Crocodiles in the Board Room, and Other Cybersecurity Stories with Andy Ellis

Awesome. Well, welcome to a special episode of Simplifying Cyber. I'm your host, Cody Rivers.

And I'm Bronwyn Hudson.

Excellent. And we are ecstatic today to welcome Andy Ellis, a principal at Duhop Consulting, author of 1% Leadership, and just a legendary CISO. Welcome, Andy.

Thanks, Cody, Bronwyn. Really excited to be here today.

Likewise, we've got a great kind of topic set up for us to chat today, and we're super excited. You know, we've not had the chance to meet yet officially, so Brahman speaks super highly of you, and I read a little bit about you before, before our podcast, and just really excited, man, to hear your story and everything. So give us a little bit of your background and let's, let's hear about the Andiela story. Sure.

So I'm going to go backwards. I just came out of being a venture capitalist. I was a first operating partner and then a partner at YL Ventures, which does Israeli seed stage cybersecurity investing. You might have just heard about one of our companies, one of my early investments, Aim Security, just got acquired. Fantastic outcome. Yeah, I'm really excited when companies that I got to be like there at the ground stage providing that value-add advising turn out really well. Mostly it means they probably didn't listen to me as much and, you know, succeeded well. Matan is great at having his own vision, but I'll take some credit for it. So that's what I've done for the last 4 years. Before that, I was at Akamai. So I was Akamai's first security hire, first CSO, acting CTO when we were building out the web security products. I sort of got to do a startup within a large company of taking an infrastructure business and creating a multi-billion-dollar security business inside it. I was there 20 years. Before that, I was in the US Air Force. I did information warfare. So one of the things I love doing when I'm talking with Israeli startups and everybody says, oh, I was in 8200, or I was in Talpiot, or I was in 81, I'm like, yeah, I was doing that last millennium for the US Air Force. We just called it information warfare instead of cybersecurity. So that's sort of the brief thing. I have some really crazy accolades I like to point out. For anybody who remembers seeing the movie Fast Times at Ridgemont High, that was set at the Sherman Oaks Galleria. And I am the winner of the Sherman Oaks Galleria spelling bee.

What?

So rad. Do you happen to remember your winning word?

Um, I don't remember exactly the winning word, um, because we went back and forth for a while because the spelling team for the, the school I went to, we took first, second, and sixth place.

Awesome.

So it's, it's really funny as somebody who did a lot of spelling. I remember the spelling bees that I lost on. I remember the word varicose. I just, I said V-E and then my brain was like, what are you doing? Bullshit, too late, you're out. Um, but all the ones I won on, I don't remember, but I remember like having fun because my My spelling teacher was Canadian. So anytime I had a word with a Z in it, I would say Zed. And you could watch the judges were like, what is this letter? And my teacher was all excited.

Amazing. Great story. When you remember the word, I do want to know it though. That seems—

Yeah, I got to see if I can remember. I don't, I don't really want to say how many decades ago that was, but it was a lot more than one, more than one letter, more than one. Actually, I'd say it was, it was one, a millennia ago.

There you go. Excellent. Excellent way of saying that.

That's kind of a flex.

Well, very cool. So kind of my thought here today, again, with your just like awesome background and talking about CISOs, and I think Brahman and I were talking even like the evolution of the CISO. Not only is it just a new role, you know, and within the past couple decades, but it's evolving so quickly, I think, from a skill set, from a coverage, you know, liability trade standpoint. So kind of talk to us, you know, kind of give me your thoughts on being a very decorated CISO, what your thoughts are on the the CISO of 10 years or 10, 20 years ago to how it's kind of come today?

So absolutely, it's a very different job now than it used to be, but I think that also tells us where it's going. The only reason CISOs exist is because CIOs functionally work for the CFO. And so if you go back 20, 25 years, CIOs were a major cost center for businesses and IT was not really seen as a huge value add. It's just this thing we had to have. And so CIOs, whether they direct line to the CFO or not, the CFO was their mandate, was how do you cut costs? So they became the personification of the 80/20 rule. How do I solve 80% of the problem with 20% of the budget? And so innovation for most companies was not done by the CIO. There are exceptions, and I know some fantastic CIOs who really were CTOs in that role, but in most places they basically were a support function. And someone said, hey, there's this web thing. I bet we could make money on it. It's usually an engineer. And they built an e-commerce site. And the whole point of the e-commerce site was like, hey, why do we have people calling up to book a hotel room when they could just do it on this web thing? And then somebody said, you know, that seems really dangerous. And that somebody was either in IT security or in engineering security, or maybe just in engineering. And that became your first security dedicated person who wasn't just doing help desk.

Yep.

And it was an awesome role, and that person became your first CISO. They were highly technical, they were— showed initiative, and their job was, I will cover every security problem that nobody else is paying attention to. And it's a cool role, a great place to be. That's not where CISOs come from anymore. CISOs are now coming from teams that have a CISO that have specialization. You don't have to be a polymath. You don't have to do everything. The challenge is a lot of companies still want that unicorn. They want somebody who does everything. I've seen these job descriptions. I've done, I do this, what I call the, the strategic CISO assessment, where a company will hire me to come in. They say, look, I've got a director of security, but they talk mumbo jumbo. I'm not sure if they're doing the right things. Can you just help me out? Right? It's this very fast, like less than a month, Come in, interview everybody, read all your current reports, and help uplevel somebody. But what I have found in talking with every executive there, they all want something different out of this, you know, CISO candidate that is not what that person thinks they do. All right, so I even wrote about that called the Idealized CISO. I wrote the job description. It's up on howtociso.com, free resource for CISOs or people who are going to be CISOs in the future. that lists like everything a CISO might be asked to do. And the challenge is almost nobody can do all of that anymore. And you really don't want to, like you want specialists who are good at each piece of this pie rather than somebody who's good at everything but not great at any one thing.

Yeah. Well, and that's a great comment about the CIO stuff too. And I'll probably kick it off with a provocative thought, which I think is probably a newer thing, which I want to hear your take on. Reporting structure, CISO under the CIO, CISO under the CFO, under compliance. What's the ideal reporting structure? I know that's probably relevant to the size of company, but what are your thoughts there?

So the first thing we have to ask is which roles do we actually need? Between the CISO, the CIO, and the CTO, we only need two of those jobs. So one of those does not need to exist. And the reason we have this debate is because the CISO is only half of a C-level executive. So we're trying to figure out where to put them. Like the answer is, if you have a C in front of your title, you should work for the CEO. There's no other way to answer that question. You're in the C-suite, which means you work for the CEO. If you don't work for the CEO and maybe you work for like the COO or president, like there are companies that do a weird split that way. That's okay. But if you're working for the CFO, You're probably not actually a C-level executive. You just have that title. If you work for the CIO, then you are the head of IT security. The CIO is really the CISO as part of their job. Now here's what I'm seeing in smaller companies. There's no CIO and there never will be because what do you need a CIO for? You don't own any applications. All of your corporate apps are in SaaS. So you need somebody to do procurement and somebody to do configuration. So I know a bunch of, of CISOs. They don't even have the CISO title yet, but IT works for them. That I think is going to be the wave of the future, is it will be a blended role that the non-innovation parts of the CIO role are just support, and that's going to be part of the security role. And it'll be this blended CIO, CISO that'll, you know, end up there. And they should be still reporting though to the CEO. But I think in a lot of companies are reporting to the CTO or the head of engineering.

I like that take. I've not heard that yet before, but I do like that. Now, in that same vein then, who— looking at who drives innovation, And then who's kind of looking at protecting the digital assets of the company? So, because to me, if you're CIO, CISO, CIO, that's still a kind of an internal conflict of when I balance innovation driving versus protect data, you know.

So I don't think there's a conflict there. And I think the fact that security people believe there's a conflict is part of why we have not been successful as a career field.

Okay. I like this. Say no to conflicts.

Your job as a security professional is really 3 things, but it comes down to only 1 that's important. Which is enable the business to make wiser risk choices. That's it. Your job is not to say no. Your job is to make sure that they are making the better choices because they're informed of risk, that the things that they have outboxed to you are taken care of. So that's your support role, is if they say, look, I don't want to have to deal with malware, and you're like, great, I'll take care of malware, here's the cost. And they're like, great, go do it. Okay, you have an execution role there. But your governance role has nothing to do with your execution role. Your governance role is when people are making decisions, do they understand the environment they make decisions in? I'll give you an example. Let's go back to when we were like not even kids. I'm going even further back. Like when we were wandering around the tundra, actually, let's go to the jungle instead, right? Way back, right? Everybody knew about jaguars. Right? And you're like, okay, great. We got to deal with jaguars. When the grass is moving in weird ways, everybody circle up, point your spears out because the jaguar might be coming.

Lock it down.

Lock it down. Okay. Unless you were in the Nile, you weren't worrying about crocodiles. Right? And the problem is too many security professionals today are basically running out into the forest in the savanna and say, watch out for crocodiles. You're not allowed to do anything because of crocodiles. And the rest of the business is like, Why should we listen to you? Instead, you should be the guy who's saying, look, we're migrating and what's coming up ahead of us is crocodiles. Let me give you the reports to make you believe and understand in crocodiles. My job is not to protect you from crocodiles. It's to make sure you're aware of crocodiles and that you believe in crocodiles when they're relevant.

I believe in crocodiles. I like this, man. This is—

but you don't have— but Bronwyn, you don't actually believe in crocodiles. You don't like check both ways for a crocodile. Like you've heard of it. You believe that they exist, but you don't believe that they're a risk to you.

Well, I can tell you in Indiana, when I go outside, the least of my worries is a crocodile in my front yard. So I can vouch for that.

That's appropriate. Like if I came to you and said, I want you to burn brain power worrying about crocodiles, you're going to say, I'm not going to talk to Andy ever again.

Andy needs to look for some help.

Or I would think that you were about to set a bunch of crocodiles loose.

That's true. That is definitely the sort of thing I would do. Many security professionals, let me prove that I am right by releasing crocodiles in the boardroom.

Yeah.

And right there, there's our quote for this episode, releasing crocodiles in the boardroom.

Boom.

Oh my gosh.

Started.

That's great.

That's great. Thank you, Bronwyn.

Oh no, it was a combined effort there, I think. Yeah. Yeah.

Well, and to your point, talking about the boardroom, this is the thing that Bronwyn and I actually were having kind of a good battle on about, like disagreement was in the C-suite. What's the responsibility of other C-suites to be educated on at a foundational level on cybersecurity risks? So you've got the CISO, which is the expert to, hey, but what's the onus or liability or the obligation of other C-suites to be foundationally educated?

So that's an interestingly phrased question, and I don't agree with the phrasing of the question.

Okay.

You're a gestalt. Like, it is the CISO's responsibility to ensure that they are educated.

Hmm.

Right? Now, it may be that they don't want to be educated, in which case, like, it's their responsibility to pay attention. But if it's not being taught correctly, you're not being made aware of it. Like, and think of how many times in your life you took driver's training. How many of the things did— that they told you did just went in one ear and out the other because it was badly taught? And as a result, like, maybe you're not as good of a driver as you could be. I hope you're both still reasonably good drivers, um, but if you're in Chicago, so I don't have to worry about it too much.

Terrible.

Yeah, everybody in Chicago is an awful driver from my perspective, but I drive through Chicago like every score year.

I think, Cody, the, the, I, the phrasing of the question, well, I liked it, but, uh, I think the context that we were talking about before as well is really important because I think that question came out of this, this idea that the CISO, wherever they have come from in terms of their background, that it's kind of their responsibility to show up in the boardroom and educate everyone all the time and then be kind of a no person. That's the context there. But I just felt like there's got to be some, some meet in the middle of like the CISO. We're pressuring all CISOs to like learn the business language, to be able to explain it really well, to have soft skills and communication skills. But is there a way that we can also maybe in a more invitational way get CEOs and CFOs and other C-suite members to also like maybe care a little bit, like come to the table as well. That's, that's the vibe. That's where I was trying to go with it.

Yeah. So I hear, I hear where you're going. Um, and I, I have, I have one nitpick. I hate the phrase soft skills. Me too.

Oh my gosh. I said that earlier. I hate it.

She did say that earlier. No, there, there's no, there, there, there are 3 types of skills. There's technical skills, which is what people like to call hard skills. Those are easy to measure. That's why people call them hard skills. It's like, I can measure how good you are at technology. Right? There are people skills. And the way I think about technical skills is, can you change the world through your own energy? People skills is, can you get somebody else to change the world by using your energy through them? And process skills, which are the hardest ones, which is, can you get people you don't even talk to to change the world on your behalf? Those two are the hard ones. Communications is a huge piece. There are components of communications, the technical skill, But it's really fundamentally a people skill. How do I brainwash you into believing what I need you to believe?

Yeah.

And so here's my finding. There are some really bad executives out there, just to be very clear. I've talked to a lot of CISOs who I know are very good at communication, and the things that their CEOs have told to them would astound you. And they don't care about risk. Their attitude is, corporate risk is not my risk. I'm here to make a bazillion dollars, which means all I have to do is survive for 12 months.

Right.

And so any risk that's going to hit us 15 months from now, I'm fine with, because I'll be checked out because we're selling the company. Totally fine. That's— but recognize that for that person, that's a wise risk choice. They're just violating their fiduciary obligation, which I think is to Bronwyn's point, which is we, we need the humans to accept that they have a fiduciary obligation to the business to make wise choices.

Yeah.

And the security risk is a component that's the halfway we need them to meet. And then it is our job, in the same way it's general counsel's job to talk about legal risks, to come in and talk about it in a way that is accessible.

Yep.

In the same way that you don't walk into a preschool and talk to kids in language they don't have about the risks that are relevant to them. You have to meet people where they are. And if any executive is listening and is insulted that I compared you all to toddlers, sorry, that is the reality is like, in the same way that I expect the general counsel to come in and talk to with like toddlers about law.

Yeah.

Right. Because we don't necessarily understand torts. This is one of my favorite things, by the way. If you're ever at a cocktail party and you see two lawyers and they start doing one of these, like one-upping each other, talking about some legal issue, just say, but is it a tort? And then just step back and walk away. That's great. They will now spend hours arguing. Like the answer is half of them have a default yes, half have a default no, and they'll just fight over it.

I bet you're a hit at parties.

I have a lot of fun at parties. Cocktail party tricks are my specialty.

Man, this is, this is great. So talk to me about your 1% Leadership book. So I do want to kind of get to that. And as we were talking about like the CISO and the evolving CISO, I think my thought is this book may have came from your experiences. So talk to us about your book.

Yeah. So I started writing this book because like every company, and in fact, I had this when I was in the Air Force as well, there are leadership fads. And it's like you come in and somebody's gonna teach you about leadership, maybe following a book or following some fad, whether it's the growth mindset or Good to Great or you name it. And I'll actually be pretty honest, I find that almost every leadership book out there and almost every leadership training is awful and they're all awful in the same way. They believe that there is one answer, do this thing and you will be amazing. Second, they badly explain, if at all. If it's a book, they don't actually explain the answer because why would you read the book if they could write the answer down for you? For you, or they don't understand their own research. The growth mindset is a great example of that one. They misapply the fundamental research in a different way, and then they just pretend that all you have to do is copy this thing.

Yeah.

And I hated it. And this book actually started because we, we had a speaker come in, a fantastic guy, talked about inclusion. I still remember a bunch of the things he said. He said, look, the moment you have two people in a company, you have diversity. He said, stop, stop looking at people as race, as gender, as whatever. And like, if you have two Black men, You have diversity, not because they're both Black, but because it's two people. They're not the same person. All right. Right.

Right. Yeah.

If you don't have inclusion, diversity is harmful. Inclusion is what matters. Like, how do you get people to show up and, and actually be able to be present? And so it really resonated with me. I'm like, this guy is amazing. And so I wrote this note to my team. I said, look, we decided to bring this training to the whole company. You're gonna love it. And my team came back to me and said, "Dude, what were you talking about? This training was awful." And I'm like, "What do you mean?" Well, this guy was a very high-priced, you know, expensive speaker. So when we brought it to the company, we'd hired a company. It was basically, you had to watch a video with a guided trainer in the room who was somebody from our HR team who didn't understand this and how to explain it. And so they fell back on like the standard language that we now know is so awful, you know, talking about like, "Oh, diversity's the most important thing." And so make sure you're hiring for diversity, right? And everybody knows that, like, yeah, if you tell people to do that, they'll put the thumb on the scale in a bad way rather than you're doing it the right way. So I, I took that lesson. I said, well, what if I wrote them, for them, an essay, right? And so that was the first essay I wrote in this, which the tweet for that one. So the chapter titles of my book, um, every chapter title is a tweet and it is inclusion is reducing the energy cost that people pay just to exist in the space.

Interesting, right?

And Bronwyn, I love when I have a woman here because I can give you the easy one. How many times in your career have you walked into a room and been wondering how long it was going to take somebody to ask you to get coffee?

Oh yeah.

No, right? Every woman resonates with that one. That is a lack of inclusion. You are spending your energy worrying about a thing, even if it never happens.

For sure.

We need to make it that no woman ever worries about that. That's inclusion.

Yeah.

It is not having more women in the workplace. It is making sure that every woman who's in our workplace doesn't feel that.

Yeah.

That people don't say like, I have that. I'm an observant Jew. Let me tell you, I walk into a meal and I don't know if I'll be able to eat it. I've had people try to serve me shrimp and pork and I'm like, come on, I've told you my dietary restrictions. What's going on? Every one of those moments. Is a challenge, right? And how do we remove those challenges? So I wrote that essay, my team loved it. I'm like, oh, maybe this is what I should do. So my book is 54 of those essays. So 54 lessons, each one is a standalone. They're, they're written in an order. I will tell you that they were not written in that order. I wrote them all and then I put the titles of everyone on a Post-it note on the wall of my office and I moved them around until I loved the order.

Love that.

So you can put 'em in whatever order you want. This is the order that I want, that I structured them in. That I think there is a logical flow. 18 of them are about personal leadership. How do you manage yourself? How do you lead yourself? Because all that leadership is, if you really distill it down to its bare bones, we're gonna define it by success, not by style. Too many people, I think, focus on style of leadership rather than success. Success is how do you maximize the value you get out of the energy that somebody contributes? That's it. Your job as a leader, I've got this much energy coming out of that person. I want more value out of them. Whatever my value equation is, whether I'm in the military and my value is, you know, seize land, you know, kill somebody, whatever it is, or if I'm in corporate America, I'm going to go make money, or I'm in a nonprofit and I'm, you know, how many people do I serve? That's my value. Okay. Leadership is how do I take people's energy and make it more valuable for us? That's it. And so the first person you have to lead is yourself. How do you make your energy more valuable? Then you can lead a team. How do you make the people you interact with more valuable? And then you can lead an organization. How do I set up an organization to produce more value? Sure. And so you notice this matches to my technical skills, people skills, process skills. Oh, yes. That it's like, how do you technically lead yourself? How do you lead people? And how do you lead process? Mm-hmm.

Yeah. So, so then taking that, you know, into our earlier conversation about like the new version of the CISO or maybe the evolution of the CISO. How do you, how do you, those principles, how do those apply to today? And I know in your book you talk about, you know, leadership isn't just for executives, you know, it's, but I think how do you see those principles applied to, you know, security in today and then the evolution of the CISO? Do they come from the technical side, the business side, or what do you think on those trajectories?

Yeah.

So I think the challenge of that thing is if I said, well, they always come from the technical side, in your head, you have already said, oh, they're architects.

Yeah.

I know folks on the, on the GRC side who are what I would consider very technical. And the challenge is that we're so used to these high-tech companies, right? If you're coming out of Akamai, you're coming out of Google, you're coming out of Facebook, technical means something very different than what it means in like any other company.

Yeah.

Right. So I like to think about that when you talk about technical, there's technical depth. Right? How well can I personally interact with the technology? And there's technical breadth, which is how many technologies do I have good competency at? And if I'm buying tools, I don't need technical depth in any tool. I need technical breadth across all of my tools and across all of my environments. That's, that's when, when I think people are more technical, it's really about the breadth. I don't want CISOs who are super deep on one thing at the expense of being broad. And so we're now sort of seeing that the folks on the GRC side, they're focusing on breadth. Now, there are folks on the GRC side who are just pushing paper and documentation. They don't know what they do. That's— and there's job roles for that. Just to be very clear, if you're somebody who does that, this is me not saying you don't belong here. This is me saying that's not the path to a CISO.

Yep.

If you don't understand what you're doing, you're just pushing paperwork. That's okay. There's a reason you're doing that. But there's a reason you won't become a CISO, right? Wherever you start, understand why you're doing this. What is the real reason you do this? Could we stop? What should we do differently? If you can't answer those 3 questions, you're not yet on the path to being a CISO.

I have a left-field question, Cody, that I didn't write down at all and didn't prepare for, but—

Fire away.

The question is, why do people want to be CISOs so badly if not only do these job descriptions crazy.

Mm-hmm.

Too, too long. There's now personal liability, like legal responsibility that CISOs have. Why do people want it so bad? What, what's happening?

So I think that there's a couple of different reasons, and I'm not gonna say everybody ascribes to all of these, but let's start with the first one. The money is good.

Fair.

Like, why does anybody want a promotion at work?

Sure.

Because you make more money doing it.

Get that bag. It's true.

Right? Second is your span of control grows, which means you're, you feel like your independence grows. Right? Like Bronwyn, why would you want to be a CMO one day?

Oh yeah. Just to feel extra powerful. I want to become on top of the world.

You want to get the bag.

You want to be in control of your day.

Okay.

The higher up in the org chart you are, the more you are in control of your day versus somebody else telling you. The reality is the more the environment controls your day.

I completely, I totally agree.

Like, just to be clear, when I was a CISO, like I would walk in and I had what was on my calendar for the day. 9 times out of 10, that is not how my day ended up looking, and it was not because I chose to do something else.

Yeah.

Oh, we have a customer issue. We've got a whatever. Some people, it is the calling. We want to make a difference. Like, I got to— as Akamai CISO, the amount of difference that I made on the planet is huge, right? I, I'm the first person to design and build a TLS CDN, the ability to secure web over a CDN. Which everybody now does by default. But I brought forward the concept of like an e-commerce-driven secure web, like maybe call it 4 years. That's me.

Is that an idea? Just outta curiosity, is that an idea that you had and were able to bring to the business at a certain point? Was it an idea you had before? Like how, how did that come about?

So, so this one is really funny. So I actually did, When I was an undergraduate, I had nothing to do with the Akamai founders at the time, but I got to show them one of my writing examples. So at MIT, you have to do, pass a writing requirement to graduate. And so the report I had written was actually on like, how do we solve the problem of scalability on the web? It's blowing up all of our internet connections. And then I go into this thing and I'll actually be honest, Danny Lewin, who was one of the founders who was murdered on 9/11, but I knew him. And he was the one who had the idea, just to be very clear, the idea that we could do TLS on our network. I was like, nobody will ever buy this, Danny, you are insane. Like I was the single biggest naysayer, but he said, let's just assume, let's go design it. Right. So he and I designed together the security model for it. Um, and let's just say that we had disagreements. I'm happy to say I won on several of them. He thought we should just like hire guards with guns to stand outside of data center racks. He's like, we'll just say they're network engineering technicians. They'll just physically guard our things. And I'm like, I don't think that'll work. So instead I designed a great key management system. I never believed it would work, but one day after I'd been working an incident until like 3, 4 in the morning, I get home, go to sleep. My phone rings. Um, and it's actually my, my, we don't have like great cell phones that work. Um, so I actually remember it was my landline that he'd called, you know, we had a voice connector. So he dialed in and said, Andy Ellis home. It rings like, you know, 9:00 AM and he says, Andy, I'm here. I think I can probably tell who the customer is at this point. I'm here with Capital One. And this is in early 2001.

Okay.

And he says, and they want to know why they should trust eSSL. That was the name for our product at the time. And I'm like, I literally just had a shouting match with him like 48 hours before. I'm like, nobody should trust us with this. And he's like, they need to know why they should trust us. You give the best pitch. Go. And I'm like, are you effing kidding me?

So you've got 3 hours of sleep.

You're on your own. And no notice that this was happening. And I just, and so I said, I said, I need to fix my connection. Can I have 3 minutes? And he's like, sure. So he stalls them. I literally run into the bathroom, splash water on my face. My girlfriend, who is now my wife, is like in the bed. Like, what is going on here? I'm like, Be quiet. I gotta go do a pitch. And so I, so I pull out the phone. So I go back to the phone. I'm like, okay, I'm ready. I got my slides here. I have no slides. I've got a piece of paper on which I've written 5 things. Uh, and I do a pitch. Here's why you should trust us. And I, and there was no lies in it. Like straight up, here's the security. Here's why you should trust us. And at the end of it, there's just silence in the room. And I'm like, I'm like, did I get disconnected? Did I do one of these? I just talked for 20 minutes.

Crickets.

And there was nobody in the room. Like, I didn't know.

Yeah.

And they said, huh, the CTO was like, huh, that's really interesting. We should consider this. Now, in fairness, it took us like 10 more years to land Capital One, like 2000, 2001. They weren't doing it, but that was the moment I believed.

Interesting.

And I went out and I started selling it and it reminded me of this moment. And Danny was brilliant. I, you know, a lot of, a lot of people had issues cuz he was just such this intense force of nature. And it reminded me of the story I had read in middle school, which is titled Takeover, Bosun. It's the story of like this shipwreck and there's a lifeboat that has this young lieutenant who has the gun and the food. And there's this bosun's mate and like 2 or 3 other crewmen that are basically like the bosun's leading this, this like, I'm going to throw you off the boat as soon as you pass out and we're going to take the food, give it to us now. Like, who are you, young kid? And like, so it's a short story in which like this officer gets more and more delirious. And as he's about to pass out, he steps forward to the bosun's mate and he turns the gun around, hands it to him, and he says, "Take over, bosun." And when he wakes up, the bosun is standing over him and the food, protecting it from the rest of the crew members. It's this moment when you realize my job is not to be the contrarian anymore. Now my job is to go execute. And so like, for me, that's the epitome of disagree but commit. And then sometimes when you commit, you realize you didn't actually disagree.

I mean, fascinating story, fascinating moment. I have to now ask you about Going back to our leadership conversation, what was that moment that you realized either you were a leader or that you could be a leader?

I don't know that there's like a specific moment. Um, you know, it's sort of weird because I dodged leadership for a really long time, or I dodged authority, I should say. Like I was an Air Force officer who never had anybody report to him.

Interesting. Uh-huh.

Like I went into the Air Force, like my first job was information warfare. We were a squadron of 83 people, half of whom were officers.

Interesting.

So I'm a second lieutenant in the engineering section, which is 5 officers. So, you know, we've got 2 captains and 3 second lieutenants. I don't have anybody who works for me. Uh, and then my second posting, I was at Electronic Systems Center. You know, I come in and I was supposed to have 3 people who worked for me. At least that was what the assignment was. I show up. Um, one of them was a master sergeant who's like, who basically rewrote the org chart so he could report to the colonel. We were a unit of like 15 people. One was a civilian who said, don't tell me what to do. I've been here 15 years and I'm going to keep doing whatever I want. And I've already moved my office across the hall. And the third was a second lieutenant. I'm now first lieutenant. I'm like excited. He can't do this to me, except he was a former Navy SEAL who made the mistake of wearing all of his ribbons one day, man. And he was spotted by public affairs. And so they requisitioned him to be the tour guide for visiting dignitaries. So like, so here, like the Air Force trains you for leadership as an officer. I didn't get to lead a single person.

Interesting.

Um, as an authority. And then I went to Akamai and I was an individual contributor for a while. Uh, and then they actually hired, my boss hired in somebody to take over the security team. We were up to like 5 people. He hired somebody in who, and, but didn't make him our boss. Just was a principal engineer. And this guy, everybody hated, all 5 of us hated him. Like everybody else in the company did not like him. Um, he went on, he did amazing things later, but like that, that was not the right time for him. Uh, and so one day my boss calls me and he says, well, you know, this person hasn't really worked out. Would you like to take over the team? Right. Cause we're at this point, all 6 of us report to him, but he's got 40 other reports. He's got a whole organization. So I'm like, yes, I will take it over. So that's sort of the first time. And he says, great. By the way, um, I've already put in my resignation. I'm leaving next month. Oh, and also we're doing a riff next week. So you have to cut half of your team.

All right. Well, that's different.

There you go. What? Like, well, clearly I know one of the people I'm riffing, which is the guy who's going to be a problem because he didn't get the job he was hired for. So I think that was the point where it started to be like, okay, I've got to do this, but now I've got to lead through influence. Like I am the senior security person. I was a chief architect, now director of information security. And it was this realization over, and this is during the dot-com crash. So my job was to convince people who weren't sure we would have a company the next day to do security work that would be valuable into the future. And I had no actual authority other than my title.

It's a tall order.

And so I sort of just had to learn. And I spent a lot of time trying to understand how humans think. And that was my single biggest realization is if you rely on authority, At the end of the day, you're going to fail. You have to rely on influence, even if you have authority, even if I'm allowed to tell you no.

I see. I see.

My job is to make you believe that no is the right answer. Because then, A, you're not going to come ask me in the future because you know the right answer, but B, now we're not at odds interpersonally. Like, you believe that no is the right answer, and so you don't blame me for telling you no. You're like, great, we're doing the right thing.

Yeah. And one thing too, this has been a great conversation of all the leadership and stuff. And I was talking to Bronwyn earlier about like what's kind of missing in today for CISOs. I think there's a lot of like a lot of tools out there, right? There's the next tool to have there. But like hypothetically, you are launching a new podcast, you know, called the CISO Series. And so with—

I might know that podcast.

I know.

Yeah.

You know, it's hypothetical, you know, here. So From that perspective, as someone who's deeply in the game, you know, what's missing on current cybersecurity podcasts, right? There's a lot about like threats and everything else here, but like, what are those pieces that like, hey, young CISO, early in the game, go listen to this and soak it in?

Yep. So that's, I love the question because A, I like to think we try to hit for that sweet spot in the CISO Series. And the real question is, how are you actually talking to the business?

Us.

One of my favorite things we do is we do What's Worse. Readers will send us in like this scenario and they're always two awful scenarios. We're not allowed to tweak them. You basically have to say, you're stuck with it living in this scenario. Which one of these is worse? And today we just recorded one. So it'll be out in a while, but it literally came down to, there was one that was technically bad for the security team, right? Here's a bad outcome. The security team is failing. Other one, no impact to the security team, no actual impact to the company. But there was a brand hit. You looked bad in front of your customers.

Yeah.

And I and the guest both went on that one.

That's worse.

That's worse. Yeah. If you are not thinking that, that impacting my customers is worse than the security team dealing with incidents. If you don't have that mindset, that's what we need to teach you, right? That's who your responsibility is. It's your customers.

As a marketer, I feel like I have to, I mean, I agreed immediately, but I don't know, maybe if I was a CISO, I would think that like protecting my team did, I don't know, was more important or that there was a different risk there.

I mean, it is important. I'm not going to say that this is like an ethical difference of, oh, always protect your customers at the expense of your team. There is a balance here, but it's a key piece of that. And the challenge is you have to understand like, why do you exist as a team? You exist because your company serves customers. If you fail to serve customers, why are you there? Like, this doesn't mean you do crazy things to make your customers happy, but the security role is protect the customers. Make sure the company makes wise risk choices about serving the customers to keep them safe.

Yep. Man, Andy, this has been phenomenal today. I think your background, the book, which We will make sure, Brahman will make sure we get this on our, on our post and everything here so people can click the link and, and get to the book as well as your, your co-host of, you know, of the CISO Series podcast. So I think a lot of the things that we try and push on this podcast is for either young aspiring security professionals, ones who've been in the game for a little bit, um, but just a kind of a fresh approach. I think a lot of times there's a lot of like the tools and the other side, but I think there's much more important things, you know, there's much more things to be, to be cognizant of as, as a CISO or, or for CISOs in, in the industry. So, uh, Yeah, thank you again for the time today. I've been super appreciative of this. This is awesome. Your, your story is, is remarkable and I appreciate you spending the time with us.

Thanks. You guys were great hosts and great questions. I feel like we could talk for another 5 hours.

Oh, easily, easily.

Completely agree. Amazing. Well, thank you so much for your time and we'll talk to you soon.

Awesome. Thanks for having me.

Thanks, Andy.