Technology is everywhere. It powers our homes, helps us work, and even runs behind the scenes in food production and animal care. But what happens when that technology is not protected? Kristin Demoranville is working to make sure that never becomes a problem.
Kristin is the founder and CEO of two companies: AnzenOT and AnzenSage. Through both, she helps organizations in food, agriculture, and animal care understand how to manage cybersecurity risks and keep their systems safe. Her goal is simple: help people be prepared, stay alert, and protect the systems that grow, feed, and care for our world.
A Winding Path to Cybersecurity
Kristin didn’t set out to work in technology or cybersecurity. At first, she thought she’d be a teacher. Then she worked in a myriad of industries before landing in tech. Her interest in tech took off when she got a job with Geek Squad, eventually moving up the ranks at Best Buy and working in IT consulting for healthcare.
Over time, her work became more focused on technology systems known as Operational Technology, or OT. These systems run equipment like HVAC systems, water treatment tools, and machines used in food production and animal care.
Kristin also worked with gorillas at the Louisville Zoo, a highlight of her career. That time, she says, taught her important lessons about how humans and animals both react to change and risk. Those lessons help her explain cybersecurity in ways people can understand. For example, she often compares risk in technology to how gorillas reacted when something new was added to their space—first with fear, then with curiosity, and finally with action.
Reducing Vulnerabilities and Cyber Risks
With her companies, Kristin is helping organizations recognize and repair cyber risks. That includes farms, food producers, zoos, and aquariums. These industries often rely on technology without fully understanding how it connects to the internet—and how that connection makes them vulnerable.
Kristin works with these organizations to:
- Find weaknesses in their systems.
- Create plans to prevent cyberattacks.
- Educate employees so they know how to respond if something goes wrong.
She uses a simple way to explain this idea: Stop, Drop, and Roll. Just like we were taught to respond to a fire as kids, she believes we need a clear, simple plan for reacting to cybersecurity problems. If something doesn’t seem right, people need to know how to pause, assess the situation, and take action to protect the organization.
Why Cybersecurity Matters in Farm and Ag Industries
You might think a small farm or local zoo isn’t a likely target for hackers—but that’s not true. Any system connected to the internet can be attacked. Sometimes hackers want money. Sometimes they just want to cause chaos. In one case, a dairy farm in Switzerland was hacked, and it caused the loss of a cow and her calf because their health monitoring tools failed.
In food production, attackers might try to:
- Steal recipes or secret formulas.
- Change equipment settings to mess up a product.
- Use one company’s weak spot to get into a larger company’s system.
Kristin also points out that many farms and food processors are already using automation—like milking machines, crop sensors, or irrigation drones—without realizing how easily these tools can be hacked if they aren’t protected.
She wants people in these industries to start asking better questions, like:
- Is this device connected to the internet?
- Do we have a plan if our equipment gets hacked?
- Who knows how to fix or shut down these systems if something goes wrong?
The Human Side of Tech Problems
To Kristin, the biggest problem isn’t the technology—it’s the people using it. Most cyberattacks happen because of human behavior, like clicking on the wrong link or using weak passwords. She believes training and education are the best ways to reduce these risks.
She also wants people to stop thinking cybersecurity is only the IT team’s job. Everyone needs to be involved. Whether you’re running a milking parlor or managing animal care at a zoo, you need to know what to do if something goes wrong.
Education as Prevention of Cyber Risks
Kristin is focusing more of her time on education. She’s speaking at more events, hosting her own podcast called Bites and Bytes, and working on a larger project expected to launch in 2026. Her hope is to keep building awareness and bring cybersecurity into everyday conversations across food, farming, and animal care.
Her message is clear: as technology becomes more common in these industries, the risk grows—but with smart planning and simple tools, we can protect what matters most.
As she puts it, “It’s not about fear. It’s about being ready.”
Transcript
This transcript has been edited from its original form to support readability.
Maureen Ballatori: I’m Maureen Ballatori and this is Spilled Salt, a podcast on the thrills and spills from the food, beverage, and agriculture industries. Today’s guest is Kristin Demoranville. She is building resilience in the systems that feed, nurture, and amaze. And that includes food, agriculture, zoos, and aquariums. Hold on to your hats, folks, because this woman is a wearer of many hats herself.
Kristin is the CEO and co-founder of AnzenOT, a company that makes industrial cybersecurity and OT risk management faster, smarter, and more effective by integrating risk intelligence and automation into every assessment. AnzenOT streamlines cyber risk assessments, helping teams identify vulnerabilities, evaluate potential impacts, and strengthen security.
She is also the CEO and founder of AnzenSage. AnzenSage partners with food, agriculture, zoo and aquarium industries to anticipate risks and build resilience. With her deep industry expertise, AnzenSage provides strategic guidance in cybersecurity operations and business continuity, helping organizations stay prepared, adaptable and future ready. And that nugget right there, the idea of helping organizations stay prepared, be adaptable and be ready for the future was a cornerstone of today’s conversation. She calls it the stop, drop and roll preparedness. And we talked a lot about after we closed the episode, we continued to talk about that concept of stop, drop and roll and how much that was ingrained in us and kids and how that concept of preparedness really needs to be applied to cybersecurity in particular in these industries.
Kristin is also a fellow podcast host. I’ve had the privilege of being on her show, which is called Bites & Bytes. Bites like the bites that you eat from food and bytes like computer bytes. So B-I-T-E-S and B-Y-T-E-S. On that podcast, she’s exploring cybersecurity technology and beyond in food and agriculture. And that is really the hill that Kristin has chosen to climb is the idea of the intersection of cybersecurity and tech and food and ag. And then also, of course, brings in the zoos and aquariums model, but those things being pretty closely related when you think about the environmental aspect of them. I hope you enjoyed today’s conversation. It was a really great thread and discussion on something that we don’t talk about a lot here on the show, the idea of cybersecurity. Enjoy the conversation.
Hey, Kristin, how are you?
Kristin Demoranville: Maureen, I’m great. How are you?
Maureen: Very good. Thanks so much for joining me today. I’m glad to have you on the show. So I just recorded the intro to this podcast and let the listeners know what you do and some of the initiatives that you work on. And I couldn’t even include it all because it would have taken the entire episode. You wear so many hats. So take me back to the beginning before we spend some time talking about that impressive list of your initiatives. Take me back to the beginning of your career.
Kristin: Pleasure. I think we should probably start when I left high school and went to college. I know that’s just like, well, and I originally thought I was going to teach history or social studies to like the 13 to 14 blockage. That’s what I thought I was going to do, which is kind of hilarious because going to college, we realized I wasn’t going to do that. And I didn’t want to do that.
Maureen: Yes, right. I also went to college thinking I was going to be a teacher.
Kristin: Yes, and it’s funny because I actually do a lot more education than I do anything else at this point or like advocate or that kind of stuff. It always wraps around that for some reason. So I guess it’s sort of a full snow crew.
Maureen: Yes, ability to deliver information clearly is really what that comes down to. So interesting.
Kristin: Yes. Yes. So I made a year of that and then I went out and I went to a static school. So I learned I did facials and waxing and things like that. So I did the beauty industry for a bit. I was a makeup artist for several years, did a lot of weddings, realized that wasn’t a thing I would want to do. It’s really stressful. I have a lot of respect for people who do that for a living. And throughout all of that, I was waitressing. So I was working in two different restaurants. One was like a steakhouse style, the other was a pizza place. Super great, everybody should do food service. Also, yikes to that too, of course, because you do all kinds of people. Yes. And this was when smoking was still happening. And so I’ve been in cocktail bars and secondhand smoke. So that was super fun. And then I went back to school and I like, I’ll switch to literature, I’ll teach English.
Maureen: Yes, you learn you. You learn a lot from long days, stamina, and memory.
Kristin: Whatever with that, like dreams, here we go. And then I said, forget it, I’m just going to go work for a bit. One of my clients hired me, I did HR for a minute, not my vibe, respect for people who do it, I’m just not crazy enough for that. And I say this because my sister’s an HR director. Anyways, and then I was like, well, I’m going to go back to school again, you know, like, let’s just do this, like, I’m struggling, like, I wasn’t prepared, I think, at my age to go to school. Which is totally fine. I think we should normalize that and not make it weird. And I got hired at Best Buy as a tech admin at the time and then they acquired Geek Squad and I transferred into a double, I’m sorry, I was a precinct agent or whatever the hell they call it. And then I worked my way up to Best Buy corporate actually. So I drove the Geek Mobiles around Washington DC for a little while. And then I went to work for them as a secret weapon or secret weapon. Basically it was like a call center for agents that were in the field. I did that and then I left there and I went through a bunch of consulting. This is all my IT side. I did a bunch of consulting in healthcare. I did telephony, which again was in my jam. I didn’t finish my degree at that point. Then around 2008, 2009, I think is when the market crashed for IT. I think that’s roughly when it happened. It was the first time technology really got hit.
Maureen: Yes. Yes, I think the market crashed for a lot of things at that time. Mm, yes.
Kristin: So I was caught in that mess because I was a consultant. So I said, forget it. I’m just going to go back to school. I’m going to get a degree in nothing that I’ve ever done and has nothing to do with anything that I’ve ever done. I thought at the time and I got a degree in environmental management, which is hilarious because I work in operational technology, which is like a big portion of that. So it took me five years. I went to the university of Maryland and I was finishing up my degree remotely when I was living in Kentucky. And I got an opportunity to work with a Marietta’s professor to be a research associate with gorillas at the Louisville Zoo. I’d already spent some time in zoos. I worked at the National Zoo in the commissary for a little while. So cutting fruit for birds, which I don’t like doing. But I make gorilla salad every day. So it was like we were feeding the zoo animals at that time. But I did get my wildlife certification with the National Zoo when they were doing that back in the day, pretty badass. Actually, fun fact, I actually am wildlife rehab certified. I just didn’t take the exam. So like I’m technically educated, but I’m not officially licensed. So I’m not going to go pick up on a possum off the street, even though I probably could if I wanted to. But yes, so I worked with gorillas for a little over a year at the Louisville Zoo. And it was probably the best thing of my career I’ve ever done. And I didn’t get paid and it was amazing.
I, it saved my life. I’ll be honest, Maureen, I was in the middle of going through my divorce. I was in a really low spot in my life. Really floundering, I didn’t know what I wanted to do, but watching gorillas really kind of got my head wrapped around like the basics of life. Like what are the basic things we need? Food, shelter, companionship, some fun because they had fun all the time. and then watching humans watch gorillas really informed my IT and security career aspects. I was like, people are weird. People are really weird.
Maureen: People are weird, but help me understand what gorillas and watching people watch gorillas has to do with technology.
Kristin: Sure, so it’s really funny because actually I do a talk on gorillas and tech and or how gorilla behavior informed my security career. What ends up happening is a lot of the way security frameworks are written is a lot about how animals are already protecting family groups in the wild, especially for gorilla troops. You know, what a leader means and what that means to be a leader. And the way that they interact with the environment is a lot like how we kind of look at risk as humans as well as within our jobs because we’re humans. So I talk a lot about how one example would be one time they introduced mealworms into the enclosure where I was watching the bachelor gorillas. That’s the group I was with and there’s four of them and they’re like 300 to 450 pounds. Like they’re big, like a proper gorilla watching them interact with these mealworms was hysterical because they were freaking out. They would poke it with a stick and they didn’t realize they could eat it until like 10 minutes in. And they’d seen them before which is kind of weird. So the way they were assessing risk was really amazing to me because first the reaction was complete panic freak out what is this absolutely hair on fire so I can eat that. I’m going to totally eat that now you know it was really interesting. Then watching people watch them troubleshooting was really interesting because people were like, well, ew. And then they had the same reactions in a way, but just on a different side of the glass. And it really got me thinking about how we view risk, because there was no risk to those who were there for their enrichment, if you will. But because they were nervous about it, they didn’t look at it in a way that was proactive. It was more of a reactive situation. So it made me start thinking about how we wrote frameworks and how we continue to write frameworks and how we interact with security and technology.
Maureen: But before you continue on that, because I’m sure that that thread is going to lead us to the work that you’re doing now, when did that interest in tech start? Was it the realization in 2008 and 2009 when a lot of that stuff exploded or?
Kristin: No, no, I think I was starting getting interested in technology when I was in high school, I think roughly around when the internet became like a real household thing. So like 94, 95 ish, I would say. My dad had a computer and was like a big CRT monitor and like the big tower and all this stuff. And he had some games there, but he and I were locked out. So I hacked my dad’s computer to get to the games that I wanted to play because I don’t, I don’t do well, so…
Maureen: And I think too, like the way the computers were set up back then, I used to tinker around on the computer all the time too. Literally, I grew up on a farm, my siblings would be outside, I would be inside, I have distinct memories of like, everyone is inside, outside, I am inside at the computer, just like tinkering around in the operating system. Why was that my interest? I don’t know. And it sounds like to you, like it was like, there’s games on here and I want them and I’m going to figure that out.
Kristin: Yes, I mean, they were password protected. It took me a minute and then I was in. But I don’t really think at my age, I probably should have been playing Leisure Suit Larry, but like, whatever, it’s fine. It was like a two bit situation. So it wasn’t like it was really that offensive. But it really, I hung out with a lot of friends in high school that were also, they were into theater lighting and tech for theater. And I was in that crowd as well. They would play Dungeons and Dragons together. We all talked about building PCs. My first PC was built with my friend, Paige. I do distinctly remember laying the processor on and freaking out. And then later on, it just kind of blossomed. I have the aptitude for it, so it took off. I got lucky that I got started early and was able to learn really fast on the job. And then after I finished that degree and working with the gorillas, student loans came in and I was like, I gotta get a job, you know, like deal with this. So I ended up at this bakery company. So I jumped into this food company. It was finished goods and ingredients and it was in Atlanta and it was such an amazing job at the time I look back on it I think, my God, it was the hardest thing in my life. I left the IT world to the director and I had to start back up as a level one desk analyst, like it was eating the humble pie literally. And I worked my way up to Chief Information Security Officer interim before I left. Yes, before I left and I was the highest rated security person within the corporate environment and all because my boss had left ultimately. And then we had our first breach and my first breach, which was you never forget that. And it was, now, Friday afternoon. And it was bad and crash teams were called in and I was having jerks with my old corporate lawyer from there and we were reminiscing about it. He’s like, you were just so great about it. You’re so brilliant. I was like, I was a freaking mess. Said, you have no idea. Internally, I was freaking out. I was calling people who were traveling and you know, Southeast Asia to yell at them because, you know, I didn’t know what I was doing. So.
Maureen: Well, so what happened? You said that there was a breach and what was breached? What happened?
Kristin: Sure, I can disclose a little bit. This was part of the scams that were running. I think this has been about 2016, 2015, where people were having their tax returns basically stolen and people were filing for them. And that’s what it was. So it was actually a really big problem. So one of our developments got filed that we didn’t know about. Long story short, people were sending things that shouldn’t have been. were 100 % spear fished, if you will, or whale fished or whatever you want to call it. were able to, the hackers were able to determine the social dynamics of the company to the point where they knew exactly which executive would get people to jump. And the thing that was really, really, really hard about it was, is the person who did it actually did it securely, which is hilarious. Send one email and then set the password for the next email, now, like did it the way they should have done. And that’s, that was the really hard bit because it was like, it was like not bad behavior. It was sort of great behavior, but the fact that they didn’t recognize that this person was being impersonated, but also that that person really was a jerk and really needed to stop it because they made it easy for these hackers. Like stopping things easy for these people, like please. But it’s so interesting that like, again, it comes back to social dynamics and people’s behaviors. It goes right back to that gorilla aspect for me every time. It’s just like the simple basic behaviors that we just need to not allow people to modify and adjust for their financial gain or whatever they’re trying to sabotage or hurt people or whatever’s happening. So yes, that’s kind of basically what happened. And of course it happened on a holiday weekend at like three-third in the afternoon on a Friday.
Maureen: Yes, no one’s around, everyone’s half out as it is. And so you’re like, wait, this thing is happening. So that is this idea of social dynamics and human behaviors and how technology is connected to human behaviors, especially as it relates to food, eggs, zoos and aquariums is what you are focused on now and the central point of your work. Tell us a little bit about that.
Kristin: Yes, it’s where my sweet spot is, guess is what I’ll say. A lot of people, there’s a lot of cybersecurity people out there that are generalists, which is fabulous when you have those people big time. I just really like to niche and I’m also part of the operational technology side. So that’s all the equipment that we use in our world to power a modern world. So things like dams and water treatment facilities and elevators and HVAC systems, those are all controlled by computers that are probably connected to the internet for some regard. So I’ve niched down even further because I’ve been sector niched and there’s not a lot of people coupling the sector, unfortunately. And that’s part of the reason why I said, you know what, I’m going to do this because we need people to get in there and start helping deal with and manage these issues because Asian states, bad actors, whoever you want to say are coming for us and it’s hard. I created the firm because I saw the need, obviously. And I have had experience in it.
Maureen: You saw the need not only for the niche, the opportunity for the niche, but the need for someone who understands that ecosystem to help protect us from those bad actors. Is that the idea? Yes.
Kristin: Right. That’s really the idea. And the other thing too is realizing that inside of these food companies, so production in general, cybersecurity is now part of food safety culture because we touch food. Our equipment is touching food. And how do we partner and bridge these gaps? And a lot of people still are stuck on the stereotypes that IT and cybersecurity are, you know, an ivory tower, we’re not approachable, or we’re wiggadoes, or whatever. We can’t be bothered, and we’re politicians, or whatever you want to call us. And I’m really trying to bust down those silos. I’m a disruptor. I move across. I don’t bother with these hierarchy things. I see everything in a systems sphere of thinking. So really getting people to understand that, hey, it’s just part of your job. I need to pay attention to it. I’m not telling you I need to do anything about it, but you need to raise a flag if something goes wrong. And this is what you do. I don’t want people to turn into inflatable two people and be like, like, I don’t want that. I want them to be able to be like, crap, I think I’m being hacked and know what to do, like stop, drop, and roll. And I think that’s super important when it comes to ages and zoos and anything else in that sphere is people don’t have time to do 18 steps or a damn checklist. They need to know what are the first two things they need to do and then how to respond. That’s it, that’s all they need.
Maureen: That’s what an individual person needs when there is something that they recognize that happens at their organization. They need you to recognize this, maybe something. I think the stop, drop, and roll analogy is actually great, right? It’s like, I think I’m on fire. I should stop, drop, and roll. And so that’s what you’re referring to. It’s funny too, because I can’t be too specific as I find in any time I talk with you or some of our friends that there is the exact disclaimer that you just mentioned when I was asking you about the ingredients company and what happened with the breaches. I’ll say what I can say. And so I work with an organization in some capacity that has this mindset of technology, information technology being something that transcends the whole organization and isn’t just a department who is responsible for replacing your computer, right? It’s the idea of it being that much higher level up in the way that you’re talking about and they are a food company. But as you said, it’s really uncommon. What are some of the things, so not only is your niche a big opportunity and your role a big value because of your knowledge of how those systems all work.
Kristin: That was so uncommon.
Maureen: But what are some of the things that organizations like that are in food, ag, aquariums, zoos that they’re missing, that they’re not aware of?
Kristin: Sure, it’s really just awareness to be honest, Maureen. You kind of already said it. A lot of times people don’t know what they don’t know because either they haven’t been taught or it just didn’t sink in for any relatable reason. I was speaking at a large Zoom conference this past January and I was waiting to go on stage and I decided that I was going to get onto the Wi-Fi and take a look and see who had their devices on. And I was like, know, because I don’t normally do that, but sometimes I do, because I think, well, maybe I need this as an arsenal moment kind of thing. And sure enough, where basically everybody was on the Wi-Fi and I could see things like Bob’s iPad and Sally’s laptop and all these things. And I could get to like their open ports. I probably could have walked all the way through to the computer if I wanted to. If I was on a different device, I just happened to be holding my smartphone. So I got on stage and you know how like, I used to speak a lot to Maureen. So you know, there’s sort of like a weird lull where people are like, they’re either processing or they’re zoning, it’s one or the other. So I saw that kind of hit the crowd. And all of a sudden I went, you know, I’m not, I didn’t, wasn’t going to mention this, but I think I need to. Most of you are on the wifi and everybody’s like, yes, they had a kind of nodding. And I said, okay, well, none of you are using a VPN. The comments after were, what’s a VPN? What am I supposed to do with this? It’s a virtual private network. I thought it was a common thing, like me being me and I didn’t make the connection in my mind because I’ve spent too much time in corporate land. It just was like the basics. Yes, so I shouldn’t connect to the airport Wi-Fi, right? No, not without a VPN. What about the hotel? No, absolutely not. Like, what are you, are you doing work stuff? Are you doing banking? Like, please don’t, please don’t. Like, don’t make it easy for people to take advantage of you. So it became this really concerning moment of, my goodness, I really have to go back to like absolute basics which is totally fine. And my bad too, I should have made that connection in my mind. But getting people to realize that there’s all this great cool stuff that’s coming on the market, whether it’s ag tech, I mean, you’ve had some guests on as well, or if it’s the newest and greatest thing for the zoos, whether it’s life support system or whatever, you know, that’s great. I love tech. I think it’s awesome. Put it in if you want, but for the love of God, please have a security professional look at it with you or because it’s not made with security in mind. None of this stuff is made with security in mind.
Maureen: Right. And, but talk about why that’s a concern, right? Like, why is it a big deal? And also for listeners, Kristin told me this story the last time we were at a conference together. And I hope the hackers aren’t listening. The last time we were at a conference in Virginia and I was like, Kristin, I don’t use a VPN. You gotta help me set that up. like, so what is the bad thing? First of all, from an individual’s perspective of what is bad about getting on the airport Wi-Fi. And then from a company perspective, especially as it relates to these companies in the industries that we’re talking about, what is the thing that can happen if the life support system is installed without security and mind is a hacker going to come in and shut it off to kill all the gorillas?
Kristin: No, I don’t I don’t think it’s going to be that well it could be I shouldn’t say that it won’t be for you know, never know but I will say that what they’re trying to more than like what they’re trying to do is just disrupt if they can disrupt and hold things for ransom if they can disrupt and cause chaos if they could disrupt and cause harm Sure, all that can happen disruption could also mean financial Obviously, that’s probably the goal. However, we have to deal with agro terrorism and eco terrorism and all this other terrorism ish stuff
Maureen: Sure, you never know, right?
Kristin: So some of it’s just for the sake of being a jerk, like just a hurt. And I’m not going to go down that huge rabbit hole of yikes. But what I will say is, people just need to be aware if something’s connected to the internet, they need to know that it’s probably and more than likely hackable. So the VPN, it just protects you. Essentially, it’s putting a shield up in front of you. When you connect to a Wi-Fi like let’s say in an airport. You’re basically connecting to everybody. Everybody else’s devices are on there with you. So it’s like being connected at home, right? Like we’ve got our smart devices, our computers, our laptops, whatever. Everything’s connected and I can see all of it in my home. That’s fine because it’s a trusted network. But I don’t know these people at the airport. I don’t know what they’re looking at. What if they’re looking, what if they’re falling for a fish at that moment on their phone sitting across from you and their credentials are leaked to them because your device was on that network. Now you’re gone too. or what if something asks you to log in while you’re there and then your password is exposed? It’s very easy to pull things or if you’re looking at your bank account. I mean, at that point, the device is being cloned on the backend if it’s an actual pineapple type situation. Pineapple is usually this call to the receiver that’s spoofing or mimicking the actual Wi-Fi that’s in the airport. So it’s really just a good idea to have a shield up in front of you. There’s also some additional benefits, I would love to share right now. You can connect to other countries and watch Netflix in other countries. Like, how great is it if you’re into anime, you can totally watch Japanese Netflix and get all of the anime you can’t get in the United States or whatever. I have a dedicated router in my house for UK TV because my fiance is British, so he has access to all the UK-ness that’s there on his TV in his office because I’m a good partner like that. But I will say that there’s some awesome benefits to having a VPN anyways. It also covers, it makes you look completely invisible, like you don’t exist. And that’s how I knew that none of them had VPNs ultimately, because they all existed. So yes, it’s again, it’s just a shield. I know it’s a bad example, but it’s.
Maureen: Well, no, those specifics are really helpful to understand, but take us to the industry, you know, so for anybody who’s listening, who is connected to food, ag, zoos and aquariums, what is the, what are the bad actors trying to do? You know, what are you protecting against with your cybersecurity measures in those industries?
Kristin: Sure, we can just go from basic, which is just reputation. Say you have a competitor who hates your guts and wants your stuff, as just a really bad example. Steal a patent, a recipe, or anything. Yes, they could hire a hacker as a service and some bad actors. You literally can go on the dark web and just hire people. It’s really kind of wild. And say, hey, I need this, this, and the other thing. And also, the hackers don’t care. They’ll take what they want and probably destroy most of it on the way out. The other thing too is financially motivated. So if you are a small producer that produces into a large producer, which is obviously just about everybody, they don’t necessarily want to go after you. They want to go after your parent company. So they will come in one way and then they’ll try to bash into the parent or they’ll cause havoc because you only make one certain agreement ingredient for this most super popular thing ever, yes, that’s bad. That’s going to hurt everybody in the long run. The other thing too that we’re seeing now is there’s manipulation on the production lines or during using certain parts of farming equipment. Things could be changed and people don’t know until basically too late. We’re seeing that in a lot of different places. Unfortunately, dairy is actually getting hit really hard right now, which just breaks my heart because that sucks because they’ve got a lot of other issues. They don’t need this either. And a lot of it comes down to they don’t have time. The tech is there to help them produce and to do things faster and more efficiently and sustainably and all these wonderful buzzy words, right? But the problem is, none of this was created with security in mind because it’s not regulated to be created with security in mind and nobody’s going to do it because it costs money to do it. There has to be parameters set in place. Now. I’ve talked to several farmers recently, actually, who’s kind of I think I’ve shared some of this with when we saw each other. The converts to marine weren’t even aware that the Wi Fi password would be a problem to give out to anybody visiting on a farm tour. There. And I was like, don’t ever do that. Like, don’t, because you don’t know who’s on your farm tour either. And that’s a big concern because it’s again, going back to that social engineering, it’s going back to the basics, like again, with the girl behavior of people being exploited because of the kindness of who they are. Generally, most everybody believes in the kindness of others. I’m not saying you have to look at everybody with a, you know, a side eye, but you should look at everybody with a side eye. know? I have a friend who calls it the evil mindset. I just call it a security mindset. I’m like, yes, it’s so negative. Like, I can’t call it that.
Maureen: Yes. I grew up on a dairy farm. And so that example in particular hits close to home, literally, is that when I, it’s not still an operating farm, but if it was, I mean, when technology rolled out and we never used it on the farm, first of all, at all. The first time I remember, like my dad, engaging with technology, we would always joke with him that he was like a one finger typer, two finger typer, you know, cause he would poke at the keyboard because he was just, he was a farmer. He wasn’t tech savvy.
And so I think that that’s something that is a challenge too, when you think about the average dairy farmer in the United States, we’re not talking about a 10,000 head farm. We’re talking about less than 200 heads usually. And that farmer, if they have relied on technology in their operation, they don’t think, and I’m generalizing, right, but you’re telling me this is a problem, that they don’t think that I have to check the temperature on this setting or that I have to monitor this, you know, and it’s that sort of thing, right, of bad actors coming in and hacking things to change them just for the sake of doing it that the average farmer doesn’t think that they’re ever going to be a target of.
Kristin: Yes, there was an incident that happened in Switzerland. I can’t remember. It was the last year, beginning of this year. I’m so sorry. I cannot remember everybody’s dates. But what I will say is it was such a devastating case because first of all, I didn’t, I mean, I don’t read Swiss news, right? Like who, I don’t as much as I probably should. Maybe I should now. But it was a dairy farmer and they were held at ransom. And I can’t remember if this particular person paid or not. It doesn’t really matter either way. They’re still going to get hurt. Their data was so corrupted that they actually lost a cow and a calf because they weren’t able to figure out that the calf was in distress and the mother was in distress while giving birth. Because, you know, they have the little tags on them, little IOT tags and things like that because their instruments and their network was so damaged. And I thought to myself, here we go, because now we’ve got the emotional toll and the mental toll on a farmer is already really heavy because we already know that’s a problem. Now you have to deal with technology causing these issues on a whole other level. And now we’ve got to deal with a dead animal, two dead animals in this case. And it was just like all these things just kind of like came in my head and I was like, ew, this is really ridiculous. Like the people are this bad and this this It’s unnecessary, right? And when you were talking, you actually made me think about a conversation I had a couple of years back when I first started my company. And a lot of people in the security world don’t understand how automated the food industry is and agriculture is. And I was on another podcast with a very popular podcast for cybersecurity people. And he said, well, I thought cows were milked by hand. I said, well, they can be, but not for thousands of them. at one time, like these cows need to be milked regularly. There’s no way. So because of that, I kind of had to educate him live on air and not laugh because I was really trying not to laugh and be like, nobody, can’t, you have to, you have to put these cows up. And I said, I explained to him, like, it’s a circle, it’s a whole thing. It’s all this industrial equipment. Like it’s really pretty amazing. The cows don’t mind. They don’t care. They just want to get milked. And yes. and will they get food sometimes when you know, it’s all how they handle it. But the fact that he didn’t realize that and then I said, let me blow your mind one more time and say, hey, that’s not just one cow in your milk carton. And he was like, I can’t, I don’t know how to talk to you anymore. And I was like, you need to do some research. You know, I said, you need to actually know where your food comes from. And that’s the biggest problem. Nobody knows where their food comes from anymore, for the most part. And the supply chain in the food system is so interconnected and complex. And we did that. We totally did that. That’s a human problem. Because of that, nobody knows how to protect it. Because everybody’s like that, we need to protect the whole thing. Sure. But we’ve got to, we get a literal bite off, pun intended. We can chew. We can’t just, you know, stick to the whole supply chain. So many layers.
Maureen: Mm-hmm. Yes. Right. Because there’s so many layers to that whole thing, right? When you’re talking about a fragile supply chain as it relates to food manufacturing, you’ve hit on a piece that’s very close to me. My husband’s in food manufacturing. We work with a number of clients who are in food and bev manufacturing. It’s a special niche for us because for many reasons on the marketing and operations side, but that’s another day. The idea of a fragile supply chain is true both with the production of the food supply and all of the technology and all of the factors and the environmental factors and all those things that impact what the output of the farm is, whether that’s dairy, vegetables, specialty crops, whatever it is, as well as the production process, which is a whole other thing that I’m sure is a big factor in what you’re working with, because that’s all automated. Anyone who’s anything at scale, even not at scale, with the co-packers that are producing, you know, small scale for producers, but they’re getting scale, you know, like by adding up those little ones. So there’s, I’m seeing this permeate all through that process. And it makes me think of, I’ve always heard that our power grid is very fragile too. That like one wrong move, you sneeze wrong and it could fall apart. I’m getting the feeling that that is kind of what you’re talking about here. Help us understand how common this really is. Like, are we just talking about a random story in France and in Switzerland and, now, a story here and there in the US? And is it like, you know, it’s just a handful of years throughout the course of a year or is it? more widespread than that.
Kristin: So there’s been an incredible rise in security attacks in the manufacturing sector. So we’ll just put food production there. There’s not been a lot of research done on what’s going on in agriculture. And if there’s a study out between now and when this podcast airs, then great. But I have not seen enough data to support it. A lot of times people don’t report. And you’re not required to report unless you’re underneath SEC guidelines and regulations. We’re not even realizing it’s happening. and nobody talks about it because there’s a shame component to this. Like, oh, I got hit, I should feel shame. And my response back is no, why? Because to me, that means you’re a legitimate company that is hackable. I suppose it’s kind of a good thing and not in the regard that you’re valuable. That’s good, right? You want to be valuable. But the rise has happened quite, it’s just blasting actually at this point, it’s really huge. Critical infrastructure attacks in general and food and agriculture are considered critical infrastructure have increased to like tenfold. It’s ridiculous. Not tenfold. That’s a lot. But yes, it’s a lot. It’s definitely when I see the numbers, like, you know, kind of do one of those pullbacks. I think what happened was, and this is just my opinion, where people could take it or not, digital transformation back in like, 20, the early 20, 20,000s, 20,000 Jesus, 2000s. So it started to happen and it sort of was slowly creeping and then all of a sudden like blasted like 2010 took off. I’ve been involved in several digital transformations and I will tell you they’re chaos. People don’t. Because people are so siloed, Maureen, that they don’t understand how one thing affects the other on the other side. So I’ve watched stuff break. I’ve watched people be unsafe. I’ve seen it all. And a lot of this digital technology that’s being put in is for the betterment of the employees. Think about cutting lines for chicken processing plants. You want that. You want that. You want that tech in. You think about it, I was talking to a farmer the other day who was telling me that he’s going to be getting irrigation drones. So his workers don’t have to go out into his tomato field into nightshade and get sick. And I was like, holy crap, this is like, this is the good stuff. Like I, this is the stuff I wish people would talk more about, which we do in some ways, but not in others. But also my response back was how are you going to keep those drones safe? And he’s like, I don’t know. And I was like, oh, good. I have no idea.
Maureen: Big shoulder shrug, no idea, yes.
Kristin: And that’s frustrating to me that we keep throwing tech into these places. So really what needs to happen is people need to understand their environments. And I realize that’s an undertaking in itself because you have legacy people that have been there for like 40 years. To me, that’s crown jewels. Like you need to know, cause they know to hit the wrench to the side of this, the particular pipe at one time before it blows up the boiler or whatever. I really want to see that information be captured because these facilities are environmental disasters, they’re hazards to people’s health, there’s all these other factors that can be involved. People don’t even know that the one of things I get people on all the time, is at zoos as well, are you the little boxes that sit outside office buildings or various other places, they’re little rat traps or whatever, those are actually IOT, they ping. And people are like, I didn’t know I was interconnected. I’m like, it’s fine, but you should know what’s in your environment, you should know what’s there. And also, you need to make sure you have a plan and a strategy around it. And a lot of people are like, I don’t want a cybersecurity strategy. I was like, but it’s part of your disaster recovery. It’s part of your business continuity. It’s part of everything that you do. And people don’t understand it. This is technology. What we’re talking about is technology. You need to do something to protect it. I’m not telling you to spend more money.
Maureen: Right, your phone, Yes, and it’s the idea of what you’re talking about with stop, drop, and roll, right? How can you prepare people to stop, drop, and roll? And that idea of having that plan in place so that when the worst happens and as it becomes more rampant, they’re prepared.
Kristin: It’s going to be hard. And I think we’re behind in this anyways, it’s just as a society, because stop, drop and roll was taught to us since we like to talk, you know, we got it in schools. It’s a national thing here in the States, also global, they have different versions of it. But it all means the same thing. Why haven’t we done that with security awareness? We’ve got kids in school that will never know a world without AI.
Maureen: Oh my God, don’t even get me started on kids because that’s a whole other thing of what they are sharing online? Where are they engaging? I was up to no good when I was sitting on that computer when I was 10 years old and my family was playing outside and I didn’t know any better. So I think that that is a great, great question of what is the stop, drop and roll campaign of tomorrow that we can teach to youth today and so to answer your question of why doesn’t that exist, I think it’s just because it hasn’t been around for that long, right? When you think about, well, not back since the creation of fire, right?
Kristin: But it has. What if it has?
Well, no, that’s true. That is true. But I will say that, you know, I heard an interesting phrase the other day. I don’t know if it was an article or somebody said it to me. But where AI is today is where the internet was in 95. And that was like, like a total explosion in my head. I was like, what?
Maureen: Yes, with the idea that it’s going to continue to grow and permeate and yes.
Kristin: Be part of everything that we are in our lives. And it already is in some ways. But I think what I’m concerned about is we haven’t gotten the basics right. So like an example I saw your rant post today on AI. So I appreciated that. And we’re just going to lean into that for one second. Yes. So we’ll lean into that for one second. What I think what’s interesting about that is people still have to learn how to read and write.
But ultimately they could open up AI and just talk to it and it could do all that for them. Are we going to skip reading and writing? Like, are we going to skip that? Are we going to just straight into AI? Like, I have questions now because, I mean, yes, I use AI too. I couldn’t do my business if I didn’t have it, I’ll be honest. It covers over several employees for me, it’s beautiful. But I’m not calling it out as like the be all and end all, the godlike factor of fact, if you will. So it’s one of those like, are we going to, how are going to teach this? So we have to teach more critical thinking and more discernment in that thinking.
Maureen: Yes, right, with the idea of what she’s referring to for anybody, because this will release after, right, is that my rant was about the idea of AI is great, AI tools are great, you should use them as a tool, they are not the end all be all and you still have to use your brain. And so what you’re getting at is how do we teach the future leaders of tomorrow?
To leverage AI and still use their brains. And it’s so interesting because I have a nine and a 10 year old and my 10 year old in particular, when I see him engage with an iPad or look something up, I’ll say like, can I look up whatever. The first thing he does is he goes to a search engine and he pulls up the talk to text and he just talks instead. He’s like, I’m not typing, right? And it’s…
It’s little things like that that I observe. Like I would not, I rarely talk to tax and he’s like, I don’t have to spell that word. don’t have to, you know, so it’s, but to your point, how do we teach discernment? How do we teach that you have to use your brain? How do we teach you to think about what you’re putting into social media tools, to search engines, to AI tools, to everything that you’re putting in writing. I am also very cautious.
I reached out to a friend of mine the other day who was an attorney and I wanted her opinion on something. And I intentionally did not put in my text to her because it wasn’t written. I intentionally did not say, I’d like your opinion. I did not say I wanted to run a scenario by you, like so that nothing could be pointed back to say you called her for legal advice. Right? It was just, hey, I have a question on something. I wonder if you have a few minutes to talk.
Maureen: It’s those sorts of things that even I think are 20-somethings do not realize. And when we go back to the main topic of what we’re talking about is these sectors of food, aquariums, and zoos, are they all thinking like this? And that comes down to the people and the systems like you’re talking about and being protected so that as this continues to develop, you’re creating and building a safe organization, right?
Kristin: And I think it depends on the size of the facility. So let’s be honest, we can discount that. We’ll just put to the side like Disney and Busch Gardens and things like that, because those are large corporate publicly traded organizations. Which that’s the side because people will argue with me that people are there that are doing security. Yes, of course. You know, but what I will say is that smaller zoos and even in the accreditation process of zoos are not requiring any type of cybersecurity requirement. And again, we’ve gotten to the point where there’s so much tech in these places, they don’t even realize where the tech is. I had that same conference I mentioned, a woman stood up and said, how, and I think she was saying it in just what she was also very serious in saying. She goes, how close are we to Jurassic park? And not because animals like that are extinct coming alive, but like the electronic locks and the, and the electric fences and things like that. And I said, well, you all are very much a key based culture. I don’t see that happening anytime soon, but it will probably be a first line, not a second line, you know, or vice versa, that kind of thing. So it’s all an understanding how the tech is being used in those places that’s super important because you don’t want to hinder jobs or make people unsafe because most of the stuff is there to keep people safe and keep animals safe, especially in a zoo. But what people don’t understand is how it interacts with the world outside of their facility or even inside their facility.
There’s been several things in the news recently about insider threats. And I know my fellow cybersecurity people are going to be like, it’s just bad offboarding of employees and they were disgruntled and da da da. Why are you just disgruntled in the first place? That’s the number one security issue for me. Number two, why wasn’t, yes, sure, their offboarding was awful. Like why are their credentials still logged in? But third, why did they go exactly to where they knew they would be the most vulnerable and they could do the damage?
that screwed up because now you’ve got a problem and that could have been raised at some point. You just ignored it or it wasn’t valued at the time or they didn’t say anything. You shouldn’t be empowering your employees to say, Hey, I see a vulnerability in the system. Well, that should happen. I think that’s what scares me. And I’ve been saying this forever is it’s not the tech that’s the problem. It’s the people around the tech. And I think that we constantly go towards the tech is the issue and we need to protect the tech. No, we need to educate the people.
Maureen: Yes, right.
Kristin: We need to educate people to be able to handle a situation or to mitigate it or to completely not have one at all. And so I tie a lot of my work into business continuity and disaster recovery, incident response, that kind of thing. A lot of strategy, a lot of advisering, a lot of these places just don’t have a security person. Or I had somebody say something to me and this stays with me and I should probably put it on my wall as like a poster or something. But someone said, I said IT is not cybersecurity.
And someone said back to me, I thought IT was cybersecurity. I thought you all were the same. And I said, well, we’re not. I said, I’m a hybrid, so I’m not offended by that. But if you were a true blue, I got you green, cybersecurity, you’re going to have a problem with that statement. And the fact that people don’t understand there is a distinction in skills. So that’s like me saying that, oh, you’re like a large cat person, so you’re going to work with the elephants today. Because why would I put you in hoof stock? Like, that doesn’t make any sense.
Maureen: Right. Yes.
Kristin: So I’m sure that happens, but ultimately if your specialty is where it is, it is where it is. So how do I get people to understand that there’s so much more than just, I type on a computer or I type on my phone or I have these little devices I do whatever with, whether it’s testing food or testing different things in a lab. Where’s your data? Follow the data is what I always say a lot of times, follow the data.
It turns out that zoos and aquariums use very similar data for their species documentation, things like that. That was a little concerning to hear. There was no redundancy there. What are we going to do about that, people? Because you have the power. And someone’s like, no, we don’t have any power. I said, you guys are all buying, you’re the power, you have the power. You can come and have changed together as a group. You are quite loud, that you can do this. And it’s so interesting because Tech is going to solve a lot of our problems with agriculture, course, sustainability, things like that. But who’s going to sit down and teach the farmer about their GPS tractors? I mean, who’s going to teach that to, what is the average age of a farmer? What, 63 or something like that or somewhere? I can tell you right now, they’re not going to want to learn that. Like that’s going to…
Maureen: I think so, yes.
And there’s the next up and coming generation and the generation after that that wants to bring technology. There’s all sorts of emotional apprehension there that relates to the passing of the baton of the generation. So the last question for you is related to that. What’s next for you and how are you working to protect these industries?
Kristin: So next for me is a lot of education. Yes, I’m actually excited because I’m speaking more at attraction type conferences and things like that. I’m really getting into conversations with a lot more of the zoos and various other places like that. It’s been an absolute honor. I consider it an honor every time I get asked to do something or be in the presence of these people because, like I said,
Maureen: Sounds like it.
Kristin: We’re going to grow and save my life ultimately. And so I feel a lot of need to give back in that regard. Besides, now, five year old Kristin wanted to be an oceanographer. So there’s some kind of like, give it back there. The other thing too, is I do have a project that I’m working on. It won’t be out until probably autumn of 2026, but yes, there’ll be a lot of interesting information that will be set around that. I’m really excited about it. Also really just, whoa.
You know, there’s a lot of really amazing things that are going to happen and I’m really excited about it. Other than that, the podcast is going really strong. So I do have a podcast that talks about this intersection of cybersecurity technology and food and agriculture and more. Maureen’s been on it. And if you want to listen to that episode, it was great.
Maureen: Yep, that’s called Bites and Bytes podcast for anybody who wants to look it up. Sorry.
Kristin: It’s bites and bites, but that’s okay. So it bites like you bite something and computer bytes. Nice play on words by me. And yes, we were award winning, Actually. I won an award last year, which was like, whoa, I still think those people are crazy, but it’s fine. And I will say that I think there’s a lot coming out of that right now because I’m having a lot more interesting conversations and deeper conversations. I’m sure this is like your seventh season, so you totally understand what I’m saying.
Maureen: Congrats.
Kristin: I’ve really had a lot of interesting conversations with farmers recently and just the struggle is real. It’s real. It’s really, it’s gutting to hear what’s going on. But the problem is, that, you know, a lot of it is down to financial. We’ll just say what it is. People can’t spend money on things like this. I’m sure you know this too, Maureen. Meaning, marketing is also considered expendable at times. But ultimately you’re glad you have it when you have it.
Maureen: Yes it’s kind of, it’s like insurance, right? I mean, you’re protecting the future scenario. And so I’m glad that you’re engaging, especially farmers, to tell that story because they will listen to above all their peers, you know? And so for you to be able to pull that story out of farmers to help educate other farmers, I think is a beautiful way to do that. So yes.
Kristin: Trying. I think we all are in our own little niche nerdy group that we have.
Maureen: Yes, I love it. I constantly call, we are in this group, Andrew Rose has championed and I call it the Ag nerds, belovedly. And I just love that. So thank you for being part of my Ag nerd community. I appreciate you joining me on the show today and sharing some of your background and expertise in this industry to help educate those who may need to hear it. So thanks for taking the time.
Kristin: Absolutely, partner. Thanks, Maureen.