Unspoken Security Ep 1: Through the Eyes of a Startup CISO

I think that what we're witnessing through the normalization of breaches is we're witnessing a maturity of the industry and realizing, holy shit, we were wrong.

Welcome to Unspoken Security by Zero Fox, the raw and gritty podcast for cybersecurity professionals who want to understand how threat actors are leveraging the internet. In each episode, your host AJ Nash engages with various industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding security. Ultimately, the lessons learned will enable security professionals to take an intel-driven, proactive approach to physical and cybersecurity that extends past the perimeter. Let's get started.

This is how legends are made.

Hello and welcome to the first episode of Unspoken Security, brought to you by Zero Fox, the only unified external cybersecurity platform. I'm your host, AJ Nash. For those who don't know me personally, at least not yet, I'm a traditional intelligence guy who spent nearly 20 years in the US intelligence community, both within the US Air Force and then as a defense contractor. Most of that time was spent at NSA. I've worked intelligence missions fighting terrorism, human trafficking, chased war criminals, and combating threats in cyberspace. So I'm old and I've been around a while. For the past 8 years or so, I've been building or helping other people build effective intelligence-driven security practices in the private sector. I'm passionate about intelligence and security, and I enjoy writing and speaking publicly on these topics. I'm also deeply committed to servant leadership, which is why I completed my master's degree in organizational leadership at Gonzaga University. Go Zags! The goal of this podcast is to bring all these elements together with some incredible guests and have authentic, unfiltered conversations and debates on a wide range of challenging topics most of us are faced with every day. This will not be the typical polished podcast. You might hear a dog barking. People might swear. We may have heated disagreements, and that's all okay. Think of this podcast as the conversations you might overhear at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually just have when nobody's listening. So today I'm joined by Neal Bridges, another intelligence community veteran who's now the CISO at Query.ai. He's also the host of the Cyber Insecurity Stream and a good friend of mine who won't hesitate to tell you he has cancer. So Neil, as you're battling cancer and beating that and everything else, can you tell the audience a little more about your background and all the things you're working on today, man?

Absolutely. AJ, thank you so very much for, for your introduction. Thank you very much for your service to our country. It is awesome to be joined with a fellow veteran. Name's Neil Bridges. I'm currently a CISO at Query, but like AJ, I spent time in the service as well. Spent 10 years in the United States Air Force. As a network warfare operator, which meant I spent a considerable amount of time with the National Security Agency being the proverbial state-sponsored hacker on behalf of the United States government. I also helped build the Air Force's first functional training program as it pertained to cybersecurity, specifically offensive security that trained a lot of the hackers that ultimately went on to work at the agency as well. And since being out, I've done a litany of cybersecurity jobs. I've built red teams and penetration testing teams. I've helped build an MSP practice to $5 million ARR. I've worked for a Big Four consulting company. I've built security teams for some very, very large Fortune 100 companies. And I've done the startup thing quite a bit. And so, really enjoy, you know, doing the wide range of cybersecurity roles. And as AJ said, I host the Cyber Insecurity Podcast. If you don't know about that, that's over on Twitch. We do tons of career conversations as well as, to AJ's point, talk a little bit about the secret things that most people don't want you to talk about when it comes to cybersecurity industry. So I'm super excited to be on your inaugural podcast. I can't even begin to tell you how excited I am for this.

Man, I'm so happy you're here too. Like, you know, listen, you had me on pretty early in yours and I know I've been there a couple times. I look forward to coming back and, you know, it just, when I was going through this, I'm not gonna lie, Ben, building a podcast, you know this, right? This is hard. It's a little daunting. I've been on a bunch of these things. It's really easy to just show up with a mic and talk a bunch, bunch of crap for 30 minutes and walk away. Yes, it is. It's hard when you're on the back end. Yeah. It's so hard on the back end. Like, oh my God, I gotta plan stuff now. So this has been kind of a journey. Like, all right, what are we gonna name it? Oh shit. I didn't think about a name. Okay. Well now I gotta come with a name. Naming and you gotta have all the graphics and it's like, well, how are you gonna get guests? Oh, I don't know. I know people. Let's see if people like me or not. So you get out there and you start asking about that and all of a sudden now it's starting to come together. It's kind of exciting. I've got, you know, you're number 1 on the list. I think I got 23 confirmed guests. Wow. Wow. 25 more people have said they wanna be on, but I haven't come back to 'em yet. So I mean, that's up to 48. We're gonna do this every couple weeks. So I mean, that could be 2 years worth of shows.

So nice.

Yeah, I'm pretty excited about it, but I was really excited to have you on first. Everybody knows you. I mean, frankly, you've been around a long time. You've been doing a lot of this stuff. I'm not gonna lie, it helped me to have somebody who's a friend come on first, plus somebody who's done a lot of, you know, podcasting before, because I don't know what the hell I'm doing. I'm probably gonna screw this up today.

Well, I'm gonna ask you, I know, I know, I know you've got questions for me, but I'm gonna flip the table on you really quick.

Oh no, this is not the deal.

No, this was not what we talked about.

I know, but this is totally not part of the prep. All right, episode 1, screw me. Let's go. That's right.

What do you got? Absolutely. What is your biggest learning coming out of doing this podcast stuff?

Just so far, my big, well, my, now my biggest learning is to keep you on the script. But I should, no, I, I, I said it was unscripted. I mean, that's the deal, right? So I, I think my biggest learning so far, and again, I'm, I'm 12 seconds into the first episode, is it takes a lot of organization on the backend.

Yeah.

You know, it's, it's not as easy. It's certainly a lot easier, uh, to be a guest, frankly. You know, I show up and, and I'm an underpreparer. Everybody knows me. Like when I said, hey, I wanna do a podcast and we're not gonna script things, I really don't wanna prep. And people are like, well, of course not, cuz you're lazy. I'm like, well, yeah, that's, that's true. But also I want authenticity, but that's how I do most of my things, right? I just sort of roll up. I'm like, what's the topic? Okay, cool. You know, people ask me like, hey, you ready for tomorrow? I'm like, what, what's tomorrow? They're like, dude, we got this big thing. I'm like, oh, I don't know. I'll look at my calendar in the morning. I guess I'll figure it out. So you can't do that here. I can't just roll up and be like, hey, Neil, can you come on tomorrow and we can record a show? So that's my learning so far is this whole process I've had to go through of you gotta develop a list of possible guests and a list of topics and getting it approved. And there's, there's technical stuff and mm-hmm. There's a lot that goes into this. And the other thing I've learned, which I, I know, you know, and everyone else, there's a million podcasts. So, you know, I, on the one hand it's like, man, there's a lot of work. And the other side is how are we actually gonna matter in this huge sea of podcasts?

Yes.

But I think, you know, I'm lucky that I'm old. It's still around, I guess. So I know a lot of people and I'm lucky I know people that are way smarter than I am and way more interesting who like spending time on microphone talking to me. So good. You know, I'm hoping that this is gonna be a lot of fun for folks. I've told people. The goal was to be entertaining, you know, to be educational. And we gotta be, you know, well, let's see, informational, educational, entertaining, exciting. There were a few other words I had in there. This has to be something people want to listen to, right? This is not, it can't be a sales pitch. Yeah. People are like, I don't wanna listen to a podcast. It's just somebody selling stuff. That was the first thing I said. I'm not doing, this is not infomercial. It's not Ron Popeil. I'm not gonna be selling food dehydrators for 30 minutes or how amazing and wonderful Xerofox is.

Sure.

I'll talk about us a little bit, you know, the sponsor of the show and I do like my company. We do some cool things, but this isn't going to be a sales pitch. That's right. I'm not hiring salespeople on, you know, this is about, like I said, those conversations. It came to me frankly a while ago and full credit goes to a couple of friends of mine who I can't really talk about right now, but we had talked about doing a podcast possibly. And I said, you know, it came to me as one of those discussions after one of those conferences I was talking about. We're sitting there. I'm like, man, this would make a really good podcast. Like we have all these conversations. You and I have conversations on the phone. On a microphone, you know, at these bars, whatever. And everybody does this. There's always great conversations where we say shit we really mean and care about. And then you get on stage and half that stuff you don't talk about. Ah, no, I can't say that. Or, ah, it's not really, you know, gonna fit with the corporate model or whatever.

That's right.

I was like, what if people got to hear all the stuff we actually talk about? You know, and, and, and the times you argue like, I'm gonna get one more beer and then I'm gonna tell you how wrong you are for 28 minutes. You know? And then people do that, right? And I was like, all right, well let's, let's make that a thing, right? Yeah. So, you know, I'm really excited about the chance to do that. I, I gotta, I gotta admit one plug. I'm thankful, you know, Zero Fox is giving the opportunity. They're paying, like, this is not free. So that was the other thing I learned is like, you know, it's not super expensive to build a podcast, but it's also not inexpensive. So I'm thankful that, you know, I work in a place where people are like, yeah, man, go do your thing. You know, this is what we, we want to contribute to the community.

That's right.

And we're gonna talk about, sure, we'll talk about some technical stuff and we'll talk about, you know, fighting bad guys and we'll talk about security and intelligence, but we're also gonna talk about culture and we're gonna talk about, You know, equality. And we're gonna talk about real life issues and trauma and hell, we'll talk about cancer. Like we'll talk about real shit, right? That we're all going through. Yeah. And how it all mixes together. Cuz this is, this is about, you know, our lives in security, not just what's the next cool platform and when's AI getting blockchain to solve all my problems. And oh God, you know, there's, that's all in there someplace. I'm sure. I'm sure I'll have somebody come on, some Brock blockchain bro will explain to me why I don't know anything about blockchain. And you're gonna tell me all you know about NFTs, cuz I know you love 'em.

I was gonna say, I was like, you want me to start, you want me to start that trend?

Well, that's not this episode. We'll do NFTs in a different episode. I'll have you come back. I'll have return guests. I got like a 2-year waiting list. So we'll see you, we'll see you in 2026 or something.

That's right.

No, no, actually we should talk about, so today's episode, first guy, first, first episode, first guest. So, you know, the working title we went with on this one was Through the Eyes of a Startup CISO. Now listen, everybody heard your background. I talked a little about too, Neil, you could have been on the show for a number of things. We could have talked about NFTs. We could have talked about military service, could have talked about culture, we could have talked about, you know, like I said, startups, you've worked at major healthcare. There's a lot of things you could be a weekly guest on your own, but you already have your own show and you're fighting cancer. So you're pretty busy. So, and you have a job. So, but what I wanted to focus on one for this episode, you know, through the eyes of a startup CISO, right? You've done this before from all these different, you know, levels. So I said, you know, I want to really understand like, what are the similarities and differences across CISO roles right now? What's it like to be in a small company versus a, you know, a big company or a startup or a, you know, a large international, you know, all those things, right? So for those who don't know, I should say as we start in this, the format for this show, by the way, is gonna be super simple. There's 3 questions. That's it. Like we didn't, Neil will vouch for this. We did very little prep. I did have a prep call. I'm an adult. We had to agree on a topic and then it was like, here's a couple questions I'm thinking, man, don't gimme your answers. And that was it. So there's 3 questions. Granted, there's gonna be one closer at the end. So 4 questions for those listening. But that's it. Like, this isn't scripted. I'm going to ask, I have no idea what Neil's going to say. Maybe I'm going to cut him out of this show and you're never going to hear this, but let's just knock out the first and we'll see where it goes. Then we'll kind of riff and see how it happens. So the first question I had down was like, what's the hardest part about being a CISO? Like, especially at a startup, but what's the hardest part about being a CISO, man?

And I answer this question with a little bit of context because I still consider myself a very technical person, right? I've done a really good job throughout my entire career of maintaining a lot of my technical chops, right? I still do TryHackMes. I still, you know, peruse the, the bug bounty, you know, boards every now and then. I'm obviously on my stream. I've built honeypots on my stream and, and, and done, done a lot of technical work. And so I, I consider myself, I mean, hell, at the startup that I'm at now, I literally am everything from the CISO to the analyst. And so, and I've always been like that. Like, it's, it's something I've tried vehemently never to lose as I've gone up the corporate chain. But I can unequivocally tell you that as my eyes have changed focus. I know that we're, I know you probably can't relate to that because, you know, you've, because I can't see anything, because you can't see anything.

For those who don't know, I'm getting eye surgery soon, both eyes, neither of them work worth a shit. So, but I don't have cancer. So I'm ahead of you there.

That's right.

But yeah, I can't see anything. So as you were saying, you're switching your focus.

Yeah. You switch, you switch your focus around. And I think that as I got out of the Air Force in 2013 and moved through various roles in cybersecurity and moved up that corporate ladder, And that lens has changed very, very much to realize that when you're young and when you're highly technical and when you're tactical on the ground, when we talk about technical and tactical and being in that day-to-day fight, whether you're an incident responder or a pen tester or an auditor or an analyst or, you know, an associate at a, at a Big Four consulting firm, like there's a lot of idealism that happens in our industry. Oh my God, why didn't you just patch this? Why didn't you do more user awareness training for the help desk at MGM? Right? Why didn't you, you know, oh my God, there's a new zero-day out, all hands on deck. We've all got to patch this immediately. Like there's a lot of idealism that happens early on in your career. And I was guilty of it, man. I remember the first time I talked to a CISO when I got out of the Air Force and I was talking to them about nation-state hackers, because obviously I'd just come from the Air Force. I'd just come from both defending against nation-state hackers and conducting nation-state operations. And I'm talking to a CISO about nation-state actors and he's like, I don't care about this. This is not, this isn't important to me.

And he's probably right.

Yeah. And it blew my mind. I was floored. I was like, how am I ever going to survive in this organization when they don't care about the things that I care about?

But the thing is, the funny thing, he was probably, like I said, he was probably right. And I've talked about this. I'm going to talk about this in some other episodes coming up too, but You know, a lot of organizations, I'm, I'm, I'd love to know, you don't have to spit names out here or anything, but I'd be curious who that CISO was because I have, I have a lot of opportunities that have been the other side of that where people are like, hey, I wanna know everything about this all the way down to the detail. I'm like, why? They're, they're a nation state. You can't do anything about it. Yeah. Like, why are we chasing this rabbit hole all the way to the end so you can find out this person's home address and what organization within that government they work for that you're never gonna do anything with?

Never.

Never. You can't hack 'em back. You can't arrest them. Is this, can you find out like it's a budget thing or something? I want to wow my boss so I can get more money. Like, all right, you hired a bunch of spies and you're not doing anything to keep your org safe, whereas criminals are stealing every dime you have in the bank. That's right. So he was, whoever this was, was probably right on. But yeah, I can imagine the shock for you coming out of the government. This is what I do and they don't give a shit.

Yeah, it was. And, and, and I think that, and I think that as I, as I grew up into the different roles in cybersecurity, and this applies for both my time at Query as a, as a startup CISO all the way to some of the larger organizations I worked for. And, and I talked a little bit about this when you, when you, when you air this, there will have been a stream this morning. I talked a little bit about this this morning where my, my reality for that, for me really came as I sat in a room full of finance people and we were talking about pay no pay. And this is obviously on the heels of the MGM ransomware stuff. 'Cause you've got, and I talked about this, is you got a tale of two casinos, right? 'Cause you've got MGM and you've got Caesars. And you've got MGM who chooses not to pay, and you've got Caesars who chooses to pay. And I can remember that that moment for me, that growth moment for me really came to a head as I sat in a similar room with a bunch of finance people who were asking me my advice, and I was advising them not to pay.

Don't pay. God, don't pay.

And they looked at me and laughed, AJ. They laughed so hard and they said, Neil, they said, if, and I won't rat out the CEO's name.

Sure.

If the, if the CEO is about to go to the street to deliver the financials for the street and his laptop gets encrypted with ransomware.

We're paying.

There is no end to the amount of money that we're paying to get that laptop unencrypted.

And pay the ransomware groups. That's the target right there.

Just so you know, I was like, I was like, okay, this is reality now. It is about risk management. And I think that's the hardest part as a CISO is realizing that that at some point in time, your priority and the business priorities are so far away from each other. And to realize what that distance is and how quickly you have to close that chasm. And I've had Joel Fulton, you've met Joel before on our stream. And he said it best, right? Do you want to be right or do you want to win? And realizing that the role of the CISO is about winning together as an organization for the goal of protecting the business.

Mm-hmm.

That's the goal of a CISO, not about being right.

Oh, that's a, I mean, that's a really good point, right? And, and yeah, Joel's a really, really smart guy. Smarter than you, frankly.

But that's, I'll give you that one.

I'll give you that one. Yeah. I'll have to get him on the show at some point. You were like my second choice. Joel wasn't available, but, oh, okay. Yeah. Don't tell anybody I said that. So, no, I think that's a really good point though, right? Like, do you want to be right or do you want to win, right? Yeah. And, and, and it is interesting, you know, listen, I'll also tell people all the time, don't pay the ransom. And, you know, full disclosure, I'm prepping for future shows. One of our shows is actually gonna be on this topic specifically, like whether, whether you should or shouldn't do that and maybe whether it shouldn't be legal. But I've said the same thing. I'm like, listen, don't do it, but, right? There's exceptions everywhere. Yeah. I understand why hospital systems are gonna pay 'cause people are gonna die.

Yeah.

The example you gave. Yeah. There's a point, there's certain critical moments where I just, just pay it. Like it's just, it costs us less than not paying it. Right. There are gonna be exceptions. In general, I think the rule of thumb is don't pay the ransom. You do just become a target for more ransomware. But at the same time, yeah, there's exceptions to every rule, right? Which I think is really interesting. So, but I think you made a good point about it. You know, it's, it, do you want to be right? Do you want to win? Right. CISO is a hard job. They're, I don't know. I haven't yet to see one yet who's got more resources than they know what to do with. Right. No CISO has ever come and said, my biggest problem is I have too many people and I have too much budget. I just have so much time on my hands right now.

I'm bored.

Right. That's not happening much. A lot of, I don't sleep. I get a lot of that. A lot of CISOs I think next to the presidency, the CISO is the job where you age the most in 4 years.

There, there was a recent, there's a recent study that come out that talked about the amount of burnout, the amount of mental stress that CISOs have been under, the amount of CISOs who have utterly vacated the industry altogether because of the stress that they're under. And it's, it is insane.

Oh, it's true. I mean, look at you, Neil. You've been a CISO and Neil's only 12 years old, folks. So you can see what it does to you. But no, it's, it's, it's a hard job, man. I got, I remember when I first got in this industry, in the private sector, right? And my first gig, I won't name it, but anybody can look on LinkedIn and see where I used to work. And, and I saw the CISO and I was like, man, that would be the job to have. This guy, I mean, he runs the world. It seems like he makes a ton of money. Yeah. That was driving a Ferrari. And now I look and go, yeah, I got no desire to be a CISO. That's, that's, that's a brutal gig. I don't know if you could pay me enough to do it. You know, it's, it's, you could, by the way, by the way, if somebody's out there looking for a CISO and you think I'm qualified, come talk to me. You can't pay me enough, but it's, it's a lot of money. So, all right. So, so the takeaway anyway, hardest part you said, you know, is, is just making sure that understand the difference between like knowing when you want to win or whether you want to be right.

Yeah.

Is it different in a startup versus like other, like you've been with giant international companies. Now you kind of, we kind of ate into the second question. The second question was gonna be, you know, what's it like being a CISO to vendor after all your time on the other side of the fence? And I think we'll still ask that question because there's a difference there, but I'm gonna expand it a little bit. And so. You know, talk about what it's like, you've been a customer side, obviously.

Yeah.

You've been in the government space.

Yeah.

You've been in healthcare, you've been around, right? And you've been in startup and, you know, now you're at a vendor, of course.

Yeah.

Yeah. So, you know, can you talk about the differences between those kinds of roles? And then, you know, let's, with this question, I would like to roll back to the vendor specific, 'cause I know there's some very interesting takes on how people think of vendors in the CISO space, but, you know, talk to me about the differences across these different roles.

Yeah. So, you know, It's, I think that everybody understands that, that a CISO, or let's just, let's even go even more macro than that, right? You know, a Fortune 100 company has a different set of priorities than a Fortune 1000 company, than a Fortune 5000 company, than a small to medium business all the way down to a startup. Like I think, I don't think that that's lost on anybody, but what I do think, and it gets back to kind of some of our mentalities that we have in the industry when it comes to Oh, well, you know, everybody should be doing cybersecurity. Everybody should be involved in cybersecurity, but I don't want to pay for us. I don't want to pay for a CISO. I don't want to pay for cybersecurity. I'm an SMB. Who's going to— there's— we hear all this time, all the time, who's going to attack us, right? We're an SMB, you know, and then you've got, you know, well, I'll just let a third party handle that. Like I'll hire insert MSP here to take care of all that stuff for me. Right.

Right. That'll work.

I think that, I think What I would say is, is what makes Query different, and this isn't, you know, this is what has always attracted me.

Plug Query a little bit. It's all right, man. Give it to me.

No, no, no, no, no, no, no. This is, this is cultural. This is more culture than it is company related.

Yeah.

When, when Andrew and Dheeraj first came to me, who are the co-founders of Query, you know, they came to me because they realized that they are a security startup. They want to be in the security space. And so how important is it for them to be in the security business if they don't have a CISO, right? Right. What image does that set forth if they're trying to, to put forth that they care about security, that they actually genuinely care about, you know, providing, you know, some type of product to security organization who's going to evaluate them for third-party risk management, is going to evaluate their code from a SaaS perspective. If they don't actually have a dedicated CISO function, And so I think that that has helped make, you know, the case as to why you'll see certain startups who recognize that like, hey, this is an expense that if we want to be taken seriously in the audience of the people that we're trying to market to, we should probably invest in this early on because I make no qualms about it. I'm very grateful that Query at the stage of funding that they're at has decided to hire a CISO and invest in having that security posture. It has paid off. We've done some amazing things. We've had some huge milestones that from a startup perspective are really, really unheard of in a startup. Things like achieving levels of compliance that help us, you know, get new customers, streamlining the third-party risk management onboarding process with a lot of enterprise customers, which if you've been on the vendor side, you know, is a huge giant pain in the ass. And, and so, but on the flip side of that, right, once they've made the decision to hire a CISO, and I'll kind of put this in perspective. Well, you mentioned some of the big companies I've worked for. My bet, my biggest cybersecurity budget was $50 million for a large healthcare organization.

Did I get any of that money? Did I? Were you a customer of ours? You did.

You did. You did. When you, when you were at the, when you were at the other Threat Intelligence company.

Yeah. Yeah. Got it. All right.

Good. Yeah. Yeah. Yeah. You guys got some of that money.

Yeah.

And I mean, Splunk got a lot of money too.

I bet they did. Splunk got a lot of money from Cisco in the last 24 hours or so from what I saw. So they're doing all right.

Yeah. So, so—

Any of my Splunk friends out there, congratulations.

I know, right? Speaking of Ferraris.

Right, right. They all have one now.

And I can definitely tell you that like you, and this is part of, this is part of being flexible, not just in cyber, but also if you're a practitioner or a CISO, or you're a director in the space, you have to realize that like, sure, it's really nice to have a huge budget. Like it was great. It was awesome to have $50 million. And I mean, you know, I've been in lots of conversations with vendors and it was like, listen, I got a checkbook. You got to wine and dine me if you want to like, you know, you know, hit me up for some of this money. Like we got to know that there's something really, really important going on here. Right. And now on the flip side of this, I'm having to do like everything with open source, right? I'm having to beg, borrow, and steal for $5,000 a year for a, for a managed detection response., you know, solution or $5,000 a year for, for an MDM solution, right? You know, anything like that. And so like, there's a huge mentality shift that comes with, you know, I've got money to burn and I'm going to spend it on cybersecurity to what are the priorities that I need to do for this startup that says, what are the things that get us a minimum baseline acceptable security posture for where we're at as a company to move forward? Because as a startup, as many, maybe you go, maybe, you know, maybe you don't know. At a startup, everybody, everybody wears 50 hats. It does not matter how many people you are, everybody's wearing 50 hats.

Yeah.

Yeah. And so like, I'll, you know, I can't just like poke the dev team and be like, hey, you know, we've got to do this on the app because it's part of this compliance or because we just had a pen test and do this because that dev, that engineer, he's wearing 50 hats to get that first million dollars or that first $2 million or that first X million dollars. For us to be a valuable company in the industry. And so I think a lot of that has been a lot of the growth that I've had is in terms of like juggling plates or juggling spinning plates on sticks.

Mm-hmm. Mm-hmm.

To take everything that I know should be right from my days of Big Four consulting to having a, a huge budget at a, at a Fortune 100 company and saying, all right, how do I do this with table scraps, with less than table scraps?

Right, right, right. Well, so here's a question for you then. So all that really, really interesting stuff, by the way. And I think it, I think you made some good points there, especially for a small company to have the, you know, balls to say, hey, listen, we need a CISO, right? If we're going to be, if we're going to be, and maybe I should have picked a better, better word than that, but if we're going to be credible, you know, we've got to have the spine. I'll go spine. That's a better word. We got to have the spine to say, hey, we're going to spend because this is credibility. Like we can't be in the security space and not have a CISO. Guiding us on what other CISOs need. And otherwise we're just out there just selling stuff, right? So I think that's very, very cool. So here's a kind of a sub-question. This is not question 3 yet for anybody paying attention. We're still on 2, but do people consider you a real CISO now? Like if you're in a vendor, are you a real CISO? Are you just a guy with a CISO title because they need to sell stuff and they want to have a CISO on board? Or are you still considered a real CISO?

This is, this has also been super eye-opening for me because I, I had always known tangentially that this would be a reality, but I thought that it would be easier for me to, to fight against this. And I'll tell you a real, I'll tell you where it really hit me. And it really hit me last year at the Gartner conference. And, and not because it's Gartner, but because, you know, we were, Quirrell was obviously gonna go to the Gartner conference. And if you've ever been to Gartner, right, you've got the main track and you've got the CISO track, right? And the CISO track is very networking-centric. You get to spend a lot of time with CISOs.

Were they all shunning you? Nobody wanted to talk to you now?

That was, that was exactly what Gardner, Gardner shunned me. Gardner was like, no, no, you can't participate in this chat.

You're not a true CISO, you're just a vendor with a title. They didn't want you in there selling to them, they thought.

Oh man. Oh man. It was brutal. It was brutal. I was like, I was like, hold on. Are you telling me that I have no value because I work for a vendor? You tell me the vendor can't have a CISO that actually represents security CISO interest and therefore you're just going to shun me from the community? Oh man. It was. It was the, the amount of, I eventually got in, but the amount of strings that I had to pull, the favors that I had to call in to get access to that was something I was not prepared for at all.

And as a reminder, you've been prior to, to this, you've been a CISO for how many years? I mean, I lost track of your resume. You've been, you've been a CISO for not, not one or two. You've been a CISO for quite a while at big companies, large pharmaceutical companies.

Yeah.

Like, yeah, you've, you know, you've been a real CISO, right? But it's funny, you're a vendor, suddenly you're, you know, persona non grata at those events, right? You know, 100%. And I've experienced that as an Intel guy too, not nearly to that extent, but some. Yeah.

Yeah. But I mean, it's, it, and so like, I think that that's, that's been, that's been the hardest part of my job is that you do get that vendor title tagged to your name. Uh-huh. And I'll tell you like, and you'll appreciate this because you've been on the vendor side longer than I have. I've got friends now who, if I were at any other company, if I were at any other company, they'd pick up the phone for me and they would talk to me right off the bat. As soon as I worked for a vendor, the amount of people who stopped talking, who stopped answering my phone calls because they're like, oh, Neil's just going to try to sell me something. I was like, wait a minute. How do you even know?

Yeah. Yeah. If it makes you feel any better and you're right, I've been in vendor space for a while. Right. So when I, when I left the government, I worked at a bank at first. So I was, I was not vendor. And I only did that for about a year. And then ever since then, I guess I've been on the vendor side, right? And you'll get there very quickly if you haven't already. I'm lucky that people still answer my phone calls, but it's because everybody knows I'm not gonna try to sell them anything, right? You know, it's, you can be in the vendor space or you can be salesy in the vendor space. And you know, it's funny, one of the goals of this podcast, in fact, is I've said I don't want salespeople on the show. Yeah. I'm not putting people on with sales titles generally. There'll be a couple exceptions. I have friends who are like CROs, but not salesy, right? But this isn't a show to sell people stuff because nobody wants another damn sales pitch. So, and you're, I mean, if you haven't already, you probably already have overcome it, but if you haven't, you will. It's people start to recognize, no, this guy's actually not going to sell me stuff.

Yeah.

He works for the vendor, but he's, he's the same guy he was before, or she's the same gal she was before. And they just want to have a conversation. And once they, they get their hackles backed down, then you have these open conversations. Right. But I went through some of that at first. People like, man, I'm not here to buy anything. I'm like, dude, I'm not here to sell anything.

Yeah.

I just, this is a Burger King, man. I just, I almost got to grab, just got to grab lunch. I'm not trying to sell you anything. It's all right. You know, it's just calm down. Like, put it away. Like, I didn't even bring any laptops in. Sure, I'll happily introduce you to sales later if you want, but that's not my gig, right?

I've even, it's, it's even, it's even manifested itself a little bit to where I've, and, and I've, it took me a while to get over this. It doesn't happen much anymore. It did happen at the, at the beginning stages when I started at Query last year, where when people ask me like, how's it going at Query? I take pause and I'm like, Okay, what do I say that doesn't sound salesy so that I can make sure that I convey how's it going at Query without somebody thinking that I'm trying to sell them on Query?

Totally.

Totally. And I mean, yeah, that mentality, I was, again, I was not prepared for, not prepared for it at all.

Yeah. I've been there. People ask me and you know, it's like, all right, how are things? Bad, dude. I love my job. I like the place I work. People are great. I'm on a microphone right now. I mean, this is awesome, right? Somebody's paying me to talk to a friend of mine and they're gonna record it and it's gonna be useful. I love it. You know, but I don't come in and go, oh, how are things at Zerofox? Well, dude, let me tell you about our entire platform from left to right and everything we do, which is all great. I can go on and on about how we're, you know, very proactive and deep in dark web to the reactive and incident response and breach response. But I don't like have that conversation, you know, over coffee usually. Right. But, but when people have to figure that out, right. And sad part is, I don't know if you had experience, but for me, when I first started doing it and each company I've gone to, frankly, it's tough early on because I'm still learning the pitch. And so I have a tendency to fall into that discussion because I'm learning this information. I'm like, oh dude, you gotta hear this new thing. And you go off for 2 minutes. It's like, no, no, dude, I, I didn't mean to sell you anything. It's, I'm learning the information and I think this is actually very cool, but I'm not actually trying to sell you. I'm not, because you get through that and I'm sure you've had it. You're like, you get 5 minutes in, they're like, dude, I don't have any budget. I'm like, I'm not, oh shit, I didn't even realize I was selling you. I didn't, what was my plan? I don't care if you have budget. I'm just excited that we do stuff. Like, you should meet the guys we have in the deep and dark web. They're, they're freaking amazing., but you know, I don't, I'm not trying to sell you on it. I'm just telling you this is a great place to work and I love my gig and I love my team. Right.

That, but that right there that you just, that, that you just described, that's, that's the current challenge that I'm on because, and, and again, back to, to, to the point, you know, I'm working for, I, I've never, I've never not worked for, and this is something, this is very cultural. This is very career-minded, right? I've never not worked for some, someplace that I wasn't passionate about the mission.

Yeah. Yep.

Right.

Same way.

Like if you look, I could, I could name, I could name very specific things about every company I've ever worked for that where the passion has driven me and there's no difference in it here. So I've experienced exactly what you're talking about where it's like, how's it going at Query? And I'm like, oh, let me tell you like this thing that we're doing that I'm so passionate about, which was what led me here. And then you realize like, I promise you that was not a sales pitch. I'm just incredibly passionate about this.

Yeah. Oh God. The number of times I had to go, I, I swear I'm not trying to sell you anything.

Right.

But I'm like, yo, listen, I've yet to, you know, knock on wood. I haven't taken a job for the money. Like, don't get me wrong. Let me be clear. People pay me to work. Yes. And the day ZeroFox stops paying me, I promise I will stop working.

That's right. That's right.

I do it for the money, sort of, but I've never taken a job just for the money. I, I came here cuz I was passionate about what the company was doing. Like they, they sold me on the idea, which was true. And I really liked the vision where we're going. I did the same thing at the last two companies I was at., you know, before that and before that was the first one coming outta the government space. So I'm like you, I, I wanna be passionate about this. I think most people do. People want to know what they do matters. It's meaningful. Yeah. It's important. They wanna have some passion. And I've been very, very lucky that I haven't yet had to take a gig where I'm like, oh God, this job is meaningless. Yes. And I hate it. Not since like high school. Yeah. I worked at Dairy Queen once upon a time. Let me fake, let me tell you, I love ice cream. I love, I'm passionate about that job.

You look like, you look like a Dairy Queen worker.

I look like I, I look like I spent a lot of time at Dairy Queen, not necessarily working there. I definitely spend some time at Dairy Queen still. All right, cool. So let me, let's see, let me move on. We got one more question here. So, you know, the big thing, I mean, we've been going through all this, right? You and I have been doing this a long time. So that's code word for old, right? We're old. Yeah. Between the military and the government space, you know, in the private sector, like we've had, we've got, I don't know, 40, 50 years of experience, something like that. So here's the question, man. And, and I, I, we, I ask a lot of people this, but How are your sleepless nights today different from the ones you had in these other roles? From the ones you had, say, 20 years ago, right? 'Cause I mean, sleepless nights come with the job. I, I'm notorious for a guy who doesn't sleep much anyway, but yeah. How, how are they different now than they were, say, like 20 years ago?

Oh God.

Ah, you didn't prepare for this one. I can already tell.

I, I didn't, I didn't prepare for any of these.

I know, I know. You're like me. You're like me. Just figure it out. Let's go.

Yeah, like, like you want it natural, AJ. This is what you get.

That's exactly right. I told people that. Don't edit it. Leave it in. No, I want the ums and the ahs and the, ah, that's a hard question. I want all of it.

You know, the world is, world is obviously, and I think, you know, this is, thank you, Captain Obvious. It's obviously vastly different now than it was 20 years ago. It's, that's, that's it. That's easier to say, but it's mind-boggling to think about, right? And, and, and I deal with some of this with my coaching sessions and my mentorship sessions and even the chat that I get on cyber insecurity. Right? When people ask me questions about like, Neil, Neil, do you think AI is going to take our jobs? Like the, like, I got this, I got that question 2 years ago when we started Cyber Insecurity and I'm, and I'm, and I'm, and I'm, it's exponential now that ChatGPT is a thing. Right?

Right.

And, and I, I, you know, again, we're not going to talk about NFTs and blockchain, but there was a time where like, I wasn't, I wasn't a fan of NFTs and blockchain. And then there was a shift that happened that made me go like, okay, this technology has potential. And the same thing has happened with AI and the same thing has happened with cloud and the same thing has happened with a lot of the stuff that's out there. So I think the crux of the question really boils down to is I think the sleepless nights continue to be sleepless because the rate at which the world changes around us, the fact that in cyber, the world doesn't stay safe long enough for you to adapt to the status quo.

Oh, that's so true. Like, is the world ever safe, right? I mean, is— yeah, when was the last time there was? But I think so interestingly with that, maybe there's also a flip side of numbing, you know. Do people lose sleep or do they get past it? So, you know, you mentioned MGM and Caesars, a couple big breaches going on right now. Some of this is 5 years from now, they'll be like, oh, that's old news. But you know, those are massive deals, right? And they're in the news and they're, they're making a big deal, but there are breaches every day. Yeah. That would've been the top story 5 years ago, 10 years ago.

Without a doubt.

And we just shrug 'em off now. Like, it's just like, oh, yep, that happened. I mean, I'm, I'm finding myself as an intel guy who's supposed to care about all of this stuff, and I do to a point still care and pay attention. But the last, aside from these now, the last couple of breaches, somebody else had to send me something like, hey man, What do you know about this? I'm like, I didn't know anything about it. I'm not even paying attention to it right now. Now, for anybody listening, I no longer actively run the intel team. I promise you the intel team was paying attention. So just to clarify, so anybody doesn't run away from us, I helped put some things together and, and get people on the right track. I'm not operationally running the intel team anymore. Adam and Olga and that group do, and they were the ones who asked me, so they're brilliant. But, but, but it's funny. I mean, I have people aren't even in IT now, not even in security, friends, relatives. Like, what do you know about this, Mike? I don't know anything about it. I'll go look now. Because it's just, it's constant. Or they get very panicked about it. I look, I, I just shrug and they're like, what do you mean? I'm like, yeah, that's, that's how things work. This is, this happens all the time. This is normal. Like, this is, well, so how do we avoid the numbing instead of losing sleep? Just going, eh, everything's owned. Just go get a good night's rest.

Well, and, and this is, that's, that's, that is a very, very interesting and good question because like, I think the, I think the problem is, is that, you know, I think we're going to see the maturity of the things we care about change continuously as we see more normalization of breaches. And that's still a weird thing to say out loud, right? Normalization of data breaches. Like, I'm sure that there's going to be a cringe factor that happens. Like, oh my God, did he just use normalization of data breaches in the same sentence? Yes, he did.

That's going to be the blurb for this show is Neil Bridges says data breaches are just normal now. That's going to be, that's how I'm going to open up with this. That's how we're going to advertise this one out there. Neil Bridges says, don't worry about data breaches. It's all normal.

Well, I mean, it is. I mean, that's not an unfair statement because like, I think that there's a split. I think that there's a split in the industry where a lot of us have come to that acceptance that that is reality. And I think that this is idealism we talked about before. There's a lot of people like, no, no, we will get to a utopia where, you know, if people would just patch and if they would just train their help desk to not answer, you know, phishing, you know, telephone calls. Totally.

That's not gonna happen any day.

Yeah, it'll happen in a day. And I think that what we're witnessing through the normalization of breaches is we're witnessing a maturity of the industry and realizing, holy shit, we were wrong. Nobody will say it out loud. Like, you want to talk about a stream where we talk about the quiet parts out loud? Nobody will say that we're wrong. Because you are wrong about patching. You are wrong about compliance. You're wrong about GDPR. You're wrong about CCPA. You're wrong about NIST. You're wrong. You're wrong. And you're scared. You're scared to admit that you're wrong because you made money on it, because you told people they would be safe, because you told people it would work, because you, you attested to their certifications. And I think that, that as a, if we look at cybersecurity as a being, as a person, as an entity, I think that that's the mental reality that we're starting to come to grips with. And so I think that The fatigue is the reality that we've all been screaming at 1,000 miles per hour that all of these things are the things that we need to do to be safe. And we're seeing zero change and zero difference in the industry. And we have no flipping clue what to tell people because none of it is working.

Now, to counterpoint, I don't disagree with that.

Absolutely. Absolutely.

But to counterpoint one small piece of it, some of the things that aren't working, it's because people still don't do the things we tell them to do. You know, patch prioritization would, would be useful if people actually did it. You know, having a CMDB and knowing your environment is really important. But if you get on, I've gotten on stages around the world and said, you know, by a show of hands, tell me everybody who's confident in their CMDB. And everybody just laughs. Like they just accepted that, oh, my CMDB is garbage. I'm like, why, why, how do you not know your own environment? This is just basic Sun Tzu. You don't even know yourself. How do you, why are you worried about even knowing the enemy? Right. Or, you know, passwords. Well, password reuse is still a huge problem. Passwords, every time there's a breach, there's a segment of the passwords like password123. I'm like, are you kidding me? Is somebody still doing this? So people are a big part of the problem. People don't seem to be changing their behaviors and they're expecting different results. Or frankly, a lot of users don't expect different results. They just don't care, right? It's not their problem. It's somebody else's problem. The IT geek will figure that stuff out. It's his problem. He can sleep. Yeah. Never. Because I don't feel like having a hard password. And a lot of those people are the executives. Right? A lot of people we find that don't follow the rules are the ones who are supposed to be enforcing the rules. And then you find out they get breached and it's their stuff that's garbage because, ah, it's too hard to actually do it because it's not user-friendly. So they do their own thing and then they get breached. So, you know, there's, there is an issue in that. Yes. In most cases, I think you're right. We, we, as an industry, people have come up with answers, turn out to be wrong answers, but the right answers still aren't being enforced. Now, as a self-serving person, I'll point out, I've said Intel's the right answer and I don't think anybody's proven that one wrong yet. If you have Intel, If you know about bad guys before they do something, that is still the best plan. It's just expensive and metrics are challenging, but it's still proven to be true. And I mean, that's why it's true in warfighting. It's true in the government. It's true out here. If people put more, more money into intel and prevention, they'd probably do better for themselves. But that metrics beast shows up and then sometimes can't, people can't explain the metrics well enough.

Yeah.

So I, I got one more piece with this. So you mentioned it briefly. You talked to like ChatGPT and AI and all that. You know, it's, is AI gonna take my job? Right. And I will say, I'll preface this before before I jump into the question, but, and this is by the way, a sub-question to question 3 for those who are scoring at home. We're still on the same question, but you know, when I got to the agency, I got to NSA in 1999 because I'm fucking old. And so I got there in '99 and I remember I'd been on, you know, I'm excited. I'm a young kid and ooh, I'm in the agency. I'm an intel guy. And I remember very early on people were like, oh, enjoy it while it lasts, kid. Cause you're all going to be replaced pretty soon by machines. It's all going to be automated. We're not going to need all you people anymore. It's all going to go away. That was in '99. It's 2023 now and there's more Intel analysts today than there were then. So I'm not remarkably concerned about being replaced by machines, but that's my opinion. How do you see the emerging technologies, the ChatGPTs and the AIs, or what people are calling AI and it's ML, you know, it's stacked machine learning or whatever the hell it actually really is. Or sometimes it's just a whole series of spreadsheets stacked together still, you know, squirrels on a wheel someplace. Like some of it's more real than others. I will say I just had a, meeting this week with a bunch of CISOs and in there, there was a vendor pushing this small company and he's pushing his AI stuff and I was less than courteous by the end to him, as were a couple of the CISOs, because all of his talk came back to just like automated translation and it wasn't impressive. So anyway, what are your thoughts on where the emerging technologies fit into all this stuff?

So I have, I have, we're running out of time, but briefly, briefly, you should have hired, you should have brought a different guest if you want brevity.

History of the earth, you got 30 seconds, give me all of it, right?

So, so, so, All right. So I was going to tell you two stories, but since I have to break on— Tell me everything now. You got editors.

We'll figure it out. Tell me everything. Tell me all of it.

I laughed when ChatGPT blew up, right? Because, and the reason I laughed, the reason I laughed is because I remember, you remember this, I'm sure you do, maybe two or three years ago, right before COVID right? What was the big thing that was over every banner at RSA? AI and ML. Oh yeah. AI this. It was all over RSA 3 years ago. Everybody had AI and ML in their tools 3 or 4 years ago at RSA. It was, it was the Gartner leading way on how security technology is going to advance themselves 3 years ago. Yep.

Look what that's done.

And, and, and then we get to ChatGPT and all I could think to myself were the screaming marketing people who were dying in a puddle of their own despair. As they realized that they had burned all of their marketing material on AI and ML 3 years ago and couldn't use it anymore.

Oh, couldn't use it. You don't think they recycle? You don't think that's how marketing works? They recycle, or that guy's down a different company, takes the same ideas with him, changes the colors, calls it AI. Now it's ChatGPT. It's the same crap with a different wrapper, right? And, and to clarify, this isn't all crap. Don't come throwing tomatoes at me today. There's some real in this technology, but there's an awful lot of snake oil there too. Yeah, no, you're right though. I remember that, right? It was all gonna be this stuff. It was, that was the big push right before. Yeah. Funny, it's like COVID. I had to think for a minute of the before time. Yeah. But yeah, right before I remember that.

And then, yeah.

And everything got quiet cuz we were all busy at home suffering. Yeah. And then, and now it's, yeah, ChatGPT and, you know, ChatGPT is very interesting, does some cool stuff. And I've told folks this will make people into, you know, humans will become superhuman, but they can replace us.

No.

While this presentation was going on yesterday, this is a true story, and this guy was going on and on about it. I pulled up on my phone ChatGPT 3.5, 'cause I like playing around with stupid things in my free time. And I said, all right, I'm gonna prove to myself, remind myself how good or not good ChatGPT can be. Right? I was like, all right, fact of what's the capital of Utah? Capital Utah is Salt Lake City. I think two of us knew that. One of us knew that at least. I don't know about you.

I was gonna say one of us knew that.

I'm not sure if you knew or not, but capital is Salt Lake City. All right. Next question was, all right, why is it the capital? And it gives me a whole bunch of stuff, some of which was factual, some of which was theoretical on just how capitals are picked anyway. And okay, great. And the third piece was who decided on the why of making it the capital. Oh, then it just fell apart. Like it gave answers that were vague and semi-true at best. Meanwhile, I went to Wikipedia and got the real answers with actual names and dates and all this stuff. I was like, hmm, I think ChatGPT's not quite there yet.

Um, yeah.

And as I said to the guy who was giving his presentation, cuz he said, you know, he's talking about intelligence and The meaning of intelligence. He said, you know, this machine, it's, it's read everything that's ever been written. So it's, it's intelligent. I said, no, it's read everything that's been written. It doesn't understand any of it. And so that doesn't make it intelligent. It's ingested all of the words. It doesn't mean it understands any of it. You don't have a sentient platform yet. God, I hope we don't, 'cause that's gonna be the end of all of us. But it isn't sentient. It doesn't understand it. It's a really, really impressive parrot in, in his machine was at least. And that's a long way from being a human being. It can't be held accountable. It doesn't have a reason. It doesn't have gut instincts, which do come in handy sometimes and are actually valuable and important still. It's short on a lot of context. Now the technology's better and a lot better and does some things very, very well. Like you can do some summarization very quickly. You want a recipe, it's got all the recipes in the world. Like frankly, if you want a recipe for anything ever, I think you ask ChatGPT. Now you don't, if you say the best of, I don't know which recipe you'll get,, but it has things like that knocked down. It can do math equations, it can do some things really, really well. I guess it can write code. I don't know how to write code. Yeah. So I, it's already smarter than me.

So, so a lot of, a lot of things I can't do.

Go ahead.

I was, I was, I was at a, I was at a conference a couple weeks ago, maybe a month ago or something like that. And they were talking about the hypotheticals or the, the hypothesis-driven stuff that ChatGPT and other large language models that AIs do. And, and full disclosure, I'm not an AI large language model expert. I'm, I'm only, it's very, very, I would call myself like on a, on a, 1 to 10, I'm probably like a 3 maturity when it comes to this stuff, right? 'Cause there's a, there's a lot of math there and I'm kind of a dumb kid when it comes to math.

Yeah, but you're in the vendor space now. You have to pretend to be an expert.

Oh, that's right. That's right.

I don't know anything about any of this. And look at me, I got my own show talking about it now. But no, it's, we're vendors. We have to pretend we understand. But I'm with you. I, the guy I was talking to had a PhD from Stanford. Thank you. And I was like, I can't believe I'm gonna challenge the PhD from Stanford in a room full of people. I feel stupid. But it turned out the CISOs agreed with my point, which was helpful. But, so go ahead, man.

Yeah, but, but I mean, I think that that's the point though, right? Is it, it's, they're talking about, they're talking about the, the hypothesis-driven stuff that, that these large language models have to do. And they're saying that, I think the, the crux of it really boils down to cybersecurity has a huge critical thinking component that they haven't baked into a lot of the large language models or the, the hypothetical, the hypothesis-driven engines that a lot of these, these AI chat engines have. It's great at filling in things like, oh, you have to make, you know, fettuccine Alfredo. Well, I generally know that these types of ingredients are included in fettuccine Alfredo. Oh, you want to add this other component to it? I can hypothetical say, well, to do that, you kind of have to do these things together. Yeah. But we've seen that hypothesis fail. There's been a case where somebody tried to get ChatGPT to write a court argument citing court cases that have never existed. And then they tried to present that to a judge and it didn't, and it fell through. Yeah. And so I think that that's, that's the current limitation that I see, that while AI could probably help us with a lot of day-to-day a lot of the remedial type of stuff. I don't see us ever really having to worry about some of the critical thinking aspects of ChatGPT. And I tell people all the time, like, listen, if you're worried about ChatGPT taking your job, maybe you need to upskill yourself just a little bit.

Yeah, that's a good point. Your job might be too easy to replace if you're really replaceable by this, you know?

Yeah.

And some people probably will be. I had also said, you know, there was a discussion about, well, can we get rid of like tier 1 and tier 2? That's, yeah, a lot of people talk about that. Which is interesting. And I've heard Intel too. Let's get rid of those low-level Intel folks. We can just do, you know, automated data mutations, that kind of thing. And so, well, that's also, while I could give you 100 reasons why I worry about that from an Intel standpoint, even putting that aside, if you get rid of all your tier 1 and tier 2 in any career field and you say, okay, all we need is experts now. Well, where are you going to get the next set of experts from? Where are you going to grow them from? Eventually, I'm not working until I'm 80 because I'm the only Intel expert left in the house.

That's right.

I'm going to leave. And if the machines did it all the way through, are you assuming the machines will get smarter and become the next experts down the road? Because if we can't get to that point, then you have nobody. That's right. So, you know, it's, I think that's a, something people may not, it's shortsighted. And unfortunately in a world right now with economic, you know, pressures and people always wanna do more with less and save money, et cetera, this feels like the next stage of outsourcing almost. But there's no way to get the next group of people as a result. So I, I worry about it. All right. So listen, that's our 3 questions. I don't know if anybody kept counting at home. It felt like more than 3, but I promise it was just 3 primary questions. So, you know, we're, we're coming up to the end here, so You're the first person, so you're the first victim in this case. Oh, okay. But every episode we're gonna have a closing question. So yeah, you're the first victim, man. Good luck. So the closer is basically like, listen, the name of the show is Unspoken Security.

So, okay.

You know, with that in mind, tell me something you never told anybody before.

Oh geez. Cybersecurity related, I, I take it, is kind of the—

Doesn't have to be. I mean, I, I'm thinking most will be, somebody eventually is gonna confess about infidelities or murders or something. And I'll, I'll certainly keep it in the show if they let me. But you know, if there's such a thing as ratings week for podcast. I'll save it for that one. But I mean, it could be security related, you know, it could be, you know, career related, you know, whatever, whatever it is, man. Something that you haven't told anybody before though. Something unspoken.

I'll, I'll, I will, I will elaborate on something that I've kept very high level. Okay. Because I don't think that, like, there's people hear me say it at a high level and I think that they're kind of like, I think they, yeah, yeah, yeah. Gloss over. Yeah, yeah. Neil, Neil didn't go to college. Neil didn't. I, I don't think people realize just how dumb I was in school.

Okay. I should, maybe I shouldn't laugh at that. Maybe I'm an asshole. We're gonna have to cut that out later. Now it's, it's a good thing we're friends. Cause my initial response is to laugh like what a jerk, right? You're probably, this is a serious moment. You've quieted the crowd, you've whispered your truth. And I'm like, ha ha ha.

What a dick. That's right.

That's right.

Anyway, it wasn't Nelson, the guy from Simpsons.

Exactly. Ha ha. So sorry, you weren't, you weren't a good student. All right, I got you.

I'm following along now. Let's, let's, let's, let's clarify like how not good of a student I was. My, my high school class was a class of, of 350 and I was number 340 out of 350 from a, from a, a class perspective.

Good number usually. Yeah, I got you. But somebody was, say somebody was 341 through 350.

Yeah.

Like you're not alone. All right, I got you.

Yep. I failed, I failed my very, so I, so I'd been doing, I'd been doing computer work for a number of years. I've got, there's articles written about me about,, you know, webpages being, you know, you know, from the first webpages being written, I was doing work for NC State, you know, for the food science division, writing some of the first webpages. I was building computers from scratch, knowing all of that. And some of the first jobs that I had coming outta high school were, were sysadmin jobs and tech jobs. I failed my first A+ and Network+. I've never told anybody that.

Wow. Okay.

And, and, and it really, it really kind of like like it gave me a lot of doubt as to whether I was going to be a contributing member to the society for the longest time of my early years was, yeah, I did, I did not expect to be smart enough to be in cyber.

So how did you, like, did you get, it was a root cause analysis? Like, how did you overcome this? I mean, you're clearly, listen, you're very, very smart, obviously, and you've clearly done very well. So, you know, it's, this is, I think, by the way, Thank you. It's kudos. Like what a revelation. You're the first person on spot with a question and you gave a really hard-hitting answer, which I hope will help a lot of people. 'Cause listen, this industry's full of imposter syndrome and it's full of challenges like that. I, I, you and I have talked about this off, you know, off air before, you know, this is a huge issue. So, all right. You're obviously very, very bright and you've done very well, but what was there a moment? Was there a person that helped you through? Like, how did you get from, hey, I feel like I'm too dumb to be this. To clearly proving you're just the opposite of that?

It, it took, it took an ungodly number of years. Like when, when I failed, so I've, I failed A+ and Network+. I failed some of my first Microsoft certifications before I ever got into the Air Force. And, and I did not handle it very well. I, I fell into a deep depression. Mm-hmm. I was very, very recluse. I, I did not talk to friends or family. I, I had nobody. I, I was going through, I was going through some terrible times at the time. This is obviously post-9/11. The, this was the dot, this was the dot-com bubble and I had no degree and no certs. Nobody would hire me cuz they could get people with a master's degree for half the price that they, you know, were, you know, at the time. It was, it was a dark time for me where I struggled mentally a lot. You know, I, I just, I mean, you know, I'd just gotten a divorce. My, my ex-wife had taken my daughter. I had lost my house to foreclosure. I had to go beg my ex-wife to go live with her because I had no place to live. Like there was a lot that was just generally going wrong in my life around that time. And honestly, the military gave me a new foundation and a new set of confidence. And I was 24 when I went in. I was a, I was a late entry into the, the Air Force. I was 24. I celebrated my 24th birthday in basic training.

I turned 22 in basic training. Yeah.

Yeah. So you, so you know, you, you, so I don't know if you did it either. I didn't tell a soul that it was my birthday.

Oh, I'm definitely told people. No, no, I wasn't that smart. That extra 2 years must have made a world of difference. Cuz now I, I told people there's some good stories, but for those thinking about going in the military, if you're gonna have your basic training birthday for any reason, don't tell anybody.

Don't tell anybody.

Yeah.

Don't tell anybody.

Yeah.

I, I celebrated my 24th birthday under the sheets of my bunk in, in basic training and I didn't tell a soul.

I wish that were what I did.

I celebrated my 20th.

Second birthday by being down in charge of quarters with, uh, one, a fellow airman nose to nose with me attempting poorly in front of others to sing happy birthday to me while I had to keep military bearing or be rolled back. So, oh, and then I had my bed short-sheeted by, by my flight. So yeah, it was good times. I also had a, a letter from home from a friend of mine. That's if I could edit it out, but a female friend of mine who's still a friend of mine, but she, she sent me a card. I had actually called her on my birthday. 'cause I was downstairs, I was doing background investigations, so I got to call home and whatever. And I called her, I didn't tell her it was, I, I didn't remind her. I just wanted to have a conversation. And she felt so guilty after the conversation that she had forgotten it was my birthday that she sent a card. I have no idea how she got the right address to get it all the way to the right unit and everything. And I, I opened it up in, in latrine and it was like a glitter bomb.

Oh no.

Oh no. She was just trying to be friendly. It was glitter everywhere. And for those who don't know, never been in the service, a good little story for you. The, the latrines have these tiny little tiles, millions of 'em with all this grout and everything has to be spick and span perfectly spotless.

Yes.

And somebody is responsible for that. It was not me. And so I've now made that person's life impossible. Yeah. Because I have an endless supply of glitter in every little crevice and crack. So I was very, very popular for that moment.

And, and, and you were just thinking at any minute that there's gonna be a drill sergeant who's gonna come in and see a massive amount of glitter or even a speck of glitter in the grout in between the tiles. And all hell is about to break loose.

Oh God, I'm surprised I didn't get, I, I thought I was gonna be murdered. I had, I had visions of like Full Metal Jacket. I, things were gonna be very, very bad for me in a moment here. It thankfully it was not. But yeah, don't have your birthday in basic training. So, but that's interesting. So the military helped get you on track with all this stuff.

Sounds like, yeah, the military gave me an, an unbelievable set of, set of confidence. That I didn't know was possible. And, and I found a, I found a good amount of camaraderie. I found a good amount of purpose and I found a good amount of mission in being in the military. And, and it was almost like, as, like, obviously basic training is what basic training is, but once you get to tech school and you get to live a little bit more of a normal life in tech school, and you get to go to a pseudo-college type of experience where you have dorms and you have classes and you have a, a real cafeteria and you've got leeway to go out on the weekends and you realize like there's actual a support system and you've got training buddies and everybody's there to help you succeed. And, you know, everybody wants you to be the best version of yourself that, that you can have despite, you know, what's, whatever's been going on in your life. Yeah. Like, and that's, that's, that for me was when, when things started to kind of turn up for me and I, I found my true self.

That's, that's an awesome story, man. Thanks for sharing it with me. I, I can relate, you know, I, if it makes you, well, I don't wanna say it makes you feel better, it just, it's a, it's a different story. Well, you're, you're doing great. I mean, you've, you've overcome that feeling, right? And, and proven to yourself and, and yeah, the Air Force can be good for that. Air Force did a lot for me as well. I, I didn't graduate high school, so you might've been 340 out of 50, but I got thrown outta high school my senior year in April and we graduate here in Minnesota in June. So yeah, it was about, I don't know, 4 or 6 weeks before graduation. And, and to be clear, this is an unspoken, I've said this at least before, but I, I hadn't really been going and so they just sort of relieved me of that responsibility. So I, I was, I was no longer invited to attend. That's how it worked out for me. So, yeah, so I mean, it's, you know, and eventually I found my way to the military as well and the Air Force, you know, because the only branch of service that I care about. Yeah, yeah. Love all the branches of service. Please don't throw tomatoes.

That's right. Love all the branches of the service.

They're not all equal, but we're all very important and useful. It's a, it's a good system. Some are not equal as others, but we're all good. But no, the Air Force did, uh, saved me in a lot of ways too, man. So I think that's a good story. Good little recruiting pitch for anybody who's not sure where they are in their early to mid-20s and want to, you know, maybe a different sense of a way forward. All right, cool. Listen, we're, we're out of time and I really want to thank you, Neil, for coming on, being the inaugural guest on Unspoken Security. This couldn't have gone any better. I'm super happy about it. Thanks again, man. I'll look forward to talking to you, you know, both on your stream and here and just, you know, catching up in conversations. For those who don't know Neil Bridges, I highly recommend looking him up on LinkedIn., you know, and talking to, to him about what they're doing at Query AI. See if you can get on his show. His show's awesome. If you haven't, if you don't know about his stream, you should certainly find out cuz it's fantastic. You know, Neil didn't even bother to mention his cancer that I've mentioned several times, but Neil's currently kicking cancer's ass while we're having this conversation, which is pretty, pretty freaking awesome. And he's also working his way towards the senior tour of the PGA. So I mean, this guy, he's doing amazing things all the time. I couldn't thank you enough for being on, man. You know, I'll, I'll I'll have you on again as soon as I get through a few other folks, I'm sure. But thanks for being here. And, and for those of you listening and watching, you know, the first episode of Unspoken Security, thanks for taking your time to be here. I look forward to chatting with you all here again in a couple more weeks, and we're going to keep this rolling forward. So for Unspoken Security and for Zero Fox, my name is AJ Nash. Thanks again and have a good day. That's a wrap for this episode of Unspoken Security. Brought to you by Zerofox, the only unified external cybersecurity platform. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.

This is how legends are made.