Cyber Incident Response: Ransomware, AI and Breach Readiness

Welcome (00:00):

Welcome to the Alliant Specialty Podcast, your source for insights on emerging risks, market trends, and specialty insurance solutions.

Brendan Hall (00:10):

Hello and welcome to yet another Alliant Specialty Podcast. I am your hostess with the Cyber Mostest, Mr. Brendan Hall of our Cyber practice here. And folks, today is special. Today, I am very excited to welcome Ms. Jennifer Coughlin of Mullen Coughlin, cyber breach coach, attorneys to the stars and regular people as well. Jen, welcome to the pod.

Jennifer Coughlin (00:37):

Thanks, Brendan. Thrilled to be here.

Brendan Hall (00:39):

AH, we are so happy to be here. You know, I saw you at the XYWAV Awards, which for folks who are not in the know is also known as the CyberProm that we have in New York once a year. And it got me thinking the next day that I was like, "Gosh, how long has Mullen been around now? It's gots to be close to 10 years." And lo and behold, I checked and you were hurdling towards your 10-year anniversary in October. So I thought, what better time than to do a look back on the last 10 years and get the origin and kind of what is going on now and what you see maybe coming down the pipe. With that, we will just jump into it. So 10 years ago, you were on a flight either to or from London for net diligence with John. What were you thinking?

Jennifer Coughlin (01:16):

Yeah. So we had a long flight back from London and we sat next to each other on the flight back. And in between watching movies and just catching up and small talk, we started brainstorming the idea of would we ever want to start a firm dedicated solely to cyber and the. Cyber insurance market? And over that long flight, as we talked about it more and more, we realized we really want to, but we almost felt like we needed to as well. We needed to build a firm that was built to service the Cyber insurance market and its needs, which were very unique at that time. You need twenty four seven, 365 access to resources that are going to help organizations investigate and respond to incidents, contain incidents. And we had a great team of attorneys, only 12, we're talking 2015 at this time, only 12 and we were very busy, but we felt like we were at the beginning of something really big.

Jennifer Coughlin (02:15):

And we spent the next 16 months or so working towards that goal, talking to the team, talking to our professional mentors in the cyber insurance market about what do they want? If we were to do something like this, what would they want it to be like? And over that time, it became abundantly clear we really wanted to do it, but the Cyber insurance market was already demanding it. They were demanding an organization be stood up to service this very unique line and the policy holders that they had. So we did it and October 1st is just a few weeks away and we are going to be celebrating our 10-year anniversary at that time with 150 attorneys. The day we opened our doors, October 1st of 2016, we had 13 attorneys and 10 non-attorneys. We are now to 150 attorneys. We have offices in 18 states in the US, one in the UK.

Jennifer Coughlin (03:02):

We have over 100 admins supporting the attorneys in the work that they do. We offer advisory compliance services. We offer incident response services, regulatory investigation defense services, litigation defense services. We're in the US and we're abroad, so we can really be a one-stop shop for organizations in all facets of Cyber risk and incident response. And its been quite a ride. I can not believe it's been 10 years. The last four months before we opened our doors, it was actually my maternity leave with my oldest daughter. So I look at Marielle, she turned 10 in June. So it just makes sense that we are already at our 10-year anniversary and it feels like it was just yesterday we were opening the doors.

Brendan Hall (03:44):

Yeah. You think about that time, that is right when the Cyber insurance, the underwriters were really starting to take control, if you will, of how and who got paid for what. So yeah, the timing was just perfect and I'm sure it's been an incredible ride. When you look back at this, what specifically do you think you nailed and then what maybe surprised you about something that was not exactly how you thought it was going to turn out?

Jennifer Coughlin (04:06):

Yeah, so we were pretty spot on in that it was going to continue to evolve and it was just the beginning at that point. And if you look at penetration rates for the insurance market at that time, unless you were a Fortune 5000, which they're pretty good at having Cyber insurance and have been for a while, you were seeing a penetration rate of less than 20%. And that means there is a lot of Cyber insurance to be sold to a lot of organizations that have cyber risk. And we got it right. And the market penetration, depending upon who you speak to, the highest number I've heard is 40%. Again, not the Fortune 5000. So what we got right was it was just the beginning and we were going to be able to help everybody involved in the cyber insurance market, insurers, brokers, insureds, identify, assess, and mitigate against this Cyber risk and become more resilient and become better at identifying the issues and preparing for responding to incidents.

Jennifer Coughlin (05:03):

So we definitely got that right. We didn't miss the mark. We just didn't expect it to evolve the way that it did on so many different levels. The needs of organizations, the laws applicable to organizations, the regulators that are active in investigating these incidents, the litigation risks that organizations are facing, but also the threat actors and Cyber crime in and of itself, how it has evolved. Back in 2015, I remember some of my largest matters were mismailings or a lost laptop that was unencrypted. And you see the claims coming across your desk. When was the last time you saw a mismailing? When was the last time you saw a theft of an unencrypted laptop? Gone are those days. And we joke at the front, we see over 40 new matters every single day. And when a new matter comes in and it's a mismailing or something small, people grab it, we want that one. It's like the easy, breezy, old school types of incidents that we see. We do not see those incidents anymore. And I think it's because organizations just really nailed mitigating that risk and they're dealing with a totally different adversary at this point and type of cyber risk for their organization.

Brendan Hall (06:08):

Yeah. And actually speaking of them, that really brings me to my next question about the bad guys, right? You seen so many, 40 new matters a day. That is crazy. But when you look at the threat landscape today versus back when you started, right? And when you are talking about laptops and mismailings of those have nothing to do with anybody trying to create malfeasance. So can you talk a little bit about that and how those folks have become, I suppose, better at their jobs? <laugh>

Jennifer Coughlin (06:31):

They are. Cyber crime was more opportunistic a few years ago where, yeah, if somebody had a vulnerability, okay, great. Somebody could get in. But it was walking by a car, jiggling the door, seeing if it's open, grabbing a laptop, sending a phishing email, maybe somebody will respond, maybe somebody will send information, maybe somebody will wire money to a different account. But it's a totally different threat landscape right now. It is super easy to become a cyber criminal if you want to. There are so many resources available to cyber criminals now that they can weaponize to attack organizations. They have dedicated technical and financial resources backing them. They have a tremendous amount of human capital focused on launching these attacks on identifying vulnerabilities, on identifying zero-day exploits, and on attacking organizations every single day around the clock. So the adversary has absolutely changed since we opened our doors 10 years ago.

Brendan Hall (07:29):

Yeah. I do not think people realize that in certain states, which we don't need to get into, these folks are in office buildings. They're not in a basement or something. These guys are in an office with a plaque on the door. Maybe not plaque on the door, but they are in office space in downtown metropolises and conducting themselves like they're AT&T or any other business, you know, you could think of.

Jennifer Coughlin (07:50):

Yeah. And they've become so brazen over the past few years. Never in a million years did I think we would see threat actors impersonating IT team members going into offices risking being caught. Now it begs the question, is that somebody that was hired online to just go image a laptop and they weren't really told exactly what they were doing? Possibly. But how brazen have these Cyber criminals got to go into offices, to image laptops, to steal information? It's just wild what's happening. And the risk that organizations are facing in today's world.

Brendan Hall (08:27):

Yeah, you would think they would stay in countries where there was no extradition and just play it safe, but coming directly into the physical office space is...that is just crazy.

Jennifer Coughlin (08:37):

Yep. And they're just one piece of the puzzle. There are so many people working to attack that US organization, somebody going in, but then also people working hands on keyboards, working from different locations throughout the world to support the attack against the organization.

Brendan Hall (08:53):

Even if you do work in this space, it blows your mind. But folks who come into this, they know some facts, but they hear that and it is really, it's something else. A couple years ago, I think it was maybe the first time that I saw you speak, it was at Access and Densom event downtown and you had such a grasp on these very specific data points. And I was like, "wow, they must be just tracking all of this information across matter types and industries." And what a cool way to be able to help clients and also just be able to pinpoint trends in the industry. You know, when you look across this thousands and thousands of matters, what patterns or data points consistently stand out to you and what do they tell you?

Jennifer Coughlin (09:29):

Yeah. So we track a lot of data on our matters and we have been doing this for years. And reason one was people were coming to us saying, "What are you seeing?" So we were able to use real life data from real life incidents to say, "This is what we're seeing right now." And we can slice and dice that data in so many different ways. But think about the advantage our clients have when they work with us because of that data. We're able to tell them organizations similarly situated dealing with a similar situation went through the following. We're able to tell them more about their adversary, more about what to expect as part of the campaign against their organization and how to in turn better defend against an attack in the future, but also respond to the incident that they're dealing with. So we have organizations come to us, say it's a law firm, and they're dealing with a silent ransomware group matter...

Jennifer Coughlin (10:17):

We have so much data on silent. We have so much data on Luna Moth, which may or may not still be silent, depends upon the intelligence resources that you speak to. But you think about the advantage that the client has when they come to us because we're able to say other organizations similarly situated to you are dealing with this incident. So one, you're not alone. We're not sharing any privileged information with these other organizations about what their peers and counterparts are doing to investigate and respond to their incident, but we're able to share information about the threat actor and the types of demands that we're going to see, the type of negotiations we may get, what happens when you do not pay the ransom, what happens when you do pay the ransom, the pros and cons of paying the ransom. And you're able to just better understand exactly what you're dealing with and understand what other organizations may be doing and have done for years prior because this data goes back for years.

Jennifer Coughlin (11:09):

And what's interesting is we have a lot of processes at the firm, one of which is monitoring for a common event. So we call a common event something where we see three or more matters coming in the door that have very similar fact patterns or they have a similar other organization involved in the incident. So think about Blackbaud, think about PowerSchools, think about Canvas, think about Progress and Move It software. So when we had three matters come in the door and they all referenced the use of Move It, we were able to say, "Common event, let's start monitoring and see what's going on." So then we're able to tell everybody in the market, "Be on the lookout. If you utilize Move It, we are aware of this incident. We are aware of threat actors doing the following. You need to be prepared for the following." So we are able to identify incidents that are impacting a lot of organizations very quickly, and its based upon the work that comes into the firm and what we're able to see...

Jennifer Coughlin (12:04):

And it really sets us far and apart from other law firms that are providing this service because the data is key. We have law enforcement coming to us, "What data do you have? What can you share?" I think it was 2017, a special agent with the FBI, he is no longer in the Cyber unit, but he asked for a meeting. He came to the office, John and I met with him and he was like, "So I do not know how to say this, but you guys have a lot of data." I said, "Yeah, we do." He said, "We don't have that." And I said, "Yeah, I know." And he said, "What do we do?" I said, "Look, the problem is that the FBI made a statement years ago that organizations should not pay ransoms." So now we have clients who at this time aren't mandated or being guided to report to law enforcement to investigate an incident.

Jennifer Coughlin (12:44):

Why would they feel comfortable sharing information with you when there is this position that is being broadcasted publicly out there by the FBI saying, "Don't pay the ransoms!" So we were able to really come to a good place where law enforcement is a key stakeholder in the incident response process. We work very closely with them. They are a fantastic threat intelligence resource, and we leverage those relationships to make sure our clients are getting the best support from law enforcement that they possibly can. But even the FBI realized years ago, you guys have a lot of data. You have a lot of information coming in the door and it would be really helpful to have that.

Brendan Hall (13:15):

This is slightly off the cuff from it, but do you have a chief data scientist? You guys are lawyers, so who's managing this whole collection and how do you know when to declare a common event?

Jennifer Coughlin (13:25):

Excellent question. So we have a team, it's called the MCIC, Mullen Coglin Information Collection. At the helm is Chris Ballard, who is an attorney, licensed and practicing, but he's also a former forensic investigator. So he got this technical background and experience that he marries with his legal background and experience. And it's fantastic because sometimes the data is very technical. He's able to speak in the super technical terms. He's also able to speak as an layperson and make it completely understandable of whomever he is talking to. And it really helps our clients understand what the risk is, what they're dealing with, but also what the data means to them.

Brendan Hall (14:05):

Yeah. That skillset, especially in this business, is pure gold. To be able to take very complex technical situations around a matter and just data collection in general and be able to say it to somebody who you meet on the street. I found the best forensics people in particular, they are the ones who can do that, right? You can say, "Mr. CEO, Mrs. CEO, CFO, whomever, this is what's happening" in a way that they can completely understand. Those are the folks that you just sit back and go, Wow.

Jennifer Coughlin (14:32):

And our attorneys are also well-versed in the technical language and what we're seeing there, but we bring in forensics to do the investigation. We're engaged as counsel, we are acting as counsel. It is important that you bring in a forensic investigator to support that work. But just based upon the experience that they have at Mullen Coughlin alone, they're seeing incidents every single day. They're aware of what's going on. They are able to speak to it, but we have this dedicated team of resources that have a great technical and legal background that is married to just really well-position our clients to understand the risk they're facing and respond to it.

Brendan Hall (15:06):

So when you're looking at this data, you are calling out common events, but are there other trends you're able to see before the market does? What is something you are seeing right now that maybe will sneak peak the market's not really aware of yet? <laugh>

Jennifer Coughlin (15:17):

Yeah. So we're able to see trends on attacks and going back to Silent. We keep a dossier and all the different threat actors, as do all the threat intelligence resources out there. But there was a point in time where we saw Silent pivot. All of a sudden the demands jumped. All of a sudden, the ransom notes all looked the same and the harassment tactics all looked the same, but it was so different from what we saw them doing before, like sending somebody in to a law firm trying to image a laptop, and newsflash they were successful, which is just wild. But you think about all the different physical safeguards that they need to defeat in order to get there, and they're able to do it. They are able to convince reception in the building lobby to let them in. They are able to convince reception in the office itself to let them back.

Jennifer Coughlin (16:03):

And that was a trend that we saw developing in real time, and we were able to say to our clients and to the market, "Well, guys, like, this is new. We need to be watching this. We need to be making sure everybody is aware of the importance of physical security." Because sometimes you can get so caught up in the actual technical security piece and you forget about the physical security piece that really goes hand in hand in organizations protecting themselves.

Brendan Hall (16:25):

Yeah. Wow. And when threat action groups finally break up, do you put an RIP and like a, like a window of like 2005 to 2010? <laugh>

Jennifer Coughlin (16:33):

Gone but not forgotten. Yeah. No, you know what? They break up and they always reappear somewhere else. So when we get word that, "oh, they're closing up shop." No, they're not. They are just changing their name.

Brendan Hall (16:43):

I wonder if they have a trade deadline like the NFL where you got to switch teams by a certain date. <laugh>

Jennifer Coughlin (16:48):

It's so funny. And it's something that we talk about with our clients who are like, "Oh my gosh, we need to pay the ransom. They took data. We need to pay so that they delete it." Which was the million dollar question or however much the demand is, do they actually delete it? And we see instances, we are seeing this right now, where tied to Silent. We are having some of our law firm clients that were impacted by Silent. Yesterday, we had three matters come in, so we flagged it as a potential common event. They are all former victims of a silent ransomware attack. They may or may not have paid the demand, but when they did make the payment for the deletion of data, we received the report back from Silent saying, "Yep, deleted. You're good to go." And yesterday, they received extortion notes with the same exact data that was exfiltrated as part of the attack launched by Silent months ago.

Jennifer Coughlin (17:39):

Now they're trying to re-extort it. So what does that mean? They are providing copies of the data to the clients, the data that they paid for the deletion of. And you talk to some resources out there and they say, "Oh, threat actors have the same issues with storage space and why on earth would they hold onto it?" They're getting a lot of money. They can probably pay for extra storage. But if you think about it, threat actors are able to weaponize the data for financial gain the very first time they try to do it. Why would they stop? Why would they stop? You look at the median household income of some of the countries that are known to have nation state sponsored Cyber criminal groups attacking US organizations. Then you look at the average ransom payment, that's generational wealth for a family over there. So why would they stop? The answer is they wouldn't. At all.

Brendan Hall (18:25):

It is easy money and the sums are just mind-blowing. And I always think, like, after one of those, I'd be done. I'd be like, "Yep, that's it. I'm out. I'm out."

Jennifer Coughlin (18:32):

You know, you think about it. But if you are doing it once, obviously, you have to be comfortable compromising or having no morals and ethics...

Brendan Hall (18:40):

Assuming zero moral compass...

Jennifer Coughlin (18:42):

Exactly. If you do it once and you make that much money, I'm sure you would say, "Maybe I'll do it again. We will see what happens

Brendan Hall (18:47):

Well, it's like anything, you start, you make the money, you spend the money. Oh my god, that is so funny. So just pivoting a little bit from a client perspective and we have all been through the incidents with clients, and some step right into action, and then others are running around like chickens with their heads cut off because there's no plan, right? They have no idea what to do, and they are calling you going, "We had never thought this was gonna happen." When you think about those two groups, what is the biggest difference between them, aside from all the panic and anxiety?

Jennifer Coughlin (19:13):

Yeah, it is preparedness. The organizations that are prepared. And there's no way to be 100% prepared to respond to an incident. You just can't. There is no way that you can go online and use ChatGPT or Claude to develop an incident response plan and not be effective for your organization. That's just not the world that we live in. You can't be 100% prepared. But those organizations that take the time to get as close to 100% as possible are just better positioned when they're responding to incidents. They are more aware of the risks their organizations are facing, and therefore more alert on seeing any indications that that risk is coming to fruition. They are understanding... they have cyber insurance. They are understanding what it means to have cyber insurance. They understand the different players and stakeholders in the incident response process. They understand the importance of having an incident response plan and testing it, doing tabletop exercises.

Jennifer Coughlin (20:03):

They understand the importance of including the C-suite and the executives on their team when they're investigating these incidents. Oftentimes, we have organizations come to us and they're experiencing a ransomware or extortion event. And we will be speaking to somebody on the phone on day one, and they will say, "All right, got it. Yep, we need to pay for the decrypter or we should pay for data suppression, but we need to get our management involved." You may have somebody on your management board that is dead set against paying a ransom. You need to know that now before you have an incident, because sometimes you need to pay in order to regain access to your data. But if you're going to have a conflict internally on how to respond to an incident, take the time to resolve that conflict to the best that you can before you experience the incident. Do not waste the time when you're in the middle of an incident.

Jennifer Coughlin (20:48):

Another thing that we work with organizations on the preparedness side is, we need to understand the organization's core values because those core values may play into how they plan on responding to the incident. So we oftentimes have calls with clients that we do tabletops for and help develop their incident response plan. We say, "Tell us about your core values." They are like, "Don't you want to know about our network and our security?" We said, "Yeah, absolutely. But we need to understand if we are working with an organization who believes in transparency from day one, because that is going to require a certain approach be taken to the communication strategy." So preparedness, I can't overstate it enough. Organizations that try their best to be in the best position possible to respond to an incident, understand their risk, understand the legal landscape applicable to them and the regulatory landscape applicable to them, understand the resources that they have. Those are the ones that are best positioned to get through an incident as quickly and efficiently as possible and as unscathed as possible.

Brendan Hall (21:52):

Yeah. That is such an amazing example about the board member - Knowing whether or not they are because that could hit you like a ton of bricks when you think you got everything buttoned up.

Jennifer Coughlin (21:59):

Yeah absolutely. I had a client where the CISO was like, "No, we're paying absolutely." And then the CEO gets involved and he says, "We're not paying terrorists." I said, "Whoa, whoa, whoa. That word has some power."

Brendan Hall (22:12):

All loaded.

Jennifer Coughlin (22:12):

But you know, and we haven't done an OFAC check yet, but we got to talk about this guys, because I'm being told by the CISO that we have to pay. "We have no choice", and I'm being told by the CEO that "we're never going to pay." I'm being told by the CISO that "we can't recover." We got to figure this out. If they had taken the time before experiencing an actual incident to run through a ransomware fact pattern and talk through with management and the decision makers their positions, we would have saved a few days on the incident response, for sure.

Brendan Hall (22:40):

So this is for the clients who are out there potentially listening, and even my colleagues, this is why I am always banging on about tabletop exercises. Because this is the sort of thing that gets sussed out way in advance <laugh> of an incident if you've got people who are detractors who are going to put a last minute roadblock to getting the company back into business. It's not just me who is saying this. There is a real reason behind this. It is actually a good idea. I was actually really excited to ask this question. In the first 24 hours after breach occurs, when they become fully aware of it, what are three decisions that most influence the outcome?

Jennifer Coughlin (23:10):

Yeah, so you shot me this question before this and I couldn't come up with three. I could only come up with four with a caveat to one. So the first one is, make sure you understand who your Cyber insurance carrier is and notify them. You are paying a premium for access to resources and coverage to help you respond to an incident. Make sure you are taking advantage of that. And that goes hand in hand with talking to your broker as well, of course, Brendan. The second is engaged experienced counsel. The experience matters. It really is going to drive how your incident response is going to go. So engaging experienced counsel, engaging through counsel forensics. So there is the importance of protecting privilege to the best extent that we can. So making sure to the extent forensics is needed, you are engaging them through counsel and having counsel direct that work.

Jennifer Coughlin (23:59):

But this also ties back to something that I was just sharing as part of the war story. Identify the potential anticipated and current, internal, and external communication needs. And this is something we work with on our tabletop clients as well. Communication is very important. You will have some clients that want to share absolutely everything. You will have other clients that want to share absolutely nothing. But just because you don't want to share something doesn't mean you're not going to have the media show up on your doorstep. Does not mean you are not going to receive an email from media saying that they're going to be reporting about the incident. You need to be prepared when it comes to the communication strategy. And that's all something that we work with our clients in the first 24 hours.

Brendan Hall (24:40):

Wow. Yeah, you wouldn't be surprised because you do this all time, but the number of times people go, "Why do we need lawyers? What about... "No, it comes with your policy, "but we already... we have a general counsel, Mike," it's different. And your general counsel..."

Jennifer Coughlin (24:51):

Yep. It's so different, the business purpose versus legal purpose. But also, the laws are constantly evolving, and they're requiring more of organizations. I remember back in law school thinking like, "Oh, being a GC of a company, so cool. Must be great." They're the jack of all trades. They're the busiest people I've ever seen. I am sure that they are not up to speed on all of the different data breach laws and laws that reference and relate to data privacy and information security, and then all the guidances that aren't laws, but regulators interpret to be laws. The council is key in really helping the GC get through these incidents because they've got a lot on their plate already.

Brendan Hall (25:31):

Yeah, they are going from HR to contracts to litigation in one day. Some of them handle Cyber insurance on top of that wich is crazy. So we're going to get close to wrapping up here. One thing as Alaska look ahead question, we have to have a future prediction. What is the trends that you think are maybe over-hyped and maybe something that isn't getting enough attention?

Jennifer Coughlin (25:52):

Yeah. My answer is the same for both, which I know makes no sense, but it's AI. It's Artificial Intelligence. I don't want to say it's over-hyped. It's not over-hyped. I don't think anything is over-hyped when it comes to cyber risk. But there is a lot of talk around AI, and it is 100% a risk, but its not insurmountable. It is new-ish, but AI has been a risk for a while for organizations. New and newish does not automatically mean it's insurmountable, but it is something that organizations have been grappling. Some do not even know, but they've been grappling with the risk associated with AI for a while. But it also can't be downplayed and a great resource. I use it personally. It is something that has to be used correctly. And we see organizations that are so anxious to incorporate AI into what they're doing and cut the workforce and rely heavily upon AI.

Jennifer Coughlin (26:46):

But we see gaps in quality control and information governance, and we see organizations not understanding AI tie-ins to applications that they're using and the risks that are associated with that, and organizations not limiting or restricting the use of AI applications to their workforce. And we're seeing risk associated with that. We're seeing incidents associated with that. And information governance is key. Employee training is key. Understanding your risk is key. And AI is playing into all three of that. And if organizations don't take it seriously, they're going to end up in a position where they're losing access and control of their own data because they're inputting it into an AI application that they don't understand exactly how it works. We're seeing organizations have actual incidents because employees are putting very sensitive customer information into these applications to analyze it in a way that they have never been able to analyze it before and act upon it in a way that they have never been able to act upon it before.

Jennifer Coughlin (27:47):

So it's coming from a place of good, coming from a place of let's get the business, let's grow as a business. But it's an unauthorized disclosure because the information is being provided to an application that's open-ended and is going to be used to feed other applications and other organizations, including possibly your competitors.

Brendan Hall (28:05):

Yeah, that's an incident we have seen at least several of that I can think of where people just put up client or customer data into a public LLM and though nothing of it. But unless you have a closed-end enterprise application you can't do it. Which is one of the many reasons we're working closely with clients now on this AI strategy, risks and opportunities to try to shut down shadow AI. And you bring up a really good point too about information governance. I always thought this because of my background in e-discovery from back in the day, the idea that keeping all this information is just increasing your attack service exponentially. Right. No one's thinking one way to reduce cyber risk is just get rid of all this stuff you don't need, right? Do a house cleaning because otherwise you're just making yourself a bigger target. I always thought the unsung hero of cybersecurity is information governance.

Brendan Hall (28:47):

Jen, this has been so much fun and I really enjoyed the conversation. I was just doing some math based on a eight-hour workday, which I know is not realistic. You've already got two and a half matters that have come in since we've been on this half hour phone call, so... <laugh>

Jennifer Coughlin (29:01):

I will tell you exactly how many we've had come in... We're up to five already today.

Brendan Hall (29:06):

Okay.

Jennifer Coughlin (29:08):

It's going to be a busy Tuesday in cyber work.

Brendan Hall (29:10):

Yeah so you got to get back to it. So thank you so much. I really appreciate your time and all your insight here today.

Jennifer Coughlin (29:16):

Thanks, Brendan. Thanks, everyone.