Meet the Security Awareness Apologist

Thanks for tuning in to Simplifying Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And today we're happy to be joined by Jason Heinich, who goes by the title of Security Awareness Apologist. And I think I know where he's going with that, but we're going to need to get into that real quick in this interview. Jason, welcome to the show and maybe tell us about your title.

Thanks guys. I'm stoked to be here. I think I started using Apology, like Security Awareness Apologist, a couple months ago. You know, I've, I've been on my own little journey here from the practitioner side to being a founder and then kind of being on the product side for a while. And just, I see a space right now. This industry is, there's a lot of funding happening with new startups coming out. And I feel like everyone is kind of maybe kowtowing to the VCs and what they want to see. And no one's really still here for the awareness practitioners. And so I'm just here unapologetically just being like, yeah, but this is security awareness. This is how security awareness goes. And if I can maintain, uh, people's attention and, and kind of helping people to rethink like what really awareness programs are, that's what I want to do. And so I don't know, I just, I kind of landed on that and it sounded good.

Love it. I like it, man. I like it.

So, let's start with, I think, Gartner's latest slogan for awareness. And I do think it broadens the terminology because I think awareness is only one part of behavior change and really shifting a culture. But let's go around the horn here. What is human risk management to you and what is its relevance in today's world or enterprise? Jason, we'll start with you and over to Cody.

Yeah, happy to go first. I think, you know, I think when, was it Forrester or Janan kind of introduced that HRM term, I looked at it as like not the new umbrella, but kind of if you consider security awareness and training as one layer, which is kind of like the actions you're taking, the content you're sharing, the HRM introduction to me is another layer that sits on top of that as part of an awareness program, which is more about data and like the data around behaviors and those metrics and stuff like that. So to me, HRM is just another, you know, layer 2 of what I think is probably a 3-layer, paradigm there of like what it is. So I don't think it replaces anything. I see a lot of those conversations of like, I'm not using this or not. It's still this. And I'm like, I think they both exist. I think both, both things can be true. So that's my point. Yeah.

Good answer. Cody.

Yeah, that's great. I think maybe 3 kind of areas I would say, and that's like engage, you know, engage, educate, and empower. I'm engaging the workforce, like pulling it out of just IT or cyber professionals, I think, and then educating those on like what their role is and how they can help a company. And then I think the empowerment is like, how did they do that? So here's what it is, here's what you can do, and here's how you do that. I think as you're doing that, you kind of build— and we know with any— as a former CTO, you know, a lot of the tools you can buy are great, but they need to have like integration and visibility. And so this is looking at like the non-technical pieces and like, how do I build the human risk area and how do I evolve that as like a valuable piece and viable piece of my cyber program?

Yep. No, that's great. Yeah, I think you guys have, have both covered it. I would say awareness to me, you know, when I was running this on the corporate side, it kind of, the term felt short, right? Like it was, I'm going to make people aware of a problem or a need or an opportunity, but it didn't necessarily mean anything was going to change or their behaviors were going to change. So when I got to the consulting side, you know, at the time, this is 5+ years ago, we were kind of trying to recast it to awareness, behavior, and culture change. And it was ABC and then the delta sign. And I think to me, I hope that human risk management, you know, as a category that's broader than just awareness content and phishing messages, which is largely what it's mostly been for the last decade, my hope is that it is more holistic. And then Jason, to your point, I think Data is the catalyst that brings all that together. Because if you're not measuring, you don't know what's working. And if you aren't making changes based upon what's working and not working, you're, you're, you're in a, an echo chamber. You're not really doing the things that matter most because we're, most programs don't have unlimited resources and the shots on goal that you're going to take better be the best ones. So you're maximum successful.

Yeah. So I mean, kind of getting in, I think Aaron, you got a good point there, but Jason, from your perspective, like how is the definition and scope of these programs evolved? Evolved over the past few years? I know you can go back and it was just the training, but from your perspective, talk about the scope and the evolution.

That's an interesting question. I think I'm going to have some probably unpopular opinions and views on this.

Love it, man. I love it.

I actually think that what we are calling human risk management right now, I think it's in a dead zone. And I don't know that it's going to— I don't know how we get out of it unless we just like blast right through and just say, okay, this is okay, but we need to move forward. And I think we see vendors kind of like falling in that trap right now. But it's still like in the right direction to me. And so I think the scope has shifted from like more of that technical tool of like, I can send simulations and I can assign training via an LMS to like having more organic conversations maybe around like human behavior. And I think there's a gap where We've introduced this concept in, in human risk of like behavior change. And I still think like most practitioners and vendors, I'll say, don't really have that qualifying education to even like frame them the right way, I think. And so like, I don't know, to wrap this up maybe, I think it's a necessary shift. I don't think it's the right shift. And I think we're, I'm interested to see what comes next, right? Yep.

So maybe the pain point that you're starting to get into, let's put some big hairy pain points on the table. Let's discuss them a bit, and then we'll move into kind of, you know, this group of thought leaders kind of ideating for the future. So the first one I'll throw out there, we'll get some reaction, then we'll go through second one, third one. The first one is SaaS or MSP commoditization of awareness training. And Jason, you alluded to it. 95% of the focus of most awareness programs out there that aren't, you know, staffed with 2 to 3 people or, or plus is basic phishing training quarterly, sometimes monthly if you're getting a lot of it. Online training, like you mentioned, jammed into the LMS, starting to be more bite-sized, but it's still canned, it's not tailored to the company. And then, you know, metrics and reporting on top of that. So pausing there, Cody, your experiences, Jason, your experiences, what's wrong with this picture?

Yeah, so I'll kind of dive in. I think a lot of it is like there's a lot of focus on, to your point, Aaron, the basic like social engineering and the clicking the phishing. But then I think what they're missing is going beyond that and like look at like insider risk or AI policy and certain things that are going to be bespoke or tailored to an organization. And you're really not getting the depth of education or what you want, like the so what there outside of like the table stakes. Here's what this is, don't hit a phish. And so I think getting beyond and say, okay, if I want to educate my workforce and drive awareness or drive even just a sense of accountability that like it isn't just the responsibility of cyber IT to protect the organization, I think you kind of got to get is like, How do we do that? Is it we report this way? Is it we are aware of the type of data we have, whether it be like data classification or we see someone doing suspicious things? But that first part is educating and kind of understanding what's my other user's accountability in this giant picture of cybersecurity?

I'll just chime in there, like approve tools to do good secure behaviors. I feel like many cyber programs don't do a good job of setting up a great user experience to do the right thing. Right. The awareness piece or the human risk side is making people aware of the tools that are there to use. But to me, you know, if I'm a CISO, I'm putting dedicated resources on making it super easy to— whether it's encrypting data or minimizing accidental email leaks or wrong sender, like pick your 90% of human flaws that lead to the breach and wrap your tool structure. You spend a lot of money around and really focus on that human and creating an ecosystem of like, I know exactly what to do. I know the data I'm using. I know the tool that I need to secure that data, and I know why it's important to do that. Jason, other thoughts?

I think the only thing I would add is at least what I'm observing with MSPs starting to really deliver awareness services or HRM services, however you want to kind of like frame that. MSPs can only be as effective as like their, the platform tooling allows them to be. I, it almost seems like where they're— MSPs are providing a very much needed service for small businesses and smaller entities and stuff like that, right? So like, I don't, I don't, I don't blame them in any way. I think they're only limited by the robustness of the tools. And so when you look at like a, a KnowBe4, which is a, a SaaS company at its core, you know, they, once they introduced multi-tenancy, then MSPs are like, oh, I can now sell this, right? You're still missing that. And this is the thing that I always like to echo and, and amplify is like, but you're still missing that education of the person administrating the platform, which when KnowBe4 launched, it was the awareness practitioners. But as soon as they introduced multi-tenancy, MSPs are now the practitioners. And if they don't have that experience and knowledge on how to manage a program, you know, they're kind of starting out where KnowBe4 did 15 years ago, right? Which is they're figuring it out on their own. And so I think that there's some damage that can be done by kind of like not QAing that platform by educating the MSPs. And I just, what I would like to see is more focus by those vendors to educate the MSPs and ensure that they're applying the best practices from practitioners. Yeah.

Jason, I think also on that too, like there's a difference from like playing not to lose and playing to win. And I think in that case it's like, hey, I'll do the basics so I don't lose, but To your point, we're not like playing to win. We're not really getting better. We're just kind of covering a checkbox and it's kind of changing that mindset. Like, let's push the bounds and let's, let's drive a change versus, you know, check a box.

Yeah.

I always like refer to like the snake eating itself. It just kind of feels like that cycle of like, just because you can do it, should you kind of thing, you know? And it's like, I always, I always ask vendors and practitioners to be like, just think about it one more step. Like, yes, you can do this. And we'll probably get into this maybe on another topic of like all the, the startups coming out now that are implementing AI. It's like, Yes, you can, but should you be doing that? Right? Like, is that actually beneficial?

One, one interesting observation is, you know, we do a broad number of services across cyber and strategy, operational stuff. Awareness is one of our capabilities, but 99% of our clients all have, you know, usually KnowBe4 or Proofpoint or one of the other solutions out there. And we're not trying to displace that. I'm not rushing out to be one of the, you know, the 100th tool that does that. Because I think a lot of what's missing— and Jason, both you and Cody alluded to this— is beyond the what you can get in a box. I'm for— I don't want to recreate the basic training things, but Cody, all those things that you mentioned, like, how are we going to— what's the strategy of how we're going to roll out InfoClass and data protection and DLP and like appropriate use policy so we're not doing HR investigations of thousands of DLP trip messages that hit because we have broken business processes and people don't know how to do the things we expect them to do but never told them. So, I think there's a lot of work beyond just the tool, which kind of leads us into the next pain point, which is I think historically, this is changing a bit, but 10 years for sure ago, most CISOs or senior cyber leaders came out of a very technical background and a lot of times infrastructure. I too, you know, started my career as an IT developer, right? So I'm a technical person by background, but I think if you have a prominent or a heavy portion of your community of leaders that grew up there, they were rewarded for developing, delivering tools. It's hard to get out of that mindset to not just solve a solution completely, with a tool deployment and a solution. So I think we've already kind of alluded to it is like there's layers here. Yeah. But Jason, Cody, what are the layers that, you know, beyond a tool that we think either tools need to be starting to solve or what are the, what are the examples of human and process things that a tool will probably never solve?

Yeah, you go Jason.

This might be, uh, venting here. So I think like what's missing continues to miss. And even there was a big announcement today on a huge funding for a startup that just came out like, like $30 million or something. And I went and looked at the site and they're automating things that from a technical standpoint, there's a lot of toil, right? And for an awareness practitioner, you know, I see a lot of these, these HRM platforms focusing on workflow automation. And I think that's great, but everyone is stopping short literally at the most crucial element I think that they can provide is risk reduction action button that an end user can take. If you're going to interrupt them, and you're going to auto-assign this, this fancy workflow automation because they clicked on a phishing simulation or a voice phishing simulation, instead of serving them content to train, like, see what their— what other data do you know about them? And, you know, I think the example that I'm referring to is like, you have externally shared files, and the solution is, hey, you should go and unshare these. But how powerful would it be if it's just like, do you want me to unshare these? And they just click it and all that risk is reduced. Mm-hmm. And then you can actually take that away from the score.

So take a moment in a workflow that helps them undo what they, the accident they were about to make versus backend manipulation.

Yeah. Like do not show, like, yeah, if you're gonna interrupt them, give them something to do. Don't give them like a homework assignment that they have to go and figure out, you know, through policies or some other page. It'd be like, do you wanna take it there right now and do it? Yes. Boom. Done. All I have to do is say yes or no. And I think that once we can get to that point, that's when you can start seeing user risk scores being actually valuable and reducing them with one click. You can say like, hey, your score is this. If you just click this button right here, I can take your score from a 55 all the way up to an 84, right? Because you're removing this risk. And those are the tickets that get created with, you know, with like SecOps and IT ops. It's like it's still just removing that last mile of toil. You know, with everybody. So sorry, that was a big, big—

No, it's your point. Spot on.

I like it. I think, Aaron, I think to your point about additional things, my thought is like the process or the approach to this is also important because like, you know, I think of a client we had was a 70,000-user oil and gas company. They're on— they're in 40 different countries. They have guys on oil rigs in the middle of the ocean. They don't even check their email. And so it's like, how's the tool going to solve that unless there's a process or there's a one-pager, there's a town hall, a standup? But I think, Jason, to your point, A lot of people aren't looking for like more things to do. Like, I have plenty of time. What else should I do? So you're taking time from something. You're going to be competing for time on someone's calendar. So like, be brief, be brilliant. God, I probably messed that up. Be bright. Oh, whatever it is. Oh, we all know that thing. But I think with that is like, let me not send like financial wire fraud training to someone who's, you know, pulling a switch on my OT line or my manufacturing line. Right? So like, have an approach. Multichannel, some are video, some are audio, some are just a line leader with a slide in the all-hands that week or something that like, do omnichannel, make it relevant to that person. So it's like, this is relevant to me, how I can help. I'm not getting like finance or anything, I don't touch accounting system, so this is not relevant to me. So to your point, use that time wisely, build their trust, and then engage them so they're like, okay, this makes sense, it's relevant to me, I know what to do. And then I think really the next challenge you kind of face is measuring effectiveness, but that's another topic here as we get going. That's kind of my thought. I think you'd miss out is, you know, you look for, send the emails and the training out. And so many of my employees either don't speak the language. I don't have different translations or the content's just not relevant to them.

Yeah. When you said something there, Cody, you know, this, this omnichannel approach now where we can do Slack and Teams and email and SMS and stuff like that. And I think that's my biggest concern right now is because I think that's what AI and the technology right now is unlocking for a lot of vendors is like the ability to do that at scale. And if all you're like, my fear is people are going to, every vendor is going to have their own Slack bot and they're just going to use it to remind people, hey, here's your training, you need to complete it. And like, you can just do so many more effective risk-reducing actions than just automating that like email outreach. It's just a fancy email reminder at that point. Right. And so.

Yeah, no, I totally agree. We see a lot of them. We'll probably get this later on too, but a lot of our programs we've done, our larger programs are like built like a spokesperson or a character and it's animated. Makes it fun. So I'm getting like, there's a video or it's like, you know, they use like an internal Yammer system or something. But like, to your point, find a way that's engaging. Like, Lord knows we've got 1,000, you know, Teams alerts, Slack alerts, email alerts, especially in security. You know, we've got so many of those. So like, how does this stand out? How does this look different than what else I'm getting to make me be like, oh, I should look at this one?

Well, we'll get back to characters because I know Jason spent some time at Disney and Sony, so I want to see what characterization came up there. Before we do, one more pain point. And Jason, this is kind of where you've been on my feed for a number of years. We connected many years ago when we were both at different companies. But, but I think you had a video post, which was your first, if I would call it a series, where you were kind of not so happy, I would say, with the vendor market that you had seen out on the floor at RSA. So unpack that for us. What drove those feelings? And, you know, how have you since culminated the general industry concern And then we're going to use that as a jumping off point into kind of how do we solve both the tech side as well as the stuff that the tech will never, never really resolve.

Yeah. So you saw that, huh? Sorry about that. Yeah. I think like I was, I think going into RSA, you know, I was kind of seeing a lot of chatter on LinkedIn leading up to it about, you know, different vendors. Once it was all said and done, I kind of looked back at it. I was like, there was really nothing exciting, at least from the HRM awareness in a space, like, I think maybe I was just disappointed. And I think what I'm seeing is, and this is again, this is just what I think and feel, and it's having been on both sides with VCs, without VCs, is I think that founders are coming in as software developers, creating a great platform, but then they fall into that VC cycle of like, you gotta feed the monkey, right? You gotta raise every 18 months, 12, 18 months. And so you get into this like relationship of like, well, what does the VC want me to do? And if you have a great VC, I think like that's really healthy, but I think there's also some VCs or, or, you know, just investors that are like, I don't care. I just want the Novi for $500 million ARR, like potential for awareness. And everyone's just losing creativity. And like, at the end of the day, everything should be about making that employee's time most valuable and to build trust between the security team. And I, I, I just don't, I was just disappointed. I didn't see anything happening.

I've been just What, what, one thing that worked really well for me, it was actually at a different conference. I was at DEF CON in 20, what was it? 2023. And got to see, it was, I believe, one of the security researchers for CyberArk that filled room. I mean, they call it LineCon for a reason. It's tough to get into some of those rooms, but it was probably a room of 500 people. And he had been given the special assignment to deepfake the CEO of CyberArk in real time on stage in video and audio. and I was, I was so excited to see it and I, I knew it would be good, but I didn't know it would be good. And even since then, that's been almost 2 years ago, the technology and the compute speed has just gotten so high. So I left there, I'm like, shit, like this is getting like voice, the voice stuff, like the CEO, uh, BEC now becoming CEO phone call, becoming CEO Zoom meeting fraud. Um, and I, I was concerned as an awareness practitioner, like this opens up a whole new aperture for what we need to be educating people about. So, yeah, didn't immediately action it, but early that next year, it was actually right before the first big case, the $25, $26 million Hong Kong manufacturer, huge wire fraud scam, multiple deepfakes running in a Teams meeting. They definitely did their homework, uh, but we, we decided to do something very tailored to organizations, and we said, what's the best way that We're going to show people how this works and it's going to be with their CFO and CEO and showing an actual attack in reality. So obviously this is not something you can SaaS, but we, you know, we've, we've built over, I would say at this point, 15 different large company, uh, threat scenarios using real CEOs, CFOs, CISOs, and we usually make the CISO the hero in which they're the one receiving the Teams call or the Zoom call, it's an attack, exactly what's going on in the wild using them, and then both leaders together educate the workforce on how they stopped it. And we've had some of the feedback, like established companies of like, hey, this was some of our best received feedback. And you know why it was different is it wasn't something out of a box, right? It was real people with people they know that they wouldn't have expected to go, you know, be game with some of this stuff.

Yeah.

So, so maybe, maybe shifting with that, let's, let's jump into kind of the art of the possible and the solutioning. And I've got a few things to guide our conversations, forgetting about tech. And Jason, I want to maybe start with you and some of the things that were maybe creative that you did at Disney or Sony, but like program-wide and not the basics, not the tool, not the know-before, not the proof point. What are some of the things that you've done in the past or have thought about for the future? That work that are the above and beyond that really capture attention of the workforce?

I mean, clear standout for me, I did it at both companies and it was, it was in an effort to create an event for October, you know, for Cybersecurity Awareness Month. The red team at Disney that I was partnered with, they were just like, they were down for this idea. And I was like, we always talk about like, don't click the link, don't click the link, but we never like talk about what happens after the click. Right. I was like, what if we just did a life hacking session? I'll volunteer. You can life hack me in front of everybody and try and show what happens after I click on it. And the, the concept was like, we would do that. We would have both screens. We would have like my, my laptop that I was presenting from and then theirs kind of like Mr. Robot style. And, um, so they did it. They sent a payload after finding like, I think I had just gotten married at the time, so I still had like my wedding website up. And so they just pulled it from that. They sent me an invoice from a vendor with a payload. and you know, and like, I knew it was happening, so I had to like act it out. And it was a, and for a live, for a live audience, and then it was recorded, so it was available. But that moment when I clicked on it and all of a sudden my face was up on the red team screen because they'd just taken over my camera, like the gasp in the audience that like, it took like 10 seconds for that to happen. Right. And so like, that was my, that continues to be my favorite example when, when I, when I see people talking about what they wanna do for October coming up and people are planning for it right now, I was like, if you can pull off a live hacking demonstration in a way that's safe, people eat that up. And like, that's something that they'll go home and talk to their families about.

Yeah. No, that's key. The, if you're talking to your wife or your spouse or your friends, you know that it's sunk in and then they're teaching others, which means they're reinforcing it themselves.

Yeah. Social currency you give them.

Yep.

Yeah. One thing I have, you hit on a little bit, but this is a challenge I, we see a lot of, and even we're big on like metrics for like, you know, program metrics and vulnerability and risk reduction, but like measuring effectiveness in a human risk awareness, human risk management program. You know, you're— how do you, how do you think they recommend, like, how do organizations measure success or failure of their, their initiatives? Do metrics matter? I mean, what, I wanna get your thoughts there.

I mean, I think it's gonna come down to, you know, what, what vendor they're using, what platforms they're using, and really like what the goals are. If, if there's a strategy behind what they want to do with their awareness program or their HRM program, then I think metrics can be great. You know, it's just like with any, any event, any marketing event, any, anything like you want behavior change in some way. And so if you know what that behavior is and you know how to track it, then I think metrics are great. If you're just doing it because that's what's available on the dashboard and you haven't thought more about it, then throw it out, you know.

Great point. I think it's the same challenge. Metrics effectiveness is the same challenge that marketers have in commercial marketing, right? Like, so you think about how do marketers measure, you know, events, you know, well, how many impressions did we have at the booth? How many people came by? Well, that didn't necessarily convert to how many buyers. Same thing with cyber programs, right? Like how many people opened the email, how many people did the training? It only gets you so far. So I think Jason, you, you kind of touched on it, like what's your goal? And you may not have a perfect metric, but tailor that to either understand, are you getting to the volumes you want? Ideally, if you can get to the behaviors you need. So Jason, you earlier mentioned like You know, the, the, a button to, you know, prevent something or to, to, to show it. If you can, probably easiest example in tech that's available today is the report a phish button, right? Like, okay, this person thought about it, they reported it, they got the little popup with the feedback. That's at least some, you know, you're able to show the number of proactive people that came across it that did something. But I think my, my big thing with metrics is if you're not gonna use the measure or the metric. It's not worth the time to collect it. So going back to intentionality of what's your goal, what are you trying to push? And then most, you know, the biggest thing is like, what are you gonna learn from metrics of things you're not gonna do, right? Don't, don't keep repeating the same stuff if it's not getting the eyeballs, if it's not getting the behaviors. And I think that's where the volume metrics can come in. Like 'em or not, they, they're limiting. But that is something that you can at least say, okay, I'm gonna— this topic was really effective, at least from a volume standpoint. Let's, do more on that and see if that continues or take a different slant on it.

Yeah. And like, it reminds me, and that's when I was with Habitué, you know, selling my product, my, everything I did was like working with my customers to help them improve their programs. And even just working within like the SANS community, like the human risk community that they have, like everyone like talks and has the same issues over and over again. And it always come, what I noticed was like, it always came back to like, would you have a program plan for like what you want to do for the next year? Or are you just kind of like, reactively doing something because the CISO said, well, we need to do phishing, we need to do content. And I was just finding that, like, you know, it's a nascent space and practitioners don't have a lot of experience yet. Even, even today, you know, 10, 15 years after it was more formally introduced. And so I, I always refer and, and suggest folks, like, if you don't have a strategy, work on that first because everything else falls in line, you know, once you understand, like, where your baseline is and stuff like that.

So Jason, you mentioned your October kind of live hack I've, I've done one of those. I would like to do more cuz we had a similar effect. What are some of the other greatest hits, if you will? Both Cody, Jason, I'll give a few, like what are your favorite things to do again beyond the commodity tool things?

I think the other thing I always tried to do, and this was because I was either with Disney or Sony, so I had like a very global audience and like in-person events are great, but like that serves like 5% of the population, probably 10%. I started, I really liked the idea of like, an online scavenger hunt that you can have people kind of participate in each week. And I always just tied it back to like something I wanted them to know about or some behavior I wanted them to practice. So like, I think I, right before October, I had introduced like a 1-page AUP document, which I had gotten down from like 8 pages. And so like, I just wanted people to go to where it was hosted on the internet site and read what was on line 85, right? And that was the answer they had provided. But I got them to go to the intranet site, you know, and then you just do a series of that throughout the month. You can get creative with what you want them to know and do. And it's a nice way to involve everybody. Everybody can participate in that.

You mentioned global. We've had a lot of success. And on the corporate side, we had a very extensive Cyber Champions program. And it was really helpful to us and me to, one, to not have it kind of be from the voice of corporate, but kind of bring that down into the various— we was a multinational company in pharmaceuticals. So, you know, different cultures, different different divisions, some were acquisitions and had a completely different way of working. So it's one of the hardest and most time-consuming to grow something, right? Right. Because you're, you're essentially getting volunteers or voluntolds in some cases. And sometimes a voluntold is good if it's appointee of somebody at a senior level that's like, this is your influencer for commercial sales because they know the whole organization and people listen to them. I would take that over a, general volunteer any day, but ultimately it's, it's, it's blood, sweat, and tears to build up the knowledge of that group, meet with them frequently, and then start to feed your content through them and start to get the tailoring. And Cody, you mentioned like translation issues, like champions can be your friend if they've got the time and the ability and the driver to like, okay, you're going to take this mini poster that we're putting up on digital bulletin boards and you're going to translate it. You're going to make it more meaningful within the culture because some of the stuff might not come across the way, the way that we talk about it in, you know, the US corporate side. So for me, the champions, again, it's, it's not the easiest one, but you usually by year 2 or 3, if you're not into a champions program and really building it into the culture, there's missed opportunities. You can only go so far.

Yeah, I think your point on like the champions or influencers, I think of like popular brands, like what do they use? They leverage like celebrities or people that have influence in the communities, or they'll have like or leadership, right? If it's important to them, it should be important to me. And I think you're going back to what's engaging is like, yeah, I think even sometimes like humility, you're going to see that like, oh man, my C-suite is also vulnerable and they made a mistake or they showed theirs. So I think getting that like sponsorship, that engagement, using like champions and influencers, it definitely helps on when you're looking at representation across the globe geographically or even just like business unit diversity. So operations, manufacturing, sales, R&D, clinical, you know, whatever the different business units are there. Where you get some good feedback. And oftentimes I found if you engage those groups in the, in like a way, it's a two-way street of feedback. Like they're going to give you feedback to make it more relevant on the ground, and they're also going to give like the team and take your message and say, hey, here's, here's the how we're going to echo that message. So easy way, you know, a lower operating budget. There's a cost to kind of get it up and running and manage that effectively, and what's a good starting point and what's a good trajectory to build it. I know one of you know, global clients. They're about 35,000 employees. Their first year, their program was 13 champions. That was their first goal. Hey, let's get a chart. Let's get 13 champions. Let's train them. And now they've got a— they're in year 2 or 3 on it. And now we're doing like recruiting and we've got kind of more swag and there's like a little moniker for the email. So there's a little bit of like clout internally. But all these things began with like an idea and like, let's just start somewhere simple and then build it. And to your point, Aaron, they've done things like translations, you know, and like local representation and then as well as language.

So, Jason, I got to ask you, Disney, Did you get to use Mickey? Did you get to use Kermit? Any of the Muppets?

I got hard nos every single time. I had so many fun ideas. And Disney is a brand protection, like, masterclass in every way. And it's because they're so successful, I think, is because of this. But they, like, their, their response was, well, Mickey would never be in that position.

What?

He would never be in that role, or Kermit would never be in that world. And I'd be like, okay, well, can we do ESPN? Like when we used to do the ESPN commercials where the players would be like in the office trying to make a copy. And they're like, yeah, no.

If you would've got Terry Tate, man, that would've been the—

It was, it's like sky's the limit. Like we had Pixar, we had Lucasfilms and everything. It was just a, it was a no. So you had to be creative, you know, and, and, and just work around it and stuff like that. We filmed at Disneyland for our training, like our CISO at the time, uh, or I should say, I think he was the VP of security, uh, Greg Wood. He was part of a video we filmed in like the, the animation hat that's at the studios. It's like one of the oldest buildings there. And so like we found ways around it, but we could never, or we never had the blessing of that would, you know, it was always, that wouldn't be in their world.

So maybe, and Disney, you're right, brand protection, brand is everything for Disney. I think I ran into it on the corporate side and we run into it with the clients. And I think anything above a Fortune 1000 client usually has a PR arm as well as corporate comms, global comms. So let's talk about building partnerships because I think a lot of times the instant answer is no, you can't do that. But I think building those relationships and getting to a compromise, even though it might not be as creative as we all want, it's a necessary investment in your time. So Jason, what's been your experience maybe as you've moved on to Sony? Did you take any learnings to get further with that? Because Sony has obviously lots of brand assets as well.

Yeah. Sony was a really great experience. You know, I went in post-breach, you know, and that was like the most notorious breach at the time. So I was in a very interesting environment and to your point, I was always looking for way to go from no to no, but, you know, and like, that's like the relationship building that I always liked. It was really having a vision and a strategy for like what I wanted to do with the program and then being able to sit with Corp Com or, I mean, I used to sit with legal, HR, Corp Com at Sony and I was like, here's the idea that I want to do. How can we do this? And like most of the times they loved it and they're like, oh, well, this could align with October or this could align with August because of this. And I think it was like the clarity and the transparency that I was bringing, um, that gave them confidence to say, I'm going to co-sign this because if this screws up, it's going to make me look bad. Right. So if you could like get them on board, so I'm always a champion of that. Also, I wanted to mention always a big fan of security champions, security ambassador programs.

Yeah.

Um, highest impact you can get if you put in the time upfront, but relationship building one-on-one, I think every program should have either like an advisory board from HR, legal, CorpCom, so they at least see what you're trying to do. And they can support you when it's in time.

Man, hold on, hold on. One more time for the folks in the back. Say that again, Jason. I love, I love that. Say that one more time.

The, the advisory board thing?

Yeah.

It's something that I've, I've always like encouraged folks, but I think if you are, if you have a program and you don't currently have a program plan and you don't have an advisory team, I think your biggest, most efficient wins time and time again is to make relationships with, you know, CorpComms for sure, HR for sure, because it'll affect training periods and stuff like that. And legal, if they're open to it, right? They might not want to provide the team, but if you can get them onto a steering committee, an advisory board, and you just say, here's what I want to do with my program for this year. I want to do this, this, and this. Here's where I need your support. And they see that and they can build, they can have the confidence that they're not going to look bad by doing it. And they give you a thumbs up. You unlock a superpower. Right, with your program. I just don't think, I don't think enough programs spend time making those relationships.

Yeah, I mean, I, I couldn't agree more. I think that we've seen the best success unlocked when that happens. So I, I think that's, that's a huge thing. And, you know, I wish more folks invest in that thing because to your point, it's like even if you get the input, you know, HR and legal could also be offices of no. And if they're aware, then it's like you're kind of greasing the skids and you gotta, gotta push through.

I hate to say it, but is it a true statement that post-breach companies typically get to more openness? Because I did see that on the pharma side after an incident, like we got a lot of support to do a lot of really cool stuff, live video, use of employees, heavy, heavy adoption of champions with support of senior leader executives. I try to push that knowledge and experience down to other companies that we help because no one likes to build a program right after an incident. It's a lot of chaos. Was that your Would that be your takeaway as well?

In my, I would say in my direct experience and what I've observed from others, 100%, you go from constantly fighting and justifying what you want to do to just being like, yep, do it. You know? And that's, I mean, it stinks that that's what it takes, but it is certainly an unlock, you know?

Yeah. Jason, kind of as we wrap up here, I kind of want to get like, give me like your concluding or final thoughts or even like your advice for like security leaders that are grappling with with either getting one off the ground or rebooting a program? What are some, like, Jason's insights?

So, I love Stu, I love Perry, and I've always called it, like, the KnowBe4 effect. I see a lot of programs in that spot where, like, they're either with KnowBe4 or, like, another provider on a 3-year contract, and it just kind of gets a little stale. It's to take a step back and assess your program if you can. I put together this tool. I don't know if you might be talking about it or not. It's, it's been a passion project for me of practitioners not really understanding the wholeness of awareness programs and what they can be outside of just phishing simulations and content. And I wanted to make a way to better understand, like, even like the latest NIST requirements that came out. There's a— it's all technical and there's a slew of like requirement or, you know, suggestions, recommendations. And so I chunked it into this, like, framework. It's called SEAT, S-E-A-T. So it stands for strategy. You gotta put strategy up first, right? And then the engage, ascend, training. And so it's an easier way to understand all the components of an awareness program, and then you can assess yourself based on those questions, and everything aligns to NIST. And what's great, I refer to it as, like, my, my Blue Apron concept. So if you're familiar with, like, the meals, the service delivery, it's like you, you go in and you tell what you want to eat, what you like to eat. It sends you a box of recipes and ingredients and tells you how to cook. You still got to do the cooking. So it's like at the end of this assessment, if you don't have a maturity baseline for your program, this can help you do it in like 15 minutes. And then you can actually plan your strategy for the rest of the year based on where you didn't perform high. So I just always go back strategy, strategy, strategy. If you, if you don't have one, work on it, you know, do it for October, do it for beginning of the year, anything like that.

Yeah.

Think outside the box, think outside the tool, because again, like I think all of us here, we use the basic tools in all the programs we do, but it's those things beyond the tool that a lot of people miss. And that's really the missed opportunities for more than just click impressions, but really workforce culture change and getting executives on board and getting champions to be that grassroots driver upwards within your program.

Assess yourself before you wreck yourself.

Yeah, I mean, it is. It's that other 90% of effort that people don't focus on, you know, they feel like, well, we got it, we got it all down to 90%, but it's like, there's the other 90%, you know, that you have to do kind of concept.

Awesome. Well, Jason, appreciate you coming on the show. Love talking about this topic. Enjoyed our conversation. Continue doing what you do, continuing to apologize, but also solutionize. Uh, cause I think there's a lot of, a lot of, uh, help that's needed out there and appreciate your time.

Yeah, Jason, this is awesome. Thank you, sir.

Yeah. Thanks for having me on, guys.

Appreciate it. Bronwyn, if you want to pop back on and let us know if we needed to do anything else.