Cybercrime in Europe: Retail, Ransomware & the Scattered Spider Network

Mike and Steph look at Europe’s growing cybersecurity challenges, from ransomware spikes to Scattered Spider’s latest attack tactics. They explore why retail, insurance, and travel sectors are being hit hard, and what makes these threat actors so persistent. Special guest Daniel Card, Cybersecurity Consultant at PwnDefend, joins to share lessons learned from the field, plus thoughts on the UK’s Online Safety Act and how orgs can better defend against threats.

🔗 https://info.lastpass.com/threat-reports - Want the data behind the discussion? Download the companion report for deeper analysis, regional stats, and expert insights.

Transcript

Mike Kosak

00:05 - 00:11 

Welcome to the second episode of The Phish Bowl. We are your hosts. 

I am Mike Kosack. 

Stephanie Schneider

00:11 - 00:13 

And I'm Stephanie Schneider. 

Mike Kosak

00:13 - 01:40 

And each month, we'll be taking a plunge into cybersecurity threats from nation state activity to cybercrime trends and general cybersecurity issues that we're tracking as cyber threat intelligence analysts. We're gonna be doing this every month and rotating through different regions doing a regional threat overview. 

So last month, if you missed it, we started with Asia Pacific, so you can check out our inaugural episode if you're new here and haven't had a listen. This month, we're gonna be taking a look at Europe. 

So for our special guest, which we do every month as well, we've got Daniel Card. He'll be joining us later, who is a cybersecurity consultant at PwnDefend. 

And we'll be talking to him about his consulting work, for both the public and private sector, and lessons learned, as well as a discussion around Scattered Spider's recent attacks, plus the implications of The UK's Online Safety Act. And so since this is only our second episode, you may not have heard our initial introduction. 

So, you're still getting to know us, we assume. So we just wanted to take a quick minute to reintroduce ourselves. 

So, again, my name is Mike Kosack. I am the senior intel analyst here at LastPass. 

I've been with the company for about two and a half years. I've been in the private sector, for about thirteen years, most of that within cyber threat intelligence. 

Before that, I was in counterterrorism with a defense intelligence agency, and, I am supposed to share a fun fact. So here you go, Steph. I don't even know if I've told you this before. I, I have actually been sort of hit by lightning once. 

So and obviously lived to tell the tale. Sadly, no powers gained, but it was the summer between freshman and sophomore year in college. 

My mom had come in while I was listening to music and said, hey. There's a thunderstorm rolling through. 

You should probably turn that off. And as a petulant teenager, I was like, yeah. 

Whatever, mom. And as I reached out to turn off the stereo, a bolt of lightning hit the house. 

I watched everything kinda blow up. Like, the entire plug blew up right in front of me, and, like, lightning arced it, like or a like a yeah. 

Electricity arced into my hand. I passed out, collapsed, stood back up, ran into the hallway, checked. 

No, like I said, no lightning powers, nothing like that, sadly. So, yeah, now I just can kinda tell you when the weather's gonna change. 

Stephanie Schneider

02:38 - 02:52 

That is an amazing fun fact. First of all, I appreciate you participating and, going along with this idea of sharing a fun fact because I love sharing that. 

And also that explains so much, Mike. I mean, is that where you got your curly hair too? 

Mike Kosak

02:52 - 02:56 

Yes. It was. 

Yep. Absolutely straight before. 

Stephanie Schneider

02:56 - 03:49 

That's fantastic. I'm Stephanie Schneider, and I'm a cyber threat intelligence analyst. 

I've, been in this role for the last five years. Before working at LastPass, I worked at Bank of America, and I actually came into the CTI cybersecurity space with an international affairs background. 

My fun fact is that I'm an avid runner. You will not get me to stop talking about whatever race I'm training for next. 

And I also love scuba diving, so I absolutely am a huge fan of our fishbowl podcast name. It's very fitting. 

Sadly, I don't get to go scuba diving as much as I would like because I'm in DC and, not really not the best place to see, aquatic life unless you wanna, go for a dip in the Potomac River, which I do not. 

Mike Kosak

03:49 - 03:57 

Yeah. You can find some stuff in the Potomac. 

It's just you're probably gonna have to talk to the police after you see. 

Stephanie Schneider

03:57 - 05:02 

Exactly. So first, today, we're gonna take a quick look at some regional threat activity trends that we're seeing play out in Europe. 

I wanted to highlight just a few things to kind of frame our discussion today. And one of the interesting things that came out of that reporting from doing that research is just the huge volume of attacks that European based organizations face. 

IBM put out a great report. It's called the X Force 2025 Threat Intelligence Index that found Europe is the third most targeted region after Asia Pacific and North America. 

And in q two twenty twenty five, attacks against Europe really jumped. Europe experienced the highest year over year growth in regional attack volume. 

They also accounted for a quarter of reported ransomware incidents coming in second place after North America at 53% in a 2025. Mike, do you wanna talk about some of the factors driving this heightened threat environment we're seeing? 

Mike Kosak

05:02 - 05:47 

Yeah. Sure. 

I mean, there's there's plenty to cover, across the board, really, when we think about dynamics within the cyber threat environment. So geopolitically, of course, there's the war in Ukraine. 

So we've got nation state aspects there. There's cyber espionage, that sort of thing. 

There's the war in Gaza as well. There's hacktivist groups that are getting involved because of that. 

Rise in cybercrime, like you mentioned, certainly with, with with ransomware, info stealers, which are certainly all the rage right now, and and definitely, you know, Europe is is not immune from those attacks. So yeah. 

Really, just across the board, just a lot of a lot of factors going into that. 

Stephanie Schneider

05:47 - 08:25 

Definitely. Yeah. 

I mean, there's a lot to dive into, a lot more than we have time for to today. But, so yeah. 

Make sure that you go check out the last past Europe regional report that we, are publishing in August if you wanna dive deeper. So pivoting, from kind of cybercrime ransomware, it's a really great transition. 

Let's dive right into Scattered Spider. They've recently been seen, they've been very active jumping from targeting The UK retail sector to insurance companies and then the airline transportation sectors, and looks like they're con you know, they're continuing to, be quite active in general. 

And it's also we've seen a lot of, government alerts come out, joint alerts on updated TTPs that that we've seen from them. And, really, there's just been this string of attacks, you know, if we're looking specifically at Europe against UK retailers. 

In April, Marks and Spencer was hit by really just a devastating ransomware cyber attack, with significant impacts. There were empty shelves across their stores. 

It took down their website that took them six weeks to get back online, and, they forecasted, about a $40,000,000 impact on their earnings. So, you know, it's just just devastating to this company. 

Really, ransomware is so effective in retail because attackers know that businesses in that space are likely to pay up, because they need to get back online in order to be profitable. And, also, there's, you know, just, vulnerabilities in terms of, you know, many retail systems are Internet facing and handle sensitive financial information. 

So they're really just low hanging fruit for these ransomware operators. After they went after The UK retail space, Scattered Fighter then pivoted to insurance and airlines, transportation, during the busy summer travel season. 

There were several arrests, from this group in The UK. Several individuals were arrested in July, and activity from the group has dropped off for a while, but now it seems like they may be back collaborating with shiny hunters. 

And, I mean, I know it can be kind of confusing keeping all of these cyber criminal groups straight, especially when there's, you know, some overlap. But I know, Mike, you've been looking into Scattered Fighters affiliations with other groups like shiny hunters, and, and I think there is some overlap there. 

Right? 

Mike Kosak

08:25 - 10:05 

Yeah. Yeah. 

So I I describe it, as as a sort of Venn diagram of shittiness, for lack of a better way to put it, where you've got when we sort of the at the center, the the primary area with all of the overlaps is is what's called the Calm, which is short for the community, which is an online, an online presence, like an online exchange where groups like Shiny Hunters, Scattered Spider, Lapsus are really all sort of sharing their best practices, sharing their tactics, you know, kind of really sharing that knowledge across the board. So and as well as probably, like, personnel are moving back and forth. 

You know, these groups have names, but it's not, you know, their affiliations more than anything. It's really easy for, for folks to move between them. 

You know, and I I think that explains some of the resiliency that we see with these groups as well. So, like, you mentioned some arrests from earlier this year. 

There have been previous arrests tied to scattered spider, and these groups just kind of keep on going because there is this corpus of knowledge that's shared through the comm. I will add as well, like, if we look at the comm, not only are they associated with lapses and, and scattered spider. 

It's a fascinating, and and in some ways terrifying, but, culture, that has that kind of has this through line going all the way back to probably at least 2020 or before, with a a previous iteration of this sort of community called the OG, which was a Telegram channel that started around SIM swapping and that sort of thing and then now, you know, kind of led to this. 

Stephanie Schneider

10:05 - 11:16 

So just kinda giving a little bit more background on Scattered Spider. Right? I mean, they're they've they're infamous. 

They've been in the headlines a bunch over the last few years and are are responsible for some really significant breaches. Social engineering is really the name of their game. 

They've been around since 2022 and have been linked to over a 100 attacks across a bunch of different verticals, but they really tend to target one sector at a time. Just calling out a a few kind of significant breaches. 

There was the hotel and casino giant MGM Resorts, was popped back in 2023. It cost the company more than a $100,000,000 from disruption. 

And then the, there was an attack against Clorox also back in 2023. This was also highly disruptive, led to significant financial losses as well. 

Just recently, Clorox filed a $380,000,000 lawsuit alleging that its IT vendor Cognizant failed to uphold, their duties by handing over essentially, the credentials to attack to attackers without really, adequately authenticating them. 

Mike Kosak

11:16 - 12:00 

When we think about their social engineering, it's it's simple, but it's not easy. And what really sets them apart is the amount of reconnaissance that they do. 

So, you know, they'll they'll, they'll look at LinkedIn profiles, they'll look at company profiles and everything else to get a sense of people's roles of of who's in IT, who the right people to try and imitate are. Because oftentimes, when it comes to, calling in, they'll call in, you know, imitating an employee into the IT help desk to try and get credentials reset, reset MFA, and then they'll pull some SIM swapping. 

So, you know, that's that's kind of the core aspect that's often associated with Scattered Spider. But if we look at that evolution, you know, originally, it started with kind of the classic phishing, and and then the social engineering aspect where at the time, they focused primarily on imitating IT employees and then reaching out to, employees at the firm that they thought might have privileged access. So getting them to, either using stolen credentials or something else, MFA bombing, you know, finding a way to leverage those legitimate credentials to get their foot in the door, and then they'd run from there. 

They've also gotten a bit more technically savvy, not to say it wasn't there before, but they've kind of broadened it out. So they've moved from primarily focusing on data exfiltration to now focusing on, to a large degree, ransomware, particularly right now, the Dragonforce ransomware. 

They'll get in. We've seen a real stretch of them targeting VMware, hypervisors to really maximize the impact and spread of ransomware as quickly as they can. 

They're very good at reconnaissance, and they've only gotten better at reconnaissance once they get their foot in the door to understand what's out there. They'll look for hard coded credentials, credentials stored in in ClearTech, stuff like that. 

Stephanie Schneider

13:01 - 14:00 

In response to this uptick of activity that we've seen, there have been, a slew of advisories, joint advisories from The US, Canada, UK, Australia, New Zealand, giving some really good guidelines and recommendations for how you can protect yourself against these types of attacks. And I think something that's really, you know, interesting with social engineering is that this tactic is going after the weakest leak in cybersecurity, which is people. 

And so training help desk staff to really review identity before they do a password reset or MFA bypasses is so important. This was an issue for the Clorox breach I mentioned earlier where their IT services help desk was a third party and allegedly handed over login information without questioning threat actor's identity or asking for that additional verification. 

And people are always the weakest link, so you really need to back up the people training with other strong cybersecurity, practices. 

Mike Kosak

14:00 - 15:10 

That's a lot of pressure for them, and and it can be very challenging, especially when this group in particular is so good at the reconnaissance and getting you know, learning, being able to impersonate people well by doing their their their homework with social media, you know, sort of pattern of life and figuring out all that sort of data so they can at least sound as convincing as possible. So that can be that can be really tricky, which goes to some of the other, potential mitigations that that come up in in the report, which, you know, again, came out on July 29. 

We'll drop a link to it. Actually, if you if you wanna take a look at it, we'll drop a link in in the in the write up, in the podcast or for the podcast, so it should be right there for you. 

But they also cover stuff like good identity access controls, least, least privileged access, you know, really being, sharp about that, Phishing resistant MFA, the use of pass keys, segmentation to reduce lateral movement, like I mentioned. One of the things that they've gotten really good at is getting their foot in the door moving quickly, both in privilege escalation and then moving laterally. 

So the the the more you can do to disrupt that sort of kill cycle, you know, the more prepared you are to protect yourself against this. 

Stephanie Schneider

15:10 - 15:46 

Now we're going to talk to our special guest, Daniel Card. Daniel Card is a special security consultant at Pondefend. 

Daniel is a cybersecurity expert with over twenty years in the technology sector. He's an active member of BCS, the Chartered Institute for IT, and he specializes in helping organizations globally to protect, deter, and respond to cyber threats. 

Daniel, thanks so much for joining us. We're happy to have you with us today. 

Daniel Card

15:46 - 15:48 

No worries. Thank you very much for having me. 

Stephanie Schneider

15:48 - 15:54 

Tell us a little little bit more about your background. So it is really interesting. 

You've you've served in a a variety of roles. 

Daniel Card

15:54 - 17:01 

So my background is just pretty I say pretty normal, but, it's like working in tech support. I did, like, a modern apprenticeship. 

I have worked for, like, local gov. I've worked as a consultant. 

I worked for logistics, nuclear, rail, do everything company. And, I went consulting at about 23 years old, and then I've worked with hundreds of companies from the sales and from a delivery point of view. 

Yeah. So I've worked in, like, a vast array of roles from support operations through to, project management, department head, team leader, you know, multimillion pound budgets, free to very much not many budgets, and having to see what you can do to hang someone's mind about their investment portfolio. 

Everyone always says, what do you do? And what I I'd like I help people, hopefully, before buying and before they have a problem, and then, help people during unplanned incidents. Normally, people's passwords are crap. So Yeah. Which is a good point, isn't it, about, like, that is probably one of the key points. Right? Like, what do you have to worry about as a person or as a, a CSO or as, a CEO? You're like passwords because I think that well, people get phished. 

Right? People get phished. They lose creds. 

They install malware, that kind of stuff. And that's all at the the end that's slightly underneath the I broke something or something broke element. 

Mhmm. And then all the way down the line, you get, like, ransomware. 

And the probability of a not trying to remember the numbers, but, statistically, it's not like, oh, I woke up and suddenly today, all my assets are ransomed, and then the next day that's gonna happen again. Right? Like, it's it's probably like a one in 10 year event for a company in that. 

But because, obviously, the global scale is there's that doesn't make it not a thing. It's just not every org is getting pwned to that extent every day. 

I try and interview people in real life. Mhmm. 

So any taxi they're going to or any, like, social events, if someone will entertain me talking, I'm like, cool. Come look at your phone. 

And they can get to the password settings, and then you get to the compromise box. Oh my god. 

Stephanie Schneider

18:16 - 18:26 

One of those really simple things that is shockingly so common that we see and and just one of those, like, glaring security gaps that really should be Please. 

Daniel Card

18:26 - 18:30 

I reckon, like, every time I come from one is anywhere on an assessment. 

18:30 - 18:32 

Like, I I always have kept track. 

18:32 - 18:54 

for that granularity of data. Right? Like but, you know, you've passed into a VPN through a password generally or or an RCE, so we won't go too much into that space. 

But, like, the the two routes are, you either got a and, you've been asking you, or or you've, like, fished someone or you bought some credentials or you found some credentials because. 

Mike Kosak

18:54 - 18:55 

Yeah. 

Daniel Card

18:55 - 19:26 

Goodies don't do the do the the the other bits. Right? And then you're like, okay. 

I've got creds, and you haven't got MFA. Now I'm in your VPN, and now I'm buying a site through a domain controller. 

And I'm joking about it, but it's real. That's that's actual findings. 

So we have got this massive sort of challenge between the the hard work of taking a long look and saying, where's all the credentials and key material? And why is our dot e m v file on the public Internet? And why is everyone logging in with the same password? 

19:26 - 20:01 

It's not on the cloud. It's simple it's simple, but not easy. 

You know what I mean? You look at patching, you look at passwords. You you take care of those two. 

It's like the classic sort of Pareto principle. You you're you're gonna be covered against most of the stuff, but you have to do that well. 

Otherwise, you're exactly right. You're just leaving the front door open for those things because it's easy to miss those if you are not paying that attention to detail, if you're not, like, monitoring for exposures, if you're not scanning your environment for hard coded credentials and everything else. 

And, you know, you're you have to you're exactly right. If if people aren't doing that right, they're just setting themselves up for for risk. 

20:01 - 20:16 

Yeah. All the AI in the world won't save you if, like, scanner and scanner will leave you in a position where there's an RGP server or the debt, that someone's just logged into, that isn't authorized. 

And then bad bad things will happen. Right? 

Mike Kosak

20:16 - 20:45 

Yeah. Or if, as we were talking about earlier in the episode, you know, we were talking about Scattered Spider, and and some of their and and now Shiny Hunters as well. 

We were kinda talking about the comm in general and and sort of that overlap of of, as I referred to it earlier, the Venn diagram of shittiness, where you've got all these groups kind of overlapping with one another and sharing TTPs. But, you know, you can have the best security in the world, but even some of those basic simple relatively simple again, simple but not easy social engineering aspects to get their foot in the door. 

Stephanie Schneider

20:45 - 21:19 

In your opinion, like, what do you think has made this group so effective? I mean, it's it's relatively simple engineering social engineering tactics, that we see, but, they've just been able to, you know, continue to go after various industries and pivot, you know, globally from more recently with The UK retail sector onto US insurance and and transportation, aviation sector, and and, it just seems like, they're really they're really just really good at what they do. 

Daniel Card

21:19 - 21:20 

Are they really good, or is it. 

21:20 - 26:22 

just everyone's really quite crappy defending because most people haven't paid attention to stuff? Who knows? I think here is the key for offer. Right? Like, this idea that you're a threat actors and sophisticated I mean, you what don't read nation state reports, and some stuff, obviously, is, like, you know, pretty smart. 

Some stuff. The small now stuff. 

And then the rest of it, like, teenagers kicking your front door in or phoning up and saying, hi. I've left my phone at home. 

Can you reset my account and reset MFA? And someone's saying, okay. Hey. 

Can I have the domain admin credentials at the same time? Just probably in domain admin is wicked. And some of this stuff is, again, it's like, there's a conversation with friends. 

There's ages ago. Way before I didn't need spiders and slap that stuff came around trying. 

And I was like, if you lose DA credits, you should not be game over. This was the premise. 

Right? And I reckon sub 1% of net can turn to that. Right? You should be able to lose your domain admin creds and just not get burned from the outside of the Internet. 

So, yeah, the I think the the point I have and I made this, like, after Mark and Spencer's on the news and tow up and Harrods. I was like, people think about this as groups of people. 

I don't think they are. I think this is a collective. 

Right? I'm supposed to know that people's, like, feeding. And I also think that the the threat here is, like, it's not I don't care if it's Dave, Johnny, Jim, Phil. 

Who gets it? This is if someone is motivated and decides to come after you, are you resistant and resilient, and can you respond to that position? And I think the answer should be better and healthier. It's that most organizations are not prepared for that style of correct approach. 

Right? You know, we talk about APTs and the word advanced and stuff, but I don't care about the advanced bit so much. I care about persistent bit. 

TTP approach isn't stupid. Right? Thinking that it's it's not intelligent would be completely wrong. 

Because, you know, if you're attacking an organ, say, I don't know, Luton in The UK, and you throw, and you want to connect to a VPN in Luton and the start are based in Luton. I don't know why I picked Newton, but whatever. 

And you could just get someone in Luton to give you their residential IP. You could use a residential proxy service. 

You could send a mobile phone with a battery pack stuck to it into Luton, with a five g, four g SIM card in it, and you could proxy through that. Like, there's a load of ways. 

Sorry. Don't everyone copy me on that idea, by the way. 

But, like, that makes the, it makes it really difficult to impact. Right? So you've had someone find the help desk and ask for a password reset. 

If you're a large enough org, that's that's not just a per day event. That's a that's about hour event. 

Right? Yeah. And then you've got someone that's speaking the language that's local. 

You've got someone connecting from a local address. You've got the they get in and then they are adaptive. 

You know? Are these people super smart? You know? Let's say there's a thousand people actively participating in this crime collective. If you need someone to do something, I'm sure you just say, hey. 

Can anyone do this? Yeah. And someone says yes or no, and then they can join in, do the thing they're good at, and get paid, and and get out or whatever the, you know, the dynamics are. 

And I guess that's fluid as well. I think this makes it a really hard thing for the industry to talk about because fluidity of threat is a concept that I don't think people can understand. 

Right? Yeah. Everyone wants to have a cool name. 

Everyone wants to have a brand. I mean, someone set up a Telegram channel, didn't they? Like, splattered shiny spiders, whatever. 

Shiny sisters, hunters. Yeah. 

Yeah. Yeah. 

And they I'm just they're what, like, say that, you know, people for actors watch the goodies, the goodies watch for actors, to the point where people talk to each other and jokes and stuff like so they can see the stuff in the papers, because some people are like, oh, it's Dragonforce. And I was like, what? You mean a ransomware as a service That is like me using a server in Azure attacking someone and someone saying, Microsoft attacked us. 

Again, it's because this stuff is not not super complicated. But if you're not, like, into the cybers as it were, you're not gonna be like, oh, what's the collective threat group, sort of threat model versus a group model? And Yeah. 

People say, like, what team are they in? And I'm like, well, who says they have to have a team at all? Yeah. You know? You could just turn up. 

Like I said, you could turn up and be like, I've just social engineered someone. Here's the set of creds. 

Give me $5, and then I'll never speak to you ever again. That's it. 

I'm done. And and I just I'm I think it's really hard for people to comprehend. 

Yeah. Yeah. 

Stephanie Schneider

26:22 - 27:00 

I don't think that the cybersecurity reporting does ourselves, you know, does the industry much of a favor because that is so muddled in how people report on this as well and just kinda adds to that, confusion and trying to parse apart, well, what what actually happened? Who's doing what? I like the term you used, fluidity of threats. And and, yeah, I think, so many people we want black and white because that's easier to understand when in reality, these groups are are not, kind of just in those set boundaries and there is overlap and, you know, they're they're adaptive as well. 

Daniel Card

27:00 - 28:06 

I mean, it's out, like, I don't know what we're gonna call it, like, dragon spiders. There you go. 

So if anyone joins dragon spiders, don't worry. We'll, like, plan a whole operation and someone kick your door down. 

If you don't get hit by something, it seems like it's impossible. Oh, that's someone else's problem. 

And then if you read a breach report, you're like, oh, well, that's another breach report. If you're a victim, there's a huge impact to you, and I think that gets lost. 

Right? Because we live in an age where everyone is pwned daily, weekly, every month, every call. I don't know. 

It depends on the person, right, and how many services they've signed up to. But there are breaches constantly. 

And and I think people have lost, like, some sort of understanding of, yes yes, we have breaches, but we shouldn't be accepting that. Right? We should be stopping them, where we can, and we should be doing things better. 

That's like a super important message, I think, is, this is not impossible to stop. You can absolutely build systems, networks, and organizations that can be, very resilient to being compromised and can be very effective. 

Mike Kosak

28:06 - 28:42 

Obviously, you've been tracking this very closely, the Online Safety Act within The UK, you know, ostensibly to protect children. You know, won't somebody please think of the children and, you know, and their their access to the Internet and and what that means. 

I'd be really interested in your thoughts on on the approach as it currently stands under under the law and, you know, suggestions for better approaches because I think this is it's not just, as you know, not just playing out in The UK right now. It's happening sort of at state levels within The US, and there's a lot of discussion, you know, on this side of the pond as well. 

So we'd really love your thoughts on that if if you'd be comfortable sharing them. 

Daniel Card

28:42 - 31:05 

I think the premise of helping kids is a great idea. I think the premise should always be to help everyone. 

Right? I think as soon as you focus too much, attention on specific, victim group or a specific area of society and you don't consider the whole of society, you get problems in thinking. So there's that. 

The there's clearly, like, some good parts of the intent. Right? Intense. 

There's only, like, the way the the the path to hell is paved with good intentions or something like that. Right? And I suggest this. 

Like, I did some research really quickly, a few weeks ago when this came into enforcement into The UK. And I've been looking at this subject for years. 

Right? But, again, I don't focus heavily on it. There are some things where, like, I was impressed to start with, but, like, the iPhone iPhone sub 13 category experience was pretty good. 

It started off pretty locked down. And I was like, cool. 

Safe search is enforced on Google and Bing. And then I was like, oh, okay. 

That's cool. And then I started going to some other search engines, and they just don't care. 

They don't look. There's no, like, industry standard for checking the safe search setting, which is mental. 

Right? So you can go to Yandex. You can go to Yahoo. 

I was surprised at Yahoo. Like, I don't know why, but I was. 

So I think there's something really important here to recognize that what is the problem we're trying to solve, how is current state, what can we do that would actually help people, as in, you know, how people see less harm. Mhmm. 

I think there's loads of stuff there that's just been ignored. We could do some stuff around the HTTP experience in web browsers where if you set the safe search feature, we could send, like, a header. 

This isn't the only way of doing it, but we could send a header of every, HTTP request that says safe search, yes or no. It doesn't invade anyone's privacy. 

It doesn't identify child or adult. It just says, I want a safe or unrestricted Internet experience. 

And adoption that would probably help people. So, yeah, I think there's loads of stuff that we could do if the mission is to help society and including in that, helping children have a safe online experience. 

We could do some technical changes that we we can do as. 

31:05 - 31:27 

an industry. We do it all the time. 

Protocols and standards get changed. We could do some app store improvements. 

We could, also consider asking people to educate and talk to their children. 

Mike Kosak

Well, thank you, Daniel. 

This is, I really appreciate your time. This has been fascinating, and I really appreciate you having this conversation with us. 

So thank you very much for joining. 

Speaker 2 

31:27 - 31:29 

Thanks so much for having me. 

Stephanie Schneider

31:29 - 32:01 

That wraps up our episode of the fishbowl. Thanks again to Daniel Card for joining us and to Mike for being a great cohost, and thank you again to our listeners. 

If you like what you heard, make sure to like and subscribe wherever you listen to your podcast so you don't miss new episodes. And you can also download the latest threat report on Europe. 

We'll include the link, in the episode description as well. So thanks again for joining. 

See you next time.