Fortifying the Digital Frontier: Information Security and Risk Management with Melanie Thomas

Scott Kinka: 

Well, hello from wherever you’re listening and welcome to another episode of The Bridgecast. My guest should be familiar to some of you, those of you who are fans and regular listeners of the show. Joining us today is Melanie Thomas. She’s the Vice President of Cybersecurity here at Bridgepoint. What’s unique is when we had Melanie on the show last time, she was not with Bridgepoint. So we’re thrilled to have her here. Melanie, thanks for joining us on the show today.

Melanie Thomas: 

Thank you. I’m happy to be here.

Scott Kinka: 

Fantastic. We’ll get into a little bit of that job change, and you joining over here. But Melanie was on the show probably about six months ago when we recorded this. I’m not exactly sure when we’re going to go live with the episode. And I really wanted to have Melanie on for two reasons. First, I want to talk a little bit about her legacy, her background, and why she’s now here at Bridgepoint. Just talk about what we’re seeing in the market a little bit on the security side. And then lastly, I think we can’t have an episode like this right now where you’re two weeks removed from the CrowdStrike incident, let’s call it for want of a better term. Melanie wrote a great blog that I want to explore a little bit, and we’ll include that link to that blog as a reference point in the liner notes. But I want to get right into it. Melanie, thanks for being on the show. How long have you been here at Bridgepoint now?

Melanie Thomas: 

Just about two months in.

Scott Kinka: 

Fantastic. It’s been an eventful two months given some of the things that are going on, which we’ll get into. Melanie, give us a little bit of your background before Bridgepoint. Obviously, you’re serving as the VP of Cybersecurity here now, but tell us a little bit before you get here.

Melanie Thomas: 

Yeah. It has. So before I was here, and like you mentioned, I was with AT&T Cybersecurity, which is now effectively Level Blue, with that breakout from their cyber side from the man that is AT&T. Now Level Blue is its own entity. So, when I was there, I was a Principal Cyber Engineer who worked with a couple of different managed services. I really had the opportunity to work with a lot of different vendors, a lot of different customers, some larger contracts and smaller contracts, so I had a chance to work with customers from multiple managed services, incident response, and all that very fun cybersecurity side with the hands-on. So, it set me up really well, I think, to come into Bridgepoint and look at the technology and engineering side for customers as well from a vendor-agnostic point of view now.

Scott Kinka: 

Got it. I’m sure you’re glad you weren’t sitting on the sock there when the CrowdStrike thing happened this past week. That would have been a fun morning or two weeks.

Melanie Thomas: 

Absolutely. I got some things from coworkers. Like, I’m so sorry you’re dealing with this right now.

Scott Kinka: 

Right. But I mean, you were effectively, you know, there, you were a lot of things there. You were training, you were products, you were, you know, involved in all of those, but you were also eyes on glass. I mean, you were involved in incident response on these types of things. They’re the kind of things that, frankly, our listeners had to deal with two weeks ago and are dealing with, you know, frankly, largely every day.

Melanie Thomas: 

Right, right.

Scott Kinka: 

Got it. You also have an interesting history in education. Tell us what you do on a day-to-day basis.

Melanie Thomas:

So, education-wise, within AT&T, we did a lot of training. Customer training on different technologies, training with our threat hunters and our software engineers on provisioning services, running the services, and all the very fun things. On the education side, I’m still with the University of San Diego. So I’m still a professor there with their master’s in cybersecurity operations and leadership program as well. So very excited. We just redid a couple of courses. I just taught the first course that I developed in Blue Team Fundamentals. Very, very fun, with lots of hands-on labs and all that great stuff. So, there are a lot of things that, regardless of where you are in your career, you should probably keep on anyway. So, it reminds people, especially when we have situations like CrowdStrike, that everyone needs to be aware of what’s going on in their environment. Everyone needs to be aware of what these teams do on a day-to-day basis because it can get really complicated really quickly.

Scott Kinka: 

Tell me about, you know, mean, has the, who’s in that program, I guess, is kind of the, do you have a lot of kind of return learners coming in for a master’s in cybersecurity or they sort of straight line out of undergrad?

Melanie Thomas: 

We have, it’s really, it’s interesting. It’s only a couple that we get straight out of undergrad that goes straight from that kind of program into this master’s program. A lot of what we have are people who are transitioning from other technologies into cybersecurity. So maybe they’ve been a sys admin, maybe they’ve been, you know, GRC, that kind of thing, but they really want to focus on cyber. We have some people who are already pretty established in their careers as well. So, people who are already directors of security CISOs, we’ve had a couple of people who are already in a C level go through the program as well. And so it’s interesting. This program gets a very holistic point of view for cybersecurity, but it is really meant to really help you in your career, regardless of where you come from, get into some of those management positions and really understand things like Bluetooth fundamentals, cyber intel, forensics, things like in addition to the very real business cases like we’re seeing with CrowdStrike, right? The CEO has to now go to Congress, things like that, or the House of Representatives. So, there are lots of things that really tie in business technology.

Scott Kinka: 

Yeah, right? It feels a little bit like an MBA to me, right? You’ve got sort of people coming straight out of B school, and then you’ve got executives returning. It’s just sort of practical in-world education that is, you know, super pertinent and timely as it stands right now. You’re also Melanie, a Hope Punk fan. We talked a little bit about that on the last episode, which we will link in the liner notes, but can you define what that is? A little bit about Hope Punk.

Melanie Thomas:

Absolutely. So, Hope Punk is a radical movement of kindness and optimism, and it really stays on the positive side, that, you know, change doesn’t have to be scary, right? Change can be very optimistic. You can move forward. And it’s also very punk rock, right? It’s very, you know, metal, not metal, but it’s very radical. It’s very fun. It’s very dynamic. And it’s the very good way, I think, to approach life and same thing approaching right, crowd strike, when we have events when we have incidents that, you know, yes, there’s going to be a lot of emotion, right, there’s going to be a lot of anger, things like that, but it can still move forward and, you know, change and evolve.

The State of Cybersecurity in the Market

Scott Kinka: 

It’s a healthy way of looking at it when you’re staring at a screen on some days, right? I mean, in particular with events like this, you’ve been, before we jump right into the crowd’s right thing, mean, just give me, you’ve been at Bridgepoint here for a couple of months, you obviously were on the customer-facing side at AT &T, you know, now Level Blue. Just give me a state of the state, as you talk to an average, you know, mid-market CIO or CISO, although I think most mid-market businesses are probably doing a fraction all over its and also job with the director of IT. You know, where are we? I mean, are we at a point of maturity and acceptance? Are we still chasing the ball? Like, you know, obviously, security is always a catch-up game, right? But are we at least understanding and accepting that role? Or are we still very much in the holy crap? What should I be doing mode with a lot of businesses? What’s your what’s your high-level opinion?

Melanie Thomas: 

I think we are definitely moving into more mature conversations. There are fewer times that we’re seeing now where customers come in and say, I don’t have anything of security. Tell me what I need. It’s more they have an idea. They know why it’s important. They might have one or two tools that they’ve been able to implement. I think one of the really big benefits of that is that you see a lot of MSPs and MSSPs really starting to help create packages and bundles of just kind of basic solutions that everyone should. And then you have, you know, some of the customers are like, great, I have Microsoft. Awesome. Let’s talk about the security center. Let’s talk about everything that can come with, you know, inside of your Microsoft, manage yourself or not. But I think we will see a lot of opportunities there. So, luckily, we’ve definitely progressed into some of these larger conversations. Now, we can talk about some of the shinier tools that they might need to help their security kind of cross over that line. A component of that is absolutely cyber insurance, too, right? We see what happened to the crash. That could be cyber-related, but likely not. But you know, a lot of people are seeing, wow, everything is connected, and we’re going to have to start having some of these harder conversations.

Scott Kinka:

Do you find, I mean, you mentioned, you know, sometimes you go in and it’s like, Hey, we have these one or two things, right? You know, and I think it’s always the chicken or the egg conversation, right? Is that, is that right? Is it like strategy and policy first, then implementation, or is it, you know, trying to go through a couple of best-of-breed tools? I have my own opinion, but I’m curious, like, where are people when you meet with them? Is it more often that we’ve done a couple of things, but we need to take a step, maybe backwards? Just figuring out what we’re trying to solve and build policy and governance and then get it all the way forward? Or are you sort of in the mode where they know what they want to do; they just need help to do it?

Melanie Thomas: 

It’s more that they bought a few of the best-in-breed tools, right? They see the need. They’re great, that’s a great price point. Let’s try to implement it. And then let’s look back and see, let’s make this change our policy, right? Let’s look at some of the other procedures that we need to do to operationalize that. So you see that very firsthand in the provisioning of some of these services. They aren’t maybe provisioned very well, right? They didn’t know it had that feature. They didn’t know that they could do this kind of thing with it. So then it’s kind of exploring what they already purchased. Let’s not maybe buy something new. Let’s make the most of what you already have. At the same time, know, these policies and procedures, especially things like disaster recovery and incident response, if you don’t have the provision of the tools correctly, you’re still going to be, you know, on the bad side of that fence whenever something bad happens. So it’s a little bit of a mix. I’d like to see more preparation. I’d like to see people already have an idea of their policies and procedures. And have that govern more and influence their decisions on tool sets. But then, today, sometimes it’s a decree, right? You have to have this, and they buy it and then figure it out.

Lessons from the CrowdStrike Incident

Scott Kinka: 

Check the box because it’s come down from the board or because it’s come from a customer that you’ve got to have an X or Y. Totally get that. And I think that’s an incredible segue, right? Into maybe the broader conversation. You’d like to see maybe a little bit more governance and kind of policy around, you know, I’ve got a thing, but I don’t know how to run a thing, or it’s not sort of part of a larger story. And I think quite a bit about, I mean, we’re two weeks now to the day when we’re recording this removed the crowd strike incident. And I think a lot of the, let’s take, let’s take, you know, crowd strikes mistake or whatever it was. We want to call it at this point. We don’t know that we haven’t categorized completely. Just take that off to the side for a moment. I think a lot of the discussions that I’ve been involved in have sort of been a reckoning on policies and procedures, DR, edge strategies, and things of that nature. So, it’s an interesting parallel to what you just said before we jumped down into the details. You know, obviously, everybody’s got to turn on this story. I’m going to put you on the spot and ask you for your turn, like what happened, at least as it relates to the information and Melanie that you’ve been able to compile, that you feel comfortable representing what happened a couple of weeks.

Melanie Thomas: 

Absolutely. So what this was from the best information that we have in general is that it was an incremental update that did not contain the files that needed to actually run. So part of it is that a lot of endpoint technologies, and so when we talk about them in general, have this, the higher level conversation starts with, well, you need security, right? And you need to be fast to be able to respond to active attacks, right? Things update all the time. And so you have a lot of these EDR vendors who have just incremental updates, right? So it’s not a full agent update, which is typically what updates the kernel, right? The kernel is a very important core component of your Windows programming. And so when you touch the kernel, it’s usually going to be a larger update. It’s going to have other things that are validations involved, right? Cause it’s, and you need it on the kernel level to start from boot, all those great things. And so when they push up this incremental update. It was full of invalid fields, right? And so when the kernel tried to start up, the data it needed wasn’t there, and then it was blue-screened, right? Because we touched the kernel, you potentially caused a lot of issues. And if they’re not the first vendor to do that, of course, this is very, very widespread. There have been other updates and issues with the way Microsoft doesn’t want to play nice sometimes or play nicer now with a lot of EDR vendors in particular. I think we’ll see that very much so moving forward. But when you have these kinds of incremental updates enabled on your endpoints, it’s cool, right? You want those tiny little updates that happen frequently. It looks good to a board, right? Cool, we’re constantly updating. We don’t need these major version updates every once in a while. But that’s kind of the risk you run when you allow that, right? So, if you really want everything to be updated as fast as possible, you have to accept that that’s something that could possibly happen. And when the fields were empty, it didn’t allow anything to start.

Scott Kinka: 

Got it. It should have been low touch, and that was incremental, meaning that the core kernel software wasn’t being updated, but the core kernel software was looking for, you know, file definitions that may be, frankly, updated attacks, things, you know, the things that are consistently changing that the software is looking for, it couldn’t boot effectively. So, okay, so that makes sense. So, and maybe we don’t know this answer yet, but I’m just going to ask the question of how we ruled out that there was anything cyber security, you know, attack vector related in this process or just is this pure QA, you know, problem on the, you know, on the, you know, side of

Melanie Thomas: 

It’s pure QA. So, it’s pure software development. I don’t think anyone has any kind of indicators. Think it’s easier to jump to that, right? Insurance-wise, it’s easier to say this is cyber potentially malicious. I think here we’re seeing a lack of QA, maybe a lack of other processes and code review before that fact, and a lack of maintaining a really significant testing environment that is a good representation of what they need to test. And so I think that just you when you get a little, you know, apathy toward those kinds of normal procedures, right? This is something they push out multiple times a week. And you know, maybe it failed on a couple of tests, but they’re still gonna push it. I think this is kind of a result of, you know, just maybe falling into a little bit of that hole.

Scott Kinka: 

Yeah. So I think there’s, there’s, you know, in the, happens next, there’s probably two sides to that discussion, right? The one is, on the side of the provider, on the side of the software maker, you know, there’s, mean, I’ve been developing software and been in companies have done it for almost my entire career. And there’s always this like, you know, push and pull. There’s always this pressure between kind of, you know, customer success and unbridled innovation. Like there’s, there’s this built-in, built-in tension. In fact, it came up a couple of episodes ago. I forget which episode it was. I think it was with Pete Eisen, Graham and evolved by P that we got into this whole unbridled innovation, which is basically the genesis of, of, you know, of, kind of bad process, right? Or, or, you know, future tech debt, if you will. Right now, great. And this was an incremental update. So it’s probably less of an argument there, but I think that’s the one side, right? The one side is sort of facing those suppliers, frankly, of ours, right? And providers of ours who are responsible for making sure people’s operating systems run by leveraging the software that they have. And I think the other one, the other question is really, as the user, how do we think about just clicking the update button? Like, is this changing where we’re mentally? So, let’s address both. And I’ll, I’ll take both. Like, is this a wake-up call in the supplier ecosystem related to how swiftly, how adeptly, you know, we’re updating?

Centralized Control of Devices: A Solution for Security

Melanie Thomas: 

Yes, absolutely. And I think for anyone, it is kind of similar, right? Worked for a company that talked about violent execution in their software development. And I was like, no, no, no, I hate that entire term. He’s going to laugh when he watches this. But, and it’s, we’re seeing, right? I have a lot of people on the side of it, like myself. I’m very risk-averse when it comes to software updates because things like this can happen. And so I think a lot of vendors on the other side of that see, well, we need to respond to the market faster, we need to push this faster, and we need to tell people that we’re doing this faster. And so I think a lot of vendors now are going to be like, well, maybe we should take a step back. Maybe we should take a little bit more time to test things, time to release things, which, of course, time is money, right? And so, what does that mean when you have kind some of those imbalances?

Scott Kinka: 

Yeah. I think time is security, too, right? When you’re, it’s harder. I think it’s one thing if you’re a SaaS offering, right? It’s, know, if you’re Salesforce and you pushed it, yes, we can’t process it in order. We can’t do it. Like, I get it. When you’re a piece of software that’s driving over the kernel of an operating system of every machine, you know, 80 % of the machines in the world, it’s a completely different level. I get it’s hard, but I understand the reckoning. Let’s talk about the other side. You’re a customer. Does this change the way you think about just pressing the update button? Automatic updates, let’s go. Okay, tell me more.

Melanie Thomas: 

I hope so. I hope so. Please, please, please. Yes, yes, yes. So, ultimately, the customer is the one responsible, right? So we see these lawsuits coming out from the shareholders, for example, against CrowdStrike. But when we look at it, or Delta, for example, Delta Airlines is now suing CrowdStrike and Microsoft for $500 million in loss, which makes sense, right? These numbers are going to continue to come out through the next course of weeks, potentially months, as this fallout continues to happen. But at the same time, you know, when you implement software, especially security software, you kind of also are coming into a joint agreement with the vendor. Like I trust you to not blow up my environment. At the same time, you accept the risk of you’re installing it in your environment, right? Your teams, whether you’re, you know, it’s definitely on the customer side. If you have a managed service, it’s partly theirs, and you also have the vendor. So it’s a shared kind of responsibility. And so I think it’ll be interesting as we see some of these lawsuits is that customers want to be asking these kinds of questions when they implement any kind of software, when you talk to vendors, if they do, they’re monitoring your logs, right? Ask them how often they update their backend and if you can have release notes or notifications when those kinds of updates happen because something like this could absolutely, you know, impact all of those things. So, some technologies, of course, are less of a priority, right? Less of an impact when something big does happen. A lot of security software is, like you mentioned, on the edge. If you push a bad update, if you can’t get the internet to your workforce, you’re hard down, right? You have to be able to fix that. And telecom, right? ISP providers all understand what the risk is and the weight on their shoulders when they accept those kinds of responsibilities, right? It’s what they do. So, I think we’re going to see prices go up for software and technologies that are really consistent. I hate to see things that, like, you know, we need, we have a hundred percent uptime. I’m like, I don’t think about it. I don’t know if we can actually do that. So it’s fun to kind of joke about it at the same time. Like when you’re critical infrastructure, right? I think we’re to see regulations get a little bit more stringent. I think we’re going to see insurance providers know, cyber insurance providers in particular, really start doubling down on those kinds of requirements. So they get, they, I hope they’re thinking one, two, three times about pushing that update button.

Scott Kinka: 

No, you don’t. Yeah. Specifically on. Yeah. So, I mean, super interesting. I think you and I also had a conversation last week. We were really beating this up. We also talked a little bit about how it changes our feelings on edge, like on the computers and devices we have in the field. Mean, this was a kernel level update, which, so, you know, for those who are maybe not all the way following along at home thinking like it only is affecting a device that running an operating system, you know, in the field. And of course, yeah, that’s dramatic when it’s the device that we’re doing this on, like my workstation. But, you know, we saw the effects of just bricking, you know, displays in airports and really basic applications in retail. Like, and, you know, I make no bones about it. I’ve talked about it on the show a lot. I am a big fan of virtual desktop infrastructure and thinking about thin clients. You know, a thick device should be in a thick scenario. A thin device should be in a thin scenario. And, you know, to hear like, well, the airlines needed to touch 10,000 devices. I’m like, well, who’s… Yes, CrowdStrike had a problem, but that’s a flaw intrinsically in design, that you can’t put people on airplanes because they can’t see when they have to go get to the gate. That is the dumbest machine you could possibly imagine in the simplest environment that should be going on. Like, are we going to have a reckoning in your mind? You know, I mean, I’m sitting here holding, you know, a reasonably thin device. Are we going to rethink how thick the devices that we use in the field are because of this, too? Is that going to change in your mind?

Melanie Thomas: 

I actually hope so. It’s going to be a lot of these organizations are also struggling with a lot of their own tech debt, right? They are super old; it costs millions and millions of dollars to replace kiosks and displays and the systems behind them. So I think as we get more into virtualization and we look more into hyper virtualization of things, I hope that we see more things that are essentially controlled. So something that you can just change the master image, push it out to all the child images, and not have everything hard down, everything needing to be replaced. You still are gonna have hardware issues. You’re still gonna have, you know, displays still have hardware, they still have power, all that great stuff. But I would like to see more centralization of images like that and just kind of more control. It’s complicated; it’s slightly more expensive in some ways and cheaper in others, but it’s important, especially when you’re working off of increasingly smaller staff. So with more automation, people are thinking, well, that’s going to replace me as a human. You’re like, well, in situations like this, you needed as many humans as you could possibly get to get their hands in those machines. So when you look at that balance too, you’re like, well, you can have one or the other, but you still need both. Right. And that still needs to be strategized. That still needs to be planned.

Hope Punk: Approaching Cybersecurity Challenges with Optimism

Scott Kinka: 

Yeah. Sure. Well, and also, mean, you know, really even getting down to what can be running off of mobile operating systems when it’s a device that’s not going to be touched all the time? Like, you know, if those kiosks were running off of a mobile OS at an airport, then, you know, when the thick operating system, the full Windows operating system, went through a disastrous kernel update, those would not have been affected. Like, I think the variance, not just an approach, the variance in device approach will also vary potentially the operating system approach, the distribution approach, as you said, like, yeah, it should have been, wow, this kernel blew up, but I’ve got X thousands of machines out there that are running virtually that I can just update one time and push. If there was more of that going on, yes, this still would have been a disastrous event, but it wouldn’t have been disastrous at the level that it was, right? We’re just kind of a lot of cases where big hardware is being brought to small applications. So I hope it’s a reckoning on that as well. This has been super interesting. There’s a lot. I don’t want to steal all the thunder from your blog entry. There’s a little bit more detail in that. Obviously, if you’d like to talk to Melanie about this, we’ll have Melanie’s contact information. She’s on LinkedIn. You know, she’s here to help customers through this thought leadership as we go on the Bridgepoint side of the house. But we’re thrilled to have Melanie here on the Bridge. Melanie, I want to have a couple of fun questions before we let you go. All right. All right. All right. So let me see what your first off is.

Melanie Thomas: 

Okay, yeah, let’s do it.

Scott Kinka: 

I did this to you six months ago, so it’s probably a little bit unfair, but I need a shameless prediction from you. Maybe it comes from this incident, but give me something in the next 12 to 18 months.

Melanie Thomas: 

In the next 12 to 18 months, I think we’re going to see CrowdStrike’s going to apologize if we stay with an industry. I think my last prediction was related to Taylor Swift, and I think I was wrong. But I think industry-wise, think we’re going to see because Black Hat’s coming at us in a couple of weeks. So I think here in the next 12 to 18 months, we’re going to see some vendors overpromise, and they’re going to get burned. I think we’re going to see some smaller vendors who do have a little bit more ability to be agile in their development really start to shine. And then rounding up that 18 months, we’re probably going to see those big guys swallow the small guys.

Scott Kinka:

Interesting. So, it’ll drive a little bit of consolidation because the risk level on the smaller side has increased dramatically. And okay, that’s an interesting one. What’s, I asked you this six months ago. I don’t recall the answer at this time, but I’ll go back and make sure that I do when I go through my notes at the end of this. But what are you reading right now? What’s on Melanie’s end table?

Melanie Thomas:

I just started a new book. So it’s called The Humans by Matt Higgs. He wrote The Midnight Library, which is a really amazing book. But it’s about an alien that’s coming to blow up Earth and starts learning what it’s like to be a human. And then, you know, our redeeming qualities as humans, right, as we go through our journeys and our lives and adventures. It’s pretty interesting. It’s very fun.

Scott Kinka: 

It’s, that is very super on brand for you with the whole punk story. I got it. I can see that it’s in your reading as well. All right. I have some fun business level questions here. I’m going to pick out a good one for you. on. all right. Well, tell me about the biggest mistake you’ve made as a technology leader. Completely put you on the spot.

Melanie Thomas: 

I know it’s good, good, I like it. I was at an organization responsible for creating some very important things for a board of directors meeting. Completely, completely lost track of that, got very distracted and completely missed the board of directors meeting, completely did not provide that deliverable and have been a very type A person ever since. So it was a big one.

Scott Kinka: 

Got it. You’re never going to make that mistake. How do you deal with that? Are you a list maker? Do you keep priorities? How are Melanie’s big rocks organized in your head? Like what did that change about the way you’re operating as an executive?

Melanie Thomas:

Never, never, never say never again. Very big list maker. Very big into lists. I organize my calendar like it’s my job. So, if it’s not on my calendar, it doesn’t exist. I put work time on my calendar. I put when things are due. I put prep time before meetings. Put weeks in advance, and start drafting and brainstorming things. So, I’m a really big procrastinator in some things. So if it’s a big deadline like this board of directors meeting, I work better under pressure. I’m going to work great as soon as I know. I really, really blasted out right before this, and it’s going to be awesome. Something comes up, and I get distracted, but it just doesn’t happen. So, after a lot of planning, I colour-coordinated my calendar for different things. So I know where my brain needs to be. I’m just kind of allowing myself that time. So, it is definitely something I’ve learned in my professional journey.

Scott Kinka:

We organize ourselves similarly. I colour-coded my calendar. That’s a big tip. I think scheduling work time is really important. I’ve heard that tip quite a bit, and it’s easy to use Office 365, which is what we use internally. You can just schedule X number of hours for me per week. If I don’t do that, I can’t get the big stuff done. And then thank you, by the way, for making me feel like I’m behind because I owe stuff for the board of directors meeting, which we haven’t even.

I’m gonna, and thankfully, I have some focus time scheduled after this recording to get to it. Melanie, it’s always a pleasure to talk to you. Think, you know, hopefully, these 28 minutes so far will, you know, our listeners will understand why we were so happy to add you to our team. We’re super thrilled. This will not be the last time we’re hoping to get you back often. And, you know, we’re gonna continue featuring your blog entries. Melanie’s a great writer. She’s gonna be commenting on what’s going on. Certainly, someone to follow in this industry.

Melanie Thomas: 

Thank you.

Scott Kinka: 

Melanie, we’re thrilled to have you back, and we can’t wait to hear back from you.

Melanie Thomas: 

Thank you. Thank you. I look forward to it. It very fun. Thank you so much. Can’t wait to come back.

Scott Kinka: 

You got it.