Unspoken Security Ep 20: Is Any Security Marketing NOT Bullshit?

it's not necessarily who does this one thing better. It's where is the right fit? So I don't, as a marketer, and maybe this is a bad way to think about this, I'm sure it is from a lot of business leaders, but I don't want just any customer to give us money and then if they are not right, because that's just gonna create churn and, and frustration in the market that's going to proliferate among their networks. So my biggest concern when I think of it is, okay, we're getting business. Are they, are we retaining these customers? And if we are not, is it because we sold them a bill of goods that we didn't deliver on? Is it, or is there, you know, what's at play? That, those I think can be the most telling metrics. And that's another thing. We are constantly being measured. We want to show our work and we wanna show our value. I can get you clicks. I cannot tell you the amount of people who've said, well, we wanna go viral. I said, well, I can make you go viral, but not in the way you want. You can't create. When I've spoken to nonprofits about communications, I can't tell you how many of them say, well, how do we just create our own ice bucket challenge?

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello, and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent about 19 years in the intelligence community, mostly at NSA, been building and maturing intelligence programs in the private sector for about 8 years now. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga College. Go Zags! And I continue to be deeply committed to servant leadership. Now, this podcast brings all those elements together with some incredible guests so we can have authentic, unfiltered conversations on a wide range of challenging topics. It's not going to be your typical podcast. This isn't polished and finished up necessarily. We don't necessarily stick to the topic. Sometimes it's technical, sometimes it's not. We'll talk about culture, we'll talk about people, a lot of different things. My dog makes appearances occasionally. You know, Riley's been on. She's not in the room today, so I think we're probably safe. People will argue and debate, swear. I'm definitely gonna do some swearing. And that's all just okay, right? This, the whole point of this is think of the podcast as a conversation. It's one of the conversations you might overhear at a bar after a long day at one of the larger cybersecurity conferences, like the many we have every year. These are the conversations we usually have when nobody's listening. So today I'm joined by my former colleague and still good friend Emily Phelps. She's a 20-year veteran in marketing and corporate communications with the last 10 years or so focused on the security industry. Emily currently serves as the Director of Marketing Communications for CyberFusion Solution Provider Cyware, where she leads the organization's content, public relations, analyst relations, and digital communications functions. She's been referred to as the marketing Swiss Army knife, and having seen her in action, I think that's a pretty apt nickname, actually. Emily has both a bachelor's in journalism and a master's in public administration from Georgia State University. Emily, welcome to the show. Is there anything I left out that you want to add to that bio?

No, I think you covered, we'll get to some of the nitty-gritty in the podcast, but I'm just happy to be here because you're my friend and I've been listening to your podcast and didn't think I'd be on it, but here we go.

Well, there you go. Well, that's, I mean, that's, you know, frankly, that's one of the things we have here with the flexibility, right? Is it's not just, you know, this is not one of those podcasts where it's all going to be practitioners all the time and technical. And let's talk about this threat actor and this group and this, I mean, we do a lot of that, obviously, but I want to have a wider opportunity to speak about things in the industry. And frankly, you know, I want to talk about security marketing for good reason. So, you know, it's a big part of our industry. And so, you know, we had an opportunity to chat about it. And you're— you've been doing this a long time. I love working with you. And you're one of those people that's really honest and authentic. I'm not going to have to, you know, hear a sales pitch for an hour. Nobody wants that shit. So I felt like this was a good opportunity.

Yeah.

And today, you know, the topic today, I mean, we're going to ask a really subtle, you know, nuanced question. Is any marketing not bullshit? So, yeah, I've had a lot of people ask that question. Normally, I think the answer has been no. But, you know, that's the question I want to get into today. Is any marketing, especially in our security industry, is any marketing not bullshit? Because it's just a really frustrating—

No, thank you for having me.

No. Okay. Well, great. It's a short episode this week, everyone. I'll see you next week. We'll have a new guest on. Emily will not be back based on this. She sort of screwed everything up. No. I listen, I get it. Like, you know, no, right? So I think that's— listen, I bet half the audience said the same thing. Yeah, half the audience said the same thing at the same time, I'm sure.

So anyway, since I got into communications, I started in public relations and was called a spin doctor. And I, throughout my career, it's always, you know, and what's funny about that to me is the first thing I learned when I was still interning when I was like 19 was If you are working for a company that is doing unethical things in your field, you leave because what you have is your reputation. And I've really taken that to heart. I really have. I understand people's frustrations where and why there can be this antagonistic relationship between marketers and product and practitioners. I do my part, I think, wherever I work to kind of bridge that gap because One, I think it's really helpful to really have an interest in whatever area you're working in. I've worked for companies where, you know, I wasn't as enthralled by the kind of work. And I've also, and when I found cybersecurity, it kind of changed the game for me because I loved it. I was fascinated and there's a very low threshold for kind of bullshit. So that's the kind of marketing. That I like. I, I don't— I think if all you're spewing is bullshit, then what you're doing is marketing. You're just plain old lying.

Exactly. Well, and, you know, fine line there between marketing and lying, or sales and lying sometimes. And, you know, I think it's interesting you said that, you know, I think people find too much gray, and I think we need to—

yeah, we gotta clarify the gray area. Yeah, for sure.

Great. Well, that's what we're going to try to do today, right? And get a better understanding and help folks. You know, this is not obviously gonna be a discussion about you know, sales and marketing outright, and certainly not gonna be a marketing, you know, a sales pitch or anything like that. But I think it's a good opportunity to say, you know, what's the good? What's the bad? What can we do, right? So I think, jumping right in, like the first question, I'm a big believer in getting a baseline, make sure we all understand what we're trying to do and what the good is, right? So I mean, what are the goals of marketing? Marketing has a function. It's valid. It's valuable. There isn't a company on Earth that doesn't have somebody doing marketing. So there's got to be some reason it exists and it works. So, you know, Let's get kind of into a one-on-one of, you know, what are the goals of marketing? At least what are they supposed to be? Like, what's, you know, what's the ethical, proper way to do this? What's the structure and the goals for marketing?

Sure. Yeah. Well, the ultimate goal of any marketing function, whether it's cybersecurity or otherwise, is to reach and connect with your audience, articulate the value that your company provides, and build and retain and grow your customers. And while that might not seem like a complex task, it really is there. And there's a lot of different schools of thought of market— of marketing. So when you get down to the fundamentals, you'll hear a lot of people talking about the 4 Ps of marketing, and that's product, price, place, and promotion. Those are really the fundamentals. Now you see a lot of kind of newer marketing influencers, experts kind of trying to redefine what those fundamental pillars are. But I really subscribe more to the— I think I've told you before, the Mark Ritson school of marketing than the Gary Vaynerchuk. Gary Vaynerchuk is far wide, I'd say more widely known among non-marketers. But I'd also say that a lot of what he focuses on is really just a very small niche. And I wouldn't consider his approach to be a very authentic, applicable view. It's very bombastic and, you know, he makes a lot of like very simple statements that aren't easy to back up where I think the Mark Ritson school of thought, which I realize I'm getting very into the weeds, is very like, but it's all about like really having a strong foundation and doing the right things and building a sustainable program that supports whether you're a business, a nonprofit, a government agency, they all have marketers, right? So I, when I'm not working, I'm also on the board of the, you know, the ADL in the Southeast. They are a nonprofit. They are trying to facilitate, you know, ending hate and start— and the reason I bring that up is you would think that would not necess— that seems like a pretty straightforward message, but it's still hard to penetrate and get to the right people when there is so much noise. So, you know, similar to how security people want to find the right, the signal through the noise, marketers want to be the signal. In the noise in a crowded market space. And when you have that, and that's really when you get into the promotion and place of like where you're gonna be reaching people, that's when you get and see some of those messages get either watered down or hyper, hyperbolic. They turn hyperbolic. And that's, I think, where you get that disconnect and that friction between, you know, a very technical skeptical audience. Not saying they shouldn't be, you know, and a very kind of enthusiastic marketing function. And it's really, there's this need to start speaking the native language of the audience. And that's a, that can be a hard thing if you're not super passionate about learning because it, it moves so quickly. You can't just, you know, read Intro to Cybersecurity and, you know, call it a day. Oh.

No. Yeah. The industry changes too quickly. And by the way, for anybody out there who knows who Gary Vaynerchuk is or knows him personally, feel free to pass along. I would love to have Gary on to rebut everything Emily said, mostly cuz he has a massive audience. But you know, I think it's interesting. He does. Gary Vaynerchuk. Yeah. And I know Gary Vaynerchuk's work. I don't know him personally by any means, but I follow him. So I, I know who he is. And to your point, I don't know who Mark Ritson is. Now I do now cuz you mentioned it to me and I've looked him up a little bit and I'm fascinated by it.. But I didn't, you know, it sort of makes the point. Gary Vaynerchuk's very much out there. You said, you know, kind of bombastic. He makes a lot of big statements. He's got a big audience and some very interesting stuff, but maybe not all the concrete results that can come out of it.

Right.

It's a, some of what he says is just, you know, it's hard to action on. I think in some cases I like the guy as a, you know, I think he's personable, but I think you make a good point in the distinction between the two styles. Right. But yeah, you know, the discussion there is, so you're trying to build this audience, right? You're trying to, create value and get customers, right? I mean, that's the goal of marketing, if I'm not mistaken. You know, you said the 4 Ps, right? It's product, price, place, promotion, right? You know, as somebody who's been on the marketing side a little bit now, you know, I do intel, I do marketing, I do a little of everything it seems like these days. I've always been in a lot of these meetings where it's like, all right, we need people to know we exist and we need people to know what we do.

Sure.

That's a good start.

Yeah, it's nice, right? And we need them to know what we do and then we need them to know why we're different, the differentiators. To make them wanna see us and value proposition and those things come into play. And the goal was, if I'm not mistaken, is to build the audience, right? And to build, I guess in funnel, in marketing, what they call top of funnel. Like for those of you not in marketing, I'm learning all sorts of marketing stuff over the last few years. This giant funnel and top of funnel is basically everybody in the world who might fall into the funnel and be a possible customer. And then you kind of dribble your way down, bottom of funnel and you get to talk to salespeople and hopefully you write checks and people make money, et cetera. And your lives get better as a process.

Right.

So, you know, this big top of funnel piece is, is what you're going for. But, you know, where does the challenge come in?

That's part of it.

Why is there so much pressure that it just becomes, like you said, hyperbolic? You know, I, I mean, I, like I said, I remember when claims used to be sort of reasonable and now it, it seems like most marketing campaigns, these big ad campaigns, you read 'em and you're like, man, that's, who believes this anymore? Like, we stop all threats.

Right.

We don't, we don't. So, you know, how have we gotten to that point and who's believing it? You know, what are we gonna do about that kind of stuff?

Right. So, with cybersecurity marketing in particular, with cybersecurity, there is a real problem to solve. And unlike a lot of industries, it's not necessarily competitor versus competitor that you can only think about as a marketer. You're also thinking about the industry, you have to think about the industry as a whole and that there's an adversary. As well, good, bad, or otherwise, there is, there are individuals and networks and groups of people who are working together to prevent your security. So I think that purpose-driven industry makes the message important. Not that it's not in other industries, but I think that it is a very purpose-driven audience. It's not, it's expensive because it's difficult. So this isn't about impulse shopping. I'm not, you know, marketers in cybersecurity aren't trying to get you to buy a candy bar by the register at the grocery store. Nobody's ever gotten fired necessarily for buying a computer, but if you buy, say, 10,000 of the wrong computer or, you know, millions of dollars of the wrong services, you know, there are a lot of consequences both internally and externally. And I think the challenge is, you mentioned the funnel, you know, Behavior, human behavior is really hard to track in a consistent way. Now we try to make sure, you know, you know, when you're reaching the most people, you're thinking about awareness when you're, and this is all of course after a bunch of, you know, research is done to make sure not only that your messaging is right, but that your product is right. You're looking at your competitors, you're looking at the audience, you're looking at how the industry is moving. And as people start getting into that consideration phase, which is growing in its complexity because more people are involved, you want to make sure that you are talking about your product, you are clearly identifying how you're different and what you can do and backing that up with proof. And then in the decision, you know, when people are starting to make those decisions, you want to be accessible so that— and have that foundation of credibility and trust, which are maybe no more important to any other industry than security, with buyers, with peers, that show why you should be considered and get kind of into that. That's when you're gonna get more into that kind of one-on-one conversation and one, or one to few as opposed to one to many, that gets really into the details and needs to really clearly articulate what you do and how it's different and what you solve for the person who needs your services or products in general.

Products. Yeah.

So marketing really has to be this cross-functional team that works with product, with engineering, with business leaders, cuz it's very easy, especially as companies grow, for marketing to become this fragmented group where every, where people are kind of going off on their own and we want everyone to have a cohesive message that's rooted in ground truth. And that was something that I learned very early on. Like you need to have a cohesive message that is clear. No one's going to see your ad once and give you $2 million. If that were true, I would set up a billboard tomorrow. And I think where, you know, to kind of get back to your question, we are competing against each other. We are competing with Google algorithms and social algorithms, all who incentivize this impulse click behavior. And we are seeing that some of those bombastic messages work. To your point, what we've talked about, Gary Vaynerchuk, excellent brand builder. People know who he is. If you really— if we really looked at who has produced more effective marketers, more business people, I don't know that he would come out ahead in that one. And that's where I think marketing has to really align to the goals of the business and to the goals of the security community at large. And that's hard. You want security, you know, marketing people can learn cybersecurity, but you're never going to have a marketer be as much of an expert as someone who's worked in as a practitioner or in the space for 20 years. So there has to be a lot of open communication. And I think what happens is a few things. I realize I'm just throwing all this at you, but I think you run into a lot of challenges to get everyone on that same page and not let the enthusiasm you have as a business of what you think you can do turn into these hyperbolic messages. You know, you have internal audiences too, and you know, your founders, your leadership is extremely invested in the success. And believe in the product, as they should. But you're dealing— that's not who you're trying to reach. You're trying to reach someone who's much more skeptical, and you have to show your work. Show, don't tell. Like, you really have to lead with that mentality and, you know, manage expectations for a lot of internal stakeholders that these messages— yeah, it worked for big companies when they came out with it early, but you can't just steal and repurpose and expect the same outcome.

Right. That makes sense. I mean, that's— no, that's fine. At least that's what we have editors for. But no, I think it's all really good content. It's all good content. And it makes sense, right? I mean, you covered a lot of, you know, pieces that are important on this. I think you might have jumped in a little bit to the next question I was going to go to, which is fine. I mean, these kind of all, you know, mush together occasionally. But I think you've made some really, you know, good points there. Frankly, that last point that you put in there, the last couple I thought were really interesting. Listen, you can't just repackage somebody else's, you know, work and get the same results. Don't expect that. First of all, they did it first. Their company may be different than you. Their product or service might be different. You know, Nike had wonderful success with Just Do It. I'm pretty confident nobody else could just come out with the same thing and get the same result. That's not how it works. You know, it's, so I think that's important to know.

Yeah. I would like to see another shoe provider come up with the slogan.

It's almost identical. If they do, it probably comes out of China. I mean, it might be done. Right. It might be done in China. Like they might've done it there and, you know, and whatever the biggest manufacturer of shoes in China is may have had the same campaign, but But you can't do that, right? And I think the other piece, I thought you hit on something really interesting that you went through really quickly, so people might have even missed, is, you know, the owners, right? Your leadership team. They're all really invested in this, right? And so they have an opinion, but they're also not the audience. So being able to find that balance of, hey, how do I put together a campaign and a messaging campaign and work with sales and work with these organizations to have authenticity and to have accuracy throughout? And have it be, you know, compelling enough that we think it'll work well in the market and bring an audience, but still be truthful, you know, and please our internal audience. Because while leadership might not be the audience, they are the one that write the checks and they won't let things out the door. And I've seen a lot of conversations where you get going and then, you know, the marketing team's really excited about it. Maybe the CMO is, and then the CEO goes, well, wait a minute now, let's do this instead. And they add like 68 different words to it that change everything. And they're like, well, hold on, we don't actually do these things. Yeah, but just tell them it's very exciting. I'll bring them in and you're like, whoa, whoa, that's a, that's a problem, boss. And then you end up going around in circles with the boss to try to find that middle ground of, well, what's truth? And, you know, what's, what are facts? And where do we want to define those things?

And what matters to your audience? I mean, I remember specifically at one company where we were trying to establish a new category and we wanted to say we were leader in that category. Well, nobody cares if you're a leader in a race no one else is running. And that's, I mean, and it's not, that's a bad idea, but I think there's this resistance to having any sort of vulnerability that you're building something new and that's different. So you can't be the established leader in something that doesn't exist. I mean, like, it just doesn't mean anything to anyone.

You can say it. How dare you?

It, it'll read on a, like, you can try, you, you try it and see how well it resonates.

I found you're a useless human.

The thing is there's a lot of ways, there is a lot of ways to, there are a lot of ways to pressure test this messaging. You can do focus groups, you can do surveys, you can have an advisory board. The challenge is those things take time to do them right. They often take resource money and they had, and they're seen as a cost center, not an investment. And they're really an investment. You can do all, you can get all the data you want. Through, you know, in terms of quantitative data, it won't really give you legitimate validated insights into behavior. That's something you need to do that takes a little more effort. And you, there are a lot of companies that have this like, well, if I don't have the ROI, then I'm not gonna invest in it. And even like I said, like the Mark Ritsons of the world are like, well then you're missing a lot of opportunity. And you're not building sustainable growth. And that's what I would like to see a lot of leaders really adopt this idea of sustainable growth. We know we wanna grow fast. We know that the market is moving fast, but we don't wanna just make, we wanna make an educated guess. We don't wanna just throw stuff to the wall and see what sticks. And you know, sometimes you have to do that if you, and if they're, you know, cheap or, you know, inexpensive tests. Do it. But if you really, if you were gonna go big, then shouldn't you make sure that the people you're trying to reach can relate to what you're saying more than you just like the sound of it? I write a lot of stuff personally. I would not use that language with a technical audience necessarily because it's not that, they don't care about those words or that, that message. So, you know, that's why I always say like, it's about listening first. Listen first. It's slow. Or there was some article or book called Don't Just Do Something, Sit There, because you have to like take that time and understand what you're trying to, not just what you're trying to do for the business, but what someone wants from your business, if anything.

Right. Yeah.

Yeah.

Our job is supposed to solve, help people solve their problems. Right. So you gotta know what the problem is first. What, Or at least what they perceive the problem to be. So, so it brings me to the next question. Again, we've jumped, jumped into some of this already, which is great, but you know, we talked about like the purpose of marketing really in detail, I think at this point, but knowing that, like, why is marketing in the security industry specifically so damn hard? And therefore, why is it so full of bullshit? Like, I mean, I've got my ideas, obviously. I've been on multiple sides of this. I've been a customer, you know, in the financial space, on the vendor side. Both, you know, outwardly helping people buy products and services. I've been a customer within a vendor, which is, you know, kind of all the above. I've done, you know, intel, I've done marketing, I've done all these, you know, bits and pieces. And, you know, to me, you know, I always see the hardest part being that it's just, there's a lot out there, right? It's a busy industry. There's a lot of really cool products and services and tools. And differentiating can be really difficult. You know, in all honesty, you pick a category and I could probably give you 3 or 4 vendors and say any one of them's good. Well, why am I gonna choose one over the other? I don't know. I mean, it's gonna depend on you. Maybe you like the look and feel of this. Maybe you like the process of that. Maybe it integrates better here. Maybe you just like working with these people more than the other ones. But functionally, they're probably gonna be pretty similar. There are very few sections in our industry where I think there's just a world-class leader and then everybody else is just way behind in the pack, right? There's a lot of really good technologies. But I mean, is that part of it? Is that what, you know, I just asked, like, is that what makes it so hard and so full of bullshit? Is that part of it? What else is in there that's making this so difficult to get?

I think there's honest stuff. That's part of it.

Mm-hmm.

Right. I think that can be part of it. I think there, there's a lot of things at play as to why you see a lot of bullshit. Some of it, and I would say that this is the smallest percentage, is that some people will say anything to win. I don't think that is the majority. The, I know a lot of people in marketing across cybersecurity, across other industries, and not one person I have worked with and liked working with has adopted that mentality. But I do know people who have been willing. I've also worked at places where I've seen competitors literally steal stuff from our website, rebrand it, put it on theirs. They're right. There are people who will do those shortcuts and that stinks. The majority of it comes from a few different things. We've touched on a few of them is that you're really balancing all these stakeholders and too many cooks. It's not good. There's also these, there are knowledge gaps when you're talking about a very fast pace evolving industry that is also young. This is not manufacturing where some of the fundamentals haven't changed in 100 years. Of course, manufacturing has changed. There are technologies and changing, but I just mean overall, we've been manufacturing things a lot longer than we have been stop it, trying to stop breaches and cyber incidents. So you have these technical gaps. I am certainly not the first to say, marketers in cybersecurity need to really get to know the product and really need to get to know the industry. And I'm not saying everyone needs to get like their CISSP, or maybe there's a better certification, but you have to, we have to know when, not only when we are writing stuff that sounds bullshitty, but if we are being told stuff that sounds bullshitty. And again, I don't think that this is intentional. I think we have a lot of people make mistakes. Human error is a thing. And even in, whether it's product or engineering, if it, if people are talking past each other or if we're just really excited about the possibility of something, is it really able to do what you think it can do? And are, or are we overstating it because the marketers don't know any better? Because you're not gonna have a 20-year veteran of both marketing and cybersecurity in one. So it really, there is a shared responsibility to make sure that what we are saying is accurate. Now, there's also, you talked again about the funnels. When you're trying to talk to people broadly, you really have to broaden the message. So it is gonna, we are in a way as an industry all trying to solve the same problem, not the same way. Obviously endpoint security is not gonna be the same as like, as threat intelligence and other technologies and other solutions. Excuse me. But if you— we are all trying to enable either businesses or organizations or healthcare companies, uh, and entities, critical infrastructure to operate without interruption. That's what we're trying to— we're trying to stop the adversary from disrupting business life as we know it.

Mm-hmm.

Stealing IP.

Everything.

We're all trying to do that. So, Right. So, and that's what people are, when you're thinking of, people are trying to come up with these bold statements that catch your eye that, you know, don't get, you know, downgraded by the Google gods, but that still resonate with someone. You're trying to like, you know, so there's, there are all these balancing acts. You wanna talk to people, but you have to talk to Google. I mean, there's, if, if you have the greatest product and you're on page 3 of Google, no one's gonna find you. You're dead. No. Yeah. I mean, so, so there, you're, it's all these balancing acts, you know, and it's a lot of different opinions. I always say people need to have like a tiger team, especially if you're trying to kind of infuse, which I always recommend, a personality into your brand. Nobody wants to talk to a robot that just sounds like a bullhorn for their message. People are not receptacles for your sales pitch. That is not what people are. People are concerned about what they have to do. And if you can solve a problem, the, the best thing to do is not say, well, I can solve it in 5 minutes if you can't. A bait and switch is never gonna be a sustainable way to grow your business. But if you can illustrate that you understand what is getting in their way, and if you can do it the way that they speak or as a human would talk to another human, that goes a long way. I mean, so if I'm ever trying to do something kind of funny, like not making fun of breach victims or punching down at people who've been like, you know, victimized by online, like criminals. But if you can kind of poke fun at some of the frustrations that we all can relate to. I think that goes a lot further than saying we stop all breaches or SOAR is dead or whatever like next thing, you know, we all know it's an evolution. And I, I think we get in our own way sometimes when we're trying to please our internal stakeholders while still, and thinking of all these different audiences with one message, we really have to get much more strategic and much more You know, we have to stand up when we say, when someone says, no, I want you to say that we are number one in this thing. Are you? Show me.

Right.

Does that matter? Does anyone—

and I think you made a good point, you know, which I've seen, you know, challenges with for others in the past. You know, you mentioned that you need to be familiar with the product, right? That marketers really should be familiar with these technologies because I think one of the challenges you can run into is, so you got a product team, right? And they've got a job to do and they've got KPIs and they've got all these requirements, right? And they've got promises they've made to whoever, the CTO or the chief product officer or the CEO or whoever. We're going to build this thing and it's going to do all these things and it's going to have all these capabilities, right? Well, they may start ranting and raving about how great this product is. Hey, we've done it. We've achieved our goals. You know, here we hit our marks. All okay. But does it really do those things? It's in their best interest to claim victory, to stay on task and to stay on time, et cetera. Even if they maybe think, well, it might do some of those things, or it does it, but it's super unstable. They won't mention that part. Right? So they're going to talk about how great they've done and how great their product is. Not always, by the way. Some organizations work just the opposite. They're really conservative and they never launch anything. But some were going to do this, right? And so marketers need to be in a position to POC the product, to test the product, to say, okay, these are the claims you guys are telling us you want us to start amplifying and building campaigns on. Show us, like, can we get a demo? Can you show us how it does the things you're saying it does? And if product can't prove that it does those things, then maybe it's time to go back to the board and say, well, hold on a second, let's, you know, let's reconsider what our message is going to be. You know, we're not going to mute it down and say, well, we blocked 28% of the threats. I mean, nobody's going to put that out, right? I get that. But let's take a look at what we really can say we do. We'll put it in the best light, but let's not say we do all the things that we said we were gonna try to build that maybe we didn't actually accomplish just because you guys needed to do that to meet your requirements and, and make your bosses happy. I think it's important, and I don't see enough of that in my limited time, at least working with some of the marketing folks. I haven't seen enough of that where the marketing folks actually know the product inside and out, know it really well. I see a lot of Chief Product Officer, Chief Technology Officer tells Chief Marketing Officer and Chief Executive Officer, here's what we've accomplished, here's what we can do, here's what we're capable of. And then the messages start getting built. And I'm not, I mean, there's a trust that goes in there. And you'd like to think everybody you work with is trustworthy and they're not going to set you up to fail. I'm not gonna lie. But, and maybe they're not, maybe they're just being very optimistic in their interpretation of how the platform works or how the tool works or how their services deliver results or whatever it is. Right. So I think you made a really big point there that marketing teams, if you're going to put something out there, your name's on it. Right. So make sure you know the product or the service or whatever it is you guys are are putting together and that the claims that go out there aren't ridiculous, or you're willing to live with the ridiculousness. If you wanna say we block 100% of the threats, well, it's gonna be really tough when you go to the, the trade shows and that's the big sign over your booth.

If you were to say that, you're, you're legal team is gonna be, yeah, your, your legal team is, is not gonna be happy. But, and, and I don't know that's what anyone expects. I think the opportunity is there are a lot of technologies. There is a lot of opportunity for personalization. It's harder at the top end in terms of messaging, but it's not necessarily who does this one thing better. It's where is the right fit. So I don't, as a marketer, and maybe this is a bad way to think about this, I'm sure it is from a lot of business leaders, but I don't want just any customer to give us money and then if they are not right, because that's just gonna create churn and frustration in the market that's going to proliferate among their networks. So my biggest concern when I think of it is, okay, we're getting business. Are they, are we retaining these customers? And if we are not, is it because we sold them a bill of goods that we didn't deliver on? Is it, or is there, you know, what's at play? That, those I think can be the most telling metrics. And that's another thing. We are constantly being measured. We want to show our work and we wanna show our value. I can get you clicks. I cannot tell you the amount of people who've said, well, we wanna go viral. I said, well, I can make you go viral, but not in the way you can't create. When I've spoken to nonprofits about communications, I can't tell you how many of them say, well, how do we just create our own? Ice Bucket Challenge. Do you remember the ALS, the Ice Bucket Challenge? It went— yeah, that, that I can't— you can't bottle that and then just unleash it. That's not how it works. Now I can make you go viral, but you're not gonna like the outcome because the only time you can really kind of push that forward is if you do something controversial and negative, because that is what creates that impulse reaction. That is why a lot of social media is kind of a hellscape, especially. So we don't want that. We want to be able to attract eyeballs, but we— and we want to be able to show, hey, these metrics are growing. But you can also game the system in a way that doesn't support the business, and that's what I want to see people avoid. And I don't know if it's you know, with different— obviously there are a lot of factors, but I am sure some marketers feel pressure, especially in a down economy, to show, okay, well, all these numbers are going up and there are shortcuts you can take, but those don't always pan out. Meanwhile, there are other tactics you can employ that are much harder to measure,, but that are more resonant with the people you're trying to reach. Do you not do it because you can't measure it? Or do you do the—

yeah. Yeah. Well, it's a good point. And something you mentioned is, you know, wanting the right customer, right? So, you know, as you said, that might be controversial. It depends on who you're talking to. So I, and I think it is depending on who you're talking to. So if you're a seed company, you're a Series A company, most of those companies, I feel like this might be the dirty little secret in industry and, you know, maybe people aren't gonna wanna hear me say this out loud and maybe I'm, it's just my perception, I'm wrong. But my perception is you build a company, you know, your first generation customers are mostly donors. They're gonna come in and they're gonna be your beta testers and your donors, right? I mean, you hope you've built such a great product and service that they'll stick around for the long term. But I know a lot of companies that come in and they're like, all right, we're gonna build something. We're gonna make a lot of noise about it. We're gonna get excited about it. And then we're gonna learn as we go and we're gonna do it at the expense of our first generation customers. They're gonna pay us and we're gonna use that money to build things. You know, we're going to, we're going to say we're going to do stuff, but the truth is we're going to start doing it and we're going to actually build it once they give us the money to build it. And we'll keep moving forward from there. And we're going to churn that first generation. They're, you know, unwitting donors in a lot of cases. But the challenge I think that comes with that, and by the way, for anybody who disagrees with me, feel free to come on the show and yell at me if you want and prove me wrong. But for those who disagree, I think, you know, the flip side of it is if you're truly innovative, if you have a new thing that nobody's done from scratch, you're also probably going to start as a Series A seed company, whatever, right? So, right, both of those things exist. You may have the wild new amazing technology, right? You may just have something that's just coming up and you're going to claim things that aren't there so you can build the technology as you go. And so it makes it very difficult for people to know. I'm not saying don't buy anything from a seed or Series A company. A lot of times those are some of the most amazing things. But I think it's important to really be skeptical, you know, of those companies early on and really push, you know, when they have the big marketing and say, okay, really take a look at their POCs. Because a lot of them are looking for first-generation customers that can help them build to the second-generation customers. And if you choose to stay, that's great. And if you don't, thanks for your donation for the year. Your ARR was very useful and now we're gonna build something else. Whereas more mature companies, you know, as you're talking about now, you want to, I want customers that are gonna stay, right? Churn is a nightmare for a more mature company. It costs a lot of time and energy and money to save customers, right? You know, to keep them together. It's easier to, it should be easier to save a customer than find a new one. But also you can burn a lot of energy keeping, you know, customers are unhappy if you bullshit them to get them in the door and they spend a lot of time explaining to you how disappointed they are with what they bought, which is, you know, why some of them churn out, right? So the more mature company, I think you're right. I think at that point it's like, hey, we gotta really make sure our messaging ties to our product because we don't need to be churning people. We want to keep growing and growing. The first generation, you know, a smaller company may be okay with churn. So I think it's important to know where the company is in the maturity level. Or the experience level. And I wonder if that doesn't affect— and I don't know if you have an answer to this one— but I wonder if that doesn't affect how they approach their marketing strategy.

Oh, I'm sure it does. You, you wouldn't have a startup necessarily market the same way like an IBM or a big company would, because there's just— number one, you're not necessarily trying to reach the same people. So when you're— when you are a big company and you sell an established product in an established category, you're going to attract people who want that tried and true, uh, way of doing things. And it's not that startups can't do it that way, but usually when you're thinking of a startup, you're thinking of someone who wants to maybe deliver the same outcome but in a more innovative way. And there is plenty of market for that because there are people, there are companies that are tired of kind of the same way of doing things that, that treats, especially in cybersecurity, they might think of it as treating more of the symptom and not the root. And so there are reasons to, for both, and there's an appetite for both. And again, like I know I kind of dive into, we've talked a lot about the similarities between the marketing industry and the security industry, but I think one of them is just how diverse they both are in terms of the different domains and what those capabilities can do and the need to really understand and have that level of self-awareness of who you are and what your risk tolerance is. Whether, and if you're a bit startup, you have a lot more latitude. You know, that's why they, you know, I've worked at startups and a lot of time, especially early stage where you, your goal is to fail fast. And I think when you're investing in a series or a, or early stage startup, I don't think there's so much that it's, you're a bait and switch you have to worry about. I think when you are going in with a comp— you have as a customer of that startup, if at least in the ones I've worked at, there is a lot of reciprocity where you get to help shape what this product is becoming and really in real time see how, you know, how that value can evolve. And that's a really exciting prospect for some people. Others, you know, when you get to be a huge company.

Yeah.

Yeah. I mean, that's a good point. But, you know, I bagged on it. I should get the positives, right? If you do get in with that, you know, small startup, right? And like you said, you can really, you know, like you can really shape it. Yeah. No, you can really shape it. You're right. And I, you know, I've worked again, I've worked with small startups too. And a lot of times the messaging has been, listen, we're going to be here for the long haul. We want to be partners with you. And the advantage of working with a company like that, it's, I think it's about expectation management. All right. If you come in and go, hey, listen, they're new. They're trying to do something that's been done before.

Right.

Clearly it's not gonna be all polished. It's not gonna be all perfect, but we can be here and beta test with them and help make it better. And we have great influence on what it's gonna be going forward.

Right.

We can be a partner going forward. And the good news is if you stick it out, if you're able to do that and go, hey, we'll go for the bumps in the road. First of all, you get a better deal price-wise. Usually that company will raise prices on others, but you'll be fine because you were in first. And, and you have a chance to really, you know, shape that product in a way you couldn't any other way unless you built the company yourself, which you probably can't do. So, I mean, there are benefits. To going with these smaller, newer, innovative companies, just as long as the expectation management is there. If a company who's seed round, they're brand new and they come out and say, we've solved it, this problem that nobody's been able to solve for years, we, you know, trillions of dollars have been spent on it, we solved it. I'd be very skeptical of that. I'd certainly have the discussion, I suppose. And maybe that's why the marketing works, cuz it's enough to get your attention and get you in the door.

Right.

But I'd be very skeptical of it. But if they come in and go, hey, listen, we have a new idea on how to do this. We've had some success in it. We really think there's promise here. We want to work with some folks together as a team to develop this next generation technology that's going to revolutionize things. Then I think you're like, all right, cool. Do I want to be a teammate with this? You know, do I want to be a partner on this as we go forward? Maybe even a partial investor in this. And everybody ends up being on the same page going in as opposed to the startup that just says this wild thing. But it seems to work. The shiny object, you know, people show up and go, oh, let's throw money at that. They've, you know, you get the right lawyer leader goes, well, they said they've solved it. Why are we wasting money on these expensive guys? We can go this guy who's cheap and new and they said they've solved it and they get sucked into being that first generation investor for somebody. Accidentally. So I mean, I think that's, I think that's really interesting.

And it can happen with large companies too.

Yeah, totally. Oh yeah, it can happen with anybody.

Listen, there's plenty of people that'll spit out bullshit if you let them. Yeah.

Yeah. I mean, AI is a good example.

Listen, sure.

Just let's just sit and talk about generative AI for a while and all the amazing things that AI is doing. And AI has changed the world and it's all great. And I can still pick an argument with most of these chat, you know, bots very quickly and get them to just go totally off the rails. Or give answers that just are wildly inaccurate. You know, there's great potential in this technology, but those who've said that's it, we've solved it, the world's totally different now, it's going to take everybody's jobs away, and, and, you know, it isn't. All right. There's a long way to go. People and generative AI together are going to be superheroes, I think, but, or supervillains. But AI in itself isn't just replacing all of us. But boy, you wouldn't know that if you read the marketing. You wouldn't know it. You'd think it was over. Like it was over for a bunch of us. We should all just, you know, walk off cliffs like lemmings because there's nothing left for us to do. The machines have won and we're done for.

Click, baby.

Click. That's right. Well, and you can see it. Like, I mean, I know it's affected marketing. You know, people are saying, hey, we don't need to hire marketers. We'll just have AI write, you know, copy for us and write ads for us. I fear it tremendously in the Intel community, in the Intel space. I've seen people talk about it. End-to-end automated AI intelligence. You don't need people anymore. You know, the AI can read all the stuff. It can analyze all the stuff. It can write your answers. And it's all going to look, feel, and smell like Intel. It's just all bullshit. It doesn't have any of the confidence language that goes in there. It doesn't have any of the sourcing in there. It doesn't have the nuance. And somebody's going to take that and go, well, I can buy this really cheaply instead of all these expensive people who think they're so smart. And you're great. And you keep making decisions off that until something blows up in your face and you realize how very devastating it was to just believe that the machines knew everything.

And, you know, I think you're always going to find those. I think you're always going to find the early adopters who want to just go all in. And yeah, maybe this is the optimist in me that you're gonna see that most people approach it with a skeptical eye. I don't know if they're as skeptical as you and I are. I use generative AI in my work. I've never, and I never will just put a prompt in and then think that's it. It all sounds the same. It's got so many errors. It's, it is a tool and just like I wouldn't hand you a hammer and say, well, here, your fence is done. Like, I, that was probably not a great analogy, but like, you know what I mean?

No, I hope not.

Like, but to me, that's kind of what I'm seeing is that there's, there is a lot of hype around new technologies. There always is. There's always gonna be something. There was the EDR boom and the XDR boom, and then there's the SOAR and SIEM, and there's always something to distract you from a cohesive long-term strategy. And I don't love that. I, that is just, I think that AI can make a big difference in making a good product better. I don't think it's going, anyone who says AI is gonna replace people is afraid of the wrong thing with AI, quite frankly. That's not what you should be afraid of. And that's not what I, in my view, business leaders, and there have been some who publicly said, oh, we laid off 1,800 people because of AI. That's happened recently.

Yep.

That's stupid and no one believes it. No one believes that that is why you were laying off all these people. And I find it infuriating, which again, it goes back into that like hype cycle and that outrage machine. That is, we could talk about that in a whole other podcast if you ever wanted to, because what you're doing is, my fear is if we don't start taking it down a notch when it comes to these hype cycles, is we're just, it's just gonna become a race to the bottom. We're going to lower our standards. Like if we think that the output that AI can do can mimic the context and nuance that experience can provide, it's just, that's not how AI is. They're large language models. They're not sentient beings. It's just not the same thing. It can help you go faster.

I agree.

It cannot replace what you are doing.

Right. All right. So listen, we talked—

it gets really hard to— oh yeah.

Yeah. Sorry about that. So we've talked about, you know, we talked about the fundamentals, obviously with the marketing piece, and we talked about, you know, really some of the challenges in, in the security industry and why there's so much bullshit in it. So I like to give some hope to people, right? Some optimism. So the, you know, the third question, you know, we put together for today was knowing all this, like how can security practitioners, especially CISOs, frankly, how do they combat all the bullshit? Like how are, what do we have? You know, you're a marketing expert. You've been doing this 20 years, 10 in, in the security space, right? So as an insider, Like, what do you see as some tips and tricks to say, hey, listen, this is a way to see truth from fiction maybe, or to suss it out a little bit better? You know, what are some of the tips that you think would make sense to say, here's a way to understand what you're hearing and, you know, and how to kind of sift through it so you can make sense of it and hopefully end up with the best tools and services to get you what you need?

Right. Well, you just listen to me. I'll steal your right. Steal your right. No, I think that there's a responsibility on both sides. Sides. Like, marketing has to get— has to catch up to the technology. Marketers do. And we also have to kind of understand how we can make sure that when we are creating promotions, when we are reaching out to our audience, we are keeping our customers in mind, our audience in mind, And that things like SEO and search and these algorithms play a role in helping give that lift. But we shouldn't be writing for these machines because that's one thing that just is a recipe for just bombastic nonsense. And you know, we've seen that one thing Google has even changed with their algorithm is it really is starting to prioritize. Human-to-human language. So whenever you see like, in today's complex threat landscape, nobody talks like that. Everyone has written that sentence. I have written it more times than I'd like to admit. And now I'm not going, I, I, it just gets you started and I just cross it off. Like I just, and one of the startups I was at, they literally called me the chief bullshit officer because I would see the jargon and I would just use my little digital red pen. And I'd be like, no, you're not saying this doesn't mean anything to anybody. This is horseshit. Like, and I just, yeah, I was very fortunate that I worked with some very like open-minded, like not precious about what they sent me. And we really worked together to create like an identity that was real and kind of strip out all that stuff that gets stuck in your taxonomy that really doesn't benefit you. I think what others can do, I think the marketers have to get better at listening. We have to really start listening to what CISOs are saying. We have to start being, listening to the conversations that security practitioners are having. You can find a lot of really honest feedback if you look, and it's not a place to get defensive. It's a place to learn. I cannot tell you things I have learned when I have just gone to cybersecurity subreddits and just paid it to, not to manipulate them with my message, but to really understand what's number one, their humor. They're very funny. You, I think anybody who has a very high stress job often copes with humor, and I do enjoy that. But also, if I'm not there to sell to them, I'm there just to, sometimes I have questions and I will ask and I will be candid about who I am. Or sometimes I will just listen to like what they're talking about and get a sense of like the frustrations so that I don't do the same things. I don't wanna make anyone's job harder. I look at my job, I look at marketing's role as to get people the information they need the right way when they need it so that their jobs can get easier. Now, when it comes to How CISOs and security practitioners can do it. I, I think I've told you, I think it's similar to how you establish, you know, you know, your intelligence requirements. I think you have to have a very clear idea as to what you want. I think you have to really understand what you don't want. And I think that you can, there are a lot of resources out there to kind of help you wade through all that, whether it's analyst firms. I mean, there are, obviously there's the big ones like our, Forrester, but there's 451, there's TAG, there's all sorts. Christina Richman is one of my favorite people and she is such an open book about like how you, like what information is gonna be valuable. And there's so many of these resources available that are, that don't necessarily have a dog in the fight of vendor versus vendor, but who really want to see movement in the space go forward. And that's what I think is a really good step. I think understanding your risk profile, your risk tolerance when it comes to whether or not you want to work with a big established company that may do things in a very rigid way, it may not, or one of these disruptors and try and do something different. And, you know, it's about having, asking a lot of questions, the proof, You'd mentioned the proofs of concept. Really, don't be, don't shy away from asking questions both of your audience, of your networks, of different vendors. Think about things in different ways and what it's, and what the outcomes are you want. We think a lot about in the short term and I get why. And the role of a CISO is extremely hard. And this is another thing I think is very common with marketing that I've talked about is You're trying to prove something. You're trying to almost prove a negative. Like, I am— this program is why we didn't get breached. This campaign is why we had this amount of business. Like, it's not easy. So there has to be a lot of outcome-driven questions and a lot of, um, of kind of synthesizing what all this marketing means, trying to get past that and get into— sometimes it's just about getting on the phone and having a conversation, which no one hates to do more than I do. I hate being on the phone. This doesn't count. This is not a phone. But sometimes it does mean that, like finding a community of practitioners or— and really kind of getting people's experiences. That's what I think. I know there's a lot of good marketers out there who have found the same kind of challenges I have. And there's some folks started this Cybersecurity Marketing Society because we are all kind of over that and want to have, want to do what I've talked about. I'm certainly not unique in this area. Like we all want to be providing value. We all want to be getting to the right people. Nobody wants to contribute to unhappy customers or a bait and switch. We want to do the right thing. So, you know, boring marketing, bad marketing, it doesn't mean it's a bad product, but it does mean we also need to reward what we consider honest marketing. You know, I talk about it across industries, clicks, their impulse control, like all of that behavioral psychology behind that kind of creating that noise is all in negative emotions, positive, you know, fear, fear-based messaging. Or now I think people have gone so far the other way to be overly confident. And I think we need to make a concerted effort to don't just give someone the business, your business, because you think that their messaging is authentic, but certainly like think about if someone is telling you something that sounds too good to be true and someone is telling you something that seems plausible, see how the— where those conversations go. And I think most of the time you'll find that, that the, the more reasonable conversation, you'll be— there will be less overpromising and underdelivering, and you'll see kind of the opposite and be able to build out a program or a relationship with a vendor that is more beneficial than just, well, I'm going to give these people my money because they say they can solve this problem. And I can't imagine any CISO really does that.

I mean, I don't think they do, but really just like buys all in. I, yeah, I don't think, I don't think anybody just buys based on the marketing, right? But I think the challenge is if we reward, I think a lot of folks reward these grand claims because listen, if you're a CISO, you don't have time, or, or security practitioner, you don't have time to, to check out 10 vendors, right? So it just seems like there's this constant one-upmanship because the bigger the claim, the bolder the claim, the CISO might say, okay, I'm only gonna pick 3 vendors. So now it's gonna be the 3 that gave the most wild, amazing claims end up being the 3 I'm willing to look at. And of course you're not gonna buy based on the claim, but if that's the claim that gets you in the door, if the key to entry is to claim you could do anything and everything and be amazing, even if it's way beyond reality. If that's the key to get in the door, then everybody's going to be using that. They're all going to be making that same claim, one bigger after another. And that company that is, you know, maybe they're boring, maybe their marketing team's not great, or maybe they're just, they're really dedicated to ethics to the point of being super authentic. They're going to get drowned out. They're going to get left behind, even though they're probably as good or maybe better or in the neighborhood at least, and they're honest and they're direct. But they're not willing to say, things they know are untrue just to get your eyeballs, just to get you, you know, to say yes to a POC or a discussion, and they're gonna get left behind. I mean, I tend to be somebody who's gotten to a point of saying, hey, listen, when I walk down the halls at the conferences, if somebody says, you know, ransomware is dead, you know, we've ended all these, whatever it is, that's a company I probably won't even bother to talk to because I know it's not true. Like, it's not a thing, right? You know, we block 100% of— no, you don't. I mean, I'm probably just gonna skip them because I've to me personally, my opinion is you almost have to punish those groups to say, hey, listen, this marketing campaign doesn't work. You've gone too far. You know, if you wanna say you're the best, you wanna be the leader and you have some stance to support it, that's one thing. To say we do 100%, you know, this threat is dead forever. I'm not even probably gonna waste my time wanting to hear your pitch because that's what your, that's your goal. Your goal is just to draw attention. You're a carny barker just trying to get somebody to the, to your booth. And it doesn't matter if it's true or not. And I feel like we keep rewarding that in the industry. A lot of people keep rewarding that mentality. And again, if you only have so much time, if 3 or 4 companies are what you have time to work with and you're just gonna pick the 3 that had the biggest, wildest claims, you know, I think that's really problematic. I know going all the way back to episode 1 of Unspoken Security, nice callback here, Neal Bridges was the guest in episode 1 and the topic was Through the Eyes of a Startup CISO, I believe was the name of the topic. And I know Neal had mentioned, he talked about vendors and, you know, smashed a few of them along the way, but he said for him, you know, he seeks out trusted outside opinions, basically other CISOs, friends, people he knows and trusts, and says, hey man, I got all these claims from all these different vendors. Are you familiar with any of them? Have you worked with any of them? Are you familiar with their products? Are you familiar with their people? And I wonder if that isn't part of a solution for this, is to say, hey, great, we all these wild claims. Let's talk to anybody who's worked with any of these folks for, oh, it might turn out, well, I've never seen their product, but I know their CMO and this is where that person used to be and here's all the claims they used to make. And you know where that company is now? They're not doing well. Or the opposite. I know their guy. Or gal, and these are the claims they made someplace else, and it was all true, and they were great to work with, right? So I feel like maybe there's an opportunity to have more of a networking as a bolster against some of these things, because I'm just tired of the claims working that get you in the door, and that's what they're trying to do.

Right. And that's where a lot of this is going. I mean, just thinking about when I started earlier in my career where, you know, kind of social media was emerging, this was even before I was in cybersecurity. If you think about where it is now, It used to really be kind of like a promotional channel. Like that's what people used it for. And to me, it's not now. It, it's all about kind of these networks and online communities. The reality is people are online. That's where a lot of people during work, after work, we have a lot of online communities and using a channel as a bullhorn is not a great use. Even I think Forrester put out a paper a few years ago that's talked about if you can't do social media, for example, correctly, then just don't do it because there's not a reason to just add to the noise. Now, I'm sure people still do. I'm sure that, you know, people want to have this presence because when someone searches your company, they are searching that you have a presence on these. But I think where it's going is creating networks. Now, I'm not saying create a street team like you're a '90s band. Like, like a college garage band. But I hang out posters everywhere. But I do think that there is opportunity to provide a more human side of your business through these online networks, like for the business. And I think these businesses have to be accessible without it going right to a salesperson. Nobody— people approach these sales calls with anxiety because they don't want this hard sell. And I'm not, and I don't think everyone does that, but there's this idea that's what they're gonna get. And so, you know, whether it's, I think companies can make their tech team available, make their executives available, give away what you can for free. I think that's always a really good strategy. And maybe you can't do like a free trial, but You know, one of the things I know that Cyware has done is they have these free tools. Like, we have, you know, some intelligence feeds that, you know, they're open source that we curate, but we are not a feed provider. There are other tools that they've built out. I— SecureWorks did that when I was there, where they created this free honeypot, because the goal is—

Sure.

Create things that are gonna be useful for the people who you want to attract. Don't expect something in return. But try and earn their attention to build that trust because right now the trust between buyers and companies and vendors is very low and it does, I don't think it has to be.

No, I think that's a good point. And, and freemium, you know, the freemium model you're talking about, which I've been familiar with too, I think that can work really well. Right. And I think organizations who wanna invest in freemium as a way to earn the business, right? Earn that trust as opposed to just going out and having these massive, you know, billboards and campaigns that just sell things that may or may not exist. I'd consider that to be a more ethical way to try to prove, you know, we deserve your business, we're good enough, we'll show you, we'll give some things that make you better right now just to prove how much we trust what we do. And for a little bit more money, you know, you can have more things. So, all right, cool. So I think, listen, we're coming up to the end on time here. I think we've, you know, done a, I think you've done a great job here of explaining what marketing is, why it's so challenging in our industry, you know, some of the things that, that can be done to make it better, both from the practitioner and CISO side, and frankly, putting a lot of the weight back on marketers to stop being bullshit artists. I mean, I think the answer to the question is, you know, is any marketing— Is any marketing not bullshit? Right. Is any marketing not bullshit? The answer is yes. I mean, a lot of the marketing is not bullshit, but there's a lot of bullshit out there. And that's the challenge we're trying to get through. And I think, you know, I hope that this has done, you know, done wonders to help some folks understand why it exists and how to counter it and how to not feed into that and maybe how to even punish organizations that are, you know, participating in bullshitting. So that we have less of it in an industry going forward. Or just not rewarding.

Just don't reward it.

Yeah, exactly. As long as you keep going, oh wow, that's quite a claim. I'm sure it's shit, but you know what? I should go check those guys out. Well, then it worked. Like, it doesn't do any good if you say, I think they're full of shit, but I'm gonna go check 'em out. Well, then that works. Yeah. I'm gonna go prove they're full of shit by demonstrating their product, you know, having them demo their product to me. Well, then they won. The whole goal was to get you to do the demo. They don't care if you did the demo cuz you're excited or cuz you think they're stupid and, and you wanna prove 'em wrong. If you're willing to put your time into seeing their product, they won. If you look at a marketing campaign and go, God, what garbage, the next answer should be, I'm not doing business with them. Like, just it. Until they give me something better. Unless again, unless somebody, a colleague or a close friend or somebody who knows things goes, oh no, they actually can do everything they say. But otherwise, I'm just going to pass on that product or service and be like, listen, that's the only way I can deal with this. I think the only way that there's an appropriate answer is no, I can't give you my time. I'm not going to come in. It's just like trolls on the internet. And I make this mistake sometimes. I'm going to prove this guy wrong. And I pick a fight and I spend 20 minutes with somebody who I don't know and don't care about to try to explain something and bring in all the facts and data, and then they just pretend it didn't exist anyway. And you just realize what a waste of my time and energy this was. My answer should have been, that guy's full of shit and everything he says is nonsense. Block and move on. And I think that's what we gotta do, you know, with some of these vendors as well. So listen, we're up on time. As I said, I wanna get to the closer question. The name of the show's Unspoken Security. You know, with that in mind, every guest, and you're on the hot seat today, every guest gets asked the same question. You don't get out of it, you know, unspoken security. So with that in mind, you need to tell me, please, and tell the audience something that to this point in your life has, you know, has gone, you haven't told other people, has gone unspoken. So what's your story? What do you got?

Okay. So very little in my life has gone unspoken, which you could probably tell, try to tell, often I talk and our long friendship, but this is something I haven't told a lot of people. It just hasn't come up because when it happened, I was working two jobs in graduate school, but I got a ticket for not wearing my seatbelt while I was wearing my seatbelt. And I was enraged. Enraged. I was pulling into my work parking deck and I got pulled over. I was like, what? I do not like— I am a rule follower. I just am for the most part. I don't like that. And he comes in and he's like, the police officer said, Well, I'm giving you a ticket for not wearing your seatbelt. And I just looked down and looked at him and it was very clear. And he said, well, I didn't see it. So he gave me the ticket. Now I'm short, I'm 5 feet tall. And I had, it was winter and I had a big furry collar, like almost famous kind of coat picture, like a Pendragon coat. So I'm sure he couldn't see it over the shoulder, but you saw it when you stopped. Do you know what I mean? What am I? Seatbelt when I like go from one part of a parking lot to another part of the parking lot. Like if I'm in shopping center and it was cheap and I was going to fight it and like go to the court date. But I, like I said, it was graduate school and it was set for when I had my hardest finals. So I was like, I'm just gonna pay it, but I'm really upset cuz I have to check this box and say that I was guilty and I was not guilty. And I was in, I was enraged. I was so furious.

Yeah, yeah, I can imagine. Yeah, it's a ridiculous— I mean, it's ridiculous, right? I mean, you had it on, and I understand, I mean, you know, listen, from the police standpoint, for anybody who might listen to this, I know people stop and then they slap their seatbelt on real quick, and I'm gonna assume he was able to see that you hadn't done that. You haven't been scrambling in your seat or whatever, you know. It's— yeah, it's a— it's an unusual story, you know. I generally don't hear—

yeah, like, maybe he didn't look.

Yeah, but yeah, I'm Yeah, I mean, who gets a ticket for things they actually weren't doing wrong, right? I'm still— meanwhile, meanwhile, I get pulled over somewhat regularly. I just got pulled over again a few weeks ago, and I get warnings all the time. So, you know, I've— I moved back to Minnesota, spent a couple years now. I think I just did the math, I think I've been pulled over 6 times now since I got back to my home state, and I've got 6 warnings.

You've not gotten a ticket?

Nope, 6 times, 6 warnings. And the funny thing is, every time it's the same story, you know, I have a clean record, of course, and so I get a warning, and therefore I can continue to have a clean record, so I continue to get warnings. I'm actually reasonably convinced it's because I'm retired military and they see my military ID and my driver's license and let me go. But now that I've said that, I'm sure I'm gonna get a ticket and get in all sorts of trouble because I'm stupid. But, but yeah, I have the opposite experience. I, I'm breaking the law regularly and not getting tickets. You were obeying the law and are a world-class rule follower and picked up a ticket that you were forced to pay. I've actually gone to court and beaten tickets that I shouldn't have beaten. So yeah, we're definitely on the opposite side of this coin. It all balances out. I guess that's how it works. Like, you know, the system all gets its money. It just gets it somehow. And I'm just on the opposite side.

I mean, it was just a $17 ticket at least. Like, if it was a speeding ticket— but yeah, no, it was— but I was— it was the principle. And if it had been for any other final, I would have told my T— like, professor, like, no, I will take it early, but I'm fighting this. But it was my hardest final. I needed every second to study, and I just could not. And it was my last semester.

So it's good prior—

good prioritization. It's not on my record anymore because this was— I was in graduate school. Yeah. Oh, but I'm still mad. You can picture my angry face. I, I don't get very angry very often.

It's very feisty. 5-foot-tall woman, just very feisty. All right, so listen, we're gonna wrap it up for today. Emily, I can't thank you enough for coming on. You know, I really appreciate it. You know, I love working with you, and you know, one of the reasons I wanted to have you on the show, it's, you know, it's an unusual topic. We haven't done a lot of marketing type stuff But I think it's important, you know, we all deal with this in the industry that, you know, all this marketing bullshit. And I thought, let's bring somebody on who's not a bullshitter and who's good at marketing to tell us, you know, what the challenges are and how we can overcome it. So I appreciate you making time to come on the show. It's been great, you know, spending time with you today. Is there anything I missed? I'll give you one last shot. Anything you want to jump in, anything we missed before we wrap this up? Otherwise, I'm going to close this up and give some folks the rest of their day. Anything we missed that you want to hit some last notes?

No, I mean, I think we kind of covered all of it. I think it's, you know, it's an evolving relationship. And I would just say, you know, as we marketers work hard to get further into the weeds of the product and of the tech space, you know, we just want to make space for where we can speak authentically and not, you know, get beat down immediately. Just let's— I think that there's a lot of opportunity. For us to work together. Basically, I just want everyone to be friends. Yes, it's a great—

this is a great motto. We should all be friends. I agree. All right, well, with that, listen, again, I want to thank you for being on the show. Thank everybody for listening and watching. Please like and follow and subscribe and, you know, leave good comments. If you have, you know, great things to say, I'd love to hear it. If you have negative things to say, you can keep them to yourself, you know. But no, you can send me messages if you want, AJ@unspokensecurity.com, if you want to, or wherever you can figure out how to do it. Subscribe on all the great podcast places or come see our website at unspokensecurity.com. Again, thanks everybody for taking the time, and until next time, this has been another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.

Legends are made.