Unspoken Security Ep 28: Is it All Just Pay to Play? Working with Industry Analysts

So if you're a vendor, especially a small one, you know, go and reach out to them. Just, you know, like I said, you don't have to be a client to do a briefing to show your company, introduce your company to a Forrester analyst, at least. No, no charge to do that. It's up to the analyst to decide if they have the time and if they, and some of that depends on their research calendar. So dovetail into that if you're a vendor. You probably have data and you talk to customers too. You have some insights in the marketplace.

Mm-hmm.

Try to contribute, try to help that analyst do research.

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place. Including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry. Hello, and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent 19 years in the intelligence community, mostly at NSA. And I've been building and maturing intelligence programs in the private sector for almost 9 years now, I suppose. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! And I continue to be deeply committed to servant leadership. This podcast brings all these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. It's not your typical polished podcast. My dog makes occasional appearances. She is in fact sleeping right next to me today. So if anybody comes to the door, you know, the wind blows funny, you might all get to meet her again. That's just how it works though, you know, so The point here though is that people argue, we debate, we even swear here. I promise I will be doing some swearing and that's all okay. Think of this podcast as a conversation you'd overhear at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. Now admittedly, my dog doesn't go to those usually. Today I'm joined by my good friend Brian Keim. Uh, he's an intelligence professional, served 20 years combined active and reserve service in the US Army. He's been in cyber threat intelligence for over a decade across many industries, including critical infrastructure, finance, and manufacturing. He's worked in multiple cybersecurity vendors. And the topic of this episode, the reason we're going to tell you what it is in a second, but he was also an industry analyst at Forrester leading the research on threat intelligence, vulnerability management, and ICS/OT security vendors and their best practices. Brian, is there anything about your long and distinguished profile that I left out?

Well, it's right here on my hoodie. I'm a Ramblin' Rep from Georgia Tech. Did my bachelor's there. I got a couple master's degrees too, but I don't have any hoodies from those schools. And I see you're repping your, your local, uh, big research university there too. So that's right.

University of Minnesota Golden Gophers. Now Brian didn't mention, uh, yeah, if you're going to say this, like Brian went to Georgia Tech, what he didn't mention is his degree is in architecture, which is pretty interesting if you think about it. We just talked about the background here. I've worked with Brian, by the way. We worked together. We've known each other prior to that, but we have worked together. I've yet to see Brian design any buildings. Or, you know, maybe he's got some, he and some famous architects I'm unaware of, but to my knowledge, he doesn't design buildings, but he's a damn, damn smart guy. Maybe we'll talk about that. That's not part of today's discussion, but actually I should have thrown it in someplace to talk about architecture. Actually, what today, what we're going to talk about, the topic is, isn't it just pay to play? You know, it's about working with industry analysts. And as, you know, as you mentioned, you know, and as we talked about in the opening, Brian did spend time working at Forrester. It's actually where we originally crossed paths. I've been in the industry for a while, which means you run into everybody eventually. And so listen, let's jump right into this one, Ben. So when we talk about industry analysts, like first thing, like setting the stage for those who aren't familiar with the topic, who are we actually talking about? Like what industry analysts, what organizations, you know, and a little bit about what they do.

Yeah, you're talking about companies like Forrester where I obviously worked. And there's tons of other firms. There's the big, biggest one, Gartner, which pretty much everyone is familiar with. There's smaller firms like IDC and Frost Sullivan. There's a lot of firms that are, that focus on a particular technology area where the bigger folks like Gartner and Forrester have research teams across many different personas. And so I was on the security and risk team. At Forrester. And so obviously we served security and risk professionals, so mostly CISOs, but your enterprise risk managers and so forth, anyone that was in that kind of security space.

Okay, that makes sense. And I want to get into a little more detail on this one a little further down. But so, I mean, in the, in the high level, like I've seen some of these, right? Like Gartner has what, the Wave or something like that, right? And Forrester does, I don't know what you guys do, a shiny pickleball star.

Actually, Forrester does the Wave.

Does the Wave. See, that's the issue. That's, I got to understand.

And Gartner has the Magic Quadrant. Those are the two newest ones. And every one of the firm has their own type of, of, of vendor evaluation with a name. And typically the result is vendors want to be up into the right. That, that's, that's the main goal really, uh, uh, vendors that, that are selected. From one of those research reports. But they don't just analyze and report on vendors. We do, they do a lot of best practices. So at Forrester, the biggest thing, at least from the security and risk team that folks would be familiar with is zero trust.

Oh yeah.

About 2009, 2010, predecessor of mine there, John Kindervag, started talking about concept of zero trust, how networks should not be trusted. Trusted regardless of where you are. Wait a minute.

Are you saying John Kindervag invented the term Zero Trust?

I believe he takes credit for it. There's, there's, I'm sure someone else out there would say like, no, no, it was so-and-so, or, or maybe it would raise—

well, there's always some of that.

Yeah.

Yeah.

Say it was, it was them themselves.

But interesting.

That evolved obviously into various products and services amongst cybersecurity companies. You now have, uh, the White House has a Zero Trust strategy. DOD now has a zero trust strategy. Each military branch, the Air Force where you were, uh, someone showed me the other day, the Air Force, Department of the Air Force zero trust strategy. And I hear down in corporate areas there. So my last employer, they, they were talking about doing zero trust and Google even, they've done zero trust. If you've heard the term BeyondCorp, that's Google's implementation of zero trust strategies. Zero trust is a, uh, a big thing at Forrester. It still is to this day. They, they continue to do research on it. That's way more than just network, obviously now, uh, but that's one of the bigger things that they've done there.

Interesting. I'm, uh, as you're talking, I'm over here Googling. John Kindervag really is like universally apparently accepted as having coined the term Zero Trust.

So, yep.

Oh, that's a feather in the cap of Forrester Research apparently. Do you want to like briefly for those who don't know, like, cause that's kind of a big deal. So you talk about vendors and what they do. I mean, in this case, John's words under Forrester kind of changed the industry, right? What's Zero Trust? I know we're not gonna have that discussion today. It's not the big topic, but for those who are wondering, like, I mean, Zero Trust sounds like a good dating strategy, but like, what is it? I'm just, just saying, uh, especially for some people I know. But, uh, what, I mean, so he, he coined the phrase, I assume, cuz he was working, was he working with others when he did this or was this, is this something that these vendors do? They're not vendors. These analyst organizations do their own research and just come up with their own concepts as well. Was this separate from working with other orgs? And, and like, what did you invent basically?

That, that was quite a long, uh, question there. So let's break it down a little bit. Let's define zero trust real quick. Zero trust basically is on the network side. It's all networks are untrusted. So it doesn't matter, internal network, the hotel Wi-Fi, your Starbucks, your home network, whatever it is. When we were all like in offices, you used to just trust the enterprise network. You plugged in, boom, you're on, right? You know, if you got physical access to the building, you plugged in, it's all good to go. Now, now we don't want to even trust the, the local network, right? Because I can sniff packets, I can sniff PII and PHI coming over the network when I'm in the office. Uh, VPNs are great, but VPNs can be vulnerabilities themselves. So one of the key points from the White House strategy actually is to authenticate to applications, not to networks. So it's flipping that a little bit. Where, where do we authenticate to? And conditional, like risk-based authentication dovetails on that. So new devices, new locations, whatever, you may get prompted for more multi-factor authentication prompts. MFA is Absolutely part of a good zero trust strategy. You get into segmenting networks there. So traditionally you kind of just monitored the perimeter of your network. Now we encourage monitoring inside the perimeter, controlling what a lot of folks on the network side call east-west traffic. So through your network, not necessarily to the internet. And with that monitoring, you then start to segment your network. So an R&D lab. Kind of gets its own VLAN or firewalled off from maybe production spaces. Accountants don't necessarily talk to ops or, or programmers or whatever. So you start to segment networks down, you segment identity. So if you, if you're a cloud admin, you should have a specific identity to perform those admin actions, anything on-prem. You know, unique credentials everywhere. So when one credential gets compromised, which it will eventually, it doesn't lead to a catastrophic takeover, you know, a catastrophic ransomware, right, of your network. So it's a lot about microsegmenting identities, data, networks, workloads, and everything to help you build resilience, recover easier, limit the damage from a breach. Because we're all going to get breached, of course, and, you know, Zero Trust is a good way to limit the damage, to recover quicker. So it sounds out of the news, really outta the breach news.

Yeah. So it sort of sounds like, cause I'm a dummy, so I'm gonna break it down in simple terms. The, the before times, right? When we were all in the office space, like that's sort of like to compare it to say international travel. You get to the US border, they check your passport, then you're in, then you can go anywhere you want in the States. You're trusted to be in the States basically, right? Zero trust would be like if every state you went to, they had to check your paperwork again, or every city they, like, it's like check and check and check, right? And so, you know, if they're, you know, checkpoints all the way through, but it's technical and digital and, you know, not as overt as, you know, somebody at the gate saying, may I see your papers please? But I mean, that's, that's what it sounds like, right? That's what you're describing. By the way, for those listening or watching who are pedantic, uh, like me, frankly, apparently John can argue with Stephen Paul Marsh apparently invented the term zero trust in 1994 as part of a doctoral thesis. Yes. The internet's wonderful like that.

I knew there was someone out there that would argue.

Yeah. 1994, I guess Stephen Paul Marsh. But, but then it, John Kindervag still is credited with putting it more in this context in 2010. And then, you know, now it's really taken off, taken off.

But I'll give you a better metaphor actually. That's a little more appropriate.

Sure. Sure. Enough. Give me a better metaphor, Brian.

Go for it. You spent plenty of time at Fort Meade. I spent plenty of time at Fort Gordon, now known as Fort Eisenhower. And just to get through that main gate, think about like that main fence. You've got a couple of places to get in. They check IDs, but there's not a whole lot of scrutiny there, right? You can see, see, to get a guest pass.

Yeah. Yeah.

Get on post, right? Uh, but then you get in there and then certain buildings, you know, have higher levels of security buildings that we used to work in. And you may have a different badge, a different ID to get in there.

So there's a secret handshake at the agency for those who don't know.

Little fist bump, you know. Yeah, it was a little song, that kind of thing, you know.

Yeah, go Heidi Klum.

Right, right. And even then, once you're in the buildings, then there's other segments, you know. This badge gets you into this door and it doesn't get you into that one. And then you've got to get different tickets, if you will, to get in different places and all. And so everything's very segmented. So zero trust is a little bit, you know, like that.

Okay. All right. Well, that's cool. I know that's a little sidebar, but I thought it was interesting as you're going on the path because Yeah, we talk about these vendors or, or these, I keep saying vendors 'cause I'm a vendor guy normally, the, the analysts, right? So, you know, this is part of what happens though. Like John went and did research on this and obviously again, built off the shoulders of somebody else a little bit. Maybe I'm not trying to take away from John. That's awesome. But he's the one that coined the phrase in this context and really started talking about zero trust architectures. And I mean, that's a big contribution to the entire cybersecurity industry. So it's not just about, you know, where he was in Magic Quadrants and, you know, getting ratings and awards and, and that kind of a thing. I'm, I'm sure it's some of it, but there's legitimate contributions independent of that. Yeah. Back to the, the cybersecurity community. So, I mean, I, I think that's important to note, frankly, because I don't, I don't know that a lot of people know that. It doesn't come up much.

I think a lot of people go, oh, I wish I had a concept or, or report that was as influential as Zero Trust. Yeah.

What did you write? Well, yeah. You, you did. Yeah. What did you write, man? What? Go ahead, tell me what your version of Zero Trust is. What's the awesome thing you wrote for Forrester that changed the industry? No pressure. No pressure, man. Get on it.

No, I wish, but I'll, you know, one of my predecessors, Rick Holland, uh, was the first one to start really evaluating the threat intelligence space. He was an enlisted Army intel guy back in like the '90s. And he also helped create the SANS Cyber Threat Intel Summit, which continues to go on today. He's still a co-chair of that along with Katie Nichols.

Yeah.

And brilliant people. These are people that want me to be on the show. Yeah.

Yeah.

Yeah. So, so Rick kind of started that over there and that term kind of became the, the overall kind of industry term for what you and I have spent a lot of our private sector careers doing. When I first got into what is now cyber threat intelligence, I was an IT security intel analyst. Cyber wasn't even in there for one. And then my second role at SecureWorks, I was a cyber intelligence senior. Threat was not even in there yet. And it wasn't until I was at Southern Company that threat and they all, all the words got put together. Cyber threat intel analyst finally got put together on one business card. And, and Rick is definitely partially responsible for that. But other things I wrote, one, I did the first full Forrester Wave on threat intelligence. There was a lightweight Wave years before, but I did the full, the whole process with all the checks and editing and everything. I also wrote a report called How to Operationalize Threat Intelligence in Your Enterprise.

Oh yeah, I read that one actually. I think that's how I first met you. I think that's what I came across originally was that one.

I'm glad somebody wrote it or read it rather. And because a lot of the research, a lot of the vendors at that time and everything, you know, it was IOC feeds and stuff. And, and you had some of the, the APT fuzzy snuggly duck type reports and all of that. And the industry was still a little immature. And I would like to think that it's matured a little bit. It's, it's more valuable. To enterprises than it's ever been. And then I like to think that I played a small part in that and helping the field grow and professionalize.

Yeah, no, I think that's true. Like, it's, yeah, I, it might've been that one or something. I don't remember exactly. I think it was that piece, but I think that's how we crossed paths. I've been someplace else and I was like, oh, this is really interesting. And so I think that's important that people know, like I said, that, you know, there's contributions here. I think a lot of people, not everybody, and we're going to get into it in a minute, but I, and I've been in plenty of companies where it's like, all right, well, All right, Gartner's coming or Forrester's coming. All right. You know, do we have, are we going to pay them? Like, how are we going to get represented? Where are we going to be in their quadrant or their wave or their shiny pickle or whatever their, their, the report's going to be from this, this analyst group. And I think a lot of people I work with, you know, think of them from that standpoint, which is, you know, the evaluation portion and the, the, you know, that piece matters, but I don't think everybody gathers that, hey, these are also legitimate professionals who go out and do research and write new things and change stuff. Rick Holland probably doesn't— I mean, Rick and I are friends, but probably don't love the fact that I've actually tried to reverse a lot of his shit. I don't believe cyber threat intelligence is the right term, and I've hammered that for years. Threat is a subset of intel. It shouldn't be its own damn thing. I don't— I've pushed the other direction to cyber intel, and I've actually pushed further and down and said, just call it intel. It's all intel. You know, it— just stop trying to segment it out. These are subsets.

It's intel. I didn't write a report about this, but I had vendors that came to me for advisory. And they wanted help like understanding intelligence, threat intelligence, cyber intelligence versus other things. So, and in the business world, what I discovered, there's like business intelligence and consumer intelligence, market intelligence, competitive intelligence, location intelligence. There are tons of different things in the business world that co-opted that term intelligence. And for you and I and folks that came up through government and military intelligence, it's probably a little bit confusing. And we took that and we said, oh, well, this cyber thing, that's, that's definitely intelligence. And I think we're correct. But what a lot of the other folks did is, is I think this is like a post-9/11 kind of thing where intelligence just became more accessible to the layperson that a lot of business people co-opted that term and said, well, Instead of just data analysis, now it's business intelligence.

Yep.

You know, and, and what I, what I told folks in the vendor space was all those things kind of at their core are doing some of the same things. They're trying to improve decision-making, use the data to develop some insights. Sometimes it's about consumers, sometimes about competitors. The difference between what you and I have done and what we do for CISOs and other security leaders is there's risks and threats here. And I don't know about you, but my job description as an Army intel officer always started with reduce risk and uncertainty to the command, the unit, the team, the whatever. And that's where the difference is in cyber threat intelligence, cyber intelligence, threat intelligence, whatever term you want to use. We're there to help folks make better decisions so that we don't have breaches, or if there is a breach, that we identify it and contain it and eradicate that threat quicker than we would have otherwise.

Yeah, exactly. I mean, I, I said, I know you, you've said it too, you know, get the right people, the right context at the right time to make the right decision, or at least the most informed decision. Like, I can't guarantee they'll make the right decision. Right is very subjective. But yeah, I mean, that's how it works. And, and in terms of that, you know, business intelligence, that is kind of their goal as well a lot of times. And competitive, eh, Competitive intelligence. I mean, some of it, it's in there, I guess. Right. And that's why I've been saying, listen, this is all intel, but I'm with you. Like there was a point where it was so bastardized as a term. I remember getting frustrated about it. I used to, you know, talk to people about all these things. I said, I, I, everything's intelligence, network intelligence and this and that. I said, I'm pretty sure my dry cleaner is a dry cleaner intelligence analyst now, you know, or it's, it's just everywhere. Right. It just became a thing. And it frustrated me when I first got in the private sector because I was like, intelligence means something that there's a real word to this. There's, there's definition. There's a meaning. It, and that's what led to an opportunity and how I started talking more about this stuff publicly and, and why, you know, I ended up gravitating towards people like you and others who come outta the industry and said, hey, how do we help private sector understand if you're gonna use this term, let's get it right. It makes, you're gonna, you're gonna water it down. It's not gonna make any sense anymore. This is all gonna become just regurgitated news or information or whatever. And this will be very hard to explain to people later why this, this isn't intelligence and this is, and all these structures, right? And so I don't, again, I don't think Rick's wrong. I don't think you guys are wrong with, you know, cyber intelligence, whatever, threat intelligence, whatever. I just said, hey, that's all a subset. Like threat's a subset. Just, You're complicating things too much. Let's get everyone to understand what intelligence is and then we'll just park everything underneath it as pillars. But we don't even have everyone understanding intelligence first and they're just going to willy-nilly throw this everywhere. I'm like, and that's how you end up with people who are intelligence analysts in our industry and you're looking, you're like, nope, you're an incident responder, a really, really good one, but you're, you're not an intelligence analyst. That's not what you do. Uh, you know, it's, that's just not it. And you go, God, it's hard to explain. And then anyway, I could go on that tangent, but I won't because people are tired of that. So, all right, moving on in some of the, you know, core topics of our discussion on industry analysts. So we've, I think, hit pretty hard on like, who are these people and what do they do, right? And even a little more than we thought. But in doing that, like, you know, the topic is about pay for play. So, you know, what value do the industry analysts bring to these organizations? Bring— and as the opening says, is it just all pay for play? I mean, we already talked a little bit, we hinted because some of the other stuff that's written, but in terms of interactions, between these advisory groups, these analysts and, you know, vendors or potential customers of vendors, et cetera, you know, what's the value, uh, that these folks bring and, you know, how does that work?

So the value that I brought to clients at Forrester, and those clients could be security vendors, all the big names you've heard of, could be startups and lots of large enterprises, Fortune 500 companies, manufacturing companies, finance, you name it, you name the vertical, they probably subscribe to one of these firms. And our advice is research-based. It's neutral. I don't care, you know, really what industry you are in, who they are individually, whether they are private equity-backed startup or venture-backed, if they are publicly traded. Security company, you know, they're going to get the research-backed advice, uh, from Forrester and from me personally. And I owned those three topics, threat intelligence, vulnerability management, and ICS OT security. And so my view on, on the, uh, the industry and the vendors there, you know, that was, that was like the singular voice at Forrester for those things. So everyone got basically the same Advice, you know, for threat intelligence. Yeah, you should, you should really have a threat intel team if you're like a Fortune 500 company, right?

Yes.

If you want to stay out of the breach news, you know, it's one thing just to stick firewalls and EDR in there, but you can't defend against every threat out there. And not every threat cares, sees you the same as, as a different target.

Mm-hmm.

So Intel, you know, I, I said to people, it's to help you be efficient with your security spending, with your staff. Should you be writing detections for every state nexus threat actor out there? If you are an accounting firm, maybe not.

Hmm.

Maybe, maybe you have clients that are the targets of, of those state actors. And they're going to look to breach you to steal that information, that confidential financial information there. So, you know, helping clients prioritize, spend efficiently, if their tech budgets, tech budgets are not, you know, infinite, they have caps. And especially for security teams, you know, most companies are incentivized to spend about as little on security. Possible. So, we helped enterprise clients make their vendor selection. You know, they might ask me, Brian, I've got, here's my tech stack and here's my staffing. You know, what intel vendor should I go with to maximize the value of all those things, of all those controls? And, and we talk through it, you know, maybe they need a, maybe they're mature enough to use your APT fuzzy snuggly duck type reporting and, and really design their security stack for a particular threat group that is known to target their industry. Or maybe they just need an IOC feed they plug into the firewall and the EDR and just call it a day, right? So we, Forrester analysts and similar, you know, help folks make procurement decisions.

So it's a consulting role. I mean, at least part of it sounds like it's some consulting.

We called it advisory because there actually is a consulting practice at Forrester. And all the consulting is based on Forrester Research. So unlike a, uh, a Big Four firm.

Yep.

And I'm not saying that their consulting has no research behind it, but all Forrester consulting, whether it was a longer-term project to implement Zero Trust for an enterprise client, or it was some lead generation type of project for a SaaS vendor was all backed by research. So I did, I supported a consulting engagement that was creating basically a cyber threat intel maturity model. And now years later, Nicole Beckwith and Mike from Intel 471, Mike DeBolt and a bunch of other folks got together and they created another one. And I'm, I'm so happy to see that it's, that there is something out there now, but yeah, I helped create that back in the day at Forrester. It was a bespoke thing for one client and, and I don't believe it's even out there anymore. It was like one marketing campaign and, and once it was over, it got shut down.

And you were ahead of your time basically. Like it was, it was too early for me to know what to do with it. Yeah. Cause I, I also had talked about, you know, when I was at Symantec and I talked about, hey, we need, we really should establish something that's kind of the equivalent of CMMI coming outta the government space, defense contracting for anybody who's familiar with that. CMMI is a, big deal and it had a big push about 10 years ago. Like you couldn't bid on contracts unless you were CMMI 2 level certified or whatever. And I said, we should try to do that in the private sector with Intel. You know, we had a whole discussion about it. Nobody ever did the work, you know, myself included. And so it sounds like you did the work. You're just ahead of schedule, which makes me feel better that I didn't burn my time doing the work I kept because I would have failed. And I saw the same thing when this came out not long ago. Brilliant people, good people, smart people. You know, we know most of them, I'm sure. And I was like, this is great. I'm glad it's here. I'm not going to lie. I had a twinge of jealousy, like, goddammit. Probably should have just done it years ago, or how come they didn't invite me to be part of the cool kids group? But it doesn't matter. Like, I'm glad it's out there. I'm with you. The having that model matters, you know, and should help us going forward. So I'm curious, these are some questions that you didn't know were coming because I didn't know I was going to ask them until now. I did a little research. So if this throws you off, we'll edit shit out, I guess. But I'm looking through like, so Forrester and Gartner are just the two I chose to pick on. And of course the big four firms are out there. But so Gartner's annual revenue is over $6 billion. And Forrester's annual revenue is about half a billion, $450 million, give or take. So you got the research that's out there doing what's doing. And as you've said, this is independent, right? And you've got consulting type stuff, advisory, as you said, and that clearly generates some revenue. And there's also, listen, there is a pay-for-play component somewhere in this. Is there not? Or is that totally wrong? I mean, I get the feeling there is, because I know, you know, people have discussions about, you know, paying to be in, in, in these quadrants, et cetera. But are they paying? Are, is it, how do I ask the question politely? Is it a rigged system where if you pay, you get where you want to be? Or is it just paying as part of the opportunity to work together? Whatever. Do these organizations, the Forresters and Cartners at all, do they really get to continue to stay independent regardless of, you know, their customers and their funding? And, you know, are vendors able to put their thumb on the scale and say, hey, how about if I slide you some money, move me up the chart a little bit?

So in short, no, it's not pay for play, right? SaaS vendors, technology vendors can be clients of any of these firms.

Mm-hmm.

Mm-hmm. And what they pay for and get is different than what a lot of enterprise customers get and ask for from a Forrester. I guess the, um, thought from folks that are uninformed is that that is the pay and that gets them into a vendor evaluation away from a magic quadrant. And that's just wrong.

Hmm.

The, the research team has robust methodologies, a very strict integrity policy. I couldn't own stock in a company that was part of research. I actually did sell some stock that I owned when I arrived at Forrester because that vendor was likely to be in my research at some point. And I proactively went out and sold that. Gift policy, like you can't accept a big screen TV or a trip to the Super Bowl from a vendor that's in your research. You can't do that stuff. So there's, there's very strict. Integrity and research policies there that they all follow. And frankly, like the, the, the relation, the reputation of a forester or an individual analyst would go to crap if it was patently obvious that we're taking essentially bribes or some quid pro quo, you know, to speak better of them in, in research.

So pay for play is actually insulting. I mean, it's, it's, it's really insulting your integrity when, when people suggest it.

It, it, it is, you know, and, and I feel that I have higher integrity and I was not going to compromise that at Forrester. And like I said, I sold some stock that, you know, could potentially have been a conflict of interest. And, and I, and I jettisoned that, you know, after I started there. It wasn't, it wasn't worth it. And if you look at, at the end of every at least Forrester report, Forrester Wave report, you'll see the qualities that, that got vendors into there, the inclusion criteria. And there's always like Forrester client mindshare. So we'd look to the enterprise clients. What vendors are you interested in? We look at folks in the community. What are people talking about on social media when someone You know, mentions you on Twitter, LinkedIn, whatever. And they say, hey, you've got a, there's a new startup out there. You know, we, uh, you know, we take some interest in that, that, that some of our audience is interested in a particular vendor. Now, going back to my earlier response that vendors can be clients, but a client relationship does not matter. When anyone wants to brief a Forrester analyst, at least. And the same should apply to any of the companies in there, that any vendor can go and brief the aligned analyst on their company, on what they do, what the value they provide for their customers and clients. That costs absolutely zero. Now it's up to the analyst to accept a vendor briefing. Some have very busy schedules. They may not have time. I try to fit these in when possible. Some technology vendors have these big analyst relations teams that hound you often, like, oh, we've, you know, we're on version 17.11 now. Can we brief you on the updates in 17.11? And you're like, no, that's not enough. Like, it's only like around 18, you know, right? Like, just send me a an email about it, right?

Right, right.

And it's up to the analyst to, to accept that vendor briefing or not. And I mean, I loved hearing what like brand new startups, you know, with just a seed round were doing.

Mm-hmm.

They're the ones that typically have the brand new ideas. And, and I would keep my pulse on, on the industry by accepting a lot of the startup interviews, startup briefings, because they, they were fascinating. And seeing what the, the, the new hotness may be out there. And sometimes like the ideas are just, you know, way off in left field, but never did, did I even consider a client relationship to be a criteria for inclusion in any of the vendor reports. Yeah.

Well, that's good to hear. I mean, you know, a couple of interesting things that stand out with it, I guess, like, so a lot of the vendors like they want Gartner or Forrester or, you know, all these ones, right? To recognize them, right? They want, because there's an audience and it amplifies. So they're pitching you guys like, hey, come listen to me please. And you guys can, you know, choose to or not. But I think that's really interesting. Also, you know, in mentioning the revenues, listen, you know, $450 million for Forrester, $6 billion for Gartner. Yeah, it actually, I think, lends credence to the idea, listen, it's probably not pay for play because how much can I really influence a company that's already got $6 billion in revenue? Do they really care if I give them an extra $20 grand? To be in the report? Probably not. I mean, I know the macro scale, but you also notice for anybody who's ever looked at these Forrester, you know, the Forrester Wave or the Gartner Magic Quadrant, it doesn't have 612 vendors in it. It's not that big, right? So like you'd have to be paying an awful lot, I guess, to influence companies with that kind of revenue. So, and I, to be honest, had not thought about that until just now when I was looking at revenues that it does blow a bit of an argument in. Now, uh, I will ask you, and I won't ask you to name any names, are the companies out there that look like these companies but are just pay-for-play and just marketing and they run their own little thing and it looks the same, but basically you just pay to get in there. I, I can say for a fact, by the way, for anybody wondering, there are awards like that for sure. Like there's plenty of awards that you get pitched where it's like, you know, how would you like to win this amazing cybersecurity award? It's just $1,500. You're like, well, that's not really an award. That is it.

I'm buying cookies.

Is that the same thing for animals?

You know, back at our former employer, we saw those even on the enterprise side because they'll, they'll have like the 100 next CISOs and the last, my last job, the deputy CISO was on one of those lists of like future CISOs and yeah, it's like, uh, you know, pay a few bucks and get your name on there. There's basically no methodology. There's, it's just a marketing thing, uh, purely. And, you know, that's definitely not what Forrester, IDC, and vendors like that. That's not what Forrester does. Forrester runs global surveys that collect just oodles of data across tons of different tech spaces. You know, so obviously there's a security one, there's marketing ones, there's, you know, general IT stuff. Healthcare. They have a ton of different research specialties and robust surveys, you know, with good solid methodologies, good tools for analyzing the data. And if you, and, and then speaking about a Wave or a vendor evaluation, mm-hmm. You know, that's like a 6-month process. Yeah. I can say that at Forrester, we interviewed and surveyed the vendor's customers. So we spoke to them directly and, you know, we, we ask them deep questions and we probe and we poke and, you know, we, we try to find where the warts are in the product and, and, you know, where all the good stuff is. Uh, and, and, you know, we don't just take the vendor word for it. You know, we give them a questionnaire and they're gonna say, yeah, we're a 10 outta 10 on this thing.

Of course.

Or 5 outta 5, whatever. The scoring criteria is, but, you know, we validate as best we can in the, with the resources we have, you know, all the PR and marketing stuff that those vendors come with there. So we never take their word, you know, for it, you know, we validate everything that we possibly can and we call shenanigans on stuff and vendors will often complain and there's a dispute process. And sometimes they will threaten to not be clients anymore.

Hmm.

Okay. Pound sand. We don't use your—

Yeah. $50,000. Half a billion dollars or $6 billion in revenue. I'm guessing that's not fine.

I can say that Forrester wouldn't sacrifice their reputation just so that a vendor got, you know, slightly more up and to the right.

Like, right.

It's not how it happens there. Like, unless the vendor could prove that I used bad methodology, that maybe they could say that I didn't consider a particular feature of their product. If they could point to it and, you know, say that I, I missed it. And if I did, okay, cool. My bad. We'll go and do it again. If I, if I didn't follow the methodology, sure. But if they just didn't like where they ended up, we never changed the score. Didn't, didn't matter what they said. Didn't matter if there were tears. I had, I had vendor people actually cry. I mean, I think they thought they were gonna get fired because they weren't a leader, that they were like a, I don't know, a challenger or, or a, I dunno, I forget the other category is actually, it's been a couple years, but yeah. No, I mean, tears, emotion, you know, you can yell at me all you want. It was not gonna change your score.

Oh, it's true. I yell at Brian all the time. And it's, you should meet his wife. She yells at him a lot too. Um, it's all deserved, by the way. She's, she's brilliant. So, uh, but, uh, yeah, Brian's gonna get yelled at. That's the truth.

I can take it.

Well, I mean, it sounds like you have to sometimes, but I mean, this is actually really good information about the industry, right? So, I mean, these are, these are sort of the honest brokers of our business, right? And, and yeah, they make enough revenue. It sounds like that you can't really influence. And so if you're looking to understand the environment or do some comp intel, or maybe you don't have your own comp intel and you're trying to figure out, I need a solution, but I don't know which one. It sounds like there's a real value in working with, you know, some of these analyst organizations. So with that in mind, you've been on both sides, like you work, you know, we talked about Forrester, uh, you know, quite a bit. You worked there, you've worked in vendors, you, you've been on customer side. What recommendations do you have for building relationships with the analyst? I mean, whether it's a vendor who wants to get noticed, clearly bribes aren't the way to go. Uh, whether it's, uh, you know, whether it's somebody who's thinking about, you know, changing their structure or their infrastructure or their security posture and, and they're looking to, work with some of these companies, like what's, what kind of recommendations you have having been on both sides? What's, what's a good way to go about it?

So if you're a vendor, if you're a startup and you're entering, let's say the threat intel space, right?

Sure.

You know, go find the analysts at the various firms that cover that area. It should be pretty easy to find. We're all public because the analysts are the product at the Gartners and Forresters and IDCs. Of the world. So all of, all the Forrester folks have usually a pretty big profile on LinkedIn, Twitter, Bluesky, whatever social media they prefer. It's pretty easy to get in touch with them. They will preview research. They will talk about research on those forums. Often folks, uh, like when I was there, I would do press interviews. I'd be quoted somewhere and all. So it's pretty easy to find the analysts that are in your particular technology space. So if you're a vendor, especially a small one, you know, go and reach out to them. Just, you know, like I said, you don't have to be a client to do a briefing to show your company, introduce your company to a Forrester analyst, at least. No, no charge to do that. It's up to the analyst to decide if they have the time and if they, and some of that depends on their research calendar. So dovetail into that. If you're a vendor, you probably have data. And you talk to customers too, you have some insights in the marketplace. Mm-hmm. Try to contribute, try to help that analyst do research, right? A lot of the bigger firms are gonna have analyst relations managers, and usually they would check in about once a quarter with me and ask me what, what's my research schedule like? And would often help connect me to someone that may have some data or some insights into the problem that I'm trying to address, which the problem usually came from some other client, you know, where they said, hey, I'm having trouble with whatever it might be. It could be OT security, right? You know, what do I do? What's my, what should be my strategy in OT security be, right? And just to kind of go full circle back to Zero Trust is I didn't get to it, but I wanted to write a paper called Zero Trust for Operational Technology, or ZT for OT. Didn't— I ended up leaving, uh, to go work with AJ Nash, actually, and I never got to that. But, um, that engagement, you know, is free. You know, anyone can connect with folks on LinkedIn, uh, and they'll announce research. And, and if you've got a particular idea, go for it. If you're an individual contributor at some large enterprise and your leadership only listens to the Forresters, Gartners, and Deloites and KPMGs and stuff of the world, and you're saying the same things, you know, go talk to those analysts and tell them what you're seeing as a, you know, a technician in these areas. If you're that programmer or that security operations person, that security architect, go and talk to these folks. I felt like I was a little bit of a, proxy for some of my peers in industry when I went to Forrester is I can take everything that they're seeing, everything they say to their leadership, and I can write it in research. And then it goes back to that CISO and then they're like, oh wow, like I should do intel that way. Cool. Like let's do it that way. And, you know, it came from the brand, you know, a Forrester or whoever. And, you know, but that, those ideas, like they come from somewhere, you know, we, we talk, you know, it may be informally, it may not be a formal interview, research interview. I may not have a research assistant on the line taking notes, but, you know, you talk on Twitter and Signal, Slack, whatever it is with people. And, you know, you detect themes. People are complaining about maybe a particular feature or security control or, usage of threat intelligence, and then we're pulling that out and we're looking through survey data and we're validating or we're, you know, refuting what folks are complaining about. They're like, ah, that's not really a problem, or yours is an edge case or something. And, you know, we take inputs from a ton of different places, you know, to build these best practices reports to guide folks on, What's the next thing in security? What's the thing that comes after zero trust?

Yeah, that's a good— we haven't gotten there yet, obviously, but we probably should.

And if you're in an enterprise too, if you're that individual contributor or a lower-level manager, you probably only have a couple contacts for some of the bigger firms like a Forrester.

Mm-hmm.

Go and find out who that POC is and then use that person to get some inquiry time. So an inquiry with at least a Forrester analyst is like a 30 to 45 minute conversation about existing research. So I wrote a report, uh, for example, on how to hire your first director of threat intelligence. So maybe you're hiring, maybe you're the CISO hiring that director of threat intelligence, and you want to bounce a candidate, you know, a profile, like a resume off of someone Like, like me when I was there, you could schedule an inquiry about existing research and, and, and answer some questions and go deeper. For all those best practices reports and waves and, and everything, there's always research. There's always notes that were left on the editing room floor. Forrester writes really sharp, concise reports, really digestible, which means that we often do cut out a lot of insights. Lot of data that we discovered during the research process. So go and ask, you know, to go deeper and, and have those conversations with them. There's always more inside. There's so much information inside, uh, some of these analysts' brains. Most come from industry. They, they were sales engineers. They were, you know, threat intel analysts like me. They were network architects. They were programmers, developers. They're most come in having done a lot of the job. That their clients are doing and, and, and they've been in their shoes. They feel, they felt the pain. They have empathy and they, they have so much knowledge and, and sometimes it's like based on their own experience at another, another company before Forrester or before a Gartner. So have that, find out who your contact is at your enterprise and, and see about scheduling inquiries. A lot of, a lot of inquiry privileges just don't even get used. Uh, which is sad. We want to talk. We want to have the conversations. We, that's why we joined the company to do research and, and then to turn that into something that helps, you know, technology leaders be more efficient and effective. And then from the other vendor uses there too is find out if, if you've even got a product market fit. You may have this crazy idea, right? And so use that briefing as an opportunity to get, you know, a response., you know, at a briefing, it's all about the vendor talking to the analyst, but, you know, there's always questions and you can pick up on themes. And, you know, if I ask about a particular feature or product, quality or whatever, and I, and I, I keep asking about that one thing, that's probably an indicator of something like, like maybe I'm not buying what you're selling because I know my enterprise clients don't care about that. Right. You know, before getting really far into a product lifecycle, before, you know, when you've just got a, you know, an alpha or a beta or something before you're getting really to an MVP, you know, brief, go brief an analyst and get the reaction that can tell you a lot. You know, it's, it's almost free inquiry, you know, just a way someone like I would, would respond to a new product or service offering. From a, a vendor. Is there— I'm not going to tell you.

Okay, sorry to interrupt on this one, but is there tricks? So on the one hand, there's 850 million vendors out there, right? So I'm sure none of these analysts want the 12 people who listen to this show to tell everybody to, to go ahead and flood them with things. So like, is there a way to stand out if you're going to reach out to, you know, somebody at Forrester or Gartner or whatever and say, hey, listen, I want to I want an opportunity to chat with you. I want to brief you on, you know, what we're up to, et cetera. Like, what is the right way? What is an effective way? How do you stand out? You know, how do you make it so it's worth their time, right? As opposed to just being one of this horde that's like, please, please, please, you know, see my stuff so you can amplify me. Like, is there a trick to it? Is there a better way to do it?

You know, just saying, hey, we're a new threat intelligence vendor is not going to be enough, right?

Right.

I've got a ton of time, or I don't have a ton of time. Mm-hmm. And that's not gonna really interest me. But if you tell me that, hey, we are extracting signals across the internet that detect malware, you know, earlier, uh, you know, before, uh, ransomware is deployed or something like that, now you've got some interest. Like, if you've gotta be, you've gotta be able to distill down the value that your product or service provides in like one bullet. Right? If you can't do that, I don't think you're really that mature yet. And then the other thing is when, when I do get the, the vendor briefing, typically one of the questions, and this, I learned this there at Forrester was, was to see how mature that vendor is, is ask them, you know, when you win or lose a competitive deal, You know, why, why do you lose to competitors? Why do you beat your competitors? Like that shows that they are extracting some insights from their own customer and prospect base. And that's hugely, um, that's important. Like they should be able to, they should know that, right? And then that also does help the analysts understand if there is like product market fit and, and if this is a vendor that maybe should be in research someday and, you know, fairly easy questions. That, that should be easy questions to answer, short questions, you know, that you can ask any, any vendor. And, and, you know, we would typically ask that like to any new vendor out there, you know, to see if they understand their customers and prospects.

Hmm. So what I'm hearing is if I want to get the attention of somebody, if I've got a new product and service, what I need to do, because it's gotta be quick and effective, is just tell them that, you know, we're, we're cutting edge. New wave technologies and, you know, utilizing AI in unforeseen ways to secure all networks proactively for 100% protection using blockchain technology. Like that, that should be enough, right? That'll get me in the door. And Zero Trust, I gotta throw that in someplace.

I don't know. Less than zero. Yeah, yeah, definitely.

Less than zero trust. Is there somebody out there writing that right now? The less than zero trust.

Like absolute zero. Your example there, while, Well, hilarious. I mean, that's, that's like all marketing basically. Like, of course, don't tell me it's AI and it's blockchain, whatever there. Yeah. What's the actual value that it brings? What does it do that's better than legacy products and, and, and services?

Hmm. So if I just said, I, hey, we've developed a new technology and capability that is faster, uh, more effective, less noise, you know, we can prove it to you with the data and statistics and it's, you know, faster, cheaper, better, that kind of a thing. That's more likely to get response than just throwing all the marketing jargon out there.

Definitely. Marketing buzzwords don't work very well on folks like me.

Yeah. Well, that, I mean, that's probably good advice for folks out there because a lot of these are tied to the marketing organizations and no offense to marketing. Listen, we've, you know, I've talked a little about it. There's a show a few episodes back that was, you know, it's all security marketing bullshit. If you didn't see it, shame on you for not watching it, everybody. It was a good friend of both of ours actually, Emily Phelps, that was the guest on that one.

I introduced the two of them.

Yes, you did. Yeah. And now she and I are really good friends. Brian and I talk occasionally. But anyway, no, but I think that's important, right? Is, hey, listen, marketing is a lot of times the front end of this. Make sure that you're working with practitioners or product people if you're building something, right? To get the real answer, like the value piece. I think that's important. And marketing knows value too, right? So instead of using the buzzwords, skip to, hey, the value prop. That sounds like the better way to get noticed.

And additionally, for B2B folks, like don't market to your own executives, right? You got to market to the buyers. Like, your executives know if there's some AI or ML or whatever that's in the product, right?

Yes.

And the buyers don't really care as long as it provides value, as long as it solves a problem that they're having there. So focus on the problem and the value and get rid of the buzzwords.

I think, see, I got the good advice that, frankly, that's probably, we buried the lead. That's probably the best part of the whole show, you know, is, hey, how do we make this work for us? And the answer is, you know, skip the buzzwords and just focus on value. Which makes sense. We all talk about that, right? People just want return on investment. They want value, you know, tell 'em to 'em, get the attention of these analysts and then prove it to 'em, you know, show it to 'em, give 'em a demo, et cetera. And if you can do that, you'll probably get a good write-up and then you'll draw business and you can be super rich and famous. Like, you know, I don't know, somebody. So, all right, this is really cool, man. And listen, we're coming up on time. We're, we're getting, you know, a little short here, but, which is fine. This has been a good conversation. I think it's really interesting. Like it's not all pay for play. In fact, these companies make enough money that you probably just can't bribe your way into their charts. So we can actually probably have some reason to trust and believe. It's nice to know that there's processes behind the scenes on this stuff and documented processes and, you know, legitimate research processes like, like you would expect from people, you know, who are professionals in our industry, whether intel professionals or, you know, academics or a bit of both. I mean, again, Brian went to the prestigious Georgia Tech University and others went to other schools.

And you, you, you just did a faux pas there, man.

You're not prestigious Georgia Tech University?

We, we are, it's the Georgia Institute of Technology.

Oh, Georgia Institute of Technology.

Right.

I forgot. It's not Tech.

You watch enough college football, you should know. It's always that trivia question. We're like the 4 schools that don't have university.

And yet you don't go by GT though. Well, you don't go by GIT. You just go by Georgia Tech. So, but I guess Caltech doesn't either and they're probably the same way. So anyway, no, it's a good point. Right. So, uh, great universities, you know, good legitimate research, not really bribable, not pay for play. There are some others out there that are actually going to watch for that. And the best way to really get engaged and get involved is to, to go out there and do so. You know, if you're a vendor, do you want to pitch? Use your value prop, not your marketing shit. And if you're somebody looking for help figuring out how to navigate the industry and get better, these are people that actually are looking for those conversations. So I think that's actually really good. You know, I think, I think this is exactly what we're looking for.

A lot of folks will say that I'm in a particular Slack group, a Signal group, a text group, email chain, whatever, with other CISOs or, different security leaders, IT leaders there. And I just ask them what they think about a particular vendor or what I think about zero trust. And, and that's good. Keep doing that. I'm not saying don't do that, but a Forrester has just a bigger aperture, a global aperture. You know, their survey goes globally to the point where you can get specific insights by region. So if you're a vendor and you're looking to sell in APAC, you're going to have some different buyer attitudes over there than you might have in North America. You know, that's the global scale of like a Forrester. That survey data is huge and you can bisect it and break it all up and get some really neat insights by region and industry. And, you know, if you're a CISO, you probably know very similar CISOs and, you don't necessarily know, you know, their experience is going to be very different than other folks elsewhere. And so use it to complement each other there. Oh, another thing that I wanted to, to mention is with a Forrester Wave especially, and this probably is similar to the other vendor evaluations, is the, the end research is not simply the graphic, right?

Right.

That's what gets shared on social and whatever. It's not even just the full PDF. That has some of the breakdowns and scores there. But at Forrester, there's a tool that clients get that is customizable. So I'll use threat intel as an example. If you are great in, in technical, tactical threat intelligence, maybe you don't need that. Maybe your gap is strategic. And so you can use that tool, change the weightings, say drop technical tactical down to zero. Tune strategic up to 100, and it replots all the vendors out there and you get a new set of leaders. And then you can use that, like I said, to make, make better decisions on your technology procurement there. So it's not just that particular image, uh, there's way more to it. And of course, if you need help navigating that tool and that report and all, that's where the inquiry comes in with talking to the analyst, you know, to go deeper than maybe what the Wave report You know, talked about there.

Yeah. That's actually really interesting. I didn't know that. And so you can customize it and tune it further.

Yep.

This is turning into a really good advertisement for Forrester, by the way. Those guys should probably be sponsoring the show. I'm going to reach out to them and tell them I'm not putting this thing out until they actually put some money on this thing. Damn it. No, they don't, they don't care about me. And obviously I can't bully them because they make half a billion dollars a year. But, but it's good to know that I didn't know you could actually tune the tool because that is a good point. Like it's a segmentation piece, right? You might say I'm good at this. But not that. And Intel's a perfect example in that you might have great strat and lousy tac and operational or vice versa. And to be able to, to tune it and go, that's important because maybe I'm great at tactical. Well, the number one group according to the Wave, uh, you know, or Magic Quadrant or whatever, I, I shouldn't just assume that's the one. 'Cause maybe if I tune it, I find out, well, they're great at tactical and they're lousy at strategic. Well, why the hell would I buy more tactical? Now the group that was actually down the Wave, it turns out for strategic though, they're great. Well, that's the group I should be looking at. So that's actually a really good tip for those who are working with these organizations or, or thinking about it, that there's, there's more than what we see publicly, I guess.

Yep.

So listen, we're, we're, we're coming down to it. The name of the show, like you, you don't get a pass. Nobody ever has yet. Don't be a coward. The name of the show is Unspoken Security, right? So the closing question's always the same. With that in mind, you know, tell me something you've never told anyone, something unspoken.

I mean, I, I never take risks. I'm very conservative, you know, By the book, never pushed boundaries or anything. I mean, I've got nothing really. I don't have any skeletons in my closet. Right, right. I don't think I've ever said that, by the way.

That was, you know, but no, uh, I'll get Emily in here to tell stories. I'll get them full right now. I'll get some stories.

Oh yeah. Yeah. Emily's got some stories. And one thing that she probably wouldn't even know, I mentioned, you know, Fort Gordon, now Fort Eisenhower. Yeah. Uh, between reserve and active time, I pretty much commuted. Between Atlanta and Fort Gordon throughout 20 years of service. And anyone that's from this area knows Interstate 20 is pretty boring. Lots of pine trees. And I, I, I kind of got in the habit of testing my vehicle at the time. So a lot of times I was driving like really early morning so I could make PT at like 6, 7, whatever it was AM. And so every car I owned during that 20 years, I validated the vehicle's top speed, including a Jeep Wrangler, which is like driving a billboard. So I, I think I, I, I'm not even sure I hit 100 miles an hour there, but my current car, which I've had for 12 years now, I did validate the electronic governor does cut off at 155. Ooh, geez.

Yep.

Nice. So you get some of those stretches there and you can see for miles and there's not a, there's no tail lights there and You know, man, anybody from the Georgia State Patrol that might be listening to this, sounds like I-20 is a place to hang out and wait for Brian Kime to come by.

Look up his vehicle and plate. I don't have that available to you, but, uh, that's, you beat me. I've done 140 a couple times. I haven't done 155 though. That's, I think 140 is my top and I don't recommend it for those who are asking. Um, uh, I mean, it's fun, don't get me wrong. I'm not saying I don't recommend it cuz it wasn't fun. It's just, I, I'm not gonna be responsible for bad things happening to people. I'm actually going to share one. I don't, I don't usually do this as the host anymore, but because people know things, but I got a funny one because it's about you. So I'll get to do it. So Brian mentioned that he, uh, when he left Forrester, he came to work with me, which is true. We worked together. We both were hired roughly almost the same time. I was hired right before him. Basically, we both had interviewed around the same time we were hired together and we had peer roles in the company. And not long after we were hired, there was a holiday party because that's just the time of the year. Right. And so we're all sitting nice, nice party. And you know, it's a fancy get-together and whatever. And I get to meet Brian. Brian's, you know, wonderful wife who obviously has terrible taste in men. And we're around this table and it's, you know, it's, it's a really nice event. Right. And, uh, and Brian was very happy to have joined the company and maybe had one or two drinks or more. And so our CEO was standing up, we were talking about the year in review and, and, and to be honest with you, it was a few people were kind of kissing the ring of the CEO. That was kind of how the vibe was in the room. And, uh, they looked at him and Brian stands up. And kindly says, you know, I'm so thankful to be here. I really appreciate you hiring me. And then spends the next 2 minutes or so raving about me and just, it was very kind, but also very embarrassing. I'm like, Jesus Christ, dude, you're going to get me fired. You're, you're showing up the boss. This is his moment. You're supposed to be kissing his ring and suddenly it's me. And it was, listen, Brian's a really nice guy and it was genuine and he was very happy to be there and we were lucky to work together and we had some good times. But if, if Brian has one too many, I promise you, you will get all sorts of sweet honesty from him. I'm just glad Brian likes me or it would've been just a terrible, terrible night for for me because he had no problem saying what was on his mind. It was a lot of fun. It was very sweet and it was kind. It was a little embarrassing for me, but, but it's one of the funnier things I can actually remember in my career. Cause I thought, sat there thinking, dude, I don't know this guy that well yet. Like you might've gotten me fired. You just showed up the CEO and I'm going to look like the jackass somehow.

Hey, you were there longer than me, so you're welcome.

That's true. Yeah. Like days, but, uh, no, it was good. And I appreciate it. And we had a good time working together and it's a shame that it doesn't happen anymore. And maybe somewhere in the future. We'll get another chance to do so. I think you should do the ZT for OT thing. You got some time on around. I think you should write, I'm serious. You should sit down, write the paper, like publish it, you know, do it. But listen, so you gotta share your little story about, you know, driving a million miles an hour and I get to embarrass you, which is fun. We're kind of outta time, but the last thing, uh, you know, after that is just, you know, is there anything that you want to add as we come up on time? Any last thoughts, anything you want to plug, anything you want to say before I, you know, we call it a, a show and hop outta here.

Uh, you know, I'll make a plug for myself really. I don't often do that. I like to, you know, say good things about people like AJ, right? But, you know, I'm on the job market too. So I'm looking for threat intelligence leadership positions, uh, vendor or enterprise. So if you know something in the Atlanta area or remote, hit me up on socials and, you know, let me know.

Yeah. And, and listen, I, I think you should hire Brian. Like if you guys are listening and you have that. I've worked with him. He's a good guy. You know, his resume's fucking amazing. Obviously you can read it and we talked about it and he went to the Georgia Institute of Technology where he got his architecture degree. But also the, you know, the military background. But the truth of the matter is the guy's a good guy to work with. Like I trust him. He's reliable. He's a good person. He's easy to work with. I'd work with you in a heartbeat, Brian, if I had the opportunity to do so. If I could hire you, I would, but I have like $3 and a ham sandwich a week if you're interested in that job. Otherwise, I recommend you hold out for something a little bit more. But no, I think it's good. Yeah. Plugging yourself is the best way to go in this place. Hopefully, hell, by the time this thing, by the time anybody other than the two of us sees this, you might already have a new gig. But if not, yeah, I highly recommend, you know, Brian's a good guy to work with, to build teams, to build organizational structure, to do intel stuff. He's a good one. So, all right, listen, man, with that, thanks. Thanks for being here and thanks for the topic. This was 100% Brian's idea to talk about, you know, analysts. I think it's great because I wouldn't have thought of it and we don't do enough of this stuff. And hopefully it helped it. Frankly, I learned a few things about it. It's not all pay for play and you know, there's value in this and now we know how to, to work with these guys and maybe pilfer some good talent from them eventually. So thanks again for, for being on the show, man. I appreciate it. Have a good luck with, with the search, et cetera. We'll keep talking offline, obviously. And for everybody else listening and watching, thanks for spending some time with us today. If you like the show, I appreciate it if you can, you know, like it and recommend it to people, subscribe, all that stuff. If you don't like the show, shut the hell up. No, that's not true. If you don't like it, please do tell me. Like, I'd prefer you don't tell the world, but please do reach out and let me know if you got ideas to improve it. If you know people you think should be on the show, I'm open to ideas. But again, thanks for taking the time to listen and watch today. And until next time, this has been another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security.

If you enjoyed this episode, follow us wherever you listen to your favorite podcasts.

See you next time.