This podcast episode delves into the evolving landscape of cybersecurity, particularly focusing on the intersection of cloud security and artificial intelligence. Ian Austin, co-founder of Pwned Labs, shares his extensive journey through the cybersecurity domain, highlighting the gradual transition from traditional IT roles to specialized security positions. A salient point discussed is the significance of fostering a community-oriented approach to learning, which enhances knowledge acquisition and practical skills in an increasingly complex environment. Ian emphasizes that current training methodologies must incorporate gamification and hands-on experiences to engage learners effectively, ensuring that knowledge is not only theoretical but also applicable. As we navigate these insights, listeners will uncover valuable strategies for enhancing their own cybersecurity practices and understanding the critical importance of cloud security in today's digital landscape.

In this episode of the Security by Default podcast, host Joe Carson speaks with Ian Austin, co-founder of Pwned Labs, about his journey in cybersecurity, the evolution of learning in the field, and the challenges of Cloud and AI security. Ian shares insights on transitioning into cybersecurity roles, the importance of community engagement, and the need for continuous learning in an ever-evolving industry. They discuss the significance of gamification in training and the current trends in cloud security, emphasizing the importance of hands-on experience and collaboration.

Key Takeaways

• Ian Austin is a co-founder of Pwned Labs, specializing in cloud and AI security training.
• His journey in cybersecurity began with help desk roles and evolved into penetration testing.
• Creating content is a great way to learn and contribute to the community.
• Cloud security presents unique challenges that require ongoing education and adaptation.
• Gamification in training enhances engagement but should not overshadow practical learning.
• Community involvement is crucial for personal and professional growth in cybersecurity.
• Transitioning into security roles can be done from various backgrounds, including sysadmin and help desk.
• Continuous learning is essential in the fast-paced cybersecurity landscape.
• Mentorship can significantly impact career development and confidence.
• Cloud security is a growing field with increasing demand for skilled professionals.

Chapters

00:00 Introduction to the Podcast and Guest

00:40 Ian Austin's Journey in Cybersecurity

06:40 Transitioning into Security Roles

10:54 Evolution of Learning in Cybersecurity

16:19 The Importance of Community in Learning

22:58 Challenges in Cloud Security

28:46 Staying Updated in the Cybersecurity Field

Resources:

https://pwnedlabs.io/

https://www.linkedin.com/in/ian-austin/

Hi everyone.

Welcome back to another episode of the Security By Default podcast.

I'm the host of the show, Joe Carson and it's always great to be back here at my favorite time of the week, which is talking to amazing people that I really, really admire for changing the industry and making the world a better place.

So I'm really excited about today's episode.

Somebody that I've had on a previous podcast that I had in the past and I'm really excited about the conversation, finding what's new, what's the latest trends and what's happening in your world.

So Ian, welcome back to the podcast and thank you.

Since it's the first time on this particular show you want to give the audience a bit of a background about what's your origin story?

Where did you start off?

Did cybersecurity choose you or did you choose the industry?

And some fun things about yourself.

Amazing.

Joe, thank you so much for the invite to the podcast.

It's amazing to be here.

Yes, I to introduce myself, I'm Ian Austin and I am a co founder of a company called pwned Labs.

We specialize in cloud and AI security trainings for professionals.

In terms of my background then, I mean, I'm kind of an old man now I guess in some ways.

I've kind of had a career that's about 25 years so far.

So I've always been on the technical side.

I started off in help desk in my gap year when I was I think 17 and not my gap year.

No, 18.

Yeah, so in my gap year I was 18 and I worked at help desk in, in the school that I was, I was kind of at.

And that was a great experience in terms of, you know, getting hands on with some technology, solving problems, seeing some of the crazy things that happen in, in the real world as well.

And so yeah, really after that I went to really know what I wanted to do.

To be honest with you Joe, I thought, well, I liked English so I'll kind of let me take English at university.

But honestly it wasn' for me, I'll be honest.

And I, I left after a year and went straight to full time work and I again was doing help desk which kind of moved into system administration and through, through the sysadmin things even like really early into my career, like one or two years then I was doing some security stuff also.

Like, you know, I was always really interested into, in security and like packet captures and looking at what was being sent on the wire and stuff like that.

Like really I've always found that really interesting.

Even, even for my first years in the industry.

And then so moving on became pretty good system administration.

Before obviously this is when sysadmins were sysadmins and now obviously a lot of them have moved into the cloud and become DevOps engineers and stuff, stuff like this.

Yeah, I kind of got more into security administration.

I was kind of drawn to managing the security, the antivirus, the various kind of desktop policies, creating secure images and stuff like that.

In later roles I kind of, I was still a sysadmin, a bit more of a senior sysadmin at that point and was kind of looking after the security tooling.

So almost a bit like a security administrator, like getting hands on with a lot of the security tools.

And then in another role after that really kind of transitioned completely from system administration.

I was still doing a lot of like support and system administration, but more so my, my kind of day to day was on assurance and penetration testing and stuff like that.

So I was getting into that.

But at the same time I wasn't just learning penetration testing.

I was using my at that point, kind of 10 years experience in the industry to also make sure that we had the security controls internally.

So it was kind of like a purple focused role.

And yeah, fast forward to, you know, a few roles later.

I was kind of like a full blown penetration tester and doing that during the day and realizing, well, I love learning, right?

And so I, even in the evenings I was doing like CTFs and stuff like that.

I found Hack the Box, which was an amazing new platform at the time and it's still an amazing platform.

And yeah, I was really enjoying some of those machines that people were creating.

And I kind of found that with my experience as a sysadmin and security engineer and penetration tester that I felt like I could contribute some realistic scenarios to the platform.

Right?

So that's kind of what started me creating content.

Another thing about creating content I think is that it's actually a great way to learn, right.

And so I definitely advocate that to any listeners who.

How can I get like really good at something?

You know, creating is a great way to learn as well.

Um, so yeah, created some, quite a few machines for Hack the Box.

They became pretty, pretty popular.

I started becoming, helping out with the moderation of Hack the Box in the forums and stuff like that.

And then Harris, who's the CEO of Hack the Box, James, who's the cto, they took us out and we're like, okay, we, we kind of want to make this Hack the Box thing an actual company and we'd love if you can join us.

And at that point I didn't initially jump at the opportunity, but to be honest with you, it didn't take me too long to process it and realize that I'm pretty passionate about content creation.

And so yeah, I joined Hack the Box at a very early stage and it's an unbelievable, like, I've got some amazing memories of, of Hack the Box and you know, the people there.

It's, it's a really, it's a time in my life where I feel very, kind of have really fond memories and I kind of headed up the content for Hack the Box and what I really liked about it as well was that it was probably the first rollout where I kind of felt like I had my thumb on the pulse of the business as well.

Right.

And I realized actually this kind of business is something I also really enjoy.

It's something I'd been reading audiobooks about or books about like years before, but this was the first time I really had the opportunity, I think, to dive into the business side and realize I liked it and also I guess the marketing side.

So I'm a bit of a marketing geek as well.

I like that.

And so yeah, that really was my journey in, in Hack the Box and obviously latterly really developed a passion for cloud security.

And here, here we are today with phone labs, really I guess, and, and so that's, I guess a bit of my journey so, so far.

But I just kind of want to mention one point about my journey, if I may, which is that.

Absolutely.

So I never really went from a non security person to a security person straight away.

Right.

It was like gradual evolution.

And I think a lot of the people that I've been speaking with previously in the Hack the Box community and now in the pwned labs community have this question which is can I, how can I become like, how can I get into the industry?

How can I become a penetration tester or something?

And I think there's this common kind of perception that if you're doing a specific type of role at the moment, which could be help desk or sysadmin, that you can absolutely not do any security stuff and you have to kind of do this learning and kind of get your certificates, especially if you're kind of early in the industry where certificates are kind of useful, I'd say.

But what I would kind of advise to people who are looking to get into, into the industry is that you can actually take on some security stuff potentially in your existing role and kind of just if you start seeing things through the lens of cybersecurity, even if you're doing like system administration or help desk, which to be honest are very security focused roles anyway.

But I would definitely advise people to, you know, maybe take on a project, speak to their manager, speak to their team, speak to the developers about, hang on a minute, you know, we have this potential issue here.

And if you kind of showcase the value of security and really highlight to them something that really helps is for example, a bloodhound map.

Like if you can show visually to people in your company how, how something is possible, then they kind of sit up and take notice and, and like that.

So I'd say don't wait until like it's, it's almost like the expression dress for the role that you want.

It's like it's the one you want.

Yeah, it's almost like kind of start seeing things as if you were in that role already.

And in my experience, people are generally quite receptive to, you know, allowing you to improve things in security, even if you're not in a specific security role already.

Absolutely.

It just brought back something.

A lot of times, even when I think back when I was doing system administration and, you know, help desk and support roles and a lot of those roles, when I think about a lot of the tools I was using were actually overlapped with what the security team would be using in order to detect as well.

When I think back and when I started off, it was ethereal, which of course now, you know, we know today as Wireshark, I was doing that for a lot of, you know, packet capture in order to understand why the three way handshake wasn't working or why packets were failing or why sticky bits weren't working for me, sometimes there's a lot of crossover in the tooling that we both use.

Sometimes it's about learning the same tool you might be using in your day to day job about how to look at it from a security perspective of what things to be looking at.

And sometimes that's a very easy, quick start to get into that crossover into the security field.

So I love what you're saying because I love learning as well.

That's one of my passions, is continuous learning, is learning new things.

And that's one of the reasons why I started the podcast, is so that I can get to talk to some of my favorite people and learn from them, because I learned so much from these interactions.

But what I found is in, in the last 10 years, even when I started doing Capture the Flags and Hack the Box and working towards my OSCP as well, that I found that learning can be so much more fun than what it used to be in the past.

So in your view, how, how is the learning evolving from the old traditional?

I remember, you know, 20 years ago, used to go and spend a couple of days in a classroom with an instructor and I remember when I did my cissp, it was like the book that size that I had to read, know everything in it, spend five days with an instructor in the classroom and go over all the kind of little details.

The, in a theoretically scenario, you know, you're going through it in, in.

And it was a, it was a tough test.

But then I, you know, fast forward to, to a couple of years ago when I did the oscp, it was a very, it wasn't, it, it wasn't a ABCD test.

It was like, well, you got to show what you can actually do.

So how is, how is the training evolving in, in your view?

Cause you've, you've came through this same transition as well.

Yeah, definitely.

I think we've both kind of had that experience, Joe, where like when I was taking my MCSA and messaging then like rest in peace, firstly to Fabrikam and Contoso who are, who are no longer going to be with us.

But you know, those sort of scenarios, probably the most interesting things was the actual scenario involving Contoso or Fabrikam where they were trying to implement something and you, and you'd have to figure out, well, what's the ideal solution for those people and stuff like that.

That's pretty much as interesting as it got.

Maybe Microsoft exams are great.

So don't get me wrong, I've got, you know, they're very challenging and they're very rigorous.

But obviously a lot of exams from AWS or Google or Microsoft are very theoretical.

It's, it's great to know the theory, but honestly having the hands on experience, I guess number one, it means that when, when it comes to doing it, you are kind of, you feel more comfortable because you have some muscle memory already.

And number two, in terms of keeping going with the learning, then having the hands on and kind of like the gamification is something that is just gonna, you know, if it's something you enjoy, you're gonna keep doing it right and.

You're gonna, you're gonna pay more attention, you're gonna focus, you're gonna, you're gonna, you're gonna listen more.

Exactly.

And that's where I feel like companies such as offsec Hack the Box, Pwned Labs and you know, the whole kind of cybersecurity training industry, but also generally speaking, it's not just us as, as like the cybersecurity vertical.

I think everyone is realizing how important it is.

If someone enjoys what they do, they're going to learn it better, they're going to learn more.

And yeah, and, and so there really is an expectation now where I'm hearing a lot of people saying, oh hey, I'd love to learn more about like for example, pipeline security or I'd love to learn more about, you know, Azure or something like this.

There's almost like an expectation nowadays where by default training has to be gamified or you know, from, from the perspective of an individual learner.

And so that's something where, you know, having these immersive scenarios, having leaderboards, there's various ways you can go about it.

Like for example, if you're learning a language, gamification is something that is very important but it shouldn't necessarily be the be all to end all.

Like how best to put it, I guess if you're trying to learn like French for example, and you download duolingo and it's great because you kind of get these, you know, reward motivators, various sounds playing in the background when you're achieving stuff and, and you kind of get a good feeling.

But is it really helping you learn French?

I'm not sure.

Right.

And so that's where there's like this thing with gamification that if it's something that's just if you focus on the gamification aspect only and kind of this can kind of result in, in people feeling like they're learning but not actually learning.

So I think it's like a trade off where you need to make sure that you teach the theory you give students hands on and then you have gamification elements that mean that they get kind of their dopamine hit and kind of, you know, submit the flag and feel good.

But that's what I would kind of say is that gamification is important, but we shouldn't be focusing exclusively on gamify because otherwise you get into like a bit of a scenario where it's kind of dubious how much people are actually learning versus just feeling like they're learning and feeling good about something.

I think it also gets in, you know, for me, listening to how you're explaining it reminds me of the old times one when I was doing a Lot of the Microsoft and Cisco certifications, which were that very textbook, you know, even, you know, kind of the theoretical side of things.

And then I remember when CBT nuggets came out and you had these video based, which wasn't just about somebody explaining, it was actually you following and learning and you know, you would see the video and you would repeat the same steps in your lab.

So you actually start and you would simulate and start learning about not just the theory, but how to actually configure something in order to make it do something.

So you're actually seeing immediate results.

And I think that's kind of where you're getting to that really the simulated side of things.

I think what the gamification is really the bridge is bringing the community together, the people together.

Because I'm in Estonia, I do a lot of capture the flies with people based in the US and UK and all over the world and I think it's really bringing them together.

So if you're talking about the example that you mentioned with Duolingo is that, you know, that's really, that, you know, the practical simulation side I want to practice and what, when the gamification is, is connecting me with somebody in France and I can actually try and practice having a conversation.

You know, it's about taking those learning and saying, here's other people that you want to book a time with.

It's, it's a engagement side.

You're, you're absolutely right.

You're.

You're so right.

And it's like the expectation now is that learning is also social and it's constructive and you're kind of learning with people and it's not just an individual thing where me and you might have been looking at the cis CISSP book or mcs, whatever.

Right, right.

Yeah.

So that, that was very solitary.

And I mean still, if you're, if you're kind of technical and you like that stuff like we do, we still find enjoyment in it.

But honestly, there's so much more to be had through like the struggle of learning, capturing the flag, speaking with other people.

And this is where people, I think like Tyler Ramsby and various other people in the industry are doing a great job because, you know, you know, people also, when they're starting, they kind of don't really know where to start looking up to these kind of people in the industry who are saying, well, let's just get stuck in.

And just.

Tyon's journey is also very inspiring in terms of, you know, how, you know, he kind of went from Just documenting his progress to really being an inspiration to others.

And I think that's something that is very important.

It kind of that community aspect and having like a community and hack the box or try hack me or Pony Labs or whatever company like.

I think sometimes companies are too focused on just like the product and they're not focused enough on the community.

And the community is such a powerful thing in terms of keeping people within your platform and, and having fun, keeping.

Them participating, keeping them creating.

Because you know, to your point is that you're creating content is, is one of the fundamental things that keep going.

If you just stop creating, eventually it becomes steel.

It becomes almost feels a little bit about, you know, after using some of the AI models for a couple of months and if no one's contributing new learning to it, it just becomes this is very much the same, same thing, same answers as it was six months ago.

It's not learning if I.

Similar to me, like you love learning and, and me too, like in Pond Labs, I feel like I'm learning on the business side, I'm learning on the content and research side.

I'm learning, creating and researching new scenarios.

I'm learning from amazing researchers in the industry who are publishing blogs and you know, some of the, some of the people in pwned Labs as well who are like investors.

So we did a community investment round.

I'm not sure if everyone knows this, but we kind of opened up ownership of pwned Labs to the community and had people signing up to be like a part owner of Pone Labs, which is incredible.

And we've exclusively selected practitioners in the industry and a lot of these people I'm also learning from or they're kind of saying, well, almost like challenging things.

Yeah.

So I'd say there's a lot of people inside Pony Labs that I'm learning from.

Like some of the amazing practitioners that we work with inside Pony Labs who are like co instructors or instructors for the various trainings that we have.

Yeah, I'm learning a lot from, from everyone.

And to that point I think if I ever stopped learning, I'd probably stop doing it.

Right.

So if I Poned Labs is this amazing journey and it's, it's got an amazing team and an amazing community and I'm, I'm really thankful and blessed for the journey we have so far.

But I think if I ever stopped learning, I'd probably have to find something else to do because.

Because that's all, I mean that's, it's what life's all about is finding a passion.

It's about having something to keep the motivation going.

I think going back, if I was to change things, you know, as I was doing my learning path a couple years ago, I would have probably tried to find a mentor much earlier in the gamification side because I did try to do it a lot of it alone.

I was doing a lot of the boxes all by myself.

And then I would sit, you know, trying to figure out am I having imposter syndrome, am I not good enough to do this?

And then realize that it's just about finding somebody with the right knowledge who can help, help you try to.

And one of the thing is there's, I don't want people to do it for me.

What I want them to do is explain how I can enhance my skills or what area to, you know, point me in the right direction so I can maybe do it self paced, you know, learn it myself and then find out where I'm going wrong.

So definitely getting that community much earlier and getting a good network of people who are skilled in certain areas who can, who can work together as a team because ultimately, you know, that's what.

It's a team effort.

It's bringing that team together.

Yeah, I, I agree.

And some, something, something that I like to do.

I know Tyler Ramsby also.

So Tyler Ramsby has the hack smarter community and obviously we've got the Pond Labs community.

But I feel like both of these communities are very encouraging to beginners.

They're very welcoming to beginners.

It's not really this kind of elitist thing that you can sometimes get, I guess.

But some, something that me and Tyler both like to do as well is we like to mentor people in our communities and this isn't like a paid thing, right.

And so people can literally just book a time.

So yesterday I had a really nice call with someone in our community and they're like 18 years old and not really sure what to do.

So I had a great chat with them and I feel like there's some things that give me a lot of pleasure and one is obviously learning and researching and seeing people, seeing people kind of change and improve and develop.

And so that's why I like mentoring people internally but also in the community that it gives me a lot of satisfaction.

In terms of me though, I think that, you know, I'm not just someone who is mentoring others.

I get a lot of, I get a lot of help.

And there's many times, Joe, where I'm like maybe second guessing myself about like and and so that's really where I kind of just, I have many people, to be honest, that I feel I can reach out to and be like, just have a chat with them and like, is this the right kind of approach?

Like.

And so again, it comes down to speaking with people in your community and kind of that kind of process of speaking with someone helps to kind of clarify things in your own mind, I guess.

Whereas if you're just doing something alone and to be honest as a founder as well, then it can be quite a solitary journey sometimes.

So yeah, I'd say for students, absolutely.

This kind of social learning side and joining a community where you can learn with others is the way to go.

Absolutely agree.

So one of the things I've always admired with Pawn Labs and your vision and taking the new journey and adventure is that there was definitely a massive gap and I do still see that gap.

And it's great that Pawn Labs is ticking a lead in that area which is around knowledge in cloud environments.

Specifically, you know, cloud misconfigurations about, you know, how, you know, to secure clouds.

What's the risks and vulnerabilities in cloud cloud environments.

So many organizations struggle with it today because, you know, finding knowledge and finding experienced people, you know, practical real world knowledge across a hybrid multiple cloud environment.

What do you see there?

Is that something that, you know, still.

Still is are we getting better at it or are we still a long way to go?

Good question.

So I'll kind of, I guess I'll start by saying that we don't just train people in PWN Labs.

So we kind of, we talk the talk, but we also walk the walk in terms of we do penetration testing across the cloud, AWS, Azure, GCP, M365 and on premises and web.

It's a mix obviously of configuration reviews and penetration testing and stuff like that.

I've kind of got an active GCP engagement that I've been working on this week.

And that reminds me, I actually need to work on the work on the, the report today.

So I've got that later on.

The fun part, the one that make the hardest part that people, people don't realize, you know, sometimes they see our job as, as exciting and fun.

But, but there's a lot of, a lot of the tough tasks in the background.

Such as writing reports.

Yeah, the easy part is actually hacking into stuff.

The hard part is the report.

What we're seeing generally, I guess in our engage that cloud is hard, just like on prem is hard in general.

Any sufficiently complex system is Hard to secure.

Right.

And I wouldn't say that cloud is necessarily more secure than on Prem.

On prem isn't going away.

It's going to be there.

It's going to be there.

It's.

We have data sovereignty and other other things that force that to.

To be in existence for a long time.

Exactly, exactly.

You know, you're right.

There is this kind of, you know, more a lot of companies are thinking about the cloud.

I'd say it's true to say that there is an or kind of a really strong trend for companies to you know, be implementing some sort of hybrid multi cloud architecture and you know, whatever stage they're on in that journey, whether they're kind of migrating workloads, workloads to the cloud or they're kind of thinking about it, many companies are kind of choosing bits from each cloud platform as well.

And if I was in a company, Joe, I'd be like, to be honest, I wouldn't use that service because I know, for example it's easy to enumerate externally for threat actor I'd use this service, from that one I'd use.

So I'd kind of cherry pick the services and create this kind of multi, hybrid, multi cloud environment.

And that's what a lot of companies are doing as well.

They're kind of choosing the best bits from each.

Obviously a lot of companies also are active directory in Microsoft shops and Azure and M365 just makes a natural transition.

Obviously there's really strong reasons for going for GCP and AWS in terms of the breadth of services available and the cost efficiency as well that you can get for some workloads.

There is also a, you know, it's fair to say as well that there is also a repatriation effect where companies try the cloud for certain workloads.

Realize actually you know what, it's probably better if we have this on prem so they kind of repatriate that.

But in general I'd say that Net net there is an increasing trend to the cloud and there is also this kind of assumption sometimes that you can take a workflow that existed on Prem and create it now in the cloud and it's just going to be secure.

You don't really have to worry about it.

But yeah, there's a huge need for people to be able to secure these cloud environments.

And for sure, like what what we're doing, which is obviously cybersecurity, cloud security and now AI security.

I'd say to the people who are looking to get a really good career that will allow them to kind of get enjoyment from their career and hopefully financially do very well as well.

Cloud security and AI and kind of, that's kind of at the nexus of three really strong growth factors.

And even with AI kind of being, you know, on that crazy journey since ChatGPT launched or even before that, right, where we're kind of worrying a bit now like, well, what's AI going to be able to do in two years?

And so everyone's kind of got this kind of feeling maybe that, you know, as a young person who's kind of like looking to get in, into the industry, maybe they're at university now, maybe they're just starting their career and they're thinking, well, what would be a safe bet for me that's not going to be completely automated in two years time?

Right.

What's going to be a position that's not going to be bought by the time, by the time you're starting your career?

Exactly, exactly.

And so that's why I'd say with AI obviously being cloud first, with SaaS being like it used to be, where you could maybe pwn an active directory domain and get access to everything inside, but more so nowadays it's like the actual secret source, well, not the secret source, but a lot of the important data is hosted in SaaS that is maybe authenticated using a Google login or a Microsoft login.

And so you have this kind of thing there where you can potentially gain access to all the data in the company without even compromising their active directory environments.

Yeah, for sure.

Cloud security is something that is growing for sure and on premises isn't going away.

It's, it's, it's going to stay there.

But if you're looking to get into the industry and you're looking to kind of, you know, you've got a choice.

I'd say that cloud security, AI and so these are careers that won't be replaced by AI, but you'll kind of be augmented with, it'd be an assisted,.

You know, with, with AI knowledge, you'll have lots of assistance helping you navigate the way.

One of the things I kind of, since you're into the continuous learning side of things yourself, what's the way that you stay up to date?

Is there, you know, events, conferences, casts, books, audiobooks, what's any, anything recently you've, you've, you've listened to or read that was insightful?

What's the way that you stay up to date?

And do you have also any mentors that you look to, for, for, for advice and direction.

Yeah, good question.

So I think probably five to ten years ago I was doing a lot of reading in terms of, of business because I realized that there's something I really wanted to get into.

And so I did a lot of reading on that.

But in, in terms of the technical side, it's, it's just every day there's like a blog article or something like that or some research.

And so how I stay up to date is I kind of focus on things that interest me.

If it doesn't interest me, I, you know, I don't really give it any time.

And so that's what I'd say to people as well, is to follow what your actual interests are, what you enjoy, because you're just going to learn so much more because it's going to be easy just to read something and learn.

So, yeah, that's how I stay up today is just through reading a lot of blogs.

There's some giants in the industry.

There's so many people in the industry who are doing amazing things and also share their learnings with the community and create a blog on it, or maybe they create a lab on it or however they do it.

These are people that I kind of learn from generally and just reading some of their articles, it's like, wow.

Like, for example, recently we had this whole thing with cicd workflows, embedding AI and LLM.

It's like I didn't even know about that, but this is this whole kind of attack surface that is really interesting to me.

And so I've, I'm planning a lab on this next, the next AI and Azure lab is going to be based on that.

So like GitHub Actions, embedding AI agents and moving into, you know, some really fun exploitation steps after that.

So I learn a lot through creating, honestly, through researching, creating scenarios.

It's, it's what I, it's what I enjoy.

Like, I probably wouldn't be doing this if I didn't enjoy that.

Right.

So that's, that's kind of how, how I learn.

Conferences and stuff like that can also be interesting.

Listening to people, sharing their experience and having different perspectives is something I like as well.

But yeah, generally it's kind of also in the community.

There's lots of people asking questions in the Pone Labs community like, oh, what about this, what about that?

And inevitably, even if I'm in the middle of something, I'll kind of probably stop and I'll chase down a rabbit hole and find out the Answer and kind of learn something along the way as well.

I'll definitely make sure that for the audiences, you know, for the.

For the Porn Labs Discord channel, I'll add the link to the show.

So they do want to participate and join the community.

They have an easy way of finding it.

I appreciate it.

Thank you.

If the audience does have any questions or want to follow up or want to contact you afterwards, just to kind of get some insights, some direction, what's the best way for them to reach out to you?

Well, that.

That would be amazing.

Firstly, so on.

On LinkedIn, you can reach out to me there.

Happy to have a chat.

Discord.

I'm kind of.

That would be a really good place to reach out to me.

My name is.

My handle there is E G R E55.

And I'm kind of in the top.

Right.

If you just click on me, you can send me a message.

Honestly, happy to chat about anything, whether it's your career, if you need.

If you, you know, you'd like some guidance or just someone to talk to about something.

Always happy to jump on a call or, or just have a ch or whatever.

So, yeah, LinkedIn or Discord would be the best places, I'd say.

And yeah, Ian, it's been awesome having you on.

It's really great to hear the journey that you've been on and what you've been up to these last couple of years.

It's always fantastic.

And what you're doing for me, you know, is you're making the learning path and the knowledge path a lot easier for many of us who need it in the industry.

So thank you for everything you're doing.

So for the audience, hopefully this has been interesting, valuable episode for you.

Lots of learning, lots of new things, lots of places to go and look into.

Search and see if you can actually find more possibilities to learn new skills and find out new platforms.

So for the audience, this is the security by default podcast.

Tune in every two weeks for new episodes, new guests and new insights.

So everyone stay safe.

Take care until the next time.

Thank you.

Thanks, everyone.

Thanks, Joe.

Appreciate it.