Name: Cybersecurity, Compliance & Client Trust: What Every Professional Services Firm Needs to Know
Uploaded: 2026-10-15T16:31:23.389Z
Duration: 52 min 56 s
Description: Cybersecurity, Compliance & Client Trust: What Every Professional Services Firm Needs to Know

Transcript for "Cybersecurity, Compliance & Client Trust: What Every Professional Services Firm Needs to Know": Hey. Welcome, everyone. Thank you for joining us today for our webinar. I'm very excited to have you here. For the best viewing experience, we want to make sure... Oops. I guess we're missing that slide now. Okay. Hopefully, you were able to see for the best viewing experience, please use Google Chrome or Firefox. Audios will stream through your computer, so make sure your volume is turned up. There's no dial in option. If you have a question, type it into the Q and A box at any time during the presentation. We'll address as many as possible at the end, and unanswered questions will be followed up individually after the webinar. Resources, including today's presentation slides are available in the resources widget at the top right of your screen. All widgets can be resized to fit your screen. You'll receive the email with on demand recording within twenty four hours of the webinar ending. So, now what I'd like to do is introduce, Becca. My name is Michelle Chipolone. I'm vice president of product marketing. We're super excited to have you here. Becca, our chief information security officer is with me, here today as well. And before we dive in, Becca, I was hoping you could give us, the a quick version of, you know, what your path to cybersecurity and what it's like sitting in the CISO seat at Deltek. Yeah. Certainly. And, thank you very much, and it's great to be here. You know, it's it's kind of a a funny story. You know, when I was in college, I was a marketing and communications major, had full intentions on a a career in marketing. And, but this was the, late nineties, and it was sort of a funny thing. You know, if you could spell IT back then, you could get a job in IT. And, so, you know, after graduating college, I I got into IT and worked in technology for a number of years. About 2012, I was actually applying for a new job to a very large company that's based here in Saint Louis as a messaging architect. And of course, you know, anytime you you work in IT, you know, security is always part of the job. The messaging architects ended up getting filled by an internal resource, but, they they called me back in and said, hey. We really like the way you think. We have this big problem with vulnerability management. We're looking for someone to lead that. Would you be interested? And I was like, you know what? Sure. Like, that sounds great and exciting and new. And, so fast forward, you know, that really worked out well. I ended up leading, the, the security architecture and engineering group there for a number of years, and it was, just an exciting opportunity. And so fast forward and, you know, the the way it worked out is, you know, became a CISO and, you know, for Saint Louis University and then another tech company. And and, you know, now with Deltek, I've been here a little over two and a half years. And I gotta say I absolutely love it. You know, Deltek's exciting. You know, we have a lot of, industries that we support with our, ERP systems and a lot of different products and services. And so it's a it's a good dynamic environment. And, you know, for someone in my position, it it makes it a very interesting position. So, yeah, it's a it's a good good spot to be. Awesome. Well, that was great. Becca, I had no idea that you had a marketing background. So now. I'm coming to you for some messaging, help around some of our cybersecurity, messaging. So that's all. That's great. So great to learn. So what I'd like to do is take us through, our agenda today. And, really quickly, obviously we're gonna... We just went through number one, the welcoming, the framing of why you're here today. We're gonna talk a little bit about why professional service firms are prime targets for cyber criminals, unfortunately. We're gonna talk about compliance, liability, and client trust. We're gonna also talk about what clients now expect around cybersecurity. We're gonna also get into, Becca's gonna share some great practical tips to reduce risk, which is so important these days. And then we're gonna talk about incident response readiness. God forbid you have an incident in your organization, but I think most organizations probably have had one, at least at this point. And we're gonna talk a little bit about how you respond to that and how, you know, your readiness should be organized. And then we'll get to some question, question and answer session, and then we'll wrap up for today. So let's go ahead and talk a little bit about, you know, the cybersecurity and going from the server room to the boardroom. So we say in cybersecurity, cybersecurity has moved from the server room to the boardroom. Why are professional services firms specifically so attractive to cybersecurity attacks right now? Yeah. And you know what? It was it was interesting. As I was as I was preparing for this webinar, I was, you know, doing some research and I ended up at the, identity theft and resource center there. You see that 162%, figure. And I I was I was really... So along with their, annual report, they had a really nice infographic and they specifically called out professional services firm and I got to tell you like even though I've been in this industry a long time that surprised me a little bit. Like we hear about health care organizations, we hear about the tech you know the big tech companies, financial firms. Turns out professional services firms are actually the third most targeted industry out there right now. And as we you know look at that 162% number like like what's behind that you know over five years, You know, year over year and so the ITRC only works with publicly disclosed information. So they're looking at the, breaches that were made public that had to be disclosed to a regulatory body. And so in 2024, you know, there's 344 publicly disclosed breaches for professional services firms, and that increased to 478 in 2025. What got even more interesting is when we look looked at other data sources that look at breaches that may not have been publicly reported, but where third party, breach response services had to be engaged. So Verizon's, data breach investigations report cites for the same year that it was actually over 2,500 breaches, you know, for, professional services firms. And when we think about, you know, why would that be? Like, why why would attackers be going after professional services firms and and increasingly going after them? And it it looks like, you know, the attack surface has been quietly growing for years. And when you think about professional services firms, you know, whatever their industry may be, you know, it's very much about serving their clients and, working fast to adopt technology, and and better service to their industry. And so when you have a rapid digital transformation and you have this rapid adoption of AI tooling that honestly we're still trying to figure out as an industry how to best secure, you end up with a tech stack that's not as well managed as it should in an industry that's super attractive to an attacker because of the professional services firm's client archive. You know, like, their their client data, the work that they're doing for their customers, that has great value to experienced professional attackers. Those that, you know, not... May not be interested in just ransomware, but also, exfiltrating that information for use and other purse... Purposes. And we see that a lot with nation states. So certainly a, increasing challenge as an industry. Yeah. That's super interesting. I mean, are are they... Are those attackers looking at, like, from a professional services firm, Becca, like, customer information or that type of data? Is is that what they're targeting? Yeah. You know, in in in a lot of ways, yes. And, you know, some... We think about data, we think about things like, you know, customer names, addresses, emails, stuff like that. And that's all very valuable because you can use email email addresses, you know, for other targeted attacks and such. So it's just that treasure trove of contact information. It's that treasure trove of the work they're doing for their customers that may have value, in other ways. You know, it's... I I I don't mean to be too alarmist, but, like, it's it's everything from, you know, as as simple as, like, I have a a greater interest in attacking your customer than I do in you, but you have information that'll that'll help me in that, to something as advanced as industrial espionage. And, so, you know, it's it's that, it's it's that hook into so many other systems and and industries that make professional services firms, so attractive. Yeah. So super interesting. Super interesting. Okay. So that's great. Appreciate that context, Becca. Before we dive in, what we'd like to do is get a little bit of information from the audience. And, we're going to actually do a poll and we're going to, ask you what's driving your interest in cybersecurity today. So there are, several options protecting sensitive client and company data, reducing the risk of a cybersecurity breach, improving cloud security and governance, addressing compliance and regulatory requirements, and responding to a past security incident or concern. So as we're waiting for, the results to come in, give it just a minute. Okay. Like, it might be slowing down a little bit. So, I mean, does this resonate with you? I mean, is this what you would expect? It certainly does. Yeah. The, and I think it's just interesting that the top two, like, really, you know, took off there, especially reducing the risk of a cybersecurity breach. And, you know, it's it's no surprise. I mean, it's in the it's in the news constantly, and it's, as many years as we as an industry have been fighting it, you know, it's it's still a very significant challenge for for most firms. And I think the... As the regulatory landscape has been changing and getting more aggressive particularly in the EU and you know on the state side you know in states like California, I think you know that protecting the sensitive client and company data becomes super important because of those regulatory concerns of, hey, if there is a breach and and that it... That is touched and there's a suspicion that has been exfiltrated, you know, we have to disclose that. And that's, never never a good conversation to have with the client. So, yeah, it's Yeah. probably what I would have expected. Okay. All right. Great. All right. So we can go back to the the our presentation. So, Becky, you wanna talk a little bit about some of these threats, in in a little bit more detail and talk a little bit about, you know, really what you think is maybe the most, and the biggest threat here? Yeah. Certainly. You know, I think I think the first point I would wanna make is that, all of these threats are connected. You know, the, when we when we look at that landscape, you know, how an attacker gets in, is, you know, you look at that, phishing and business email compromise and and third party risk, credential theft, you know, attackers, there's an old saying in the industry is, you know, hackers don't hack in, they log in. And, it's it's really getting even more interesting than that and that it's not so much that they're stealing credentials and logging in with those anymore. They're using advanced social engineering techniques and we're also seeing, threat actors, different groups start working together. So, it was a good story last year that a a US based group that was very good at social engineering would take the lead on social engineering and then they would pass that access on to attackers in like Eastern Europe or non English speaking countries where they were really adept at taking that access and then exploiting it further. So that's, when I when I look across these, it's not it's not just one thing. It's like as a collection, you know, they're all used in support of a a greater mission in order to, you know, compromise a firm and then take that access and do as much damage as possible. I think, you know, one thing that's worth mentioning, we talk a lot about phishing. You know, I'm sure a lot of your companies do simulated phishing, exercises and such. But, you know, we've gotten really good at preventing, business email compromise and phishing incidents. Most companies nowadays have very advanced protections against that, and attackers know that. So doesn't... That doesn't stop them from trying, but they are... We are increasingly seeing, attacks that are... That come through a channel that's not protected by an organization. So that could be phone calls, that could be text messages, that could be emails to personal addresses. In some cases, we're seeing a a compromise where, you know, they're able to, call in, like, through Teams or Zoom or something like that to make it appear like it's an internal conversation. Yeah. So that's a... There... There's a lot of, all all of these things are, like, super important, but it's, like, you know, they're all used in support of one another. Kind of to that point on, you know, other texts coming in other ways, you know, it wasn't it wasn't too long ago that, Arup, which is a Hong Kong... They they have an office based in Hong Kong. An employee got an email requesting a, you know, a very large financial transaction. They, they questioned it and was like, you know, I think this is a phishing attack. But the, the attacker offered up said, let's have a video call. And so they got on a conference call with the CFO, so to speak, and, their supporting staff, so to speak, and, you know, ended up convincing that individual, like, okay. Yeah. This is, authentic. So across 15 different transactions over a short period of time, you know, they... You know, $25,600,000 was lost. That was a deep fake attack. So, you know, that's an exercise in using, you know, AI and and deep fakes in order to convince people in order to do work. And, you know, the the attacker was able to, you know, take which, you know, a a simple business email compromise that anybody, you know, any, any person with privileged access would be, you know, likely likely suspect and not engage with and then escalate that up and build that trust, you know, based on a a deepfake video. And so it's, it's it's getting to be a a a scary environment, when we think about those type of advanced attacks. And, again, that was, you know, it wasn't so much that the the network got hacked, but the attacker figured out, like, how they can exploit trust that were... That was already in place. And, so it's challenging to say the least. Absolutely. I feel like, you know, I I think about it. It's an organization. It's like a little Swiss cheese, right, where you're constantly, you know, plugging up the hole to make sure that these attackers aren't getting to your files, your employees. Right? And I I I can recall several years ago, I got a text from someone who said that they were our CEO and that he needed me to call him immediately, you know, and it was really urgent. But, you know, I I haven't received the text from our CEO like this ever before. Like, I don't know what would be so. urgent in my role. Right? So, you know, I was suspicious of it and didn't respond and reported it to our IT. But it's so interesting how, things are becoming so much more sophisticated. I'm sure then, you know, I even realized, you know, based on your story, it's, you know, it's it's challenging for organizations to keep their information safe. So what happens, when somebody gets through and, there's a ransom where, you know, attack? I mean, what... How how organizations deal with that? I mean, what what... What's the best... Yeah. You know, things get serious very fast. Yeah. The, you know, people always ask, like, you know, what do we do in those early days? And it was actually interesting. Our, our, local sheriff's department in the county just south of me where where I grew up, was... Had a had a major cybersecurity event just two weeks ago and, you know, a ransomware event and such. You know, they're a law enforcement agency and, you know, you would think that, you know, they should they should know what to do and who to call and everything like that. But, my brother who has a friend there, like, reached out to me and was like, you know, they're scrambling a bit and, you know, could probably use a little bit of guidance. And I was like, you know, the the... You know, calling counsel is obviously, you know, one of the number one one things to do. But I I think having a recognition that handling it yourself is probably not gonna end well. You know, with ransomware specifically, there there are companies whose whole job is to negotiate in a ransomware incident and have an understanding of, the the the threat actors and what their motivations are and how likely they are to negotiate and that sort of thing. There's firms that their whole job is to do forensics to figure out why and how it happened, other firms for recovery. So reaching out and engaging. I often tell people if you have a cyber insurance company, you know, reaching out to them first is really the the best answer because they're going to have contacts for all. these vertical industries, to help you through and and recover in that in that breach. But, not acting too fast, Right. not acting in pressure. You know, if if you're in a ransomware incident, like, you know, damage done, you know, it's... At that point, it's time to make thoughtful decisions and not make a run... Not feel pressured into making a rush decision. And that's where, you know, if you're in The US getting the FBI involved, you know, if you're... Basically, every country has a cyber, you know, cyber focused law enforcement, agency. So reaching out to them, you know, is is certainly a good option, but, the cyber insurers are best at navigating those incidents and and helping you through that, hopefully as inexpensively as possible. Gotcha. Okay. Good. Good to know. Good to know. And I'm sure that that takes the company down a rabbit hole, right, of wasted time and, wasted resources to try to. deal with it too. It's, I can't imagine being in that situation. All right. So let's move on and let's, let's talk a little bit about, how one security incident can really turn into both a legal problem and a client relationship problem for an organization. Can you talk a little bit about, you know, how... What your experience is here, Becca, and and how these are... This is handled? Yeah. You know, with with my team, we talk a lot about customer confidence, and that's that's really my recommend... Recommendation to every industry when you think about compliance is think about it in terms of not necessarily are we doing the right things for security, but think about it in more of can we demonstrate that our clients can trust us that our customers can trust us. And that's and and I I you know it compliance certainly isn't inexpensive and it's a great first step into understanding if the right controls are in place and it's a great first step in demonstrating particularly if you have government agencies as customers or if you have like financial industries or you know as customers I... The compliance really does a good job at like opening the door to that conversation and how we're demonstrating customer confidence. The, you know, when, in our industry specifically, but I think in a lot of industries nowadays, third party risk management is really a growing concern. We kinda saw that on the, threats impacting professional services firm earlier about, you know, third party risk management. Especially with digital transformation, there are so many systems inter... Interconnecting with one another. So that, you know, that that... We see that a lot with systems used in support of, like, sales and customer service. And, you know, if if you're thinking about engineering, you know, there's a lot of different tools and stuff, and a lot of them are SaaS based, so they're connected to one another. We've seen a number of breaches where, partners for, like, Salesforce have have had a compromise that has then impacted, you know, Salesforce. And Salesforce is a big cloud organization. Interestingly, you know, it's gotten really really good at identifying those and then shutting down that access to protect their own customers. So we've we've seen how that that third party risk has been an issue. Because it is such an issue and there's so much more collaboration globally across firms in order to deliver, like, complex projects. What we see is that third party risk management piece and even... We're even seeing fourth party risk management now kind of taking off as an industry of understanding, okay. I understand you, my partner, that your security impacts mine, but I also wanna know how your partners might impact my own security. So we're seeing that become more and more of a conversation as these type of systems and interconnections get more, more complex. I think, I think kinda to that point, you know, I'm I'm based here in Saint Louis and, Equifax has one of their major business units based here. And, you know, this has happened a long time ago, but, in the wake of their breach that they had in 2017, they hired a lot of cybersecurity talent in Saint Louis and where they had these major business units. And so I was one of those lucky folks that went and helped them out for a while on on the recovery. And, you know, what we later learned and became public is, you know, Equifax had these, you know, big data centers, which was popular back then for companies to to run their own data centers. So they were doing their own patching. They were doing their own access management. And it was just like... It was so disappointing. It was like one individual, you know, got direction, go patch this vulnerability, you know, secure this system. You know, they had an alert. They even... They had an alert from law enforcement. Hey. This is a this is a, you know, a big challenge. You know, this needs to get corrected. And it was just... It was one individual making, you know, a poor decision on one day of of not chasing down that last vulnerability. And that's, you know, that's what ultimately caused that compromise is an extraordinarily complex, you know, data center trying to manage all their own systems and then ending up in a position where, you know, one mistake, you know, cost them an issue there. So that, you know, that cost, you know, just awake for that organization and trust and such. And their new CSO there who I worked for for a while, Jamil, and he's their CTO now, an amazing leader and and really, you know, worked for years to reestablish that trust. And so if you think about it like a huge data provider like that and, you know, they made all the right moves and and, you know, post breach to bring in the right talent to, you know, bring in a new CSO who had been through this before and do that, but it it still took years to reestablish that trust. And we we see that nowadays that there's... You know, it's just across years of headlines, you know, customers. have grown, you know, and clients have grown increasingly nervous. So, like, even even small cybersecurity incidents that must be disclosed to your customer base really, you know, take an impact to customer trust. And so it's like, you know, taking that compliance and working that through, and using that as kind of the the table stakes of, hey. We are doing the right things. This is how we can demonstrate it. But then also holding yourself accountable on the back end that, you know, compliance is like... That's like level two on the on the five five step maturity scale. So, you know, there's a lot to do beyond that. So, there's a lot of insurance for your business there, right? I mean, the money well spent because, you know, not doing that could really impact. your business and cost you a lot more than doing it. So Yeah. super super interesting. Yeah. It was great. I'm sure it was great experience for you to work in that environment and, I was. you see how bright I'm bringing them back. Alright. So, we talked a little bit about, SaaS systems. I mean, there's a lot of pressure right now for, everyone to move from an on premise solution to the cloud. And, you know, some organizations, individuals are very nervous to move to the cloud because they feel like their on prem infrastructure is more secure. Can you talk a little bit to that and and, you know, help us understand that? Yeah. You know, the example I like to give a lot and and, you know, we do something similar here at Deltek. There is there is work that we do that is, like, part of our identity that we're super good at. And then, you know, we take advantage of SaaS providers ourselves for a number of our systems, our collaboration, you know, productivity systems and such. And why that's important to me as as a CSO and and why we look at that is that introduces natural segmentation between critical systems. So that, like, our our back office productivity systems are completely separate from, like, our Salesforce systems. So if if we have any, you know, if any one provider has a has a has a challenge or if we have a challenge internally, it doesn't take down the whole company. You know, it's it's like we have, you know, most of the most of the company continue working even if, like, one provider or one system was impacted. So that leveraging cloud in order to do that introduces that natural segmentation. And it's and it's interesting in the cyber insurance industry, we're now seeing cyber insurers get wise to that and they're starting to ask that of, you know, who do you use for your productivity systems? Are you hosting internally? Are you, leveraging external systems? You know, particularly true for, you know, things like email and critical systems and and such. So that that becomes their their tee up to understand cyber maturity, and then that can influence, you know, what your premium rates are for for cyber insurance. I think one reason for that is, like, when you're dealing with, you know, a massive data center and multiple systems and, you know, kinda like we talked about with Equifax, just trying to keep up with patching across all that, you know, we... We've seen in in in our industry, like, vulnerability management is so noisy nowadays, and it takes it takes multiple tools just to understand how you should prioritize patching those vulnerabilities. When you're dealing with a large provider, you know, a Cloud provider, like, that's their job is to secure that system, and that makes enormous sense. And so, you know, getting that out of your own data centers and out of your IT's, you know, out of IT's hands where they're not trying to juggle a thousand different things, like, Yeah. you know, do I go help my CEO with their Teams issue or do I go patch these vulnerabilities today? Like, you know, it feels like it should be an easy choice. Go patch the vulnerabilities, but, you know, the CEO needs needs help with Teams. So it's like it's like... And that... That's that's a really simple example. Right? But the but the sentiment holds and that, you know, IT teams, internal teams are juggling an awful lot of work nowadays. You know, they're trying to help a business through digital transformation and such. So removing that that rinse and repeat operational work off their plates is is, you know, just a natural pathway to security and to start, you know, reducing your external exposure risk, you know, to to cyber attackers. And I think it's, you know, it's it's even more important nowadays that there's so many people are working remotely because by definition, what that means is you have to start exposing more, externally. And even with the best intentions and even with, you know, new technologies like zero trust and such, those are very complicated to implement and maintain. And so without robust IT staffs, you know, that we... You you start to see where those those gaps emerge and attackers uncover those. And, they're very... Especially with the assistance of AI, they're very quick to exploit that nowadays. Yeah. For sure. No. I I... It makes a lot of sense, and it's gotta be a big, it's a big effort to to do this for cloud infrastructure. I would think a company having to do that big effort just for one, is is expensive and a lot. And some of the efficiencies that you get in a larger cloud environment where you're not responsible for that, you know, could be, you know, could be impactful for your business as well, you know, if you're thinking about, moving to the cloud. So, I I do think AI has definitely brought some more, complicated things into, this conversation right now. So if you think about what clients are are asking, you know, the firms and the companies that they do business with, like, really what what do they expect, especially with, you know, the craziness of AI and the fast changing technology that we seem to be experiencing right now. Yeah. You know, it... We... Cybersecurity questionnaires have always been a thing. I mean, for years and years and years, like, I remember, you know, working on that, you know, back in the early twenty ten. So, that... That's that's always been something that, customers have been interested in, for... In... Across industries. Those questionnaires are now getting, much more detailed and, much more... I I hesitate to use the word invasive because that sounds like a a harsh term, but, you know, it's like details really, really do matter. And with the rise of AI and all the headlines around, how AI models are trained and, so many customers looking to, you know, so many companies looking to integrate AI into their business processes, into their own products, into the services that they offer their customers, You know, data governance has really exploded as an interest. And I think, you know, a lot of companies historically may have been like, okay. You know, we understand this data is with this provider because, you know, we use them for this service. You know, that is what it is. No big deal. Now it's like, hey. Wait a minute. We we understand that that data has has value and probably has value to train your AI model or it might have, value internally in order to, you know, create virtual employees and that sort of thing. So, we've seen those, type of those those questions get a lot more interested and so, you know, clients for professional services firms are certainly very interested in how their data is being utilized, how maybe, you know, engineering projects that that they thought were confidential and begin to help them through in solution on on a certain thing. You know, years ago now has tremendous value in training AI models. So getting very interested in that data governance. I think, you know, the challenge with AI nowadays, like, so many companies are trying to adopt that. I mean, you know, Deltek included, you know, we're, you know, chasing after many different use cases, how we use it internally to deliver faster, to work work better, and be more efficient. You know, that's that's no different than any other company out there right now. And, Securing AI has been, it's interesting. Every cybersecurity conference I've been to this year, you know, they always have a vendor hall, like, you know, I think of, like, a lot of industries do. And I think nearly universally every... All the signage says we secure AI and then this is how we do it. So it's part of everybody's story nowadays. You know, we we have on that slide there that 45% of employees now use AI regularly at work. I I bet it's much higher than that. I mean, that's that's based on, like, recent stats, but I... I'm sure that's much higher than that. But what was inter... Interesting when I was, looking at that data is there was there was a tag on one that was 67 of employees admit using non corporate AI tools on their corporate devices. Oh, And so then that really starts to make you wonder. It's like, well, what are you sharing with that non corporate AI tool? Are you sharing internal documents? Are you sharing customer diagrams, statement of works? You know? And, on those non corporate AI tools, you know, not many users think to go in and click the little button to say, you know, don't use our conversations for training data. So that that that, like, enters... Introduces a whole other line of governance. And there's lots of tooling now, you know, for that, you know, to block non corporate AI tools, to detect usage of it, to, you know, do data loss prevention that's specifically tooled around, you know, AI conversations and chatbots and such. So, you know, that... If I if I had to, encourage everybody to, sorry, my voice is dropping on me. If I had to encourage everyone, like, one thing to think about, it's like, how do you answer the question simply for a client of do you use AI with our data and how? And, you know, it's... That can be... You know, spin up and become a more, complicated answer. And I think bring... Bringing it down to, a, a very practical, straightforward, no nonsense answer, helps create that assurance, but it also helps create a culture internally to where your employees start to understand that, hey. This is really important. Like, this is part of my responsibility to ensure that as I'm interacting with customer data that I'm only using it with approved tools. So building that culture internally becomes, becomes critical. Yeah. Absolutely. I feel like here at Deltek, before we hardly got out of the gate with AI that we we were given governance around what we can do, how we could use it, the tools that we could use, which from my perspective was super helpful as an employee so that I had my guardrails and and knew how to to operate. But that 60, I think you said 67%, like, Yeah. 67%. that scares. me. Yeah. I mean, I I wouldn't have thought that. Hopefully, that's not happening here at Delta. But that... That's a lot a lot a lot of people not, you know, putting things into, the AI engines that shouldn't be mostly... Yes. That's what it sounds like. So, interesting. Very interesting. And I think, the governance too is so important. And just from our perspective, you know, we... As we started to release some of our AI capabilities here at Deltek, it was very important for us to document, you know, what we were doing, how those thing... Those AI functions were were working in our solutions, because those those questions were, you know, the coming up constantly. So, I do think it's super, super important. Alright. So let's go ahead and talk a little bit about, incident response readiness. So if a firm doesn't have an incidence response readiness program today or plan today, Becca, where should they start and, you know, how often should they be testing it? How often should they be reviewing it? So talk talk a little bit about, about this with us. Yeah. And I'm gonna I'm gonna keep... I know we're we're starting to run a little short on time, so I'm gonna I'm gonna keep this brief so we have time for questions. But, you know, it's interesting... My my answer to this has changed. Yeah. You know, with the advent of AI, and, you know, if you have access to a, you know, a paid model, you know, anthropics cloud is a good one. You know, describe to it your organization, you know, what your structure is, you know, if you're global, where employees are, and that sort of thing, what kind of systems you interact with, and then just ask it. Say, how do we how do we how do we test this? How do we develop... You know, I need an incident response plan to know that when we have a cybersecurity incident, like, we're ready to go. Like, what are the top five things we should think about? I'm sure it's... You know, one of his pieces of advice is gonna just be like, you know, who's your cyber insurer? You know, make sure you have an insurance policy. And if, you know, if for whatever reason that's not available to you, you know, reach out. There's a number of firms, you know, large organizations, and, honestly, you know, your your CPA, you know, your your accounting firm is probably a good place to start. And just ask them for advice. Like, you know, where where should we go for, like, that that first call out? One of the interesting thing... One of the cool things we did here is we have, of course, our instant response plan. And, again, as as a cloud provider, it's it's it's very lengthy. We have multiple teams involved in in, that process. So for us, it's pretty complicated. But because it was so complicated, you know, it really wasn't consumable by our executives and partner teams that we use throughout, you know, Deltek. So we created an an executive instant response plan that's that's much shorter, much more direct, and it's like, you know, for what those... The roles that executives play in that process. So I think that helps us to take what can be a very complicated plan and, have a second one for an audience that isn't necessarily engaged in, you know, the hour by hour details. And then I I think the other big thing you do is is honestly just test it, you know, tabletop it. You know, we do those often here at at at Deltek. We do tabletops with highly technical teams and and, you know, they're multi multi hours. We do tabletops with executive teams, and we structure a little bit like dinner theater. So it... It's, it's exciting and interesting and, you know, scenario changes as we go through it. So that's, that's pretty helpful. But, yeah, those are the things that I would I would do, you know, and, in in short order in order to ensure that you're you're ready and prepared. Awesome. Yeah, that's great advice. I think that's super helpful. All right. So as we go into, wrapping up, here, let's talk a little bit about, some practical steps to reduce risk. So can you talk a little bit about that, Pekka? Yeah. You know, the the the, I like to say that within the industry, we've gotten very good at controlling technical risk with technical controls. So when we, think about access management and, you know, ensuring that multifactor authentication is available everywhere, you know, most companies nowadays are using multiple, SaaS providers for, you know, different different systems throughout the organization, ensuring that you're using single sign on, so a centralized identity provider with MFA engaged. And and it... You know, these days, you know, MFA through a text message is is really not sufficient anymore. Same thing with, like, MFA through phone calls is not sufficient. We really, like like to see controls that are phishing resistant. So we're using number matching or, like pass keys, something like that. Training is still a huge thing, ensuring that, you know, individuals kind of engage with that. We actually produce some of our own videos internally here at at at Deltek, and, you know, that that kinda helps people engage with it a little bit more because it's people that they work with talking about it. I was at a CISO dinner on Tuesday night, and one of the organizations had a really neat technique. They produce videos when they have a cybersecurity incident. They interview people involved. So they have these training... Cybersecurity training videos, and they feature employees that were impacted by that cybersecurity incident because they couldn't run payroll. They, you know, they they they couldn't meet with customers. They they couldn't finish their work. They had, you know, due dates that had to get pushed. You know, and so they talk about how it impacted them in their daily work and missing time with their families and, you know, you know, other impacts. And, it was interesting that Cecil made a point and it's like, we feature no executives in that video. It is it is just employees, you know, heartfelt conversations. And I I was like, you know, that feels like that's impactful. And so, you know, when you're trying to present major incidents like that, it's like, you know, lean on those technical controls, you know, lean on experts where you can in order to protect the environment, recognize it's a very complicated problem to solve. And so, you know, really think about it from a risk management standpoint. There's there's no perfect security. So you need to think about, like, how do I either make it not my responsibility, so take advantage of SaaS providers where I can. And, when I'm interacting with those SaaS providers, be very, very thoughtful about how do I... You know, if I'm gonna link SaaS provider a to SaaS provider b, how confident am I am I in that in that security? And just always make it part of a conversation. Right? Like, you know, it's, it's really everybody's responsibility to have those security conversations and and push on that a little bit and ensure that they personally understand it even if that's not their role in the company, certainly helps out. So, you know, these are all great examples, but, you know, a a lot of security comes down to access control. So everything you can do to, implement an MFA and then restrict what... You know, if if you have the technical capability like we do at Deltek, you know, like, my Deltek laptop, you know, is required to access certain Deltek systems. So not... It's not available to everybody on the Internet. So those type of controls really make a difference. Awesome. Alright. So if you could tell the audience, one thing they should remember from what we discussed today, what's what's one thing that you want people to walk away from, today? You know, the stories, the examples that I've shared about people that have been breached or, you know, had major cybersecurity incidents, and a lot of those turn... And I've seen this throughout my career in security incidents that I've worked. A a lot of those turn on one small decision that had an outsized impact. You know, it could be, hey. We had an old system for, you know, remote access. We didn't think anybody knew about it. Well, attackers are really good at finding those. And especially nowadays with AI systems, attackers have gotten super good at compromising systems that, you know, just a year ago, they never would have bothered trying to figure out how to hack their way in. But with AI, they can they can test so many things so fast. It makes it super easy. So, like, if I was gonna have one takeaway, you know, to this audience, it's, like, think about, you know, every day, every week, every month, like, what what is one small thing that we can do to ensure that the right decision is made forward or to remove the opportunity for a poor decision to be made. And I I think that's that's really one of the the the top answers there is, you know, as I've got it on the slide here, you know, security is a trust issue. And, you know, there's an old saying trust but verify, and that's that's a really important thing to do is just verify. And sometimes that's through compliance, through testing, through internal audit, and, you know, figuring out what are the things that we can really impact and what are we experts at and what are we not experts at and where we're not experts. Like, is there a partner I can leverage in order to, in order to take care of that for me? So that would be my key takeaway. Awesome. Awesome. Well, great. I really appreciate, the partnership in today's webinar, Becca. It was fantastic information. I think that, you conveyed here. Hopefully, I learned a lot. Hopefully, the audience did. And I think, Jen, we're ready to hand it back over to you. Maybe not. Yeah. I see that. your list. Yeah. Having some some difficulties today. So let's go ahead and, just wrap it up here a little bit. So, we're... Deltek is, in the business of powering project success. So for those of you who don't know what we do, if you'd like to learn more about what Deltek does, please, you know, feel free to reach out to us. We will be happy to talk to you about how we can help your organization, become more efficient or effective in managing your project based businesses. So let's go ahead and I. did see, I see some q and a here. So I went ahead and read right right ahead a little bit, and, we got, you you know, one question out here is, you know, what are the tools that allow you to check if employees are using nonapproved AI tools? Essentially, every cybersecurity vendor now, you know, whether it's like CrowdStrike or SentinelOne, are now rapidly rolling out tools so that their agents can detect, AI tooling, whether it be through a browser or a, locally installed piece of software. So that's usually where I start. Now I'm gonna say, like, a lot of companies may leverage, built in, you know, like, you know, Microsoft Defender or something like that. They're gonna be slower movers, you know, if they're using that for, threat protection. But, most other companies, the the larger cybersecurity security vendors are now rolling those into their tools. There's a lot of startups out there doing this work today. If you're looking for, like, a very, very quick solution, you don't wanna necessarily change over your, you know, your, threat protection to a different provider or if your threat... Your current provider doesn't offer it. So there's a lot of startups out there that that offer that as well. But I think one of the keys to look for, is that they can detect in browser usage and also detect locally installed tools, usage. Part of that is because, not so much that employees might download a piece of software installed in their system. Most companies nowadays would block that ability, but so many vendors and, you know, approved pieces of software and such are rapidly rolling out AI integrations and turning it on by default. Not all companies, not all industries are gonna be comfortable with that, because they're not confident in the answer the AI might give. I think that would be particularly interesting to, like, you know, engineering firms. Like, you know, in some cases, that might be a great ad. In other cases, you know, that could cause a safety impact. Right? So that's, at... You know, looking to those... Your your threat management products first, detecting and blocking that. And if that's not an answer, I'll look out, you know, to some of those startups out there. There's no end to them, so that's kinda one of those things where you may wanna, like, tap on an outside expert. You know, consultant, you know, accounting firms generally have cybersecurity consultants are good ones to ask of, you know, what would be a good tool to integrate and bring into our environment. So... And, we talk about, there's another question out here about, where does SSO, fit into the natural segmentation concept, and, how does SSO not become the vulnerability? A very good question. So, you know, a few things. One, you know, always work with a trusted provider, you know, you know, someone that you know well. You know? So, in most cases, collaboration software, so whether you use, like, Google Workspace or Microsoft three sixty five, they both offer natural, SSO capabilities. It can become a vulnerability, and to be perfectly honest, it becomes a social engineering risk because if I can convince your employee to log me in, that that can make me a thing. You know, in the industry and again this is where it starts to get very complicated, but, you know, we do a lot of work here on, identity detection and response. So detecting when an attacker may have compromised an employee's account or maybe attempting to compromise an employee's account. So it does seem natural to suggest that SSO would be a single pathway in to get to everything. But by and large, it is the the most secure way in order to protect your environment. And if for nothing else, as you onboard and off board employees, it becomes very, very easy to add and remove their access. And then also modern SSO tooling, is increasingly offering phishing resistant or or vishing resistant multifactor authentication to prevent those. And then finally, like, those SSO providers often offer threat detection, of their own accord. So they will block temps from malicious attackers. And they will detect things like someone tries to log in as me from New York City, which is half a country away from me right now. You know, it... It'll detect that and and block that. So that's a that's a good one there. K. Anything else saying in the queue, Becca? Another one just popped up here. Maybe real quick. Yeah. So there's a question about, you know, with professional firms, replication of data is easy. And so, you know, how do how do you predict, like, data privacy and, you know, for the customer and such? You know, that... A lot of that comes down to access management. It... We kinda go back to compliance. For a number of our products at at Deltek, you know, I I think I think, actually, universally, we have SOC one and SOC two, attestations. Number... Increasingly, we're adding ISO 27,001 to our product stack, kind of across the board. We're also, using, like, Cloud Security Alliance, their STAR program, which is designed for Cloud providers. That's very much about transparency of, like, you know, putting that information out there. So, that's a big part of it. That's how you give, like, that external assurance to, you know, your own clients and how we do so for our customers, is through demonstrating those controls. But it's also very much an internal cultural and training issue of this is when and how you can access this data. This is, you know, with access management, you know, restricting that access to, you know, back end databases and administrate... And system administration to very specific employees, you know, and understanding there's a high degree of trust that comes with those roles, and so they have to be managed appropriately. Alright. Well, that looks like all of our questions. All right. So I'd like to thank everyone for joining us today. Thanks Becca for the great information and a great conversation today. Like I said earlier, if you have any questions, please feel free to reach out to us. We'll be more than happy to, respond to additional questions to you on an individual basis and answer anything that we can around, you know, what we do here at Deltek or any of our solutions. So thank you all, and have a great day. That's fantastic. Thank you. Bye.