AI & Cybersecurity: Balancing Risk and Innovation with Jax Scott!

Welcome back to Simplifying Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And this week we're joined by combat veteran and vice president of cybersecurity at Pearson. Welcome to the show, Jack Scott.

Thank you, Aaron. Thank you, Cody. Excited to be here. Glad that Brawn finally got us all wrangled in together. I know that it was like a couple of attempts to get us all at the same time.

Absolutely. We're excited. I don't want to steal any of your thunder, so I'd just love to, you know, combat veteran, you do a lot on social media, you have a podcast, The Two Cyber Chicks. I'd love to just kind of hear your story and get us oriented to the JAX story, and then we'll dive right into a few cool topics.

Yeah. So the other day, funny, so Saturday was like last weekend. I was hanging out with some new friends. I just recently moved to North Carolina for work, been here about a year. And I forget how unique my story is. Like somebody, this woman, she was just floating in the pool. She's retired attorney. And she's like, have you always been in technology? And I was like, no. And she's like, okay, so explain. And then I'm like, wow, how do I explain the journey? And so I just gave her kind of high-level points. I'm like, well, initially I had my own business at like 19 years old. I sold perfume. Then I joined the military when I was like 20 years old. I then went into the special operations. That's when I got into like doing actual intelligence and electronic warfare operations. But I was doing my job at the time was IT, but I never actually really did per se IT in the conventional way.

Was that what was on the office door to kind of be behind the cloak? Yeah. Yeah.

SOF is really unique. Special Ops is really unique. They don't— what I loved about it, because I got out a few years ago, is that you may have a particular job that you go to like school for, but if they know that you're specialized in other things, maybe you're studying AI on the side, or you may be, you're electrical engineer, whatever that is, they're gonna utilize those skills when you're on deployment. And that's what makes them so unique. Yeah, they wanna really utilize the person and who you are. So I started doing electronic warfare and doing all these things. While at the same time I had my own defense contracting firm and I had my own firearms license and I was running like a, and we'll probably talk about this, like I had a company in the defense industrial base and so I had a defense firm, but I still wasn't really in cybersecurity.

Yeah.

I didn't actually break into like cybersecurity until 2019. So like fast forwarding, I got picked up for mobilization with the special ops to support this mission. It's called, um, Atlantic Resolve. And you go out and you support like the European mission and create alliances. And at that time, we didn't have the Ukraine war happening. And I think you couldn't really do electronic warfare in that country because you didn't have the appropriate permissions and authority. So they were like, well, you need to figure something else out. So I was like, well, I guess I'll do this thing cyber, 'cause I had the understanding of technology. I'd been in IT for about a decade and a half at that time. So I started researching and I started realizing that there was this whole world of cybersecurity. And at that point, I started doing, 'cause I was in country, I'm like, what can I do? So I started doing strategy, cyber strategy with NATO and other NATO partners and really helping them build out what that looked like. But then I started leveraging my intel background and I started falling into OSINT. And then from there, I landed my first job working for Mandiant. And it really took off from there. I started to get, I got my master's. That's when I really dove into writing a book about it, 'cause I was just hungry to learn. So pretty much from like 19 to where I'm at today, I went from like Mandiant, I worked at Capital One in a SOC for a while. I then worked as a consultant for a couple of years. And if you guys have worked as consultants, that is like a fire hose of just learning. And then from there, I got the opportunity to become the VP of Pearson to run the business information security team. And It's essentially, we're composed of BISOs, if you're familiar with BISOs, like many CISOs. Yeah, business information security officers. So I have these like highly technical people and we sit in security, but we work within all of the divisions in the various different businesses. So it's been a literal whirlwind to get to where I'm at. And I never once thought, oh, I wanna do cybersecurity. Like it, it wasn't like a, a dream to get here, but it was something that I just kept getting pulled into. And then I finally was like, I should really like see what's in this space. And then my curiosity opened up in 2019.

Yeah, I love that. Wow. I would love to know. And actually, this is not a topic we were planning to talk about, but BSOs have been around for a bit. And I've seen, especially on the consulting side of the table, after, you know, 17+ years on the corporate side, there's so many different versions of what BSO means to a company. So, as you lead that group, I'm curious, like, how do you define that? How do you get to business value and how do you help your group really conquer that each, each department or function that they represent?

Such a great question because this has been my, like, lifeblood for the last year and a half working at Pearson. It literally, when I first got there, we were called Posture Management, which is a coin term by Microsoft. And it's to manage the posture of your organization, the technology posture, the security posture. But a lot of people didn't understand.

But at least sitting up a little straighter now.

That's exactly what people would do. They were like, is this yoga? Like, and so right then I'm like, I have to rebrand. So, I realized you guys are BISOs. This is essentially what you're doing. And so, to your question of like, how did I like really communicate that? It's been a journey. It started with roadshows. But as you guys are both aware, not every— you can say the same words to one group of people and say the same thing to another group of people and they're not going to understand it. So it's been a journey again. But what I will say is I've learned a lot as far as what I say and then what my team does. And so teaching my team what the role of a BSO is, is really critical. But then the communication piece was around using things that they know, like technology PM. That's one thing I use, or I say mini CISO. Like, these individuals are mini CISOs. They're not doing the work, but they're managing the work. Technical PMs also. I don't love that, but that sometimes can get them connected. But I think where it really started to shift and change is where I started refreshing my team with new talent and then getting my team to think differently, reframing themselves in the role. I actually had them read a book to, to help them understand what it was to be a leader. 'Cause I think as a BSO, you need to understand you have authority in that role. And even if you're a senior manager, your authority is a BSO and it's getting in there and learning how to develop those relationships. And I think once the team started really truly understanding and grasping that, I can talk till I'm blue in the face, but if they're not operating at that level, that was the challenge. And then they started operating at that level and have been, and now it's starting to finally shift and people are starting to understand how to use BISOs, and essentially they're a single point of contact. That's what I explained. They're a single point of contact for you all if you're at the business level to go to a BISO if you have any challenges with, say, compliance or a new regulation coming out. You essentially can come to the BISO and say, hey, I've got this, what do I do? Help me.

They—

and they're the glue. They don't do the work, but they connect you with the people, they get things going, they get the ball going, and they make sure things get implemented on time, processes are in place, and they, they problem solve for you essentially.

Yeah, I'm curious, when you rebuilt the team, or you mentioned up front that there's a lot of technical people and technical PMs, did you diversify that skill set? Because I think at the BISO level sometimes, and in general in cybersecurity historically, uh, individuals have come up through infrastructure or tech, and I think we've started to see more diversity of thought and all sorts of types, but like some of the best BSOs that I recruited came from business areas and then they fell in love with security. And actually was just talking with one of them a couple of weeks ago. That was probably one of the more successful ones that just really understood the business but got into topics like InfoClass and, you know, secure handling and insider threat. So curious on your thoughts on that and what makes a good BSO.

Nailing it, Aaron. Just this week, I think it was this week or this last week, everything kind of blends together. I was having a conversation with one of my VCs I'm mentoring. He is a technical individual. And so, his first response when something happens is, I'm going to go fix it versus I'm going to train them, I'm going to teach them, they're going to fix it, I'm going to provide oversight. And he and I were talking and I said, you know what the challenge is here is that you know how to fix it. If you and I were in a different role, I wouldn't know how to fix it. So I would have to leverage connecting people, talking to people, getting this, like managing this better, more effectively as a BISO because that's, you don't have to be technical. You need to understand security. Primarily, you really need to understand risk management because that's one of the primary roles of a BISO is understanding risk management. Because that glues everything together. But what I've noticed is that when they're technical, their first instinct is immediately to go and fix it. But when you're not technical, you have to problem solve. And so I think one of the most critical skills for a BSO to have is critical thinking. Interpersonal skills are great, but you've got to be a critical thinker. You've got to be able to problem solve. You've got to be able to ask the right questions to be able to drive things and get them done on time and effectively. And in this essentially be that enabler for that business. Yeah.

No, that's great.

Yeah, I agree. I was telling Erin this maybe, but I was at a, it's like kind of like meetup group where it was a PE firm that was in town and asking questions of some local leaders. And I mentioned BSO just in like passing and they were like, well, hold on, wait, what was that? What is the BSO? While we know it, I didn't realize that it's still not a very common thing outside of like large enterprise. And this is like mid-market and maybe some of the SMB type stuff. But to your point, I think you said posture management, then technical PM. But I think even as we know BSO matures, it's still relatively new to a lot of markets outside of large enterprise.

Yeah. So maybe let's, let's double-click on kind of— you mentioned the soft skills, the critical thinking. What about emotional intelligence and kind of that versus data and technical claims? Both are important in winning over decision makers, but when you're dealing with the business as a BISO or maybe broadening it as a cyber leader, what are some of the skills that our listeners can pick up that maybe aren't in their conventional tool belt?

Hmm. Yeah. One thing I've noticed working with— because I mean, I've got an individual, I think he's been doing cybersecurity for 50 years. So like, I don't have, I don't have any Gen Zs on my team because visas, you've got to have at least a good amount of experience, 8 to 10 years preferably. Like I need you in the, it's not an entry-level role typically. I know they're doing like junior visa roles now. So what I have found is that you get these individuals that have really high IQs, but their EQ is maybe not as high. And one of the key things that I've seen challenges with is being able to understand the business unit situation. I think as security leaders, I think it's important to have empathy and understanding of what the business unit is trying to strive and do and not just mandate things to get done. Now, I understand there's frustration when you ask for something, you ask for certain plans, DR plans, or these things to get done, and there's a policy and it hasn't been done, you've told them and they've given them time, like that's a whole other thing. I think for, to be successful, you've gotta develop relationships, be empathetic, be understanding and ask questions, hold space. And one of the things I actually told one of my bisos today who was having a challenge with somebody else in security, but they were trying to do something that would impact a business. I said, let's not try to be right, let's try to win. And your role is to consult. Like on the RACI chart, we are the Cs. We are there to consult and to guide. If somebody wants to push back and still do something else, that's fine. We recognize that. We'll support it. They will own the risk. We will let them know there's a risk. We will provide the guidance and then we will sit back. And then if it goes awry and it turns into— Who is that? You know, a disaster. We will be there to help guide you. But I feel like in my team, you get these technical experts who are like, but that's not right. It needs to be done this way. It's very black and white. Why isn't this done? And it's trying to get them to shift their mindset to more of like a consultant mindset, like a helper. Let me be there to help you. Let me guide you, but I'm not doing the work.

I formulated a catchphrase when I was in my second role of my career in corporate audit, and it sounds boring, but I got to travel the world, loved it. Cultural learnings.

That's fun.

But the phrase was, you, and obviously in audit you're finding problems, right? You're not there to suggest things. You have to be independent from that. So there's an angle of the job that I really enjoy what I'm doing now versus that. But the phrase that I kind of was using a lot is you can do anything in business pretty much that you want as long as you have the right controls. So I think Jax, as you're talking about finding the right way to the answer, there's always a way to the answer. It just might not be the first thing that comes to mind or the way that has zero control that they don't want to do.

Yeah. So also, Jax, I want to hear your opinion on this here. Thinking of BSOs in large enterprise, but for those who don't have a BSO, haven't gotten to that level yet, what are like some like practical tweaks that can help reframe security spend from like pure cost to tangible business value? So the BSO does that, that's kind of their inherent role, but without that, what are some like practical tweaks you think that CISOs and InfoSec leaders can, can use there?

I mean, one of the first things that come to my mind for spend, because I know this is what we're pushing and a lot of organizations are pushing this right now, is leaning into and learning a GenAI. Like it's becoming one of our OKRs for next year.

Yeah.

And one of our goals this year is, and I think this can be done at any size, is like We're trying to bring in more resources by people that we maybe have in roles that we can either upskill, move on, shift around, and then bring in additional personnel because we've been able to replace those roles by streamlining the process, by bringing in Agentic AI to help streamline what we're doing. I think that is imperative for organizations to lean into this. Like if you haven't already started, leveraging and understanding AI agents, you're already behind. So I think that is a really critical point for the budget piece. And you asked another point and I should have wrote it down, but I forgot it. What was the other point of that?

Just like kind of practical tweaks there. So like I think sometimes, you know, the BISO's job is to learn the business. And I think sometimes in InfoSec, there's not that connection. So for those who don't have a BISO, what are some other tweaks to help reframe just security spend to kind of tangible business value?

Hmm, that's a good question. For— and I'm like thinking from the smaller business side, I think it's relationship-driven. I think that especially from the smaller side, take the time to meet regularly. Like we meet once a month with the CTOs, which are the risk owners of each of the divisions. I mean, Pearson's 180 years old. We're massive. We are so unbelievably massive with all the businesses that we have. So, once a month, we meet with them. We understand their space. So, I think for a smaller business, understand those risks, meet with your stakeholders, provide them maybe a monthly, biweekly call where you go over what is their spend, what do they have. Something that we've been doing is fraud transactions. That's a huge area that's being impacted. Maybe you're having that, meet with your stakeholders, how can you put in, maybe AWS tools and controls in place to help draw down some of that expenditure, identify their findings, meet with them, give them plans, next steps on how they can address those, all those things are a cost. So if you can help them reduce their overhead while also supporting them in the business, that's a win-win. That's essentially, like you said, that's essentially what the BSOs do on a regular basis. We meet with them, we show them what their risk base is. I think Risk management and risk assessment is a critical piece to this 'cause you have to understand the environment, and through that, I think mitigations, using, oh, using native tools, that's another thing that you can do. A lot of times you try to buy tools externally. Stop and take a moment and look at what you already have in your environment.

Yes.

See what you have and be able to either use the free tools that you have. I found out just yesterday because I'm helping stand up a fraud program, is that AWS has a native tool to help with some fraud transactions. We're multi-cloud, so that won't entirely fix our problem, but maybe that'll help offset some of the costs. And that's what smaller organizations can do is look at what the tools you're using now. Microsoft has a ton of security features that people don't know about. See how you can expand on those versus just bringing in another vendor.

Yeah, well, and kind of in that same vein, I mean, you mentioned, you know, AI earlier, which is obviously like on everyone's mind or should be. But like, as, as though you have a lot of, you know, as AI tools kind of flood this GRC space, how do you decide which compliance processes should be automated versus those that should remain human-led?

Where on the hype curve are you, Jack?

Yeah, that's—

oh my gosh, Erica's going to love this, my co-host of Two Cyber Chicks, because we literally talked about this, her and I, on one of our episodes. And she's like anti-AI completely. Completely, where I'm like on the fence. Yeah. She's like anti as far as like doing reports and stuff, completely anti. Are you guys for it a little bit? Like automation?

We're leaning in. We're leaning in. And to me, as cyber practitioners, like the business is going to go with or without you. And the few companies, probably the far too many companies that are just blocking it, it's just squishing the problem somewhere else to a mobile device or whatever. I don't think any cyber practitioner has the— I mean, you can avoid it, but to me, you want to understand it, even if you still think it's scary. Like, what can you do to enable something in a non-scary way that will help you ease those concerns? And then back to my young Aaron catchphrase of like, you can do anything in business you want with the right controls. Let's figure out those controls. We have to.

Yeah. Well, and my thing is like, you know, spaghetti against the wall, throw and see what sticks. Because otherwise I don't want to burn cycles on if it's not valuable, but it's almost like chicken or egg, right? I got to see what's valuable first. And then if it's valuable, is it worth the controls around it? But then sometimes you got to have some controls to Aaron's point to then test the value. But I'm very aggressive on it. Not so much. I think it should be everywhere, but I think we got to kind of test and see where it's valuable, then where it is focused there, hit those points where it's not, let it sit for a couple of years until it matures or someone else establishes the value. But I mean, I do Aaron's point. I think it's going to go there regardless. I think you mentioned earlier, if you're not looking into it, you're behind, but there is that like kind of testing ground. What's a safe testing ground? And we see a lot of clients right now that have like massive POC environments and they're just like almost backlogged because I think to your other point about looking at all the tools, I often see people that don't define success up front. So then when they get in these demos, they're sold by anything because it's like, well, I had 2 problems. I got in the demo and now I'm going to go solve 15 problems. And you're like, well, you forgot you set out to set 2.

So Jax is a fellow podcast co-host. I love how you turned that question around on Cody and I to see how we're feeling. Oh, I totally did. Love it.

Yeah, you guys like that?

Let's turn it back. And then I want to come back to what Cody just brought up with the vendors kind of overselling their capabilities because that's a whole different stream of thought that we need to unpack.

That's a whole bag of worms. Okay, so AI at a high level, it's an enabler and a risk. You know, I think the things— I think you should automate some of it, like the initial mapping, the initial— when you're initially going into an environment, you need to initially map, get the evidence collection, things like that. I think you can automate that process because that's so manual. Oh my God, depending on the size of the organization, I remember doing assessment, it just took, I mean, weeks sometimes to get all of the evidence. If you could automate that, like even to automate and get it into folders to be able to sort where the policies were, this or that, that would be immensely helpful. I think that can be automated. I think that you need the human element when you're getting into the intrinsic information that is about the business that I don't know that AI can really dig into yet. I do think that we're going to get into a space in the next 3 to 5 years after we've tweaked these machine models. 'cause it's just too new right now. I think we can get there, but I don't think like judgment calls should be. I think you need to have a human there to be able to look through what those final scores are. I think that you need to have it for ethics and accountability still. I think that may never go away 'cause that would be scary if we have machines running all of this and we've just negated that portion. And then it back to, I think there's that element. I was actually talking to a friend about this today of like, the human element. If we let machines do everything, you're not gonna have that relationship building that you get when you're doing these assessments. And I think people forget about that. They're very laborious, but there's also a lot of relationships that you get trust in the, like being able to build trust with the regulators and the auditors, even though internal audit can be a pain sometimes, you build relationships through doing these assessments, through reviewing them. Working with the business leaders to address them. So I think that's also part of it as well.

Yeah. What about, so beyond the relationship, what about the education piece? I mean, how much education is required and like knowing the backend logic so you can automate a lot of things. And I think we're kind of in that void of like, we still did the manual way and this may sound like I'm, when I was a kid, you know, type thing. But, you know, to your point about like it's automated, but then the logic and evolving and educating and the relationship, you lose that part. You kind of become stuck and siloed and then you don't have the ability to kind of mature because you've, you're kind of relying on a machine or AI to do too much of the work.

Are you saying we're going to all become dumber and dumber? I think that was the point of the movie.

Yes, they're proving that.

They're proving that. Have you all read the MIT article that came out?

I have not yet.

Oh my gosh.

So there was the one on 95% of corporate AI projects, the big ones are failures. But then the byline was like all the skunkwork stuff is like blowing up and successful. Was there another one on the Becoming Dumber?

So like, yeah, and I just read it and then I watched a podcast. So I'll give you like the, the wavelength of it. Essentially, they did the report and they had, I think it was 50+ people were in this research study and one group couldn't have any tools. One could have Google, one had AI, and they tested your brain and how it functioned depending on what you were supposed to do. You're supposed to write a report essentially. What they notice is the individuals that didn't have any tools, they just had books and stuff, their brains lit up. Their critical thinking was so engaged. When they went to Google, it was still there, but it would drop substantially, but it was still there. And then the third one, it was not present at all. Not at all. And then the other thing that they found out is when they asked them, hey, can you tell us about what you wrote? The people that wrote the ChatGPT stuff, felt disconnected, couldn't remember what they wrote, didn't even feel like it was part of them. And the people that didn't have any tools at all could like cite their research, cite their papers. So it's like if we automate everything, we are essentially becoming dumber. We are becoming dumber because now we're not critically thinking in the ways that we need to.

I just watched—

so maybe it's like everything else in life. It's a balance. How do we find that balance between pushing ourselves further, just like the internet when it first came out, right? Like, oh, well, you can get all your answers on the internet. You're not going to the encyclopedia. Who has encyclopedias now? We've evolved.

Yeah, well, the other day I watched with my 7-year-old, I watched, uh, WALL-E on Disney. Yeah, man, in the end of WALL-E, it's like you see like these like humans on this like planet and they're fully automated.

Like, they get carried, they get everything's food, and then they're so overweight, they're on like—

yeah, it is. And I was like, that was crazy years ago. Now I'm like This is kind of wild.

Look at the Jetsons. Go back to the '60s and like George Jetson had one button to push and that was his job, right? Like, yeah, I forgot about that one.

George Jetson. Yeah, that's a blast in the past right there. Oh my God.

So Jax, from your perspective, you're at Pearson, you're probably managing AI risk and benefits and leaning into it and providing guidance through the BSOs of areas that are too far off the rails. How, how do you guide your teams or your business through resistance and the, like we were talking about, the over-enthusiasm? Because those are two extremes and people can be over-enthusiastic and do some bad things, or they can be resistant and miss some opportunities. So how are you helping the balance? How are you helping strike that balance within your business base?

We— so we're building out a risk— AI risk program. We have it, but it needs— we need more people. You know, that is— we need more resources.

No one ever says that.

It's challenging right now because we're a global company. People can create agents. We don't want to hinder people, but we've also provided guidance. We've provided SOPs. We've tried to control some of the agents that are coming out. For the security reasons. But there is a level of like, how much do we try to protect our org without also impeding the growth and being able to use these tools? To your point, Aaron, of being able to create more streamlining automation of like workflows and increasing— I think they said proper use of AI, you can increase your effectiveness by 50%. So we don't want to impact that. We have internal programs that we use that are specific to us, like PAAIC is one of them, P-A-A-I-C, and it's what we use. So we have internal tools to our organization that help us with graphics and video and stuff like that. So it keeps, keeps people internal without trying to go external and use various different tools. I think that does a great job with reducing a lot of the risk because you're giving them tools. We use Copilot a lot and, you know, You guys have all seen the memes. It's getting better. But man, when I started using it a year and a half ago, holy moly. I think the only thing it was good at was doing the meeting minutes, literally. But I'm noticing it's getting immensely better now with summarizing meeting notes. And even I went into Copilot just this week and I said, hey, summarize what— I was out of the office on Thursday and Friday. So on Monday I said, summarize what I missed on Thursday and Friday and give me a list of tasks. It actually did a pretty decent job. So I think for us it's that education piece for the BISOs, like educating what is capable, teaching people the safety and why we need to be safe and using these tools and what it means about copying, like doing a Ctrl+A, Ctrl+C and then Ctrl+V into ChatGPT. Why is that bad? Why? Where does this information go? Because I think people just don't know. I truly try to always say I think people are trying to do the best they can, but I don't think people are trying to leak. They're trying to just make their jobs easier. And so I think there's an— there's that. And I have recently, actually just today, I told my team, spend time on GenTech AI. I need you all to start spending time on it, build agents, learn it, because we can't teach it if we don't understand it. So that's what I've been really— I've been teaching myself how to do it because there's an education piece, and I think there's a fear around it too. So we need to educate, teach, and just get out and use it, learn how to use it. Yeah.

No, that's great. And you can start even before you get into some of the more complex Agentic, just writing queries and setting schedules and like threat reports. Probably the earliest cyber, like do a threat report on a specific client or an internal business unit or an acquisition target. A lot of really cool stuff. And just having that pop up at 8:00 AM, but that's not even Agentic, that's just scheduled prompting, right? So you can go even further once you do the basics, but starting small and then expanding is the way to go.

Yeah, and I don't know if you want to hear a thing, this is a total pivot here from AI, but in our pre-podcast meeting, Jax, you had some great knowledge I wanted to make sure we can get this on and get to our viewers. But like, in regulation-rich industries, how do you adapt incident response plans to unpredictable rule changes? So we were discussing the rule changes in reporting and everything, but kind of talk to us now about like some of how that like is shifting and what it means for, for a lot of big firms?

Oh my gosh. Yeah. If somebody can figure this out, man, you'll be a billionaire to like figure out a technology to help with this. It's volatile. Like it's super volatile. We have a Provision 29 coming out right now. It'll be enacted in January and it's affecting UK businesses. And essentially we're a UK business even though we have a headquarters in the US here in Durham and It has disaster recovery, which is part of incident response. You know, after the boom goes off, we've got to go into the disaster recovery. And so, you've got to have all your applications with a DR plan essentially done so they can do random testing come 2026. And that takes a lot of work. And part of that, I think, for the incident response—

Yeah.

—and disaster recovery, it is going to always be changing. I think we're going to see more and more changes, especially with the emergence of AI and more threats that are coming out, I think that we need to find ways to build flexibility into our plans. I think we need to do more testing. Like, we're implementing more tabletop exercises. Yeah. Provision 29 is actually, not only do you have to have a DR plan, but you have to test that. So being able to test, what are you gonna do? Who are you gonna call? Not Ghostbusters. But like, literally. People don't have cell phone numbers. What if your Teams and everything gets knocked off and all your high-value assets are down? You don't, you can't get into computers. Do you have your help desk number on your computer somewhere, like saved on your phone? Do you have your boss's phone number? Do you, like how, like working through that I think is really critical for that flexibility piece. And then, if possible, have somebody on the team that that is their, one of their jobs is they're forward-looking at what provisions are going to be coming out. How can we address them? Like these provisions when they come out aren't brand new. They've been talked about, like CMMC, they've been talked about for years. And then it's like Provision 29 is coming out and then you do research and you're like, oh, this has been talked about for a couple of years. This isn't news. Yeah. I think that's really important. It's just being forward-thinking and having somebody, because there's a, Cody, you know, there's so much information. How are you supposed to keep up with all of it? Well, you're the exact point.

And there's always like leverage third parties and tools. And so even the plans, right? The contact sheet may be different or the, you know, the company it was last year was this tool. Now it's this tool. And my incident response plan, while it may be for one company, it may have 15 parties that need to be alerted to be convened in the thing. And so that's the hard part is like, I think sometimes they do the minimum once a year test. But I think of like, if I go on a cruise ship or hop on an airplane, they do the safety thing every single time. And so it's like, it is a wild amount of testing. And sometimes companies do it once a year and, ah, we'll do some changes to it. But so much changes in that course of the year that if you don't do it at least annually, chances are every 3 to 6 months your IR plan's out of date. Yeah. Shooting from the hip for sure.

So I know we wanted to talk a little bit about CMMC and JAX coming out of the military and being, you know, on the other side of the DOD and the various government agencies. How has CMMC shaped up for you? I know it's a long time in the coming. Are in the making. Where are we and what's your— are you leaning into this?

I have a CMMC shirt. I actually should have worn it that Jacob Horn had created during one of his talks many years ago because CMMC has been going on for that long. I was like one of the first adopters. Pretty proud of that. I actually became like a CMMC RP or whatever it was called back. I feel like literally it was a decade ago, but it was only like a few years ago when it really got rolled out with the CMMC AB and all that.

And the 5-level days or 3-level days?

Oh God, yes. Yes. Like I was in it. I did the class. Oh geez. There we go. That's what I did for like 7 months. And then I'm like, this is not going anywhere. This is like 20— what was it? 2020, 2021. I'm like, this isn't going anywhere. I need to get a real job. And I will tell you that I support where it's going. We're in corporate sector. It'll impact segments of us, but it won't impact like our entire organization. But where it's interesting is that these smaller organizations that have been just self-attestation, um, especially ones that need Level 2 and 3 now, that are like, oh my gosh, this is going to cost so much money. I think the big point that's really been pushed out is like, no, it shouldn't cost you any money because you should have been doing this all along. Like, again, what we were like on the other thing, these provisions are not new news. Many times they're already being enacted, but not like unofficially. So this is— Unenforced contracts, right? Correct. Yes. They've been in there. You've been checking that you've been doing these things. Now it's just being enforced because sometimes we're like toddlers. We have to like put a law and then enforce it or we're just not— we're just not going to do it because it is going to add a level of work and resources, extra controls, you know, the 171s, 172s, I think, if I remember all the frameworks, uh, NIST frameworks that you've gotta do. It's just extra work. It's extra this. It is extra money. You've gotta get certified. We don't like to do it, but I'm happy because being in the military, and I still serve, I'm in the reserves now, and I still see, and I'm still connected, and I still see how some areas we can be super insecure with our supply chain. And CMMC is intended, I think, very positive for our defense industrial base to secure our critical infrastructures and be able to bring security through protecting our suppliers and our vendors and everybody that's connected into us. We need that. I mean, you guys saw what came out recently. Remember, what was it with the China security people that were like—

Oh, the Microsoft thing? He has the Microsoft thing.

I was like, what general officer thought this was a good idea?

Like, well, well, that's just it to your point. Like everyone can know everything. So the process is what helps to like bring more people, more eyeballs in to like to get that validation. Otherwise you rely on one person to know it all. So you're, you're spot on.

Well, and Jax, I'll go back to your comment of like, it shouldn't cost a lot if they've been doing things along the way. We leaned into it, got, got a company RPO. We had some, consultants that got trained as the, I think, the registered practitioner portion, which sounds like maybe what you got. And 3 years ago there was some momentum. And then when it started to fall apart, everyone was kind of like, well, pencils down, let's wait and see. Who knows what this is going to be? So I feel like we've— the country as a whole and the DIB has lost a lot of momentum. Yeah. Now it's picking back up. But you know what I, what I fear won't be bad for consultants and those that can help, but it's like we're going to throw a bunch of Hail Marys. There's a lot of work to be done. Really quick. And that's not— we've done that beyond this space, like in healthcare as well. And that's not the way to build a sustainable cyber program. You burn people out, you get so much done, and then it falls apart and you have to put it back together again. So I would rather not take a Hail Mary check, which are big checks, and do something in graduated steps over time. 'cause you're going to feel better about the product. It's going to be less painful and the businesses are going to hate you for it.

Well, and Jackson, I think— Go ahead.

Did you all have a significant cost with doing your CMMC yourselves, like getting it all done and getting it certified? Did you find, did you have to get level 2 certified?

So since we weren't, I think the C3POs had to do the full certification since we were just doing the program building and consulting side. We had to pay the company fee, which was I think $5,000, and then individual fees for training. So it wasn't as crazy as kind of the full, but we also weren't storing CUI as part of it. We work in the customer's environment and very intentionally so. Yeah.

Jax, one thing I wanted to mention that I think you talked about earlier was like even when you have like unlimited, say, you know, budget and people resources, to Eric's point, the organization can only absorb so much change in a given time. And so I think to your point, these aren't new, but we waited for so long and like even with the amount of money you try and throw at it, it's still going to be hard to hit this mark within people not burning out or trying to sustain it. So I would totally agree there.

All right. Well, maybe one last question and then Cody, you have a special question that you always ask all of our guests. So I'll keep that in suspense and let you ask that here in a bit. But maybe kind of going back to the BISO front and kind of the business side, How do you keep your teams agile and committed, especially when change fatigue— we talked earlier about budget reductions and IT or cyber being a cost center, new technology coming on. Like, what is your best way to keep people's hearts and minds focused on that mission?

Motivational speeches, really, as a leader. Half-time talks? You got to talk to your team. And you got to tell them when it sucks, it sucks and be okay with admitting that to be frank, because sometimes it just sucks and it's okay. Be real. I am very much a real leader and we have our ups and we have our downs and I ride the wave both ways and I'm with them when it's down and I'm with them when it's up. But my goal is always to let's provide a way out of this down. Like right now we're getting hit with a lot of last last-minute requests, and it's kind of been continuous, and I've been trying to figure out a way of reducing that, because it is really fatiguing all of us. We're exhausted. And it's requests that are very time-consuming, but need to be done, like in a really short, short period of time, multiple at a time, not just one. It's like multiple. So it's like, how do we resolve this? How do we fix this? So as a leader, my goal is, I need to make their lives as less stressful as possible. I need to reduce the chaos and noise as much as possible. And I got to be real with them. Like, if, if we're not operating at the level we need to be, then we need to get to that level. But I also have empathy. So if we're not operating at that level, is it because we're tired and burnt out? Okay, then I'm going to hold space that we're probably just going to be at that level right now, but we're going to get out of that because I'm going to put things in place to get us out of that. But everybody has to own it. Because it's a, it's a complete team effort. So for me, it really is having one-on-ones with my team, understanding where they're at. If things are not getting done and we're getting drained, figure out why. Maybe there's personal reasons. Address those. Everything's a phase and then be patient and then push through it and talk to them. But you do. I think as a good leader, you got to motivate your team. You got to talk to them. And it's not just the rah-rah-ree, it's being real with them.

Yeah, I like that. I like it a lot.

Transparency and authenticity goes a long way.

Yeah. Yeah.

All right, Jax, are you ready for this question? You have no idea this question is— I mean, this is crazy. I mean, Aaron, get a little hype. Okay, here it comes. Okay. So, all right, if this is a new audience, so for— give us one fact about Jax that no one would probably know about you from just maybe the interwebs or the general, but we've got like a fun fact or Give us a fun Jax fact.

Okay. Okay, it's a little weird, but it's okay.

Everybody seems to like weird. I like weird.

I don't know if it's that weird. I moved out of my parents' house at like 17, and that's important because ever since I moved out, and I'm in my early 40s now, I've never owned a TV ever. I have no— I've never— people have given me TVs. I've sold them. I have no TV in my place here. Never. So I haven't literally had a TV in over 20 years.

That's pretty cool. That's pretty cool. I think. Yeah, very cool. Bronwyn, you know, on our team, a superstar. I think the other day we were talking, she said the exact same thing and I was like, no way. But she did.

So that's, that is amazing. It's interesting dating because people that have TVs like to play it in the background or like to have just whatever. And it really like messes with me.

Jarring for you?

Yes. And so I'm like, I don't know how this is gonna work. Like, because they'll come into my place and be like, wow, it's so quiet and calm. And I have Alexa playing like calming lo-fi beats in the other room. Now we're talking. It's very low. Yeah, yeah. I just think, I think you need to be, um, cognizant of what you're putting in. And I think you need to filter it. And the only way you can do that is having control and not having your TV just blaring. I think, I think watching movies are fun though, occasionally. So I do it sometimes on my iPad.

Oh, okay. I was gonna say, how do you watch it? Do you go out to like a little movie theater and get some popcorn and nachos?

Or— don't ever, Cody, ever ask me a question about anything pop culture though. I will not. I will have no idea who the actor is, what movie it was. I can't quote anything. I think Bronwyn did a, uh, like LinkedIn post today or the other day about like even song quotes. No clue. No clue.

We've got a gentleman on our team that knows 3 movies and literally you'd be in good company because he has not seen any movies. He'll know who he is when he hears this.

That's awesome. That's awesome. Well, Jax, thank you. This is— this has been phenomenal. Excellent time hearing your story. Super, super. Just, you know, really cool. So, Aaron, I'll let you wrap us up. No, thanks for coming, Jax.

Appreciate it. Thanks for your service in the military and your continued service on the reserves and giving back to cyber and getting your voice out there. And Cody and I follow you. We'll continue to do that and we will talk soon. Thank you, Cody.

Thanks, Aaron. Bronwyn!