Launch of anthropics called Mythos, if you're in cybersecurity, was older news. And with the restricted project Glasswing consortium, it's fundamentally rewritten the rules of engagement in cyber.We're no longer talking about AI as a productivity tool. We're talking about AI as a specialized engine that recently uncovered twenty seven year old vulnerability in seconds. This quiet decades of legacy code are over. If a vulnerability exists, the machine will find it. And in 2026, the question isn't if you're exposed, but if you can remediate at the same speed the machine exploits. So, ladies, let's dive right in. So, Susan, let's start with you. With anthropic and OpenAI models that can find vulnerabilities, how do you balance fixing fast to fixing what matters most? How do you how would you recommend organizations develop capabilities to determine the vulnerability, the exposure, and the risk?

Why does asset management, continual testing, and threat modeling matter more than ever to prioritize what you patch first?

Well, thank you, Virginia, and good afternoon and good morning and maybe good evening to many people. So excellent question. You know, with Anthropic and OpenAI and those models, first principles continue to matter even more so than they ever did. So you gotta know what your assets are, what your attack surface is, you know, where are your vulnerabilities, and then where are your threats? How do you model them, and how do you respond and beyond? Because this isn't even detecting at machine speed. It's responding at machine speed.

Mhmm.

So asset management matters. So what you do with your traditional asset management tool, augmenting that with things from your cyber tools, knowing at a host space level, what is on every single device, knowing what's being delivered in your supplier code with the software bill of materials. You need all of that package together. You keep your traditional vulnerability scanning, but you add AI into it. And you make sure you understand, okay, how are these things being chained together to cause an attack, but how hard is that attack to do? Is it reachable? Is it is that threat actually a risk to you? Is it your crown jewels? Do you have compensating controls? So all of these things have to be combined together dynamically to constantly tell you where do you prioritize fast because there aren't enough engineers in the engineering teams to fix everything.

So things like where, where the vulnerability is, how you can get to it, how an attacker can get to it, what you can chain together, and the exploitability of it matters. And then also in addition to that, what matters even more than anything is how segmented and how zero trust architecture is your network to minimize risk and minimize the blast radius to your key key credentials and your key, crown jewels, if you will. And so in order to do that, it's gonna take a lot of work, data science, pulling all of this together, and really having continuous threat exposure management to know where you pivot first, but pivot on a done.

Thank you, Susan, for a very thorough answer. So over to you, Ayesha, with Project Glasswing focusing on finding vulnerabilities before attackers do, You know, give us your, perspective. Are we finally moving from a detect and respond industry to a preempt and patch industry? And how does a CSO like you like yourself budget for the shift?

Yes. So these are two different questions, and I'll try to doing it justice to, them together. So let's talk about the first one. Yes. The shift is real, and it's a messy shift right now. We are shifting from detect and respond to find it first, but I'll tell you this, and many CISOs can chime in here. We are paying for both right now. The categories were not very clean. So from that point of view, it's a really real budget constraint that we are figuring out. From my point of view, what I have seen internally work, number one, I am not framing it as a proactive security budget. I am naming it as cost of not knowing our weaknesses. So from that point of view, the ROI is we didn't become a headline.

So my conversation with my CFO is very simple. Detection, respond, all those categories were there. But now we have to continuously monitor these things. And even in that, I don't know what I don't know, so I need to build that capability internally as well. The number two thing that I've been doing is reallocate, don't add. So move dollars from alert triaging into continuous vulnerability monitoring and fixing. So that's where I am shifting things around. Same budget, but better leverage. And third thing that I am looking at is positioning AI driven intelligence, not only security. So, yes, we are still calling it security, but we are using, which I often now say, we are fighting AI with AI. So I'm using AI to discover and then remediate on top. So those are the things working for me internally. Shift is real. It's messy. Budget is a problem.

It's the framing of how am I going to first talk to the right people and then building capabilities internally.

Very good. Thank you. And, Christine, over on to you. When the threat environment is changing so rapidly, how are you leading your customers through the risk conversation that they may not be ready to have?

You know, it's a it's a good question. For, you know, the better part of twenty five years, that at least I well, seventeen, I've been here at Blackberry, but, you know, we've served the highest level of of government customers in the world. We serve, you know, seven of the g sevens, 17 of the g 20 NATO, you know, on and on. And so those customers tend to be extremely security conscious. And, you know, what I've learned, I guess, over the last twenty five years of my career in dealing with these sorts of our, of customer base is that the conversation they're they're not ready to have is really almost never about the threat because they're such high, you know, high risk, customers.

They always know about the threat, and they keep up on it, and they know all the intelligence. But it's more about their definition of readiness, and And I think we could probably all take some lessons from this. They're all in different parts of readiness conversations, and it would surprise you at, you know, some are really ready and some really are not ready but think they're ready. You know, because, you know, the threat speed has now outpaced government procurement, which as we most of us probably know is a very long cycle for them. So that gap is actually caused them to have to write rekind of look at how their actual structural process works. And readiness used to mean prevention. Right? That was all especially for our government customers. You know, it now means response velocity. You know, how fast can they respond?

And it isn't just about having the intelligence that tells them everything. And those require different investments from from this kind of customer perspective. And these organizations were really built, you know, around the I d the idea that that level of preparation and investment they made there was prevention. That, you know, they could spend all of this effort and comp this great intelligence, and they knew all these things before everybody else. And that was their level of, you know, preparedness. And that model is broken, and that's really what this sort of new era is ushering in for us. And, you know, because readiness now means response velocity, you know, how fast can you move when the inevitable happens? Not whether you stopped it for happening, but how fast can you move when it does happen.

So I, you know, I lead them in these conversations, recently, quite a few of them, by asking, you know, one question. Not are you prepared, but but how fast can you move when you're not prepared? Mhmm. And so that conversation evolves into these, you know, stop preparing for the last attack, start building muscle for the next one. And so, you know, they kinda have to move that ball forward and look at where those gates are happening. And that's those are really tough conversations when you have, you know, these big, really, securities kind of created some of the controls they have in place and, you know, especially in the procurement cycles of the vendors that they do business with, etcetera. So it's helping them really go, okay.

Well, we need to re all now reexamine that because all of those critical controls you put in place are actually slowing down the velocity that you need to have today. So I guess that would be my my sort of top thing I believe that I'm continually having conversations with about the question they're not ready to answer is about speed and velocity. And, again, in this in these areas of of, the world, it's it's very slow. Those are tough conversations.

It was it's one of those tough conversations that need to be had. So this is a good segue into the next topic we have around fighting at machine speed. So, Anja, as a dual headed CISO and CIO, the time to decide collapses because you aren't arguing across different silos. You're effectively arguing with yourself. What would you advise organizations that aren't unified? How do they prevent this government friction from becoming a fatal delay when an attack moves in seconds, not hours?

Yeah. I mean, first, I'll say it's the best thing ever happened to me. Thought it was unintentional. I joined the organization of CISO, and then through the evolution, they realized, well, it makes sense to have united resources, budgeting, and alignment in in a CIO sees a position. And I can be more grateful that I'm in this position. And one thing that I would say is, although in my position, there is constant context switching happening, but I'm in my own head. At least I don't have to negotiate with other people. So my mantra is now very simple, simple, and secure. So from a CIO head, my lens is very simple. Every system that we are building, how do we make sure they are simple and scalable?

So once we have that lens, we are also making sure security is baked in from day one. Mhmm. That is also goes into a question of building a culture of security. I think somebody asked a question somewhere earlier that what are c CIOs doing to, meet the speed with risk management. And what I say is it's a question of culture. In my organization, I always say is we are not doing only innovation. We are doing secure innovation, and that's where I have the privilege of seeing firsthand being a CIO and see. So how innovation will be supported with security in mind. But now with the CISO lens, the goal is and the incentive that I have brought into our organization is the security teams are incentivized on speed, and the engineering teams are incentivized on security.

So I flipped that for the organizations. That's the first thing. And now because the culture is there, people are more aligned. Now the question that you talked about, I have that that negotiation happening in my head. So my dual role gives me that flexibility, but most organization do not have that luxury. So what are the options? And here's what I would say, pre authorize decisions. As the window is collapsing, do not wait when you are in the middle of it, then you are going to find out who are the owners, where are the systems. So make sure define in advance what security can act on alone, what needs escalation, what needs the CEO done in peacetime not doing the attack. So the second thing that I'm doing is one decision owner, not a committee. When seconds count, a committee is a breach.

Name the person, give them authority, review the playbook afterward. And third, as we talked about AI and everything that we are doing now, I am looking at AI generated playbooks as well. How do we make sure that the the l one, l two things can also be automated, and my people are getting involved only when they need to because it's a banded question as well. So I'm looking at those three things, and I think other people who do not have the luxury of being both CIs and CISOs, they need to get more prepared.

Thank you. Very insightful, Aja. K. So, Susan, over onto you. How do you transition to fighting AI with AI and allowing defenders to code their own agents? I think something from Aja that resonates is the culture. Do you think culture affects it? You know, does the culture have influence on this on the skills needed within the organization? And does that mean roles change in security, entry level roles, and how culture plays a big part in all of that?

Yes and no. I would say because, I mean, culturally, the the security teams have to shift and be willing to adopt. Because if you don't adopt, you're not going to survive in what is going on. So what I see here and let's just take the security operations center as an example. What I see is a real opportunity to take developers, maybe even application developers, and teach them cyber, but then even take the cyber people and teach them, you know, application development. Because you, you know, you have to know both, and you can't, you can't automate something in cyber or playbook if you don't understand it. So I still think you're going to need to bring in junior talent, but the way you bring them in and what you train them on is gonna fundamentally shift and change.

You you need to fight AI with AI. I do think over time as an example with the SOC, the personnel are gonna be managers of agents. Mhmm. But they're gonna have to know what to automate in the guardrails because you can automate things, but then you could break business. So you have to make sure you know what the guardrails on, what you're gonna authorize an agent to do, and what you're not gonna authorize them to do. There ultimately needs to be a skills retooling. I think, ultimately, there are many places in cyber this could be used. Do you think about threat intelligence reports, security operations center, third party risk, even application security testing? How do you create agents, democratize those, give that to your application development team, and kinda shift some of the testing to them, allowing your application security people to kind of do the next evolution, the next evolution, and the same thing if you've got an internal red team or an external red team.

Now how you balance that with, you know, the foundational models and the cost of the tokens, etcetera, versus maybe something you're doing internally, that's gonna be have to be something we figure out because there is there is a cost element to this too.

Very insightful. Thank you, Susan. Christine, over onto you. Do you think that we are in that moment where fundamental rules of how fast attackers move actually change? Not evolve, but change. And if so, are we living in the in that moment now?

Yes. So I so I'll say this. I've actually seen, this change twice. I mean, over the last, you know, twenty eight years, I guess, I've been in security. I've seen it change two times. The first was when we went mobile with a mobile phone. Happened to be in the right place at the right time for that. But when the attack surface sort of walked off the perimeter and into people's pockets, you know, we as security professionals really had to just get out of the network, and it was a very very kind of scary change in time. And for those of you who have been around, as long as that maybe you remember, lots of change in the industry and lots of change in the ways we did security, and that took a little while to sort of evolve. But the second time is definitely now. And the this change versus the last one is a lot more fundamental, because it's not just about the speed that it's happening. But, you know, for most of my career, really, defenders already you know, they always have the structural advantage. Right? We owned the infrastructure.

Attackers had to work to get in, and, you know, time was kind of on our side and definitely favored us. And, you know, AI, as we've discussed, has reversed that. The attacker now has automation scale, personalization, you know, and they don't answer to a compliance department, which, you know, we get. But they don't operate on human decisions and human timelines either now, and that is the big fundamental shift, and and we do. And so AI didn't make attacks faster. It kind of made human speed irrelevant. We're kind of irrelevant now. And so there are a few things that I, you know, as I go and speak to, you know, other governments, companies, or whatever on, really, what are the fundamental things to be doing right now and also to echo, ladies, what you've already said because that was both both of you spot on.

But I think the one other thing that I'll add or a couple of things I'll add to the list is is first, map your data like an adversary would. Don't just make a threat model and have it be sitting click you know, collecting dust, but really think about the new attack surface in AI and what they're after and what they're capable of. Take that inventory and map it like an attacker would using AI. That's different. Right? So, and then I love I'm gonna another thing I already heard, but I'll say it again. Audit your decision rights. Where's the bottlenecks? Find the bottlenecks now. Run through all of these different attack scenarios. I mean, make a playbook for everyone. Mhmm. You know, you should have 20 playbooks. You shouldn't have one because, you know, practice. Do it again. And then where are the bottlenecks? Address those now because, again, that's building that muscle memory.

Stop fighting the old stuff, fight the new stuff. And then, if if AI isn't on your leadership agenda, it should be on everybody's leadership agenda. In every leadership meeting that you have, you should be talking about it in some you know, shape or form. Mhmm. Assuming it probably is already, but if it's not, now is the time. And the last thing I'll leave you with to answer this question, this is probably and we've done a lot at Blackberry, we've done a ton of supply chain research. We released a report a few years ago that just kinda blew the water out of supply chain and how we think about vulnerabilities. But I'll add this now because we talked about it three, four, five years ago, but it's even more important with AI, and that is your vendors are attack surface.

And I don't I think that is one probably area that we're not talking enough about. Every vendor you're attached to is attack surface for you. And if you're not holding your vendors accountable, and I love you know, Susan, I think you mentioned SBOM. I love that. We have to have bills of materials of our vendors' things, and we have to hold them contractually responsible to make sure that we have some sort of, you know, some sort of playbook on our side to what happens when the bump is in the night, how are our vendor how are we holding our vendors accountable.

And that is something I just I feel like we're we're gonna find out really fast. You know, SolarWinds wasn't wasn't the call. Call to action on that part. I don't know what was, but I think that kind of stuff is gonna get automated really quick. And if the attacker is a target they wanna go get, they're just gonna go through a supplier. It's not just you. Right? There's a weak supplier in the supply chain. They'll just target that. And if you don't think that's easy, remember how many, you know, how many vendors on their website have right on the front page of their website who their customers are. It's really easy for you know, to build a machine to go mine that in AI. Okay. Go tell me who all of the vendors are that support this thing.

That can be done in, like, you know, I could build that. So I just just really think about that as, you you know, your attack surface goes all the way down, you know, to the bottom and and really start thinking about if that's not a leadership conversation you're having, start having that one.

That's thank you, Christine. That's a good segue to the topic the our next topic around leadership and governance. So, Susan, you hinted about this already. When we talk about the AI talent gap and if Mithos can do the work of a thousand junior security researchers, should we be hiring security analysts or AI orchestrators? You framed it in terms of a SOC manager managing agents. Mhmm. Tell us about how the talent that we need within our SOCs are evolving.

I think it's it's a it's in a couple different ways. We're facing a a situation now. You know, many of us used to say if. I think you can take that word off the table. It's when. And the critical thing now is your speed. And, you know, I loved what Asia said earlier about being a CIO and a CISO and being able to make those decisions. There's another key component of this too. Depending upon how your company is structured, you may have kind of an operational resilience team.

Mhmm.

So how do you know what you need to recover first? Because maybe you are targeted and you can't fix everything, but you can fix the certain things that are critical to the business. But having that's really important. And that's where I think the cyber team, if it's not, you know, already part of an operational resiliency team, it needs to be really tied at the hip relative to what's going on here because it's when. It's not if at this where we are. On the talent gap, you know, we all have seen there's not enough cyber talent across the globe. So, you know, we I I wouldn't just kind of say, hey. We don't wanna bring in junior people. I think we bring those junior people in in a different way. Maybe they're learning how to code agents.

And as part of that, they're kind of doing a little bit of a blue team, red team, purple team thing that they're they're maybe they're learning from the purple team and that and and saying, okay. Here's the scenario and a response. How do you improve that? How do you shave off a minute? How do you shave off a second? So they can think through the process and then ultimately figure out how to make that an agent or partner with someone who knows how to do that, and then you're kind of teaching each other. And, again, I think application teams are great places to maybe pull some of that that talent to train them up in cyber. Again, we don't have enough people who think in that kind of cyber realm. I always say that our jobs are we're paid to be paranoid. And, you know, there's just not enough people in the globe around that. And it's it's how do we blend these skills together? How do we learn from each other?

Whether it's cyber, application, infrastructure, you know, recovery and operational resiliency. It's it's even more important on the speed and how you prioritize what goes first. I also love the comment that was made on third party risk and what, Ayesha said earlier about maybe there's certain things in your program you don't do anymore because that risk is not as high as other risks that exist today, and it's always a balance and a budget conversation that you're having.

But there there may be some opportunities for automation and these other things that give you lift to shift other people into other roles, that that can learn and wanna curate their talents. I think it's an incredible time for all cyber people to learn something new and different and be able to take advantage of it.

Very good insights, Susan. Thank you. And, Ayesha, I'm gonna tie some of the questions from the comments to some of our prompts here. But wearing both a CIO and CISO hat, tell us how you're fighting AI with AI. How are you scaling your programs that keep pace? Or, one of the questions in the comments is how do leaders balance rapid AI adoption with responsible security oversight?

Yeah. Great questions. I don't have to set the context here. Number one, I'm the first one of the company where when we started the whole AI conversation, I pretty much hold all my exact team responsible and accountable saying, let's talk about what is going to be our AI ambition. Let's get clear on that first. Because, if we are going to do AI for the sake of AI, then it's also destruction. So from AI ambition point of view, we ask ourselves first, are we talking about AI in our product? Are we talking about AI in productivity pursuing internally? And the answer was we wanna be AI first, AI everywhere. Okay? So who owns it internally? So then between my c f CPO and me as a CIO, we divided our responsibilities, and we said our CPO is going to ensure that a AI is getting built in in our product.

But as a CIO, it was my responsibility to ensure tools are available to my builders. Now this is a new term. Nobody is we don't wanna call anyone specialist and analyst anymore. We wanna call everyone a builder. So from a CIO point of view, my first job was to make sure that I create a seamless experience of building for for the builders, provide all the tools to them. So there was a long list of policy creation, approved list of AI vendors, monitoring, AI governance. And I don't know for others, but in my organization, first time in the history, I created enterprise AI pillar, which is now building the infrastructure. Imagine this up until this point in building work or engineering work was mostly happening within r and d. That is no more the reality. People are building in product.

People are building in security. People are building in HR and legal and finance. So I have to create an environment outside of r and d to enable and accelerate AI usage. So building that enterprise AI then require the governance and observability on top. What are we building? How are we building? And then the conversation goes about cost. So this was on the CIO side of things. My CISO had was none of my playbook would work anymore. Literally, I had this feeling few months ago saying, whatever I have done so I've been with my company for seven years. And every single program that I have built, I cannot match human speed to fight AI. Mhmm. So not that I say we need to fight AI with AI.

So right now, just to give you an example. So I have four different pillars, product security, trust and assurance, security operations, and IT enablement. Every single pillar is the program that we had. We are changing our operating model, leveraging AI. AI is a tool. AI is not a strategy, but we need to have the clarity of how we're gonna leverage the tools to implement on our strategy. Now just to give you one example, in r and d, software development life cycle, my product security team used to get involved. We used to do threat modeling, source code analysis, penetration, dynamic analysis, and all sort of other things. I had to literally look at if my developers are writing 5,000 line of course every day.

How can my security engineer get to a point where threat modeling is automated, where penetration testing is automated. And we are not sitting with low level vulnerabilities triaging and remediating. We have agents now reviewing those vulnerabilities, triaging, remediating, looping people in the loop, and my people are now using their judgment for high level things. So that's how I'm deploying AI agents in all my programs.

Very good. Thank you for that insight. I show a really good perspective to see that CIO sees some flip that you're providing us here. Okay. And over onto you, Christine. So, again, I'm gonna tie this to one of the questions we've got here in the comments. For leaders not in security, maybe they're in finance, HRs, operations, what is the one thing about this AI driven shift in the threat landscape that they need to understand that they probably don't yet? Or what's the biggest blind spot you can think that organizations currently have around AI and security?

Oh, good question. I think so we have a lot of these conversations too, because security tends to fall on the security people. Right? Of course, it does because it should. Right? But I think the one thing that AI, especially with both Mythos and g p t five dot four, we need to remember is that we're not protecting systems anymore. We're protecting intelligence because everything needs to be considered intelligence. You know, most of my non security executive sort of friends that, you know, I talk to or, you know, hanging around and we're talking about AI, you know, they're talking about the still that the threat is the system going down and, you know, all of these other things. But the real threat is the data that you all have. Everybody has data. Everybody makes data. Everybody collects data. Everybody operates in data all day.

Customer records, financial models, HR files, all of those things aren't just data anymore, but that's really what AI is going to use to weaponize that speed and scale that makes that traditional breach response what you would use if that data was exfiltrated somehow. You know, that's, like, slow motion now. You know? So that is every leader's problem. It's not just the CISO or the CISO CIO. It isn't just their problem anymore. AI driven attacks exploits all of those decisions that are made with that data. In finance, again, operations, HR, all of those vendors you've onboarded that we talked about, the access you've granted, the systems approved without a security lens, you know, you're not protecting that infrastructure. It is about that intelligence. So I think the the the just to echo a couple of things I know we've already said, but this is where it really is important to the third party supply chain that you have is now that can be that primary entry point.

So those are driven by business decisions, not necessarily security failures. And then, you know, the other thing we have to remember, and this is a two pronged approach, is that regulatory frameworks so any of those frameworks that are happening, we're about two year three years behind. Even and I do a lot of work on this globally with different areas of the world. Even the most mature there's 82, the last time I checked, security frameworks being developed right now that have to do with AI. None of them are in a state of, you know, where they're gonna be rolled out and shipped tomorrow. So we're lagging about two to three years before any kind of regulation will actually hit the pocketbook of vendors, which is where we really need when it when money talks, Ford listens.

Right? So where you'll be forced to do things to protect your your customers, so the vendor supply chain where you're forced to put security controls in, we are far from that. So it is on the onus is, again, onto you. So some quick, I guess, suggestions that that are, I guess, some of the more top of mind things that I think about for my non security department friends is, number one, just remember, stop delegating security to your security team because everybody needs to now be a security person.

That is the reality. Right? The reality is you have to, you know, identify every vendor contract, every system approval, every access decision that your team owns, and recognize those are security decisions, not just operational ones that they do open or have the potential to open attack service. And then back to the data conversation around, you know, identifying data and all of the points you have and not just creating threat models, follow on to that. Inventory your data like it's already been stolen. So, really, you're in HR. What kind of data you have? Pretend it's already been stolen. Right? And then ask yourself, what would an adversary do with it if they had if AI could process it and weaponize it tonight? What would happen? Because then you can kinda start thinking about the future things you need to think about.

And then another thing we just talked about that is genius is shadow IT is a huge problem here because if you don't think if you you know, I ran into I know a couple of people who've done this in big companies. Well, we have a policy against AI. Fabulous. Not gonna work. Right? We all know that if you have a policy against AI, people are gonna go around it and they're gonna use it anyway because everybody is is using it. Right? So that is a problem because as we also, I know, just talked about, when you have someone on the HR team that throws up cloud in a browser or cursor and says, oh, I need to analyze all these 18 reports and I don't have time and out pops this beautiful report. And they've realized that, oh my gosh. That's amazing. Right? What systems on the back end did that thing just just access? So the shadow IT part of it, I I'm sure for the the CIO nightmare is just I know, you know, it's it's a tough blind spot.

But, you know, shoving that under the rug is not the answer. It is happening. Pressure test lastly, I'll leave you with this one thing. Pressure test your compliance assumptions. If you run audits like you're trying to pass an audit, you will fail the AI criminal audit, which should be right? So don't just go through the motions when you're trying to, you know, run a compliance check. That is not enough anymore. Again, used to be great, but now it's not. So, really, you gotta uplevel just all of your understanding of the everybody's a data custodian, and that's really really, everybody should be taking that seriously no matter what department you're in. You're creating a tax surface. So start model it like it's already been stolen, and that's a great place to start.

Thank you, Christine. Very, very insightful. Okay. So as we close, and I'm gonna leave us, all the women in the panel here, one final, remark. If you're leading a team or an organization through this technology shift, what's the leadership lesson, in this AI security moment that applies beyond cybersecurity? Or tell us a scenario that you're preparing for today that wasn't in your radar twelve months ago. Ayesha, you hinted about your none of your playbooks work anymore. So what what what's that the one thing you wanna leave everyone with? Everyone's got one minute.

I'll just say maybe one thing here. What I from a leadership mandate point of view, I tell everyone the same thing. Clarity first, focus second, execution third. If you are not clear about what we are doing, you're wasting time for everyone. So that's one. Now what was not on my to do for the last twelve months going back to the playbook piece, the biggest thing was enterprise AI platform was not a thing. RND had a platform. As a CIO, my job was to, you know, enable the company and from a CISO, secure the company. Now I'm also responsible for helping rest of the builders build. So that's a new mandate on my plate. And now, what Christine said, not only that I have to build this infrastructure and platform, I am constantly thinking about shadow IT and shadow AI, SaaS portfolio management, AI portfolio management.

So that's why I said the reality is it's very messy right now, and we are just navigating and there's no certainty. So figuring things out.

So I would say a couple things. One, change management and leadership through that matters more than ever. And what I mean by that is you have to challenge your teams to move their cheese. What you did yesterday is going to continue, to go forward. And your partnerships that you built with the rest of your IT teams, your compliance, they matter more than ever. So how as transformation, you lead that change and bring people together for, like, AI a thons. I have this problem. How do you solve it? You solve it together, and people learn from those. And I think the last thing too is identity matters. Identity matters. Identity matters. And if your identity is broken, this is gonna make it more broken.

Great answers, ladies. I think I will add, I think every woman in this room is probably navigating some sort of technology shift, right now. And, this moment is asking all of us kind of the same question. Have you designed an organization that can move when it matters? So speed of decision is the new currency. Leaders, you know, in my opinion anyway, leaders who win won't be the ones that reacted necessarily the fastest. They'll be the ones who architected for speed before the crisis arrived. Because resilience is not a recovery plan, it's an architectural decision that you make before the crisis. So the bottom line, leaders who will win have built organizations designed to act, not just monitor and report anymore like we used to.

And with that, that concludes this panel. Thank you very much,