Hello. Good afternoon. Good morning. Good day. Wherever you are in the world, welcome to data you can defend, operationalize, and trust at the point of ingestion. My name is Alex de Lucena. I am Shield’s director of product strategy. I always go into these webinars talking about how excited I am to talk about, but, the topic at hand. But I’m particularly excited today just because this is something that I have been talking about so much and honestly talking about so much for, a while. So, today, we’re gonna talk about, you know, why ingestion is the priority it is. We’re gonna talk about challenges. We’re gonna cover what good looks like partnership. We may have time for questions at the end so people can plunk them in the chat. We’ll be monitoring those as we go. But first, and the other reason I’m super excited is we have a really great panel, with whom we’re gonna kind of, talk this all through. So, you guys introduce yourselves. I’ll name you, and then just go. Therese, Therese, Tom, and then Dan, tell us who you are, and then we’ll kick this off. K. Hi, everyone. I’m Therese Crepero. I’m a partner at Reed Smith in our emerging technologies and fintech and data groups. And my focus is on data risk management. So that’s everything from technology implementations to record keeping to data minimization, and everything in between. Great. Tom? Great. Hi, everyone. My name is Tom Rimmer. I’m part of the Shield team. Really grateful to be here. I have the exciting time of working with a lot of our clients, a lot of our prospects. And I’ve had the pleasure of being involved in projects like this since the early two thousands where it was slightly easier. It’s got a little bit harder over time and complex, but really looking forward to the conversation. Dan. Dan Erig. I’m an ediscovery and surveillance architect at Query, and I’ve worked in this space since it became a space over twenty years ago. And, since then, have worked on projects at, about forty different companies. Okay. Amazing. I should say that, Tom, Dan, and I, we didn’t coordinate on our shirts. This is a total accident that we’re all in the same color. Well but, anyway, let’s dive in. So we live in a a a kinda curious moment and for lots of reasons. But for the for for the purposes of this conversation, what I keep seeing and hearing is that the ability to foster accountability and transparency and build processes around ingestion have become equal in importance to the core capabilities that financial institutions seek as they look at archives and surveillance vendors. Right? So if you take surveillance, they care about detection, they wanna see their risk coverage expanded, their false, alerts go down. But show me the numbers first. Let me know, that I account can account for everything coming into the platform in order to trust those detections. Right? They’re furious about AI. But, again, let me get a hold of these numbers so that I can be comfortable with these more modern tools to be, so that I know that I that they’re even performing the way that they should. They wanna move off legacy tech, but, again, they want confidence and completeness. I was trying to think of an analogy. Right? And it’s, and maybe this one isn’t perfect, but, it’s as if in the home buying process, the inspection became equal to or happened at the same time as someone actually saw the house. Right? So it’s, you know, I love the closet space, but can we talk about the foundation? We have enough rooms, but does the roof leak, and can we make sure it never does? Right? And maybe someone else here here has sort of an, you know, a better analogy, but but we’re seeing sort of controls become equal to the core capabilities people usually look at technology for. Now one driver is, of course, the fines we’ve seen in the last few years around off channel comms, data integrity. But I think if we’re honest, these only serve to emphasize and expose concerns and controls that have been around and that people have developed controls around for a while. So, Therese, let’s start with you. Just from your seed advising firms on on on good compliance, what’s changed that puts ingestion completeness, you know, to the top of the agenda? Yeah. Look. I think what’s changed is really technology and the way that people communicate in terms of what you’re seeing. Like you said, right, I think the off channel fines have kind of put a renewed focus, so to speak, on this area. But but in reality, what we’re seeing is we are not where we were twenty years ago. There are a huge number of different ways that people are communicating. It’s not just, right, the, the WhatsApp that somebody down downloaded to their phone. There’s a communication feature in almost every application that our clients are using today. There is a drive toward collaboration, toward having communications within the tool that you are using on that particular subject to drive efficiencies and to drive effectiveness. So you’re seeing a huge increase in the different types and channels of communications that are out there. And with that comes a huge increase in complexity. Right? This isn’t well, I’ve got email, and I know how that gets ingested. And I have Teams or chat or Skype, and I know how that’s ingested. This is customization for every new type of chat that pops up in every application. So now you’re looking at a lot more many more channels that need to be monitored for completeness of ingestion and for accuracy and all of those things. But you’re also seeing the complexity in how they’re ingested where one small thing can change and suddenly, right, the pipeline breaks. And you may not be ingesting everything or you’re not ingesting all the things. And that I think that that increase is just making people realize, I can’t monitor all the channels manually maybe the way you could have, you know, twenty years ago. There there’s so many potential breaks and so much complexity and customization that we’re seeing a greater focus by saying, I need to find another way to do this because there are too many opportunities, points of failure in the systems now that really require more controls, more scrutiny around making sure that the ingestion pipelines aren’t breaking down. Right. That’s a great point. And, right, not even twenty years ago. Right? I think even five years ago, there was a level you know, like, if if, but, now, Tom, what are you hearing from, you know, people in the field? Like, what’s the balance between how these concerns are being prioritized versus talked about? What’s the balance? Yeah. Hundred percent. And just to add to Therese’s comments there, the variety. You know, we I was speaking to, someone recently, and I saw it on social media. Different asset classes or departments use different tools, and they’re just expanding. So if you’re in kind of fixed income and equities, maybe it’s Bloomberg. If you’re in, commodities, it might be WhatsApp, but there’s just so much variety. You know, we’re seeing, tools like Salesforce being used and actually emails that came from Salesforce seen as a record. How do you capture those? So the variety is just expanding. You know, what we’re seeing when we speak to the clients and, prospects out there is one of the major concerns straightaway is how are you gonna capture those? How can we get the assurances? But also through its life cycle, if there’s changes with those data sources, how do I make sure that I’m still getting those records? And I think also it’s it’s looking at the outcomes. So it used to be, you know, how much data have you got? Go and report on it. Now it’s making sure, right, has that data got through to my surveillance suite? You know, can I search on it? So there’s steps within the whole process that is getting more detailed. So there’s more requests coming into us as a vendor. Can we show more visibility? Can we show where the data is in the life cycle? Have you had challenges with it? Where is it in its remediation cycle? So there’s definitely a focus from the clients to say, right. I’ve gotta get this bit right. I don’t want any risk with my books and records missing. I wanna be able the assurance is I’ve got my records that downstream, then we can do our work and our actions. Great. And then, Dan, over to you. Right? You’ve watched this. You know, you sort of alluded to how long you’ve been doing this. Right? And we don’t have to get into years exactly. Right? But, but you have seen a shift around how ingestion is approached. So, Theresa and Tom have touched on it a bit, but but what else would you add? I’d say that completeness and reconciliation controls are no longer considered a day two activity. You know? In the in the early days, it was just we were just so happy just to get journaling and Bloomberg data coming in, and and, you know, we deal with the issues later. But, there’s a much more of a proactive expectation now that all this is gonna be watched very closely and that the whatever process can be put in place to ensure completeness and and reconciliation is is is part of the implementation of that channel onboarding. And, I also see that archive and surveillance vendors are expected or is preferred that they have more native connectors so that this this process can be built in to the to the process rather than something that’s that’s tacked on. So, you know, fewer fewer hops involved in the process, fewer points of failure as was mentioned before, and, more of a single point of control over that process and and, reporting. And, certainly, more detail and granularity in the reconciliation is is, expected. Very cool. Yeah. Just to build on what Daniel’s saying, because I think from a legal and a compliance perspective and you know, I won’t say that we have been behind, the times on technology development, but I think there has historically been this view that it’s technology and technology takes care of itself. Right? Well, it’s technology, so it works. Right? I mean, we we battle that with even with AI today with our users saying, just because it’s a computer doesn’t make it right. Just because it’s a, you know, an automated process doesn’t mean it’s fine. And I think that there is a greater recognition, not just among, right, the professionals that are clients, but also among the regulators who are emphasizing that it’s not enough to say, I have a technology, and I assume the technology works. There needs to be more controls around that to make sure that it continues to work the way it is expected to work and that there aren’t any changes and that there is more of a requirement, I would say, and an expectation of a partnership between the technology professionals and the legal and compliance professionals to make sure that you do have those controls, the type of controls you would expect to see, that you are managing the technology properly and not just relying on the fact that that it is technology and there is an automated process. Okay. Really great point. I think the the one other one I would add that I see coming up too is, the starting point has changed for a lot of people for for when we’re getting these channels. Right? So another one we see is just, when messages made it into an archive and then when messages made into surveillance. We see people trying to reconcile the numbers between the two even though they might be in completely different formats and have different numbers. Right? So there’s even complexity within the institution, not just the channels themselves, but within the institutions and the tech they have. Not in a good or bad way, but just if we’re gonna start baseline and then drawing lines across, okay, what’s the source of truth here? How many messages are there really between the channel complexity, the way the tech has changed? You know, where we’re receiving it is another that sort of can play into it. And we’re alluding to kind of the next thing, or not even alluding to. We’re sort of barreling right into the, what I wanted to to kind of get into, next, which is just to explore the the kind of messy real world gaps and challenges with channels, vendors, and re ingestion too. Right? Because I think that becomes an important part of this process too. Isn’t just do I have everything, but how do I account for what’s missing and then bring it in. Right? So we’ll talk about the challenges. One thing, any war stories you have, completely welcome. Right? So we don’t have to name names. But, Dan, let’s let’s go back to you and and, you know, shift into channels. What makes it so hard for firms to know what’s what? I think some of the biggest challenges is that there’s no standard for this across delivery methods, across all the different vendors that we need to capture communications from. So each channel can have its own unique challenges. Each channel will allow may support a reconciliation, but how far back in that process are you going for that reconciliation? And especially if there’s multiple vendors involved with that, it’s, you know, there’s there’s a lack of transparency flow flowing through that process. But let’s just take SMTP as an example. A lot of channels come in via SMTP. The, you know, that protocol itself doesn’t guarantee delivery. It’s it’s, normally highly reliable, but it’s not guaranteed. And even if perhaps a a manifest of, SMTP counts that were generated, could be passed through for analysis. Sometimes, you know, great. You you can verify you received x number of messages that day, but depending on the the communication type, you know, message counts don’t add up to interaction counts. Sure. There’s there’s a a level of of, complexity there too. For channels that come in via Well, I was gonna say, what about if they come in, on a like, an API or something then? Yeah. So that is generally better. But, you know, vendors can can make changes to APIs. You know? Teams is an example of that. Microsoft can make a change, and now something is no longer captured, or we’re waiting on the vendor to update their their code to reflect some change in the Microsoft Or the flip side now is available. Right? And as a vendor, we have to figure out whether we wanna bring that in and if that’s useful to our customers or or something like that too. Right? So it can kinda cut both APIs too. Right? Yeah. You might not wanna see, I remember once, the ability to delete messages became sort of available within Teams. Right? Do people actually wanna see that? And then for us, how do we capture fact that something existed and then it was deleted? How do we display it? You know, is it a record? Isn’t it? And and so on. What about, our favorite, file based, you know, channels delivered by file, you know, Bloomberg? All all our fin chats. Right? Bloomberg Yeah. And at Reuters. You know, what are some of the challenges around those? Yeah. So file delivery is pretty easy to track and to alert on if something went wrong with that. But you you’ve you’ve gotta trust that the source communication platform is delivering what it should to you. You have no visibility further back in the process than than that file. That file is the authoritative source that you can you can, check against. Great. And then, Tom, just from your seat, kind of, how have you seen this sort of breakdown in in in in in in in your lifetime? Yeah. So I think, you know, as Daniel, was just alluding to there, it’s it’s that visibility. You know, you’ve got so many varied data sources. Some of them don’t even give manifest files. So have you got all the data? I was recently speaking to, someone who it was on voice recordings, and the recording they were getting recordings, from the supplier, but, actually, one of their geographies, one of their regions have actually had an issue and stopped. But for them, all they saw was data coming in from this supplier. It dropped. The volumes dropped. So, again, the only way they could really tell that there was an issue was actually looking at metrics and looking at trends, which is not something that traditionally that people have done. They’ve looked at, oh, is messages coming in? No. It’s not. Oh, there must be a problem. So I think that’s the kind of legacy approach of is the channel working because I’m receiving something. People understand that’s that that’s not good enough, in any way, and there’s some gaps in it. Another thing I’d add there too is often when you have these sort of older controls in place, sometimes you actually have a kind of de facto tracking of that, and it’s some SME. Right? It’s it’s someone or a team that’s just kind of watching, and they know that you get this many more or less, Bloomberg messages a day, and they know the days it comes in, and and Sunday is less than Tuesday, and so on and so forth. And you have this sort of you’ve kind of backed yourself into this human control that’s completely relying on someone saying, you know, kinda sticking their finger in the air when they they, you know, to to to check where the wind’s coming from when something’s off because they see a drop. And it creates this sort of reactive process where you’re constantly looking back, and having to figure out, what’s there. And it’s another kind of, I think, kinda issue that people bake into this. Now I wanna move into kinda what good looks like. But, Teresa, I wanted to make sure just because I know you’ve been across this, as long as anyone here. Is there anything else you would kinda wanna add just from the challenges perspective around kinda what holds this up, what makes this hard, and so forth? I I think that one of the hardest things about this in terms of the changing technologies is balancing the risks. Right? We all would like to think, you know, there’s one hundred percent absolute compliance. There’s no risk decisions that are made. And, you know, that may be what we strive for, but the reality is is there are so many of those. Our clients are sitting down and analyzing every new channel that comes in that they, you know, can surface and saying, okay. If this has to be captured, what does that mean? Is the vendor willing to work with me on a capture mechanism? Some are. Some are like, okay. I serve the financial services industry. You tell me it needs to be captured. We’ll do the development. Some are saying, I don’t I’m not gonna invest in that. I don’t wanna invest in that unless I have a critical mass of somebody that needs to do that. And it’s cost that’s required from ingesting that. It’s fighting with the vendors sometimes, not with the shields of the world, but we’re talking about, like, the vendors that have the communications because you’ve gotta set up some mechanism for getting them to to your archive and then sitting down and saying, okay. Legal and compliance don’t wanna say no. You can’t if the business has a business critical application with communications, legal and compliance don’t wanna be the ones that are saying, no. You now I’m gonna block your use of that. So you’re trying to find the way that you can make it work. Do we find that a a side method of getting it in that isn’t great, but at least I can say that it went to the archive and somebody can surveil it and and the like. Or, you know, if I’m looking at a very specific channel, can I make the argument that, well, these type of communications, I’m gonna argue are outside of the regulations? Right? And depending on your, you know, business, that’s easier or harder. Broker dealers are business as such. We all know that is a very, very broad definition of communications. CFTC or MiFID or investment advisers are gonna be a little bit more circumspect, but even so, it’s very when you’re trying to make those decisions to say, could I exclude this? And then what if usage changes? What if I could make the argument it’s not covered, but usage suddenly changes? How do I know? How am I monitoring that? So there’s a more focus on trying to make these distinctions of what is good enough for getting it into my archive and for being able to, you know, surveil it and the like? Where can I make some risk decisions about these if I feel comfortable that’s possible depending on the institution? So those there’s so many challenges associated with this and with the technology changing so quickly of saying, now I don’t have to just monitor, is it getting into the archive properly, but is there a new usage or a change or a new tool that pops up in an application that I’ve been using for years that didn’t have communications. So the I think that just the changing landscape and the volume and the costs are such a challenge to trying to find, right, the right balance of being compliant, but also, right, being business conscious. So let me I I wanna make a quick side comment, and then I wanna ask you a a question. Right? So the side comment is is just a on your thing about around sort of, upstream channel providers sort of not wanting to provide. Right? In some ways, it it it sounds, malicious. Like, why wouldn’t they wanna do that? Right? But if you take, like, a Meta, right, they’re two, three billion WhatsApp users. Right? The core use case for them isn’t banking compliance. Right? And so we may feel like, well, why don’t they make all these features available to them? And it’s because it doesn’t matter as much to their bottom line as it might for a different channel. Right? And that’s what makes it so difficult to bridge, these gaps, and it can create technological headaches and and workarounds. Now, I wanted to sort of ask you, what are there any rules of thumb, right, for risk based decisions? So let’s two examples. Right? You know, one might be, let’s say something traders use. Three traders use it. It’s been onboarded. They use it only to communicate with another counterparty, and the, volume is impossible to baseline. Because sometimes they communicate a lot, and sometimes they barely communicate. And it’s too much work to constantly be looking and even calling them on the phone to say, did you communicate last week? And they say, you’re calling again, that kind of thing. Right? So what’s the rule of thumb for these sort of edge cases? How do we kind of and and this sort of maybe a good segue into what good controls look like, but how do we become comfortable, you know, with some of these edge cases? I can give you a rule of thumb. I wish it were that easy. But it’s not it’s not. Right? Because any risk based decision just has too many variables. Right? It depends on the institution, depends on the level of risk. Now look. If you have three traders who are engaging in communications that are required to be retained by the under the regulations, then you have to capture and retain them. There’s not you could say I’m going to choose or a a company could make the choice to say, I’m not gonna capture those because the odds of me getting caught and, you know, that becoming an issue Right. And just have that is not what we’re That is not what we’re advocating for. Not the point of this this guy. We we for that. Right? But, again, but that’s sometimes. So we’re often where you end up is instead of saying I’m not going to comply, which is not a choice that our clients typically would make or that we would recommend. And instead of saying you can’t use it, you start saying, okay. But what can I do that will be close enough? Maybe I can’t set I’m not gonna build an API to ingest the messages of these three people, but I’m gonna get a report every month or every week that gets emailed into the archive and it gets, you know, designated for being surveilled. Right? So I set up a mechanism that’s not perfect and not and that I don’t love. But if I can’t get the vendor to do it because of cost, you know, issues for them, right, you’re asking for a development effort to change their product, which they may not feel is always necessary as you pointed out. It’s saying the educations, I think, are typically handled by what again, what’s the good enough scenario here so that I’m still compliant. I’m still getting into the archive. It may not be some perfect mechanism. Maybe there’s manual workarounds and things like that. But still making a reason I think the most important thing is making a reasoned decision that is an intelligent decision with the input from, right, your legal teams and from the business and from compliance that says this is this isn’t a perfect methodology, but it is reasonable. It is compliant for these reasons. I can explain, right, why I did it so that you know? Okay. Maybe it’s not going in in real time, but it’s going in the next day or at the end of the week. Again, it’s not perfection, but I have a reason to basis that I can defend in explaining to the regulators. So I think that that’s really when you’re looking at making risk decisions, it’s less about being compliant or not. It is more about what is the best option that is good enough for compliance. Right. And I think an easy question, like, obviously, for something like Outlook or Bloomberg, safe to say, there’s very little wiggle room there. Right? Alright. Yeah. I mean, absolutely. In particular, because there already are mechanisms for capturing that, and the volume is so high. Right? I mean, there are again, when you’re looking at risk balancing, right, you’re not gonna accept a, you know, a a mechanism that’s kind of manual for email. Right? Right. If the volume is too high and and there’s too more risk there than there would be for something that’s smaller volume or a smaller risk from a content perspective. Great. Okay. And and now we are, we continue to move in in into kinda what good controls look like. Right? So I think we’ve sort of addressed some of the challenges. Dan, Tom, we were talking yesterday, and we started to kinda tease out a framework, for what good looks like that covers, you know, did we get it? You know, do we get the data? Did it make it into the archive? And did we get the data that we should? Tom first, are those all the steps? Are there any did we’s we wanna kind of fold into that and make sure we have? I think there’s, from the onboarding process, it’s also looking at the end game. What do you wanna actually achieve at the end game? So from a discovery, what do they want to achieve? So each of the steps that it goes through, am I you know? So one of the ones we talked about yesterday is, population going in there. If I’m searching for everything for Tom Rimmer, am I gonna identify everything for me? Or do I need, you know, special naming conventions in there that I’m using? How do I make sure that from an eDiscovery point of view, I can find everything that I want? So I kind of you know, some of that onboarding process is to go through those use cases. You know, one example is we’ve got some, you know, data sources that, you know, might call me trimmer for my name, but maybe Tom Rimmer. But if I was searching on Tom Rimmer, trimmer’s not gonna come up. So I’m gonna miss a whole junk, chunk of data. So all of that naming convention, understanding users, who they associated with departments, those kind of things. So I know one of the the key focuses is is looking at the use cases, testing the use cases out. So as you onboard these channels, you know those steps, you know, that endgame of what you wanna achieve from it. And I know Daniel was teasing out kind of multiple steps that he’s seen. So I don’t know if Daniel And I’ll I’ll talk to that really quickly, but I also wanted to add a few other steps. So you added, did we can we search for it? Right? There’s also, did we transform it? Yep. Did we alert on it? Right? If it’s missing, can we find it? Right? And so on. Right? So, so switching to Dan, right, because I I I know you have sort of a lot to say here. So let let’s just start with let’s just start with the most general. So what what does good look like? What’s our starting point for good? And then let’s talk about what did we get the data good looks like and and some of these other steps. So what does good look like? Sure. So like like you mentioned, we have those three basic levels of of checks. So the first one is just basically, did we get data for the channel? And and this is just just a baseline verification that a process ran, that data was processed from an upstream system, and that it’s that it’s been received. So, you know, preferably, there could be some automation around this, alerts from ingestion systems or processes, alerts from data transfer systems. Some of these, depending on how novel they are, may require some some manual system checks. But that’s that’s just the just the And what might that look like like, we you you know, you were talking about earlier how you might have, you know, an SMTP provider that gives you a lot of detail in a man in a manifest and then, an SMTP provider that gives you sort of barely any detail. Like like, how are you kind of managing that sort of differentiation across detail at the did we get data, step. Well, you know, it it’s for that manifest, it’s a it’s a question of, does the upstream provider have such a thing? Right. And then in what format is it is it sent in, and does the does the, ingesting system know what to do with it? And, you know, if if it’s just a message count, I mean, that’s that’s a good first step, but, you know, there’s more expectation on a lot more granularity there. So something with actual message IDs that could be tracked within the the the receiving system would, just, you know, bring that up to a a much higher level of of, detail. Okay. But but after that, you know, looking at the next level, did data get did the data get into the art archive? Okay. Great. We’ve we’ve received it. But did the data get in? You know, ideally, some sort of automated search of the actual repository. This ensures that it made it through the pipeline. It’s it’s indexed, and it it’s it’s available now for your rediscovery and and surveillance processes. The the challenge with that is that, you know, now you’re now you’re dealing with, potential processing that the pipeline might do. For example, dedupe. There might be some dedupe occurring there. So now, you know, instead of four hundred messages from a certain channel that day, you’re only gonna show three hundred and eighty five. Well, is that a problem, or or did something you know? Did it did it do what it should do? You know? We want it to dedupe. Right? You know? Like, we don’t want you know? Like, someone sends a message to five hundred people, it’s the same message. You know? If we can kind of, you know, bring down that storage size, right, and just have a single message that serves as a source of truth, right, then great. Now there’s deduping. We have failed messages too. Right? Failed attachments. Right? So how are we kind of balancing, the fact that that initial number that the upstream vendor says, here you go. Here’s five hundred, and the next number is four twenty three. Right? How do we balance those those two against each other? How do we sort of get comfortable with that delta? Is that a question for me? That is a question for you, Dan. But if you’re laughing at it, you know, if this is a joke, it is a question for you. But, obviously, anyone can jump in too. You know, I think, you know, we would all love to see some some sort of statistical analysis and automation around this. But, you know, depending on the channel, I think that there is a there is the human monitoring factor here. Right. Like you said, those those system admins that are looking at this, they get a sense for for certain trends and and, you know, are would would be relied on to to raise something. But, you know, I think we’ll get into this later as a as a next generation of of what looks good. Some some, more automated statistical analysis of of the process would be really helpful. I think there is some maturing of some of the you know, if we look at the vendors out there, you know, it used to be kind of a black box. Did it make it? Did it not make it? You are now seeing where, you are able to you know, as they come through, what’s you know, can we identify what the issue may be? Can we put that into a bucket to do remediation on it? Is it something we can repair and then put through the process? And you can start to see where the counts are done. You know, as you said, Alex, you know, four twenty you know, I had five hundred. Four twenty three has gone into the archive. Where are the other objects? Do can I tie those down to where they may have failed? And can I look at a process, some kind of automated process to bring that number? Or can I replay those back to the client and say, look? These are the ones we couldn’t process. So at least you’re you’re following that life cycle. You’re following those those areas where you’re tripping up. I think in the past, it’s been, yep. I’ve got four twenty three. Don’t know where the others are. And then there’s a bit of a a cycle going back and forward trying to work out what’s gone wrong. I think there is more now steps that we’re seeing that you can put in place to help the clients through that process and the data. And I wanna thank you for saying help the clients through that process. Because, look, when when I’m looking at this and when my my clients are looking at this to say, basically, how can I be comfortable that I have reasonable processes to make sure that my ingestion is complete and accurate? I mean, part of it is you only know what you know, right? You can only know what you can see. And yes, volume counts are one way to do that. Trends over time, we’ve talked about that, are a way to do that. If you know that you see a certain amount volume of data from a particular channel and you see unusual changes, right, those are things, sure, that you can look at. If you can get reporting on errors, right, there there are errors. I should get reporting on errors when people are reporting on of it. Right? You know what I mean? Yes. And what is the error? Yeah. What is the error? Yes. But am I getting errors? If I know there’s a rate of deduplication, can you tell me the rate of deduplication? So those are the things that are a combination of right reporting and, as Daniel said, sort of there is some manual aspect to this of monitoring. But the other thing is that as from a shield perspective or any other vendor, you see more than our clients see. Right? You have the benefit of that. I expect my vendors in this space are acting as a partner. You’re not a technology provider. You’re a service provider. If you see something that’s happening with a common channel, if there if you know of an error that’s occurring, then I expect that to be surfaced so that it can be handled in the appropriate way. And and that may seem obvious, but it’s not. I very seriously once had a vendor who said to a client after the client found a material error in the ingestion process that the vendor knew about, Said, why would I ever tell you if I knew there was a problem with my system? I mean, we almost had a fit because that’s your obligation. Things will go wrong. We want to be able to find them and fix them. That’s the obligation. We don’t expect that nothing will ever go wrong, that will never be a problem. And I think part of it is this expecting the vendors also to do their job to say, one, if there is an error that you’re aware of, surface it so so we can come up with the appropriate solution. That’s the goal. The goal is to provide a solution, not play blame games and things like that. If there’s an industry issue or an issue across a common channel, raise it because maybe it’s affecting your other clients, maybe it’s not, but give them the opportunity to investigate that for their own opportunity when you’re aware of it. You’re not naming clients. Right? But you can say this is an issue with this type of data. You may wanna look at it for yourself. That kind of partnership also helps with the compliance. Right? And for the client to get comfortable that we’re working together toward this goal of compliance, and I’m not, you know, solely on my own trying to find, you know, all the needles in the haystacks of the channels that are coming in. Right. Hundred percent. You see the partnership there. You know, another example is is orphaned object sometimes where from a client’s point of view, where they were giving us maybe a HR file with these and the monitored users, that process there end is broken down. And all of a sudden, we’re starting to see volumes of these unorphaned objects. What do you do with them? Where do we send them? So and it’s a partnership there to go, look, guys. This is where it’s growing. These are, you know, the orphaned ones. And then it’s that that collaboration that we have to say, alright. We need to fix these. Okay. Let’s get the HR file correct, and then then we can, re ingest and remediate the problem. So there’s definitely, much more of a partnership now to say, nope. Sorry. I haven’t got it. Your issue. And I think if if I step back, you know, a point I often make or something I often see is is that there’s this gap. Right? Some of it’s just intuitive. Right? And how we kind of view these things. But as banks have moved into the cloud, they’ve gone from going from having a tech team who they often know, right, where they can pick up the phone and say something’s off and just kinda work it out between themselves. And whether that’s a good control or not is is is neither here nor there. It’s just to say they’ve gone from this model, where they’re working with people they know to now a vendor is managing that data with them. Right? Because we’ll manage it, but it’s still their data they’re responsible for. Right? It kinda cuts both ways. Right? So now the onus become comes and I think that some I think in some ways, vendors have been slow to appreciate because they’re not the ones getting fined. Yeah. Right? How important, right, being able to have the same level of attention, right, and and know how across those flows is to them, right, Especially as they brought on ICCs and controls of their own and and had them accepted. Now, you know, what we try to do is we try to sort of visualize and make transparent all the errors, failed messages, everything that came in, everything we deduped, what we’ve replayed. Right? And we’re putting a lot of investment in that. And then from the support perspective, we’re monitoring on the back end too to sort of see what trends, are in place too. What we find is is that the the the financial institution will have its own controls on top of that too, typically, because they’ve had those validated, and there’s sort of a governing process around it. Right? So we’re getting, I think, to a better place, right, where vendors, can be more transparent and are providing more tooling around, what ingestion looks like, what’s making it in, what’s missing. Customers are getting more mature around their needs even where they are on their actual development of controls. Path does vary. Right? But their needs are there, and that’s sort of kind of what the the the seed of the conversation we’re having. But all of that, I think, is what’s getting us, essentially to, the next, phase. I did have a question pop in, and had a bunch of questions in it, and and some of them I I’ve kinda folded in. But I wanna make sure we answer, what comms channels are hardest to monitor for completeness and and accuracy? I can take a stab at that. Okay. Over to you, Dan. I think some of the more challenging ones are the ones that require end users to register or enroll because it it requires some action on the on the end user’s part. And those channels too that we’ve already talked about that are that are, intermittent. You know, you might have twenty, thirty messages sent on a certain chat channel on Friday, and you may not get any others until, you know, the next Wednesday. Right. And I think for the first one, you’re saying that a problem. Is is is we don’t know what’s missing because someone hasn’t enrolled. There are no comms because someone, you know, hasn’t done it. Right? And that sort of Yeah. Into sort of, even, you know, sort of, adjacent controls where you start monitoring, not just for your for for flows, but also for usage. Right? And and and and potentially looking across specific employees and pull Yeah. And and you’re in, you know, you’re typically in a multi vendor scenario there Right. Also, which which, makes it more more challenging too. You know, there’s there’s certain channels that are that there’s no technical challenge with reconciling. You know, Office three sixty five, you’ve got the tracking logs there. You can reconcile against that. Systems that deliver via file, you can reconcile against that file. Those those should absolutely be the the the baseline. The ones that are still more of a challenge are these these, you know, social media SMS type channels that that are more user and and consumer based. Yeah. I would also add to that that some of the the channels that require some kind of transformation, so whiteboarding, you know, if you’re using real time whiteboards and the like. Is that The way the way you have to manipulate that to get it into, right, the archive, there’s not a one to one. Right? Or when you have comment, you know, an internal chat that sends comments by email. Right? And that’s the capture mechanism. It’s email, but there’s not a one to one from the original communication. So there isn’t a great mechanism for either of those for being able to automatically reconcile. So I think that that’s some of right? That some of those types of, you know, ad hoc or, you know, in you know, usage that aren’t as common are harder to find a way to reconcile. You you can make sure it’s coming in, but to be able to say there’s that one to one correlation like an email coming out of, you know, Microsoft or the like. It’s just much more challenging in the current environment. Right. And, of course, I think another curious thing is not everyone might wanna capture whiteboards in the same way. Right? Mhmm. You know, some you know, it’s because it’s this live thing. Right? And someone might decide, you know, our internal disposition is whatever’s left at the end. Right? Right. And someone might wanna see, how it progressed. Right? Or even want it as a video of some sort. Right? I think these are more edge cases. Right? But they come up all the time. Right? As we’re kind of bandying about, how we get, comfortable with this. We talked a little on partnership and and vendor accountability. We said some great things. But I wanna make sure we didn’t leave anything just on the floor just around what good controls look like. So before we move move forward, anything else anyone wants to add around kind of what good looks like? I mean, what what I would just make sure I mean, I think this can feel overwhelming, right, for particularly with the volume of channels that we see. But from a compliance perspective, from a legal perspective, what I would say for those folks who are saying, how do I how do I manage this? How do I, you know, know that I know what I’m doing is to say, one, know your channels. That sounds silly. Know your channels. Right? It’s not just through email and and Teams and Bloomberg. Know all of the channels. Have a have a record of all the channels that are going into your archive. Know what they are. Know what your steps are. Whatever your controls are, know what your controls are for those things. Right? Work with your tech teams to say, what are we doing? How are we doing it? It doesn’t have to be right deep in the weeds of the technical pieces of it. But what are our controls? How are we doing it? Are we monitoring volumes? Are we monitoring trends? Do we do sampling of these periodically to make sure that nothing has changed? And it may not be the same for every channel. You can hear that. Right? It’s gonna be what is the reasonable process that we can do? Know what it is so that you can explain it if you are questioned, right? If something goes wrong, you can explain what the control was to manage that. Because I will tell this to every client that I have ever had. I can defend a process. Mistakes will happen. I can defend a process that says, no, we had a procedure. We had a process. We followed it. This thing happened. And when we caught it, we fixed it. That is much easier to defend and much more reasonable to a regulator than I assumed IT would do it. Sure. And their controls failed. Right? The the one offs and the lack of a process, right, when something goes wrong is much harder to explain than I had a process and just an error occurred. Right. Right? There’s a huge difference in I think one thing we’ve left out too, we’re also talking about, I think, a world of, of reports and dashboards that accounts for all this stuff. Right? It’s it’s it’s a process for sure. Right? But, we’ve built within our own platform, but also firms are building their own reports that looked and and and they’re building all of these assumptions into it. Right? And we’re building all these assumptions into it that factor in, you know, how the how the data comes in, the differentiations across modalities, what details need to be accounted for to get an appropriate count, how to reconcile. Right? And then it doesn’t just end with that report. Dan already alluded to some of the things we need to do after it. Right? Do we, you know, how do we reconcile the data across it? What’s the process to do it? What’s the process to automatically replay? Automate in searches, right, that then look for that data to make sure that, they’re appropriately indexed even if they don’t match an individual, on an HR file. Anything else people would add just, from a controls perspective? I’d just to really add to what you’re saying there, Alex, I think one of the big questions that we get a lot of the time with our prospects is the flexibility in those reports. You know, I think long has it gone where you get one style of report, that’s the information coming. The demands of the management and the execs within the banks, within these environments are asking for much more detail. So that flexibility about the information that you can access, you know, is it more that they can query with APIs? They can build their own dashboards off the side of it. Can we deliver dashboards boards that are more flexible, and delivering the right information? Because a lot of the reports that kind of come out of some standard are aged. You know? They they they don’t have the level of detail that they want. So it’s a big question and a big request that we get a lot of the time. And then then Yeah. Just to just to add to that, I you know, at at a minimum, there should be a a daily either a daily report across all channels or a a, a live dashboard that can be checked. You know, that’s gonna show those daily archive volumes per channel with some historical volumes graphed. Like, that’s that’s the the baseline. Now building on top of that, a lot of this automation and historical analysis, that would be great too. But, you know, when you’re in a scenario where you wanna make sure if you need to replay something, you know, it’s a lot easier to replay it that same day or the next day rather than three months later, and you’re wondering, you know, how do I get that how do I get that data so I can replay it? So, Yeah. You know, those those basic system checks we talked about and then this sort of dashboard or or, daily report. Cool. Let’s, talk about AI because we can’t have a webinar and not talk about AI. But also because I think, there is potential here that I think is unexplored, you know, in in within our space, we see it being used. Certainly, we we have a lot of it under the hood, you know, as we look for, you know, the surface risk and that kind of thing. But how far are we away from, you know, Therese, Dan, an agentic approach that takes in, and understands, flows and anomalies across, how many channels came in, can go and fetch a missing message, can, you know, pre you know, we can I could kinda keep layer on use cases? Right? But there is a world in which and it doesn’t feel that far in a way in which we could, have agents that understand how this day what this data is and how it moves, and then, you know, be engineered to then see those processes through, notify us if something’s off or that kind of thing. So, Dan or Theresa, how far away are we from that? Well, I would put that question to to the vendors. So I’m saying and I okay. So I’ll I’ll take that. And I would put it back to you because in some ways, at least Shield as a vendor is ready. Right? The tools are there. Right? Yeah. And it’s not just the tools. It’s the controls we build around those tools to help, end users become comfortable with, the conclusions those agents make on your behalf. The tools are there. What I haven’t seen yet is given the amount of heat there’s been around ingestion and reconciliation, is someone saying, okay. Well, let’s let AI figure it out yet. Even though it might do a better day to day job than sort of the process in place. That’s sort of my my hot take since, since, you flicked it back to me. Therese, I see you sort of, We’re seeing in the even in the financial industry, a huge uptake in the use of Agendec AI and the deployment of digital workers and things that are specified for certain tasks and the like. So I don’t I don’t think the industry is opposed to that or would be necessarily reluctant to adopt it. I think people are looking for a solution. I don’t know necessarily that if you’re gonna roll out something like that, the first place that an organization is gonna ingest you’re gonna invest is in agentic AI to do monitor your, you know, your archive ingestion. Right? They’re using it in other places and the like. But I think the industry is open to it. I think that one of the challenges with AI generally is, you know, someone who says, oh, here’s this AI tool I have. It does stuff. Just don’t ask me how. Right? Which, you know, legal and compliance will always be concerned about. It’s, well, how does it work? How can I rely on it to your point? Why should I be able to rely on it? What’s the process that makes sure it’s continually, you know, not that it’s learning necessarily, but that it is being trained properly to look for things that it needs to look for and the like. So I think I would say the same thing. I didn’t I think the industry would be and my clients, at least, would be interested in seeing that if there was something out there somebody, right, was offering, that they felt they could get their hands around. I don’t again, I don’t know. And and Daniel could probably talk to this more than I. I don’t know how, like I said, willing they are to invest in developing this specific AgenTic AI right now because I think they’re focused on other business use cases where they might see more bang for their buck. Right? But I think it it’s something that folks would be open to if they saw a tool out there that could help in that way. I think a lot of their customers moving to SaaS for for this or that are have already been on SaaS, They they like the idea of of the vendor being able to handle more of the daily nuts and bolts of basic channel monitoring, but they wanna trust but verify approach. So, yes, they want the vendor. You know, something didn’t go right that day. The vendor fixes it. Yes. The customer wants to be notified, but unless it’s something that they need to take action on, you know, it’s something that the vendor just just handles. But, you know, definitely a trust and and verify. They still want that visibility because ultimately, they’re the ones that are accountable for this. The the the customer is accountable to the regulators for for, archiving or surveilling their their data. Great point. Cool. So we’re almost, at time. Tom, any last points you wanna make? Anything you wanna say to to sum it up? And then Dan, Theresa, I’ll ask the same of you. I think, it’s there’s definitely a change in you know, there there’s there’s always been focus on making sure that we’ve got the records and the books and records, but the level of detail, the level level of controls, and I think Dan said there, the level of, trust in your vendor to be able to deliver you that information and partner, I think is is never been higher. It is important. So there is definitely, I think, from our perspective, keeping with clients, creating that partnership and that trust is is number one for us. We I think we recognize the variety and the complexity, and we’re learning all the time. And I think, as, I think Teresa said, nothing’s ever gonna be perfect. But as long as we can work together and we we we have reasonableness against the whole process, I think there’s a there’s a lot more vendors can do out there to to start improving this, process. Jen, any last thoughts? No? No. I’m good. You could have summed it up right before. So, Therese, you’re last. Over to you. Yeah. I mean, I think that what I would say is the regulators are right. Have been focused on the the changing technology space and the impact that can have on compliance. And while these things usually have a long tail to develop before we start to see enforcement actions, I would say don’t bury your head in the sand about the challenges that the variety of communications tools and the collaborations tools create in this space for monitoring and and for ingestion, I’d say get ahead of it now, understand what it is, and be ready because, you know, while we might not see, you know, active enforcement in the next, you know, few years as these things develop, you will see it. Right? The the off channel communications thing percolated for many years before they came out with, you know you know, enforcement actions like we haven’t seen before. So I would say just stay on top of it, understand it now, and start putting your compliance mechanisms in place so that you’re not playing catch up later. Great. And the last thing I would add, it just quickly is, you know, the possible is possible. Right? The tools are there. There are vendors building these, tools for, their customers, and there are institutions that have put together great controls. Anyways, awesome discussion. This has been Data You Can Defend, operationalize and trust at the point of ingestion. We are at the hour. It’s been a great conversation. So thank you, Therese, Dan, Tom, and everyone out there. Have a great day. Thanks all. Alright. Thanks a lot.