Scott Luton (00:02):
Welcome to Supply Chain Now, the number one voice of supply chain. Join us as we share critical news, key insights, and real supply chain leadership from across the globe. One conversation at a time. Hey, good morning, good afternoon, good evening, wherever you may be. Scott Lewton and Myers Sanoy here with you on Supply Chain Now. Welcome to today’s live stream. Hey Myers, how you doing today?
Maithili Shenoy (00:25):
Doing great, Scott, how about you?
Scott Luton (00:26):
Wonderful, wonderful. And I tell you what, we’ve got such a great show here today and it’s so great to have you back here on Supply Chain. Now folks, it’s the Buzz where every Monday at 12 Eastern time we discuss a variety of news developments from across supply chain and business news that matters what we like to call it. And all month long here in October, Buzz is powered by our friends at Altium, an innovative organization that is redefining electronic product creation in a software defined world. Folks, you can learn more at altium.com. Now Myers, big show, big topics, big guest today, big cohost today. We’re going to touch on a variety of topics including the critical human component here in the golden age supply chain tech, one of my favorite topics to talk about. Hey, what did US manufacturing activity look like in September? Well, the data is in.
(01:14):
At least one story of the data is in. We’re going to be taking a look and we’re going to be discussing how the tech skills gap is a growing challenge across industry, all of that and much, much more, and Myers, about 15 minutes or so. We’re bringing in two special guests, Andrew Austin and Bob Carver are both here today. We’re diving into their expertise here near the beginning of cybersecurity awareness month. So folks, stay tuned for these dynamos. So Myers, as promised, this is going to be a big show here on the first Monday of October. Are you ready to go, my friend?
Maithili Shenoy (01:46):
I am ready, Scott.
Scott Luton (01:48):
You’re always ready, I feel like Mylee. I mean, the whole world is turned upside down in some cases and we got a lot to cover next hour, but I can’t wait to hear your take on these topics. So folks, buckle up for a big edition of The Buzz powered by Altium right here on supply chain now. Okay, so Myers, we’re going to cover three things before we bring in our guests, right? Let’s see here. The first one is over the weekend, we published the 190th edition of With That Said.
Maithili Shenoy (02:17):
Wow.
Scott Luton (02:18):
Yeah, how about that?
Maithili Shenoy (02:18):
That’s a lot of editions.
Scott Luton (02:21):
Tell me about it, Myly. And no one else cares about those numbers except for the team that puts them together, right? Folks, we led with some big key takeaways from Change 2026, which is a big industry event powered by our friends at ASCM. Took place last week in Long Beach and we couldn’t be there in person this year, but we reached out to our friends there to gather and then to share some key takeaways from all the conversations. And check this out, Myly. I love this theme that seemed to be recurring and ever present throughout the event. Now here that in this era we’re in, technology may well be advancing innovation right and left at an ever-increasing pace, but people remain the most important driver of supply chain success. So check out that one and all the other key takeaways from change. We also included in this, with that said, connections between barbecue and optimized manufacturing processes.
(03:14):
And then finally, Myle, we shared one of our newest favorite accounts on X. It’s called Excel Humor. And get this, it’s an account dedicated to spreadsheet jokes. So talk about your niches to folks, give it a look. But I got to ask you, Myer, did you have a chance? I know you had a big weekend, but did you have a chance to check out with that set?
Maithili Shenoy (03:32):
I did. I did. And actually, I totally agree with the piece around AI and technology because here’s the thing, the reality is that technology is becoming less of a differentiator. It’s actually the ability to how we use it and that becomes a differentiator. And that’s where people come into place because yes, you can have AI, you can have more automation, but that alone does not create value because someone still has to make a decision, still have to create the trade-offs. You need to manage your relationships with your suppliers, respond to changes that are happening. And so that’s really what resonated with me is that we shouldn’t be asking whether AI can replace people. I know there’s a lot of hype about that right now. The question that we should be asking is, are we designing the organization so that people can use AI to make better decisions and move faster?
(04:17):
And that’s where I think the differentiator is going to come.
Scott Luton (04:20):
Myly, that’s such a great comment. You’ve got some kindred spirits out there and our friend Felix who also oftentimes tunes in from Scotland. And actually he shared a version of that and talked about, “Hey, are we just curing technology and throwing it on top of the organization? Or to your point, are we taking a minute to redesign the organization so we can take best advantage and take into account how the nature of work is changing?” And that’s kind of what you were sharing there. I love that. All right, so folks, Trisha is dropping a link to With That Said, go check it out. Let us know what you agree, what you disagree with, what are we missing? But we’d love to get your feedback. Also, Trisha did drop the link to Altium. You can check out the cool things they are doing there. All right, so that is it for the 190th edition of With That Said.
(05:05):
And we look, hey, the market –
Maithili Shenoy (05:07):
And many more to come, right? And many
Scott Luton (05:09):
More to come, Myers, because the market always is like, “Hey, that’s great, but what have you done for me lately?” So you know how
Maithili Shenoy (05:15):
That goes.
Scott Luton (05:15):
So number two, this was really cool to see, Myers. You gave a very well received keynote at a wonderful event here recently. The event was the Sourcing Journal’s Fall 2026 Summit, and your topic was the Global Sourcing Reboot: Finding Opportunity in a New Trade Era. Now, Myers, I went out as I was reading some of your takeaways here, and these comments that was listed up under of folks that were there, I was blown away. Now I know you’re the best in the business, Myers, but these comments can prove it. Look at all this was so informative. Thank you. Great energy to kick off the day. It’s always wonderful listening to your perspective. Love seeing you on stage sharing the truths always and many, many more. That’s got to make you feel good, Myers. But I got to ask you from that event, the Sourcing Journal Fall 2026 Summit, what was a couple of your favorite moments?
Maithili Shenoy (06:06):
I mean, for sure doing the keynote and actually it’s the conversations afterwards with people where essentially what I was presenting was that the model right now is broken. And I’ll be honest with you, going up there on stage initially, I was like, “Well, I don’t know how people would react to it because they are actually operating this model right now.” But the overwhelming feedback was extremely positive that it resonated. They felt like they had some clear actionable tips that they could take back to challenge internally within the organization, but also to put into play right away. So I thought that was really great. And I do need to give kudos to the Sourcing Journal because the rest of the panelists as well, the conversations were really timely, very relevant, and actually expand the breadth of what an executive goes through, I would say in supply chain operations in general, but certainly from a sourcing standpoint.
(06:54):
So again, it’s actually, this is like a one day Super Bowl, once a year of sourcing. And I have to say I’ve been going to it for many years now and truly every single time I come back going, “Wow, that was a really good use of time.”
Scott Luton (07:08):
Okay. I’m going to join you next year then. You should. And speaking of the Super Bowl analogy, you’ve been the starting quarterback in many of those Super Bowls in the retail and consumer goods world, so I can’t wait to catch you in your next keynote. And folks, if you want to tune in and get some of those key takeaways that Sourcing Journal and Myers was sharing, we’ve got the link right there which will take you to the LinkedIn summary I was just sharing. So check it out. Okay, Mylee, one more thing and then we’re going to bring in one heck of a one, two punch. We got a one, two, three punch here today on the buzz. Folks, we have got a very robust programming schedule throughout fourth quarter this year as we always do, but I wanted to share two sessions in particular that I’m really looking forward.
(07:47):
I’m looking forward to all of them. It’s like picking your favorite kid. You can’t do that Myers, right? Can’t do that. But I want to make sure you’re aware of two ones in particular, including this first one. We’re diving into healthcare supply chain leadership tomorrow. This was very timely, just came about in the last couple of weeks. I’m being joined by Industry Hall of Famer Regene Valley as we interview Mina Medler, the chief supply chain officer with Sutter Health. Join us at 12 noon. You’re not going to want to miss her story and her perspective on this critical industry as we all know. And then on the 28th, talk about your unique shows. So Laura Serr is joining me as we bring on these three big leaders that have been helping to build supply chain management programs at Georgia Tech, the University of Arkansas, and the University of Wisconsin.
(08:30):
We’re going to be diving into how supply chain management undergraduate degree programs, try to say that fast seven times or one time maybe, how all of those things are evolving and maybe the bigger question, how they should evolve. But come join me and Lauren, Chris, and Jake and Matt. I’d love to have your perspective as we have that conversation on October 28th. So Mattie, I tell you what, if our education programs aren’t evolving as industry evolves, the talent pipeline of incredible leaders coming out of those programs, it’s not going to be optimized, right?
Maithili Shenoy (09:04):
And it’s actually really interesting because if you actually look back 10 years ago, a lot of kids wanted to go into marketing and now I mentor a lot of young kids and they’re actually all interested in supply chain. So go figure. I think COVID has really articulated why the supply chain is so crucial and you certainly see a lot of kids now much more interested in supply chain. So this is great that we have this as part of your upcoming sessions.
Scott Luton (09:29):
Very true. And we’ll take every silver lining from that very difficult chapter and hey, we need more talent coming into global supply chain, so that’s wonderful.
Maithili Shenoy (09:37):
For sure. Yeah.
Scott Luton (09:38):
Okay. And thank you, Trisha. Trisha dropped a link to each of these sessions that I highlighted yesterday or a moment ago, the supply chain management, undergraduate discussion and healthcare supply chain leadership, as well as I bet she’ll put a link to all of our upcoming live programming. Okay, so Myers, between you and these two guests, we have got a big addition to Buzz here today. Folks, I’ve really enjoyed these two guests’ perspective on leadership and technology and cyber and you name it over the last few years, especially across social. Both have been moving mountains as they help organizations productively, successfully, and safely navigate these very disruptive times. I want to welcome in Bob Carver, CEO of Cybersecurity Boardroom and Andrew Austin, CEO and co-founder of Breach Aware. Hey Andrew, how are we doing my friend?
Andrew Alston (10:27):
Hi, Scott. Yes, nice and sunny over here in England.
Scott Luton (10:32):
We didn’t do a time and temperature check, did we? Great to see you here today, Andrew. And Bob Carver, welcome in my friend.
Bob Carver (10:38):
Glad to be here.
Scott Luton (10:40):
So let’s do this. Mightily Bob and Andrew, today’s many things, but it is World Teacher’s Day on October 5th, which I had to bring here on the buzz because I really am curious of all the teachers that have all had a profound impact on our lives, I’d love for each of y’all to share one teacher in particular, one of your favorite teachers in your journey as we start with a little fun warmup question. So Bob, I’m going to start with you, my friend. What was one of your favorite teachers here in your journey?
Bob Carver (11:10):
I had a teacher, a math teacher in high school, and anyway, she wore granny glasses and long blonde hair and all that kind of stuff, sort of a hippie type, but she was really good at teaching math. And what I liked about it is she was able to show you how to get the answer in the front door and the back door and the side door more than one way, because sometimes there’s certain ways that it didn’t make sense to me. I said, “I don’t like that way. I need another way.” And she would show me the other way and hey, she got me through, I would say probably three grades full of math in that one year.
Scott Luton (11:48):
Okay. And I love part of your response there. There’s always more than one way to solve the challenges we’re presented with math and otherwise these days. Andrew, your thoughts, your favorite teacher, one of them.
Andrew Alston (12:00):
Well, I think the only topic, I mean, I hated school. I really did dislike school. I was really good at school and sport, but I disliked school. My favorite teacher definitely has to be, I loved history, has to be a guy called Taffy Jenkins, who was a big boisterous welshman, had a fantastic voice, could sing in a choir. He could spot you in the back if you were talking, even though he is looking the other way. But he was as passionate history as I’d have history, so it would have to be Taffy Jenkins.
Scott Luton (12:29):
Andrew, I love that Taffy Jenkins. I’m writing that down. And Myers, how about you, one of your favorite teachers?
Maithili Shenoy (12:35):
This probably won’t come as a surprise to you, Scott, but actually my favorite teacher was my dance teacher growing
Scott Luton (12:41):
Up.
Maithili Shenoy (12:42):
And one of the things, especially as you kind of grow older, you are always on in your career and it’s really important you have that balance. And for me, that balance comes from, and if you think about the sympathetic with the parasympathetic state, it comes from dancing. And it’s such a gift that I got early on in my growing up where she gave me this love of dance. And actually not just dance, but I’d get to perform a lot on stage. And so I actually don’t have stage fright, which actually has also helped me. If you think about doing that keynote, getting up on stage, it’s actually the same skills you need as when you’re, and some people might say it’s worse when you’re dancing on stage. I have no stage fright when I’m dancing on stage. So anyway, it’s a gift that stayed with me through the years when you’re doing that, you don’t realize it.
(13:23):
And frankly, thanks to the teacher who kept pushing me.
Scott Luton (13:27):
I love that. I love that. And I saw a video of you giving that keynote and you were there, just like you said, there was no fright. You were going to explore all those topics and you had that presence, which a lot of folks that give keynotes are always trying to develop and work on. So excellent stuff. I got to add, the late great Gloria Marks, she was my third grade English teacher, and she was the very first one that I can remember that really shared with me the power of storytelling. She shared so many stories from her background and then she tied that into modern literature and whatnot, and she had a great gift that she imparted on the rest of us. So Gloria Marks, incredible teacher. All right, so Miley, Andrew, and Bob, enough of the fun warmup question. We got so much to get into here today, but thank you for sharing.
(14:10):
And I want to dive into, we got three new stories we’re going to dive into here today, and then we’re going to get Andrew and Bob to help us out with cybersecurity month. But up first, we are going to be talking about the manufacturing industry. So let’s see. This comes to us from Reuters, and this is the data I was referencing that came in here recently via the ISM manufacturing PMI. So I’m going to share a couple of very brief highlights. Folks, go check out the link that Trisha is dropping for the full story, but a few highlights here. So the US manufacturing activity remains solid, but essentially flat when it comes to month over month growth in September over August. And the PMI reading was still above 50 at 54.6. And as y’all know, because we talk about this quite often here on the buzz, any reading over 50 signals expansion, right?
(14:59):
Certainly AI infrastructure and inventory rebuilding helped to support some of the activity last month, and demand also strengthened a bit as new orders increased, but so too did backlogs due to a variety of factors, including slow supplier deliveries and some capacity and labor constraints. Now speaking of the workforce, hiring in this sector ticked up just a bit in September, at least according to this data set. But one of the big warning signs, folks, y’all probably guessed it because you’re probably also feeling it, rising costs. The ISM input price index jumped significantly. Of course, diesel fuel was a big factor, but other factors driving input price increases include steel and aluminum price increases, tariffs, steel, and oil-based plastics and resins all jumped. So Bob, when you hear that rundown on what’s going on in US manufacturing, your thoughts?
Bob Carver (15:50):
Well, anything with resins and plastics, of course, that it goes back to the oil and gas industry. So that’s going to cause an uptick. I’m not involved in buying raw materials too much in my situation, but I do look at scanned consumer goods all the time, and I notice that it seems like every month, if not every week, we see an uptick in the prices, whether it be food or just goods. And of course, we’re talking about data centers right now, the price
Maithili Shenoy (16:22):
Of
Bob Carver (16:22):
RAM is just gone through the ceiling. It’s probably, matter of fact, it’s gone so high that I’ll probably put off buying another computer for another two or three years until the RAM prices start coming back down. And then they expect it to take two or three years before they can catch up with this demand and they’re just charging whatever they can get away with right now.
Scott Luton (16:43):
Tell you what, some folks are printing money for sure. Okay, so Andrew, when you hear some of those points on what’s going on in the US manufacturing sector, your thoughts?
Andrew Alston (16:52):
Well, tariffs obviously play a big part. When you hear the news in the US and what we’re trying to do in the UK, it has a real major impact on us over here. One of the interesting things about your manufacturing business in the States is that I did do some research. The IBM report said that in the fifth year consecutive year, manufacturing is the most targeted industry of all. I think it was 27.7% of all incidents in 2025 were with the manufacturing industry. So I mean that would add to costs as well, wouldn’t it? But the trade wars don’t exactly help, do they?
Scott Luton (17:24):
They don’t. And that’s a great nugget because manufacturing plays such a critical role in the global economy and creating wealth in all kinds of countries. So naturally it’s going to be, I think you said for the fifth year in a row, the number one targeted sector. All right, so Monday, of course you’ve been in this space during big chunks of your journey. What do you see going on in this space?
Maithili Shenoy (17:46):
I mean, I feel for the manufacturers, to be honest with you, because their input costs are increasing, yet I think the reality is even though we see increased prices when we go to buy something from a consumer standpoint, actually the reality is that not all of that cost is being passed on to the consumer. So they are absorbing those costs. So you can just imagine the pressure that it’s putting on them where yes, they’re growing, but the question is, are they growing profitably and can they maintain their profit rates? And so that really is the question because the reality is they’re not passing on all those costs. And yes, trade plays into it. I do wish that as a country we had better industrial policy because the trade policies were intended to increase manufacturing in the US, but if you can’t actually bring in machinery without paying an arm and a leg for it, then it can’t just overnight.
(18:34):
So I think that’s something that we need to think about as a country.
Scott Luton (18:37):
I’m with you. We need to dedicate a six hour –
Maithili Shenoy (18:40):
Exactly. 12 hour. Got to have a point of view on that for sure.
Scott Luton (18:44):
Man, we’re going to have that conversation. But nevertheless, I appreciate y’all’s take on this first story as it looks at one of my favorite industries of all time. I’ve been fortunate to work in manufacturing through big chunks of my journey as well, but we got to keep our eye on this set of data, but all the data. This data just shares one story, right? We got to compare and contrast it with other data we’re seeing out there in industry. And one final note before I move to the next story, Trisha dropped a link to the whole story. You can go check it out. You can download your own. I think you can download the ISM report and all the data points and give us your take on what you’re seeing. Okay, let’s move to a second story. This is kind of a neat story depending on how you view it.
(19:25):
So we’re going to be talking about some cool robots that need some supply chain help. So as reported by MarketWatch, humanoid robots have all the potential in the world to revolutionize industry and society. When it comes to this sector in the US, we’ve got some really big gaps in the supply chains behind these types of robots. And in particular, actuators are the big bottleneck. Humanoid robots depend on these components to convert energy into physical movement, and they can represent up to 60% of a robot’s cost. US unfortunately lacks a strong domestic actuator supply chain. Much of the existing US capacity serves aerospace and automotive applications while countries like China have built a far deeper ecosystem for producing robotics components at scale. Some project the humanoid market to hit $5 trillion by 2050. So we have got a lot of work to do. All right, so Andrew, when you hear that and you compare and contrast it with the massive opportunity that’s out there, your thoughts, Andrew?
Andrew Alston (20:26):
I always think it’s about microchips. There’s not going to be enough chips to supply you. We reliant on Taiwan, that’s the bottleneck. Unless someone monopolizes it, chips are the most important thing.
Scott Luton (20:39):
All right, so we got chips and actuators. Bob, your thoughts on these humanoids?
Bob Carver (20:43):
Yeah, I tell you, instead of having our highly competitive markets like we have here in the States, I think we’re going to have to take a playbook from China where they look ahead five and 10 years and say, “What are we going to need?” And then they have a group of companies compete, and then after the competition, they figure out a winner and they say, “Okay, you’re the winner. Now go ahead and make this happen.” And it becomes part of the supply chain. Unfortunately, we’ve sort of done the same thing and put our head in the sand on critical minerals also. So we need a better plan on being able to address this. We’re behind. We’re behind the curves.
Scott Luton (21:25):
A better holistic strategy for sure. Great comments there, Bob. Myer, your thoughts?
Maithili Shenoy (21:29):
Yeah, I mean, bingo, I think we need industrial policy. It’s back to what we were saying in the first piece also applies here, and Bubba applies here even more because we need policy, we need investment, and you’re not going to get that by companies trying to figure it out on their own. I would also say taking a chapter from, because I keep getting asked when I talk about sourcing, there’s a pretty big gap, let’s say in sourcing in nearshoring, and it’s about Cape Verde. And I think the same thing applies here where we need companies making longer term commitments and really building an ecosystem like partnerships, because that’s the reason why we don’t have it. I mean, every company’s kind of left to figure this out on their own. Whereas in theory, if you could actually create ecosystems, provide the right investment or at least access to capital, I do think it’s something that could be surmounted in terms of the challenges that the industry’s facing.
(22:20):
But as things stand, yeah, I could see why we are lagging.
Scott Luton (22:24):
Yeah, a big challenge, I’ll tell you what. But you know what? If we had a dedicated day or so with Andrew, Bob and Myers, I think we could solve it. I think we could address it and solve it. I’m convinced.
Maithili Shenoy (22:34):
But you need the administration coming in and helping in that conversation too. So try
Scott Luton (22:40):
That, Scott. Yeah, I tell you what, I’m going to pass that baton. All right. So folks, there’s so much more to this story. We’re hitting these stories and want to put it on your radar and give you some color commentary behind it, but go check out the FullStory via Market Watch thanks to this link that Tricia has put right here. All right, one last story before we dive into more things, all cybersecurity. I want to talk about the human workforce and some skillset challenges, some tech skillset shortages and challenges. So as reported by CIO Dove, a recent survey by Pluralsight showed that about seven in 10 tech leaders abandoned the project in the last year due to their employees lacking tech skills. And the survey was made up of about 1,500 tech leaders across the US, UK, and Australia. Cloud, cybersecurity, and AI projects were amongst those most at risk of being shelved due to a lack of these skillsets.
(23:35):
So Bob, are you seeing this regularly in your work out in the market?
Bob Carver (23:39):
Yeah, absolutely. I was hired last year to, I reported to a CEO of a NASDAQ company and I was helping them with their cyber threat intelligence and we got it to a certain point, but on the other hand, it seems like they didn’t have the talent necessarily to make everything happen. They had partial the talent, what they needed, but they needed additional talent. But I’m hearing more and more in the enterprise that the vast majority of the projects, well over 80% of the AI projects are failing, and a lot of times they don’t have the experience to be able to roll these things out properly.
Scott Luton (24:18):
All right. Andrew, what are you seeing?
Andrew Alston (24:20):
Well, I’m going to agree with Bob, but I mean a lot of the projects, the AI projects are failing because of, I think about 50% of them failed because of abandoned, because of their proof of concept and provide them with the right information that the business wanted. And with AI, of course it reduces the skills gap, you still need those skills in order to deliver some of the consequences or outputs of the AR programs. So what have noticed in our business, Bob, is that a lot of the MSPs are creating these one-stop shop socks and then they’re not differentiating themselves. So then you got the other thing about who’s providing a differentiator if they’re all using some AI technology. I don’t know if you’re seeing that, Bob.
Bob Carver (25:05):
Absolutely.
Scott Luton (25:06):
Yeah, same thing. All right, so Modley, sounds like Bob and Andrew are largely validating this report from CIO Dive. What are you seeing, Modley? Well,
Maithili Shenoy (25:15):
Actually, I was just going to add something given that it’s National Teacher’s Day. Are we changing the curriculum with kids in schools fast enough to be able to adapt to this new way of operating maybe because –
Andrew Alston (25:27):
You shouldn’t be doing that. You should be going back to letting kids think for themselves to be creative. Yes, use the AI tools to enable them. And that’s where when we were kids growing up, we didn’t have a mobile phone or a PC. We had a piece of paper and you read that piece of paper and you made a decision from that piece of paper and you could be able to articulate the message. And the printer gave us 10 bits of paper and then we evolved to making the decisions from 10 bits of paper and it goes on and on. Today, we are just losing that ability, in my opinion, of thinking being creative and thinking of next steps.
Maithili Shenoy (26:04):
Yeah. And I don’t think it’s an either or, but to me it’s about actually, yes, you do need the cognitive skills and we want to make sure we don’t lose that. And we also need to know how to prompt correctly. So there’s basic skills that you need to have to operate with AI, and those are not there either. So how do you retain what’s good about our current system, but actually also move at times.
Bob Carver (26:26):
Some of the high tech companies actually are recruiting some of the better students right out of high school and doing their own internal university to help those students learn what they need to actually learn to be able to help those companies move forward.
Scott Luton (26:43):
I really think that you are more aligned than maybe you think because what I’m hearing you saying is, hey, we’ve got to create the flexibility to Andrew’s point of the self-learning, self-paces, the independence that students need to find their own eureka moments and whatnot. But got to have the structure. We got to have the evolving body of knowledge. And gosh, I am not envious of those education professionals right now to try to keep up with the body of knowledge in this space that is changing by the minute. I give you the last word on it.
Maithili Shenoy (27:20):
No, I’m good. I think I shared what I- I was starting to think about analogies. When you moved from Parsis as your primary means of transport to a car, you had to learn how to use the car, but you also still needed to know how to map your directions. I mean, all of that you still need. Now one could argue with a self-driving car. But anyway, my point is that how do you adapt with the times and still retain what you need to in terms of cognitive skills? So that’s what came to mind.
Scott Luton (27:52):
And Bob, did you want to add one more comment for me?
Bob Carver (27:54):
Sure. I’ve been talking to a few teachers and it seems like a lot of them are a little bit deer in headlights right now, especially if they’ve been around a while. Some of the ones that have already have 20 years in, I mean, they were struggling to be able to do all the things that they needed to do on the computers. And now they’re going to say, “Oh, you need to learn AI and be an AI expert to teach these students.” And then they’re going like, “Wait a minute here.”
Scott Luton (28:18):
Well, and I think part to address that challenge, because I’m hearing when I talk with supply chain professors out there, they are feeling that same challenge of staying on top of how the industry continues to evolve. And I think Andrew, one last point, that’s where I think your point is so important because one thing that’s going to help drive that relevance and drive the current topics and current subject matter is the self-journey of the students and certainly empowering that. So that’s my take. But hey, this is a living and breathing part of global business, especially in the olden age of supply chain tech, business tech. All right, let me get this comment in and then I’ve got some tough questions for you, Andrew and you, Bob. So stand by one second. But first, let me know, Trisha or Amanda, who this is. I like this point here.
(29:04):
Going back to the humanoid robot story. They say for humanoid robots, the constraint has moved from innovation to industrialization. I think that’s a great point. I think that’s a great point. Let me know who this is. All right. So Myers, Andrew and Bob, before I continue on, I want to share one more thing and put a resource on folks’ radar out there. Altium Develop brings together advanced printed circuit board design and secure cloud collaboration in one seamless experience. This powerful platform integrates everything from schematics and layout to simulation and analysis in one single environment. It’s purpose built for individuals and small teams to design, share, and stay in sync from anywhere. And even better yet, Altium is offering a free 30-day trial of Altium Developed, so you can kick the tires and give it a no strings attached test ride. You can check out the link in the comments and let us know what you think.
(30:00):
Okay. So I want to dive into a few particular topics here as we’re near the beginning of Cybersecurity Awareness Month 2026. It’s every October. I think we can all agree that every month needs to be Cybersecurity Awareness Month probably. But Andrew and Bob, I want to pose this opening question to you both. What do you see has fundamentally changed about the cyber threat landscape over the last 12 months or so? And I know it’s going to be a three-hour show, huh? And what should supply chain leaders pay more attention to than they were say a year or so ago? So Andrew, let’s get with you out of the gate.
Andrew Alston (30:34):
Yeah. Well, I’m going to talk about AI. Yeah. So if you look at the ransomware market, AI’s shortened the skills gap. So I’ve been talking to an editor of a magazine called DB Digest in the UK. And
(30:50):
Because of this RAS, ransomware as a service that’s giving out the malware, you don’t need to be as technical as you should have done in the old days in order to hack someone. AI is enabling access a lot easier. So last month we saw 19 more ransomware gangs on the market. Last month we saw over a thousand reports reported in the media of ransomware attacks. So whereas we are trying to use AI to defend our infrastructure by second guessing everything, and I’m putting up all the defenses up, hackers are slightly ahead of us. And also now with AI, I’ll come in a minute. What’s happened now, they’ve changed the commercial model. So in the old days when they used to give out the ras malware access points of the new affiliates, they used to say, “We’ll have a 60 / 40 model. If you are successful, we’ll take 60% off the ransomware and we’ll have 40 back.” Now with AI, they’re going for the 90 / 10 model.
(31:49):
They’re now saying to the new affiliate ransomware gang using these AI tools, “You can have 90% and we’ll only take 10.” It’s changed the market dramatically.
(32:00):
So it’s quite frightening.
Scott Luton (32:02):
It really is. And gosh, the new gangs you’re referencing, that’s definitely a scary though. Bob, when you think of the last 12 months, what’s a couple big changes you’d call out and what do supply chain leaders got to have, got to be thinking about here more so than they have been?
Bob Carver (32:17):
Exploitation itself got much faster and discovery of vulnerabilities faster than fixing them. Matter of fact, there was a study done recently. They were saying that before it’d say, “Oh, you need to patch within a week.” Or long time ago it was like, “Patch within a month.” Then it was dead to a week. And now they’re saying, “Oh, you’re totally screwed. It’s a minus seven days. You’re already seven days behind from the get-go because the patch is not going to come out until seven days after the vulnerability is discovered.”
Maithili Shenoy (32:49):
Wow.
Bob Carver (32:50):
So the middle managers that were cracking their whip and saying, “Oh, you need to patch, you just need to patch faster. You need to patch faster.” That’s gone. That’s no longer the case. You’re already behind from day one. So that’s a big issue. Of course, attack speed, we’re talking about trusted third party exposure, machine identities, AI assisted operations, making the traditional supply chain risk programs way too slow. And if you’re still using the old questionnaire driven say, oh, okay, what do you have in place for your security, for all your partners? That’s already out the door. It’s old
Andrew Alston (33:27):
School. Clients by checklist, don’t you?
Bob Carver (33:29):
Yeah. So again, that’s nice to have, but that’s not where it’s going to be. You’re going to need to know who all your suppliers are, how much access they have in your network, how much input, output, all the data flows to and from your network. Are you using say the same vendor? And say for example, for cloud, and are you all on one cloud provider and that cloud provider goes out for a day? And we’ve had some times recently where the cloud providers were out six or eight hours in a row. Wow. So anyway, that was just a few examples. I’m sure we could talk all day on this, but
Andrew Alston (34:11):
I think we could. But I think Bob and I could list off about 20 software companies haven’t patched and created the biggest sort of supply chain like Sam.
Scott Luton (34:20):
So as much as our attorneys won’t work, let’s hold off on that list for now, Andrew and Bob. So Modley, what we heard there, Andrew and Bob, they kept it real as we knew they would. And of course there’s so much we could talk about, but just little bits they shared in terms of the evolutions over the last year are pretty frightening. I don’t know if that’s the right word or not, but one thing in particular Bob talked about, we got to assume, we got to lean into the mindset that these patches that address these vulnerabilities were already behind right out of the gate. But what’d you hear there from Andrew and Bob Modley?
Maithili Shenoy (34:54):
Yeah, so I mean for sure that there’s a lot we need to catch up, but actually what went into my head was that there’s things you can then do internally for the systems you own. But being a sourcing person, I think about if I have critical suppliers that are supplying me something, how do I make sure that they are also staying current? And if their system goes down, how quickly can we recover? It’s an ecosystem, so it’s not just their recovery, it’s actually, it’s a domino effect downstream. So that’s actually what went into my mind when Bob spoke.
Scott Luton (35:23):
Excellent point. And we’re going to circle back to that point here in just a minute, Miley. That’s such a good one. We got to be ecosystem level thinking. If we’re not thinking like that, we’re way behind too. Hey, really quick before I pose this next question to Andrew, Bob and Miley, I want to go back to the human order thing I mentioned earlier, moving the constraint from innovation industrialization. That was Nadal. I want to give credit where credit is due. So thank you for that Nadal. And I’ve got another comment here about resilience. And before I share it, Amanda and Trisha, let me know who that is and I’ll fit it into the conversation. All right. So one of the things y’all both touched on there, Andrew and Bob, we’re seeing AI give bad actors increasingly sophisticated capabilities from social engineering and impersonation to finding vulnerabilities and potentially accelerating attacks as a security landscape.
(36:14):
So is AI currently creating a bigger advantage for cyber attackers or defenders? And how do you see this balance continuing to evolve? And Bob, we’re going to start with you here.
Bob Carver (36:24):
Sure. I started warning people in all EU conference back at 2018 in International Monetary Fund twice in 2019. I said, “Get ready. The cybersecurity landscape is going to be AI versus AI, basically the threat actors versus the defenders.” And I said, “You need to get ready for that.” And I would say probably 95% of the audience was sort of deer in headlights at the time because that was long before ChatGPT had come about and all these other frontier models that have come about. Another issue is that AI is embedded in everything now. AI is in Salesforce. AI is in a lot of chat applications. AI is in probably a lot of these third party communication packages. And the AI itself can help with many different things, but it can be also used to compromise systems. I myself, I got okay security for somebody in a home system, probably better than most mid-size businesses.
(37:29):
Not perfect, but it’s still… I’ve seen where logging into some of the AI systems, I’ve seen attacks attempted that the info stealer malware, I’ve seen those actually happen in the frontier models that we’re all using today. And I know somebody that does pen testing back in December of 2024, they call MCP, which is sort of a middleware for AI systems. They had 500 vulnerabilities for MCP servers back in 2024. Today, who knows? That could be double. Hopefully they’ve fixed a lot of those, but they probably have
Scott Luton (38:07):
Just
Bob Carver (38:08):
As many new ones. The amount of vulnerabilities out there and the possibilities, anything that’s traversing your network can be used to compromise your network and cost downtime.
Scott Luton (38:19):
Andrew, what else would you add to those eye-opening comments from Bob?
Andrew Alston (38:23):
Well, I mean, I love data. I love AI. The whole context, AI is context, isn’t it? What can you do with the data? I did a presentation in Jersey, it’s in the Channel Islands, and I told the audience that it’s about a petabyte of stolen data publicly available, sitting on the dark web, ready to be exploited and is exploited. And someone in the audience really didn’t know what a petabyte was, so I did some research and I put it into an AI machine and this is the answer it gave me. And because you’re both in Atlanta, I’ve got another answer. If you took a petabyte and you put it on an A4 piece of paper and each piece of paper had 600 words on it and each word was six letters and you piled up each A4 piece of paper on top of each other, that would reach to 28,000 kilometers.
(39:14):
So let’s put that in distance. You could go from Atlanta and South Africa and back again. So just imagine correlating, aggregating all that data. It’s exciting, but frightening. But of
Maithili Shenoy (39:29):
Course,
Andrew Alston (39:29):
This is why we talk about risk all the time, isn’t it? So you take away the fear, let’s step back and take the emotion out of it and apply some risk strategies to it. You just tick it off.
Scott Luton (39:40):
All right. So Miley, I find all of this, I think Andrew just gave us a couple options in his perspective, exciting and frightening. I think it’s more of the latter for me, but react to what we’re hearing there from Bob and Andrew Miley.
Maithili Shenoy (39:53):
I mean, yes, frightening. And I’m hoping that ultimately it is the defenders that win because they do have, at least they know their own data, they have their context if they can protect it. But I see that maybe in the short term it would be the attackers who have the advantage.
Scott Luton (40:08):
Yes. AI versus AI, Bob or Andrew mentioned. Really quick, this is Nadeel again. Man, he’s on fire. Here’s who’s on fire. The answer should be resilience. The key challenge for supply chain leaders is no longer preventing every attack, but ensuring continuity of supply and rapid recovery when disruptions happen. That’s
Maithili Shenoy (40:30):
A good point. Well done.
Scott Luton (40:31):
This is a great point. All right, so one thing. So Bob and Andrew, I hate to limit you to just one thing, but for the sake of time, Andrew, what’s one thing organizations got to be doing differently? Of course, because AI is being leveraged more and more as part of the attackers toolkit.
Andrew Alston (40:48):
I think I usually take the mic out of CISOs, but I think one of the most important things for organizations is governance. That’s not tickbox compliance. It’s actually from the bottom to the top, everyone adheres to a policy, a cybersecurity strategy, and that is the most important thing. It won’t protect you 100%, but it’ll definitely mitigate the risk. I cannot understate that.
Scott Luton (41:16):
From my perspective and all the conversations we’re having, I think governance might be one of the big topics that maybe folks understand the least. And this is just my opinion, since it’s not sexy and innovative and flashy that a lot of folks don’t want to spend time. But to your point, it is so critical, Andrew. Such a great call.
Andrew Alston (41:39):
This is recorded, isn’t it? Yes. I’ll have to retract that.
Scott Luton (41:43):
Okay. All right. So Bob, one thing that organizations got to be doing differently, especially due to the attacker’s usage of AI these days.
Bob Carver (41:51):
Sure. I think the cybersecurity teams and the business continuity and disaster recovery teams need to be connected at the hip. And like the young man that said resilience, you need business resilience. You may need to have duplicate systems or duplicates providers, ISP providers, ways to be able to back up. If one goes down, you’re able to keep on working.
Scott Luton (42:18):
I like it. Miley, Andrew and Bob have given us, been there, done that perspective and challenged leaders and organizations to do one thing different. Your thoughts, Miley?
Maithili Shenoy (42:28):
I mean, I’m thinking of this as a retail person and thinking about all the different risks that are there when you think about just even verification, payment verification, shipping destinations, things like that. And how do you actually… So I’d say they need stronger verifications and controls because I think in today’s AI enabled world, it’s so easy to fake things. So that’s what comes to mind.
Scott Luton (42:56):
That’s right. And to your point, that customer data, supplier data, employee data, it’s quite an environment. Okay. So I’ll tell you what, I’m not bringing Andrew or Bob to another party when we want to feel good.
Maithili Shenoy (43:11):
I know. My brain is now on… I’m like, oh my God.
Scott Luton (43:16):
I’m scared of touchy buttons now, Miley. I’ll tell you what. All right. This is what we wanted. These are conversations I think we got to be having at least this month, if not every month. All right, so Bob, I’ll get back to Miley pointed out earlier, the ecosystem level of thinking that we got to have, and we often do have across global supply chains, because we’re only as strong as our weakest supplier, and it’s not just input suppliers, logistics service providers. I mean, you name it, all the different software vendors, all the different nodes across our supply chain ecosystems. So I want to ask you, starting with you, Bob, how should companies rethink third party cyber risk within their digital ecosystem, especially when those ecosystems could be tens of thousands, maybe hundreds of thousands big? Your thoughts, Bob.
Bob Carver (44:05):
Sure. I think you do have to look at the entire ecosystem. For one thing, they said that DBIR, which is the Verizon report that
Maithili Shenoy (44:13):
Comes
Bob Carver (44:14):
Out every year in the spring, the amount of third party related breaches were up like 60%, which now they said is total of 48% of all breaches in their report. So we’re talking about interconnected networks. We’re talking about all the partners. We’re talking about systems that probably are vulnerable. We’re talking about EDI systems. A lot of times EDI systems are still in place because they invested a lot of money and they don’t want to spend millions of dollars to recreating what already works. But unfortunately, a lot of those are vulnerable still.
Maithili Shenoy (44:52):
Right.
Bob Carver (44:52):
But you’re talking also about API connections and a lot of those, probably half of those are vulnerable out there. Unfortunately, they haven’t been tested and patched like they should be. And you’re talking about SaaS software. We’re talking about software all over the place. And all those SaaS software, a lot of them have the machine learning and AI and a lot of them have vulnerable components. So yeah, you’re talking about the entire ecosystem, and then you’re talking about, again, going back, being partnered with business continuity and disaster recovery to be able to make sure that your organization can keep on running no matter which part fails. Oh, and also to look at where you have maybe critical software that if that’s the only way that you have to get business done, maybe you need to figure out a way, an alternative way to do that business so your whole system doesn’t fail because of that one software.
Scott Luton (45:53):
Bob, helpful and practical perspective there. Andrew, your thoughts, especially when it comes to third party risk.
Andrew Alston (45:58):
Well, I’m going to be positive because I think I’ve had an undertone of telling everyone the truth. But hey, cybersecurity and supply chain’s based on trust, isn’t it? Everything’s based on trust. Have you got good relationship with your supply chain and you’ve got visibility and you’ve got resilience across it? Yeah, that’s the first step. And it’s going back to governance. I’ll tell you a nice story. It’s changing behavior and by getting your supply chain to come along with you from a behavioral perspective, from a cyber hygiene behavior and understanding and buying into what you want, that’s the only way you’re going to move forward. But we had a customer, it was a charity,
(46:36):
They were a housing association, which is a charity that looks after vulnerable people. When they put all on their supply chain, all their physical security companies, which I thought was a bit radical, and I asked why they wanted to do it, and they said about trusts. If we’re looking after vulnerable data, it will have an impact if anything gets stolen. When a breach came up and they were notified, the initial reaction was in denial. But what it did do for the charity, it changed everyone’s behavior. They’re creating this ecosystem of behavior and then it’s just like a 1%, 2% decrease in risk. That’s how you need to get your ecosystem bought into it. The trouble is though, the big guys, the big companies can afford to implement all the tools in order to get the hackers out. It’s the small companies that can’t afford it.
(47:26):
I was being positive and I pour that in. Sorry.
Scott Luton (47:28):
You’re doing so good on the positive side, but kidding aside, really, I mean, we need to be having these frank discussions, whether it’s good news, bad news, or some point in between. Miley, I like their comments around third-party risk, and of course, supply chain is uniquely… It’s a really important item across our global industry. Your final thought there, and then we’re going to make sure folks are going to connect with all three of y’all.
Maithili Shenoy (47:50):
Yeah. I mean, actually what came to mind is when you’re sourcing and you’re vetting suppliers, you assess them on can they make the product you need, so the capabilities, can they make it at the right quality? Do they have the right responsible sourcing standards and practices? Are they financially stable? What we don’t do today as part of core sourcing processes, or at least most companies don’t, is actually look at their cyber security processes. And I wonder, especially for ones that are critical, if you’re in a grocery, you need milk, you need salt. And you think about key products that you need, again, I’m saying from a point of a retailer, do you actually also include some additional vetting around cybersecurity in your processes is kind of what came to mind.
Scott Luton (48:32):
Well, I think you’re dead on as usual, Miley, and I think Andrew was agreeing with you. I can’t see Bob, but Bob, I bet you were nodding your head as well. So let’s do this. There’s so much more that we need to have in this conversation here today, but we’ve gone the full hour and it’s gone just like that as I thought it would. A couple final questions. Andrew, if you would, two part question. In a nutshell, very small nutshell, tell us what Breach Aware does and how can folks track you down, Andrew Austin?
Andrew Alston (48:59):
Well, yes, I’ll do the boring base. I’m on LinkedIn and we do some interesting posts. It’s not the normal sort of cybersecurity thing, but it’s more about awareness and education about breach data. So what does Breach Aware do? We look for sterling data that’s publicly available on the dark web, surface web, any of the forum channels, every bit of data we find. We’ve got provenances so we show we haven’t bought it and we notify our clients. So we have a supply chain service and we also have a more detailed service and we do it through Ketan and I, business partner and founder, our ethos is to provide a service that’s affordable to the SME as well as to the big company. So
Scott Luton (49:38):
That’s it. I like it. So if we acting on a lot of the dangerous points and risks and the nefarious work out there, if you want to act on any of that, Andrew should be one of your first calls or Bob is my hunch. And Bob Carver, I’d love to share the same two-part question with you. Tell us about Cybersecurity Boardroom and how can folks track you down, Bob?
Bob Carver (49:58):
Sure. Cybersecurity Boardroom is basically sort of a service that helps companies tighten their cybersecurity and also be more resilient too. Originally, well, I got the CISP, which is more oriented towards security, but also I did take the exam for the business continuity disaster recovery. Now working for, at that time, it was a Fortune 25 company. There’s not enough hours in the day to do security and business continuity, so I decided to focus more on security. So basically I help companies decide the best way possible and economic best way possible to be able to tighten up their security and be able to have a less chance of becoming compromised.
Scott Luton (50:45):
Okay, that makes a lot
Bob Carver (50:47):
Of sense to me. And then LinkedIn is probably the best way to get me. You can just throw Bob Carver, CISM, CIS the keys him on LinkedIn. Cybersecurity, and you can do me Google or duck.gov or whatever, and my LinkedIn shows up pretty quick.
Scott Luton (51:02):
Awesome. Well, and to that end, as I shared when I introduced you both, I’m big fans of the thought leadership and the content y’all put out on all the platforms, but especially LinkedIn. And folks, Trisha’s been kind enough to drop Bob and Andrew’s LinkedIn direct URLs right here. Let’s see, there was Bob’s and there’s Andrew’s right there. So folks, follow them, connect them, connect with them, and definitely check out what they’re putting out there. And Miley, speaking of great content, can’t wait to see your next big keynote coming up. But before that happens, how can folks track you down? Miley Schnoi.
Maithili Shenoy (51:37):
Same thing. LinkedIn, best way to track me down.
Scott Luton (51:40):
It is just that easy.
Maithili Shenoy (51:43):
Easy.
Scott Luton (51:44):
And folks, again, you can also check out via the link we dropped earlier on the buzz. You can check out some of the highlights from her most recent keynote, and I definitely encourage you, follow, connect with Miley Shenoy, especially if you love retail, if you love CPG, you name it, and how that space has got to continue to evolve. Bob and Andrew and Miley, what a great session of the buzz here today. I know we’re over a minute or two. Miley, Andrew warned me as we’re coming into today. Andrew’s like, “Bring your dictionary and get ready.” I’ll tell you, Miley, I knew Bob and Andrew was going to bring it, and I wish I was a smarter cyber individual, but just leaning into and having these discussions, I think that’s part of the big challenge, Miley, would you agree with that?
Maithili Shenoy (52:28):
I would totally agree, and thank you, Andrew and Bob, for making it simple enough that I could actually understand.
Scott Luton (52:34):
Same. Glad you’re here. Yeah. So to that end, I want to thank our incredible panel here today. I want to start with Bob Carver, CEO of Cybersecurity Boardroom. Bob, I really appreciate you being here today. Andrew Austin, CEO and co-founder of Breach Aware: The Pride of Shrop Sheer. I get it right, Andrew? Yes,
Andrew Alston (52:53):
Good. Yeah, good.
Scott Luton (52:54):
Excellent. Well, it’s good to finally get you on the buzz as well. Thanks for being here, Andrew.
Andrew Alston (52:58):
Pleasure. Yeah, it’s good fun. Good fun.
Scott Luton (53:00):
It was good fun. And of course, my one and only great co-host here today, Miley Shenoy. Miley, thanks so much for being here and enjoy Atlanta while you’re here.
Maithili Shenoy (53:09):
Yes, will do. A true pleasure being on.
Scott Luton (53:11):
Big thanks to our friends at Ultium. Of course, big thanks to Amanda and Trisha behind the scenes helping to make production happen each and every day. Most importantly, big thanks to our global audience at SCN Global Fam for being here. Hope you enjoy the show, folks. I’ll tell you, if this doesn’t open your eyes and have you running to your governance pros or business continuity pros or your cyber team, if you’re not leading in those conversations, which as you can see, my attempt over the last hour, they’re tough to navigate, especially if this isn’t your forte, you got to be having them. So take one thing here today, your homework that Andrew and Bob and Miley shared, take one thing and do something with it. These not words. And with that said, on behalf of the entire Supply Chain Now team, Scott Lewton challenges you to do good, get forward, be the change that’s needed.
(53:55):
We’ll see you next time right back here on Supply Chain Now. Thanks everybody. Join the Supply Chain Now community for more supply chain perspectives, news, and innovation. Check out supplychainnow.com, subscribe to Supply Chain Now on YouTube, and follow and listen to Supply Chain Now wherever you get your podcasts.
