Mark Wickersham, Host 0:03

All right, Matt, welcome to The Wealth Tech Podcast. I am happy to have you on the show. We are gonna get into some matters that are of utmost importance to family offices around cybersecurity, the growing threats from AI. I think I've recently read over half of family offices have been under a cyber attack. I think that's from Deloitte, and I'm sure that is underreported. Um I think this is still one of those areas that gets kind of underlooked and underappreciated by family offices. It certainly doesn't get the press or the hype about the impact and benefits that AI has. So if you wouldn't mind, would you mind giving a brief introduction and talking about the firm that you've founded in Fort?

Matt LaMura 0:56

Yeah, absolutely. Well, thank you first and foremost, Mark, for having me on today. Um, my name's Matt Lemura. Um, I am a founder of a company called Fort, and we are a discrete service provider that works almost exclusively with family offices, private investment firms, family funds, small private equities, um, and similar entities. Um we're a discrete provider, meaning there's no website, we don't do mass marketing. And the reasoning behind that is because we don't want to put a target on our organization's back, which is exactly what we're trying to prevent from happening in our client's environment. So that's the reasoning behind that strategic decision. Um and uh again, we work with family offices because of uh generally the the risk that comes along with um managing the level of assets that they that they manage, um, as well as you know, uh because they have um in most cases immature cybersecurity postures. So what we're able to do is is come in and help them solidify that posture, manage that posture, reduce their footprint, and and many other creative things that we're able to do.

Mark Wickersham, Host 2:11

Um yeah, so I love the the the term the private cybersecurity concierge. I think that's uh a great way of describing it. Any chance I get when I talk to a founder, I always love to talk about their founder's journey. Yours is a bit unique, having you know been in the wealth management industry and worked for Merrill Lynch, and then during COVID, you decided to uh spin out on your own or start your business. Can you tell me a little bit about your founder's journey?

Matt LaMura 2:42

Yeah, absolutely. I I I love sharing this story um because you know it was in hindsight a little bit of a surprise for me, but um, it all in high again in hindsight kind of adds up at the end. But essentially out of school, you know, I grew up in the New York metro area. I went to business school in the New York metro area. So naturally being from the area and living here, eat, sleeping, and breathing here, you're surrounded quite often about uh uh around finance, right? So um fell into Merrill Lynch out of school. I was very lucky to get a job there. It's an outstanding organization, um, very well renowned across the globe, as we all know. Um, but it, you know, it wasn't something that got me out of bed at that at that time in my life. And so I was able to, while I was at Merrill Lynch, get my MBA at night. And that's where my interest in cybersecurity started to blossom. Um I pivoted into the cybersecurity space, specifically the services end, um, working as a consultant for the last 10 years. Um, and in that 10-year span, right, I worked with startups all the way to Fortune 50s, um, helping startups build their cybersecurity programs from scratch and augmenting programs that were already in place in larger organizations, pressure testing those environments, doing audit readiness assessments, all that fun stuff. Um, and like you said, during COVID, um the what had occurred selfishly was we had my wife and I had our first child, and what I was trying to do was implement the robust cybersecurity controls that we used for our enterprise clients. And I wanted to try to bring them into my own home to protect my kids in their in their own digital journey.

Mark Wickersham, Host 4:27

Yeah, I I think that's interesting. That you you you started it literally for your family and and try to protect your family. Obviously, family offices are kind of unique in a lot of different ways. They're in some ways they look institutional, in other ways, they look really retail. As you mentioned, they don't necessarily have the the IT or the infrastructure in place that a corporation would have. I mean, some do, but many don't. They they run pretty lean. You also have the aspect of not only is there the family office business itself and that entity that needs protecting, but to extend that out to the larger family and those individuals that may be doing things on social media, they have devices, they have homes, on and on it goes. Talk to me a little bit about what you're seeing with some of these family offices and and with family offices really kind of underestimating how often and and how they're being targeted.

Matt LaMura 5:29

Yeah, uh I think look, there's there's really two ways to look at this. Um and it it's it's it kind of it's it's funny, right? Because again, I've I've worked so long with large enterprises that there were many, many patterns we saw back in the day with with when we had these types of conversations on the in the early days of cybersecurity. Fast forward to now, we're having I'm having almost the same conversations with family offices that I was having with chief information security officers 10 years ago. Um, whereas it's it's not necessarily about full prevention. You're never gonna be in full prevention mode. That's not a thing. Everyone's being targeted, everyone is susceptible to being breached. But um, you know, family offices have the luxury of being smaller in terms of like digital footprint, right? They don't have a large footprint, they don't have many employees, but there are two types of attacks, right? At the most macro level possible, there are really only two types of attacks. There are targeted attacks. Hey, I'm going directly after Mark and his team at his company. Or there's what we call spray and prey attacks. Spray and prey attacks are somebody sitting on a couch, spraying the internet, trying to find any vulnerability in any system or on any machine that they can possibly get get a hook into. You don't have to be a big bank or anybody special to get hooked into a spray and prey. You simply just need to have your environment not tuned or configured the the in the most optimal manner. So whether you're a family office who's being targeted or not, you are highly likely going to get caught up at some point in a spray and prey attack, um, where again, they are compromising thousands of devices or s or machines across the entire globe. Um so to kind of like dig into that a little bit more, what we see a lot of in our client environments are nine out of 10 are using, for example, Google Workspace or M365, Microsoft 365. The overwhelming majority is M365, though, because that is extremely common across the financial sector. It's just, you know, a norm within the financial world. And these platforms are built to be very friendly user right out of the box, right? They don't they want anybody and everyone to be able to purchase, download, and start using these softwares immediately. Now that creates very user-friendly environments, which is awesome, right? It allows people to consume these softwares at a very uh with a lot of ease, um, but it also creates open environments and lots of vulnerabilities and avenues from the outside into your environment. Now, luckily over the last five, six, seven years, Google and Microsoft have have kind of caught on to this. And with your business or workspace licensing, you are already buying several cybersecurity tools tools and controls that just come with your subscription. Um, and in many, many cases, people don't even know that they exist, right? So you are investing in extremely powerful cybersecurity tools, but you don't know that they're even there. So um, if you're able to again ditch that mindset of, hey, this couldn't happen to me, we're too small, and tune your environment to the to the specs that it it should be and tighten it, you will definitely be in a much better place um when tested against targeted attacks or spray and prey attacks. Um because the way it works is that once someone gets a foothold, right, or they get into your environment in some way, shape, or form, they just sit dormantly and wait. Um, and business email compromise is something that is extremely prolific across not just the family office industry, across all industries. And this is how they do it. They spray Microsoft environments, they get hooks into the different environments, they sit in those inboxes, they learn about invoicing scheduling, they learn about when people are going on vacation, they learn about the thresholds about approvals, and then they just step in front of invoices whenever the time is right. Right. So I could not agree more with you, Mark, that there are certainly organizations that still feel like, hey, we're too small, no one's gonna target us, no one knows who we are. I combat that every time with the fact that no one needs to know who you are, nor do some people even care. They just want access to any environment that they could potentially get access into and leverage for ransomware, spyware, information, data, doesn't matter. They're trying to get their hands on something. Um, so if you combine those two, those two uh issues, right? The the deploying software without tuning it properly and keeping the mindset of, hey, this can't happen to us, you're setting yourself up for um disaster. Um but again, at the end of the day, Microsoft and Google are both extremely powerful platforms. There are settings available, and I'm confident that many of uh our clients and and potential prospects don't even know that they're available. You just need someone to help you squeeze the most juice out of the investment you've already made. Right. So um I guess that's that's kind of like the the short version of uh some organizations think that they're still too small to get hit. And again, you can be a one-person organization and still get swept up in a spray and prey attack. So fundamentals, cyber hygiene is extremely critical to the life, the the to the support and the longevity of your cybersecurity program.

Mark Wickersham, Host 11:25

Yeah, I mean, there is the there's certainly the randomness to it, but certainly there is certainly a targeted component. I mean, you have the for 400 list, you have, I mean, New York City just came out with second homeowners list, and and and certainly people will be highly interested in targeting uh those individuals and families given that the assets behind them. You're talking about uh especially in your just now in your recent newsletter around email compromise, I mean social engineering. I mean, one of those things too is that they sit and wait, they know that maybe they're purchasing an aircraft, they're purchasing a home, the person's uh on travel, and that's that person uh perfect opportunity to step in and and and and use that social engineering to be able to uh commit fraud. Talk to me a little bit about email compromise. Why is that such an easy front door and and and how has that been climbing in terms of uh incidents lately?

Matt LaMura 12:26

Yeah, I mean, business email compromise, like I mentioned, right, is is just prolific everywhere. Um and it is, it's I would say really it's there's it really boils down to one specific kind of problem, if you ask me. And it's it's the fact that, or two, right? It's it's organizations that haven't tuned these environments, their email environments, like we had mentioned, to just tighten them to make sure nothing can kind of get through. But more importantly, and this is more of a culture thing than anything else, is that we as human beings just move too fast nowadays, right? We try to do 50 things in a day, and we we pride ourselves in multitasking, we pride ourselves on burnout. It's I don't it's kind of like a weird culture thing. I don't know why people tell you about burnout. But and and ultimately that's that's really what it boils down to. It almost every single business email compromise is tied back to um someone moving too quickly, uh or the person who usually approves this is on vacation. So I had to do it and I wasn't 100% sure, so I just approved it to push through and no because I didn't want anyone to get mad at me. Um so I would say it's really it's really two things. It's technical and it's cultural, right? It's technical because if you're not tuning your environment appropriately, things are gonna sneak through. And then once you add the the current human nature to that recipe, someone is going to make a mistake. It's gonna happen. Um now the best way to kind of combat this is to is to have certain procedures in place, have backup proceed have backup approvals in place, um, have certain thresholds to understand, hey, if it's above this, we need a third approval or whatever it may be. And that's something that is built internally, right? That's up to the that that decision is up to the the office itself. But it is such a prolific attack, and it's so successful because of those two reasons. They haven't changed. You know, some organizations just don't take their cyber posture seriously yet. And we work in a world where everyone moves too quickly. But hackers are very well, very good at taking advantage of human nature. Social engineering is is all over the place, whether it be phishing from an email, fishing from a phone call or from a video, excuse me, or voice cloning on a phone, right? It it uh they're very creative and they like to pull on the emotional strings of human beings, right? So business email compromise, I don't see going away anytime soon. Um, so it's a matter of being prepared, executing your plan when things happen, and making yourself insurable. That's really the best, the best plan of action to take.

Mark Wickersham, Host 15:24

Yeah, I want to I want to get into these. Um I I definitely, you know, as human beings, we want to please. I think certainly uh members of the family office want to be responsive to requests, and that that's part of why they're there. It's a service uh mindset. But with AI being so good, the tone can be so good in these emails, really capturing the principal. It used to be in the past that you could see it would be like broken English or misspelling, like none of that. It's not only is it like you know grammatically correct, but it's in the tone of the principal now, and because they've been sitting there surfing on it for a while, it's really tough to detect. And like you said, you have to have those multiple layers and steps and take a step back to think about hey, is let me just double check uh on this one. Um, let's talk about the the three pillars of cybersecurity, uh, and and how you break that down and how you think about the those three pillars for family offices.

Matt LaMura 16:25

Absolutely. And and that um this is probably one of the favorite my favorite things I like to discuss, right? Because again, traditionally, when I was working with enterprises in the past, it the most of our conversations were deeply technical. Um, whereas now our conversations are with COOs, general counsel, board. Um, sometimes, depending on the family office, if they're a big family office, they have a VP of operations. Um, right. So these conversations are tend to be far less technical and more strategic or governance focused. Um, but right, with those three pillars that we harp on, and this isn't this isn't something I invented. I don't want to take credit for this. This is a very common um theme across the cybersecurity industry, but the the cyber industry adopts many military concepts. I'm I'm not sure if you've picked up on that at this point. Um, but one of the very common concepts that we use a lot is left of boom and right of boom. Sometimes it's left of bang, right of bang. I'm not sure if you're familiar with this at all. But um, boom or bang is referring to the bad event, whatever that bad event is. So a compromise, uh a fraudulent wire transfer, a ransom note, something like that. Um, where left of boom refers to everything happening before that moment. Right of boom refers to everything that happens after that moment, right? So left of boom is about preparing for and hopefully preventing the event, building resilience. Right of boom is what you do once prevention has already failed, right? So your your detection and response capabilities. Everyone gets attacked. You no one is immune to this, right? We just talked about that. Whether you're targeted or caught up in a spray and prey, no one is immune. It's the it's the one, it's the offices that have nothing planned for the right of boom that really feel it the most. And then what closes the loop on everything is making yourself insurable, right? So insurance isn't a separate purchase you make instead of doing the work. It truly is the financial backstop you earn by actually doing the work up front. Um, and to kind of give you uh a visual as to why this is really important is because when ransomware first was exploding 10 or so years ago, insurance carriers were struggling to underwrite. They they didn't know how to underwrite, they couldn't accurately underwrite it, they didn't even understand ransomware, what it was. They they they didn't understand the risk. Uh, they didn't understand how to cover it. So for a while, they struggled to underwrite. Now, fast forward 10, 15 years, they have all of the cyber claim data and what they they've gotten smart, and they use this data to essentially help themselves underwrite more accurately. They're sharper on their underwriting processes and they're looking for reasons not to write checks, right? They know how many ransomware attacks came in last year. They know what controls within your environment can combat ransomware. They know if you don't have these certain security controls in place, that they will not cover your ransom, your breach. They know that sometimes if they can sneak into the policy, hey, if it's a phishing attack and someone clicks on a link, that's a self-inflicted gunshot wound, and we're not going to carry uh cover that. Right. So they've gotten very smart about covering themselves in the underwriting process. So if you think of insurance as the receipt you get for having executed the other pillars, the right of boom and left of boom, that's a much better approach of thinking about the three, the three pillars, right? Because detection and response is where we see most offices fail, the right of boom. Um doing one annual pen test is not a cybersecurity strategy. It's the insurance and the insurance care and care and the insurance carriers are looking for more proactive prevention, right? So um it's again, there's three legs to the stool, left of boom, meaning all of your preventative work, all of your risk management projects, right of boom is your ability to rapidly detect, contain, and respond. And then, you know, the ribbon that wraps it all together is backing your whole cybersecurity program up against whatever your insurance policy says. Right. So if you're doing those three things, um you're putting yourself in a much, much better spot the the day that something does actually happen, and it will, I promise.

Mark Wickersham, Host 21:14

Let's talk a little bit about um third-party vendor risk. Obviously, family offices use a lot of different software products. Yeah. Um, and then that that introduces, I mean, I mean, it's a necessity, uh, but it also introduces vendor risk. How should family offices vet vendors and partners who touch their data? What are some best practices in that area?

Matt LaMura 21:39

Yeah, this is you know, this is always third party risk has always been an issue. Um, you know, there are every single company in the world relies on some third party or several third parties to do something. Um, and it's only gotten bigger as the years have gone on, right? More Software, more external uh outsource service providers, more of all of that. We're doing less, we're going to outsource more and focus on what we do best. And so the third party risk has grown along with that economical change within business organizations, right? So in most cases, working with those parties, it requires you as a business to provide them some type of data or some type of environment access to your environment, right? So at the end of the day, your security is tied to their security because of the access or the information that you are giving them in order for them to render their services. So really it it it the way that we've that we help our clients approach this is just like any other risk, right? I think that because it's cybersecurity and it's very foreign to most people, uh, a lot of organizations kind of almost throw their hands in the air because they don't know how to approach it or even start. And if you just take a step back, take a breath, and approach it like any other risk vector, it's it's just following that process, right? So vet them through a risk lens instead of just an operational one.

Mark Wickersham, Host 23:14

Yeah.

Matt LaMura 23:15

Um, reputable companies and platforms will have already met a lot of uh cybersecurity criteria and requirements and will absolutely gladly demonstrate that they have, right? They've done, they've jumped through many hoops to accomplish these things. They love to provide the reports that they have accomplished these certain requirements. And the companies that dance around your security questions are probably ones that you should be weary about. Um, you know, there are certain risks that are accepted in business, but when it comes to third-party risk, I would definitely, you know, apply the pressure and turn the screws a little bit harder, right? Because the cheaper tools will save you probably a couple thousand dollars a year, but they're also the ones with the smallest security team and fewer people looking. Um, so choose third parties, in our opinion, um, and platforms that you're comfortable defending to your board after a breach, not just before one, slotting it in as an operational efficiency, right? If if this stuff hits the fan and it's because of that software, you better be ready to protect that that that decision that you made.

Mark Wickersham, Host 24:24

I think it I think it makes sense. I think yeah, family options look at vendors beyond just the the functionality gains or or fit of the product, look at the the business health of the of the firm, and then also the the um the technical and the cybersecurity protections. I think SOC 2 type 2 is is is is not the be-all, but I think it is that kind of bottom floor that you should be looking for from your vendor. Your vendor should have kind of a trust center in which you can get all those documents and reports and they're third-party auditors. I verified uh that and have done it fairly recently. I think to your point that when you have vendors that are dancing around that a little bit or saying that the audit's coming or those type of things, uh, it it's it's worth a pause. Bringing a consultant in to help evaluate that particular component of the vendor can be helpful as well, given the the technicalities of it and uh how they're using encryption and and um AI and everything else, I think is really important. Um, I think the other thing to take a look at, and and there's been an emergence of family offices building their own apps now that they can with AI, the the DIY AI app. What are some of the security risks that are involved with with these particular applications?

Matt LaMura 25:51

Yeah, there's uh a lot of security risks with the market. Um, you know, it's it's it's a it's a growing problem. Um it's undeniable that AI is helping offices improve efficiency, right? It's it's there's no denying it. It's it's something that is going to change the world. I like to kind of use the phrase that we're living, we are right now living through the modern industrial revolution. Um, anything from AI systems replacing full companies to, you know, in my in my municipality here, we have water water companies replacing 200-year-old galvanized pipe, right? So we as an or as a world are going through a giant industrial revolution right now, and AI is driving a lot of it. Um, however, right, with as with any other software a company implements, just like third-party risks that we just talked about, right? Understanding where these AI tools are being used, creating governance policies for internal use so that everyone understands how to use them properly. And then setting guardrails for what information can actually be shared and stored will absolutely help offices maintain not only discretion, but compliance as well. Um, right. With any business, there are certain risks that are accepted. Um, but that absolutely must be defined so that users and you know stakeholders of the actual office know where the line is in the sand. And we're seeing over and over and over again a lot of shadow IT solutions and vibe-coded apps being used in live operations, right? So so for the people that don't know what shadow AI is, it's essentially your employees and your users leveraging AI platforms and tools that you haven't given them the green light to use. So what that, what the risk that comes with that is basically anything that's being dumped into those models is is, I can guarantee, is being used to train those models. Right. So if you aren't providing your energy your employees with acceptable platforms and acceptable use policies, they're gonna go do whatever they want uh to make their lives easier and to accomplish their jobs, and they may be throwing data out the window to accomplish that. Um, and in regards to the vibe coded apps, this again could change many, many operations, but vibe coded apps are riddled with vulnerabilities, right? So anything that's vibe coded should be reviewed by a security organization or a security expert before it's pushed into deployment, because that code that's written underneath the hood is going to have a lot of holes in it, which is going to allow access to the environment and then potentially, again, more data leakage out to the public. So defining what tools are acceptable, defining what kind of data you're okay being used in these tools is critical to the long-term success and the security of your organization. And again, anything that's vibe coded should should certainly be reviewed by a security organization. Um, if anyone gets a hold of that app, if it's facing the internet and someone gets a hold of it, that is a wide open front door into your network. Um, so again, there's no denying the operational efficiency that AI brings to the table, but the tools that are being used should follow the same procedure that you go through for any other third party, right? That we just talked about, if that makes sense.

Mark Wickersham, Host 29:35

Yeah, I I think um so many good points in here. And I do think, you know, even though AI is new and there's lots of hype around AI, still lots of the basics around technology still apply. Like AI doesn't defy gravity, right? So things around governance, things around you know, poor quality data in equals poor poor results out, right? The ability to if you're building your own applications, you're not gonna have the same degree and rigor that a software vendor that that does that has a one is an IT security framework that has to adhere to a QA process.

Matt LaMura 30:14

Yep.

Mark Wickersham, Host 30:14

Um, it's just a different process. And I I know people can complain when their vendors are slower and say, Oh, I I did this in the afternoon or I did this over a weekend. Well, there's a reason why there's an extra level of correction that that protects they're doing it the right way, protects these firms, right? And I really thought this DIY, you know, the build it yourself was was dead, and you see like these things are coming back, and you're like, Oh my god. Um, let's talk about agentic AI for a little bit. Uh so there's been some instances where uh AI is kind of jumped out of these sandboxes, it's broken into uh other firms or the firm itself, like unauthorized. I think there's also a governance component here around this, too. How do you put a governance framework around your AI agents? But talk to me about what are some best practices when it comes to AI agents, what are some of the threats that are are possible there and how family officers should be thinking about deploying AI agents?

Matt LaMura 31:21

Cybersecurity marketing departments and the media love to make cyber sound scary and complicated. And it can be, there's no doubt about it. But it it it's not as scary, it's not some massive Mount Everest that no one no one can climb, right? So if again, if you take a step back in regards to your question, deploying AI agents to do whatever task it is you need them to do is in some cases the same as hiring a new employee. So you want to have the same guardrails around your AI agents that you would if you hired a new employee. Right. So one of a good example within an enterprise environment or even within family offices is someone in the finance department should not have uh HR data or should not have access to the CEO's calendar, right? So that type of division of labor and guardrails and silos you put between your employees to make sure nobody is cross-pollinating into environments they shouldn't be. It goes the same with AI agents. So you can absolutely uh monitor those agents the same way that you monitor uh a full-time employee who runs investments for your firm or does tax strategy. Um, so again, having extremely strict guardrails around those AI agents is going to be your best bet, the same way you put guardrails around your full-time human employees. Um, you know, I think a lot of organizations give these AI models unfettered access, which is a complete recipe for disaster, as we've seen for the last two weeks of all of these AI models escaping and doing whatever they want. Now, this all ties back to the right of right of boom, as we already discussed, right? AI models and AI agents, as they get more sophisticated, you know, I'm not a, I'm not, I can't tell the future, but I gotta assume they will get smarter. They are gonna get smarter, and they will find ways to break in or break out or whatever it may be. And that right of boom, as we discussed, is going to be critical. Being able to detect and contain an AI agent that has broken out of the sandbox or broken into your network is going to be where the rubber meets the road. You're never gonna stop hackers from attacking you. You're never gonna stop AI attacks from attacking you. It's about being able to detect and contain as fast as you possibly can to stop the bleeding, right? You're never gonna be 100% impenetrable. If anyone ever promises that to you, you should run for the hills. They're lying. So it's all about building the resilience, putting the guardrails in place, and then most importantly, being able to detect if an AI agent is going off the rails at the drop of a hat and containing it so that it doesn't spread. Um, that's a non-technical way of explaining it. I don't know if some of the listeners would want to get into the nitty-gritties and the nuts and bolts of how that would be technically executed. Um, I think I'm happy to do that offline, but for today's you know, podcast, I think that's a good way to conceptualize it is just think of your AI agents as full-time employees and and deploy them, monitor them, and control their their roles like you would a human.

Mark Wickersham, Host 34:57

Yeah, I I think that that's uh that's a good um guideline or policy to follow there. Um what is the one thing family offices could do if they only could could pick one that that would improve their posture?

Matt LaMura 35:12

One's tricky. I would say I'm gonna give you two, um, just because it they they they're tied together. And it's it's the left and right of boom. Again, it all ties back to that. So the overwhelming majority of family offices that we speak to are cloud native, right? They do not have a physical on-prem server like sitting in an office somewhere. They are cloud native. They are 100% in Microsoft, 100% in Google with SaaS technology wrapped around it to kind of fill in the gaps and pick your favorite AI tools. Doing a cloud hardening assessment, right? Your infrastructure is your Google workspace or your M365. Assessing that environment, making sure that the gaps are filled and squeezing the most out of the investment you've already made, like we discussed, is going to make it extremely difficult for hackers to get in. They are by and large quite lazy people. So it's just move on to the next, right? Yeah, they just move on to the next target. The whole it's the whole idea of you don't have to be faster than the bear. So cloud hardening assessments, absolute must. You should be doing them at least once a year. That is where business email compromise lives. If you are doing these assessments, you are going to shrink the the statistical cap um the statistical possibility of you actually being compromised through a business email compromise. So cloud hardening, and then the second one would be like A uh 1B is 24-7 monitoring. If you do have it today, ask your provider what their average mean time to verdict is. And that is, for those of you who don't, you know aren't familiar, it's how quickly do they make a decision between seeing an alert and figuring out what to do with it. The average time of that window is 20 to 30 minutes in the industry. Sometimes it's three days. So sometimes it takes them three days to figure out what to do with an alert. So if you do have an MDR provider, ask them what their mean time to verdict is. If you don't have an MDR provider or 24-7 monitoring, you know, I would highly consider looking at that. Because if you are doing the cloud configuration reviews and you're doing the MDR, you are miles ahead of your peers, miles ahead of your peers.

Mark Wickersham, Host 37:41

Love it. Well, on that note, I think that's a great way to wrap it up, Matt. I appreciate you being on the Wealth Tech podcast and thanks for sharing all your insights.

Matt LaMura 37:50

Yeah, Mark, thank you again for having us today. It was a it was a real pleasure uh chatting with you, and hopefully we can collaborate on a fun project again soon.

Mark Wickersham, Host 37:58

Yeah, look forward to it. All right, good stuff.

Matt LaMura 38:00

Have a good one.