Mackenzie Jackson: Hello everyone. Welcome to another episode of The Secure Disclosure Podcast. This is a very dramatic spin there. Simon, thanks so much for coming and joining me today. So very James Bond like.
Simon Bauwens: Maybe I should.
Mackenzie Jackson: So, we meet again, Mr. Mackenzie.
Simon Bauwens: All right. Serious, serious podcast. Let's go.
Mackenzie Jackson: Thanks for joining me here today and coming on the podcast.
Simon Bauwens: Thanks for having me.
Mackenzie Jackson: There's a lot that I want to get into here. And I think just to kind of preface this, we're going to be talking a lot about phishing and areas like that. Now, in the news, everyone loves to chat about what the latest AI rogue model is doing and all of that, but when we look at what's actually impacting companies, it still seems to be phishing. It still seems to be phishing is where the initial entry point. Is that a fair statement or?
Simon Bauwens: It's definitely fair. I mean, people are bored with all the news around phishing because it's in the news all the time, but that's because it's still a main attack factor. Absolutely.
Mackenzie Jackson: Why do we struggle so much with this? Email has been a technology that's basically been around before the widespread use of the internet, but it seems to be something that we just struggle so much with. Why can't we get on top of phishing? What's causing the giant explosion that we're seeing in these phishing email campaigns at the moment?
Simon Bauwens: That's a good question. And I think we have to distinguish two different things. I think on the one hand, we are getting on top, but techniques are shifting all the time.
Mackenzie Jackson: Right.
Simon Bauwens: Initially, we had perhaps gateway filters that are filtering out a lot of the attachments, and then we have the link checkers that check if a landing page is clean, but now we see a gradual shift towards more advanced AI-driven techniques that really try to establish rapport and then build on that. So the email is just a medium, but the way that it is used in the context of phishing is changing fundamentally. The second thing that I think we need to distinguish is the uptick in how much it is being used and it's incredibly popular nowadays because AI has made it even easier than it used to be.
Mackenzie Jackson: Right.
Simon Bauwens: For sure.
Mackenzie Jackson: Yeah, and I've mentioned this before, but it was kind of funny that it used to be we were trained to look for spelling mistakes in emails to see if there's phishing because, you know, non-native English speaker maybe they write. Now it's kind of the opposite. If I see a spelling mistake in the subject, I'm like, oh, a human wrote this.
Simon Bauwens: Yes. I'm probably safe.
Mackenzie Jackson: You should always put a couple of spelling mistakes in to make sure. No, that's absolutely correct. I mean, the quality of the phishing simulations, sorry, of the phishing emails and in exercises, simulations has improved a lot. Everything looks more realistic. And then of course, there's still the business email compromise which hasn't changed, which, you know, means everything is legit, but the intent is wrong, right? I kind of want to break apart a little bit of a phishing technique, a phishing campaign, and the technique used within it because I think a lot of people kind of assume that phishing is someone sends you an email, maybe it's got a spoofed domain or something, you know, so it looks semi-legitimate and there's a link to a bad thing within that. What are we actually looking for when we're trying to identify emails? Is it contained to just the email, kind of what I'm getting at is are we just trying to find dodgy things within an email or what are the indicators that this is a phishing email?
Simon Bauwens: So there's a couple of technical indicators and I think that's what I was referring to earlier, there. We've come a long way into identifying them. Misleading links and typo squatting and all that stuff. But nowadays we see a shift towards the intent of the message. So the technical indicators as a human is difficult to do manually. You have to trust tools to do this, your gateway filters, et cetera. The intent that's where now we are getting a bit of help from AI and that means what is being asked of me? If it's just an informative email, usually no action is required. That's easy. It's usually not phishing because it's not asking you for anything. But as soon as we're asked to do stuff, click on links, send information, provide information, reply, that's where things, that's where you need to start checking things. What is asked of you? Why is it asked of you? And as mentioned, that's where AI now can help us a little bit in distinguishing, but it's our common sense, nonsense checker that will still make a big difference there.
Mackenzie Jackson: Right.
Simon Bauwens: Is this request legit because it comes from someone that I've, you know, received this request from quite regularly? Is it the first time that this is being asked? Is it the same email address that I usually get this from? This, this is what we should look for nowadays.
Mackenzie Jackson: I want to talk a little bit about MFA too. And I think I think I'm just old now, but I remember, right, it used to be the forgot my password, what was your mother's maiden name, your first pet, you know, if you if you knew someone well enough, you could get their password.
Simon Bauwens: I was there 3,000 years ago as well for doing that. Chiseling out emails.
Mackenzie Jackson: Absolutely. Okay. Now, and then and then we kind of got into the MFA era and it felt like you had MFA on your account, it's basically bulletproof, right? Now we're seeing that, you know, MFA and we have now like phishing proof MFA and all these different types. Now it seems like MFA is totally inadequate for the world that we live in now. What are the techniques that people use to bypass multi-factor authentication? Is there like poor multi-factor authentication techniques? Is there robust multi, like what is this, what? Because this amazes me a lot when you look at the phishing campaigns is that, okay, someone sends an email, they click on the link, they input their password. This still should be the MFA that stops them and often it doesn't.
Simon Bauwens: Yeah, that's because very often it is not switched on. That's the first thing. So I see a lot of IT managers and CISOs, people turn off. No, it's unfortunately, that is still a big part of it, but really there are techniques and unfortunately they rely again about on certain human reflexes. The one that really made the news I think a couple of years ago was when I believe some employees of Rockstar got hacked this way or fished this way, that they were receiving lots of SMSs, you know, prompting them to send the code, you know, the multi-factor code that was in their app, in their authenticator app. And eventually someone cracked and gave that code. And this is what's used a lot. So people are just bothered until they give in and they give up that second code too. So if if if I start receiving one SMS every five minutes, like clockwork, please provide the authenticator app code, please provide, you know, eventually I'm going to assume, oh, this must be some kind of technical error and I might just look at my authenticator app, copy, paste that code and send it to this SMS. The SMS sender looks legit. It's some generic number, maybe even a foreign number. Well, that's possible because maybe the software I'm using is also foreign and I'm just bothered until I give in, until I crack. You might say some people will never give in, but if you've received 20 SMSs like that, eventually you might. So, that's one thing. The second is that nowadays we see a big shift from these authenticator apps or two-factor authentication using SMS to passkeys. Really going back to physical keys back or forward, it's, you know, how you look at it, but where people have a key on their keychain and you know, you need that to to check in.
Mackenzie Jackson: And that's better why? Like, I always wonder.
Simon Bauwens: Supposedly it is better. I agree and I think better in when you're working with humans better is always traded off versus ease of use. If people start losing their keys, if people find it inconvenient, if they prefer receiving an SMS, it's better that they do something than that they do nothing. So if the choice is, oh, a passkey or nothing, you know, that's where it gets dangerous. So we have to trade off convenience versus security there, because if you're managing a company with hundreds or thousands of people, someone's maybe not going to comply and you need to take that into account.
Mackenzie Jackson: Yeah. Let's let's switch up a little bit to kind of what you're doing at Outkeep. And a lot of that comes down to these simulated phishing techniques. And there's a few questions I want to dive into all of that. But you know what what is the kind of objective when running these types of campaigns against like kind of against it and what's kind of the surprising results because I think we all think that we're we're bulletproof, you know, like I I think that I'll never fall for a phishing campaign. My.
Simon Bauwens: I'll hold you to it. Let's see. We have the fish. You know that we got the fishy palant on the Aikido's desk if you have it.
Mackenzie Jackson: I've heard about it. Yes, I did have the fish my first week here. It's all going to say into the matter, right? But what like what is the objective behind that? What's surprising about writing these campaigns?
Simon Bauwens: So I I want to give two two examples. The first one is that you know, training people for phishing, or to be more aware of phishing is often clustered together with cyber awareness training in general. Oh, here's a video. Watch this and you'll be more cyber aware. To some extent that's true. You can probably explain to people once or twice that don't put a USB stick that you found in the parking lot in your laptop because and people might remember that. But when it comes to phishing, the challenge is that we have a natural reflex as a human to receive a mail, to click on it. Some people are referring it to it as the hot state. You know, we try to respond to a prompt or request that we get and it's difficult to resist. And this is a psychologically difficult thing to tackle and it requires a specific technique. You cannot just send a newsletter and explain this to people and then expect them to actually actively apply this reflex. So the first surprising thing is it it's not a punctual thing. It's a forever thing. If you want to train reflexes, you need to keep going with people. So you need to keep sending phishing simulations to train that reflex. The second surprising thing is that we see when phishing simulation campaigns are stopped for three months, for four months, some companies say, "Oh, let's just switch it off in the summer for two months." And then they switch it back on. People click as if they, you know, have never received a phishing email before.
Mackenzie Jackson: I'm going to briefly interrupt this episode to thank our sponsor of the podcast, Aikido Security. Aikido Security is your complete code to cloud security solution. It secures everything from the first line of code that you write all the way through your supply chain, your dependencies, and of course, Aikido is also a leader in AI pen testing and AI code auditing. So, make sure you check them out today. You can start for free at aikido.dev. All right, enough about that. Let's get back to the episode. So, they immediately go back to old habits of clicking and especially when the company says, "Oh, you know, we think everybody has learned how to deal with phishing. We're going to switch it off." And the more noise they make around that, the more likely it is they fall.
Simon Bauwens: I like the way you describe it there because you you describe it less like a learned skill, like it's not like a skill to learn how to detect phishing and more and more like a reflex. Exactly. And intelligence has very little to do with it. I won't say nothing. I won't say nothing. Don't want to step on any toes. But no, it has very little to do with it because we see smart people clicking on phishing emails. We see in the in the statistics nowadays that it's not just older people getting fished. You know, this is another cliche that we hear a lot. That's definitely not true. In absolute numbers, in fact, we see that it's more young people because they have more exposure to to these kind of things but intelligence has very little to do with it.
Mackenzie Jackson: Right.
Simon Bauwens: Yeah. Well, I think that's kind of ported. We're going to talk about culture within companies too and I think some of that might actually come into play with it because I think there's a there's a let's talk about it now. Like while we're while we're while we're on it, because I think one of the things is how do you, I a lot of companies are running phishing simulations. How do you deal with the results following on from that? And what I want to get to and I wanted to ask to you, and we've kind of moved it up in the agenda a bit, but how do we build a positive culture around this? Everyone hates cyber awareness training.
Simon Bauwens: Yes. I'm sorry. I know this may be news to you, but like dear, right? Yes. We we, you know, the stupid videos.
Mackenzie Jackson: I mean.
Simon Bauwens: I had to hear it from you. Okay. All these years had to come to this.
Mackenzie Jackson: The videos we need to watch, you know, if you're using tools like Albert, you know, the Slack and all that. Now, yes, I'm not saying they're not good. I'm just saying they're annoying and and and people are, you know, telling how do we build positive culture? And then what do you do with the people that have, you know, do we shun them and and, you know, naming and shaving, throw throw tomatoes at them if they enter into the office, you know, yelling shame, you know?
Simon Bauwens: Put a fish on their desk.
Mackenzie Jackson: Put a fish on their desk. Yeah. Yeah. I don't mind that one. But what what do how do we build positive culture around this or or is negative culture the best way for people to learn? Like what do we do for this?
Simon Bauwens: So I I see among our clients, I see a spectrum. Generally we we prefer the positive approach and when it comes to learning, there's plenty of studies that that show that this is also the way people learn best. It's a positive, it's a positive approach that you get rewarded or praised or there's a positive reaction when you do something well. And what that usually means is that they use these numbers to not to name and shame, but rather to highlight the, you know, the people that are doing well, the departments that are doing well. Some are trying to put some gamification into that. That doesn't work for every organization. Some organizations love to compete and and see who clicked most or least and and which department is most compliant, et cetera. Other companies that doesn't work at all. We work a lot in healthcare for example. People are busy. They don't they don't want to be on some kind of ranking about how much they clicked or didn't click. They just want to do their jobs. And that's that's maybe the the the most interesting thing. It's not that they hate awareness. It's just they want to do their jobs. They don't want to be distracted.
Mackenzie Jackson: Totally.
Simon Bauwens: This comes on top of everything else they have to do. So, we like to keep things simple to the point. And this is part of the success when it's a mandatory thing, at least keep it focused. Imagine that your fire drill annually would take half a day instead of, you know, half hour check if you leave the building. This this is comparable. On the other hand, we see some companies have negative policies or or with a punitive approach. I won't name them, but we see some in finance. We see some in defense where I've spoken to people working in the cybersecurity department that say, "Look, if you click three, four, five times here, you actually get fired. After three times, your department head will call you. After four times, the CEO will call you. The fifth time, you're just out of the company." And then people are shocked, you know, why would you get fired for clicking on a fishing simulation? Yes, but these companies they they deal with defense. They deal with billion dollars in in transactions in finance or in healthcare. We could argue what if people's lives are at stake? You know, the systems of a hospital, you know, shouldn't there be some kind of punishment if we don't comply? Can you work in a bank and leave the front door open?
Mackenzie Jackson: Yeah.
Simon Bauwens: You would have some similar reaction. So, we shouldn't name and shame people. That that is never a thing. But some companies take a definitely a negative approach to this. You can see that there's a spectrum in here. And I think I think an important thing too is not to say that, you know, there's different levels of risk that are willing to be tolerated in a company depending on what they do and need to need to adapt that. And one thing that I would say the neutral point that I would favor in any case, this I would recommend to any company, talk about it. That means not just, you know, in the lunchroom, that's great. The water cooler, that's great. But make it a part of the evaluation process. Put it in your processes. If it doesn't get measured and reported and and at least forms part of a discussion in an HR context or in a compliance context, then it doesn't happen or nobody cares about it. I'm not even saying you should fire people for clicking on phishing simulations. Not at all. But if you have a training system in place with simulations, with videos, whatever it is, at least in your mid-year or end of year reviews, you could have a look at that and talk to those people and ask if they need help. I mean, it can be a positive thing. It really can.
Mackenzie Jackson: There's an interesting dynamic here that I want to talk about because one of the things you do at Outkept is you have something called ethical fishers.
Simon Bauwens: Yes.
Mackenzie Jackson: Now why I find this interesting in the context of this is that from from the perspective of the ethical fishers, we'll get into who they are.
Simon Bauwens: Yes.
Mackenzie Jackson: But they're trying to create successful phishing campaigns, right? They're trying to to to trick people. Yes. They're employing the latest techniques and there is. So there is this kind of dynamic and I think this comes back to also wanting to invest in positivity because it's successful if someone clicks on the link and it's successful if someone doesn't click on the link depending on the party.
Simon Bauwens: It's a conflict of interest that's for sure. Yes indeed. So we have a community of ethical fishers. These are people that are creating phishing emails for us, that allows us to build a live pool of of really relevant localized phishing emails. And yeah, they are they are using AI tools to create phishing emails. They're targeting specific groups. They are really working like real fishers.
Mackenzie Jackson: Yeah. And the dynamics of that are interesting to me because we know about ethical hackers.
Simon Bauwens: Yes.
Mackenzie Jackson: Right. And we and we know about, you know, bug bounties and programs all that. Is it similar economics and like these ethical fishers and and like success based reward program that heaven?
Simon Bauwens: That's where we got inspired. So indeed we we got inspired by bug bounty ethical hacking. This kind of logic of having a crowd that thinks about a certain problem. This works very well in cybersecurity. Crowds work well because lots of data points. And we thought how can we apply this to phishing? How can we leverage that that collective thinking of of a bunch of people who mean well and and turn it into a qualitative experience for for a quality experience for for our clients. So indeed our fishers they get rewarded based on the on the success of their phishing emails. So basically they they will produce a phishing email on our platform. We'll send it out and we'll pay them based on how many clicks they get, how many people fill out their landing page. Just like an ethical hacker is perhaps or or vulnerability researcher is paid when they find a vulnerability, our fishers are paid when they manage to actually fish someone. Secondly, and and this is a big part of it, the algorithm will also punish and reward the the emails that do well. We don't see the point of training people with phishing simulations that nobody clicks on. If you wouldn't click in it in a simulation, why would you click on it in real life? That that doesn't make much sense. So, we also reward the fishers that are successful with a promotion of their phishing email. It will get more exposure. More people will receive that email.
Mackenzie Jackson: Yeah, for sure. We always have a game on here. It's a game called would you rather. I'm going to ask you two very crappy questions and you have to pick one, but explain why you're picking.
Simon Bauwens: Oh, that's the difficult part.
Mackenzie Jackson: Yes. First question here, would you rather use the same password for everything but it can be extremely complex? Okay, right, multi-sentence password which is the latest trends now or unique passwords for everything except they're written in a physical notebook that you carry around with you.
Simon Bauwens: All right. So I'd probably pick the first option. I tell you why. So the one password, it actually reminds me of working with a password manager, right? You have you have a main password and if you unlock the password manager with that, you have access to all passwords. And so this would be in a way similar, only that you're using it on different platforms. So if of course they ever get leaked in plain text, you have a big big issue. And not all websites accept passwords beyond 16 characters or 18 characters. So the phrase might be an issue. But but I probably pick that one because the written version is just, you know, shoulder surfing all that. It's just too much risk. You know, traveling. Yeah, I will have it.
Mackenzie Jackson: I honestly don't know what I would pick in this situation. I need to ask it a few more times to hear some more answers and then I'll make a decision of what I think. Okay. Another one here. You're the CEO, so you'll be familiar with making decisions based on budgets and who we're going to hire. I'm going to give you an option of having a totally unlimited development budget, okay, for your company, but you can only hire juniors. All right? Or you can hire four expert level senior developers, but you can't expand. Can't expand. Which would you rather?
Simon Bauwens: At this stage. Are we allowed to use AI?
Mackenzie Jackson: AI? Yeah. Yeah. Everything's on the Everything's on the cards.
Simon Bauwens: For experienced developers. Hands down. Yes. Because Yeah.
Mackenzie Jackson: When you said I thought you were going over the junior, I was like that was a bold move. Okay.
Simon Bauwens: No. Yeah. I mean, given that these these four senior developers have some some knowledge of AI or they're willing to work with it because that might sometimes be an issue. But no, what I've seen in our team and is that this has really changed the productivity level of those people. So they can they can put out a lot of code, but the vulnerabilities, it's always something that needs to be managed. And there I see a lot of startups struggling with junior profiles just VIP coding everything and vulnerabilities get built in.
Mackenzie Jackson: Yeah.
Simon Bauwens: I'd be worried about that part. So I'd rather go if necessary a little bit slower but, you know, with AI that yeah, that gets compensated. Okay. Okay. Now, I think I I agree with that answer. You mentioned here the the component of AI, if they could use AI or not. So, let's ask this question. Okay. Would you rather have total unfiltered unchecked AI anywhere? Anyone can use whatever they want. There's a credit card that gets passed around and you can join up to whatever system you want. You know, chaos everywhere. But AI is totally allowed. Or you can still use AI, but you can only use the browser based chat function of Gemini. So if you want to vibe code, you're going to have to ask a question, copy and paste code, ignore that. I used to ask this question of like AI or no AI. No AI is not an option. So I'm going to give you a little bit of AI.
Simon Bauwens: Okay. A little bit of AI. I mean, from a security point of view, I'd have to go with the latter. I I'd just have to go with the latter. But very impractical. I mean, huge huge penalty on development. I I'd go with the letter with with the with the Gemini and and not checking because you can in your prompts try to build some of that and maybe you don't see the final code, but I think we're moving more and more towards developer teams that work like that. The other the other scenario, I mean, we haven't even talked about, you know, who owns this AI. Is it just, you know, European or American solutions or, you know, who which algorithms are we using? Who owns the data? I I'd be wary of that part.
Mackenzie Jackson: Yeah. Yeah. Well, I think I agree with you on that, but they all suck. So, which is the point of the of the game, Simon, thanks so much for coming on the podcast. Appreciate you.
Simon Bauwens: Awesome. Thanks
