Connected Podcast Episode 205: Cybersecurity in the Age of AI
Hi, I'm Greg Uland with Reynolds and Reynolds and this is Connected. Today's an in-person episode. I'm really excited I get to sit down with Nikhil Kalani. Uh I've known Nikhil for quite a
0:14
long time. He's our chief information security officer here at Reynolds. He also serves as our vice president of information security. Um and on top of that, Nikhil is responsible for Proton
0:22
Dealership IT and Cybersecurity. So, uh lots of experience uh in the room with me today. And
0:27
Nikhil, thanks so much for sitting down and talking. Thank you for having me, Greg. Yep, absolutely. So, Nikhil, just recently, uh, you spoke at the Ohio Secretary of State
0:36
Cyber Security Conference, and there were a lot of topics that came up and I thought it'd be a good idea for us to sit down and just share some of the most recent things that you're seeing in the
0:45
cyber security space, uh, specifically in the dealership world, but but also in general. Um, and I thought maybe we could start with the impact that artificial intelligence is having. I mean,
0:55
I'm in a lot of conversations around artificial intelligence and I swear every time I get asked what what should we look out for and and my default is always I mean a big big thing to
1:03
look out for is is how AI is being used in cyber security. Um so I thought maybe we could start there and you should you could share um kind of you know anything that's top of mind for you.
1:12
Sure. You know AI is being used by both the good guys and the bad guys, right? It's just an arms race of of who's going to win that one. Uh on the cyber security front, the primary topic I'd be
The Evolution of Deepfakes.
1:24
concerned about if I were a dealer is about fraud, right? Financial fraud, funds transfer fraud.
1:30
That's not a new kind of fraud. It's been around for a long time. But AI is making it easier, faster, cheaper for the bad guys. Their ability to impersonate the good guys is so much better now
1:41
than it was just a short while ago. So you might recall, Greg, in 2024 there was a $25 million loss
1:48
by a company in Hong Kong. This was January 2024. And the way that that scam worked was
1:54
the finance employee was on a video call with the CFO, couple of other team members.
1:59
It all looked it all looked really good and the finance employee had the right instinct, but seeing the team on a live call, they went through with the transfer requested. That was more
2:09
than two years ago. Yeah. Right. Since then, the ability to deep fake has gotten so much better.
2:17
It's no longer a headline. Yeah, that type of fraud is now a category, not a headline. Yeah.
2:22
Yeah. And I I want to make a real um specific point on that because you dove right into fraud and it's interesting because a lot of times people think of cyber security,
FBI Fraud Statistics and AI Growth.
2:31
right? And they think of hardware and they think of technology and and they think about
2:37
networks and infrastructures and what you described was quite literally an impersonation,
2:43
right? and and fraud as a category is, you know, maybe maybe give me your perspective, but um
2:50
it's it's big business for criminals. I mean, that that portion it's it's not about, you know, brute
2:55
force attacking trying to get into a network. It's it's massive business because it's fast. It's relatively easy and cheap for them to do. So, the FBI recently reported uh about 21 billion in
3:08
fraud on Americans using cyber techniques. Mhm. Um, specifically for the first time now in their
3:15
April report, they reported AI based fraud as about $900 million. Wow. And that's just a part
3:23
of the overall cyber crime uh pool of numbers that they have. So it is significant. It's ramping up
3:30
and we should just expect more of it. Yeah. Yeah. So maybe if you don't mind then give some other
Real World Fraud Stories.
3:36
examples, right? Some stories about how things have happened. So, I'll share one. A good friend of mine um he he has a law firm. He's an attorney and he had a client that he was representing and
3:48
um long story short, basically he got he got an email and that email basically updated um the bank account information that that a funds transfer was supposed to go to.
3:58
He authorized it and $800,000 was was gone. Um and you know, luckily had cyber insurance and and law
4:05
enforcement got involved and and everything worked out okay. But boy, that's a that's a stressful I mean, not day, that was a stressful month and a half, right? Trying to work through all that. Um,
4:15
and and those little things and those little you're in a hurry and you click yes,
4:21
um, or authorize or send and then everything changes, right, in one click. So, um,
4:27
that was just a tangible example that, you know, somebody close to me experienced and just talking to him about it, man, it was it was terrifying. And that's a big number, 800,000. Right now,
4:36
unfortunately, it's all too common. The average for these losses is $25,000 per incident. Right.
4:42
Right. $25,000 in one email gone like that. Right. So, uh faking an invoice is very common. Mhm. Um
Real-Time Video and Voice Impersonation.
4:50
the video part of it now, like I said, very common for approvals. There's always uh the the common
4:56
theme in these is a sense of urgency. Y often it's keep it confidential, right? We can't talk about
5:02
this. You may recall the Ferrari uh story where there was uh an executive who received a call from
5:08
the CEO. Mhm. And they were asked to make this confidential funds transfer. In that situation,
5:15
the executive was thinking on their feet. And although the voice sounded perfect, the inflection was perfect, something about it didn't quite feel just right. So the executive
5:24
asked the CEO, "Hey, you lent me this book to read last week. What's the name of the book?"
5:31
So those there's an interesting way very low tech way sure of defeating high-tech crime right now
5:39
I said high-tech crime but it's just really easily accessible so there's open- source projects freely
5:45
downloadable will run on a gaming PC for realtime video conversion so you can be on a team's call
5:52
uh and in about 50 milliseconds which people will not perceive on a on a video call uh
5:59
the attacker's face and voice are transformed. So they can literally be having an interaction with
6:05
uh a dealership team member, but all of that's getting transformed in real time and getting
6:11
published as um you whoever they impersonating. And in a small little team's video or zoom video,
6:19
you probably won't pick it up. So So relying on the human being to detect is just not a good
6:26
strategy. Sure. We've got to have some process related strategies. Uh the unexpected question,
6:33
right? The secret question, secret passphrase, those kinds of things. Uh spycraft. Uh
6:39
that is very helpful. So how do you how do you I guess what's the most effective way to communicate
Building a Culture of Verification.
6:45
that to your whether it's your entire team or uh you know kind of your executive level inner
6:50
circle team that that may be exposed to this type of stuff? I mean is this something that you just discuss on an ongoing basis and say hey this is something that we're going to implement you know
6:59
in the store uh implement as part of our business when we're if we're doing talking about any sort
7:05
of financial transaction um we're going to have you know we're going to implement a process where
7:10
we have a something like you know whether it's a password or whatever it is like is it that simple
7:17
I think a major part of this needs to be the communication of the culture where
7:23
going slowly, going carefully, verifying is rewarded, not punished for being slower.
7:29
Right? Everybody's busy. Mhm. But we've got to have the people who handle the money take the time
7:35
that's needed to get this right. Mhm. [clears throat] So, as part of that communication, not just the teaching, but truly the leaders establishing the culture of it's okay to verify,
7:45
it's okay to challenge me, right? Challenge the CEO, challenge the CFO. Uh so that it builds the
7:52
verification in with confidence. Yeah. No, I mean that makes a lot of sense. Um okay, so
7:58
you talked about video, you gave the story about voice. Um I think we've all probably heard the
8:04
stories. I just shared one about email, right? And and not even needing to use voice or or video. Um
8:10
so there's a lot of ways that fraud can can happen and it's all kind of financially driven. Yes. Um,
Adversary in the Middle (AiTM) Explained.
8:16
so let let's also talk, NIL, if you don't mind, about some of these other types of attacks that
8:24
are becoming more and more common. Um, I've heard you talk about adversary in the middle. When I first heard about it, it didn't make complete sense in my head, but hearing you describe it,
8:32
it's it's definitely made sense now. So, I guess talk about that for anybody that hasn't heard that term. Um, it it's also a pretty powerful one. Sure. This is extremely common actually.
8:41
Unfortunately, it's almost normal at this point, right? we expect it. So the way the scam works,
8:48
it there's different degrees of sophistication. So I'll play one out where um employee gets a message
8:56
warranting, you know, asking for some action to be taken. It might be funds transfer or probably initially more innocuous because the attacker simply wants access to their email.
9:05
So hey, log to this to see this attachment. Now
9:13
depending on how detailed the attackers wants to get, how detailed the employees in their training,
9:18
they might have you can call me to verify, right? I'll call you on your phone, verify, but the voice is faked in the verification. I'm the IT guy, so and so they got the name of LinkedIn.
9:28
So they're able to impersonate the employee very well and maybe trick the associate, the employee, into thinking they're working with the real IT department of a company. That's one
9:37
way to do this. But typically um to see this attachment log into Microsoft uh office. Sure.
9:44
When you're logging in, you may not be logging to the actual Microsoft Office. You've got a fake page. You give it your credentials. The fake page transfers it to the actual Microsoft Office.
9:56
Microsoft Office might have an MFA challenge back. All they do is replay that challenge back to the
10:02
uh the employee. Mhm. And the employee enters the MFA value. it goes into the middle that
10:08
right a proxy website uh and it's replayed back to Microsoft they accept they issue what is called as
10:15
a token this is where um it's a little technical I'll simplify to just a token it's an entry ticket
10:21
into the Microsoft office world they give it to the the the man-in-the-middle website
10:27
or the proxy website so they have a copy they'll pass it on to the request the original employee
10:34
the employee was none the wiser they actually got logged to Microsoft Office not realizing all that
10:39
time there was somebody in the middle taking all of this and even MFA could not save them in this situation. Now there are types of MFA that could save them. MFA is not created equal,
Phishing Resistant MFA and Hardware Keys.
10:51
right? There's different kinds of MFA and one in particular I'll talk about is called fishing resistant MFA. Okay, there's several kinds of fishing resistant MFA but the concept is the same.
11:03
It does not rely on just a code or an SMS text. It's it relies on something on the device that is
11:10
registered with the website we're trying to log into. So whether it's a bank or it's Microsoft Office, you might require the exact laptop or the PC that you first use to register with them
11:22
because all the codes are stored on that machine. Okay, in effect the machine is a factor in the
11:28
multiffactor authentication. It can be mobile. So you can have uh a little USB key that you put on
11:34
your key ring so it can go with you from computer to computer. Uh but still it's a piece of hardware
11:40
that you must have and all the codes are on that hardware to conduct login.
11:46
Right? So it cannot be stolen through this proxy or attacker in the middle uh tool.
11:53
So that's a very good way. It's worth the investment. It's in some cases free. for example, Windows Hello for Business or just even a pass key in general, relying on a pin for you to unlock it.
12:04
Those kinds of things, they live on the hardware. But if you want something more mobile, $50 UB key
12:12
that gets you there. Interesting. No, that's that I mean, [sighs] it's always changing, right? So,
12:18
there's always always something new. Um, no, that's a very very interesting um kind of type of
12:24
attack and one to be on the lookout for. Um, all right. So, I also want to talk with you about um,
Decreasing Dwell Times in Attacks.
12:32
you know, those types of attacks that still happen uh, pretty regularly where somebody's
12:38
gaining access to the network, right? And they're they're going to either try to steal data or do do something harmful to the business. Um, still still very common. So, let's let's talk a little
12:49
bit about those two. You know, you talked about fraud a lot, which I think is something that maybe doesn't get talked about enough to be honest with you. Um, and so then when we we go to maybe what a
12:58
lot of people consider traditional cyber security measures. Um, you know, what are we what are we seeing there? What what are you and your team seeing there uh in you know, in today's world?
13:07
So in the context of a traditional cyber attack, ransomware type of attack,
13:13
what we are seeing is that the speed of the attack is accelerating massively. Okay, once upon a time
13:20
it used to be 30 days of what is called as dwell time. Uh the time it takes for the attacker to
13:26
have some initial access to your network and then actually implement their objectives.
13:33
30 days used to be a number a couple of years ago. Then it went to 3 weeks, two weeks, one week.
13:41
One week might be luxurious. Now, sure they have I read about some attacks that are executed within
13:46
hours. Sometimes if the attack is small and extremely targeted, it can be minutes, right?
13:54
Fully automated AIdriven minutes. But I'll say um a good number to design for if you're managing a
14:01
large network. Mhm. At least plan for the attack being executed within a few hours from start to
14:07
finish. Right. At that point, when you're talking about hours, and those hours might begin at 3:00 a.m. on a Saturday. Yeah. Right. Human speed is not reliable for detection and remediation. You've
14:19
got to have the right kinds of tools that can intervene in seconds because giving an attacker
14:26
five minutes of access today might be way too much, right? Once upon a time 5 minutes was
14:32
uh you know not a big number in this context. Today it is a big number. So it sounds like speed is the the really the most important factor. So
Robot Wars - Automated Defense vs Attacks.
14:42
and and I want to also think about this. I've been thinking about it a decent amount lately and we've talked about it a little bit before. Um you know this concept of of kind of proactive security,
14:52
right? Um hardening your your cyber security position and reactive defense, right? So,
14:57
as something's happening, how do you defend against it? How do you do you make it stop? Um,
15:03
and let's let's continue down this defense path, right? This reactive path. Um,
15:08
knowing that 5 minutes might be too long. What do you that's that's a scary that's a scary thought,
15:14
especially if it is at 3:00 a.m. on a Saturday. Yes. So, this becomes really about robot wars, right? The attackers are using automation to conduct the attack. The only viable defense
15:25
is automated defense at that speed. Sure. Right. So it comes down to the engineering of the tools.
15:32
Your security architecture has to have the sophisticated mechanisms built into it
15:37
to see the signals in real time. Understand what's happening and react all within seconds
15:44
not minutes ideally. So it's an engineering function and it's raised the bar right. So,
15:51
so a cyber team that doesn't have that level of sophistication is going to struggle against the modern attacks. I I want to point something out. We talk a lot about network attacks, but attacks
Why Identity is the New Perimeter.
16:04
can be categorized in a few different ways. Uh endpoint or the PC, the laptop, uh the very machine being attacked, that's a piece of it.
16:14
Um identity, the accounts being used is a huge piece of it. Yeah. And we still, at least when I'm
16:21
working with dealers, we don't often talk about identity as much. The focus is still network,
16:27
but I want to get it more granular. Network is maybe the big container being attacked. But
16:33
within a network, it's endpoints, its identity, uh it's email accounts, those finer grains,
16:40
those have to be controlled very tightly. Sure. So defense ends up focusing on those finer levels.
16:46
Well, and when you think about accounts, you know, just to put a, you know, a fine point on it, it it
16:51
can be as simple as a a Gmail address, right? That logs you into all of your Google um ecosystem,
16:57
u if you're using, you know, the G Suite to run your business, uh, and somebody gets a login,
17:03
everything's there, right? So, that identity, it could be a Gmail address. Um, that identity could be your login. You use the Microsoft uh office example earlier, right? If you're using Microsoft
17:11
Office to run a large portion of your business um lo somebody gets that login information
17:17
uh they can go across all these different tools. So um you know when you talk about identity
17:23
just to simplify it that's what we're talking about is yes correct as a username and password. It is impersonation of the human being using their login credentials right and and nowadays
Choosing the Right Password Manager.
17:33
the credential is used quite broadly like you said across the office suite potentially and if the uh
17:40
if the individual is reusing passwords that makes it so much worse when they broaden their
17:45
attack surface versus having tightly controlled passwords. So one of the key controls is a password manager, right? Um at this point any of us might have over 100 passwords, I think, right?
17:59
How can you possibly uh in your brain store unique passwords? You really cannot. Sure.
18:05
So password manager should be a required piece of uh control given to our employees
18:12
and they don't cost very much and $3 gets you pretty nice password manager. Yeah. So talk about the difference between password manager in the context that you're using
18:20
versus I have all my passwords saved in my iPhone or I have all my passwords saved in Google Chrome.
18:26
If the budget is $0, the browser password manager is better than not having one. Right? And and you
18:32
can attack the system, you can attack the browser. It is possible to steal those and it's it's in the
18:38
workflow. Whereas a dedicated password manager being just a separate piece has a different
18:44
attack um surface is a little more complex to attack versus just built into the browser. Like
18:50
we talk about patching our browsers all the time, right? Browsers have vulnerabilities. Sure. Google Chrome, Firefox, uh Edge are constantly requiring updates. So tool on the side that's purpose-built,
19:03
I would choose that. But in but if we aren't going to go that route, the browser and its password
19:09
manager is still better than simply not having one. Sure. Okay. No, and that um that's good.
19:15
And the way these work, right, it's a separate basically application that lives on the PC. You have a master password or passphrase or you know something complex to unlock the password manager
19:26
and then all of your passwords for every login are stored inside the password manager. Okay, good.
19:31
Um, you know, another another thing I wanted to talk about with you, NIL, um, is, so going back to
Machine Speed Vulnerability Research.
19:37
that idea of kind of reactive versus proactive and and we started talking about the proactive stuff, password managers, um, but but also, you know, patching software. You mentioned the browser.
19:49
Um, but all software needs updates, right? I mean, we get Microsoft Office updates weekly, right? And
19:56
and you need to restart things and and updates are pushed out, security updates are pushed out. Um, and you think about this world of AI and um, what does that mean for the IT professionals
20:07
in the store? Because most most dealerships, certainly dealership groups have an IT person or an IT team that are managing all the PCs in the store, managing all the software. So,
20:16
um, you know, what is what does this all mean in in an AI speed related world?
20:22
So what AI is being used for nowadays is to find vulnerabilities in software at a speed
20:28
human beings simply have not seen before. Mhm. Um there's newer models some of which have not been
20:34
released for safety reasons because they're just so good at at building attack software.
20:41
Uh but uh at some point those will be very easily accessible even even not using the
20:48
very best models which are still currently being withheld. Mhm. Second best, third best,
20:53
still good enough at finding vulnerabilities at a speed we have never found before.
20:58
So the ability for bad guys and good guys to find problems with software is now at
21:04
amazing machine speeds. That's going to force patching to be at a speed that we haven't had to do before. It was fine once upon a time to patch in say 30 days. I'm talking about a little
21:16
while ago. Sure. That's no longer realistic. machines are finding the issues too fast.
21:22
So we should expect an increase in the amount of patching we'll have to do and an increase in how fast we'll have to get the patches deployed. Yeah. So there will be a strain on IT teams for sure.
21:32
And what does that mean? So and this might be a silly question. Tell me if it is. Um but you know there's those days when um I'll get the little update that says you need to restart all
The Future of Patching Frequencies.
21:42
your Microsoft Office applications and I'm like no I'm in the middle of 14 things and I can't do that right now and so I ignore it. I ignore it. Um, or there's those mornings when, you know, I I
21:51
leave my computer on overnight and I got a couple things open and I go to to log in in the morning and it's shut down overnight and I'm like, ah, cuz it had a Windows update, right? Um, you know,
22:02
are there implications to how frequent those types of things will happen, too? I mean, is it is it to the point where it's going to interrupt workflows in in the business? So, as it stands today,
22:11
the day we're recording this, there's still the concept in the Microsoft world of patch Tuesday. Okay. They're still releasing monthly. Uh we need to see how that evolves. But at least finding
22:21
the problems, the software vulnerabilities that's exploding in speed and the vendors
22:28
haven't yet caught up with how fast can we deploy solutions and get them out uh into our systems. So
22:36
uh it's an evolving field, I'll say. Yeah. Okay. All right. That's fair. It is. It's interesting
22:41
to think about though, you know, because you do have those slight interruptions or I'll call them annoyances. And and if that accelerates, boy, it's just going to it's it's going to be like
22:48
MFA was when it first came out, right? It used to be you'd get the prompt for MFA and it's like, oh
22:53
my goodness, it was so annoying. Um and in today's world, it's like, man, I'm glad we do this. This Yes. [laughter] This makes me feel a lot better. Yes. We need to get used to very fast,
23:02
very frequent patches. Yeah. Okay. No, it'll be interesting to to follow that. Um I I I want to
Withholding Models for Safety Reasons.
23:08
pick your brain a little bit too just because I find it pretty fascinating. You mentioned um you know AI tools that aren't being released because of safety reasons. You're you're clearly
23:17
referring to Anthropic's latest model and they've made it very very public that they
23:22
um have withheld this model. Yes. And their framing was was pretty fascinating to me. So I
23:28
I wonder from your perspective how much of of their framing of you know it's it's for safety. we don't want this getting into the the hands of the wrong people. Um,
23:37
how much of their framing is truly, you know, we we don't want this getting into the hands
23:42
of the wrong people. And how much of it is positioning as we just created the the best, you know, LLM that's ever been created, the best AI tool has ever been created,
23:51
and we want to get attention for that. And and we've been in this cycle for two years of like,
23:56
oh, this one's better. No, this one's better. No, this one's better. And every release, each one of them is truly better than the next. So I'm curious what your what your take is on that. Okay. Sure.
24:03
There's marketing. Yes. But it is real that these tools are fantastic at finding software problems.
24:10
So Anthropic since you mentioned them specifically has a project called Glass Wing. Okay. And they have selectively let companies participate. So they have selected the partners.
24:21
Uh Microsoft is one of them. Google's one of them. There several of these partners now. And these
24:28
these partners are seeing the power of the tools. It's not all just made up. It's not all just marketing. Of course, there's the the marketing angle, but the capability is real. Okay.
24:38
I mean, that's that's it's interesting. It just, you know, there's there's all these different pieces to it. And um I mean, the AI war right now is is a real thing. you look at these companies
The Rapid Pace of Model Releases.
24:46
that are out there and they're all trying to all trying to win because it is each model comes out and I mean it's not quite as exponential as it was 12 months ago just because you know we're we're
24:56
getting to a point where you just can't uh go that rapidly anymore or make those big of jumps anymore but the jumps are still very large when when the next model comes out when
25:05
the next release comes out. So so I'll give you an example uh Opus 4.8 okay was launched
25:12
just a few weeks after 4.7 Mhm. right? Weeks for a version out. It wasn't a version five,
25:19
right? It wasn't a whole major version change, but still weeks to launch a new capability. And then
25:26
uh just recently they launched Fable. They call it Fable 5. And that is one level down from their
25:31
top model. Uh again for safety reasons, but yes, the pace of release is significant. Yeah. Yeah. Um
25:40
no, it's it's just it's really interesting stuff. I'm glad you made you made time to sit down with me. There's a whole bunch of stuff that I I had kind of thought about talking about with you,
Investing in the Human Firewall.
25:47
but this conversation's been um been really good. It's it's flowed really nicely. Um
25:52
what else is on your mind maybe that we haven't talked about or anything I I should have asked you about that I didn't? Um anything you want to make sure to to talk about?
26:01
I don't want to come across as all doom and gloom because I don't think that's the case, right? But there is a competency required to defend against attacks in this world.
26:10
Uh dealers should invest in that competency. uh investing in knowledge is it's practically free
26:18
and one of the biggest wins they can have. Setting the right culture is huge for them.
26:23
Uh we you know we talk about the human firewall, right? It's not always just technology.
26:29
Human beings running with their instincts, making good decisions, not buckling to time pressure is
26:36
a massive win for for businesses. So invest in the human angle, invest in your security capabilities.
26:44
Uh and you know, we should come out okay in the robot wars if we do those things. Yeah. Yeah. No, that's good. And and let's uh those those are two good points. So let's just expand
26:53
on just a little bit. Double click here. So the first one, you know, investing in the competency that can take really two forms, right? It can take investing in somebody in the store and it
27:01
can take or it could be um investing in a company like Proton to assist or or both, honestly. Um
27:07
but one the other or both of them combined is is really important today and it's going to continue
27:13
to increase in importance as we go forward. Right. Yes. It's an engineering challenge. Right. And and
IT vs Security Specialization.
27:18
you know I've long told you Greg it and security are different skills. Mhm. Right. They're related but they are different skills. We solve different problems in the technology space.
27:29
So relying on the you say the traditional IT guy to expect that person to be able to engineer the
27:36
solutions needed to deal with modern cyber crime that's a big ask. Yeah. It is a specialization.
27:42
It should be treated as such. Yeah. Yeah. Know that's a good that's a really good point. Um okay. So then the other thing you mentioned was knowledge right and educating employees.
Employee Training and Deep Fake Exposure.
27:51
Uh and I can speak from experience at at Reynolds. you can probably speak more experience uh in the dealership world since you you see it every day with Proton. Uh but you know we have vulnerability
28:02
uh kind of penetration testing every day. Every day we get emails to to make sure that our associates um aren't click that they can recognize these kind of spam emails, right? Um and we do
28:12
testing that's that's required on an ongoing basis where we have to go through a a cyber security
28:17
course and we have to take a test on it. So we're we're constantly updated. I'm I'm grateful for that. not just from a business perspective but honestly from a personal perspective too right
28:25
it's it's a almost a gift that the company gives um but you know those types of things uh do make a
28:31
huge difference so is is it very are there other things I guess beyond that that you see in the dealership world or other ways to execute on it [snorts] so a lot of this training has been very
28:42
focused on email right we've got to also train for deep fakes and you can't really rely on the human
28:49
being to spot a deep fake on a video call. It's It's almost a coin flip at this point, right? Um
28:57
are you familiar with the Will Smith spaghetti videos on YouTube? Yeah. So So for those who haven't seen this, it's worth looking up. It shows the evolution of video generation uh from a few
29:06
years. And if you look at the 2026 version of it, it is pretty darn good. Yeah. So exposing people
29:13
to the fact that this type of uh representation impersonation should be considered normal,
29:20
right? and and having your processes work through those situations as well. That training is very critical. Yeah. Okay. Can I add, we've talked a lot about fraud,
Final Summary and Outro.
29:32
right? The traditional cyber crime that that people think about ransomware that that's what
29:37
makes the news that's still happening all the time, but fraud has become so common. In some cases, it's barely even newsworthy anymore. So, you don't read about it as much
29:47
because it's just a constant, right? That's why I want to focus on fraud in particular. It's it's very preventable. Uh dealers have power just through education, good policies. So I want to
29:58
emphasize that uh while ransomware of course like I said is is still happening on a daily basis,
30:05
I want to draw attention in particular to fraud. That's a great uh a great call out. Um and
30:11
honestly good place to probably land the plane here. It's been uh been a very it's been a fun conversation. I always learn something when I when I get to talk with you and I get to sit down with
30:18
you. So, um I I hope that uh everybody listening got a chance to learn something too. Um but Nil,
30:23
I do appreciate your time. So, thank you very much for for joining me. Thank you. Thank you for having me and I I hope this helps our dealers and uh then they can use education and good
30:32
investments to to be on the right side of this equation. Thank you, Greg. Perfect. Thanks. Well,
30:39
I hope you got a lot out of that conversation with Nikhil Kalani. Uh he's a wealth of knowledge, has tremendous experience, and I really do appreciate him sitting down with I learn something every time
30:47
I get to talk to him. Uh before we hop off, don't forget you can watch or listen to all episodes of Connected on YouTube, Apple, and Spotify podcasts. And make sure to hit subscribe so you're notified
30:54
every other week when new episodes are released. Thanks so much. We'll see you in two weeks.