Chuong Mai-Viet, Andrew Bremner and Tim Stephinson share their insights, strategies and solutions for protecting your business from cyber threats. Through practical advice and real-life examples, this webinar will help you evaluate your company's own risks and understand the mitigation strategies available to you.
Featuring: Chuong Mai-Viet, Andrew Bremner and Tim Stephinson
Length: 40 minutes
Key takeaways
- The insurance market has already moved. Tim explains that insurers now expect minimum hygiene factors to be in place before they will offer a cyber policy, and that getting your house in order first (training, people, process and technology) also helps with better pricing.
- Your proposal is part of your insurance contract. Andrew explains that it is about mutual honesty: if you say you have controls like MFA, staff training and regular patching when you don't, the insurer has a reason to walk away or the policy may not respond to a claim.
- Cyber insurers are under pressure. Andrew notes the global cyber loss ratio last year was 120%, meaning insurers paid out $120 in claims for every $100 of premium, which is why they have become very picky about claims.
- Your MSP's cyber policy does not protect your data. Tim points out that responsibility for personal information usually sits with the business that collected it, so each business needs to hold its own cyber cover.
- Privacy penalties are set to rise sharply. The speakers discuss the proposed Privacy Act changes, with the maximum fine expected to go from $2.1 million to $50 million, and the $3 million turnover threshold for small businesses likely to be removed.
- Cyber insurance works like an emergency service. Tim and Andrew explain that insurers provide 24/7 response teams plus legal, PR and regulator support that an MSP doesn't traditionally offer, and that social engineering and crime cover are normally optional extras.
- Simple controls go a long way. Chuong lists multi-factor authentication, endpoint and email protection, backups, knowing who has admin access, keeping devices updated and cyber awareness training, with the Essential Eight as the government's maturity model.
Transcript
Chuong Mai-Viet: Thanks everyone, and welcome to Wednesday. It's hump day, a good day of the week. Thank you everyone. So today we're going to have a bit of a chat. This is the first Fuse joint event with one of our partners, so give us a little bit of forgiveness if we don't get it quite right. But thank you for joining us today.
We've got Andrew Bremner, who's the Managing Director of Sherpa Insurance. They've been our insurance partner for seven or eight years now, since we pretty much started the business. They provide us with our insurance. And we've got Tim, who's one of their insurance consultants, part of a subsidiary called SherpaTech. Today we're going to have a bit of a chat about cyber security and the insurance side of things. So basically I'll hand over to Andrew and Tim, they can give a quick intro, and then we'll get into it.
Andrew Bremner: That's great, thank you Chuong, and it's wonderful for us to be here, so thank you very much for inviting us. So I'm Andrew Bremner, I'm the Managing Director of Sherpa Insurance, and just a little bit of background about me. I'm probably an accidental insurance broker. Previously I was a chartered accountant with PwC way back when, but I spent most of my life as a management consultant, consulting to insurance companies and other financial services companies.
We started Sherpa Insurance some years ago, and we focus on companies that turn over between about $2 million and $300 million, across industry. So that's a little bit about me.
Chuong Mai-Viet: Amazing. And for those that don't know Fuse, we are an IT managed services business, primarily focusing on the small to medium business space in Australia. We do managed services, so IT support for our customers. We do consultancy around security and modern work, and we also do things like procurement of hardware and software. You know, the boring stuff, but stuff that everyone needs every day of the week.
We are based in Sydney, we're pushing on 35 staff now, and we've been in a position of seeing where the market's gone from a cyber security perspective over the last couple of years.
Tim Stephinson: Excellent. So my name is Tim Stephinson. I'm with the SherpaTech team, and we work as part of Sherpa Insurance. SherpaTech was born out of Sherpa Insurance as its fastest growing sector, which was MSP companies, and Chuong was one of the first ones eight years ago. But we've now grown that substantially, and we're doing a lot of compliance and risk work to really help them with cyber compliance and cyber insurance, as well as professional indemnity.
So we work with a lot of the IT companies that deliver the services, like Fuse, but we also see the nuances in the cyber insurance market and try to feed that into the direct customers as well. So happy to be here, thanks for having us, Chuong.
Chuong Mai-Viet: Amazing. All right, let's get into it. Where's the cyber security landscape at the moment? What I'm going to do is talk to you about what we're seeing. Cybercrime right now is the third largest GDP, behind the US and China. It's huge. It's a $10.5 trillion business. And what we're seeing is that every day hacks happen, from the biggest companies to the smallest companies, and we've all been hacked.
So what we're seeing is, what sort of data is getting exposed? What we want to do is put up a bit of a poll and ask some of the attendees today some questions around who's had data exposed. You should see a poll pop up on your screen, and it's going to ask you to click on a button, hopefully. We want to know, of the people on this call, who's had data exposed recently.
I'm just going to vote myself, and hopefully you'll see the vote go. There you go: 75% so far have said that they've had data breached recently. So three in every four people have had data exposed, actually even more now, the poll's going up. So when we see this, it tells us that no matter who you are, no matter how safe you are, there are things outside of your control.
And it's interesting, because the first thing I said to Andrew and co was, what are some of the claims that you're seeing these days? Does it confirm what we're seeing in the data, Andrew?
Andrew Bremner: Yeah, absolutely. And the poll is really useful. My gut feel on the 38% that said no is that maybe they're not with Medibank, they must be with another private medical provider. So it is just a feature of our life now. It's just the way it is, and all our customers are concerned about it. But interestingly enough, the take-up on cyber insurance is actually quite low, around 25 odd percent.
Tim and I are always talking in these terms. We're saying that the first layer of protection is the most critical, which is the people, process and technology, and really getting that technology piece right is so critical to protect you, in case the claim blows through that first layer of defence. Then you've got to either reach for your insurance policy, and if you don't have an insurance policy, you've got to reach for your bank account. So it's a real concern, and of course we see a lot of clients. It's a scary environment right now.
Chuong Mai-Viet: Yeah, so this leads us nicely on to the fact that it's not just a problem for the corporates. We're talking about Medibank, we're talking about Optus, but small and medium businesses are under attack every day of the week. Someone was fooled by an email or a WhatsApp to a customer, and they lost $5,000 in gift cards.
I've got a real life story where we had an intern join us. In his first week, someone messaged him on LinkedIn, because he had put himself on LinkedIn as an intern at Fuse. They impersonated me personally and asked him to go out and buy some iTunes or Apple cards. It wasn't a big thing, but you can imagine this intern, who's met me for the first time, and next thing you know he gets a WhatsApp from me saying, "Hey, I don't want anyone else in the company to know. I know you're new, we're going to keep this a secret between you and I." Next thing you know, he's buying Apple gift cards.
It was only after the first purchase that he came back to me and said, "Oh Chuong, I did the first one for you," and I'm like, "What are you talking about?" And he said, "Oh, this happened." Before he even got to do his cyber security training as an intern, he had already been breached. And that's one, right?
Another thing is invoices getting hacked. Someone's got a password and is sending it to the CFO. That's just happening every day of the week. A third of all cyber attacks are targeted at small businesses, and 61% of small businesses were not able to operate after the attack. The average cost to a small business is $108,000, and I don't know about you guys, but for most small businesses that's a fair chunk of their profitability gone, just from a cyber attack.
Andrew Bremner: Without doubt, and I couldn't agree more. Across our customer set, we've got about 400 odd customers, and we've had three social engineering attacks averaging a cost of $200,000. The social engineering is very much along the lines that you were mentioning, Chuong: people trying to impersonate someone else. It's terrifying.
We've also had others where someone's broken into an infrastructure provider and got hold of the accounts receivable, and then sent emails to the accounts receivable contacts saying, "Hey, we've changed our banking details, so please pay." And again, that's a good example of a social engineering crime.
Tim Stephinson: What we've said to Andy as well is that the insurance market has already moved. The insurance markets now want all of these minimum hygiene factors to be implemented before they offer a policy. So one of the things we really try to do before we take a risk to the market is ensure that the house is in order, and ensure that there's good training, good people, a good process and good technology. That actually helps us get better pricing when it comes to placement of that insurance as well.
Chuong Mai-Viet: Yep, great. I forgot to mention we do have Q&A today, so if anyone wants to ask any questions as we're going along, feel free to pop them in the chat and we're more than happy to respond as we go, if it works out.
So to continue on, this is the scary slide that I show people, and they're just gobsmacked about how cheap it is. For $250 you can hire someone to hit someone. For $66 you can get ransomware kits. A list of compromised machines is between 13 cents and 89 cents, and for mobile phones it's 82 cents to $2.78. Spear phishing for hire is $100 to $1,000 per successful account takeover. For instance, with the Medibank hack, someone hacked it and then sold those credentials to a larger hacking outfit, who then did the really big work in there. It's that cheap.
Stolen usernames and passwords: for 97 cents you can get a thousand stolen usernames and passwords. And a denial of service attack, which is where they can take down your website or your hosting, is $311 a month for a concerted attack on a business. That is how cheap it is for criminals to get access to or disrupt your business. So if you think that hacking is only for high-end businesses, no. It can be done anytime, anywhere, relatively cheaply.
Andrew Bremner: It's just terrifying. It's terrifying, Chuong.
Chuong Mai-Viet: Yeah. So many SMBs are facing a similar challenge. What customers are seeing today is they want their data to be safe, they want remote working to be normal, cybercrime is on the rise, and regulations are tightening. Every tender or every customer now asks me for professional indemnity insurance, public liability insurance and my workers comp. I have a feeling it's only a matter of time before they ask me for something to do with cyber security before I can start doing work for them.
Risks are generally ignored. Cyber security is complex, and that's why they ignore it. They're like, "It's too hard, push it down the track. There's other things I need to fix in my business. My staff want a pay rise, I can't find people, I can't grow. Cyber security is the least of my worries." But business disruption is inevitable, right? In the professional services sector in Australia, 1.5 million people are employed, and that tells you that within SMB it's a huge risk. So that's what we're seeing today.
So my question to the team at Sherpa is, what makes up a contract? How does cyber insurance help? It's not going to fix the cyber security issues, but how does it help?
Andrew Bremner: Exactly. Tim, do you want me to jump in here, or should I? Okay, I'll jump in. Thanks, Chuong. So what is an insurance contract? This is kind of Insurance 101, but it helps to understand what you need to do as part of your contribution to get the optimal outcome from your insurance, whether it's cyber, professional indemnity, whatever it is.
There are three components that make up the contract. The first one is the proposal, and it's really critical. This is where you complete a bunch of questions to explain your risk to the insurer. We talk about this a lot: it's about mutual honesty. You're honest about what your exposure is, and the insurer is honest about how, and how much, they would pay out in the case of a claim. So it's a really important thing to get right.
The second part is the schedule, which is basically the specific details of your cover provided by the insurer. And the third thing is the wording, which is the detail, the definitions, the fine print if you like. Those documents combined make up the insurance contract.
Why this is important, particularly in the cyber space, is that cyber used to be the insurance that you could not sell. People were not interested. Now it's become very, very hard to buy, or in some cases you cannot buy it. A lot of the time it's about how you explain your risk, because the cyber insurers have been so smashed by claims. Anyway, I want to pause there, but that's a little bit about what makes up an insurance contract. Sorry Tim, you probably...
Tim Stephinson: The activities that appear on those contracts: this is the one area that insurers focus in on, to make sure they classify your business correctly. And with the changing nature of technology, a particular example is cloud services. Five years ago cloud services looked very different to what they look like now, and the insurers need to understand that.
So that's where having a great technology partner like Fuse is really important, to help posture your business and clearly explain the stack that exists to protect you. We're seeing that more from the US now, where they're drilling into those products and they want to understand what you've actually put forward to protect your instance in this environment.
Chuong Mai-Viet: So what you guys are telling me is, when I get this massive spreadsheet from you to fill out, and I fill it out, and I'm like, "Well, I'm not too sure about that, I'm just going to say yes," and then I have a breach, and what I said on that sheet actually wasn't happening, they could reject my claim?
Andrew Bremner: Correct. One of the challenges is that cyber has been so smashed in terms of claims. The loss ratio last year was 120%. What that means is that for $100 of premium, the insurers globally paid out $120 in claims.
Chuong Mai-Viet: That's a very profitable business. It's not sustainable, right?
Andrew Bremner: It's absolutely not sustainable. So what's happened is insurers have become very picky around claims, and they're looking for ways out. We call them off-ramps: they're looking for ways to wriggle out. For example, the proposal might ask, are you doing MFA on every platform, including socials? Are you providing cyber training to your staff? Are you applying regular updates and patches? If you don't do those things and you've said that you have, then it gives an insurer a reason to walk away, or for the policy not to respond in terms of a claim.
Chuong Mai-Viet: Amazing. All right, so what do we do about it? Look, it gets even scarier if you're a director of a business. There are six things that you need to do that we feel are non-negotiable. They've passed some of this stuff into legislation, and I think there's going to be some new stuff coming up.
As a director, you need to ensure the protection of the information. You need to have a cyber security framework, and you regularly review it. You need to assign roles and responsibilities within the organisation, even if you're a small business, about what to do. Your staff have to be aware and trained. You've got to review it all the time. And then you've got to make sure you've got an incident response plan if it happens. That's your responsibility as a director.
So I think it's a timely segue into what you, as a director of a business, will be held responsible for. Julian, I think we've got another poll that we're going to put out to people to help them wrap their heads around it. So, how much do you think the fine will be in the new privacy update for companies that are responsible for a data breach? This is an interesting one. It'll be interesting to see what people think, because it will show us how scary it is.
Tim Stephinson: This is a good question. I suppose the driver behind this as well is the PII records, the personal information records that are sitting out there. It's really interesting when we talk to insurers about these. A common area that we try to clarify is who is actually responsible for the PII records. In most instances it is the business that dealt with the person who gave up the PII.
In many cases that's your customers. The PII that they hold, they are ultimately responsible for, and they need to hold cyber policies to protect it. The cyber policy that Fuse holds doesn't protect their instance of that information.
Andrew Bremner: Yeah, that's a really important point, Tim. I'm really glad you raised that. That's a really critical point.
Chuong Mai-Viet: So we've got some results in, and it's an even split between $5 million and $50 million. So obviously it's still not clear to everyone what it is. Can either of you guys tell us what it is?
Andrew Bremner: Yeah, I'll jump in. So it's forecast in the 116 recommendations for changes to the Privacy Act. Currently it's $2.1 million, but the recommendation, and it's expected to go through, will be $50 million.
Chuong Mai-Viet: $50 million. That's just huge, right? So when someone comes along and says, say you're a big bank or a large corporate, you need to spend a million bucks on cyber security, as a CFO you look at your risk and you're like, what's insurance going to cost me, what's the fine going to cost me, do I roll the dice? The answer is it's not worth it. So we've got to get this stuff right, and that's kind of where it comes in.
Tim Stephinson: Just to jump in there, another point on that is that while that's relevant for the big end of town, they're looking to remove the three million dollar threshold on disclosure. At the moment it only applies above the three million turnover limit, and when that gets removed, it's a problem for anyone running a small business.
Andrew Bremner: Yes, and someone on the chat is asking about small business. There are some additional recommendations there, because a small business is not going to be able to handle a $50 million fine. One of the alternatives for small business will be three times earnings for the year, but it will be a sizeable penalty.
And I just want to add that in Australia we've really been behind the eight ball compared to Europe, under what's called the GDPR regulation, the EU regulations, and the US regulations, which are different by state. We are so far behind the rest of the world, and this is about catch-up. The 116 recommendations are about broadening the definitions around the data that people are responsible for, and also broadening the penalties and the actions by the regulator.
Chuong Mai-Viet: Amazing. So what can you do? What can the people on this call do? There are some simple things that can be done today. Multi-factor authentication being turned on: yes, it's annoying, but if you do it for your bank account, there's no reason why you shouldn't do it for personal information, which is your email address. There's software that you can buy today: endpoint protection, email protection, filters, backing up your data.
Permissions: how many people don't know who has admin access to their environment? Updating your device: every time your iPhone pops up and says there's a new update, and it says now or later, and you keep hitting later, there's a reason why the updates are there. And then cyber awareness training is the last one. It doesn't cost much to sign up to a cyber awareness training program that will help your staff understand how easy it is to lose data.
What that will do is basically help prevent the attacks. When there is an attack, it will limit the impact. And if it gets really bad, having a backup means that if someone ransomwares your data, you've got a backup and you can restore it. You don't have to pay the ransom. Yes, they've got hold of your data, but they've got hold of your data anyway, and you get on with it. So these are the simple things that we can do today.
What the Australian Government is doing right now is they've launched this thing called the Essential Eight, which is basically a maturity model for cyber security. What they've said is that if you do these eight things to a certain level of adherence, you'll get a certain level of security. Level zero is basically you do nothing. Level one is you've done the basics. Level two is you've done a pretty good job. Level three is you can now start dealing with Defence and the ATO and all the big end of town, because you've got everything in place.
So they're super important for you to understand, and it's really simple, and that's what we're doing around it: helping, because insurance companies are asking for the same sort of information. So, to the team from Sherpa: how do you get cover, how do you get a strong posture, and what insurance policies do most businesses need today?
Andrew Bremner: Yeah, so most businesses, whether professional services or retail or construction or whatever, need a bunch of insurance policies, and we've just named a few on the slide. I suppose one of the critical things, with professional services in particular, which the Fuse business, the SherpaTech business and the Sherpa Insurance business all are, is the two critical areas. Professional indemnity, which is protecting you for bad advice or perceived bad advice, and the second one is cyber. For the rest, I'm more than happy to go into more detail as needed, but I think we'll just zoom in on these.
To zoom in on cyber insurance in particular: it really helps to build a very good case in your proposal that we talked about earlier, and to show that you have a very strong technology posture, because it really can make the difference between whether you get insurance or you don't. We see huge variety in the cyber insurance policies that are out there, so please ask your insurance adviser to help you navigate that piece.
That includes cover for your own organisation, called first party, and most of the policies are very focused on that. But also third party, in the case of one of your end customers making a claim against you, and also social engineering and crime, which are normally optional extras. So there's a whole bunch of things that you need your adviser to help you navigate through.
Tim Stephinson: We also find there's a lot of confusion in the market about what cyber insurance actually does, or what it responds to. We look at it like it's the emergency services you need when there's a cyber incident. While you may have an MSP like Fuse who does a great job in mitigating and living in your daily environment, in the event of a data breach the insurer holds 24/7 support teams to jump in and actually rectify or investigate the faults. They do this because it limits their exposure. They want to get in as soon as possible and mitigate the losses.
They also have a huge legal framework that they align to for the communications, the fines and penalties, and the general GRC requirements. Those are services that Fuse or others don't traditionally offer. So it's really important to see the services that Fuse offers, and what cyber insurance does, as very different products. We see a lot of MSPs initially being fearful of cyber insurance, thinking it's a replacement for their services, but it's a huge expansion on that. MSPs quite often don't carry the legal and other services that you need when that breach happens, and that's why the insurance products exist.
Chuong Mai-Viet: Absolutely. We've seen firsthand some of our clients go through this, and the team that they bring on board in terms of PR, legal, comms, the whole lot. We're a technology business. We can help you navigate the technical challenge, but we're not going to help your business reputation get back up to speed. We're not going to be able to make sure that you communicate to your customers about the legal requirements. We're not going to be able to submit the reports to the reporting bodies, because that's a different level of expertise. So that's where cyber insurance 100% comes to the fore.
Andrew Bremner: Cyber insurance is an unusual one, because the insurer wants to know the moment you have a breach. They want to speak to you straight away for that 24/7 response, because they want to jump in and limit their exposure, and they want to control the negotiations with the regulator and the other stakeholders involved. So that's one of the really compelling reasons to get cyber insurance in place, and we would absolutely recommend people consider cyber insurance for their businesses.
Chuong Mai-Viet: Amazing. So, the last poll. We're interested to see, of the people attending the call today, who's got a cyber security strategy in place. It's one of those things where there's no right or wrong answer, we just want to know where the market is at the moment. Have people thought about this within their organisations? We don't know who responded, so we won't bombard you with marketing if you say no. Well, that's 50/50 so far. It's even going the other way.
So look, it's one of those things. Segueing into what Fuse is about: one of the things that we've been doing over the last year and a half is we've really understood that small businesses need help around cyber security. It's complex. We've got some clients that we've picked up in the last year and a half who asked their incumbent IT, or their internal IT, "Hey, what are we doing around cyber security?" And someone will come back, for a 20 seat business, with, "Oh, it's $100,000 worth of project work," and it's all care, no responsibility. You have to buy a bunch of this software. There's a lot of noise.
So what we did was build a managed service solution called Fuse 365. What that does is layer software, monitoring, managed services and education all together in a simple package. We start with Microsoft, which most businesses have these days. We then layer on some products around backup and SIEM management, which is the monitoring. We use products called Netskope and ThreatLocker, which do the web filtering and cloud CASB. That's a bunch of technical terms, but basically it will get you to Essential Eight Level Two compliance out of the box. Then on top of that we do our support and our security training, where we work with your team to make sure they have the right outcomes.
And we put skin in the game. It's for the new world of working from home and working from anywhere. It's best in class, but we've implemented it and standardised it across our stack. We eliminate the complexity, so we make sure you don't buy two pieces of software to do the same thing. And then we wrap a cyber security guarantee around it. We basically say, if you get hacked doing all the things that we've asked you to do on our watch, then, because we see it as a partnership, we should have some skin in the game as well. So we will do the remediation, we will fix things, and we'll give you a rebate on our services, because we haven't done our job to the best of our ability. But we're that sure the product fits the bill, and that's why we do it.
From my perspective, it's not a replacement for an insurance policy, but it is a bit of peace of mind. As a business owner, you've chosen a partner who cares about your security so much that they're willing to put their name and reputation on it, and not a lot of businesses in our space do that. A lot of them have great teams and great solutions, but when it comes to putting skin in the game, it's never that easy. So we're quite proud of the product. We've signed up some great customers over the last year and a half, and we're growing quite strongly with the product. So that's what Fuse is doing from a cyber security perspective.
So how can we help you guys? The team at SherpaTech have kindly offered an insurance health check for anyone attending this call today. Basically they'll offer a free discovery meeting and a health check, and present their results. Normally it's quite a time intensive exercise, but we think it's important enough, so the team from Sherpa have been kind enough to offer this. From a Fuse perspective, we're also offering a free cyber security check, what we call a desktop check, just to have a brief look under the hood and make sure there are no glaring issues in your environment. So both of us would like to offer that service. We'll be doing some follow-up calls and emails to the people who attended today to see if anyone wants to take it up. That's what we're offering as part of this seminar today.
So I think we're finished, and we're going to hand over to Q&A for the rest of the session. Has anyone got any questions after what we've presented? Very quiet, guys. It means we've answered all the questions. Okay, we've got one: what percentage of businesses actually have cyber? I think you said 25%, was that right?
Andrew Bremner: Yeah, and our customer set actually aligns with the industry average, so it's about 25%.
Tim Stephinson: I suppose the change there as well is that we're seeing a lot of companies, if they're engaging contractors, request that the contractors hold it as well. If they're managing anything in your environment, you want them to have it when they work in your instance. We're seeing it from the New South Wales Government, and we're seeing it from a number of the larger players as well. It does protect both parties, because it's first party cover, so if you both hold it, the insurance companies can then deal with it together.
Andrew Bremner: Yeah, and just as an example, the New South Wales Government is actually requiring $20 million of cyber cover in some cases, which is an enormous, ridiculously high sum. There are often negotiations to reduce this, because many companies will just not be able to achieve that.
Tim Stephinson: I saw a question there about who we're going to for cyber in the market. There were a couple of players that pulled out of the market last year, but we're seeing the market probably soften a little as it becomes more attractive and more people start offering cyber. So we go to Chubb, CFC, Emergence, DUAL and Brooklyn, and we're seeing more players come in now as well.
Chuong Mai-Viet: On this one: what percentage of applications you receive would you say make their first application with sufficient security in place?
Andrew Bremner: Oh, it varies. Tim, you've probably got a better view than me on that one.
Tim Stephinson: In some instances, and we had a Sherpa Insurance customer about a month ago, we looked at their proposal and said, "We don't think it's in your best interest to take this to the market. You need to go back and talk to your teams and look at improving your infrastructure." We want to take risks to the market that the insurers feel confident in taking on. A number of years ago, Andy could take something to the market with a bad security posture and they might take it, but now they expect a very strong security posture as a minimum.
So as the first step, we actually have a checklist that we take our customers through as well. What are the characteristics of the business, what are the areas of data that you're holding, and what does a good cyber policy look like? We're more than happy to share that with anyone on the call today. It helps people understand what a good policy is actually there to do, but getting your house in order is really the first step in that process.
Chuong Mai-Viet: Any further questions? No.
Tim Stephinson: We're always happy to take a LinkedIn add from anyone on the call today as well, or if anyone wants to reach out with any other questions, we're happy to have a chat offline or get involved wherever needed, even if it's just a second opinion. Andy and I are available.
Andrew Bremner: Yeah, absolutely.
Julian: Sorry guys, I'm just going to jump in. I can see Chuong has maybe dropped off, or he's on mute now. So thank you everyone for joining, and thank you Andrew and Tim for being here today and sharing your experience. We will definitely follow up. If anyone wants the slides or more information, you can send us an email and we'll definitely get back to you. All right, I think we're good to close the session.
Andrew Bremner: Wonderful, thanks Julian. Thank you.
