Good morning, and welcome to Addigy Frontier. Thank you, Jason, for that wonderful keynote. And I’m super excited to come now to our Apple security panel. This title, 84% of businesses run Macs, so do a 100% of attackers. Well, we’ll get right into it. But I’m super excited to be spending some more time with Patrick Wordle and Matt Lee of PAX eight. But myself, Angela Diico here, product marketing manager at Addigy, and I’m really just trying to get the the conversation started over here. But I will talk a little bit more to… Well, I’ll let the two of you gentlemen introduce yourselves more. So I know Patrick, CEO of W and doing some really great work with your project Objective C and and getting the next sort of generation of IT admins up to speed here and ready to tackle these problems. But I’ll I’ll I’ll let you kinda take it away here, Patrick. Angela, thank you. And, also, thank you to Addigy. Very stoked to talk super nerdy about all things related to Apple security. Yeah. As Angela mentioned, I really, for better or worse, live and breathe Apple security about twenty years now, largely diving into threats, exploit malware that’s targeting Apple’s, probably desktop, but also mobile operating systems. So, again, very excited to be here and, hand it off to Matt now to introduce himself as well. Yeah. Thanks, Patrick. I’m I’m excited. I’m the dumb guy in the room today. This is fantastic, so this works well. Yeah. Matt Lee. I have been in the managed service community, managed service provider community since about 2011. Prior to that in a whole different… Bunch of different organizations. But I’m super excited today to bring what I work on, is the operations side, the tactical delivery of security at the end for managed service providers, and ultimately those that support the small to mid sized business and serve that 43% of the GDP that lives below what Wendy Nathor coins the cybersecurity poverty line. So thanks for having me here. I’m excited to talk about frameworks and operations and and Mac security. Very cool. Awesome. Alright. So without further ado, so we’ll get right into it with where this stat came from. And what I’m I’m hoping for us to do here is dive in a little bit more, Patrick, to your research. Matt, the lot of the really interesting frameworks that you have and the work that you’ve been doing with Pax8 and also your own companies and initiatives to kinda give people a view, you know, whether you’re an MSP, you’re an IT director, you’re an IT leader. Just some kind of like new new ways and new lenses to kind of use when we’re talking about security in Apple. But, yeah, where where did this stat come from, Patrick? I’ll I’ll leave that over to you. Sure. So I guess I’m gonna somewhat date myself. But, yeah, maybe about fifteen, maybe twenty years ago when I started Mac security research, Mac was really just this second, third class citizen. Like, even when I was at the National Security Agency, none of our targets were running Mac. And so, like, nobody really cared. And maybe it’s a little of a harsh statement, but since then, Macs have just proliferated. I think many of us dearly love our MacBooks, our Mac Minis, our Apple products, and I think business in the enterprise has equally embraced Macs. You know, this statistic is, you know, almost 85 of of businesses run Macs. And so the follow-up kind of play on this is that means that, essentially, all attackers who are, almost by definition, very opportunistic, are starting to focus on macOS as well. And we’ve seen this not just anecdotally. I think the data backs us up as well. Each year, I really dive into all the new Mac malware samples. And over the last few years, many of these variants, these malware has actually existed on other platform before on Windows and Linux. And so as Mac, though, has become more prolific in the enterprise, what we are seeing is the attackers porting their existing threats, also building new ones, but porting a lot of times their existing Windows and Linux malware to to Mac OS. And, you know, there’s a lot of debate why as Macs become more popular, so does Mac malware. To me, it’s super simple. And, again, it just comes down to the fact that attackers are super opportunistic. And as Mac increases in terms of its market share and prevalence in, especially, enterprise, it’s really a no brainer for attackers to follow suit. So I don’t know if Matt can give something to add to that as well or… I do. I’ll add. You know, Willie Sutton in the nineteen forties or so is going to have said, why do you rob banks? He said, well, because that’s where the money is, stupid. Right? And so, like, I think there’s an element of of saying that more and more… I’m sitting in front of five Macs I’ve purchased in the last year. Right? So, like, like the more and more people are adopting Macs and maybe shelving away their Linux and certainly in the enterprise world, Windows. As we’ve gone more identity centric, meaning I has OAuth token and can access OAuth apps, it doesn’t matter where the device is and what device it is. And so people have tended to go towards MACs, and that means threat actors have now shifted their focus to where they’re gonna get the token and be able to have access to things. So It’s where the money is. That’s right. As Willie Sutton so perfectly said. Very prophetic. Yeah. No. But this is great. I mean, well, it’s not great, but it leads into really this idea that we started talking about that Jason was really kind of, you know, touched on a bit in the keynote about, you know, like, who who can you trust? So knowing, you know, that we’re we’re kind of dealing with a whole new landscape out here, you know, what… How can we, you know, kind of take a new lens to think about, you know, how do we talk to our vendors? What tools do we want to be able to use? Like, what’s our process to vet those folks? So this is really kind of I think the through line, but this idea of, you know, like security is operations. I know Matt, you and I really talked about this, and this is this is gonna be a big part of the discussion. So hopefully, we’ll be able to walk away here with again more of those takeaways, but Max being the target now. You know? Like I just… I do wanna set the stage of securities operations. Right? And and I’ll make another hyperbolus analogy for this for this point. But if you are in the Simpsons metaverse and you’re gonna go to a doctor, is it doctor Nick? Like, does does doctor Nick need to be the guy cutting on you because hi, everybody, was not a very good doctor, actually. Right? And and my point is, like, you can have the best scalpels and the fat spreaders and the lights and the most sanitary rooms, but if I’m the guy wheeling the scalpel, you’re in really bad shape. I have slept in a Holiday Inn Express, but that does not make me a surgeon. And so the challenges that we like to think of as, oh, I’ll just buy another tool and we’re going to get into this in a bit. But it really is if you can’t operate upon those and you can’t do things and take action upon it, not gonna do the things that are necessary to reduce the impact in the blast radius in an environment when something does happen. Right? Oh, that Mac has a problem. I’m gonna isolate that. I’m gonna deal with those user accounts. I’m gonna deal with the identities. Those are responses that take operational things to be able to drive forward. And and if we think about this in a more simpler… More simple term, because simpler is not a word, when you look at NIST, it’s identify, protect, then detect, respond, and recover. And and detect, respond, and recover are all after the boom happens. Right? And and and it’s all after something kinetic has happened, a piece of malware that Patrick has studied, has landed on your machine, has executed, has bypassed EDR, now we’re doing something in that in that path. That takes operations to be able to reduce that blast radius ex post facto. So my take is that so many people like to think the tools get you there. Buying a gym membership gets me fit. Negative. Going to the gym does and eating better and those things that are corollary to that in operations. Alright. But that’s my thoughts is people need to stop saying, I can buy a tool. When you think, what are those operational aspects that need to support this that can take a strategy, take it into its tactics, and then break it down into operations, and execute upon those operations? A 100%. No. And that’s a really great great point. And what is perfect actually thing now for us to talk about is this idea of, okay. Like, so what are we dealing with? Like, what’s the shifts that we’re seeing and what… If you could, Patrick, talk a little bit about this, because I know you you have such a a breadth of really, like, deep in the weeds of research to bring to folks here. I mean, if you could, you know, just kinda walk us through some of that. Like, what what should folks know going into, you know, managing their Macs and managing their Apple devices? Yeah. So there’s there’s a few things. One, I really appreciate what Apple has done natively at the operating system level. So we already touched on the fact that Macs are becoming more popular. I think this is a trend that’s gonna increase. There’s predictions that in the next few years, the… There’s an inflection point where the number of Mac machines is gonna overtake Windows. Whether or not you think that’s gonna happen in next year, next few years, I think we all agree that’s probably eventually gonna happen. So as we mentioned earlier, the attackers are watching that too, going after that increased market share. Now the good news is Apple, I think, has done a really good job. And on the previous slide, it was like, okay. Who do you trust? And, you know, one thing I really like about Apple is they’re super privacy centric. They make their money largely when they sell you the hardware or an App Store commissions, but that’s a separate thing. So the good news is they’re… An operating system that’s built largely on privacy is is generally pretty secure as well. So for example, you know, process a cannot read the the memory of of process b. That’s for privacy reasons, but that’s super beneficial because that also means if malware infects your system, it can’t easily, without some exploit or very sophisticated capabilities, inject, for example, into your browser or into your key chain to steal tokens. So the the lucky thing is I think Apple has done a really good job building a very solid baseline that hackers and and adversaries are wily creative. And so, you know, I think what we’re seeing is, for better or worse, it’s always gonna be a a cat and mouse game. And so Apple increases the sophistication of the native security as Mac users become a little bit more educated about the threats. You know, what we’re seeing is the adversaries are somewhat in lockstep becoming more sophisticated. So, yes, some of the Mac attacks are still pretty basic. I think there are some gaps where Mac users might need to be a little bit more aware of what’s happening in terms of the fact that, yes, they are being targeted sometimes by very sophisticated adversaries. And the operating system, while it will do a really good job, is not necessarily enough. So for example, many people don’t know that built into Mac OS is a rudimentary antivirus system. It uses signatures, and it attempts to detect and block no malware. Now Apple doesn’t really talk a lot about that, which I think is a little less than ideal, because I think security through obscurity is never a good thing. I’m a big proponent of being super transparent. And so, for example, now it’s a little bit improved. But when Apple kinda rolled this out, they didn’t even really chat about it. And if that system detected and blocked that, there was no alert that could be sent, for example, to a SIM or a Mac admin to say, oh, you know, there was an attack, but the core component of the operating system blocked that, which is is a very important thing to know because if the operating system didn’t block it, you have, as Matt said, many other steps that you should take. Whereas if it did, k, you might be in the clear. So there’s definitely some things that built into the operating system. We don’t, I would say, have enough transparency or insights. And to kind of go along a little bit further with that, I think Apple sometimes has made the constant… Conscious decision that security, in many cases, they’re gonna kinda delegate that out to third party tool inning. The Mac admins, the IT teams, they really design an operating system that’s very privacy and security centric, but by design, doesn’t do everything. So we see adversaries sometimes implementing attacks. You know, click fix is one recent one where they get the users to copy and paste something. Initially, the operating system kind of just allowed that. The reason adversaries went that route is running stuff from the terminal, really sidesteps a lot of Apple’s built in capabilities. Apple recently introduced the mechanism where if you copy copy and paste something into the terminal, now there’s a warning, which is good. But, again, if the user, like, agrees to it or not, like, we don’t have a lot of transparency. And, of course, what the adversaries do, they just pivot to a different technique. So, again, it’s always a cat and mouse game, and I think the attackers are paying maybe more attention to Apple security mechanisms and then finding ways to to bypass them. So there’s always gonna be a cat and mouse game. Are defenders gaining? Are attackers gaining? I think the good news is it’s kind of in lockstep, and as one kind of pulls ahead, the other then advances. So it’s great job security for all of us. Never a dull moment, But it’s one of the reasons I’m really happy we’re having this discussion because I think when we get to some of the takeaways, some of those will be realizing that, yes, Macs can get malware. Yes. Apple has built a great operating system, but there’s gonna be some things that are left maybe for third party security tools by a design to fill in. And at the end of the day, kind of that additional knowledge and insight into what the adversaries are doing is really how we can start countering, especially more more of the more sophisticated attacks. Attacks. So, Matt, I’m sure you have lots to add to that as well, especially what you’re seeing in your day to day work as well. Yeah. I… I’d I’d add to the Willie Sutton kind of example before too. Like, banks designed good vaults, and they were very well designed, but there still were operational needs of somebody locking them, dual keys, support and control. You had to have the ability to have a security guard, and that guards aspects of what they did in their training, what they do in their execution matters just as much as anything else. And so, you know, I just wanna make sure people take that corollary of, like, at the end of the day, I get frustrated as a as a security human because so many of the things that people talk about as failures are the basics. They they could have been dealt with by the basics being done decently. Right? Like, it it’s so many times. And even when asked, for most people who don’t know, I’m deeply involved in CIS, at least have been in the past, and as a practitioner, use Center for Internet Security’s critical controls. And I believe those 153 safeguards already adequately decide… Define things that we need to deal with in most cases. I I don’t find it often that there are gaps outside of that other than some of the environmental things and stuff that’s covered in IS two and personal and HR stuff. But that said, as a security framework, it’s pretty good. Now trends of the worst day. So I run a charity called msp911.org. It’s part of cyberize.org, which is my legacy charity that I run with a few friends. And I’m a victim of a cyber attack. I I lost to Soda Nokibi as a threat actor, a roughly $3,000,000 in total economic impact as a managed service provider through acquisition we made in Eastern Texas. I called I called Voldemort, and that is because I won’t say their three letter name ever again, which three letter domains are pretty dope. But that said, that sparked me for about eighteen months being sued by almost every client. Every every employee of ours… Of that company we acquired quit. They’d been ransomed three times, and it was operations every time. They never did an incident response on the first incident. They didn’t do a cleanup. I have much longer form of this, but I won’t believe you all with that. But that’s driven my world over the last fifteen years to try to give back and change operations and raise the tide and and do those things. And so now MSP nine one one, when you as an MSP, I hope you never have to reach out to us, ever have your worst day where a threat actor has compromised you and used you as a weapon against your your clients, we take those cases. And we are at case number 59 in the last two years. So I want to kind of share some of my trends and things that I’ve seen from that. If you rewind back to when ScreenConnect had a vulnerability, and I love ConnectWise. This is not shade. This is educational. But when ScreenConnect had a vulnerability that they called slash and grab, it was literally you could put a front slash after ASPX, setup dot ASPX, and you could execute code. But you could also reset up the server, and you could also take over as admin of that server, and that server would have had up to 10,000 endpoint devices on it. The threat actors at that time didn’t make that that correlation. At that time, they were simply just doing a pop the box, gain remote code execution, ransom the box, try to see if we can get people. And so that shift forward to to what we’re seeing today, now the threat actors are much more aware. There are new groups that are targeting MSPs specifically. They’re more aware of the the fact that we have these force multipliers. And if you’re an MSP, think about your operations. If I gain access to one of your employees, can I turn off EDR on systems? Can I put things in groups that would be bypassed from response? Can I do things that not only take away the response that you’re going to have, but also then inject my malware, put in a site that has click fix? And to Patrick’s point earlier, fix has been around for almost two years if I recall correctly on my timeline. It’s been used in Windows environments for a very long time. You’ve seen it pivot to Mac, and and to his point, that’s more of this evidence of this shift to where the money is. So adding to that, these MSPs that have taken these worst days, there’s a certain element that the more mature they get, the more they feel it’s their vendor that was compromised. It’s kind of an interesting trend I’ve seen is the more mature they are, though it can’t be me. It must be my my Mac has been compromised. There’s a zero day on Mac. And in reality, most of the times, it’s not that. It’s that one technician they didn’t lock down. It’s the system they didn’t have set properly. It’s something in that nature, and it’s it’s interesting to see that more maturity means more not me. But also, at the same time, the last three or so cases we’ve taken, the insurance companies that provided for that MSP were saying, we will only look at the impacted devices on your network, and we will only look at the things of yours, and we’ll gather logs from your systems. We will not cross the blood brain barrier to your client. That needs to be their own insurance case, their own filing, their own defer, and if they want to sue us, they can sue us. And what that means if you’re familiar with the term subrogation is at least in The United States, you have the capacitance for that insurance company to sue you as the MSP as a response to what the fault they believed was. Right? And and and I won’t get into the long form of that. But I’m seeing more and more shift of this setting up this tension between you as an MSP and your client. And so it’s abusing trust and and it’s shaking trust. Why did my clients leave? Because they’ve been ransomed three times in this company I acquired. You’re stick around for a fourth? Yeah. That’s a hyperbolus example, but the reality is threat actors are becoming more aware of MACs. Threat actors are becoming more aware of of the 43% of the GDP. It is much more accessible. It is easier to ransom and and gain money from those things. And so you’re seeing several shifts all play out at once, and I’m not trying to be the the doomsayer, but what I’ve seen very well played out is those that are prepared and have good operations have less impact. And the ones that have had this where all their clients got popped, but now only these 12 clients got popped because Johnny that got popped only had 12 clients access, and we did that operationally and managed that operationally so he would only have the principle of least privilege for those systems he needed. If you’re a security practitioner or a managed service provider in today’s world, and you do not have the defensibility of following some framework, following some external source that you are using, and applying that for you and your clients, you’re setting yourself up for failure as this industry shifts, as the threat actors become better and better at reaching the smaller and smaller potential threat… Victims that we’re seeing. So, yeah, some of the things I’ve been seeing. I like that, Matt. That’s very insightful. And I think you also hit on something that I just wanna echo and reiterate that I sometimes we get distracted maybe by the news articles of the sexy, you know, zero click iOS bugs that nation states are using for their targets. And like you pointed out, a lot of times when an attack occurs, people are like, oh, it must be the zero day or something. And, you know, I’ve even seen the vast majority of successful attacks against Mac users. It’s often something super basic, which I think there’s two things. One, it’s somewhat disheartening. It’s like, well, the adversaries don’t even have to have the zero days, and they have your… A very advanced capabilities. But, two, to your point, I think you articulated this really well, is if we actually address the fundamentals and the operations and, you know, did the the basics right, a lot of the attacks would be thwarted. Yes, the adversaries would evolve, but now it’s almost too easy because a lot of the fundamentals are not adhered to or not taken care of. And so I think it’s really important to first focus on those exactly like you said. And then once those are in a good place, a, I think the vast majority of current attacks against Macs would would fail against you if you’ve kind of checked those foundational boxes. And, you know, I think that… That’s just a really good good place to to start. And so I think sometimes we get distracted by the shiny exploits when reality is the the solutions, in many cases, are a lot more foundational. Yeah. Agreed. Nice. And it’s, you know, going back to this idea of the basics and sort of the foundation that we’re on, I I remember… And you had touched on this briefly, Patrick, but this idea of, like, what are the the myths that need to be dispelled? And we know over here, you know, like, don’t get malware. We feel like, at least in this room, that’s been mostly retired, I’m hoping. You know, I think maybe for the average person, maybe there’s still a couple people out there. This is fine. But but even more important I think too is is what’s going on here on the right, is like Apple is doing enough and that there’s, you know, there’s sort of this idea that, well, no, actually, like where does that responsibility lie to kind of, you know, watch out for these these new vulnerabilities? So I’m I’m sort of just leaving that up to you two now as as, you know, what are some of those myths we need to dispel? If you could talk to that a little bit. Yeah. I think it’s really good to reiterate these because especially previously, there definitely was the mindset that Macs don’t get malware. And the reason this is such, like, a catchy thing is this is essentially what Apple had on their main website all the way up to twenty twenty twelve. I mean, the full quote was Macs don’t get Windows malware. But even then, that wasn’t wholly true because there was cross platform malware. But we won’t get into the nuances too bad. But, unfortunately, the general public ran with my Mac is more secure. And to Apple’s credit, that was generally true for a lot of reasons. I think one of the things is as Macs became more popular, there was a lot of good lessons that had already been learned by the larger operating system vendors. So, again, putting myself somewhat back in the day, Windows XP, you plugged in that system. Within ten minutes, it was gonna get owned by something on the Internet. Config or Slammer, whatever the worm at the time was. And so as an industry, we learned some lessons. Like, don’t run with all these open services. Start implementing, anti exploit mechanisms like ASLR, non executable stacks, you know, heap metadata checks, all the things to make exploitation more hard, limit your attack surface. And so as Macs got more popular, Apple was kind of implementing these industry wide best approaches. And so, yes, Macs never have gotten as prolifically targeted successfully as Windows, and I don’t think they ever will be. I mean, if there’s a a a Mac worm that infects millions of Macs, I would be shocked just, again, because of large amount of the security that’s into the operating system. But the problem is because of that, which is a good thing. Right? You could plug your Mac into the into the Internet and got… Not get hacked right away, is Mac users became a little bit of a little bit overconfident, I would say. And adversaries really do take advantage of that now, where a lot of the Mac attacks we see even today, they’re kind of almost socially engineering based where they’re tricking the user into running. We’ve mentioned click fix, which is… Many of you probably know, but the idea is a website or the job interview you’re having, which is actually the North Koreans trying to hack your Mac, give you a bunch of instructions to run-in your terminal window. And you might be thinking, like, I would never run random commands, but, you know, there’s very creative convincing ways for this to be done. And many of these commands, the malicious ones are, you know, hidden at the end, and so the ones at the beginning will actually fix the problem you have. Now if you’re a Mac user who’s not really aware of the threats that are out there and have never experienced an infection on that, like, you’re gonna be super confident and just pretty much run wherever. Whereas on Windows, you might be saying, Maybe I should be a little bit more cautious. I know about malware and and leasing. So we really need to retire, and largely it is. But I think just to put the nail in the coffin that Macs don’t get malware, they most genuinely do. Any operating system does. And, again, especially as adversaries are now more than ever really paying a lot of attention to Macs, very incentivized, especially in the enterprise, Macs definitely get malware. So the next question or the next thing I run into, the next myth is a lot of people say, okay. Cool. I understand MaxScatbauer. I’m gonna try to be careful about, you know, where I download my software from and, you know, not run random commands from the Internet. And I’m like, okay. That’s great. We are moving in a great direction. But they say, I don’t need any security tools because the operating system is gonna protect me from everything. And, again, as we’ve even just shown with ClickJack, which is, you know, ClickFix, which is getting users to basically run the malicious commands, In that case, the operating systems can’t really do anything to some extent, but there’s some other examples where I personally believe that the core capabilities and security mechanisms of the operating system are not enough. And this isn’t a knock at Apple because I think this is a conscious design decision. Apple basically says, we want an operating system that’s a pleasure to use, that is good for the average person. And you have to think Macs were originally designed for, you know, consumers, maybe not as much in the enterprise. Well, in the enterprise, I think there is… The the the the bar should be higher in terms of of the protections, and I think this is where third party security tools come into play. Yep. We talked a little bit earlier about the fact that macOS has some rudimentary capabilities to protect against malware, kind of almost a signature based anti malware mechanism. But the thing is Apple can never afford to have a false positive. Because if they do, you can imagine, like, random person at home, their Mac flags something, and, like, Apple says it’s malware, it’s not like Apple. It’s just a disaster for Apple. Whereas in the enterprise, I think a EDR product can be a little bit more bold with the trade off that, okay, maybe every now and then it has a false positive because there’s hopefully an IT team behind that that can help work through that. So Apple’s built in kind of AV component is very conservative, and we’ve seen adversaries malware, specifically when their malicious code gets flagged, flip a few bytes, and then sidestep Apple’s signatures. So I think this is a great example of, okay. Apple does a lot of great things. They have a really good base, but there’s a ton of room for third parties to supply that layer, both in terms of more comprehensive security, EDR, antivirus, you name it. But then I think there’s a large layer of just managing the devices and making sure there’s more transparency. If the user runs something they shouldn’t, how does that look like in terms of a a dashboard or a scene? And then as Matt kind of touched on earlier, there’s a lot more that also goes on after the fact when a detection occurs. And, again, this is something that Apple just doesn’t lean into, I think, by design. So I wanna hand that over now to Matt and kind of have him dig into it as well. You know, is Apple enough, Matt? What what are you thinking? Yeah. I think it’s a fantastic base that I would start from every day and choose to as my daily driver. I would rather have memory separation. I would rather have not sloppy code in the way I make an OS that’s a 100 years old. I would rather see these bold changes they’ve made. That said, there is still an economics scale challenge, and when we think about even the shift to AI, there’s a speculation that the most valuable things will be data. Data will be more valuable than the thing I could create easily in in distillation of that. So the point I’m making is that when you think about what it takes to defend against a device or a threat a threat actor and threats that are out there, there are threats that happen outside the Mac. There are threats that happen by tricking me to go to a website that’s poisoned, that now has an AITM or an adversary in the middle of harvesting of my token without the right MFA or protections. That’s not anything that Mac can really do something about. I’m still a user. I’m still being stolen from. And so my argument is, I need telemetry. I need data. I need information. I need to know that that user had a DNS query that resulted in me going here, that resulted in a website being pulled down, that resulted in a click fix being copied to my paste bit, to my my clipboard, that resulted in me opening terminal, that resulted in me running these commands. There was… I need that data. I moreover need to know whether that’s malicious or actually just the stuff I should be doing in my day to day job. Right? And so I think the point that you made very, very articulately, Patrick, is that enterprises have more capacitance, but even MSPs bring tools and capabilities and and distillation of this threat intel, right, of what people are doing, what’s malicious, what’s not, and it just doesn’t make sense for Apple to be the arbiter of that. It… There’s too much broad field that’s outside of their space that it doesn’t make sense that they’re that. But in the same breath, even if I was the most skilled surgeon, back to my surgery analogy, and I’m sitting here in the Surgical Room and everything’s lit up and we’re all ready to go, and I’m going to poke my finger through your skin to make the incision I need, I’m not going to do great without tools. I still need a scalpel. It’s going be real rough without that scalpel. And so the argument is Apple brings a fantastic place that you can lay stuff down upon, but you still have to make choices on settings, and you still have to fight the fact that I have this theory, Patrick, called the middle theory that says that products don’t rise much above or fall very much below the maturity of the consuming entity. If nobody’s asking it to be more locked down and more secure and harder to work with and harder to deal with the memory management and harder to have application developed because of those changes and because… If nobody’s begging for that, then Apple has actually been ahead of their skis of doing those things even though they caused problems. There’s many a time that that has caused problems for developers, had them rewrite their trash code to deal with Apple’s changes. So I would laud Apple in that, but in the same breath, I wouldn’t say it’s enough. It’s just the the thing that I need to have the airbags and seat belts in. It may be a great car, but I still need those things integrated in that way, and there’s just so much involved in not only that, but the operations, the management, the decisions. Do I leave that port open? Do I use this thing? Do I turn on the service? Do I not? Those are all operational decisions on how those Mac fleets get managed. So, hopefully, beat this to death. Like, if Ralph Wiggum was here, he’d say, it’s already dead. But, yeah, I think the Smith is dead. Oh, but this is great, and I think the both of you really touched on these… This idea of, you know, where do you get the right data to make these decisions? How do we sort of go about, you know, in your, you know, example of, you know, like finding the right tools? How do you even evaluate those tools? And I know you… This actually was taken from a conversation we had, Matt, about, like, the tool is not the answer, but you can’t not have a tool. And so if you… Yes. Speak a little bit more about that because I think that’s really a great segue into I kinda hit it a bit ago in the sense that, you know, like, you’ve the surgical fleet. But that said, like, how do you even choose which tools? Like, what sets up an operating theater? Right? It’s from guidance from AMA. Right? From It’s the American Medical Association and the guidance of what what makes and constituents a a operating theater. And obviously other things. I’m not a doctor, again, Holiday Inn Express thing. But the the point is is, like, I think that if you are still the smartest guy or gal in the room around security, you’ve failed. You you have to start realizing that we… When we do this in every other world, engineers around bridges say that every engineering guideline is written in blood. Right? Every single bridge rule has happened because somebody fell through the freaking bridge. And so when we get into this, this challenge is, like, we as security practitioners have too long been the smartest person in the room. Well, I’ll just take it to the smart guy. Patrick knows how to deal with a Mac security. I’ll hand it to Patrick. He’s got this thing. It’s some small definable thing. Mac security is just Patrick. Done. When when the reality is we’ve built entire frameworks. Right? There’s an x k c d comic that says, you know, we have 13 competing standards. We’re gonna fix one that makes… We rules them all. We now have 14 competing standards. I love it. Right? And so, you know, what I would say if you’re a practitioner, you should pick a operating framework, whatever it is going to… You’re going to use, whether that be CIS, Center for Internet Security’s Critical Controls, and, you know, and this is NIS two guidance, which is actually, I think, probably one of the best encompassing documents, god bless its problems, that I’ve re… Read recently. But also, you know, NIST two or or Australian’s essential eight or CAF or… There’s so many. Pick one and start working from that. That’ll tell you, okay. Guess what? CIS 10 .1 says I need anti malware capacitance. Right? CIS nine .1 says I should control the browser and be able to manage the browser and its extensions and further in nine and email clients and other things. And as you start evaluating your Mac security through that, you’ll start seeing where there’s not something natively there to make that possible or there’s not something there to make it scalable. And that’s the other part. You have to make a profit. You have to make a profit in a screwed up economic world where the reality is you’re not gonna get all the dollars you want. You’re not gonna be able to do everything you wanna do, and so you have to find that greatest good impact and how do I do it at high scale and high speed. And so I think that, you know, while that does sound like a very veiled pitch for Addigy, it is a very veiled reason for why I used Addigy to scale my world as a practitioner because I could bring those things at least in some degree of normalcy to a known good space and a known decided upon space from a risk posture perspective. And, Patrick, you… I’ll toss this back to you. You said it so well earlier of, like, you know, enterprise might have higher risk, and they’re willing to take more posture and have teams to deal with it, and so they can maybe have more false positives, whereas to the consumer, they can’t. And then it comes down to, like, you have to figure out where your risk posture is, where your actual risk is, and make decisions based on that. And anyways… But, yeah, I think the the point is operations and security and hard choices are often the security, but you still need the tools. You can’t do it without it. You can’t scale it without it. Yeah. I love this discussion because, you know, the Objective C Foundation created a lot of free open source tools. And at the beginning, I was like, this is the solution. And then it’s like, no. As Matt said, this is a really good, important first step, a foundational component. But that magically doesn’t solve anything. And so I think there’s another thing I wanna touch on, you know, on the slide I mentioned. It’s like, who’s behind the tool? And so just like hackers, malware authors kind of pivoted to macOS because that’s where the market share is, we saw a lot of vendors doing that. And I, you know, can just imagine discussion where there’s a, you know, hypothetical company. They have a really mature Windows security product that’s really well recognized in the industry. And, you know, they’re saying, oh, wait a minute. Now, you know, 84% of businesses run Mac, the market share of Mac’s increasing. Like, there are more targets. I don’t know if they use that same term. Customers, I think, would be the appropriate term. Yeah. Where… But it’s the same, like, mindset of the attackers where, okay, there’s these Macs that potentially could run our software. In the context of security software, it’s good. In context of malware, it’s obviously obviously bad. But macOS is really, really different than Windows, and especially from the context of a security tool. I grew up on Windows, my initial reverse engineering malware analysis, defensive and offensive. Splunking, let’s just say, was all on Windows. And so when I started on Mac OS, yes, of course, there’s parallels. There’s, you know, memory, CPU, stacks, and all that stuff. But there’s a lot of very specific Mac isms, Apple isms that if you’re writing a security tool, you really need to live and breathe. And so what we see is a lot of vendors, a lot of companies who maybe existed or were very well known in the Windows space are kinda jumping on the Mac bandwagon because it’s maybe trendy or, you know, the sales and marketing team says, hey. Like, there’s there’s new potential customers. And then they release a Mac security product. And the crazy thing is their Windows product can be incredible, but their Mac product is just like a dumpster fire. They do not have parity there where their Windows product can detect perhaps new zero day exploits, ransomware. Their Mac one is, like, doing basic signature scanning. And it’s largely because Mac is so different that you really, in my opinion, need a dedicated engineering team that, like, lives and breathes macOS. And since macOS in some senses hasn’t been around that long, most of us have kind of cut our teeth on Windows. It’s a learning experience for us also in in the space. So for example, there’s not a ton of security engineers focusing on on macOS. So I’m a big fan. People always ask me all the time. Patrick, how do I pick a vendor? And I say, okay. Look at ones that are, a, either just focus on Mac. It’s like kinda do one thing, do it well, or just Apple, let’s just say. Or ones that really dedicate, I would say, you know, a ton of their engineering and focus on on macOS. Because the companies that are doing cross platform stuff, Windows is still 70% market share on on… In in in the enterprise. So it makes sense that that’s where all their resources or most of their resources… The majority of their resources and dollars go, especially that’s where traditionally it’s gone. So who’s behind the tool, I think, is a really important question. And not just looking at track records, because someone can have a great Windows track record, and on on Mac OS, it’s it’s it’s totally new. So I always say, you know, look for companies that are putting in the time and effort, putting in the resource… Research, putting in the the r and d money, putting in the focus on Apple because invariably, it goes to follow that their products, unless something goes very wrong, is gonna be, in my opinion, far superior than, you know, other ones who half or more of their time are distracted by Windows. I feel like Matt has something to jump in and and hopefully agree. But if he disagrees, let me know. I agree. You’re triggering me on something that was earlier in my career. This was about seven years ago. I won’t name the vendor and I won’t name the researcher, but I was having a pen test done, a static pen test done on on a very large client that was mostly Mac. And so representative device that was used was a Mac, and so they were testing a HTTP… A reverse shell over HTTPS modality. That was one of the tests that had to be done, and it was failing to be caught by the EDR. We get involved with the EDR team. I start talking to the EDR team, and the EDR team admits in front of accidentally this researcher that I brought in the room that was the pen tester that they had not been inspecting Python for three months. Oh, man. And and it’s… Your point, it’s a massive vendor, and the point was, like, they had… They got caught by the change that Mac made, and I don’t remember exactly what it was, but they just didn’t have the inspection capacitance, they weren’t ready to make that change. And so, yeah, you triggered me on this one because that one became a huge security hubbub. You could probably find it if you wanted to be an OSINT person because the researcher then wrote an article about that and doxed that company, but that’s okay. But that is a good point because my understanding is, like, Python is not natively installed on Windows. I haven’t dabbled there for a long time. And so, you know, just the the the environment is so different on on macOS. And to your point, I think you touched on earlier, one of things I like about Apple is they are very okay, let’s just say, with, you know, making changes. They throw out leggity… Legacy stuff, deprecate stuff. And for dev… Developers, that can kind of be a pain. When I started writing, you know, for example, a firewall for Mac OS, it was suggested that you do that in the kernel. And then Apple kinda said, hey. Wait a minute. This is actually not a good a good reason. In retrospect, that was brilliant of them. They said, no more kernel code. Here’s the user mode framework you can use. Awesome. But that did mean you basically had to fully rewrite your 100%. Firewall, which Yeah. Is a lot of work. Windows is never gonna do that, and that’s why we And economics don’t support it, Patrick. Nobody’s gonna pay you more for that firewall because you have to spend five sprints fixing something. That’s that’s just expected as the cost of doing business. And I I I love that you’re bringing that up because it is… In my opinion, I I respect them a lot for that, and we’re gonna get into trust too. But I had a friend of mine that worked at Apple for a very long time, and he told me that he still, to this day, has to do… I think he’s still there, as I remember from… It’s a friend of a friend, but it doesn’t matter. But he still has to do reviews of whether he should have access to something. That’s operational purely, saying you as an internal person has to do reviews of whether you should still have this standing access. That’s… That is only operations. Right? And so That’s amazing. The other thing you get into trust is how do I trust the company that I’m working with, right, to that point. Yeah. And so one of the the risks though is as Apple changes things, which I think we all agree is in the long run the best thing, but if the company behind the tool is not intimately familiar with macOS… And I remember doing this myself. They changed their, like, code signing certificate, and, you know, one of my tools was, like, looking for changes in code signing. And, you know, that was something I had to very quickly say, oh, okay. Well, this is still signed by Apple. Trusted. But, yeah, they’re they’re they’re leaf… The name of their leaf certificate changed. And that’s, like, you know, a big change that could potentially indicate something’s wrong on a host. Maybe malware’s tamper… Tampering tampering with it. But, no, it’s Apple just updating something. But if I was distracted by, let’s say, Windows tools, I might have missed that or missed, for example, the… Your your Python example because Apple does change things very quick. And so if the team behind the tool is not laser focused on Apple, in my opinion, there’s gonna be gaps that come through just exact… Exactly like your your point with Python and adversaries are sorta, like laughing all the way to the bank. It’s like, great. Bring your Windows tool here. We’ll like Exactly. We’ll run Python and just, you know, walk out to the to the Internet. So, yeah, I I really like that the tool is not the answer, but neither is not having the tool, and it’s really important, the trust and and and also the team, the company behind the tool, and how much blood, sweat, and tears they’re pouring into the, you know, Apple version of their tool, which is hopefully the only version that they’re they’re building. Yeah. Really well said by both of you. And I I I wanna dive in a little bit more to that that shared failure piece. Patrick, can you speak a little bit more to that? Yeah. I think it’s just kind of like Matt’s point where people will deploy the EDR product and maybe don’t dig into it as much to figure out what it’s doing and then figure out three months later that it’s not monitoring network traffic or it’s allowing any Apple binary to run, which includes and Python, which a lot of malware abuses. So in some cases, it’s maybe not configuring it incorrectly. It’s just having a really intimate understanding about what the tool does and doesn’t. And I would say if you don’t have that understanding, in some cases, that is a shared failure. I would say it’s a shared failure on the vendor, maybe not to be more transparent of the limitations. But I think also we have some responsibility for the tools we install and deploy to do our own vetting of them and not just taking what the vendor says as as absolute truth. Wow. Very nice. So thank you both here. And because we’re talking about Frontier here and you have a lot of that historical knowledge to kind of read the tea leaves, so to speak, what does AI actually change here? Like for the defender, for the attacker, you know, what are some things that maybe we the both of you sort of could see, hey. You know, like, this is, you know, how I could see things coming out in the next five, ten years, or even, you know, hey. These are some things I’m still a little bit skeptical of. Like like, let’s talk a little bit about that. So let’s let’s do this. I’m doing a stage presentation in… Oh, goodness. Where is that? Copenhagen. Yeah. That’s right. Copenhagen here in a few months. And one of the… It’s called cybersecurity twenty thirty, and it’s asking us to pause it. What does it look like in 2030? Like, what does five more, three more, two more years look like for us, in this case, three? But I think code has been built with one specific cadence. Imagine you in the audience are a product owner, and you have the ability to either fix some bug that’s existed a long time or do the new feature you’ve already promised to sales for the last three sprints, and sales is like, bro, got people ready to sign up. We need to hit our third quarter numbers. Which one gets the sprint? It is… Unless you’re really well structured as a company, you’re not typically dealing with this one. You’re dealing with the one that makes you money. So that has built, in my opinion, ****** software. We all use ****** software. It is part of our day. It’s part of our life. It has built ****** software, with some examples that might be excluded from But the point is is that there hasn’t been a capacitance or a reason necessarily to fix it. Threat actors can’t enumerate everything. Right? We’re finding vulnerabilities in Linux that were 20 years old, right, with some of these things. But, like, the reality is we now have this increased capacitance of threat actors and researchers alike to do tests, to enumerate surfaces they wouldn’t enumerate, to try things they wouldn’t try, to put connections together that wouldn’t happen in a way that’s fairly scalable. I think that as that becomes more viable, we will probably have better code over the next five years. I I I think it’ll just get better. Now granted, anybody in the audience can slap me. There’s gonna be a lot of vibe coding that might make that not right. There’s a lot of things that are gonna change. But for those with the applications, software development life cycle that give a ****, code’s gonna get better. I I think that’s a reality of of what’s going forward. I think at the same time, while we discussed that Vulpocalypse hasn’t really arrived, like, haven’t gotten to a point where this quote, they’re gonna find every vulnerability and everybody’s gonna be dead and it’s just gonna end right now. That’s kind of this belief that news has tried to put upon us from from all of that. And it’s even been pushed by some of the things. I’m doing a talk called giving swords to our future AI overlords of this discussion that, like, we shocked an elephant at one point. Like, we we put an elephant and electrocuted it for media histrionics. Like, we did that. But we also now have models of AI escaping their controls and attacking somebody and creating criminals. Like, straight straight up, we we did… All of the major frontier models decide that their stuff just accidentally escaped my my sandbox. And the only one thing that I had as a job to assign me, that is media histrionics. That is the expansion of saying, look what mine can do. Look what mine can do. We’re in a weird world right now in my opinion, and and we’re seeing this shift happen. But to get real, when we looked at, one of the predictions I’ve made is that as we see one vulnerability be found, we’ll see threat actors pick and pick and pick and pick because they found it. And and Patrick, you’re smarter at these things, so I may… Linda, you answering this. But I I believe we’ve seen, like, in Abel, they found one vulnerability in in central, and then after that, they found another one, and another one, and the threat actors kept picking at that wound. Right? That that wouldn’t have been done but by the most sophisticated of actors, but now it can be done by a harness. I can have my Claude bot just do that. And then at the same time, when you talked about Patrick, people on Macs have been smarter about where they download their software and they do those things and maybe protect… Well, no. Now we’re doing Claudebot or OpenClaw and slapping it on our machine and grabbing 500 MCPs that install 4,300 packages in Python that you don’t know what any of them are. Right? And so I think we’re moving towards a direction where the more bespoke the the software, the more bespoke the attack against it at the same time. And you said this before, threat actors gain, we gain. Threat actors gain, we gain. But now at a world where we’re making software yourself and you’re using that brand new Mac to run some local LM and run-in with these packages you’ve pulled down out of code, like, there’s so many challenges. And I I know I’m going off on a on a rant here, but I I think in the long term, though, companies like Apple, and I’m not an Apple fanboy. I’ll tell you, I didn’t buy an… My first Mac until two years ago or three years ago, and was for that same very purpose of running an LLM locally on my machine with shared Windows, memory resources. So, like, I’m gonna straight up tell them myself. But that said, I I have become a convert for these things, and so I think we’re gonna see more that Apple has always been in a position to break eggs, to fix things, to be that trusted partner, to do the stuff internally that’s painful. Right? And and I do believe we’re gonna move towards a better and more secure operating system that’s already been a good base to start from. And, Patrick, you can probably take it from here. Yeah. I like that. I think you hit on many of the really important points. And there was one security research that I made a really good point online that I liked, and this is when fuzzers came out. I think it was, like, you know, early mid two thousands and You’re dating yourself a smidge, Patrick, with with early days of fuzzing. But, yeah, go. For anybody that doesn’t know, fuzzing is trying to find a directory that you don’t know the name of, and you can do it by inserting a bunch of tests until you get to that one that says, alright. Fair. Fair. Fair. Fair. And and when fuzzers came out, like, bugs were, like, raining from this guy. And everyone was like, oh, wow. And, you know, so AI think there’s some parallels here where I think any new technology can be used for good and for bad, and, you know, we could discuss this forever. But we do see software vendors pushing out patches that now have the most patch bugs ever, Apple, Chrome, everything. And at the last Chrome update that came out, 90 plus percent, I think, of the bugs that were patched were found internally by Google, really showing that they were ramping up their AI use. And so that to me is is a win. Matt, you said this really well. I think AI is definitely gonna make code far better. I run it on my tools, which I have really, you know, lovingly written, and I find some embarrassingly bad bugs. No big security issues. Yeah. But still, like, things where I’m wow. Like, how did I miss that? And so it really benefits the defenders. They can find bugs in their code. They can really just empower, I think, security teams. Exactly. I loved your your argument. Previously, like, the new features were the shiny things. Well, now you can, you know, have your AI agent help patch some of the bugs. Right? Unit tests. That’s what I use. And so I believe, like, the code I’m releasing that other vendors are releasing, the quality of that is going to increase. Agreed. Vibe coding aside. Obviously, though Thank you. The attackers are also using AI. I’m sure they’re using it to to find bugs as well. I think one of the big advancements is the ability of AI to… Once a bug is patched, you know, developing a… What is it? N minus one day exploit. Yes. The timeline and the the the time window and the skill required to do that is, like, drastically Yeah. I can use a Ghidra MCP and reverse engineer something really quickly. Right? Like, those those kind of things. Point, To the skill sets and and capabilities are there for that diffing. But what have we always told people? Patch right away. Because there were already sophisticated adversaries and very skilled teams that were doing that maybe not at scale. So if the takeaway is, okay. And now this is one widespread, and so patching becomes essential, like, day zero, That I think is another win for security because that really goes back full circle to the beginning where we talked about what are the basics. It’s like when Apple releases a patch, get that installed ASAP. We always said that was good advice. I think now AI is showing that, yeah, you really need to hop on that because script kitties are now able to weaponize these these vulnerabilities. And so at the end of the day, there’s maybe just one example of, okay. This actually drives, security. So I think it’s something where there’s pros and cons. I’m currently on the fence. No. Not even. I’m currently on the side of that it benefits defenders. They’re the ones with all the tokens, and I think they’re the ones that are leveraging AI. You know? We see Apple, Google, these big vendors patching a ton of bugs. Sure. The adversaries are gonna benefit it as well, but overall, I think in the long run, you know, code is gonna is gonna be more secure than it ever has been. And a lot of exploits gained access to systems or or… Because of vulnerable code. And so if number of bugs are reducing, again, that’s a win for the end user. Even if getting there is rocky. Yeah. Wow. So I mean… Yeah. Wow. Thank you both. I think this is this is all gonna be good for us to kinda see, you know, what what unfolds. Right? And who knows? You know, it’s not gonna take us years. It’ll be months or weeks. And I I really appreciate the the both of your perspectives there. And so I I think just kinda wrapping things up here, knowing we’re almost out of time, if we could kind of summarize, you know, because I I feel like I could spend another two hours, and the both of you kind of like digging into a lot of the stuff that you said, and who knows, maybe we we have another session there. But if we could kind of leave folks with a sense of, you know, how who do you trust? Who… How can you check? You know, how to make sure someone’s a trusted adviser just moving forward given everything we just talked about. I mean, what what do we wanna leave people with in terms of, you know, what can you kind of walk away with here sort of feeling like, okay. This is what what I need to do next, or this is kind of how I wanna, you know, go forward with my security compliance, things like that. Well, you know, you bring to this point of the supply chain risk and the supply chain challenge and trust, and and and it goes back to a talk when I was really young of interdependency. As a kid, you’re like, I wanna be dependent. I wanna be independent. Well, you’re never gonna be independent. You’re interdependent. You’re interdependent on that guy not hitting you in the street. You’re interdependent on the street being viable and the signals being right. You’re interdependent. And so I I think what needs to happen for you to figure out who to trust and where to place your trust is to have a trust framework. I am stealing this from Rob Reck. He is our chief trust officer at PACS eight, and he says three things. He says, number one, you have to have a you have to have a one to one say do ratio. If I say I’m going to do something, I’m going to do it. If I tell Patrick or Angela that I’m coming over to hang out and do what we’re going to do, and I don’t show up, at some point, you won’t trust when I say I’m going to show up. There’s there’s a one to one there. But that’s not always possible. You’re gonna fail. There will be failures. You’ll make a mistake. You’ll miss something. You’ll push a patch that you thought was gonna solve the day, it missed something. You’re you’re gonna make mistakes. So the second part of trust is having ability to have hard conversations first. If you mess up as a kid and you come in and go, hey, dad. I’m so sorry. I messed up the lawnmower. I was doing something stupid with it. Like, is that better than dad going to hop on the lawnmower in three days and he can’t mow the grass and it’s hot and he’s mad, and now he’s having to figure out why his lawnmower’s broke? Which one’s better for you in a relationship with trust? I don’t want you to use my lawnmower no more. Don’t trust you. Right? But then the third one is one that can’t be faked because you can kind of fake your way through those two. You can be very disciplined and do the things you say you’re gonna do. You can be very disciplined and and speak first when it’s hard and have some introspection and tools and systems for introspection. But the last one you can’t fake, I don’t think, which is having aligned incentives. If my if my job and my underlying, like, card in in life is I have to kill Patrick Wardle, then no matter how much I come over and hang out and have beers with him, there’s no reason he should trust me. I’m going to kill Patrick Wardle. That’s my mission. We do… We have misaligned incentives that Patrick wants to live. And so there’s that point of, like… Yeah. So there’s a line incentive. So I think when you take that into a framework, makes sense. Choose a vendor that that that has a pretty good track record of releasing when they say they’re going to. They take bug bounties well. They have good re… Responses to their to their internal researchers and external researchers. And then when they mess up, they say something. They’re honest. They’re transparent. They’re front front about it. Right? And then the last one is that you you were able to determine that your incentives are aligned. And and that’s the hardest one to do, I think. But, Patrick, maybe you can speak towards aligned incentives a little better. Yeah, Matt. I like exactly what you said. I mean, to me, you know, I’m gonna start with kind of the broad apple. One of the things that’s been… We’ve touched on this a few things. I… You know, at the end of the day, yes, they are a company beholden to their shareholders, and their goal is profit. But I feel like they do that in a way that’s largely responsible, and I’m really passionate about their approach to privacy because I think security often follows through that. And so when I buy something from Apple or when I use an Apple device, you know, I’m confident that it’s it’s not spying on me, that Apple doesn’t have the incentives to track my browsing habits and all these things to sell me more stuff because, you know, they built this great ecosystem. They build incredible hardware. They’ve really taken this other angle, which is pretty rare in terms of other, you know, large operating system vendors. I I really like that. And then another extreme, you know, like, working with Addigy has been amazing. They’re super supportive of, like, the foundational stuff we do for the community in the Objective C Foundation. And so, like, that to me just speaks to the aligned incentives where vendors that I find also realize that investing in the community is an amazing thing to do. You know? Addigy, like, helps fund our student scholarship programs, which brings, like, kids to our conferences, our trainings. They then meet with companies that are hiring, puts them on an amazing trajectory. That’s just a win win. And that, like, doesn’t generate profit for Addigy. And so, yes, I’m using that… Them as an example. But I think that’s a great thing of looking for vendors or companies that kind of are doing the right thing. And, like, that sounds super, like, cliche, but I am still really passionate about that. And I still think there’s companies out there that you can take a step back and say, are they only obsessed with profits? And I think Yeah. Apple is another example of, sure, they love profits, but I think they’re generally trying to make the world a better place. And so to me, those are the companies I’m choosing because I think those are the companies that when a hard decision comes, like being transparent about a screw up or something else, those are the ones that are gonna be, let’s just say, emotionally mature enough to to to own up or have that hard conversation. And I don’t think all companies are like that or even close to that. And so looking for the ones that I think, you know, feel like have a heart or try to do the right thing. To me, you know, maybe I’m a little hippie, but that to me is is is one of the things I look for when figuring out who to trust, who to work with, who to collaborate with, and who to align with. Wow. Thank you so much for that. And it’s… As a philosophy lover, I love… I mean, just like what the both of you really are doing for education. I mean, like for me, like that word really means like to bring out the best within someone. And I… I’ll just give a nod to that there and you know, just have really enjoyed this discussion. I know we sort of went into, you know, like kind of what we wanna ask our vendors. We’ll sort of, you know, leave people with a little bit of this. And yeah, I really just kinda wanna, I mean, give the both of you sort of a round of applause here. Just, I mean, all the work you’re doing for the community, and all the work that you did even just here to sort of give people a sense of what is this new kind of world we’re dealing with here. And I’ll I’ll close us out with a little bit of, yeah, where where can folks find you both, and sort of follow some of the work that you’re doing, and, you know, just kind of follow along on your journey just as you continue to, you know, educate the rest of the community about what’s going on. Yeah. So I spend a lot of my time working with… For the Objective C Foundation. So if you pop over to objective-c.org, you can learn about all the cool things we do. Angela, love you talked about education because as I get older and hopefully wiser, I’m realizing that’s, like, such a essential thing to focus on. Perhaps naively, think many of the world’s problems are because of lack of education and critical thinking. You know, it’s probably more nuanced about that. But, you know, like, through the foundation, I’ve seen that when we connect with students and empower them, it really sets them on incredible paths and really, exactly like you said, Angela, empowers them and and and brings that out. So check out objectivec.org. There’s free tools, free books. We do free student conferences. I would say in a nutshell, we are really focused on education and helping things. And so there’s a lot of cool resources for people to learn more about Mac security. And, you know, hearing Matt talk about some of his nonprofits too, it’s, like, equally in inspiring just the goal of him helping other people. So, Matt, where can people learn more about what you do and connect with some of the community focused stuff that you… You’re doing? Because I’m gonna go check those out as well. And it’s cool you talked about education. I I was a pretty good engineer. I wouldn’t say I was a great engineer, but I was a pretty good engineer when I was working in in in tech. And I did a life plan where someone said, Matt, you you keep stealing ability for other people to learn by doing, and you’d be better off as a highest and best use by educating, right, and by teaching them how to critically think. So you you triggered a point for me on that, Patrick. But that said, like, I’m involved at PACS eight, obviously. Addigy, you can find them there. But my noncommercial interests, I I run a charity called Cyber Rise Inc, cyberrise.org, as well as msp911.org, as well as frameworkmaps.org. And in fact, I’m really looking for community involvement. We take and break down cybersecurity frameworks into their taxonomical elements, we can actually map products and say, does Addigy help me with? Oh, four dot one by the extensibility of management and configuration. Oh, these other things that I can all do to that. So yeah, so find me at cyberize.org or any of the three charity programs we run there. And then generally just LinkedIn. Please connect with me on LinkedIn or say you were in the Addigy or I won’t. I got bit by a deep fake one time, and so I just don’t approve connections anymore unless there’s some corollary as to why. But, yeah, please reach out on LinkedIn and and help me out with the mission. Thank you. And, Patrick, it’s it’s interesting when you find other people cut from the same cloth that just really wanna make the world a better place. And and I think as AI becomes more and more prevalent, humans will want humans, humans will want to share with humans. And so I I I love what you’re doing, man. Yeah. Thanks, man. Likewise. It’s an… It’s inspiring. Wow. Well, thank you both so much, and we’ll we’ll cut now to a break here, but thank you all. I hope you’re leaving this session a little bit more confident and inspired. See you soon.