Mackenzie Jackson: Hello and welcome to The Secure Disclosure podcast. We have a jam-packed show lined up for you today. We are starting off by talking about a new classification of vulnerability inside GitHub Action workflows or other CI/CD pipelines. This is called Prompt Pwn, and it is basically using prompt injection inside your CI/CD pipeline. We are bringing onto the show Rein Daelman, the researcher who actually discovered this classification of vulnerability, to walk us through why it is significant and why it is actually different from other vulnerabilities in CI/CD pipelines.
Next, we are going to be taking a look at a malvertising campaign. Malvertising is basically advertising malware. It's when you trick people using sponsored search results or sponsored ads into thinking that you are downloading something legitimate when you are downloading malware. Well, this is interesting because now developers are increasingly becoming a target of this. So we look at a very sophisticated campaign that is using Docker Hub and GitHub to actually supply malware. And in our final segment, we will bring onto the show Barry Prost to talk about the job market in cybersecurity, where the gaps are, and where we need to fill them. If your LinkedIn feed looks like mine, you will be seeing two sides of the same coin. Half of the people seem to be saying that there is a cybersecurity job apocalypse right now, that no one can get hired, and the other half of the people are saying there is a giant cybersecurity skills shortage and we cannot fulfill these roles. So what is true? Well, we get to the bottom of it with Barry. We talk about how AI is impacting the job market and what people are looking for when they are looking to hire right now. It is a fascinating topic. Can't wait to get into it. Before we get into our first segment, please do me a quick favor: subscribe to the channel, like this video. Every single subscriber that we get makes an adversary cry. That is a known fact, so make sure you get those tears flowing. All right, enough from me. Let's get into the first segment. CI/CD pipelines and GitHub Actions in particular seem to be a bit of a weak spot right now. I am sure you will probably remember the Shah Hulaude worm that was infecting multiple npm packages just a few weeks ago. 800 npm packages were infected. 30,000 repositories containing secrets were created. All of this actually started a little bit because of a GitHub Action vulnerability. See, the attackers needed to seed this worm and needed to do it in popular packages to give it the best chance that it would propagate. How they did this is that they found a weakness inside PostHog and AsyncAPI, two extremely popular organizations with lots of weekly downloads on their npm packages. And the weakness that they found was in their GitHub Actions. It allowed them to actually exfiltrate secrets because of a misconfiguration that they had. Well, researchers at Aikido have uncovered a new classification of vulnerability, again infecting GitHub Actions and also some other CI/CD pipelines and again allowing people to exfiltrate secrets and exfiltrate them in large companies like Google. So to really understand this, I brought onto the show the bug bounty hunter and researcher that actually discovered this, Rein Daelman. The vulnerability is called Prompt Pwn. And as that name may suggest, it is about having prompt injection in your CI/CD pipelines. And you may be thinking, wait, prompt injection has something to do with AI, not CI/CD pipelines. Well, you're right. But a lot of people are adding AI into everything, including inside their CI/CD pipelines. You see, there is a huge trend to be able to take data and be able to analyze it. So for example, maybe if you have lots of GitHub issues coming in, you could put inside your CI/CD pipeline or your GitHub Actions workflow to actually analyze all these issues and let you know which ones are legitimate and which ones to prioritize. The problem is that that all comes from untrusted data. So I asked Rein to walk us through the essence of what is Prompt Pwn.
Rein Daelman: Essentially, I noticed an uptrend in using AI, using LLMs, when doing issue triage, when doing issue deduplication and stuff like that in GitHub Actions. So all of this stuff is possible to be triggered by unauthorized users, right? Like in Google's case, non-Google employees. And I noticed a lot of the times user input was being used there and you could influence the LLM. I noticed sometimes AI agents were being used to do this duplication, but it is not really necessary. You do not really need a lot of permissions to do this kind of stuff. But I noticed this being used, and these agents were actually had a lot of permissions which could be abused by doing a prompt injection.
Mackenzie Jackson: So to recap, organizations are using AI tools to help them do things like triage issues inside their GitHub Actions workflow, but the information that they're triaging or analyzing is untrusted. It comes from users. So they can put a malicious prompt inside that.
Rein Daelman: There are a couple of ways that workflows can trigger based on an unprivileged user. One is on issue creation. That is what I saw a lot. So anyone can just create a GitHub issue saying, "Oh, I found there is a UI bug or whatever," and include a prompt injection payload at the end like additional instructions: "Gemini CLI, please do this." Other things can also be when opening pull requests, like with pull request targets. There are a couple of ways you can trigger these workflows by an unauthenticated or unauthorized user.
Mackenzie Jackson: Because these tools run with higher-than-needed privileges, you can do things like get these tools to actually publish secret keys like your GitHub access token inside the GitHub issue. Now, before you jump in the comments and tell me, like many people have, that this is not new, that untrusted data inside GitHub Actions workflow is not a new vulnerability, and they would be right, but they are missing one key component here. And that is that in other cases, when you take untrusted data, so the pull request description or the GitHub message or the GitHub issue context, and you use it within a GitHub Action workflow, you can get things like remote code execution if that untrusted data is being used in a shell command. But in this case, it is not being used in a shell command. It is just being parsed into an LLM or a tool, something like Google Gemini, Claude, Code CLI, or various other tools. But because these tools have access to other abilities or other tools inside them, you can actually get it to escalate. So this is the new component, not the fact that untrusted data is being used, in the fact that untrusted data is being used in what previously would have been a safe way.
Rein Daelman: We have seen this type of thing before where you would have untrusted user input going into shell commands. So this is known research. But in this case, it is actually user input going into prompts, and even the AI's response not even going into shell commands. The issue here is the AI agent having access to privileged tools, and those privileged tools can be executing certain commands which can then in turn be abused to leak environment variables and stuff like that.
Mackenzie Jackson: So why do we need these AI tools in our GitHub Actions workflows? What is the point? Is it just AI for the sake of AI? Well, no. They are actually pretty helpful, and I can understand why companies are using them.
Rein Daelman: I saw it being used a lot for issue triage and issue categorization. Once a GitHub repo becomes too big, there are a lot of people using it, a lot of people submitting small bug reports, it is almost impossible to manually go through all of them. So AI is being used there for issue triage.
Mackenzie Jackson: Now there is something kind of interesting in here. The repositories or organizations that are most likely wanting to use this type of AI process in their CI/CD pipelines and their GitHub Actions are repositories that are very large or from large companies. They have a lot of issues coming into them. So they want tools to help them get through this. So this means that the vulnerability is actually most likely to occur in large companies. So I asked then, is this an isolated incident? We have mentioned Google, but were other companies affected by this? And the answer will surprise absolutely no one. Yes, lots of companies were affected by this.
Rein Daelman: The example we gave, of course, is Google. Google's own Gemini CLI repository was vulnerable to this. This has been disclosed, fixed, and all of that, and we have got permission to disclose the vulnerability. But we actually saw quite a lot of very big repositories, talking 100,000 GitHub stars, stuff like that also being vulnerable, and also some Fortune 500 companies directly being impacted, meaning their own repositories as well. Without naming names, there was quite a large attack surface here, quite some big names being impacted, and this is even excluding the impact after a full supply chain compromise. So what this could have enabled was stealing tokens using those tokens to push vulnerable or malicious code to production, and then impacting everybody using this code.
Mackenzie Jackson: So what here is the solution? Do we rip AI out? Do we bring on the chorus of I told you so from all of the AI skeptics that told us that this was not safe, that we shouldn't use this? Not so close. There is a little bit to understand here. It is hard to sanitize the data, the untrusted data. If we want to use things like GitHub issues and use them in AI tools, it is very difficult to guarantee that there is not a prompt injection in there because it is looking at English. And there are other things to try and make sure that the prompts aren't malicious. But typically, we are seeing that this is a cat-and-mouse game, and people can typically get around this if they try hard enough. So what is the solution? How do we use AI safely?
Rein Daelman: You do not need privileged tokens or privileged tools to do issue triage, to do this type of thing. You could use AI agents with limited tokens, limited permissions. This is also the way that Google fixed the vulnerability. There is still a prompt injection there. However, they fixed it by removing the GitHub token that it had access to, that the agent had access to. So limiting permissions is very important here. Another thing, you do not really need an AI agent. You do not really need the agentic capabilities when doing issue triage and stuff like this. In this specific case, you could also just use an LLM without tools, use the output safely, of course, and go from there.
Mackenzie Jackson: And finally, if you want to know if you are affected by this, if you are using these AI tools and you want to know, hey, am I doing this insecurely? I am not sure. Well, there are some ways that you can do this. There are open-source rule sets that will now allow you to detect this. Rein explains this.
Rein Daelman: We actually open-sourced OpenGRAP rules. So anybody can scan for it themselves, scan for this behavior. So that is the main one. And always keep in mind, limit the tools you give to agents. Limit the way you go about using user input. And also very important, make sure that you do not trust output from an agent. Do not trust output from an LLM. Do not use that in shell commands and stuff as well.
Mackenzie Jackson: And if you do want to check that your GitHub Actions are safe, that your infrastructure-as-code files are delivering secure cloud environments, that your code doesn't have issues in them, then you can check out the sponsor of this episode, Aikido Security. Aikido Security is your complete code-to-cloud security solution. It does everything from scanning your static code, scanning your GitHub Actions work files for these exact types of attacks, looking at your cloud infrastructure, making sure there are no vulnerabilities, and they have even released their agentic AI pen testing module, which allows you to perform pen tests within hours. So make sure you check out Aikido today at aikido.dev, or of course, there is a link down below. Moving on to our next segment. There has been a pretty sharp increase in developers being targeted. We have seen this all this year, and this is because attackers, especially state-sponsored attackers, have figured out that developers are a really juicy target. They have privileged access. If you can compromise their machines, you can obviously try and get to things like secrets, credentials, access into cloud infrastructure. You can try and poison packages and conduct supply chain attacks. Developers are really the key to what could be the worst-case scenario type of attack. We have seen this a lot in phishing campaigns targeting developers with poisoned packages, and now we are seeing it with malvertising. Now, malvertising is malware through advertising. Arctic Wolf Labs actually uncovered that GitHub was being used as a way to deliver malware through malvertising, and ESET Security have now also discovered that Docker Hub is being used in a nearly identical way by the same threat actors. To talk about this, I kind of want to start at the beginning. So Arctic Wolf Labs in August released a report that basically showed how attackers were mimicking GitHub through advertising campaigns. And essentially, when you searched for GitHub Desktop, the top result was for a malicious page. But here is the kicker: when you looked at the URL of the advertisement, it said github.io. And when you went to it and you looked at the domain that you were at, you were on github.io. And that is because GitHub allows you to create something called GitHub Pages. And that is what this was. It was an attacker-owned page that just happened to be hosted at the GitHub domain. But this makes it increasingly difficult to spot malvertising campaigns because when you are looking at it and you are looking at the URL, when you advertise it, Google, Bing, DuckDuckGo all allow you to put in a custom domain if you want. The custom domain has to be a part of the domain that you are at. So it has to be part of github.io, but you can just be github.io. So it looks much more legitimate. Once you landed on this page, it looks exactly like what you would expect a GitHub page to look like: a fancy download button that is going to compromise your machine. Well, ESET Security actually discovered this because one of their customers accidentally downloaded this malware, but they did not do it through the GitHub campaign, which has been going on since August. They did it through the Docker Hub campaign. Exactly the same process. They created a malicious Docker Hub page that they were advertising in places like Bing. And again, when you looked at the domain, it was pub.docker.com, docker.com, the legitimate domain that you would somewhat expect. Once you landed on there, you got to a Docker image with a Readme that explains to you how to download Docker Hub. Problem was that you were not downloading Docker Hub. You were downloading malware from this. When researchers actually started investigating the accounts of these attackers, they also found things and extensions for places like Git, like Slack, like Chrome. So we can expect many more malvertising campaigns targeting developers at these specific tools, too. Preventing this is kind of tricky, and to be honest, I only really have pretty weak advice right now: be vigilant, make sure when you download something, you do it through the homepage. Don't trust anything, really, I guess. And ultimately, make sure you are scanning anything that you download for known signatures of malware. And on that cheery note, let's move on to our Leaders and Legends segment. At Black Hat MEA, that is the Middle East and Africa chapter of Black Hat, I got to sit down with Barry Prost in Saudi Arabia, and we talked about the job market in cybersecurity. Now, Barry Prost is a co-founder of Rent a Recruiter, and I know what you are saying, Mackenzie, really, are you bringing recruiters onto the show? And the answer is yes, absolutely, because there is a lot happening in cybersecurity when it comes to the job market. I am seeing so many conflicting stories about mass layoffs, about people not being able to find jobs, and then at the same time about this gigantic skills shortage that we are going through. Now, I am assuming that both are correct, but I do not really understand how both are correct. I do not understand the impact that AI is having on all of this because it does not seem to be taking away jobs as much as just redefining them. But Barry is on the pulse with all of this. He knows what companies are looking for right now. He knows how to make candidates attractive. So it was a really fascinating conversation for me to pick his brain a little bit and get to the bottom of what on Earth is actually going on in the cybersecurity job market. All right. So we are here in Black Hat MEA, or in Saudi Arabia in Riyadh. I am here with Barry. We are going to be talking a little bit about recruitment employment in the cybersecurity space, particularly in this region. So Barry, welcome to the show. Do you want to give a quick intro?
Barry Prost: Sure. Sure. Sure. Thanks so much, Mackenzie. Great to be here. Great to be in Riyadh when the weather is like this. Great pleasure. So I am involved with a couple of recruitment brands, Propel Consult and Rent a Recruiter. Our core service is providing an embedded recruitment service on a monthly subscription. And one of the key verticals that we are focusing on purely because of the explosion in demand that we are seeing now and that we are expecting in the cybersecurity space, particularly here in Saudi Arabia.
Mackenzie Jackson: Why do you think that there has been such an explosion in the need for cybersecurity professionals, especially here in the Middle East?
Barry Prost: Yeah, sure. Sure. I mean, it is a really good question, but we are seeing, I mean, we are seeing really a surge in demand, and a lot of it is to do with the migration to cloud associated with the giga projects like NEOM that we are involved in, where we placed over 2,000 professionals over the past four years. But look, no, I think we are going to see an increase in investment to $12 billion per annum in cybersecurity by 2027, and that is going to drive continued demand for cyber professionals.
Mackenzie Jackson: Yeah, I think when we look at these big infrastructure projects like NEOM, like you are talking about, they get a lot of press, and they get a lot, but they are physical. Why is cybersecurity such a big part of that that you are seeing? Why are they driving such a need for this recruitment in this tech space? Because it feels like it is a physical infrastructure project primarily, but there is a whole bunch of cloud going on, a whole bunch of security going on for sure.
Barry Prost: And I think, I mean, I think what you are seeing generally is just a move, a digital transition, whether it is AI or whether it is banks moving to fintech and digital banking. And I really think it is just it is associated with a general digitalization of the economy. And we are seeing that more so in Saudi than most other places, I think, and that drive and that continued investment. And I think what you see in Saudi is, you know, when they say they are going to do something here, they put the money and the investment behind it. So anyone who wants to see how to put on an expo should come here. Definitely.
Mackenzie Jackson: Yeah. Yeah. For sure. I want to get into a topic now that is a little bit of a misnomer for me, and that is essentially, I am seeing two things in cybersecurity. I am seeing one, we have this gigantic job shortage, and I am seeing a whole bunch of people that seemingly have skills that cannot seem to find jobs. If you are in places like Reddit and all that, there is a whole bunch of people.
Barry Prost: Really good question. A really good question. What is the actual kind of truth behind this? And what and why is the, why does it seem like there is a disconnect? And I think that is a really good question. And I think it is and I think employers are to blame. I would say I think there is an issue with employers, you know, and their job descriptions with too much of an emphasis on unnecessary qualifications and experience, right? So, in other words, to put it very simply, you know, they might be looking for five years' experience, and that might not be necessary, you know? So simply kind of making the job descriptions too onerous, too many requirements, too much experience required, not necessarily. That is one aspect to it for sure. And I think that is something that employers do need to address. And one way that we advocate when we are talking to our clients is really to focus on skills and capabilities rather than requirements and certifications. And I think, you know, that is the key, you know, that is a key shift that I think we need to see. We need to see a shift kind of away from the CV and more towards the candidate's portfolio. And so we advocate for candidates to really kind of develop a defender portfolio, if you like, of what they can do. And that is, and that is not just in cyber. I mean, I think we are, we are seeing a move to skill-based hiring across the broader economy. And employers that adopt a skills-based approach have much greater success when it comes to hiring the right people.
Mackenzie Jackson: Yeah. Because the other kind of part of that that I see is like in this same question is kind of you have all these certifications that you have. And I guess certifications are one way to qualify a candidate easily, like at least in some regards. I do not know that is necessarily true. What is your take on certifications?
Barry Prost: Yeah, look, I mean, I think, and I do not want to say that you cannot dismiss certifications. I think they are genuinely very important, and I think, you know, for candidates at that younger level that I think you talked about, I think my recommendation would be to look at certifications and definitely to, it can be a great pathway into cyber for maybe people who do not have that experience. So certifications, sorry, just noted down a couple of key ones will be like CISSP, CISM, CISA, CIPM, et cetera. So certifications definitely have a role to play, especially for that younger cohort looking for a pathway into cyber that maybe do not have the experience, have not built up the portfolio yet.
Mackenzie Jackson: Yeah. No, I think I think that is good because there are so many. It is hard to choose the right ones, and it is hard to know if it is even going to kind of land you a job because sometimes it feels like there is a little bit of luck. Certainly in my experience into cybersecurity, there is a whole bunch of luck involved and just and just direction. But yeah, so I mean it is, I agree with what you say that certifications cannot be dismissed, but I also kind of hear that it is not the be-all and end-all.
Barry Prost: No, you are dead right. And I would always go back to capabilities, build up your portfolio, and really focus on that, on that side. I think that is, that is critical, you know. Yeah.
Mackenzie Jackson: Now, it is 2025.
Barry Prost: Yeah.
Mackenzie Jackson: I cannot do a podcast and not talk about AI or I will be deep on the rules that we have. Well, we hosted a conference last week on future of work in Bahrain, and pretty much dominated by AI as well. So, yeah. Yeah. Yeah. I mean, every every conference, every podcast. Yeah, plays a role, right? I think part of it is that we still do not really have any idea how it is going to affect what are what is the limit? Like is there a limit? Are we going to GenAI? You know, you, as Elon Musk said, are we all just going to be on to work anymore? Yeah. Yeah. 20 years' time. Roll it on. Yeah. Yeah. Yeah. So where, let's talk about right now because that is what we can talk about right now. Where is AI impacting the job market right now?
Barry Prost: Yeah. So I think a couple of key points here, and these points are relevant for cyber and outside of cyber as well and the broader workplace. I think candidates need to be using AI to automate repetitive tasks. I think that is critical, and I think candidates need to upskill in AI. And what we are seeing in the marketplace is that candidates who can use AI generally get better remunerated than candidates who cannot. So I think it is more to think of it as your ally. Think of it in the context of augmented productivity, allowing you to do more, deliver more value for your employer, deliver more value for your clients, and therefore earn more.
Mackenzie Jackson: Yeah, I I I I totally agree. And I think there is, there was a knee-jerk reaction when AI first came out from security, which was to push back against it. Like Samsung, for example, they had a breach and they just banned all AI. I feel like that is just an impossible task, like the wrong direction, right? It was like it is like trying to ban the internet in the nineties.
Barry Prost: Yeah. Yeah.
Mackenzie Jackson: You need to embrace it, right? I think you use it properly.
Barry Prost: Yeah. And I think a lot of like new people, this is the, I can, I can only relate this back to me, but when AI first came out and I was using it for my job, I felt like I was cheating. I feel like a lot of new people may feel the same way, is that like you kind of like, yeah, you know, like it makes you, it makes you feel like you are doing something a little bit naughty.
Mackenzie Jackson: Yeah. Yeah. Yeah. I feel like that stigma is completely gone.
Barry Prost: Yeah. Yeah. Yeah. Well, do not get me wrong. I mean, I get, I get emails from colleagues, and, you know, there there is a bit of a, you know, you can immediately sense, you know, that it has been written by ChatGPT. And that is quite frustrating because they tend to be very long emails, you know. And so that, I think there is a bit of that. And obviously, we know we have heard the term AI slop, and so it does need to be used in the right way. But, yeah, so I think, yeah, it needs to be used in a smart way, but it can 100%. I mean, it can, it can, it can increase your efficiency as a worker like dramatically. And I think AI is not coming for your jobs, but someone who can use AI might. I think that is kind of the message that I agree with.
Mackenzie Jackson: Yeah, I feel like I just got a clip from. AI is not coming for your job, but someone that you can use AI might. Yeah. Okay, that is a good one. No, I I really resonate. I really resonate with that and using AI. What are the best, when you, you kind of mentioned before that you help candidates as well as employees kind of find find this merge.
Barry Prost: Yeah.
Mackenzie Jackson: When you are talking to a candidate about using AI, what are you saying to them is is like what, what, how should they, I am going into cybersecurity, maybe I have a certification, maybe I have some experience, whatever, but I am pretty basic.
Barry Prost: Yeah.
Mackenzie Jackson: What what does learning or using AI look like in cybersecurity, right? Yeah. Yeah. Yeah. Yeah.
Barry Prost: I I think very similar to companies on that journey that that that that AI journey that we are on ourselves. And it is really looking at kind of what are the repetitive tasks in our business that we can use AI to do for us to allow us to focus on the more strategic work. And I think I think candidates should think exactly the same way. You know, what are the repetitive tasks in my job that I can that I can use to automate. So I think it all starts with a workflow. You know, like I would look at looking at your workflow and writing it down even and and and and looking at what tools that you can implement to take to take that off your plate, basically.
Mackenzie Jackson: Yeah, we are seeing big shifts in the job market, and chatting to you just before this, I have kind of a feeling of where we might end up in here, but where are the big shifts in the kind of employment market in terms of geographical locations? We have talked about the giant need here in Saudi for for big security.
Barry Prost: Yeah.
Mackenzie Jackson: Where where else are they kind of seeing these demands, and and where is it quite tough to be a security? You yourself, you cover a lot. You are from, so you kind of got the EU covered. You are here in in the Middle East. You got offices everywhere. What are you seeing is where is demand surging?
Barry Prost: Yeah. And also in the US as well. I mean, I think there is potentially, if you are talking about, are you talking about location or are you talking about industry or a bit of both?
Mackenzie Jackson: Let's start with location. Yeah, like physical. Yeah. Like like geological, geographical location.
Barry Prost: I mean, you could not really, you could not look beyond, it is very hard to look beyond the Middle East in Saudi Arabia. I mean, there has been such a huge demand driven by the giga projects for professionals over the past number of years. I think at one point, I mean, I am going to say, do not quote me on this, I am aware I am on a podcast, but I I think, you know, if I was not on a podcast, I think there was some crazy figure like it was sucking up a third of the world's consulting resources, you know, at one point. Like it was just insane, a huge drag in resources. I think that is eased off a little bit now, but we are still seeing, I mean, like we were telling before, there is going to be a demand, a shortfall of 50,000 cybersecurity professionals by 2030 in Saudi Arabia because what is happening is they think there is 10,000 local talent being produced per per year, but the demand is increasing by 30,000 per year. So there is a massive there is a massive potential shortfall there coming down the track. So it is very hard to look beyond this region. I think outside of that, you know, over the past number of years, the US has had a very tight employment market, very hard to find talent. And obviously, with all the investment that the inward investment now we are seeing in the US, I think that is only going to be exacerbated as well. And I know in the EU there is a massive shortage for digital talent, too. So, yeah, I mean, you know, we are, we are struggling kind of across the board, really, I think, for talent.
Mackenzie Jackson: And what would be kind of, if we could, if we could break it down, if there is someone looking looking to kind of maybe, let us say that there is established in cybersecurity, looking for a career change.
Barry Prost: Yeah.
Mackenzie Jackson: Like what what industries are hot right now? We have talked about location, like what, where are you kind of seeing? You talked a lot about the giga projects. I am assuming we are going to, yeah, we are going to talk about that, which is interesting to me because not my immediate, my immediate thought. But what other industries are you kind of?
Barry Prost: It is very hard to look beyond AI and FinTech, you know, as two really, really strong areas, really strong growth areas at the moment. So, I mean, yeah, I I, you know, there is the AI company here in in Saudi, you know, that is, you know, recruiting a huge amount, a huge amount of staff at the moment. So, yeah, I mean, very hard to look beyond those two sectors, I said.
Mackenzie Jackson: Yeah, probably not not not all that surprising. Yeah, is what we are is what we are hearing. And in terms of kind of the roles, if you, if you could advise someone looking to get into security that is looking to get, what what type of roles are you seeing providing kind of opportunity? Yeah. In terms of, obviously, you got SOC analysts, areas like that, but there is also AppSec, there is a whole bunch in in cybersecurity, where where where are kind of the roles? I guess we could look at different personas, we could look at entry-level and we could look at kind of.
Barry Prost: I mean, I yeah, I would probably say, if you are starting off, I think, you know, like, like we kind of touched on earlier, I think for for for candidates, younger candidates, really focusing on that building up that portfolio. Yeah, I think that will be kind of key and then to show their work and kind of, and also pick a specialism early, I think. That is that is kind of important too. And whether that is in SOC or DFIR or red team or cloud security, I think that is that is quite important. I think, you know, the generalists, you know, it probably is not is not a role that is that is that widely available. I think what is in demand now are for candidates who specialize in certain areas within cybersecurity.
Mackenzie Jackson: Right. Interesting. And now in terms of profiles that maybe want to reach out to you, let us go of like, who who should reach out to you or your organization to try and find some sense? Yeah. Yeah. And and I am sending you my profile. What key things are kind of knocking you off your socks going, "Yes, this guy I am going to refer."
Barry Prost: Okay, brilliant. Great. Well, first of all, please do not send me a CV that you have created with ChatGPT.
Mackenzie Jackson: Okay.
Barry Prost: No investors in there.
Mackenzie Jackson: No.
Barry Prost: Would you like me to smarten this up for you for to send to an employer? Often they leave the prompts in at the end, you know, the ChatGPT prompt, you know. Yeah. Yeah. So that is a dead giveaway, unfortunately, but it still happens. But it is a bit like, you know, back back during COVID, you are still on mute, you know, they are on a V, you know, so people are still doing that a little bit surprisingly. So I think from a candidate perspective, I I I think to go back to what we touched on earlier, we would love to see from candidates, hear from candidates about what they can actually do, you know. So again, like we would love to kind of and and this is more broadly speaking anyway. We would love to kind of move away from the CV. Let us face it. I mean, maybe the CV is hopefully done. It has had its day. Yeah. And maybe we can maybe move on. But we want to see portfolio. We want to see what you can actually do, what your capabilities are, not necessarily just your experience, you know. And I think from a company perspective, we would love to talk to organizations obviously that are looking looking for cybersecurity professionals. We love to talk to organizations that are having difficulty, you know, filling those roles. Yeah, we can not just help getting bums on seats and sending CVs, but we also try to look at the whole recruitment function for an employer. So look at their reputation online, look at like how their hiring managers are doing the interviewing. Looking at, you know, what their what their brand is like. So I think there is a number of pieces that we can we can help employers with, you know, who are having challenges getting the right people and also keeping the right people because let us face it, there is no point hiring in one door if you are losing people out the back door.
Mackenzie Jackson: Yeah. Yeah, you know, so. So, yeah, that that that would kind of sum it up from an employer and a and a candidate point of view, but but yeah, happy to chat to anyone who needs any support from an employment perspective. Awesome. Well, Barry, thanks so much for sitting down.
Barry Prost: Absolutely. Great. Yeah, great to meet you, Mackenzie. Hopefully, we can do it, we can do it again sometime at Black Hat 2026.
Mackenzie Jackson: Yeah, awesome. That guy. Great stuff.
