Transcript for "The 'F' Word: Rethinking Security Frameworks for an AI-Driven World": Actually works. You'll hear from Vanessa Jankowski, our SVP of product management, who works closely with leaders navigating risk, compliance, and vendor oversight at scale. We'll take a few questions during the session and also some at the end, So feel free to drop those in the chat now. And don't worry if you miss anything, we'll send a recording within forty eight hours. With that said, I'll hand it over to Vanessa to kick things off. Perfect. Thanks so much, Kelly, and thanks everyone for joining us today for the f word. This is a little bit out of character for me and certainly a little out of character for Bitsight, but the f word we're talking about is something that's really foundational to cybersecurity, and that's frameworks. Security frameworks are the structures we all rely on to manage risk, enforce policy, and demonstrate trust, which has never been more important. But we're at a moment when I that I think we can safely characterize as a sea change in how we work, how we defend, and, of course, how we all get attacked. So today is about asking, how do we help frameworks rise to the occasion? Now before we dive in, I wanna set the stage a little bit. Today's threat environment for TPRM and GRC leaders feels a lot like the movie The Perfect Storm. The crew is seasoned. You've made it through impossible challenges, but then you see this. Have any of you ever felt that way at work? It gives gives me anxiety just looking at it. The cybersecurity landscape is more complex, more daunting than ever. In a survey of a thousand cybersecurity and risk leaders that we published that they just published just yesterday, 90% say their job is more difficult than it was five years ago. AI and expanding attack surfaces are the top two reasons. And on top of all of this, we have geopolitical risk raising mistakes, boards are asking harder questions, and regulators are layering on new mandates what feels like every other week. And as we look across the people who are on the front lines dealing with all of this change, including all of you who dialed in today, I think what you'll find is a lot of good company. You're probably saying this isn't news. To be honest, when I showed when we showed the previous slide, I think sometimes the audience wants to sort of yell through the screen and say, I get it. I get it. This is my daily reality. And cyber and risk leaders we talk to across the globe are all grappling with these challenges. But the day to day grind is what get gets lost in some of these bigger statements and some of those sort of big big headlines. When we were looking for some feedback on a new feature a few weeks ago, we were slacking our CISO, Chris Campbell, for impromptu Zoom. Chris is awesome. He he joined. We apologize. We said sorry for taking half an hour out of your Friday afternoon. Getting the way getting in the way of happy hour. And he said, are you kidding? This is gonna be fun. You should have seen what the rest of my week look like. And that's pretty much every week. We've got zero days. We've got AI powered attacks. We've got OT and IoT flaws putting physical security at risk. And this all just happened in the last week. Like, literally, the headlines that you see here are all from the last week. And, yes, your budget was due on Friday. It's a lot to navigate. It's no wonder that nearly half of cybersecurity professionals report burnout. But in spite of the big wave that we saw, in spite of the stormy seas that we started with, hope is not lost. At least I don't I don't think it is. Over and over again, we see risk leaders turn toward a specific guiding light. Again, I'm talking about the f word. I'm talking about frameworks. Security frameworks are the guidelines, the best practices, the standards, the policies, the procedures that organizations use to manage cyber risk. It's a blueprint. It's a road map for a strong infosec program. It helps you protect data and systems and people from threats and vulnerabilities. And so our headquarters is in Boston. If you drive up and down the coast to Maine, what you'll see is lighthouses scattered across the jagged rocks and the rough seas. They've stood the test of time. They work. They're literal beacons of light. And the security framework is a lot like that. It's been that guiding light for decades. Why? Because it works. The best security teams in the world are leveraging security frameworks to help them guide their security programs, full stop. No doubt about it. This is the the sort of fundamental piece of their program. And so, yes, we're joking about the f word, but we're only using it with we're using it with love. Because let's be honest, they can be a pain in the ass, but, again, critical component of security programs. And they've got a real opportunity help to continue to be that guiding light for us as we go forward. Now we have to acknowledge that the sea is rough out there. And with AI, things are moving really, really fast. Yes. We know the attack surface is growing. But what does that really mean? Well, it means that on average, an enterprise is is touching 300 new cloud services each month, and almost a third of them have high or critical cloud exposures. It means that almost half of vulnerabilities on perimeter devices are unresolved. Is it manageable? Yes ish, but barely. And the bad guys are taking note. They have this new shiny toy called AI, and it's unlocking incredible efficiency. If there was a KPI for ease of being malicious, we'd be seeing exponential growth right now. I say this with my business hat on. The growth rates that you see on the screen here of 34% growth year over year for compromised credentials, ransomware groups up 53. Those are the kinds of growth rates most tech companies would be super thrilled to have. But let's get let's take this down a notch. When we look at these stats and these numbers, yes, they are scary, but they're also a little bit abstracted from what's happening on the ground. And what I love so much about Bitsight's threat intel arm is that that what they see every day and what they do every day is so so real and also very scary. So we saw a stat like a 30% rise in compromised credentials. That's one thing. But what you're seeing on on screen is how easy it is to actually market those credentials. You can just shop for dealers, shop for credentials. You can hire for ransomware. It's crazy, and it provides an appreciation for what security teams are up against every day. The truth is that bad actors have never been better equipped to attack, and business is quite literally booming. But as we all know, we've got more than just our own chip to protect. We've got more than just ourselves to think about. And according to the 2025 Verizon data breach study, thirty percent of breaches in the last year involved a third party. That's crazy on its own. 30% is a an insanely high percentage given the context, but this is more than double what it was the prior year. So the number is not just high. It's growing. It's accelerating. The problem is getting worse. The change health care breach was one of the marquee third party cyber events that we've seen recently. It cost parent company, UnitedHealthcare, a staggering $2,300,000,000. Hugely, hugely expensive. And that doesn't include the operational disruption. It doesn't include the reputational damage. And so think about that. You can have this this really flawless internal program, but if your supplier, if your third party, if your partner gets compromised, you're still exposed in a major way. And, again, it's not just financial risk. It's operational. It's reputational. It's physical. And all of it stems from a third party's problem that might not even have existed when you brought them on board. Now the tide is moving fast, but in a lot of ways, we're still anchoring to yesterday. I love the song for the Beatles. I apologize you're all gonna have this stuck in your head for the rest of the day, but I will spare you. I won't sing it. But you gotta think about the message here. Yesterday, all my troubles seem so far away. Now it looks as though they're here to stay. Oh, I believe in yesterday. We talked about the fact that five years ago, 90% of professionals said their job was easier five years ago. And in a lot of ways, again, we're still anchoring to what what's happening yesterday. But what are we really hanging on to? Well, through the lens of security frameworks, we're anchoring on stale controls and slow updates. Threats evolve minute by minute, day by day, but security frameworks are published. They are updated when you're onboarding a vendor or when you're looking at someone for the first time. And a framework might not account for the things that are new today. We talked about AI powered threats. We talked about deep fakes. We talked about modern supply chain attacks like the one we just saw last week. That's one thing. We're anchoring on an inefficient and redundant approach where there are lots of overlapping frameworks When you're trying to sort of map and align those to multiple frameworks at a time or multiple controls at a time, you end up in the state of inefficiency and redundancy. You're doing a lot of the same thing multiple times in different ways. You're anchoring to complexity and something that's really costly from a resource perspective. And I mean people, time, money, all all of it. Frameworks can be complicated to implement. They can be complicated to interpret. They can be complicated to sort of align with the rest of your program and the rest of the information that you're getting back from vendors. And for smaller organizations or folks with a a short bench from a staffing or expertise perspective, huge huge huge investment. And what this nets out to is an a place where organizations can end up focusing more on checking the box than actually achieving the meaningful security outcome that they're aiming for. So this creates a false sense of security, and it can lead to neglect of the evolving threats that are changing and shaping our days in in real time. The security framework works. Right? It's we're we're we're anchoring to old ways, but the horizon is calling for something new. And, again, the security framework works. It's a framework. It's intended to be extensible and scalable. And it's we think this is something that's gonna continue to work for years to come, but the question is, how do we make them better? How do we help them evolve into the future knowing that the the moment of time that we're at today is one of significant, significant change? So as we look ahead, there's real opportunity to evolve and grow into the future. And while we're all struggling with the complexity and the chaos that's happening today, we think tomorrow has the opportunity to bring more clarity. Frameworks can be more than just compliance tools. They can be more than just a checkbox exercise. They can be more than just a process that you have to get through. We think they can really become operational engines. And so what that means is dynamic visibility into risk, not just static checklist. It means an easier and more efficient process that can reduce burden instead of just adding to it. It means getting to intelligence driven decisions and action plans, not just documentation for documentation's sake. The real future that we see is one of convergence where GRC and SecOps are all sharing a common language, a common foundation. Again, this isn't a replacement for today's frameworks. It's really an enhancement of their original purpose, which is all about helping teams navigate risk. So we don't have to abandon the fundamentals. In fact, we shouldn't abandon the fundamentals. What we wanna do is unlock their potential. And if we can do that, I think what we'll start to see is a bridge come up get created between compliance and security and between GRC and SecOps. And what we see more and more from teams we talk to is a desire to do more of the threat mitigation, less of the checkbox exercise. It's really much more of a high agency approach to third party risk management. And this isn't happening everywhere, and this is definitely a shift for that that organizations have to work toward. But we definitely see this happening. We see the connection being built. We see the the conversation starting. We see it in the conversations that we have with GRC and TPRM teams who are saying, I know we can do better. I know we can do more. I need to get I need to get through this so that we can sort of exercise a program that has a focus on getting to the right outcome and that helps us solve some of the problems that we started with. So the there's a huge opportunity here, but it really relies on collaboration. It really relies on, again, a different mindset, a different approach to the frameworks that we're so used to. Now I think Kelly is gonna bring up a poll question here. I'm gonna go to the polls tab so folks can weigh in here. I'm curious what your feedback is here. I actually think we're in the wrong one. That might just be my view. Well, I'll let you answer that. Maybe maybe I'll keep running through through this. Alright. Sorry. We've got a little technical difficulty here. But I guess maybe the thing that I'll end on here is that it's not all sunsets and rainbows. Again, we have tons of opportunity here, but we also have tons of challenges to work our way through. And so as we go forward, again, we think there's huge opportunity, huge potential. And at the heart of our story is this. Frameworks aren't going away. They're becoming even more important. And for that to happen, they need to evolve into dynamic intelligence engines again instead of a checkbox exercise. And what that means is continuous updates with exposure data. It means correlation with live threat intelligence. It means context about your business and your business relationships, and it means building a bridge between governance and operations that's much more focused on threat mitigation, much more focused on getting to the right outcome. Frameworks are, again, in some ways, an operating system for cyber. And right now, we've got an opportunity for a major major upgrade. Now that upgrade, that evolution means layering in data, context, automation, and, yes, of course, AI. So frameworks are not just a record of compliance, but really a source of operational insight. This evolution wouldn't be possible without AI, but AI is not the answer. It's the catalyst. It's the accelerator. It's the enabler. But it only works if it's powered by high quality data, business, and risk context, a connected ecosystem that acts on its insights. Otherwise, it's just faster noise. And in order for AI to be great, it needs great signal feeding into it and needs great teams that can act on it. So when we think about the opportunity, again, it's not an AI as the answer. AI is gonna solve all our problems. It's really how do we facilitate transformation using the right signal, the right intelligence, the right context, and the right people to make something of it. Now I'm gonna build on that a little bit. Again, I just said AI is not the answer. AI is the key. But without an engine to attach it to, without an engine to actually turn on, the key is just a hunk of metal. And that engine that I'm talking about is one that, again, is powered by great data. It's powered by rich context. It's powered by a connected ecosystem that's actually gonna do the work of threat mitigation and risk management. And so if you only have one of these pillars, you're not really transforming anything. If you have exposure data data but no threat intelligence, you're stuck guessing what matters. You're stuck guessing about what to prioritize. If you have intelligence, but you're missing the context on your vendors or your assets, you end up, again, you end up in the state of mispriorization or misfocus. And if you have automation but no human collaboration or network to act on it, it just stalls out. Context is what turns data into insight, and coordination is what turns that insight into something that actually has an impact on the result. And so this is what takes frameworks from being static and sort of helpful in the moment to being something strategic and living and breathing. So, really, again, the shift from compliance artifacts to living decision engine. So if you get it right, you can leverage these to enable automation and control validation at scale, to enable real time threat to control correlation, and continuous monitoring of control degradation. Again, AI has a ton of value here, but what it's doing is unlocking the vendor data, the exposure and performance insight, and the threat intelligence so you can actually apply them to the decisions that you make every day and to the places where your teams focus and places where you're actually putting all of your energy and hard work into motion. There's a lot of different perspectives about where AI fits within risk and cybersecurity. We really see folks run the the sort of full spectrum of adoption and interest. And so we see skeptics. We see optimists. We see everything in between. But I think the reality is somewhere in the middle. When we think about AI and security, we should be treating it maybe less like a magic wand that's gonna solve all our problems and more like a lever that we can apply in specific places to get to the right outcome. And the real magic is what happens when you bring this all together. Now what I'm gonna do is start by drilling into the first major capability that I just mentioned, and this is about automation and control validation at scale. And this is maybe the lowest hanging fruit for AI, but it doesn't mean it's trivial. In fact, if you think about the effort it takes today to validate controls, you find yourself sifting through SOC two reports, which can be dozens dozen dozens of pages long. You can be sifting through SIG questionnaires, which have hundreds of questions. You could be looking through policy PDFs, telemetry feeds, maybe even screenshots, and trying to make sense of them. Now imagine doing that across hundreds of vendors or hundreds of controls per vendor. It actually probably doesn't take much imagination at all because I imagine many of you have done that yourselves. It's a huge, huge cost. It is a huge expense to be doing that, again, at any scale. But when you think about this across hundreds or thousands of vendors, it's incredibly painful, incredibly costly, and it doesn't necessarily get you to the place you want to be from a threat mitigation and risk management perspective. But this is where AI really shines. You can hand it something big like a SOC two report. You can ask it to parse that document, map it to what matters, and connect it back with your framework. Does this particular configuration violate this this control? Does this policy satisfy this requirement? And it doesn't stop at documents. AI can pull evidence from logs, configurations, endpoints, cloud environments, other types of technical findings, and automatically align that to control objectives. Is that sexy? No. But for TPRM and GRC teams who are spending hundreds of hours every year going through documentation, It's game changing. And doing this well at scale creates incredibly incredible efficiency. It means you don't have to chase screenshots. It doesn't you don't have to manually map policies from one document to another. And it frees up your time to focus on the things that really matter. It frees up your time to focus on threat mitigation, the risk management, prioritizing risk, building better vendor relationships so that when the moment strikes, you can do something about it with confidence in where you are with your vendor. And when this is done right, it doesn't just improve your efficiency. It doesn't just make you go faster. It makes your results better. It increases your confidence. It helps you know that your validations are consistent, complete, and up to date. So it's low hanging fruit for sure, but it's also a major step forward and a really foundational step in evolving frameworks from being static documents to, again, this operational engine that can really drive our programs with a ton of success and efficiency. Now the next major capability is real time exposure and threat intelligence. This is maybe one of the most exciting unlocks that AI is making possible, and it's probably one of the biggest gaps in most security programs today. Now traditionally, we've had this kind of weird disconnect where you've got the SOC operating at machine speed in the trenches responding to things in real time. And then you've got GRC teams who are operating at a cadence that, honestly, they probably don't prefer, which is the quarterly or annual level, reviewing policies, compiling reports, assessing assessing risk maybe once when the vendor comes in the door, once again a year later. And these are two essential functions. Right? They're doing two incredibly important pieces of work, but they live in two different realities. And what AI is doing is giving us a bridge, a way to correlate what's happening right now in the SOC with what we expect to see in our frameworks. And so if you imagine you flag a potential ransomware incident, the SOC runs the playbook. But now, automatically, GRC gets a signal that says, hey. That that lateral movement mapped to this particular disk control tells us that it's time to revalidate that. We need to go back and push on that control. We need to do another round of digging with the vendor. And so instead of waiting for the annual reassessment when something happens, when something goes bump, you could actually trigger the right workflows within your organization across your teams in a way that gets you scale and efficiency and, again, gets you to the place where you can actually change the outcome. This is huge. And so every incident becomes an opportunity to learn, to improve, to tighten alignment between these two critical functions of operations and governance. And this is where frameworks like MITRE ATT and CK can come in. It's an incredible asset, but it's more of a playbook for the SOC. And so mapping the activity that you see there through the lens of the MITRE ATT and CK framework back to frameworks like SIS or NIST, that's where AI can shine. It removes, again, this manual mapping work, this manual translation layer that has to happen, enriches the context, and creates a dynamic feedback loop that actually powers your program. And the real holy grail here, the nirvana, is when this connection becomes automatic, when a control failure triggers revalidation without needing someone to open a ticket or send an email. Because here's the truth. Every org impacted by the change health care breach had controls in place. The controls aren't perfect. Incidents are gonna happen. And so what matters is how fast you can detect them, how fast you can respond to them, and how fast you can adapt. AI is giving us a new lever to do that, not just faster reactions again, but smarter ones. It's helping us move from documenting failure and documenting gaps to preventing them. And so that's how we shift frameworks from backward looking compliance tools to forward looking risk engines that we can really build on top of. Bad things are still gonna happen again, but the organizations that can adapt in real time and really weather the storm will are the ones who will come out stronger on the other side. Now let's talk about a quieter, sneakier kind of risk. And what I'm talking about here is control valve control degradation. You can do the hard work. You can ensure that your TLS certificates are properly configured. You patched your systems against the latest vulnerabilities. Your cloud assets are all locked down. But on on day one, everything looks great. Everything looks perfect. But what about on day two? What about day 100 or day 300? What if that SharePoint patch you apply back in q two quietly gets rolled back in one environment? What if your TLS certificate expires on a critical subdomain and no one catches it? What if a server that was once secured now has an exposed RDP port, flagged to Bitsight's external scan data, but buried in the noise? These aren't theoretical. They're real world issues that happen all the time. Not because someone's asleep at the wheel, but because controls can drift, configurations change, teams change, priorities shift, and slowly, silently, the integrity of your control environment starts to erode. And that's what makes this challenge so dangerous. The the degradation and the the shifting and the drifting is invisible until it's a problem. And that's where AI can have a huge impact. It can learn what healthy looks like, what normal what normal looks like across your systems and across your vendors, and it can watch for deviations over time. So when something starts to drift, like, an outdated TLS configuration or an unpatched public facing service or a new vulnerability surfacing on an exposed asset, doesn't slip through the cracks, but it gets flagged promptly, visibly, in the right context, in the right priority order. It's like a control heartbeat monitor. You don't just check it once and assume everything's good to go. You watch it. You track it. You look at it continuously because the degradation isn't just an if scenario. It's a when scenario, and you wanna be ready for it. And in a third party context, this gets even more important. You can't just trust that a vendor's control posture stays the same. We know that it doesn't. You need eyes on it. And so continuous monitoring of control health turns frameworks from a once a year compliance exercise into an always on security foundation. Again, that can apply not just to your organization, but to your third parties as well. So you can get the right eyes, you can get the right monitoring, you can get the right, agency. Instead of waiting for something bad to happen, you actually have the tools and the context and the visibility to go and do something about it. We know that controls don't all fail at once. Again, they erode over time, and AI gives us an early warning system so that we can catch that erosion before it becomes an exposure problem. Now I'm gonna shift gears a little bit. We talked about, AI. We talked about automation. We talked about intelligent frameworks. None of this works in isolation. You can't just set it and forget it and let it run and hope hope it works. The truth is that even the most sophisticated organizations with the most pristine programs are still managing risk in silos. They're collecting the evidence, they're collecting the artifacts, and then they share them one at a time. It's inefficient. It's inconsistent. And in today's environment, it's just not enough. And so this is where a network's platform can make a huge difference. This is about creating once, sharing many times where assessments and attestations and things that can help give you the right context and the right information are living in a dynamic ecosystem instead of a dusty folder. This is about helping vendors and customers collaborate in real time with the right information in a way that helps the information go flow in both directions. Because at the end of the day, what we want is for a network to be able to be established and be leveraged to help. I'm gonna get stuck in another aquatic metaphor here, but what we're what we're aiming for is for the rising tide to lift all boats. If we're all focused on the right things, if we're all improved on if we're all focused on greater improvement across our cyber programs, the broader ecosystem will benefit. We will all be better for it. And so the this is really the power of a networked approach. This is vendors and customers collaborating real time. This is threat insights and exposure, again, flowing in both directions and seeing remediation efforts that are coordinated both across customers and vendors, but also across organizational boundaries. This is kind of building on the vision of the ISACs. So these are information sharing hubs that have supported critical sectors across industries. And so this is the next generation of TPRM, and we need it to go further. It needs to be decentralized, dynamic, vendor centric. It's kind of a living ISAC. It's formed organically across your supply chain, not just sharing alerts, but really continuously syncing on risk, sharing indicators of compromise, tracking remediation, and helping to, again, lift lift the sort of posture of all organizations in the network. When you get that right, it turns third party risk management into a real time collaborative defense strategy. And that can reduce friction, it can accelerate mitigation, and build trust across the ecosystem in a way that's really powerful and has a ton of payback for all organizations involved. We know that resilience doesn't happen in a vacuum. It happens when we sort of break out of these isolated workflows and connect back to human driven collaboration. Again, this is something that gets unlocked by all of the improvements that we just talked about. When you start to free up time from the document review, the mapping, the cross correlation and the harmonization of data points across vendor artifacts, threat intelligence, exposure analytics. What this helps you do is free up time so that your teams and your people can do the work of coordination with your vendors. They can do the work of coordination with each other so that you get to a great outcome. And the good news is that this network already exists. We just need to plug into it. So we've talked about how the future of security frameworks isn't just smarter. It's more connected. It's powered by better data, by better context, and by stronger collaboration. It's powered by humans talking to humans, picking up the phone, teams breaking breaking silos, and network sharing knowledge and information in real time. But here's the thing. To make that vision real and to turn frameworks into live dynamic engines, we need more than ideas. We need tools that can actually help us bring it together. And that's why we built framework intelligence. Bitsight framework intelligence is our way of bringing all of those things that we just talked about. So AI, automation, threat intelligence, human collaboration into one unified experience. And so instead of me just talking about it, I'm gonna show you what it looks like. Alright. So, again, this is something that brings together AI powered control mapping, compliance scoring, and automated evidence extraction. And what it's gonna do here I'm just gonna pause. This is going to harmonize vendor data, exposure and performance analytics, and threat intelligence in alignment with the frameworks that you use to measure and manage risk. Again, I wanna just be super, super clear about this. This is not about changing or even fixing about your frameworks. This is really about supercharging them so that you can get more out of them and focus on the things that really matter. And so what is gonna happen here is I'm gonna come into framework intelligence. I'm gonna choose the framework that I am using. We've got another technical difficulty here. Bear with me. K. It's gonna come in here. I'm gonna choose the framework that I use for my program. It's going to select it. It's gonna prompt me to to upload vendor artifacts. And what will happen is the system is going to do some thinking. It's gonna I've uploaded a SOC two type two document and an audit report. It's gonna start the assessment. And then in just a matter of seconds, what it's gonna return is a quick overview of how my vendor is doing relative to this framework that I've chosen. And so, again, I'm looking at NIST CSF here. What it's gonna tell me is how we're doing from a compliance lowercase c perspective here, where I have specific controls that are showing up as compliant, needs review, or not compliant with an ability to drill down and see for each control. How are we mapping back based on the vendor artifacts that were provided? Again, this is from a SOC two report and from another assessment that was uploaded. What it's gonna provide is an explanation for why it arrived at this answer and then link it back to the specific evidence that we found in the documents that were provided. Now what this does is take something that could take you literal hours to do, and provide you a nice ready to go summary report in just a matter of moments. The other thing that you'll see here is Bitsight risk factors mapped directly into it. So, again, we talked about the importance of having the combination, not just the the vendor context, but also the outside in perspective on exposure and performance and how they're doing from a cyber posture perspective, which is changing in real time. And what I'm able to do is very quickly see how they're doing relative to that control framework, again, in a matter of moments. So this can save time. It can eliminate the mapping work that you do across dozens of vendors or hundreds of vendors or thousands of vendors and do that in an instant. It can help you tie answers back to actual cyber risk signals, and it helps you reduce risk by helping you sort of focus your time and your energy on downstream resilience and issues that really matter. So, again, taking out some of that sort of initial documentation and parsing and processing work so that you can focus on the places where you have the greatest opportunity to influence the outcome. So we are super excited about this. This is something that we're gonna be building on over over time. Again, huge opportunity to supercharge your frameworks and really help them be a dynamic operating system for your team. Now what I'd like to do, is leave us with a quote. And so I love this quote because it speaks to the exact moment we're in as TPRM and GRC leaders. And it says the pessimist complains about wind. The optimist expects us expects it to change, and the realist adjusts the sales. We spent a good chunk of the the start of this talking about how challenging the threat landscape is, and it is. That's the wind. It's unpredictable, relentless, and frankly, it's not always fair. And by the way, speaking from experience, the wind usually picks up at 04:00 on a Friday. That's how it goes. And so we could wait for it to calm down, and we could wait for it to get simpler, we could wait for it to get clearer or better, but we know better than that. And so the leaders who thrive in this environment, the ones who are building resilience, agility, and trust, are the ones who adjust the sales. They're evolving their work. They're evolving their frameworks. They're embracing intelligence, and they're steering into complexity with a goal of clarity and a goal of changing the the outcome, not because it's easy, but because it's necessary. And that's what today has been about. Right? Helping frameworks do what they've always done best just to guide us forward, but now with the power of real time data, context, and AI to help them go even further. So thank you for being part of this conversation. We'll keep adjusting the sales together. And I think at this point, we're gonna turn it over, for some for some questions. Yeah. I was gonna say we can share those polls now, as well. What we'll need you to do is stop sharing your screen so I can do that. Ah, okay. And then we've got a lot of great questions in the q and a. But let me share let me share the first poll that we did so we can take a look at the results. Which frameworks are you using in your current program? And I noticed some people posted others in the chat as well that they were using. So are you able to see the results, Vanessa? I am. I am. So it seems like consistent with what we've seen, which is heaviness in ISO users, a lot of MITRE attack in different in different parts of the org. I'm just seeing if I can see some of the feedback in the chat also. But this is this is super interesting, and I'm, not totally surprised. Again, these are some of the ones that we see over and over again from our customers. Awesome. Okay. The next one I was gonna share is which team in your org does the work of managing third party exposure and remediation? I love it. It's it's almost a dead split between GRC and SecOps and third party. It's amazing. It's super funny. The, it's again, there's such an an important bridge that exists between those two teams, but it's something that I think we all have an opportunity to sort of strengthen and establish better over time. There is a lot of, I don't know, I think renewed interest in third party threat mitigation because we're seeing again, we talked about the 30% of breaches having a third party impact or having a third party sort of, route. We talk about the change health care breach. We talk about some of the sort of day to day issues that we see, like the the SharePoint zero day a couple weeks ago. These are all things that need action. And so we do see that split in in ownership coming from DRC, TPRM, security ops. Lots of potential, I think, to help build that bridge, but also, to do to do more within the individual functions too. I love to see it. And then the last question we had or poll question we had was around AI. And where do you currently stand when it comes to using AI. I love it. It says this is almost a perfect bell curve. Right? Mhmm. Everybody's in the middle. They're experimenting. They're trying to figure it out. We've got some folks on the cautious side, some some folks on the sort of more forward, like, farther along in the spectrum or in the journey. I'm I would love to talk to the folks who are both super skeptical and all in. There are only a couple of you, but it's super interesting to see that because I think that's again, it's what we hear when we talk to folks too. A lot of, I think, optimism about the potential, but some skepticism about the practical implementation and some, like, concerns around governance and concerns around how it's used, how it's using data that's flowing into it. But, again, I think in TPRM in particular and in when when we're thinking about risk intelligence, there's such a huge opportunity for AI to help accelerate and improve and then sort of connect the dots between different functions. But again, it takes a lot of, it takes a lot of work to get there, and it also takes a lot of sort of human intelligence applied to it to make sure that you're acting on the right things at the right time. Yeah. Perfect. Thank you. We do have a lot of great questions in the q and a box. If you wanna take a glance over at those and see if there any that stand out that we could maybe answer a couple before we before we end today? Yeah. I would love to I see John's John Genter's question around companies combining GRC and SecOps teams. I do not see that happening so much as I see tighter collaboration happening across the two functions. And so there's more coordination, there's more, sort of especially on the third party front, there's more coordination and outreach happening across that spans the two teams. And I expect some of the third party remediation and threat mitigation work to sort of transition more into SecOps, over time, but I don't see the actual functions being consolidated at this point. The let me see if I can skim through some of these other ones too. The, Katie asked, can you use this tool to add your and all vendor content for the holistic view? That's absolutely the intent. The intent with our framework intelligence feature is to blend the vendor artifacts from the vendors themselves. And so the things that they're using to attest to their security posture or their policies and and programs, and connect that out with the threat intelligence view, with the exposure and performance analytics view so that when you're looking at a particular vendor, you're really getting this comprehensive view, but, again, sort of presented through the language and the framework that you have, that you're already using to govern your program. So the hope is really to connect the dots between all of those things in a way that helps facilitate, not just, faster review, but also better review, better prioritization, and ability to sort of bubble up to the top the things that are most critical based on the sort of cohesive view of all those different pillars of of cyber risk intelligence. Let's see. Oh, I see. Now I'm seeing the answers on the different controls. Okay. Oh, I'm seeing here. Are there any that I missed? I think the, there were a couple questions on specific frameworks that are gonna be supported out of the box by this this capability that I just introduced. Our team answered that on the chat. We're we'll have, I think, four within the first few weeks, and then our plan is to extend that over time. Our both our assessment capability and our continuous monitoring product today have some reporting that's that is framework oriented, and those have coverage for, I think, 30 or 40 different out of the box questionnaires. But we will sort of grow that over the next few months, with plans to support custom fresh questionnaires and custom prep frameworks as well. We're super excited about it. This is gonna be a big area of investment for us, but one that I think has a ton of potential both in terms of, the framework coverage and the framework alignment, but also getting to some of that, like, really rich intelligence that we provide connected, again, back through the lens of the framework and all the workflow on top of it to help prioritize, report, communicate, and automate the workflow on top of it. So tons of tons of exciting stuff coming here. Right. See. There is a question about when this will be launched. Okay. So we have this live for a couple customers today, and we're gonna be rolling it out through the next month. So if you, don't have don't have access in the next few weeks, I'd encourage you to reach out to your account manager or your customer success manager, and we can help you get that turned on. In terms of, sorry, bad multitasker. The in terms of the uploading of confidential documents to your portal, that is a challenge we have. If there are strict requirements in place that don't allow you to sort of publish it, not publish it, but share it anywhere, that would be something that we'd wanna look at carefully before we before you post anything. But I think the the key is that on the Bitsight side, we have pretty deep governance in place to make sure that we're not training our models, we're not sharing that data anywhere that it's not permitted to go. And so we're processing it, but it's something that we are that we can provide some documentation on as well in terms of the governance that we have around that. We can also we're gonna download these questions as well, and we can follow back up with with folks, with some of the answers too. Yep. Unless you see any other ones you'd like to address real quick before we close. Maybe I would just land on Christine's question, which is do you think this would help a compliance team or risk team more? And I think the answer is it depends. What we see is that this has an opportunity to really bridge the two. And so there's a, like, a connective tissue that this kind of capability can facilitate, where you're speaking the same language, where you have a a mechanism for sort of bringing in technical findings and vendor artifacts into a into a lens that is more easily translatable to other parts of the cyber organization. And so the hope is really that this will have dual use across teams, but also that it will help establish some of the bridge that we talked about. Hope that helps. Alright. Any other anyone taking more questions? Or, we can we can wrap, like I said, and follow-up, with the remaining questions in the next couple days. That sounds like a good plan. Thanks, everybody, for taking the time today. Yeah. Thank you so much, Vanessa. And thank you everyone for for joining us today. Have a great day. Thank you.