Hacking, cybersecurity and the risks you can’t ignore

* Transcript created by AI – may contain errors or omissions from original podcast audio

If you haven’t put much thought into cybersecurity, this episode is gonna make you think really differently. Today I’m chatting to Martin, the founder of Vertex, around why you should be prioritising cybersecurity and some practical things that you can do to keep the data inside your company secure and safe from attacks.

This episode is a must listen, so make sure you stick around.

Welcome to the Intentional Money Show, where we talk business growth, profitability, mindset, and building a wildly successful creative or digital business without sacrificing your life in the process. I’m Clare Wood, business profit coach, speaker, author, and unapologetic believer that you can build wealth and freedom doing work you genuinely love.

Each week on the podcast, we dive into the strategies and honest conversations that will help you scale sustainably, increase your profit, and build a business that actually feels good to run. Let’s grow your profit.

A big warm welcome to the podcast, Martin. Would you like to introduce yourself to the listeners?

Thanks, Clare. My name’s Martin Boyd from Vertex Cybersecurity. Been doing cybersecurity for as long as I can remember of been playing with computers, and was the former executive manager of cybersecurity for the Commonwealth Bank of Australia, and now the founder and CEO of Vertex Cybersecurity, where we help hundreds of businesses not get hacked.

Yes. And so why… I- let’s just start right at the beginning. Yeah. Like, how did you get into this?

Look, I think it comes back to curious, you know, and being very technically-minded and focused. So wanting to understand why things would work, what would happen, what happens if you push this button and twisted this dial, and naturally that leads to understanding how computers work and coding, and then that naturally leads to, you know, the internet and connecting to, to do more.

And, and then naturally a pathway of when you’re blocked by username or password, how do you get past that? And that’s just as a curious kid, and then from there, you know, you realise there’s actually business value in these skills. Amazing. So it started out just having a curious mind. Did you go and do official studies or did you just start teaching yourself how to code?

I was probably around 14 years old and had learned to code from online information, and in that time it wasn’t as much information, so it was actually through chats with other people that were online, other randoms. And from there, you know, I just learned more and, um, got part of certain communities, groups or forums and, you know, shared thoughts and ideas around coding.

But I, it was almost more interested in, in, you know, uh, rather than building but was able to see and explore the world of the internet. And as part of that you would get stuck with username and prompts not allowing you to access certain things and, and like, why are those there? Why should they not let me access information?

How do I get past those? And, and then that was, yeah, part of the, just the curious to learn and find and see what was there. And as out of that, that was actually a skill to understand how to, to build and part of that being knowing how to build is also and then how to, to break into it. And, uh-

So let, let’s just call it what it is.

It’s hacking, right?

Yeah, absolutely. Yeah, correct.

So when was the first time you thought, “Oh my gosh, I can’t believe that I hacked…” Was it a password or h- what was the first thing that you had a moment where you, you got into something and got really excited by it? Yeah. Look, I think, I think the initial stuff which gets you interested is, you know, you, there are access to, you know, already known usernames and passwords and so, you know, you can use those to get an access to certain things.

Um, there was… I think the first one was actually, there was a radio station competition and, uh, you know, you just had to, uh- You had to submit at a certain time to get certain rewards and, um, and it was always on during when I was at school. So I, I was never, you know, at my computer to be able to do it when I was at school.

So I found a way to access them before they released them, and so… ‘Cause I just, you know, in my head as a, as a kid, I thought that was unfair. And it wasn’t that I was trying to, to cheat the system, I was just trying to get my turn in the queue, which, you know, I, I felt like I, I was disadvantaged. And so, you know, naturally I, I did that and, and got a number of pr- uh, award, like you know, you know, just little rewards, shirts and tickets and other stuff, nothing.

Just managed to get to the top of the queue. And I still had to earn credits to spend them, so it’s not like I had actually gained anything. It was more just I was able to get to the first of the queue so I would always be able to get what I, what was on the option, ’cause they would run out and sell out very quickly.

And so, yeah, that was one of the first things, and it wasn’t probably till they delisted or blocked my account that I realised, oh, I probably shouldn’t have been. Um, and then, you know, yeah, it was kind of, you know, well, what else, what else in the, in, in there is, is being blocked or that I’m interested in and curious and, and that sort of just expanded from there.

That’s so cool. So how many hours a day were you spending on your computer as a teenager, out of curiosity? See lots, lots. So I mean, I, I wasn’t measuring- Yeah, you’re trying to fit in school there as well. Yes. Yeah, I, I’d be spending, yeah, at least four, five hours every- Wow … every day just playing with stuff, trying stuff, practicing stuff.

You know, on the weekends spend 12 plus hours just, you know… I, um, and, and it would include playing games as well and, or, you know, just exploring and, and trying things And then look, it is, it was really just a matter of I was wanting to, to learn more and curious and, uh, excited and engaged and so, you know, just focus on it and just be plenty time.

I mean, my, my biggest problem was there was a point where I played a game so much that I could see the game even when I wasn’t playing it. So there’s certain health bars that you have in certain games, and so they generally stay around the, the same… They, they stay in the same spot of the screen. So I played the game as…

That I’d burned in on my eyes, that if I looked away from the screen, I could still see the health bars. Um- Wow. That’s scary. Yeah. Yes. So- That’s a, that’s a lot of gaming. Yeah. It’s a lot. So yes, I, I spent a lot of time, um, on the computers and on all sorts. And, you know, a variety of things as well as you’d get games and you’d…

The games would restrict you from playing it on a new computer, so you would have to, you know, crack it so, you know, you didn’t have the license or whatever. And look, I’m very pro giving back reward for work that is done, so, you know, paying for games and paying for activities ’cause, you know, it’s, it’s a value-based system, and it’s how the economy works and how…

Make sure you get more of it. But obviously there was, yeah, in, in the, in the kid mode of, of trying to discover and learn things and hitting blocks and issues, you played with, with all sorts of different things. Everything was just a problem or a challenge to solve, to be honest. And, and what I’ve learnt since is actually I’m, I’m very good at solving problems and seeing patterns and getting through challenges and, uh, and I just applied that to computers, but it d- it also works to other things including cars and houses and other non-technical problems.

But, um, I’ve just looked for the hardest problem I could and, to be honest, the, the technical problem or cyber problem is, is being, is one of the hardest problems that people haven’t been able to really fully solve. Like, companies are still getting hacked, and so for me, that was one that wanted to solve.

And so, you know, that’s essentially what we do at Vertex and what we have done, which is why we have hundreds of companies that have never been hacked. But it is, it is complicated. Cyber security is not one problem. It’s like 100 problems, and so they all have to be solved simultaneously to get yourself secure.

And, you know, if I use the analogy of a, of a house, it’s like, you know, you need the skills of a, of a locksmith to, to lock your doors. You also need, you know, um, a glazier to- to secure your windows. You need a tiler to, you know, secure your roof, you know, and then you also need a fencer to secure your fence a- and so forth, right?

And concrete and foundations and, and so forth. And so if you think of it like from that perspective, it’s similar in cyber. You’ve got, you’ve got like 100 of these different things. All of them need to be secure to make sure not one of them is a, a weakness allows you to be compromised or hacked. And it makes sense that, for example, if someone had never thought…

Like, let’s go back to the locksmith example. If someone had never thought like a criminal and they’re designing locks, I wouldn’t… I would just think this is the one way of doing it because I’d never been in the position to go, “Well, how can I get into this house?” And so it would actually make you a lot better at your job, the fact that you are having that different perspective of, “Well, how…

If I was trying to get into there, what would I be doing? How would I be trying to get in?” And then that way when you’re building the, the, you know, the protection, you’re doing it with that perspective and that experience and that knowledge. So can we go back a bit? Sure. Because we sort of jumped ahead a little bit here.

So y- you’ve gone from you being a, a t- a curious teenager, you know, heavily excited and interested in this space, to then you actually making a career of it. So can we talk about how did… Who first paid you? How did you first decide that this was something you wanted to pursue professionally? Yeah, so of things, but in between that time I also ran a, a web hosting business of my own with a friend, and then obviously went…

I did a number of different jobs, some technical, some non-technical, and then went, worked at… And so, like, some, some of the technical ones I worked at a IT place called Hash Technology, then worked at Dell, and then also worked at managing, uh, IT for a school, and then managing IT for a, a non-for-profit called Wires.

So it, it was a, a mix of a variety of things. And, and lots of little side projects and friends and things also through, through uni and, and also my own activities. And that was all before I even would classify a career. ‘Cause it wasn’t ’til after all that I then started at CBA where I, um, I was the, uh, infrastructure manager for, um, the business intelligence, which was sort of the data warehouse and the reporting and the systems for the entire bank.

And so that’s probably where the formal career started but, but obviously had done up until that point probably more than 10 different jobs, and obviously lots of just experimentation and playing o- on my own from, on that perspective. And when you’re in, when you’ve gone into a, I guess, traditional corporate role, I can imagine it must be quite frustrating trying to explain technical things to non-technical people.

Did you have that experience when you were first sort of working in this space? You were trying to explain to people what risks might be or why you’re doing things the way that you’re doing it, and people not really understanding? Yeah. So interestingly, even in that corporate space and, you know, this is sort of showing, showing my age a bit, but, you know The risk was still not a universally sort of business known term, and even cyber wasn’t even known at that used as a term.

It was sort of IT risk. And in those times it was just, it was part of the IT’s job, if that makes sense. So it would be you had to manage IT systems and you also had to manage the security and, and risk of them, and that was just all sort of a bundled up kind of thing. So it wasn’t… Which kind of ties into where I went to is, and look luckily at that, at my, my first role, my, my executive manager at the time was, had a sort of a, a technical background or history, so it was easier to have that, that conversation.

And to be honest, you know, he was great at letting, giving me freedom to go to, to do and, and take tasks and trusted me in my actions, which was a really good sort of, I guess, start, which allowed me to just get into it and not have to worry about too much about having to communicate, more just about getting things done and getting those technical items managed.

And but, I mean, interestingly through those times, I, I had identified some major security risks, which were obviously huge concerns, which, you know, uh, which then, you know, I took the action on to, to resolve. And look, you know, just to give you perspective of, of the time at that starting point, and you know, I would say CBA’s, you know, just before, preface that is, is I think they do more in security than any other bank that I’m aware of.

So they’re really good at it. At the time, and this is rewinding the clock a long time, and this was the industry norm that I identified, you know, a major security issue with the, the major database and I was trying to get that fixed and changed and everyone was like, “Is this a problem? Should I need to do this?

Do I really want to?” And everyone was basically saying it, it wasn’t a priority to the point where I had to go and escalate to, you know, you know, it was another team which also makes it challenging ’cause you needed to get the other team to take the action. But to the point where I, you know, I had to escalate to the general manager and, and I think even above that as well, just to be like, “This is, this is really bad.

Like, if we don’t fix this now it will blow up.” And at that point they’re like, “Oh yes,” you know, they agreed and they’re like, “Yes, okay, I guess we should do it.” Wasn’t formally logged or documented anywhere, but you know, they, they basically gave the approval to the other team to do the steps that, that needed to occur so I could do my steps and, and then it got resolved.

But, you know, in today’s terms, that would’ve been raised, would’ve been addressed, would’ve been… And people would’ve valued it and done it, whereas in the time it, you know, required multiple conversations, multiple convincing multiple people, escalation to get resolved. So, you know, times have changed, um, and now, yeah, risk and cyber are a lot more well understood.

And so to that point, I-

After a number of y- years, uh, working and managing those systems, I then moved to manage the systems for risk for the bank. And interestingly, while I was there, we built a central risk platform for managing, tracking risks within the bank. So just to give you a picture, prior to that it was not even properly tracked.

And from there, um, and once again, I had to manage all the IT security, cyber security for the, um, the risk systems. So that’s… The risk systems are the CRO, the CRO’s IT basically for the bank. And from there I had to… You know, after man- man- managing not only understanding the risk across the whole bank, but also security and cyber security, I then obviously went into a dedicated cyber security role, and that timing was also sort of the same time where people actually started to value cyber security as a dedicated, specialized, valuable function.

And obviously in that time that’s when I made the move into the executive manager of cyber security for Commonwealth Bank of Australia. So hang on. Can we… When you first come into… ‘Cause instantly my accountant brain says,

“So hang on. A bank has let someone who is hacking…” I don’t get it. But, but objectively, like, did you have to go through security clearance? How did they… How were they managing the risk around having people with your skillset coming in? Does that make sense? Sorry. Sure. Um, I mean, I guess there’s two parts. I, I never admitted and I never got caught, and I never did any damage, so no one ever technically knew.

So it’s an interesting one that it’s funny ’cause people talk about hackers that got caught and got the police and, um, and they’re revered as these skilled, um… And they have, you know, police records against as these, um, as these skilled hackers and, you know, without, so- Are you, are you thinking that they’re not as good as the ones that didn’t get caught?

Uh.. Exactly. Yes. Exactly right. So yeah, so the answer is, is they never had the information, they just knew I was highly technical and that they needed that skillset. And look, you know, to their credit and, um, and whether it’s luck or… But, you know, from my perspective, the reason I’ve gone down this side is, is, you know, yes, I, I will admit that very long time ago I gained access to a whole bunch of systems, but I never did anything with that access.

So, you know, my ethics are never to do, you know, any, any harm in that regard. And so, you know, what I realized is, is it’s… I’m one of the good guys, I can’t even be bad if I wanted to. I could probably have made a lot more money with my skillset being bad than I could being good, but, but it’s just not in my, my, uh, my values or my, my soul to do that.

From that perspective, I’ve focused on the re- reverse, which is stopping, using those skills to stop the bad guys and, and protect companies. Cool. So when you were in that role, you then obviously started to be seeing how s- I guess even for a huge company like CBA, how vulnerable systems can be. And, you know, I’m ex-CBA as well.

I know how… It’s such a big company, and there’s so many potential areas for things to go wrong, really. And so I guess that that would’ve been an immersion into fire in terms of learning about creating security. And I presume that things still go wrong. Like, when you were in that role, I presume that things would still happen all the time because of a, the nature of a company that big.

So if I mean… Look, obviously, you know, I probably sh- shouldn’t talk too much specifically about CBA just for the fact that, you know, if, if we actually zoom out a little bit in what we do at Vertex, and across every company that I have ever seen, I have never seen a company that doesn’t have security issues that needs to be improved, and that’s just an industry problem, and that’s not limited to anything.

And the answer is this, you only have to look at the public companies that have been breached- Yeah … to know that there’s a lot of those issues. And statistically, yes, the more systems and pieces and problems and other things you have, the more issues you have. And so, and, and that’s why that’s a job, right?

And the job is you’ve gotta put in the effort to secure these things. It takes time, effort, and energy. Once again, the, the two biggest trends that I see companies getting hacked come down to one of two things, and I can… Basically every time a company’s get hacked, I can pick to one of these two things, and it’s, it’s really either, A, they spend little to no money on cybersecurity, so basically they don’t value it; or B, they have internal people managing- their cyber and they’re not…

And because of their limited experience and exposure because they’re not getting what’s seeing like, not seeing what the latest threats are or the latest attacks, so they’re not seeing what other companies… are happening to other companies. They have stale information and they get overconfident, and they think they have it all under control.

So the two biggest indicators that comes with a hack is either, A, they’re not spending anything, or B, they’re fully reliant on a, one or a few internal people who say everything’s okay. And then it’s… And so those are the biggest indicators that I’ve seen. Every company that’s ever been hacked is basically they’ve made a decision internally that they think it’s under control and that it’s okay and, and that they’re the experts in it without actually consulting an expert.

And when do you find that people make the decision and say, “Oh my gosh, I need to take this seriously”? Is it usually after a breach? Yeah, usually. And the, the s- the psyche or psychology seems to be that the closest I can find to it is the Dunning-Kruger effect, which is essentially that people have a lot of confidence when they don’t have much information on the topic, and they think they’re making the right information.

And that is ultimately breeds to a point of they have a, a lot of, uh, a lot of confidence in their… in doing very little, and then naturally they get compromised. And, you know, I, this is where I sort of share a story of a company, you know, just to… Um, and, you know, interestingly, I got a call yesterday from a, from a company who I’ve been talking to for years, and he…

they’ve just had a, a near miss, so, you know, a potential cyber incident. And, you know, now they want us to get involved and move quickly. And it’s, it’s… I see this on repeat. And the other example I, I’d, I’d give is there was a company we were talking to, and we had, um, done some penetration testing for them.

And as part of that we said, “Oh look, we should really do some other protections around, around, uh, your phishing attacks.” And the response that I got from the business was, “We don’t need those. We don’t wanna… We don’t need to, we don’t need to spend that money. We can save that money, and it will be easier.”

And so the phishing protections we were looking at were, for a company, was the equivalent of a- $100, uh… Yeah, I’m just trying… It was probably, yeah, sorry, 1,000, $1,000 per, um, per- Per head. Is that right? No, sorry, $100. $100 per head. But yeah, so it was about $100 per head. And, um- And they said to us, you know, “Oh, that’s gonna be too much money.

We don’t wanna spend that money. It’s too expensive.” And so I said to them, “Yeah, but what about this risk? What about this issue? The, the attacks are coming. They’re very good. They’ll catch you out.” And they said, “We would never click on a phishing link. It’ll never happen to us. We’re smarter and better than that.

It’s not gonna happen. We don’t need to spend the money. You don’t know what you’re talking about. You’re not an expert.” And that’s when I said, “Well, you know, have you seen this happen many times? If that’s how you think, it’s probably more, actually even more likely to happen to you.” And so then I actually talked to multiple people in the business because I was just genuinely concerned and worried for them, and I had multiple conversations to them.

And they’re… And in the end they said, “Oh look, we’re just going to accept that risk.” And what I’ve realized is most people’s brains are not very good at understanding risk, ’cause risk is almost the ability to predict the future. And let’s be honest, we’re… That’s a hard task in itself. And so in short, they were– The, their response was, “We’re just gonna accept that risk.

We’re not gonna spend the few thousands of dollars because it’s not gonna happen to us, and so we don’t need to spend that money.” Anyway, fast forward four months and I get a call and they say, you know, basically they’ve had an incident. And the long story short of that incident is the people that said they wouldn’t click on a phishing link clicked on a phishing link, lost access to their account, redirected funds The funds were hundreds of thousands of dollars of funds that were redirected and essentially, you know, it completely changed the trajectory of, of that business.

And obviously a huge amount of, huge impact. When they got us involved, we had to investigate. That cost more than the protection would’ve cost them as well, and identified what had happened, and they had to use that then to try and ultimately save the business and, uh, and, uh, you know, it was, it was a huge challenge for them.

And so, technically you would say that they’re no, uh, no longer, uh, an existing business. Had to make drastic changes because of that single event, um, not to mention the money. It’s an interesting one. You can have the conversation with people, you can explain it to them, you can tell them, you can tell them what the likely outcome is going to happen.

But comes that Dunning-Kruger in that unless people have seen it and lived it and understand it, they just don’t value it. They don’t value expertise, and so they continue to make their own decision. And, uh, and look, it’s… Look, we all face that issue. It’s, it’s a challenge because if we haven’t seen it or lived it ourselves, it’s hard to value or see someone…

And so if I look back to the locksmith one, which is a, which is a good example, the, the locks were actually invent- They were invented in the late 1800s and, you know, I mean, prior to that, most people didn’t have values that were worth locking. So it’s an interesting one. It’s also a sign of when as a society we actually had excess wealth.

But the interesting thing about this is, uh, it sort of became mainstream in the early 1900s. And so anything, anyone prior to that time period, you know, I assume if you asked them and talked to them about a lock, probably would’ve said, “You don’t need one. Why would you need one? They’re silly.” And then eventually, you know, over a period of time, lots of people and lots of thefts and lots of issues, and eventually to a point where now it became standardized, everyone had to have a lock.

Mm. And so if you fast-forward 100 years to now, a house comes with a lock and everyone has a lock, and everyone’s… The default is use a lock, and that’s the same thing. And so it’s a little bit harder with cyber because it’s less visual, it’s less direct, it’s less in our face, but it’s going to take us decades for everyone to get through this.

And unfortunately, people are going to have to learn either the hard way, um, or the easy way. And, you know, either learn from other people’s mistakes and pain or, or go do it themselves. But coming back to your ans- your original question, yes, most people are still waiting before they feel the pain themselves, before they believe it, before they take action.

Yet, even though it’s all in our news, their, their view is still, “I haven’t seen it happen. I’m still an expert in this space. I still am able to make a rational decision and believe that it’s not going to happen.” And I think I can appreciate why people are having that quandary. We’re all doing it every day in some way.

You know, I know when you talk to an insurance broker and they’re like, “You need to be insured for this and this and this and this,” you think, “Well, that would cost me, you know, probably my salary if I was insured,” as you were saying, that I’m insured. Um, and until someone has had the experience where they think, “Oh, damn, I wish I was insured for that,” then that’s kind of when the penny drops.

I know that phishing, I used to think, “What kind of person… Like, how do people fall for this?” And they’re getting better and better. Um, uh, y- I’m sure you have seen it all. What’s been the… Specifically around phishing, what’s been something that you’ve seen that, um, you know, five years ago wouldn’t have even been a, a thought or a concern?

Yeah, so, uh, there’s two things that’s obviously moved. Obviously, A, the cyber attackers have just improved their craft and capability, so it, it has improved. The other one is obviously AI has come in, which has now made it easier for cyber attackers to create perfect, pixel perfect looking phishing attacks.

And so, and do it at a speed that before would’ve taken them half a day to do, can now do it within, in, in seconds or minutes. And so that naturally allows them to create customizable, perfectly looking phishing attacks and phishing websites that previously would’ve been limited or detected or taken down.

And so naturally we’re seeing more attacks. The thing I would say, and to make it very clear, is the majority of people that we see click a phishing link are in that same thought beforehand. They do think, “I would never click it. It would never happen to me.” But the, they work… The, the attackers work on the bulk idea of if they send enough, eventually they’ll get you at a weak point.

And a weak point could be you’re busy, it could be you’re under stress, it could be you’re in the middle of a number of different issues or problems and, you know, or it could be that you… They’ve created a sense of urgency. And so, uh, what- It could be someone in your team. It could be… Um, and I s- I heard something the other day that they are able to fake URLs so that it actually looks like it’s coming from a legitimate URL.

Um, there was something I saw in the news about that now you can’t even trust by clicking on the URL and confirming because they’re able to create fake… Have you come across that? Yeah. Or is that… Yeah, so what they can do is they can create extremely lookalike URLs that look so similar that you wouldn’t be able to determine the difference by visually looking at it.

And, you know, part of the issue is, is there’s a lot of languages in the world, and so they would… Their O looks marginally different to an O that we might use, but underneath it, it’s actually a completely different O. And so what that means is visually we would look at that and we would not be able to discern the difference to it than what it would normally look.

And that’s why it’s, we… For a lot of the phishing attacks, they are trying to gain your logins or gain access, and which is where a password manager is actually helpful because the password manager actually checks that technical URL is actually exactly what it needs. And that’s, that’s one of the, one of a number of measures that we would roll out as a, as a minimum or recommend as a minimum to make sure companies aren’t easily tricked by a, a exact sort of looking URL, even though it’s not- What do you mean by a password manager?

Like a, a platform that- Centrally holds all of your login details Yeah, so we’ve reached a digital world where every, every website that we go to needs a different password, and humans, we are not designed to remember passwords. Our memory’s actually pretty, pretty bad. And so what we’ve identified is, is as a human, because we can’t identify passwords, but every time we give a password to a website, we’re sharing them a, a special secret value, and we wanna make sure that they…

the password that we give them is different to other website passwords. That way if they misuse that password or they breach that password, it doesn’t allow access to other websites. And so the challenge is though is now every website needs a different website, and we know humans… every, every website needs a different password, and we know humans cannot discern the difference between all those different…

or cannot remember all those different passwords, then the answer is a password manager. And so what it does is, is it’s a tool that allows us to put, uh, all our passwords in it and basically secure it with one good, strong known password as well as with MFA. And so that allows us to have it all sort of within a, a locked box.

And so then whichever website we go to, um, we can then pull out the password specifically for it from our locked box- our locked box or password manager. Can I say something that terrifies me about this as someone who has a password manager? Yes. I always think, “But then it’s all in one freaking place.”

It’s the same as at home, I’ve got a safe. Yes. And I’m like, if someone broke in, it’s like everything’s in one spot ready to go. So- Yes … surely those companies are susceptible to people. Like, if anything, a password manager platform would be… Surely cyber criminals are like, “Let’s go for that. That’s the money pot right there.”

Absolutely, and that has happened. So LastPass has been hacked multiple times. Um, they are a password manager. So based on the fact that they have been hacked multiple times, we would not be recommending using LastPass. But yes, they are a target. They are become a honeypot. The, the advantage though is this password that you use for your password manager is used to protect, encrypt all your passwords.

So as long as your pass- that one password you used is strong and secure, then even if, in the case as an example of, um, LastPass being hacked, they have your encryp- it’s all encrypted, so they still need to know your password. And so what happened with the, the LastPass breach was people that had weak passwords, they were able to gain access to all their passwords within that.

The people that had strong passwords, they were still protected. But even so, recommend obviously- Not only using a strong password, but picking a strong password manager. So the one we recommend, which you can actually create free accounts on when I last saw, um, is Bitwarden. And so that’s one you, you can sign up and create a password, and it’s one we, we recommend.

And then you can sign up for a, a paid plan if you need to share within your team, uh, which we also do, um, reseller’s convenience for our clients. So question, why would commercial organizations be saying, “Come keep all your passwords here and keep it safe here, and we’re not gonna charge you any money for it”?

So I… In accounting land, there’s an accounting platform that’s free, and, um, a few people have asked me about it, and I said, look, I d- I don’t wanna badmouth that platform, but objectively I am like, if they’re not charging any money, how is this enterprise operating? And I’d be really scared. I wanna be paying money for a platform because I wanna know that they’re investing in cybersecurity and safety and all of the things with my financial data.

Wouldn’t it be the same with passwords? Uh, yes. I mean, it all comes down to the business model. And so, y- you know, with Bitwarden, they even provide the code for their platform. They open source that so the code is available. So they’ve come from it, you know, and, you know, which is one of the why, reasons why we do recommend them is they’ve come from this point is that, you know, it’s really important that this is done right and securely and there’s transparency with it.

And so the way they’ve done that is through being sharing of their code, as well as they said, look, for people that are individuals and can’t, are struggling to, to do this themselves, we will provide this as a free starting option. But ultimately their business model is based on trying to either, A, hopefully you use it and enjoy it and you, you upgrade your, upgrade to a paid plan or B, you know, you move to a, a business plan where you now need to share it across your, your businesses and, and pay for it.

Which is one of the reasons why we do not only pay for it for ourselves, but also we do resell for our clients because that does support their model to then also allow it for, you know, the few, the, the individual side of it as, as well. But yeah, look, it’s absolutely a question. Um, there’s the… There’s, there, there are other companies out there that, that also provide free options like Duolingo, and that’s paid mostly by all the people that are…

‘Cause the ads don’t actually, that you get, they don’t cover the actual fees. It’s all paid via the paid users and full transparency that, you know, that paid people are subsidizing all the free users. But obviously the free users are using a subset of the fractional capabilities. So in that regard it’s less of a, uh, it’s less of a, a, a load on them and a cost for them to provide that.

Cool. I wanna go on a bit of a segue here. Something that just sprung. What are some things that people wouldn’t even think that they need to be scared about, whether they’re in a business owner capacity or in corporate? What are things that people are like, “Oh, it doesn’t matter. I’ve got nothing to hide.

I don’t really care.” Why should people be really concerned about cybersecurity and what could be accessed and what could be done with it? Yeah, I think- So the, the thing that we do see constantly is that the harm and damage or the issues that they believe will happen are not relatable to what will happen.

And so we do see that constantly and, you know, if I give you the example, most people will say, “Look, what’s the worst that can happen? They have this data.” And so the example I give for what’s the worst that can happen from a business perspective is the example of Leviticus Capital. So a lot of companies do close and have issues ’cause of cyber incidents, but all of them are too embarrassed to admit it.

Leviticus Capital is an example where the CEO himself, he was hit with a phishing email. He was compromised. The attacker created fake invoices up to $170 million. 15 million of them were paid or stolen and they couldn’t, they couldn’t get, couldn’t get back. And so they had to go back to their, uh, fund, you know, investment fund.

They had to go back to their clients and say, “We’ve just lost $15 million,” and all their clients left, and the business is now permanently closed. So it is bus- that one cyber attack not only took 15 million… Uh, sorry, yeah, $15 million, but also ended the business. And this is not something that happens as a once off.

This happens a lot more often and a lot more regularly. It’s just in the shadows. It just doesn’t get talked about ’cause naturally people that have said, “It’ll never happen to me. I’m smarter than that. I’m not silly,” and then it happens to them, are too embarrassed to come out publicly, and they just naturally end the business.

So the harms and impacts to the Australian e- economy and to businesses is in the, is in the billions and is, and is growing. But a lot of it isn’t being talked about and which makes it harder for us to actually learn from it as a collective, and so everyone’s almost learning from it as an individual, which means everyone’s having to feel the pain individually before they, they learn from the reality of it.

In the year 2026, if money gets stolen, can’t the police go track down who the hacker was and get the money back? So the, the transfers all… are usually transferred internationally and once it goes internationally, the money gets put into accounts in Australian… And this is the i- the issue with, with international lawyers is, is limited to, to take a response.

Yeah. Right. And so what are some other sort of hacks, like that’s one example. What are some other ways that companies could be compromised asides from financially, and what would that look like? Sure. So there’s a, a company in, in, uh, Germany recently, 35 years old. They do transportation, moving vehicles back and forth, and you would think that- What, what could cybersecurity, what could an attack do there?

Oh, you know, they’ll know that a truck is carrying donuts from one town to another town. You know, this kind of thing people think, “Oh, how bad could that be?” In this example, the cyber attackers ransomwared or basically encrypted their systems so their systems wouldn’t work. What that meant was is their systems weren’t able to provide the information to the drivers to, to, to do their routes.

They weren’t able to get the requests from their clients for the routes to, to do their deliveries, and then they weren’t able to do the billing for these activities, they were able to charge for it. So they tried to obviously move it manually and try to work around and do all sorts of things, and try to recover for it.

But in the end, they weren’t able to, and the end result was, uh, the business had to shut down due to insolvency. So there’s a… So I mean, there’s an element of having availability, having access to your data, having access to your systems, being able to do your just regular business. We had a… And, and I mean, you know, I’ll give you an- another company a- and that company is, that’s a publicly known, known story, so you, you can access it.

Um, but we, we had a company reach out to us and so this is not known, so I’ll keep it anonymized. But they reached out to us and said that, you know, they had a ransomware attack, they needed help, and so they reached out to us to help them out, and we got involved. And we found that they’d actually been trying to deal with this themselves for the past week, and only getting us involved after a week of having issues.

And once we got involved, we had… Then, and the reason they got us involved was they’d real- they’d lost access. And so there’s a, a technical term called domain admin, which is kinda like full ad- admin access across everything. And so not only had they been removed from access, so they no longer had ac- domain admin, but the attackers had domain admin access, so they had access to everything.

And, uh, in that case, you know, we had to regain access and kick the attackers out and get them back up and operational. And together, we were able to turn that around and get them operational within about 48 hours. I suspect, and that because, you know, key systems that they need to get up and running were obviously payments related, that had they have taken longer, had it not happened within that timeframe, there’s a high chance that this very well-known company would’ve had to enter, uh, insolvency themselves So it’s, so there’s, there’s a huge amount of just being able to do your job, being able to access your files.

There’s a passive reputation in, um… as we know, you know, Optus had a drop in the number of sales post the cyber incident. They also had huge fees, fines, sorry, for it, as well as huge costs related to resolving it. It is… And the one thing that I’d say to anyone is dealing and talking with people when they’ve dealt with a cyber incident, the…

u-unfortunately, a lot of them that are quite white in the face, you can tell it is essentially the worst day of their entire life. The nearest feeling that I could tell people, it would be to them, it look- it’s almost like losing their child ’cause, you know, for a lot of people building their business up and spending 5, 10, 20, 35 years building it, and it to be lost overnight because you clicked on a link and you didn’t wanna pay, you know, um, a few dollars for protections, is absolutely soul-destroying for these people.

And so having obviously dealt with so many incidents and seeing them, it is absolutely one of the worst things that could happen in your life. And so from that perspective, the simple thing is reach out, talk to a cyber expert, and start. It’s not the… It is confusing ’cause there are a lot of cyber people pushing a whole bunch of different products and solutions, and the answer’s all of it.

But, you know, reach out to a company, cyber company you can trust, like Vertex. And rather than looking at having to do the whole kitchen sink, just start with the basics. Start with some of the simple things. Spend a little bit of money and work your way on that cyber journey of journey, and start to improve it and start to get yourself into a better place.

And that, once you start, what we do see is most, pretty much all companies start to realize that there was a lot more gaps and issues than they realized, and they realize that it is worth putting in the extra protections in place. Can we take a bit of a segue, um, like talk about some other things? I saw on the news that someone was a- and I, I guess that this is really relevant to business because it shows how vulnerable, I guess, technology can be.

But I saw someone showing how easy it is to hack into a Roborock or a vacuum cleaner, like a mobile vacuum cleaner in your house. Is that something like, do you think that would be pretty easy to do? So the, a lot of embedded devices have very little to low security, and that’s purposely ’cause they’re designed to be really cheap and really available.

And it’s, uh, interesting, I just came from a, a conference yesterday where they’re talking about embedded devices, and it’s a, it’s a common issue that most of hardware-based items are easy to compromise, easy to hack, and it’s by design ’cause they weren’t actually designed to be secure. And so as a industry, there is a movement to work on increasing the security of it.

The challenge is, the, the issue is, is also struggling with the fact that a lot of these devices have very cheap components that don’t have as many options to secure them. And so it’s a little bit of a, a challenge in that space in regards to consumers don’t wanna pay, pay as well as businesses don’t wanna pay significantly more for entire complex computer chips that have a whole bunch more capability.

But at the same time, at the same time, the, the cheaper ones don’t have all the security capabilities that you would want and expect in current modern computing. And that’s because they’re trying to be cheap, they’re trying to be embedded, they’re trying to use low power. And so the, the secure versions are more expensive, use more power and, um, yeah, add to the complexity.

So it is a chall- it is a, an issue. A lot of hardware devices have known vulnerabilities or are easy to hack or have usernames, admin and passwords as password. Uh, and the industry is, is still playing catch up and in some cases, some cheap items from, from overseas countries are purposely not secure because they are just keeping them very cheap and affordable for everyone to buy.

And so it is a huge issue, which is why what you buy and where you buy it from and how much you pay can impact whether you have something within your home, um, or within your business that once plugged into your network becomes a, an easy access point for an attacker. And so someone could literally be able to see the insides of your office or your home.

Is that the same with your computer and any other devices with cameras in it? I’ve, I know I’ve been to doctor surgeries and they cover the camera and I, I don’t know if that’s paranoia or if it’s possible for people to be visually breaking into cameras through computers. Yeah. So once again, de- depends on the device, right?

And so if you go to, you know, like CCTV cameras, which are now commonly connected to networks, there are, you know, what I would keep call cheap CCTV cameras, which, you know, have had numerous examples of being hacked and compromised, and people able to identify. And there’s even websites you can go to where you can literally just look and view random people’s cameras.

But on the other s- end of the spectrum, there are more ex- more expensive high quality CCTV cameras that have security embedded in them and have appropriate controls in place. It’s the same, um, I would say with computers, you know, it’s not related to the computer, but it can be down to either the electronics in the computer or the software that’s on the computer, it can be a risk but it also can be contained and secured.

So the computers have enough, you know, complexity or capability to be secured, so they can be secured, but it depends. So, and then there’s obviously lots of other hardware devices like rover cameras, vacuum cleaners with cameras and the sorts which sit in that space of, yeah, a lot of them have cheaper components and that are not secured which do then allow people to gain access and view what’s in your house.

So it does… There are… But with a lot of these, there are more secure options, more safe options, but obviously they, they usually come with a higher price tag as well. Yeah, right. So if someone’s listening to this episode and they are thinking, “Oh my goodness, I am getting a bit freaked out about the cybersecurity of my organization,” whether they are in a larger company or running their own business, where do they get started on the journey?

So the, the first part, and it’s really simple, is you can take some steps you can do yourself. And so from our perspective, we would suggest you set up a password manager, so like Bitwarden. We would suggest you get some cyber training, and you know, the Australian government has some pages, uh, available where you can do some free training on, on what to do.

We would suggest you set up MFA, have malware protection that is 24/7 access on your system. So that- that’s probably what we, we would suggest, and you can just do all those yourself. The truth of it is- When you say malwa- malware, is there… What does that mean for the average person who might not understand?

Sure. And what would you recommend? Yeah, sure. So there’s sort of standard personal malware protection. Malware protection is basically software that runs on your computer, and it looks for software that shouldn’t be running on your computer, i.e. malicious trying to either take information or cause damage.

And so malware protection software is important because if you do accidentally open a file, and it could be a PDF, it could be a Word document, or it could be an executable that has malware in it, that could then compromise your computer which then gives them access to everything you’re doing on your computer and potentially all your currently active logged-in accounts and all your files as well.

And so to protect against that, uh, we recommend strong, good malware protection. The standard off-the-shelf sort of malware protection doesn’t include monitoring. What we’ve identified is most malware protection- With its rules does work quite well, but there’s still always attacks that bypass it. Some of the most recent attacks now that is becoming prevalent is the, you know, what they call the copy and paste attack, which is basically, you know, you’ll go to a website and it’ll prompt you and say, “Hey, to get onto this next thing, you need to copy and paste this into your computer.”

And you’ll copy and paste it, and then that copy and paste in itself is to run commands on your computer to basically download and install malware and on your system. And so it doesn’t even need you to download it, it just needs you to copy and paste the text. And so because of these advanced attacks that are always changing, needs monitoring to make sure your system, to make sure what’s happening on your system is actually you and not something you’ve accidentally done or something that the, the malware has done.

And so we recommend active monitoring. The active monitoring solutions are usually for businesses and they referred to as EDR or MDR. But essentially it means that behind the scenes there’s a human watching and monitoring the activity, so if it’s a high-risk activity, there’s actually a person behind it, rather than a, a rules decision having to make a yes or no call.

And then that allows it to capture all those sort of gray line situations. And that’s obviously what we recommend for all businesses. And that then gives you the sort of that 99 sort of plus, you know, percent protection versus the rule base, which is probably more around the, the 30 to 50% protection coverage.

In that space though, a lot of the protections that are via the monitoring are you’re looking at either, you know, your Surface, your… or your CrowdStrike or something similar, which are usually only available from a business, uh, perspective. We do resell Sophos because we found it’s obviously hard for small businesses to go and buy 10 licenses themselves, so we do resell, so that is an option which you can do.

And that’s just from a pricing perspective. With monitoring, you’re looking at around that $10 per device per, per month And h- if, if we, someone wants to access that, you’ll share a link with us so I can put it in the show notes for today’s episode? Yeah, absolutely. Yeah, so I can, I can share a, share a link if someone wants to, to access that.

Absolutely. Fabulous. So that’s, that’s a base place from where to start. What if people are wanting to take it to the next level? They’re in a growing enterprise and they are worried about the cyber risk. What are the next things that they can do? Yeah. So from there, it becomes a little bit more customized.

So the reason we start specifically with those starting items is because they are products. And I’ll be honest, products are cheap. And so, um, that becomes a really lightweight, easy option to start with. From there, we do move into having to look at your specific environment and setup, and look at your Office 365 or your Google, uh, Workspace account.

And so naturally, emails and your files, a lot of them are stored these days in, in those systems, and they become key central points as well as for authentication. And those systems have over 100 settings that need to be secured. So by default, there’s a lot of settings that are unsecured that leave you vulnerable to a variety of different attacks.

And so what we work with each business is to configure those settings accordingly for that business. So it’s called hardening or securing those. And so that’s sort of a, a manual activity to go through and secure that and set that up in a way. And that includes setting it up so the only people that can log into your system and your account are from your business.

And so we go through a process of hardening that as well as other systems that you might use or other third party SaaS platforms you might use, and tying them all in together so you’re basically secured so, so that it’s not vulnerable and, uh, only your business can access it. So as an example, if an attacker happens to get access to your username and password, without the right other protections in place, it will actually block and deny them, and that then gives you those protections to, for us to know that we can sleep at night knowing that you, even if you’re not going to accidentally make a mistake and put yourself at risk, but also for yourself so that in those moments where you are weak and you do make a mistake or you accidentally do something, you haven’t now all of a sudden exposed your entire business to that, for that one small mistake.

Yeah. Awesome. Okay. Fabulous. Well, I am gonna share the links for Vertex in the show notes for today’s episode. Thank you so much for all of your wisdom today. I’ve learned a lot, and I’m sure the listeners have as well. So, um, thank you so much for coming on The Intentional Money Show. No problem. My pleasure, Clare, and, and thank you for all the great questions.

Fabulous. Chat to you soon.

Thank you so much for tuning in to today’s episode of the Intentional Money Show. If you’re ready for more profit, come find me on Instagram at clare_wood_coach. Thanks so much for tuning into the podcast, and I’ll chat to you again next week

* Transcript created by AI – may contain errors or omissions from original podcast audio