Shift Left, Real Moats, and Where Your Data Actually Goes, with Chris Bollerud

Chris Bollerud: Hey, everyone.

Host: Welcome to the show. I got Chris here today. Hey, Chris.

Chris Bollerud: Hi. Hello, everybody.

Host: Thanks for joining me. I'm looking forward to our conversation. And I love Chris's background. The reason why I wanted to have him on is because I think it's a really interesting background. He started in engineering, and now he's in the CISO role. If folks are listening to previous episodes, we've been starting with this topic, uh, because it's on everyone's mind, but the, the whole, the whole world of AI. Right. And I wanted to get your thoughts on AI from the defense, using it as a defender. Right. Um, and the opportunities there. And then if you have any thoughts on the attack surface and how it's expanding there with, with opportunities. I know it's a big topic, but. Yeah. What comes to mind?

Chris Bollerud: Yeah, it's a big topic and we'll probably dive into each of the different pieces of it. It's just going to cause everybody to move faster. And I think with this whole mythos, some of its hype, some of it's a lot of it's real. There's going to be a lot more zero days than there ever were before. And what that does is it puts a lot more that's on the attacker side right now. Figure out how to take advantage of these vulnerabilities. We've always had them in place. A lot of companies will just say, hey, this is a low priority. I'm not going to focus on it. But now you have these models that can go through and look for at, uh, all the vulnerabilities and create patterns or templates that a script kitty could use, and it becomes a lot more dangerous to leave those in place. The defender now has the ability to look at their code base and say, hey, here we go. Find them all a lot more quickly, but also be able to propose solutions and code that we can put in place to fix those. And it doesn't always have to be a direct patch. We may be looking at, uh, ways to work around or something we can put in front or maybe we just become aware what we could put on our firewall, some sort of setting, um, to block access into that vulnerability. So we want to have defense in layers, and the more layers we can put in place and know about, the better off we're going to be.

Host: Love that. Super interesting. I'm curious your thoughts as you know, you think about growing teams and building teams and just you mentioned, you know, things are going to move faster and. Yeah. What's your thoughts on, like, as you develop team members and, and build a security team. Leveraging tools, education. Any thoughts there on. Yeah, how you're thinking about that?

Chris Bollerud: Well, I come from an engineering background and something I always did when I got a new team in place is try and train everybody to get on the same page and be able to think about what are the best practices in the way we're building. I'm doing that same thing or I did that when I first onboarded the team. I have now where we were focused and that focus was very much on the customer and how we. I think we're going to maybe talk about it a little later, about how we get through questionnaires a lot faster and how we are consistent in answering. But now we have this new model we have to think about. With AI coming in and the attackers coming at us, we need to be prepared. We need to be thinking differently than we have before. A lot of infosec teams don't have an engineering background or are uh, aware of it, but aware from an IT perspective. And I think we need an engineering hat for some, uh, at least the appsec side of things and being able to attack those vulnerabilities and to think a lot more like an engineer, both the attacker and the defender, and get those in place more quickly. So I'm sitting down with my team and going over a lot of these concepts to make sure that we have it ingrained in everything we do and the way we are building our skills for our models and putting up some agents and tackling the appsec side of things. Of course, infosec's big and there's a lot of different areas when you get into GRC and dealing with customers, but the app sec especially you need to be focused on and that's the big thing right now.

Host: Love that. Thanks for sharing. I love, um, I know this is a little off the agenda, but if we go a little bit deeper on the application security, I know obviously working at Appzen and uh, uh, AI native company, from how I understand it. How do you think about application security and what do the average CISO need to know or the average security professional need to know, uh, that you've experienced kind of when you think about application

Chris Bollerud: security needs to happen earlier in the process. I think that's the big thing. We always talk about shift left. There's always a lot of resistance because that always ends up on the developers or product owners. But we really do need a lot more shift left. I had an interesting experience recently where we were going through, uh, a lot of POCs with uh, AI pen test tools. A lot of good tools out there, a lot of interesting innovation. But I sat down at dinner one night with one of the CEOs and founders of one of these companies and he was so excited that his tool could find this really hard to find vulnerability that other pen test tools weren't finding. The next day I talked to one of the other vendors we were going through a POC with and she goes, yeah, my tool found the same vulnerability, but I had it patched before it got released to production. So we need to change that mindset and ensure that we are fixing these vulnerabilities before they're even available. It's no longer acceptable to say I'm going to run a pen test against my pre release or my production environment, find everything there and then at the last minute fix it. Uh, we need to look for ways to find these vulnerabilities as they're written to stop them with the dev, but we can't. It's got to be more than just training the devs. The devs need to understand owasp. Of course, but how can we help them? How can we put skills into their code base? How can we work with their IDEs so that they get a little red squiggly underneath bad or insecure code so that it is getting fixed? Or maybe we stop the PR in the build process. We can put a SaaS tool, uh, a higher quality one than we've had in the past, but we gotta find ways to automate that. Shift left.

Host: What do you feel like are the main obstacles to shifting left and how have you overcome them in your organization? I haven't overcome all of them.

Chris Bollerud: Um, um, it's, it's a work in progress and, and I think you don't want to shift everything left on day one. You keep working on it and it is, some of it's building relationships with the engineering team, some of it and, and hopefully you can build that culture of their understanding. They're going to have to fix it later if they don't fix it immediately in code and it's going to cause pain later. Well, I am finding, um, as we're getting into vibe coding or agentic coding, that the engineers are more familiar with putting skills in their code base that will interact with the models that are helping them write the code. So what we're seeing is this cycle of I found this type of vulnerability. Let's update the skill so that it will never be introduced into our code base again. We're Also putting that into our CICD process. There's still the old vulnerabilities that we gotta go clean up. But what we're doing is we're starting to put the brakes on new vulnerabilities and this becomes critical. The reason it becomes critical is because code is being created faster than it ever was before. And as it's being, if we don't do this, we're going to see a hundred X vulnerabilities and instead we want to stop the vulnerabilities from being created so we can catch up and get ahead of the curve.

Host: That super interesting. We haven't really talked about application security. I know with, on the show and I know uh, especially with the uh, LLM providers getting into helping with security. Is there anything else in this category that we missed, application security that you'd like to share as far as best practices or like mistakes you've made in your career? You're like, oh, I wish, you know, I could go back and redo that or anything else that uh, you think the audience would benefit from.

Chris Bollerud: From an engineering perspective, the one thing I always wish I probably had put more focus on is test driven development.

Host: Tell me about that.

Chris Bollerud: So it's the concept, uh, what do they call it, the red, blue, green I think, um, where you first write your test case your code fails, then you fix it and the green is the fixing process and then the blue is the test. Right. Ensure it's all working. We use that mindset and security as well. And those test cases weren't just for functionality to confirm that you're meeting uh, the product owner's requirements. You could also put them in place for security and then that would help to ensure that you're keeping a lot of those bugs and issues out. Now I guess tests for security are a little bit different, but there are some coding mistakes that our engineers consistently seem to make. Which is part of why you uh, have os top 10. They're dangerous and they're more frequently coded that way. But you can put tests in place to help reduce that.

Host: Fascinating. Can you tell me a little bit more about OS top 10?

Chris Bollerud: The OAuth top 10. Those are it, it's a, it's a list. It gets updated on a regular basis, but it's things like SQL injection or cross site scripting. So these are common attack vectors that are well known that uh, and you need to defend against, but they're not trivial to understand and to write. Somebody who's by coding very quickly is most likely going to write most of the top 10 into their product. Unless they put a skill in place that says you need to pay attention as you're generating your code base. That, uh, no, I can't just take the information that was just entered by the user and put that directly into my SQL query instead. I need to look at each of the parameters, rate them, um, out and, um, check that input, test it, cleanse it before it goes against the database. So that it's not possible for somebody who is interacting with my system to directly query, or not directly, indirectly query my database. Fascinating.

Host: Thanks for sharing. I'm curious, so you probably already shared it, but any other hot takes on the industry? I know application security is obviously near and dear to your heart and I'm curious if there's anything else, especially with your engineering background, or maybe not. Maybe just being in the CISO role. Anything that you see that's kind of broken, that no one's really talking about?

Chris Bollerud: Well, on the customer interaction side of things, it's still AI related, but because AI came in so quickly, the whole third party risk management process is due for an adjustment, I think is the best way to say it. I think we had everybody had our questions in place, our answers in place, we knew what we were doing, it was fairly consistent. But when AI came along, it came along so fast. Uh, a lot of companies brought up AI councils. They're developing their own way of asking the questions and every company has a different set or they're driving different concerns. I'd like to see more consistency in that or to have a standards body create a solution or a standard that would help to say, if we met this standard, we could eliminate 90% of these questions. Right now you have like the, what is it? The ISO 42001 and the NIST AI RMF, those are two frameworks where they started to do that. But unfortunately I have not seen from our customer base, I have not seen a trust in those standards yet. I've not seen where they say, you have it, therefore, all right, that box is checked, let's go. Even if you have it, they're still going to ask 100, 200, 300 questions. And we get that on a pretty regular basis. And then you go answer 250 questions and then they say, all right, now we want a meeting with you.

Host: Interesting. So do you feel it's because those standards aren't ubiquitous, or there's not a consensus around it, or there's not enough awareness around those standards, or do you feel like those standards are missing something

Chris Bollerud: and that's why you're standards are not. The standards are not written from a security perspective to the level that these companies trust them. Yeah, I think, I mean especially 42,001 is that you have a process in place and you are consistent in your process. Nist, AI, RNF touches on security, but not enough.

Host: What security? What are common security thing that comes up in the questionnaires from your customers that those frameworks are missing? Anything that comes to mind besides not, besides not being specific? It sounds like they're vague or you know, uh, they're not specific but there's anything that comes to mind where like hey, they're not touching on this or um. Yeah, anything. I'd be curious.

Chris Bollerud: I mean the big one of course is where's my data going? So there's a lot of fear when you type a uh, question into ChatGPT or Claude, where does that, where does your prompt go and how is that data used? Now if you have an enterprise contract, you are protected by the contract, but the truth is that's all that's protecting you is just a legal contract. There's no guarantee of where your data is going. So there are a lot of questions. Where's your model running? What data do you allow to go into the model? How do you protect the data that's going in? What do you do with the responses? And then it's all this standard security of where is that data persisting and what are you doing at REST in transit? Standard, uh, type questions. But the models open up a whole new avenue of questions because you're now touching data in ways that you hadn't before.

Host: Yeah, fascinating. And I imagine the models, I mean especially like nist, armf, um, was. I mean it's at least a year or two old, right? It's not even, not that old. Yeah, it's not that old but it's. I think things have changed fast enough that it's funny because I think your situation is probably unique in the sense that being an AI native company, not everyone is using LLMs, not everyone is, you know, having that much data. So I'm sure you get scrutinized more than a lot of companies. That being said, we're all using to your point, like third party, you know, providers or data is ending up in LLMs or you know, AI is integrated on some level. So it's fascinating that these frameworks have not adopted that, which I mean it's probably, I think this year like even just looking at claude, right? Like the adoption rate of CLAUDE in the you know, the last couple months has just been. Gotten crazy. Right. So it's just fascinating how things are changing so fast. And those frameworks, um, even though they're not that old, may be outdated. Right. They're just like data governance. Right. Like everyone has AI integrated at some level and your data's ending up in those LLMs or whatnot. Super interesting. Anything else that comes to mind that those frameworks are missing or.

Chris Bollerud: Yeah, yeah, I suppose it's not so much that they. Well, how do I put it? They, the data's not ending up in the LLM. Um, like I said, they're. They're more about the process. And I think that governance process does get covered. But what they're not talking about is what is the training set, how are you curating it, how are you protecting customer data in relation to interacting with these models? So I might be using a solid and consistent process for my creation of AI. And there's a big difference between predictive AI and LLMs. There's a huge difference in that a predictive AI. When I'm building those models, I get to determine what data's been used to, uh, been curated to train those models versus an LLM or a foundational model. I'm pulling somebody else's. It's. But when that model, those foundational models are so large, they're often hosted someplace else.

Host: Interesting.

Chris Bollerud: And there are a lot of conversations around. All right. Does my data need to leave your environment to have this interaction?

Host: Fascinating. Super interesting.

Chris Bollerud: Yeah.

Host: Well, we probably talk about that for another hour, but I know we, we're short on time, so I got a couple of the questions I'd love to hit. Is there any stories? I love stories. And I think especially in the world of AI where, uh, you know, I think it's an antidote to. I make the joke of the antidote to the AI slop out there is our stories and our experiences that we can share with one another. Uh, I'm just curious, any stories that have just been transformational for your career as it could be related to engineering or even uh, infosec, um, and security. But there's any stories that was just like life changing for you in your career that kind of lives with you to today. Right. That kind of still helps you guide your decisions today that you can kind

Chris Bollerud: of share, I think about whether it would be AI related. I have something that it's certain, whatever comes to mind, kind of personal growth.

Host: Either way, whatever comes to mind a

Chris Bollerud: long, long time ago. And yeah, uh, it's um, back at hp, I guess my early days, I got a bad review from a manager.

Host: Okay.

Chris Bollerud: And it really, it stabbed me and it really affected me for a long time. And it took me, uh, a while to really integrate and think about it. And it was just one sentence in that review. I suppose overall it wasn't a bad review. I always got good reviews, I did very well. But, um, the one sentence was, Chris doesn't understand the impact of his words. It like what you say and how you interact with people has impact. And you want to be able to ensure that what you are saying and how you're interacting with others is truthful, is getting across the message that you want to get across. And I suppose I could bring that back to AI. You mentioned AI slop. This is a big problem these days in that I tend to think that there's more bad information out there than there is good information. How do you determine what you can trust? I think this is going to be one of the biggest problems for my children and generations to come. If you have a lot of AI slop. In the old days, many, uh, many years ago, it was propaganda. Somebody was trying to influence you in the wrong way. Now it is this AI slop and you don't know what's real and what's not real. We need to learn skills to be able to differentiate and define those trusted sources so that they do impact us in the right way and move us in the right direction. Because if we don't figure out those skills, someone is going to create a new propaganda engine that is going to drive us in a direction we didn't intend to.

Host: Yeah, that is, that is, I can't relate more. I think, um, it is a weird world we're living in. And not to get existential or philosophical, but I do think whether it's our own profession and understanding how to progress and how to communicate well, or even just for education and for the ability to think clearly. Right. Like if, uh, we lose our ability to write, you know, our ability to think, if we stop, you know, if we use, you know, AI generated videos or AI generated audio for us, then we stop speaking and yeah, I think has profound impacts on our society. And I'm thinking about how do I integrate more analog opportunities in my life and obviously non screen, non digital experiences to um, to not only for my own mental health but also for just my own, you know, progression as a human and being able to, you know, whether it's, that's writing, physically writing or whether that's reading, you Know concepts that are kind of crazy that. That needs to make a habit of that. But I can see how those things will easily get replaced by AI if we let it. And that's the weird part about. We are obviously tons of opportunity with AI, but also there, there will be just like there already has been technology, profound negative impacts. Um, and yeah, it's a fascinating, weird, weird world. And even education. One of my previous guests on this show, we were talking about how, with education, like, how do you educate somebody in a higher education or in college, uh, when in four years, who knows what, you know, when they graduate, who knows what the job market is going to look like or what type of opportunities are out there? Um, it's just kind of crazy how things are changing so fast.

Chris Bollerud: Um, and uh, say that liberal arts is coming back for that very reason because it builds a really well balanced. And yeah, you got to get out with nature. I mean, uh, the map behind me is there because we want to travel. We go to a lot of the places on that map and that's there as a reminder of you got to go see the world. And things don't operate in the rest of the world the way they do in Silicon Valley. And it's so obvious when I get out of this bubble I'm in that the world does not see things the same.

Host: Do you have a. I know we're still recording, but do you have a hard stop in three minutes? Okay, we, um, we can go a little bit longer if you're open to it. Cause I know we share a couple more topics.

Chris Bollerud: Yeah. And then you can cut it as you would like.

Host: Yeah. Um, it's up to you. I. I know, yeah. I want to be respectful of your time, but I've been enjoying this conversation, so I'd love to, Love to keep going. Yeah, agreed. I think as far as y getting out there and experience and even. Even for your own skill set, um, I think actually I'd love to kind of transition a little bit for talking about. You mentioned communication. Right. And you mentioned your words have impact. I'm curious as it relates to engineering and security, how do you build those relationships with folks and the other and the rest of the org. Right. Non security folks. Right. Maybe your peers, but also your executive team, your board. I think one of the biggest trends. I was on Reddit the other day and uh, I was looking at a post where somebody's like, what's the hardest part about cybersecur? Know, there's hundreds if not thousands of comments and I go through them all. And 80, 90% of them were people related things and that 10 to 20% were technical. Right. You know, technical things that, that we come across. So just any advice you have as you have that very specific experience that was transformational.

Chris Bollerud: Right.

Host: How do you get buy in and even, you know, some of your stats I pulled from LinkedIn as far as like deal friction and AI, uh, governance frameworks. And we talked about that a bit earlier. But yeah, just how do you get buy in with the rest of the org? Um, because it seems like it's a very common struggle across, across the.

Chris Bollerud: It is. And I think you nailed it. It's a, it's a, it's a people. Right. It's a relationship issue. And there's a huge difference between technical and relationships. You have to build those relationships before you need them. Because in, in infosec we tend to have very small teams. When something goes wrong. I have to have the rest of the company believe they work for me. And the only way that's going to happen because they're not reporting to me, I'm not writing the reviews, but I have to. And everybody's at different levels. I have to build those relationships everywhere in the company. So I'm meeting with different organizations, whether it's people in sales or legal, the support or IT team, the support team, some with the managers, but also the people who are doing the work. Try to meet with them all the time and build up some social relationships so that when you do need them, it's easy to just walk over and ask. Uh, certainly for a lot of what I've done in building relationships, legal has been a huge help for me with because we have to interact with the customers together and it becomes this kind of partnership. I've spent a lot of time training the legal team or I don't know, training is the right word, but making sure that we're on the same page so that when we go through a contract or we're interacting with a customer, they don't want to have to pull me in for one or two questions. But if they are familiar with the process and everything we're doing in our FAQ that we put together, 90% of the time they can just answer those two questions right there on the fly. It's done, deal goes through. We've tried to build up one way of communicating and having that alignment has helped tremendously. But it's building the relationships when you don't need them. Um, so they're ready when you do need them. Um, I'M doing the same thing with the, the whole CISO community is amazing. The CISOs interact with each other and we can just call each other up all the time. Um, I was at an event last night with, uh, a bunch of CISOs. It's almost every week I'm meeting another CISO. And you just become friends very quickly because it's a shared experience. Every company is going through similar pains and similar joys and figuring out how we're solving the problems and we're bringing those best practices to each other and helping with moral support where it's needed. Love that.

Host: I love that. When you, when you talk about building relationships, what is there one practical thing you look for in regards to building relationship? Obviously, communication. We've talked about that a bit and how you communicate, but is there something you do? Is there kind of a, a way you think about, you know, trying to help them with a specific thing or. Yeah, anything that, that you look for as you kind of enter those relationships. Obviously spending time together and you know, that can be like a more casual, uh, personal relationship and getting to know them personally. But yeah, anything professionally or personally or kind of. How do you think about it?

Chris Bollerud: Well, uh, there is a lot of fear that CISO is saying no to everything. I think you have to build that relationship very early on to say. I'm not here to say no. I'm here to ensure that when we do say yes, we do it in a secure and safe way. And again, it's more than just secure and safe because there's a lot of regulations. We want to do it in a way that protects the company and that's where the relationship with legal is so important. Right. Because it's not. We're not doing all this for one purpose. There can be multiple. We, we need to ensure that we comply with California law, European law, federal laws, as well as ensuring that we're not going to get hacked, that somebody's not going to steal data, break into our system. So how do you. I want to build that relationship with the, that understanding that we want to move fast. And I say that a lot. I'm here to help us move fast, but, uh, down the right path.

Host: That interesting. I'm curious. In obviously working with, talking to other CISOs and in your community, what's one thing, or maybe there's a couple things that being a kind of AI native company or obviously a very tech driven company, what's unique about your environment? Obviously AI, uh, governance sounds like one of them. That seems data governance for sure. What else is unique that maybe some lessons you can share or some ways of doing things that other non AI native companies could adopt. Is there anything that's like, hey, I've been really able to help out this one CISO in healthcare with kind of how we think about security in an AI native company.

Chris Bollerud: I think the big tough one is related to third party risk management because we are AI native and we have an enterprise customer base. We get drilled with the questionnaires and we're trying to build that trust. So that program is very important to the way we operate. In the whole sales cycle. We're looking for every way possible to turn questions around quickly. Less than 24 hours. Most of the time, even a couple hundred questions come in, we can turn them around in less than a day. Of course we've got AI helping and you can say, uh, sure, I just put a spreadsheet up in AI and it answers in five minutes. Well, sort of, yeah. Problem is those 200 are not the same 200 I got last week or the week before. The week before. And therefore there's always something new that these AI councils are throwing at us. But we go through and we're making sure that we're building that trust with our customers as well. And sometimes a new question comes in that we've never seen before and I have to go back to a various part of our program and make sure that it is in line. And as we do that, we find that we've just gotten better and better and better over time. But I think something that is unique for, or yeah, a bit unique for us. When I've talked to a lot of CISOs is we seem to get drilled harder than a lot of other CISOs I've talked to. And it's just where we are on the food chain and what we, the nature of what we do. Yeah, it makes sense.

Host: Super interesting. Well, in closing, I got one more question. I think you can follow your advice and ideas. Very, very interesting conversation. Last question here. So you've done some advisory work and we were talking about this before we hit record. The um. And I'm just curious, we're talk startups, especially in cyber security or maybe I'm in cyber, but in general. Any advice or thoughts you have on like early stage security or startups in general, what patterns are you seeing? What's overhyped? Where is the real innovation actually happening? Any thoughts there?

Chris Bollerud: Yeah, we have a lot of startups out there right now, um, but a lot of them are not building an appropriate moat or business model. And I think if you're looking for advice for an AI startup, you really got to think about what is your business model and how are you going to make M money from this. You're not going to do it the way you could build a company 10 years ago, 15 years ago. You can't just build a product and expect companies to pay a lot of money for it. I know for us we've stopped purchasing most vendors and instead are, uh, building it ourselves now. When you have that mentality in a lot of your potential customer base, you need to start looking at, uh, what is your value that you're going to bring? Why? What can you do that will get you into this company, that will help them reduce their cost? So some of the purchases I have made recently, the reason I've made them is because it's is cheaper to put this product in my environment because it reduces my cost and it would take me too much time to build an equivalent product. Well, that product has a moat. But when you're trying to sell me something that I can go build 80% of it within a couple of weeks through Vibe coding, maybe it's not as good as yours and want to have a pretty ui, but it'll work. I'm not going to go pay fifty thousand, a hundred thousand dollars for it. It doesn't make any sense. So I think there is. The whole environment is changing very, very quickly and a lot, ah, and a lot of founders are thinking, well, I can just throw LLM at this, create some new software and I have a new business model. And that's not true. There's gotta be a mode in there. There's gotta be something that you can do that your customers can't and you gotta provide that value.

Host: Interesting. Yeah, I completely agree. Because if you think you, if you can go Vibe code it yourself, then obviously your customers, potential customers, can do the same thing. I'm curious, what things have you seen as really effective moats, especially from M. I think your background's so interesting, especially the engineering side. You probably think about it differently. You're like, hey, I can do that way easier or way cheaper, or I know exactly how to go build that product. Most CISOs, you know, or buyers may not have that experience. What things? Uh, especially for, you know, AI security or just security startups in general. What things do you see as like, oh, these are some great moats that. And maybe the reason why you bought that tool, right? Uh, maybe we could start there. Why did you buy that tool?

Chris Bollerud: Yeah, well, the One tool, it had a lot of integrations right out of the box. And it's one thing to build a product, it's another when you have a thousand integrations that all need to work together. Those are very difficult to do. And they're changing all the time. Right. So part of that mode is not that it was just created once, but now the other side, those integrations are going to be changing all the time. I don't want to have to deal with all that maintenance. This product just makes all that problem go away. Now they say a lot of moats are going to be around hardware. If you hold your own data, those are, are two good moats. Although I try to avoid products that are going to hold us hostage to data.

Host: Yeah.

Chris Bollerud: So probably, um, not a good place for a customer to be, but that can be a moat if you get into that.

Host: Anything else come to mind?

Chris Bollerud: Yeah, you mean as far as a moat? No, no. And, and that's a, that's a tough one because as a software engineer background, I can see how a lot of these products work and, and, and how to build them and how to replace them. Um, I mean, like an AI pen test tool or a SAS tool, they're not that difficult these days. Even some of these SOC agents, where you need to parse through a lot of data anytime you need to interact with a lot of text, it's very easy for an LLM to replace that.

Host: Super cool, Chris. Well, I know we went over time today. Thanks so much for, for coming on the show. I, uh, really appreciate your time. I'll throw your, your LinkedIn profile in the comments so folks can connect with you. Um, and yeah, thanks for coming on the show. Really appreciate your, your advice. Yeah, thanks everyone for listening.

Chris Bollerud: Well, thank you very much for having me and have a wonderful weekend.

Host: Thanks, you too, Chris. Thanks so much.

Chris Bollerud: All right, thanks, bye.