was saying 9.9 out of ten, no, and I wanted someone smart like you to say that, not me.

Ryan Williams Sr.: Right. Complete isolation is air-gapped. And that is very hard to come by, right? It takes money, like in engineering.

Manoj Tandon: Yeah, if you completely air-gap it, you still need to get information to that network a lot of times, right? And then that becomes a really cumbersome process, right?

Ryan Williams Sr.: Yeah, because you’ll have multiple patching cycles and things of that nature. Do you have the personnel for that? Do you have the time to make sure that these things are done, right?

Manoj Tandon: I’ll tell you, one example that always comes to mind is engine control software on aircraft. For the longest time, I don’t know if they do it anymore, but for the longest time, it used to be that those aircraft had stacks of floppy disks still with them, right?

Ryan Williams Sr.: Wow.

Manoj Tandon: And it was, well, it’s air-gapped. You couldn’t update over the air. So it was all about, this is a certified known good set of engine-control software that’s on these disks, and you can’t corrupt them unless you physically get to those disks, right? And you can go ahead and update, and we know it’s good. Whereas now, I don’t know. I’ve been out of that industry for a long time, so I don’t know what they do anymore. Maybe it is now over the air. But that was an example that came to mind and it introduced a huge inconvenience for people, right?

Ryan Williams Sr.: Yeah.

Manoj Tandon: You had to prove chain of custody, all that stuff.

Ryan Williams Sr.: Yeah, it’s a lot there. I love traveling. I love flying. And the more I learn about those systems, I’m like, man. It’s both inspiring and scary at the same time, right? It’s like all these capabilities and how they have to go about it. I didn’t even know about the floppy-disk situation, but that makes sense, right? How do you make your updates or come back from a good copy without having the ability to either do it over the air, like you said, or have those disks? That stuff is amazing. Someone thought of that.

Manoj Tandon: Someone did think of that, because if you do enable over-the-air, now it’s able to be hacked. I don’t care how secure it is. Given enough time, money, resources, somebody’s going to figure out how to get it.

Ryan Williams Sr.: Yeah, we always talk about on the podcast, idle hands. There are people out there who make money from doing things that are bad actors. But it has good paydays, apparently, if you can live off of it. So it’s like, the good guys are busy and they have all these extra ramifications. You need all this certification, all this training to prove who you are and what you do. And then to be a bad guy, you just have to be good. That’s it. Nobody’s going to say, “You don’t have certification. We can’t hire you to our bad-guy cabal.”

Manoj Tandon: Yeah.

Ryan Williams Sr.: They say, like, show me your résumé. Who have you hacked?

Manoj Tandon: Some of those guys are absolutely brilliant, Ryan. I say maybe their talents are being used towards the wrong things, or maybe they work for the GRU. Remember, they’ve got 5,000 PhDs that wake up every morning that are trying to figure out how to undo the NSA, right? Now, if you put that kind of resource power to anything, you’re going to do something, because all systems are flawed.

Ryan Williams Sr.: Right. Yeah. And that’s what goes back to resiliency. Our near peers and our adversaries, or even just a person in their basement, could do damage. So it’s like, you have to be able to think, at any time I need to be able to bounce back. And it’s not admitting failure or defeat. It’s just being prepared.

Manoj Tandon: Let’s switch gears to our favorite topic, because you can’t have a podcast without it anymore, and that’s AI. It’s obligatory that we talk about AI. So I want to know, I’ll ask the general question: how do you do AI governance?

Ryan Williams Sr.: So I could take it from multiple viewpoints. If you are, again, let’s look at the mom-and-pop scenario. You have to, I would say, start with figuring out what people are using AI for or need it for in your organization. If you don’t have an acceptable-use policy or something in the handbook saying don’t use it, they’re using it. So you might as well go ahead and survey them to find out what they are using and how they are using it. And then you’re not trying to stop innovation. You’re trying to put up reasonable guardrails to make sure that you’re not exposing yourself to undue risk. So it’s like, okay, you guys are using Canva, or you guys are using ChatGPT, or whomever. How are you using these things? What are you using them for? And then can we afford an enterprise solution that can bundle some of this stuff together, right? Some of these capabilities. Because at the end of the day, AI is a tool, right? It can hopefully get rid of some of the lower-hanging fruit so you can work on more meaningful work. So you want to embrace it, but you just want to do it in a safe way. And then it just scales from there depending upon what kind of organization you’re in.

Manoj Tandon: There’s a lot of money being poured into AI governance and specifically agentic AI. I guess my question would be, those tools are all very deterministic and they’re all being put in charge of managing a very probabilistic environment. How the heck is that remotely going to be successful?

Ryan Williams Sr.: I think it is going to come down to—and I know the industry is working on it, and I know a few different people I’ve talked to where it’s all about identity access management, right? If an agent is an employee, then we have to have the ability to onboard it, to watch it, and then be able to terminate its employment at some point if need be. In a smaller environment, a smaller sandbox, it makes sense. It sounds like a good idea. But then when you look at it at scale with all these agents spinning up and spinning down, it’s like, how do we account for all this? How do we make sure that they are doing what we told them to do, how we told them to do it? And then we have some kind of ability to attribute their actions to results that happen, whether they be good or bad, on our network. I think that’s what people are struggling with right now because it’s going to be cool when it does happen, but it can also take a turn where this thing is spending money or it’s deleting databases, or it could be a number of things. You’re like, how do I stop it from doing it before it does the wrong thing, right?

Manoj Tandon: And that’s the million-billion-dollar question. I want to know how you put guardrails around it. I often use the example on this topic, it’s like that scene from the first Jurassic Park where they are feeding the velociraptors those cows with that big crane. And those guys are touching the fence and they’re like, let’s see if it’s buzzing today. Am I contained? They’re always testing the boundaries, and that’s AI. It’s going to test the boundary conditions, and at some point those boundary conditions are going to fail. And we all know what happened in the movie when it did, right? But that same example, if you were to carry it into a real-world scenario, let’s say we replace the human airline rebooking agent with a super-monster AI agent, right? And yes, it can do things really fast. It can figure out what flights, Ryan, you need to be routed on, where you’re going through, what’s the cheapest way you could do it for the airline, all that great stuff. At the same time, in order to redo the booking, it needs your date of birth, your exact name, it needs your passport number, it needs your TSA PreCheck number, it needs your home address, right? Especially if you’re on an international flight, because now all those manifests go to the TSA prior to departure and takeoff for clearance, right? If an agent has access to all that data, then it has the ability to lose access to all that data or the ability to reveal all that data if it’s asked in the right way to do so. How would you prevent that? I haven’t had anybody—

Ryan Williams Sr.: Yeah, I was going to say, you would have to have—because I’m always going to be for the human in the loop. I always think there needs to be a person, right? But these things are able to, like you said, access all that data and can make all these transactions really fast. So you’re more chasing your tail when it comes to it. So it’s like, how do we build agents that supervise agents, that have the ability to terminate agents, and so on and so forth? It’s going to be really complicated. But my hope is that they figure it out. Not to replace the person at the terminal, but to make sure flights come in and land, and people run the right flights, and all that good stuff, and it’s all seamless. So I think that will be the future. I don’t know when that’s going to happen, though. Right now, I’ll have really good days with ChatGPT and I’ll have really bad days. So I won’t trust it with my credit card information, right? People are out there like, “Yeah, you can buy stuff for me.” No. No, you cannot. You cannot buy things for me.

Manoj Tandon: Smart man and great advice. That’s one bit of advice that’s worth the price of admission here. I think the human in the loop is absolutely the key. Like in my airline-booking example, I say the only real solution is you could have the agent come back to a real human being and say, route Ryan this way, but it doesn’t actually execute the transaction because it doesn’t have the data to do it. That has to go to a human agent that has to click the button and say yes, right? Because what we’re describing of agents that can detect agents and who have other agents that govern them—well, we know as a fundamental principle of computer science and mathematics, 100 percent detection is impossible. That was proven a long time ago. It is a mathematical impossibility, so you cannot build a perfect agent to detect 100 percent of another agent’s actions, just like you can’t build endpoint detection software that will be 100 percent effective at detecting every single variable infection that exists. It’s not possible. So the human in the loop is a fantastic concept. I hope people listen to you.

Ryan Williams Sr.: I do like that, though. Because, yeah, you have somebody who’s sitting there, whether it be in some kind of data center or what have you, who’s just doing the execution piece of it, right? It’s just verifying. Verify that this information makes sense, this person’s a real person, they’re not doing anything shady or funny, hit the button and then go from there. So yeah, I mean, it will probably be doable. The way things are progressing so quickly, the next decade’s going to be—I can’t even picture what the next decade looks like.

Manoj Tandon: I think it’s going to be really good. I know there’s a lot of dystopian futurists out there, but I don’t think that’s—I don’t think it makes for a good movie, or maybe a good HBO drama, but I don’t see that being the case. I think this is another evolution in humanity’s transformation to whatever the heck it’s transforming to, and it has the potential to do a lot of good. A lot of good.

Ryan Williams Sr.: Yeah, I’m very optimistic, right? But still, you have to—I’m still always watching. I’m just like, make sure it’s not Skynet.

Manoj Tandon: I gotcha. Well, Ryan, tell us a little bit about The Other Side of the Firewall. What’s the story behind that?

Ryan Williams Sr.: Thank you. Yeah, absolutely. So The Other Side of the Firewall is both a podcast. I’ve been doing it for about six years. I started it during COVID. My last assignment in the Air Force, they sent me to Turkey. I left Florida, which was still semi-open, and they sent us to Turkey. And Turkey was: you land at the airport, you go straight to the hotel, see you in two weeks. We’ll bring you food. No human contact. So I was sitting around with buddies on the phone who I worked with in the military, and we were talking about our work a lot. So it was like, you know, let’s record this. It might be something that people might be interested in. And then it kind of grew from there, right? So it became a platform for cybersecurity professionals who are either trying to break in or already in on their journey, who are people of color, women, neurodivergent professionals, veterans, career switchers—anybody that you really don’t see a lot of or hear a lot from. And I started with, we talk about two topics and a discussion every week. And we’ve been doing that for over 900 episodes. There’s a lot of content out there, plus interviews. So I have about 40 or 50 interviews with different professionals. And again, it was kind of, hey, I’m transitioning out of the military, so how do I talk to the people who ultimately can give me the best advice? Bring them on a podcast. People love the ability to tell their story and to give advice to people who are trying to break in. And from there, I decided to turn it into a book because I was like, okay, people are able to watch this on YouTube or listen to it on a podcast platform of choice, but how do I capture these things that, for the most part, are kind of timeless, right? Just evergreen material of how the different paths into cybersecurity work. So I took 26 of those stories, including my own, of how we broke into cybersecurity and how you can too, right? So how you can see yourself within our field. And I released that last July. Yeah, July 2025 was when the book came out. Like I said, the podcast goes up every week, and we’re now syndicated on the radio. So we’re on WDJY 99.1 FM in the Atlanta metro area. That’s Tuesdays at 5 p.m. Eastern, as well as Fairfax Radio in the mornings, the first Wednesday of every month on Fairfax Radio, and that’s in the D.C. area. We have about 27,500 weekly listeners, but the Nielsen numbers are going to come back in soon-ish, so I can see how Fairfax is doing as well. But yeah, we grew from probably a pool of 300 listeners, which I greatly appreciate. Those are my ride-or-die people on the podcast, to now we’re reaching about, I’d say, 30,000 if you include everybody every week.

Manoj Tandon: That’s fantastic. Job well done, Ryan. That is an accomplishment because I’ve seen, like, when you do the statistics on YouTube, cybersecurity has some of the poorest viewership unless it’s something to do with something nefarious. Then you’ll get—

Ryan Williams Sr.: Right. Yeah. My highest-listening one was Mr. Cooper. When Mr. Cooper had that breach, that one was evergreen material because everybody was like, “That’s me.”

Manoj Tandon: How do you hack a Ring camera? That’ll get you a lot of views, right? But if you’re talking about governance, compliance, and whatnot, people are just typically not interested until it becomes relevant and they get real interested.

Ryan Williams Sr.: Right, right. No, exactly. But yeah, we have a really good—I keep wanting to call them a listener edge. I don’t know what you would call it, right? But we have a lot of people who listen to the podcast, and the comment we always get is like, “Hey, you’re making it easy to be understood.” We try not to be overly complicated. And myself and my co-hosts have decades of experience. Shan is one of my co-hosts. He’s there every week with me. He served for 20 years as well, and he was on the vulnerability-management side of the house. And then Chris, he’s a Navy vet. He was kind of cybersecurity and I want to say he was an IT in the Navy. So those are the guys who are doing all the IT and the networking on the ships or wherever they happen to be. And then we have other co-hosts that pop in and out. So we all have experience within the field from different vantage points.

Manoj Tandon: Fantastic. Fantastic. Anything else you’d like to plug here, Ryan, in the last minute?

Ryan Williams Sr.: Wow. So again, the book—you can go to theothersideofthefirewall.com to pick up the book. If you want to check out all of my projects and places I pop in, hopefully I’ll get a copy of this so I can put it on the webpage as well.

Manoj Tandon: Yes, absolutely.

Ryan Williams Sr.: Yeah, I appreciate that. So you can go to RyanWilliamsSenior.com to see all that good stuff. And most companies build a podcast as a media arm to their company. We kind of did the opposite. We have a podcast, and we’re trying to build a small business around it, to do consulting and public speaking and things of that nature. That’s also the label for the book, right? RAM Cyber Consulting and Assessments LLC. So we’re kind of building the plane in the air, mid-flight.

Manoj Tandon: That’s fantastic. Great stuff. If people want to find you, what’s the best way to reach out to you here?

Ryan Williams Sr.: Absolutely. So on LinkedIn, you go to LinkedIn and you can look up Ryan Williams Senior. There’s a million of us. Or you can go RyRySecurityGuy—that’s R-Y-R-Y Security Guy—and I’ll probably pop up. Or you can go to RyanWilliamsSenior.com. It’s spelled S-E-N-I-O-R. I bought both of them. And then you can also reach me through the website.

Manoj Tandon: Fantastic. Well, Ryan, it’s been a real pleasure to have you. Thank you so much for joining us. This has been a wonderful conversation.

Ryan Williams Sr.: Thank you. I greatly appreciate it.

Manoj Tandon: Take care.