S1: Unsupervised Learning is a podcast about trends and ideas in cybersecurity,
S1: national security, AI, technology and society, and how best to
S1: upgrade ourselves to be ready for what's coming. All right, Patrick,
S1: welcome to Unsupervised Learning.
S2: Thanks, Daniel. Pleasure to be here.
S1: Yeah. So, um, last time I chatted with, uh, material, um,
S1: I spoke with Abhishek. We had a really interesting conversation, and, uh,
S1: what I really took away from that, that I found
S1: so interesting was like this focus on because I asked.
S1: I asked about, uh, detective controls, and he's like, yeah,
S1: it's not so much about detection. It's more about like
S1: putting on the seatbelts and preventative controls, like what happens
S1: after a breach. How do you limit the blast radius? Um,
S1: and I thought that was a really interesting characterization. Is
S1: that the way you think about it as well?
S2: Yeah, that's certainly a large part of it. And, you know,
S2: when I think about what we're doing here at material,
S2: it's actually the the seat belts, but also the brakes
S2: as well, and picking up on the accidents before they happen.
S2: So that's where we're heading as a, as a company of,
S2: you know, not only doing the threat detection, making sure
S2: that if and when something does does go kind of sideways,
S2: we can stop that and prevent as much impact as
S2: we can.
S1: Yeah. That's fantastic. Um, so before we jump into the
S1: product more deeply, uh, what types of stuff are you
S1: seeing out there? Like, what types of threats are you seeing? Uh, attacks. Like,
S1: where are the attackers doing currently?
S2: Yeah. So one of the things we're seeing, uh, you know,
S2: not going to be surprising, I think, to your audience,
S2: is a lot of inbound phishing threats that are hitting organizations.
S2: We know that that is a pretty, uh, popular entry
S2: point into a lot of the infrastructure for teams. And
S2: so we see that pretty frequently. But also, you know,
S2: one of the things that is, I think, Underlooked, when
S2: it comes to the cloud office. Is that lateral movement
S2: across the cloud office? Right. So if you think about
S2: the credentials for Google Workspace or M365, it's a pretty
S2: valuable piece of information for the attacker, because for any
S2: employee at an organization, it's the first thing that they
S2: get when they onboard and the last thing that they
S2: have when they off right before they off board. So
S2: that's usually the keys to the kingdom when it comes
S2: to not only other tools, but also within the organization.
S2: So you can move pretty freely once you have access
S2: to somebody's email credentials, to head across the shared drives
S2: and all that sensitive information, which can be pretty damaging
S2: as we've seen with past breaches.
S1: Yeah, so that makes sense. So it's not only access
S1: to email, but like you said, it's Google Docs, it's drives.
S1: It's um, I mean, that's the power of the ecosystem
S1: is that you can move around, right. So that same
S1: same advantage is for the attacker.
S2: Yeah. And it's.
S1: Also.
S2: Sorry I just want to jump in as well. It's interesting. Right.
S2: Because it's such a collaboration tool. It's also a challenge
S2: for security teams. And one of the problems and challenges
S2: we're seeing is trying to not be just the Department
S2: of No, but of facilitating collaboration across security, IT and
S2: their other colleagues. So you can't just shut down email,
S2: you can't just shut down access to drive. You have
S2: to rightsize who gets access to what and when. And
S2: so we have a lot of tools to help support
S2: that for our customers.
S1: Okay. So what does that look like? Is that a
S1: specific product for the Google space or what is that.
S2: Yeah. So it's a capability that comes with our product
S2: out of the box where we're able to enable just
S2: in time access and toufar controls for sensitive documents and
S2: documents that have basically aged out of a grace period.
S2: And so you can say, you know, within two weeks,
S2: let's put a toufar block on anything that has financial
S2: information across the organization or for these subsets of users.
S2: Let's put Toufar behind all historical emails in their inbox.
S2: So if a hacker does get access to their credentials,
S2: they can't just run wild and export data with sensitive information,
S2: proprietary information, things that could lead to real, substantial harm
S2: to an organization either reputationally or from a business impact perspective.
S1: I find this whole concept really, really cool. So so again,
S1: it's not about a sensor. It's not about, oh, I
S1: detected this. Let me make this change. It's like, look,
S1: we have this giant lake or ecosystem of sensitive content
S1: and data, and there are things we could be doing
S1: right now. Like you said, time based that are just
S1: like tweaking the knobs for settings and lockdown and configurations.
S1: So I guess there's if I'm thinking about this from
S1: like a fundamental standpoint, there's like, um, things you have
S1: to lock down. There's identity you could use, there's granular permissions.
S1: And so the product seems to be like just deciding
S1: what ideal might look like or something like that, and
S1: just going in and making those tweaks kind of on
S1: a continuous basis. Is that right?
S2: Yeah, it's on a continuous basis. And it's also contextually aware. Right.
S2: So you have to be able to understand where your
S2: employees are logging in from at an individual level on
S2: the regular, you know, on a regular basis. Because if
S2: I'm logging in from the East coast of the United
S2: States regularly and then you see a login from, you know,
S2: somewhere in Western Europe or around the globe where I'm
S2: not usually that should raise some alarms, right? And you
S2: might have some tools that will kind of flag that,
S2: but that might be in isolation. And same thing with
S2: your DLP tool like oh there are some sensitive searches happening,
S2: but that will happen in isolation. And you really need
S2: a tool that will help connect the dots of saying,
S2: we noticed a login and then we noticed some suspicious activity,
S2: and then we noticed some data exfiltration happening. Or, you know,
S2: for us, the ideal state of what we're building for
S2: is that whole throughput of, you know, if there's a
S2: novel attack happening via the inbox and the email threats
S2: that we're seeing and that, you know, a user might
S2: click through something or go to a login page that
S2: has a credential harvester of knowing that they got a
S2: suspicious email, and then they click through. And then we
S2: saw the suspicious login and then the weird anomalous activity
S2: being able to connect those dots together. Because what I've
S2: seen in my experience is point to do a pretty
S2: good job of picking up those individual data points. But
S2: it's taking a step back and seeing the full mosaic,
S2: so to speak, and having a clear understanding is that's
S2: where there's steam. Teams are still having a lot of
S2: trouble and, you know, doing a lot of work themselves
S2: that they don't necessarily need to.
S1: Okay. So let me rethink then. So so you are
S1: doing some uh, current context analysis of like what's currently
S1: going on. So I guess that is so what are
S1: the sources for that. What are you able to see.
S1: Is that all within like a Google Workspace, the logs
S1: that you're using or is that other. Do you have
S1: other telemetry other signal from other systems?
S2: Yeah. So uh, Google Workspace or Microsoft 365 or certainly
S2: it's a pretty big source of data for us. We
S2: also do in incorporate other third party intelligence tools that
S2: you would expect for a security product. Um, that really
S2: allows us to say, you know, once we see something
S2: suspicious happening, let's put things on lockdown, let's make sure
S2: that things are, are right sized for in terms of access,
S2: or we can revoke access if we notice that there's
S2: an issue that's been raised of a user with a
S2: suspicious login and a file share to a third party
S2: that is, you know, basically unsanctioned.
S1: Okay, so so walk me through like a scenario here.
S1: So I think I think you were giving me an
S1: example earlier. So it's like, um, is it a strange
S1: time of night or a strange geo that the person
S1: logs in with, like what are the various triggers that
S1: could that can get this going?
S2: Yeah, it could be, uh, you know, noticing a pattern
S2: of successive failed logins. So if somebody's trying to brute
S2: force a password and then they finally get in, we
S2: might pop a notification that says, you know, user has
S2: a login from a, you know, after a suspicious or
S2: brute force attempt. Um, and then we saw anomalous search
S2: activity on the drive. And then the administrators can, within
S2: our product, have already set up some automation that will
S2: say revoke external access to that, to those files that
S2: are being shared after that suspicious search. And so you
S2: can automatically with our product say, you know, once you've
S2: seen 1 in 2, go do the third thing automatically
S2: to revoke the access. And therefore the data shouldn't be
S2: leaving the building. Um, for anybody outside of the registered domains.
S1: Okay. So those are pre-set up. So those are preventative. Yep. Uh,
S1: is there anything that's like dynamically happening uh, to like,
S1: dynamically write some of those rules?
S2: Um, so our team is we have a team of
S2: three researchers, and we also use AI. As you know,
S2: a lot of the companies are today, um, to analyze
S2: our rule sets and make sure that we're really being
S2: really precise with, um, the roles that we're writing, but
S2: also our customers can come in and write the custom
S2: rules based off of very specific threats that they're thinking about,
S2: or wanting to be proactive around data sets that isn't
S2: necessarily super sensitive, but important to their organization. You know,
S2: an example that we, you know, we've seen a couple
S2: of times is around some notes for board meetings where
S2: there might not be sensitive information in there, per se,
S2: but you don't want those getting out. And so customers
S2: can set up rules for saying, you know, if it
S2: goes to X, y, z domain or XYZ email address,
S2: you know, let's put that behind the toufar. Um, for
S2: any access for that document.
S1: Yeah, that makes sense. And are there different, um, sets
S1: of templates. So like if there's a particular customer that
S1: comes on, is there like a threat model for that
S1: particular kind of customer where they would want to install
S1: a whole bunch of these preventative things, like all as,
S1: like a group or a cluster?
S2: Um, not today. One of the things we are thinking
S2: about and engaging in conversations with our customers with is
S2: really trying to rightsize what that looks like based off
S2: of the threat plane. Um, so, you know, we work
S2: with financial services companies and we're seeing something, but that's
S2: also fairly similar to healthcare. Um, and so we're starting to,
S2: to group things like that. Um, you know, if it's a,
S2: you know, an upcoming SaaS startup with a small security
S2: team that's a different set of profiling that they want
S2: to do. And so, um, you know, we're starting to,
S2: to work towards that. Um, and that's definitely an evolution
S2: of our product that's coming.
S1: Okay. But when somebody onboards what what all gets turned
S1: on automatically, is it a number of. Yeah. These preventative
S1: controls are already just by default there. Right.
S2: Yeah. So we have, um, you know, in the hundreds
S2: of rules at this point between our email and cloud office.
S2: Um threat suite, um, that are on by default when
S2: somebody signs up for material. So this includes things like
S2: all of our inbound threat email threat detection rules, but
S2: also suspicious file shares. um, you know, alerting to risky
S2: configurations as well inside of the workspace. So, you know,
S2: the way we're thinking about this in terms of an
S2: analogy is something like EDR for the cloud office or,
S2: you know, using an example for, you know, it's been
S2: the headlines over the last week was for Google Workspace.
S2: And so thinking about how do we give that full
S2: visibility and rule set for customers and their teams to
S2: be able to really identify where there's the most risk
S2: and then remediate it out of the box?
S1: Yeah, that makes sense. So it sounds like you're you're
S1: very much focused on this, uh, type of functionality. But
S1: what are some of the attacks that you're seeing in
S1: that space?
S2: Um, yeah. So it's, um, you know, some of the
S2: malicious actors are still, you know, phishing, trying to get
S2: the credentials, but also it's the inadvertent sharing. Um, so
S2: it's not necessarily an attack, but it's risk to the
S2: organization of a lot, you know, employees sharing sensitive documents
S2: to be set to anyone with a link can see
S2: it and just public shares where, you know, data leakage
S2: like that can be pretty damaging for organizations. And so
S2: that's that's an area where we've seen a surprisingly high
S2: number of issues being raised by our product so far
S2: of sensitive documents being shared to the entire world.
S1: Yeah, I love that. I love the fact that it
S1: doesn't have to be like, um, a front page news
S1: article like Sexy Attacker that's doing the damage. It could
S1: be the benign user who just made a mistake. And
S1: because both of those are risks, both of those are
S1: handled via rules, right?
S2: Yep. Exactly.
S1: Yeah. Awesome. What are some other, um, abuse cases? Uh,
S1: not so much attacker based, but, um, like, what are
S1: some of the other pieces that the rules cover?
S2: Yeah. So it's things like, uh, best practice configuration for
S2: the cloud office. So, you know, one example that, um,
S2: I have is organizations that might set group moderation settings
S2: to be able to be interacted with externally. And so
S2: if we think about that, right. So if you have
S2: a group of VIPs, if, if that group is externally visible,
S2: somebody can then just email bomb campaign, their VIP team
S2: or you know, their, their C-suite. And so that is
S2: can be hugely disruptive to businesses. If there's all of
S2: a sudden a DDoS campaign on the inbox because they're,
S2: you know, a group of malicious actors is actually just
S2: spamming the inbox and filling it up. Um, so that's,
S2: you know, that's another thing we've seen quite a few times, actually,
S2: where some moderation settings weren't quite, uh, optimized. And then
S2: from there, their executives, uh, inboxes were just totally filled
S2: up because of a harassment campaign.
S1: Okay, so, so humor me on this. Um, I'm trying
S1: to think of all the different granular controls you could
S1: possibly do. Um, so, so what are some of the
S1: some of the control points you could prompt for MFA
S1: if you see something suspicious. Um, you could remove access via, like,
S1: an ACL type control. You could have, like, a time
S1: based control if, like, something is outside of a certain
S1: time window. Yep. Um, what's another signal? Geo based signal?
S2: Yeah. So based off of IP address where we're seeing
S2: the logins. Um, also who they share with usually versus
S2: who they're sharing with in frequency of shares is something
S2: we're looking at. And so you know, we look for
S2: not only like the anomalous search and activity within the drive,
S2: but are you starting to email folks within your organization
S2: that you don't normally email. Right. So those sort of pattern.
S1: There you go.
S2: Outside of, you know, outside of the normal, um, kind
S2: of I would say, you know, kind of base level
S2: data points of picking up where real anomalies that this
S2: is unusual for a user based off of what we
S2: usually see.
S1: And how about like a classification or a content type.
S1: Are you able to see anything like that?
S2: Yeah. So we classify everything in the drive based off
S2: of the type of information that's there. So we pick
S2: up on things like Social Security numbers, financial information. Customers
S2: can also add additional custom tags for things like proprietary information.
S2: And so you know and that integrates directly with Google
S2: Workspace where, you know, if somebody puts that tag on
S2: a document, we'll obviously pick it up and then some.
S2: The security team can then remediate and protect it as,
S2: as they want.
S1: Okay. And then you mentioned particular drives internally. What what
S1: about threat intelligence on or at least basic threat intelligence
S1: on like oh, it's pastebin. Uh, this very sensitive thing
S1: is being put on pastebin, which everyone knows is like
S1: a dump site. Is that the type of thing you
S1: can get signal from?
S2: Yeah, yeah, we're pulling in, um, you know, things like
S2: that of, you know, have I been owned? Uh, sorts
S2: of websites of being able to pull that Intel for
S2: accounts and other sorts of information. Um, you know, we're
S2: also looking out for, um, Impersonation campaigns on login site
S2: login sites. So, um, you know, taking kind of the
S2: IP and um, other information from customer, an organization profile
S2: and how malicious actors are using it and try and
S2: protect against that.
S1: Yeah, that's really cool. Okay. So you said you have
S1: like hundreds of rules. That's that's the basic, uh, magnitude there.
S1: And that would be these various combinations of these different
S1: signals combined with the different control point. Right.
S2: Yep. Exactly.
S1: Um, interesting. Yeah. Any, um, any other thoughts on, um,
S1: the functionality here or the types of attacks that it's, uh, detecting?
S2: Um, really the thing that I'm excited about that we're
S2: picking up on and helping protect against is really the
S2: lateral movement across the workspace while not getting in the
S2: way of productivity for the organizations. Because, you know, I
S2: you know, I've been in security for a few years now. And,
S2: you know, one of the things that's, um, you know,
S2: really interesting to see is how passionate security professionals are
S2: about trying to stop the threat, but also how afraid
S2: they are of getting in the way of business operations.
S2: And I've seen a little bit of a gun shy
S2: mentality at times of like, hey, should I go do
S2: this remediation? Should I, you know, cut off this box
S2: from the internet? Well, I know that the attacker is there,
S2: so yes, you should. But I also know that this
S2: is a pretty important laptop, right? And so being able
S2: to then connect the dots of this lateral movement. And
S2: now the office where everyone is working, uh, you know,
S2: in the cloud, it's, it's pretty cool to be able
S2: to then say like, hey, we are actually with pretty
S2: high fidelity picking up the suspicious login, the suspicious drive activity,
S2: and then shutting it down in a way that the
S2: user might not even realize how they're being protected at
S2: the end of the day, because we're not kicking them
S2: out of their session immediately. We're protecting the the data first,
S2: and then allowing the security team to then go follow
S2: up and say with the user like, hey, just so
S2: you know, we've been compromised, we're going to shut down,
S2: you know, revoke access to your account for a second.
S2: We'll do a password reset, which we can also support.
S2: And so that's all within the realm of being able
S2: to really work collaboratively, collaboratively with colleagues for security team
S2: versus just coming in and being a disruptive force for
S2: the organization.
S1: Yeah. Interesting. So what does that interaction look like? How
S1: do you let them know or how does that interaction
S1: happen when you feel like you're dealing with something that's
S1: live and like has to be dealt with right now? Um,
S1: so are you, uh, is it a text platform? Is
S1: it an email or like, how are they getting that?
S2: Yeah. So our customers can integrate us into their entire workflow.
S2: So we integrate with tools like Pagerduty, slack. You know,
S2: we integrate with tools like tines. And so any automation
S2: workflow that will then take that signal from us and
S2: you can run with it automatically is something we support.
S2: And so, you know, for security teams, they can sign
S2: up for a slack notification when they get a high
S2: or critical alert from us. And that'll drop into their,
S2: you know, security team channel that they may have configured
S2: for material inside of their workspace, inside of their slack workspace.
S2: And then from there they can, you know, decide to
S2: action it. They can let their automation tool take care
S2: of it, or they can reach out out of band
S2: for their, you know, for their colleagues, of letting them know, like, hey, like,
S2: we know we've protected the document. That's cool. We now
S2: need to reset, you know, the password, and we'll make
S2: sure that you do that in a timely manner.
S1: That makes sense. And when you talk about the lateral
S1: movement piece, give me an example of, um, you talking
S1: about an active attacker doing that or are you talking about. Um, yeah. Exactly.
S1: What do you mean by the lateral movement?
S2: Yeah. So it is an active attacker. So once, you know,
S2: credentials have been, you know, stolen and somebody is able
S2: to log into an organization, you know, that might not
S2: have MFA or they've bypassed MFA. Once we start seeing
S2: that anomalous login or the anomalous search activity, we'll be
S2: able to then shut down the the attack by putting
S2: everything behind the toufar for a customer at that moment. Or, um,
S2: you know, if that's already pre-configured as a general protection,
S2: They don't have to worry about that.
S1: Okay. Yeah that's interesting. So normally they would have been
S1: able to just pull up files from a given share.
S1: But because they did this sensitive activity that looks anomalous,
S1: it doesn't stop them, but it just puts up the
S1: toufar to just guarantee that they're actually who they say
S1: they are.
S2: Yeah, yeah. And customers can also dial this in to
S2: the severity that they wish. So you know, we have
S2: some customers that will say, you know what. As soon
S2: as we see this suspicious login, revoke the session, reset
S2: the password. You know, no matter what's going on with
S2: the okay. But other organizations will say, you know what?
S2: Like what I really care about is the sensitive documents
S2: and not being disruptive to my colleagues. And they have
S2: that configurability within the product where they can really set
S2: their threshold for how much risk they want to take
S2: on or disruption they want to bring to the organization. Because,
S2: you know, past lives, I've seen instances where the security
S2: team has found ransomware on a machine, and it happened
S2: to be for an executive who was about to give
S2: a board presentation. And so, you know, it's one of
S2: those like, situations where you really want to try and
S2: think about how your organization works and rightsize the response.
S2: And we're trying to enable that by picking up the
S2: signal all the way across the spectrum and allowing security
S2: teams to choose when is the right time for them
S2: to respond for specific sorts of threats within the product.
S1: Yeah. And like you said, to adjust the control set
S1: according to the risk appetite for that organization. Right. Um, yeah.
S1: I love the fact that you can switch right into
S1: ATO if, uh, the security team wants to, but if
S1: there's like a culture of like, no, that's too extreme.
S1: And that would make the security team look bad or whatever.
S1: We need a more gentle approach. Let's just prompt for, uh, MFA.
S2: Yeah, exactly. And, you know, one of the up and
S2: coming use cases that I've had some conversation with customers
S2: about that I think is is also pretty interesting, is
S2: around sharing of documents internally and starting to enable tools
S2: like Google's Gemini inside of the workspace. And so if
S2: there is sensitive information inside of a document that is
S2: unknowingly shared to everyone at the organization, that also means
S2: that Gemini can pick up on that. So that could
S2: include things like compensation and other bits of sensitive information
S2: that you might not want somebody to very easily query
S2: inside of Gemini. And so yeah, it may have been
S2: harder to find in the past, but now it becomes
S2: a lot easier to find with gen AI entering into
S2: the workspace a little more proactively.
S1: Okay. And and what is the, um, the signal pickup there? Like,
S1: how are we finding out what they're doing?
S2: Yeah. And so with that, we have a rule where
S2: it is, uh, document has sensitive information and it is
S2: shared with the entire organization.
S1: Okay.
S2: And so, you know, even something like that, a customer
S2: can then say, okay, you know, email the owner letting
S2: them know that they have this pretty over permissive sharing
S2: enabled for this file, and then give them six hours
S2: to remediate it. Otherwise then revoke access and set it
S2: to private.
S1: Okay. Yeah, that makes sense. Um. Anything new coming out soon? Any, uh,
S1: new functionality you're excited about?
S2: Uh, yeah. One of the things we'll be, uh, unveiling
S2: pretty soon is, uh, really more connective tissue across, you know,
S2: and continuing to evolve the threat, uh, and detection and
S2: response capabilities across the attack life cycle. So, um, as
S2: we're building out and maturing the product, we're focusing really
S2: on being able to connect the dots, you know, with
S2: even higher fidelity, more types of, um, use cases. So
S2: from broader DLP to inbound email threats, um, being able
S2: to really say, hey, this really does look like a
S2: problem and we're going to help you remediate it. So
S2: you're not just adding tickets to a queue, but helping, um,
S2: you know, really remediate for folks is something that we're
S2: going to be spending a lot of time on.
S1: Oh, nice. Remediation. So what will that flow look like? Like,
S1: how are you tying deeper into the remediation flow?
S2: Yeah. So that will include things like, um, you know,
S2: individual slack notifications or out-of-band notifications for, for end users
S2: at an organization or things. Um, you know, beyond just
S2: revoking access, but being able to start to pull in
S2: things like integrations with your IDP and starting to disable, um,
S2: access not only within the workspace but beyond it. So
S2: knowing that there has been some compromise of the identity. Um,
S2: and we're seeing a firsthand account of somebody trying to
S2: get across it, being able to validate that, you know,
S2: if your IDP doesn't know about it yet, we will
S2: help enable the remediation there.
S1: Okay. Yeah, I'm really excited about that. So it's basically
S1: getting additional context from other places in the organization to
S1: be able to do the stuff you're already doing.
S2: Yeah. Yeah, because context is everything when it comes to security, right.
S2: Of being able to know not only what's weird and
S2: what's not weird, but like when you should go do
S2: something and when pausing for a moment might be the
S2: right call. Um, you know, I've worked, you know, with
S2: security teams where they've really been trying to be not
S2: only good colleagues, but champions for their security organization and
S2: getting that buy in. And one misstep in a response
S2: action where you have, you know, either the wrong call
S2: or at the wrong time. Um, you know, that really
S2: sets the security team back. So we're trying to partner
S2: with them to make sure that they're rightsizing the remediation,
S2: you know, automatically with as much context as possible.
S1: Nice. Well, awesome. Where can we, uh, learn more about
S1: the the products?
S2: Yeah. You can find us at Materials Security. Um, you'll
S2: see everything that we have to offer there across the
S2: protection for the whole workspace.
S1: Sounds good. Hey, David, are you there?
S3: Yeah. Can you hear me?
S1: Yeah, yeah. Any modules? Um. Any other, um, pieces of
S1: functionality we should, uh, ask about?
S3: No, I don't think so. I think that pretty much
S3: touches on, like, the basic stuff. I mean, we do have, like.
S3: Like I mentioned, the cloud workspace, like, in general, that's
S3: our general vision, um, that we're kind of releasing in a, uh,
S3: I guess two days. Um, so I think he kind
S3: of touched upon it. It's not really necessarily a new release.
S3: Quote unquote. A lot of, like, our real releases have
S3: already happened. So this is just more of like an
S3: announcement kind of stuff that brings it all together, all
S3: these elements. So I don't think there's anything on our
S3: end from a feature perspective that has not been called out,
S3: that should be called out.
S1: Okay. Sounds good. All right, Patrick, I enjoyed the conversation
S1: and thanks for the time.
S2: Yeah, thanks for having me.
S1: All right. Take care.
S2: Bye.
S1: Unsupervised learning is produced on Hindenburg Pro using an Sm7
S1: B microphone. A video version of the podcast is available
S1: on the Unsupervised Learning YouTube channel, and the text version
S1: with full links and notes is available at Daniel Comm
S1: Slash newsletter. We'll see you next time.