AI, Scams, and Ransomware: What Every Small Business Should Know Now

Iskander Sanchez-Rola (00:00)

I think I would say scams, scams, and more scams. AI is changing everything, right? It makes it easier for scammers to actually do something that really feels personal. Before, it took a lot of time, so someone had to research, understand the company, the people that work there and everything to make something actually credible. But now, like, it's so easy to do it at scale that any small business is a target, right? If you have a dollar, they want that dollar.

Announcer (00:26)

Welcome to THRIVE, a Paychex Business Podcast, your blueprint for navigating everything from people to policies to profits. And now, your host, Gene Marks.

Gene Marks (00:37)

Hey, everybody, it's Gene Marks, and welcome back to another episode of the Paychex THRIVE podcast. You know, October is Cybersecurity Awareness Month, so it's a great reminder to make sure that your business is prepared for the unexpected. You can check out our on-demand webinar to learn more about cyber liability insurance, what it covers, and what to consider when choosing the right policy for your business. Just visit go.paychex.com/cyber to watch. The link is also available in the show notes. I'll remind you about that at the end of this episode, but let's get into the episode, which is some advice from a very experienced person in the world of cybersecurity and AI. His name is Iskander Sanchez-Rola, who is joining us today. Iskander is the senior director of AI and Innovation at Gen, and he's also a board member of the National Cybersecurity Alliance. He has a PhD and a substantial academic cybersecurity background with roughly 20 published papers covering phishing, browser fingerprinting, web tracking, privacy scams, malicious browser behavior, and related threats. I could talk about this topic all day. Iskandar, I am so glad that you're joining us. So thank you very much.

Iskander Sanchez-Rola (01:47)

Thank you for you, too. Like, I hope we have something interesting and everyone can learn something today.

Gene Marks (01:52)

We will. And I'm sure that we'll walk away with some really good advice from you on protecting our business. But before we even start, just a little background about yourself Iskander. First of all, tell us a little bit about what you do at Gen, what Gen is, and how you made it to this role.

Iskander Sanchez-Rola (02:06)

Yeah, I mean, as you say, I'm currently the Senior Director of AI and Innovation at Gen. And I would say that my job is really about staying close to how technology is actually changing and thinking about, like, what that means for people. Like, and then from there, like, it's about turning the right ideas into better products and stronger protection, right?

Gene Marks (02:29)

Makes sense. And tell us a little bit about your participation on the board of the National Cybersecurity Alliance. Like, what's your role there?

Iskander Sanchez-Rola (02:38)

I mean, at the end, it's talking about security, letting people understand what is happening, understanding what we can do from there. Like, I mean, we've been working in cybersecurity for a really long time. Initially, it was more like research, but now we're talking about like how to make things better and how to let the people know how they can improve their cybersecurity and their digital freedom in general.

Gene Marks (03:03)

Great. All right, that sounds great. All right, well, let's get into it. I mean, we're, it's National Cybersecurity Month. We're looking ahead to 2027, obviously. We don't have to tell our audience how serious this is and how expensive this can be if they are breached or data gets lost or if they're hacked or if, you know, they suffer, you know, some type of a malware attack. Tell me, you know, what are you looking at for 2027? If I'm, you know, I'm running, I have 10 people in my company, if we're running a business, what, you know, what cybersecurity threats do you think a small business owner should really be aware of?

Iskander Sanchez-Rola (03:35)

I mean, actually, if I would need to say like two or three, I think I would say scams, scams, and more scams. Scams.

Gene Marks (03:43)

Sí.

Iskander Sanchez-Rola (03:44)

Like, I mean, actually, I think that that changed a lot. And there are actually two main reasons that I would say something like that is that AI is changing everything, right? It makes it easier for scammers to actually do something that really feels personal. And before, it took a lot of time. So someone had to research, understand the company, the people that work there and everything to make something actually credible. But now, like, it's so easy to do it at scale that any small business is a target, right? If you have a dollar, they want that dollar.

Gene Marks (04:13)

So give me an example of what do you mean by scams and how this would affect, you know, a business owner? Can you tell me a story or two?

Iskander Sanchez-Rola (04:19)

Yeah, I mean, of course. Like the thing that happens with the scams is that they used to be things like, I don't know, like the Nigerian prince and things like that, that they were looking like something that everyone heard about, the sketchy things that obviously they look out of place. But now that's not the reality. Now the scams are becoming boring. And when I mean that, I mean that they look normal. So maybe they're just asking for an invoice, some message that someone that you know in the company, and then doesn't trigger that like, this is a scam feeling on the people, right? And it's very difficult to detect that something is happening, right? But at the end, maybe they're asking you for doing a transfer. So maybe your boss is sending you a message and is asking you to do a transfer to some provider that you are working with, right? So it looks natural. That's how it actually works, right? So I would say that normally what happens now is the scams feel like, I don't know, like a regular morning Tuesday or something. So you expect something sketchy and weird. That's not the case anymore. They look normal. So you end up doing things that you do in the normal life, which is transferring and things like that, but now you do it to the wrong person.

Gene Marks (05:24)

Right. And, you know, obviously it is, AI is becoming more just smarter and smarter. The emails themselves are, you know, getting smarter and smarter as well. It used to be a time, you mentioned about like the, you know, the Nigerian email scam, most people could like catch that. You know, you can tell there's misspellings or they're, you know, you know, salutations are a bit odd or whatever. But again, with AI, things are getting that much more harder to detect. So how do you, how do you protect yourself against something like that? I mean, how do you know if an email is legit or not?

Iskander Sanchez-Rola (05:57)

I mean, I hear a lot of people saying like, don't trust anything or things like that, which I think is actually not the right message. I think it should be more like trust less and verify more or something like that. Because I think what happens is that if someone calls and sounds exactly like your boss or someone that you're expecting, it actually may be real, but the voice alone is actually not proof enough. Like it used to be, right? If I hear a voice and I know who I'm talking to, that's it. We're in the right place. But now you have to think, is this voice real? Or even it could be even a video, right? And you could be like, is this video actually real? Like, now what I would say is like, call back to the number, send a message in your work system. I mean, even crazier, you can go in person and talk to them. Like, that's just verify the things before doing at least something that are important enough that you actually want to take an action on.

Gene Marks (06:45)

You know, I wrote a piece in entrepreneur.com a year or so ago about a company in Saudi Arabia where the controller of the company transferred over, you know, like $1 million to a scammer because the controller thought that he was talking to the CEO of the company. And it turned out, you know, it was not the CEO, it was a bot. It was, you know, it was an AI-generated, you know, voice. Just so we understand, like, how is that done? Like, you know, like how do the scammers impersonate the voice of a CEO just to get to the point where, you know, the controller of the company thinks it's the CEO? You know, what do they use to do that? How advanced and mature are those technologies?

Iskander Sanchez-Rola (07:29)

I mean, before it used to be complex just because you needed like a lot of like videos and voice of that person to actually do something kind of realistic. Nowadays, with like just a few seconds, you can do it. So you can be like, okay, there are videos of these CEOs or maybe like calls that they are on that they can record. But even easier, like many of these people have like voicemails, right? So you call someone and, hi, my name is, that's enough. Like with that, they get that info very quickly. And again, you don't have to be an expert. Before you used to, now the technology is so accessible for everyone that everyone can do it. And just some seconds can create a very realistic like voice and even image of someone.

Gene Marks (08:10)

Yeah, you know, it's, you're 100% right. In fact, just to even, you know, add on to that, I mean, it was possible to do this years ago, uh, but it took a lot of work to do. You had to get a lot of voice files, you had to edit them, you had to merge them together, you had to smooth them out. There's a lot of production work that had to be done. But you're right, nowadays there are very, very inexpensive tools that, you know, anyone can get a hold of that can grab a voice like me, you and me talking for just a few minutes at the most, and then be able to learn from that voice and then extrapolate that voice into a persona that sounds exactly like you or me, you know? And I guess that technology is real and it's affordable and it's available to a lot of people, right?

Iskander Sanchez-Rola (08:56)

Exactly. I mean, I wouldn't even say minutes. I would say seconds nowadays. Like, seconds are enough and it's very available for everyone. Like, before, maybe you will need to be like, go to the dark web, try to find, I think now you don't even need to do that. Like, you have access to something that will generate something very realistic. pretty easily.

Gene Marks (09:15)

And the same thing can be done when it comes to videos. I mean, you think you're on a Teams or a Zoom call, right? And it can be created just as you can spoof people and do deepfakes with videos that look quite realistic, correct?

Iskander Sanchez-Rola (09:28)

Yeah, you don't even need that. I would say that in that case, it's even like crazier. You don't even need a video to create videos. And because the deepfake technology is able to like get in a body, a real body, like me moving like this, for example, and then like put the face on it. So it's just like, even an image is enough, right? And maybe you have social media or you were like in a meeting that some image was public. Like, that's enough. Like, as long as the quality of the image is acceptable, then it can be done. Because also now, also even the quality of the image is not great, you can use AI to improve the quality of the image and then use that image to do the deepfake.

Gene Marks (10:06)

Yeah, it's a lot. So your advice is really, really taken to the heart. I mean, you can't just take something at first level. If there's any money that's involved, and that's the most important thing, isn't it? You have to trust and verify and prove. Somebody makes a request for something on the phone or even by video, you have to have internal controls in place to verify that request. And like you had just mentioned, it means calling that person back, talking to somebody else that can validate, a third party, that this is a legitimate request. Having somebody else in your company sign off on something. It's not just you. So those questions can be asked, right? Asking for something in writing from the requester and then calling that person back. I mean, there's a multitude of actions that can be taken just to make sure. And, you know, I'm talking on the, I'm an accountant, you know, so it's kind of, so to me, it's just all about the money. I mean, it becomes a heightened sense of awareness when money is involved, right? Have I forgotten anything? No.

Iskander Sanchez-Rola (11:06)

Yeah, I mean, I would say something that many people have that plan, like, I will train my people to detect every single, like, fake video or voice. And I think if your security plan depends on every single person in your company to spot every single fake that they receive, the plan itself is the weak link and not the person.

Gene Marks (11:24)

I love that. All right, that's really, really good. So yeah, so first takeaway is, you know, I'm asking you, like, what do you think is the biggest threat? and the 3 biggest threats in 2027, and your response was scam, scam, scam. So that's very much taken to heart. I appreciate that very much. So, okay, so let me come back to some other questions about security and security tools. Just, I want to get your take and your opinion, okay? For starters, ransomware, okay, has, you know, been around for years. I read recently there were some reports saying that, like, the number of actual ransomware cases or incidents are actually declining. And I'm wondering if you agree with that, if that's what you're seeing, if you think that's a trend, or, you know, or what your thoughts are from the aspect of a small business owner.

Iskander Sanchez-Rola (12:14)

I mean, actually, I'm not sure that data is exactly correct. Like, it depends on how you're looking at which country you're checking. So that could be true, depends on certain countries or certain areas.

Gene Marks (12:26)

Sí.

Iskander Sanchez-Rola (12:26)

But I will tell you that the number of ransomware attacks that still happen in the wild are a lot.

Gene Marks (12:32)

By the way, check the data and it's in Vatican City. That's where it's declining. I'm just kidding. Everywhere else is going up though, but I just wanted to kind of isolate that. So your take is it's actually, you think it's as big a threat as ever, right?

Iskander Sanchez-Rola (12:48)

I mean, it's still huge, right? I mean, and the thing that happens now is that easier than ever. Before you need to be like, like super advanced hacker that is able to like bypass securities. Now, like someone that knows a bit of AI and can handle that, they can do it, right? So it's like it simplified the process. So that doesn't make that the attacks will be less. It will be the opposite. They will be less sophisticated. So maybe less bigger players. So if we are analyzing of like huge players being hacked, maybe that number may be smaller. But if we talk as like general aggregated data and stats, then probably the number is higher because maybe small businesses are going to be attacked. Maybe they don't report as much. So maybe that could be a reason because they are much smaller. But I tell you, if you are a small business, you are on their target.

Gene Marks (13:35)

Yeah, my take is exactly what you just said. First of all, I do think with AI, scammers can attack a lot more businesses than they ever could before. And, you know, if you're a small business and you've been attacked and you had a ransomware attack, it's not exactly, you're not exactly running to your local news station to report that. You're keeping it quiet and just trying to get it resolved and moved on. So, you know, some of that data might be reflective of the fact that, you know, more small businesses are being affected, and yet they're just not reporting this because they don't really want to share that information with the, you know, with the world. You know, it's embarrassing, to be honest.

Iskander Sanchez-Rola (14:08)

Sí.

Gene Marks (14:09)

So ransomware and malware like it, I mean, you know, any thoughts on protecting yourself, you know, from that? I mean, is it still mostly like an email phishing kind of approach, or is there other things that we should be aware of?

Iskander Sanchez-Rola (14:23)

I think one thing that we have to think about is like these, what I call it, the multichannel attacks, which is like they don't go through only email. They sometimes do multiple of them at the same time. So, how realistic will something be if you receive an email saying something, and then like while you are reading it and processing it in your head, you receive a call, and they are talking about what they say in that email, and they say that you have to do the action right now? Like this multichannel is very important and is getting like much, much bigger. So what is happening there is that now we have to protect everything. So now for me, if someone tells that I'm protecting my email, for example, because I have phishing, right? And then I don't protect my calls or that I don't protect my messages, then it's like literally closing the door and leaving all the windows open. So sure, like maybe they will not go directly from the door, but they will enter to your house through the windows. So you have to have like a much more complete protection. That was always the case, I would say, but now more than ever, that's super important.

Gene Marks (15:20)

You know, I'm getting more emails than ever that are fake emails. And I, I'm not, I'm not saying I'm some kind of genius here at all as Connor, but like, I have grown, I've gotten some experience in, you know, identifying this. But like, even today, I got an email from a law firm saying that my, uh, my payment has been settled and to click on this link to arrange for my payment. You know what I mean? And it was from the law firm's URL. And it was very official-looking. But then, if I just drag my mouse over the link to where they're asking for my information, you could tell it was like a bogus website address. You know what I mean? It was going to be something. A lot of people don't know to do that. There seems to be more of these emails going out because there's so much information on the dark web. It's not hard to find somebody's email address and spoof their corporate domain. So again, you know, if this is happening and it's going to employees and all you need is one employee to click on a bad link, which automatically downloads malware to something else that could attack your network, you know, what do you do to protect yourself? How, you know, what should business owners know?

Iskander Sanchez-Rola (16:28)

I mean, I would actually say that like there is a difference that people normally don't think too much about it. And I think this is even more important for small businesses because things are intertwined much more than in a big company, I would say, in a big corporation, which is like private and corporate life or like work life and your private life. So that means that when you are protecting the people in your small business, you should be sure to protect them also in their private lives. So if they have a private phone or something, protect them. Because what happens is like many times they have a computer, for example, and they use it also for their normal day, right? Or the opposite, that they connect the thing, they are connecting the network and they connect to the same network. So these kind of things, normally like corporate computers, they have much more control, small businesses don't. So it's very important to have like a reliable solution for that. So I would say always have like a security solution that you can actually rely on, not just something that checks the box. Because what I always say is like having like this basic protection instead of complete protection, for me, is like walking outside in your socks with no shoes. So it might be fine for a while, but you are taking a risk that you actually don't need to take.

Gene Marks (17:35)

Yeah. All right, I get you. Trust me, I live in Philadelphia. I'm not walking outside in my socks. Okay? That would be absolutely ridiculous. But it's a great analogy to make. You know, over the years, you know, when people were moving to the cloud, it was a big pull to get small businesses into the cloud. They moved to the cloud. There are many of my clients are now realizing the logic of, you know, using a managed server provider, services provider to, you know, you can host all my applications, take all my files, you know, it's taken a while, but we're, you know, more and more businesses are doing that. It's becoming much, much more common. However, when a business does that and they say, okay, they're like, all right, well, I guess all my security concerns are addressed because I have a managed service provider and they're taking care of all of my IT, you know, which isn't really true. And I'm kind of, I'd like to hear your take on that. You know, are our security, is all of our security problems now answered because we have a managed service provider?

Iskander Sanchez-Rola (18:39)

Yeah, I mean, I would say, like, as you said, right, the line between inside and outside the business is, disappearing because of this thing, right? So you may have this IT company that is handling things, but also you have like employees connecting apps. So you always think like, I have 50 employees, right? But probably there may be many more than 50 people that have access to your business. So that's something that you have to consider. And I think normally the case is not like in this specific scenario, like malicious actors, but more like you forget like an old account that was never changed. It was a testing account that you left and the IT didn't realize because they didn't know. They don't want to break production, so they don't touch anything. Or maybe someone that left the company 6 months ago or a vendor that you used at some point for testing something, and then you never revoked their access. Those are problematic, and not because they are going to try to do it maliciously, but they have an access that they shouldn't have, and that could have, like, consequences, not on purpose, but they may have, like, really bad consequences because of it.

Gene Marks (19:36)

Right. Yeah, great answer. Great answer. All right. Next question. I subscribe to a security software for, I'll get, they're great. Malwarebytes. Okay, that's what they're called. And they, I've got it on my, you know, my employees have it on their devices. I've got it on all of our devices. And do we need it? Is security software like, you know, back in the day you had to have like Norton Antivirus and McAfee and now it's, you know, and now I think to myself, like, you know, with all of, you know, you know, do these localized, you know, security software applications still provide a valuable function? Again, I wanted to get your take on that. What do you think?

Iskander Sanchez-Rola (20:19)

Yeah. I mean, I would say this jumps into the same thing that I was saying before, like basic versus complete. Like, if there are solutions that the only thing that they will offer you is, like, very basic AV protection, full stop, that's the only thing they offer, that's not enough. That's why you will need something much more complete. I don't know, for example, Norton Small Business has something much more complete that offers like multiple things and multiple options that you can handle from there. So that's much more useful. So you need something that is not just done for just the customers and then just put it in your computers and that's it. You have something that has to be specialized for your specific case, in this case, a small business, right? And has like all the protections regarding those things. So in that case, you need that. You don't need an IP from a basic thing. You need something that was prepared for you exactly.

Gene Marks (21:06)

Got it. Okay, great. All right. I'm going to rapid-fire some other things. I want to get your take on these things. VPNs, right? I mean, you're, I travel a lot, so I use a VPN service. It sometimes, it slows me down, which is frustrating, but, you know, it's right. I mean, I'm not, I should not be connecting to a hotel or an airport Wi-Fi unless I'm using a VPN. Is that, would you agree?

Iskander Sanchez-Rola (21:32)

Oh, 100%. Like, like, I mean, you think about it, like, the VPN, what it does, it creates a tunnel that is encrypted so no one except the receiver and you can see anything that happens. So if you're in a, in a bogus, strange place, a connection that you are not sure where it comes from, use it. I mean, to be honest, I even use it like normally with my 5G. So because it also allows me to have even more privacy from that perspective.

Gene Marks (21:57)

Well, that's what I was going to ask you. Yeah, I was going to ask you, I mean, like, isn't, doesn't, what if I just connected all the time through my mobile hotspot? Isn't that as protective?

Iskander Sanchez-Rola (22:05)

Oh, I always use, I mean, you don't know because the thing that happens is when you are traveling, you don't know which tower you are connecting to. So, what things can happen or how the tower is connected, they create, there are also ways to also bypass those things and connect to the wrong places. So I mean, and they could actually end up checking your traffic. So if you have that, that's like the peace of mind that you need to have to be like, I'm 100% sure that whatever happens, I'm okay.

Gene Marks (22:30)

Okay. Multi-factor authentication, that's for all of you guys watching or listening, the usual, you know, you go, you log in, and then the service sends you a text with a code, and then you put in the code, and then you get access. Do you feel comfortable with that?

Iskander Sanchez-Rola (22:45)

I would say that if you don't have multi-factor authentication, stop this podcast right now, go there, set it up, come back, and we can keep talking because I think that it's a must. Like, you have to put it everywhere. Like, think about it. If you don't have that, a password is everything they need to access your account. With multi-factor authentication, they will need to hack every device you have, plus the password, which again is not impossible, but I would say it makes things a million times more difficult. So please put multi-factor authentication everywhere you can. Right now.

Gene Marks (23:20)

All right. Yeah, it's great advice. And you're right, it's, multi-factor authentication can still be bypassed by an experienced hacker who wants to put in a lot of work to do it. But most hackers don't want to do that. It's, you know, they're going after low-hanging fruit, right? Those that don't even have that MFA set up. There's plenty of that out there rather than spend all the time to try and bypass. But it's great advice. What about encryption keys? You know, like, should I go to my, you know, should I be using an encryption key? My bank sends me, they have multi-factor authentication. I get the text, I then log into my whatever. But should I set up, you know, and what I mean by encryption key, like a USB key that I put in, I have to have it with me, got to put it in my device. What are your thoughts on that? Like, do you guys use encryption keys in your business?

Iskander Sanchez-Rola (24:07)

You can use, what I would say is like parts of different types of multi-factor authentication. I will put probably SMS in the lower tier one because it's easier that someone can hijack your number and they are able to receive the codes on them. This is SIM swapping. So they swap their SIMs and suddenly they have access to your number and they can receive the codes. So that one is like not the best option if I can choose. So I would be like, keys are a good one. And also apps.

Gene Marks (24:35)

Apps are good. Like I had Google Authenticate and that I have a lot of accounts set up with that. Those are pretty effective, right?

Iskander Sanchez-Rola (24:41)

That's much, much better for sure.

Gene Marks (24:44)

Yeah. Okay. That sounds great. Speaking of apps and platforms, what is your, what are your thoughts on password managers? So I, you know, we use in our business Keeper and Keeper Security. And so we hold all of our passwords there and I rely on it pretty heavily. And then I think to myself, my God, what if those guys got breached? And they can because I think one of their competitors got breached, you know, a year or two ago. Anyway, what are your thoughts on password managers for a small business?

Iskander Sanchez-Rola (25:12)

So I would say yes, please.

Gene Marks (25:14)

Mm-hmm.

Iskander Sanchez-Rola (25:15)

Because the same situation that happens is like whatever the password manager risk is generating, which I can discuss about that too, is much better than someone creating a password and trying to remember it. They will reuse stuff. They will slightly change a password that they used before. They will copy it in another place. Because it's a complex one, they will use it in other accounts that they have in their private life. So if that thing gets exposed, then everything gets exposed. So a password manager allows you to have like very unique, strong passwords for every single situation, which is much, much better. So I will definitely say you do it. The risk that you are bringing is like, okay, everything is in one place, but everything is in that place encrypted. So that means that even if somehow that thing is leaked, doesn't mean they have access to all your passwords, mean that they have a bunch of text that they don't know what it means, and they will need to unencrypt it to be able to access what is there, which if they did properly, and that depends on the password manager you use, then it could be really complex to break. So that will be okay. So I would say that the risk that is associated with password managers versus the security it offers is definitely worth it, like 100%.

Gene Marks (26:28)

It's great. And I appreciate you saying that about the encryption. I mean, it's not 100%. And with AI, you know, AI is now solving the world's, the universe's most complex mathematical problems, you know what I mean? So there is, you know, there is a time coming where AI can, will be able to figure out encryption, you know, easier as well. But then again, that same time means that AI can create even more complex encryption. So who knows?

Iskander Sanchez-Rola (26:51)

We are working on that. There is actually a lot of work associated with post-quantum encryption, which means like even if quantum computers existed, the encryption that is happening there. It should, like, again, we kind of know because those quantum computers don't exist yet, but mathematically, like, it shouldn't be possible even with a quantum computer to be able to, like, hack those things.

Gene Marks (27:11)

All right, well, listen, if you say so. That's kind of, I'll have to take your word for it, okay? I'm not smart enough to know if that's the case. All right, final question, then I'll let you go. You've been fantastic. I, you know, we've gone through, I know we've talked about ransomware, deepfakes, managed service providers. We've talked about security software. We've talked about VPNs. We've talked about multi-factor authentication. How about this, right? In 25 minutes, we talked about encryption keys, password managers, training. Last one, remote workers. Okay? So, you know, not uncommon for a small business to have people working from home or even working remotely. You're a small business. You're gonna hire some person in, you know, Little Rock or, you know, in Denver to work for your company. They're working out of their home. What would you do to make sure that what they're doing is secure from a company standpoint?

Iskander Sanchez-Rola (28:01)

Like every single thing that we said, obviously, automatically you have to enforce those situations and then you can check if they're actually following them. If they don't follow one, they cannot keep working with you. Like they have to follow every single step because again, you are risking something, right? They're not in person, they're not in your network. So that generates an additional risk that is outside of the scope when they are with you, right? So you are taking a risk and that's undeniable. We cannot deny that, that there is a risk associated with it. And probably as you are a small business, you don't have a huge team that is actually taking care, analyzing every single log. So that's where you need these kind of tools that we were talking before, like Norton Small Business, for example, right? Like something that actually they can install and you can control everything and ensure that they're on board, that they checked everything. Like not just install, that it is like, oh, I give them a VPN, I give them like, no, no, no, that's not enough. Like, have something that will allow you to verify that they are following everything and checking all the boxes, and then you will be sure that actually something like that is happening, and then you are safe, let's say.

Gene Marks (29:03)

Fantastic. All right. Iskander Sanchez-Rolla is currently Senior Director of AI and Innovation at Gen and a board member of the National Cybersecurity Alliance. That was great, Iskander. I really appreciate all the information that we stuffed into a short period of time. Definitely would love to have you back, perhaps for next year's National Cybersecurity Month, right? Or maybe before. But I want to thank you very much for spending the time. It was really helpful.

Iskander Sanchez-Rola (29:29)

Thank you very much.

Gene Marks (29:30)

Do you have a topic or a guest that you would like to hear on THRIVE? Please let us know. Visit payx.me/ThriveTopics and send us your ideas or matters of interest. Also, if your business is looking to simplify your HR, payroll, benefits, or insurance services, see how Paychex can help. Visit the resource hub at paychex.com/works. That's W-O-R-X. Paychex can help manage those complexities while you focus on all the ways you want your business to thrive. I'm your host, Gene Marks, and thanks for joining us. Till next time, take care.

Announcer (30:03)

This podcast is property of Paychex Incorporated, 2026. All rights reserved.