Unspoken Security Ep 41: Today’s Geopolitical Threat Environment Requires a New Security Model

you definitely have some people coming out of the intel community who are analysts who like to write and sit at their desk and do, you know, that is not the right fit for this type of role because you need somebody who can go and do the relationship building. And so, you know, somebody who has interagency experience, if they come out of the intel community, did a lot of JDAs or like, you know, and they don't need to be an intel person. They could be, you know, one of the National Security Agency.

Welcome to Unspoken Security, the raw and gritty podcast where security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry. Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. Spent about 19 years in the intelligence community, mostly at NSA, and I've been building and maturing intelligence programs in the private sector for about 9 years now. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! And I continue to be deeply committed to servant leadership. Now, this podcast brings all of these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. This is not going to be your typical polished podcast. My dog makes occasional appearances. She is sleeping next to me right now, so we'll see how that goes. People argue and debate. We even swear sometimes here. I certainly do. And that's all okay. I want you to think of this podcast as a conversation you'd overhear at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. Now today I've got a really special guest because I'm joined by Mark Friedman. Now Mark is Principal and Chief Executive Officer of Rebel Global Security, where he advises critical infrastructure and technology companies on issues at the nexus of national security, corporate security, geopolitics, and security tech. So just some lightweight stuff, you know, regular things gets us through the day. Mark previously served as an officer at the US State Department. Including Chief of Staff to the Ambassador-at-Large for Counterterrorism. And he was responsible for management of about $1 billion in foreign assistance funds, about 150 people. And he managed the flow of information to senior U.S. government officials, including the Secretary of State. So he knows a few things about a few things. He holds a bachelor's in international affairs from the Georgetown— or the George Washington University, and a master's in security studies from Georgetown. And he's also a certified protection professional. He's a certified information security manager. He's a member of ASIS steering committee, enterprise security risk management, and critical infrastructure. So, you know, just a couple of things Mark does to keep himself busy. Anything you want to add to that resume, Mark?

No, I think we're good.

Nothing more. It's a pretty, it's a pretty stout one to begin with, so that's good. So listen, it's gonna be a really interesting discussion today. You know, we have a lot of different discussions on this show. Some are very technical, some are about people and, and processes, and, and then some are about intel still, which is, you know, where I come from and, And this sort of leans back into that space as the topic today is, is today's geopolitical threat environment requires a new security model. Now, it's a pretty bold concept to say, hey everybody, you're all doing security wrong. I think the threat environment's changed and we need a whole new model. So I think it's a good, I, I frankly think it's the right time for that kind of a challenge. So I want to jump into exactly why you think things are different and what we need to do. So what do you see as the biggest changes in the global threat landscape over, I don't know, say the last 5 years or so?

Well, first of all, AJ, let me just say thanks for having me on. Really glad to be here and looking forward to, um, to an interesting conversation. So, you know, I mean, my perspective is informed just like everybody else's by, by my background and where I kind of come from. And so, you know, I've been in DC for going on 20 years now. I'm an international affairs person by, by kind of background, right? So I don't come from a cybersecurity or an IT background, either academically or professionally, and worked the first part of my career at the State Department. And so that kind of international affairs geopolitical lens is just the way that I view the world. Mm-hmm. And so when I think about the biggest changes in the threat landscape over the last 5 or so years, it's really through, you know, through that lens. And so for me, you know, I go back to the National Defense Strategy that was published, not the most recent one, the one before that actually, that was published in 2018. And, and for, for those listeners who aren't as familiar with the National Defense Strategy as you and I may be, right?

Sure.

Government time. It's the highest level. Document released by the US Department of Defense. And it's typically released, you know, somewhere every 4 to 8 years, depending on kind of where the political administration is. And it's intended to lay out a political perspective in the sense that it is, you know, does change kind of from Republican to Democrat, but also a kind of a Washington perspective on US defense policy. And so the National Defense Strategy in 2018 opened with a line about the shift from terrorism as the primary national security concern to interstate strategic competition. And again, so that was in 2018. So that was 6 years ago. No, 7 years. Boy, what year are we in?

It's 2025 now. Yeah, it goes fast, man.

Well, okay. So that's not a recent document, right? Right. But I think in the last 7 years, we have really seen that play out. I mean, if we think back to 2018 and like I was at the State Department and that chief of staff to the CT ambassador role in 2017, 2018, 2019, he really was still the flavor of the day. It's hard to remember because so much has happened. You know, ISIS took over Iraq and Syria like that tended to be the big thing in American foreign policy and national security. But in the, you know, last 7 years, we've really seen a change where everything all day now, including at the cybersecurity conferences and all the other security conferences, it's China, it's Russia, it's other state adversaries that are challenging US dominance. And so in response to the question about the biggest changes in the threat landscape. To me, that is the biggest change, that shift. And if you want to look at it from kind of an inter— international relations, you know, kind of academic lens, this shift from a world where you had the United States as essentially an unchallenged hegemon to really a, a multipolar world where you have peer and near-peer adversaries primarily in the form of China and Russia challenging us. And that to me has cascading effects for everything that we do and everything that we talk about when it comes to security and intelligence and private sector and government. That strategic context has changed and that is driving, you know, many other kind of secondary and tertiary changes and effects.

Well, yeah. And it's, I mean, first of all, I'm with you. I, it's hard to believe that's 7 years ago already. But it's interesting, like yourself, you know, actually we probably had a little bit of overlap. I did some counterterror, you know, in my time. Right. So, you know, I can look—

Everybody did. Right. If you were—

Everybody did. Exactly.

Sir, you were in there.

Yeah. If you were in the government space after 9/11, you did counterterror at some level. Right. So, you know, prior to 9/11, I did other things and, you know, I did counter nation state work. Obviously China and Russia were part of that. And among others, and did some counterterror along the way. And it's not like terrorism's gone away. It's not as though counterterrorism doesn't exist or it's not an issue. But there was this shift, right? We had the counterterrorism and, you know, we did a reasonably good job, I suppose, as much as you can against terrorism, you know, in terms of Al Qaeda and ISIS. And, you know, they still exist and terror's not going away, but it's, it was replaced, as you said, by this, you know, this nation-state threat has risen up, which was the threat before, by the way, you know, for those who remember the Cold War, obviously things like that, you know, for a long time it was this near-peer threat. It's just changed. So now What you're saying is, and, and I agree, is we've reverted sort of back into that, but the times are very different, right? This isn't like the Cold War. It's, it is in a sense in, in that staring down adversaries, but we have a digital shooting war going on in this case, right? The Cold War was the Cold War. We had occasional skirmishes and proxy wars going on, but the cyber aspect wasn't really part of it. So we're in a Cold War that, that feels a lot less cold if you're in the technical side than it does for the average person, you know, trying to figure out if bullets are being thrown. And obviously we saw some proxy, you know, skirmishes happening around the world, you know. And then how does that relate— listen, most of the guests, most of the audience, I should say, listeners and viewers for this show, you know, all 12 of them are probably not in the government space. Most of them are in the private sector. So how does that really matter to the private sector? For instance, you know, private sector frankly doesn't think that much about terrorism. I don't think either some of the physical security and executive protection teams do. But the private sector really spends most of our time focused on criminals, right? It's cybercrime is sort of the biggest issue. So where does this shift fit for the private sector? Why should the private sector care about a rise of nation-state attacks versus terrorism, for instance?

Yeah, well, I think the private sector has become, you know, has gotten kind of dragged into this geopolitical conflict, and the data is certainly there, right? You look at like the CrowdStrike report, threat report, or any of the other threat reports. And pretty much every year they'll say, you know, China-linked or China-backed cyberattacks on private sector companies, including private sector critical infrastructure, are, you know, up again this year, or we're seeing more of it, or they, you know. And so that, I think, is, you know, when we talk about cyber, a very obvious linkage where you see the, the Chinese and other adversaries attacking private sector companies with cyber means in order to advance their geopolitical objectives. And those geopolitical objectives are, are various. So one which we saw a lot of going back many years was Chinese IP theft via cyber infiltration. We also see Chinese IP theft via insider threat, uh, that is all in an effort to take American IP and Western IP and advance China's kind of standing in the tech race for the most part with the United States. More recently, and this will not be kind of news to, I think, any of your listeners, but Volt Typhoon is really an example of where the Chinese have moved beyond this espionage effort, IP theft effort, and toward prepositioning for sabotage. And, you know, coming out of the counterterrorism world and more kind of on the physical side than the cyber side, what's really concerning about Volt Typhoon to myself and others kind of in that community is that while the mechanism is cyber, right, this is the kind of living off the land cyber techniques, impact is, you know, expected to have physical implications and potentially safety implications, potentially fatalities. And so that's where, you know, we can talk about it in a cyber context because it is a cyber mechanism, but in effect, it's not necessarily different from if the Chinese were to plant a bomb on a pipeline or, you know, at a utility substation or something like that with the intent of taking down critical infrastructure. And like, you remember AJ, like that, that was a big discussion after 9/11, right? Absolutely. Is the terrorism threat to critical infrastructure and, you know, is Al-Qaeda gonna take down the grid and whatever?

Mm-hmm.

So we're dealing with the same thing. It's just that cyber has provided another kind of TTP, if you will, in terms of how you go about causing that effect. Yeah.

Well, and it's a good point. You know, you talk about, you know, the specific adversaries, right? And China, Russia, you know, Iran, North Korea, you know, are all, in the game, among others, obviously, but understanding their motives, right? Which is, it's, this is a challenge I've had. Like I said, I've been in the private sector now for, I don't know, 9 years or so. It's always a challenge to talk to leadership about these large strategic pieces, right? Leadership in security, physical or cyber, more cyber though, seem to be very focused on this technical, tactical, you know, oper— they want actionable. Everything's, everything's actionable, right? And I get it. Return on investment comes off of that, and there's a lot of ways to measure value, etc. But it's, it's often very hard to get some leaders at least to listen to strategic pieces because they can't necessarily do anything about it. Uh, you can explain them how they can, you know, reposition or rethink some of their security strategies, but it's a hard piece. And when you start talking about things like the China Five-Year Plan, for instance, which, listen, I, I worked that, you know, I worked China at one point in the government space. I love the Five-Year Plan. I, I've never enjoyed an adversary more than one that'll tell us exactly what they want to do for the next 5 years and what their product, you know, their motives are, and then we'll exactly follow through on it.

It's amazing. There's no, a lot of them do that.

Yeah, there's no misinformation with that. I mean, it's a roadmap, you know. I remember it's a couple of 4-year, 5-year plans ago now, but there was, you know, one that they were very concerned about healthcare as they have an aging population. They were concerned about understanding creditworthiness and how to measure that better. They were worried about, you know, renewable energy. And you go, okay, well, great. If you're in the healthcare space, if you're in the renewable energy space, if you're in the credit space, the banking space in the US, you should all be prepared for Chinese cyberattacks because they've just told you what they want. And then of course they followed through and, and did it, and they went after those things. So, I mean, that's easier, I find, when I talk to some leaders to say, this is why you have to worry about China as a nation-state, because I can show you this map. And sometimes you get some for some of the other ones, but it, it gets to be a lot of them just gloss over because they just want to worry about the tactical and the tactical and what's happening today, not why we should care about the shift. You know, North Korea, why do sanctions against North Korea affect a private sector industry company in the US? And trying to explain to them, well, when North Korea has sanctions, You know, their primary use of cyber is to raise money. And so obviously if there's sanctions, you can expect an increase in attacks as a result 'cause they need to generate more money, which is why we're seeing things like going after cryptocurrency and crypto markets and things like that. You know, we're explaining that, you know, when Russia and, you know, Ukraine turn into a shooting war, what does that do for you as a company, right? Do you have people there? Obviously, hopefully you care enough about your people, but how, what's the backlash gonna be for doing business with Russia if they're seen as the aggressor, or doing business with Ukraine as they're seen as being wrong in some way, right? And it, it tends to be very difficult to explain to leadership, I think. You know, are you having kind of a similar challenge with some of those discussions? Maybe I'm just not good at communicating, need to improve. Like, are you seeing some of that? Or, or really in a grander question, I guess, how well are companies protecting themselves against these evolving threats? You know, how, how receptive are they and what are they doing?

No, well, let me, let me answer the first question. You're absolutely on to something. I mean, Yeah, it's a constant frustration for me and frankly, like, for pretty much everybody that I talk to that's, that's in this space, both those, by the way, who have come out of government and are maybe used to the more kind of strategic discussions that we had in government and those who don't come out of government and are just on the front lines of dealing with it all the time in the private sector, but, but are frustrated by the lack of kind of attention that it gets. From a senior level and, and through a strategic perspective. I think there are a number of reasons for that, but just to kind of, you know, kick one off using the example that you gave on North Korea. So let's look at that particular case, sanctions on North Korea. The way that the private— that most private sector companies are going to deal with that or treat that issue I think, and you tell me if you think I'm wrong, but I think they would view that through a compliance lens and say, okay, do we have any, like, okay, so if you're in financial services, for example, you know, that then it would be a, you know, that would be an issue to be handled through suspicious activity reports and KYC and making sure that, you know, you've got all your AML and CFT kind of standards in place. So it would quickly go into that compliance kind of regulatory bid, right? And that's handled by a particular part of the business. Then what you're talking about is, okay, let's say that the United States decides to levy greater sanctions on North Korea. At this point, that's basically impossible.

What's left to do, right?

Let's take the premise, right?

Sure, sure.

And so as a result of that, North Korea may increase cyberattacks that have a financial motive in order to compensate for that, to achieve some sanctions relief in effect.

Sure.

The part of the business that's handling sanctions compliance is going to have no, is really not going to care about that. They're really not going to think about that. That would be an issue for the CISO, presumably, to think through, you know, do we need to, like, to use the CISO term, like, kind of shields up posture here, um, it might be an issue if the company has a geopolitical risk team that they might be following.

Not many of those, but there's not—

there are, there are not many of those. And where there are those, I mean, I've seen, and, and I imagine you have too, inevitably then there's a thing of like, well, is this the role of the geopolitical team or is this the role of the cyber team? Whether or not they work well together on that depends on the organization and the relationships and whatever. But what I would say, there is really not— unless this bit— unless that has been determined as a really huge strategic risk to the business, there is not going to be a higher-level conversation on that issue within the company.

Well, yeah, and So you mentioned like GRC normally gets this, right? Government Risk and Compliance will get this piece and legal, right? The, the sanctions piece to make sure that we're not violating sanctions, right? And they don't think about the piece we're talking about. North Korea is going to ramp up operations, cyber operations. They're, they're not thinking that way because they're only thinking about compliance and, and laws. Meanwhile, the people that are responsible for the ramp-up part probably aren't following sanctions regularly. That's the SOC and, you know, security and CISO. And, and a lot of those organizations don't invest time, energy, money, and people into looking at the larger geopolitical piece or the strategic piece. So they don't even think of the sanctions. They might not even know they happen, or if they do, they don't think of it in that context. So the legal people have no reason to pass that to security 'cause they're not thinking about it. The security people don't really have to watch it, no reason to watch it 'cause they're not thinking this is, you know, this isn't ones and zeros, this isn't what we do, right? And so there's this disconnect. And while it'll be self-serving, I'm gonna say it, I know it'll come up again as we talk further, but this again leans into a topic I've had for a few years about having a chief intelligence officer, because that would be where this would go. That's the organization, the person and the role, and then the organization that would follow all of these things and would be the translator, the person who could say, hey, listen, sanctions results in sanctions on North Korea, Korea results in these things. And this needs to be fielded off to legal and compliance to make sure that we're not going to break the law and get in trouble for export. Not that there's anything North Korea we'd send to anyway now. And this needs to go over to physical security because these could be some concerns. And this needs to go over to cyber, you know, to CISO and the SOC because these could be concerns, right? Nobody, to my knowledge, no company has that traffic, you know, has, has that traffic cop, has that, that informational traffic cop, that intelligence person coming in that oversees all of these things and could look at it and, you know, putting North Korea aside, it could be, it could be somebody else, could be, you know, the, again, the Russia-Ukraine war, for instance, you know, was there somebody to, to advise the C-level? Here's the likely impacts of this across your business from a legal compliance standpoint, from a physical security standpoint, from a cybersecurity standpoint, from a, from a production standpoint and delivery, you know, from a marketing standpoint, all these different things, right? There really isn't, to my knowledge, any one person in a position to sit over all of those things and make those kind of assessments. And so you get these haphazard approaches and all experts in fragments that are all coming together with ideas and doing things and there's stuff falling between the cracks and there isn't a unified approach that I happen to be a big believer in the idea of a chief intelligence officer would solve for that. So anyway, that's a tangent a little bit. Uh, drives us a little away from the question, but which I want to get back to, but just for anybody listening, this is why I talk so much about trying to unify those things because you just made a good point that legal and compliance will look at this. SOC probably won't think about this. And so there isn't that connection until these attacks start coming. And for CISOs who want to be proactive, and everyone tells me they do, then they don't want to spend the time or money or energy and resources on the strategic piece, which is how you get proactive. How do you know when North Korea is going to ramp up their operations? We all know that they do financial. That's, that's their primary motive, uh, for cyber. But how do we know, or how, how can we, we don't know, but how can we project, how can we assess the likelihood that they are going to increase operations and who it might be against if not for knowing all these big strategic pieces? You can say the same about China and the Five-Year Plan, for instance. So, you know, what are you seeing in that space again? What are companies doing well or not well when it comes to this stuff right now?

Well, I think that companies increasingly are doing something in the geopolitical realm. So there was a, there was a Chamber of Commerce Foundation report that came out just within the last couple of months where they did some AI natural language processing analysis of— it was either Fortune 250 or Fortune 500— like 10-Ks, 8-Ks, like kind of SEC filings and disclosures to analyze how much companies are talking about geopolitics or geopolitical issues. I don't have the numbers in front of me, but suffice it to say that this— the study found that there was a marked increase in how much companies were talking in their disclosures about geopolitical issues over the last— I think they had dated it from 2019. So that's interesting, right? We're just talking about 2018.

Yeah, right.

And so, you know, very similar time period where they, they saw a real increase in companies talking about that. Now, again, just to kind of take it back a minute to the, to the, the theoretical picture, right, of what's going on in the global environment and that shift to multipolarity and whatever, there's a reason, in my opinion, that companies are talking about that more because— and they, they may not know it because these companies, like certainly the people were writing 10-Ks, they're not, they're not like IR people. Exactly. All this geopolitical stuff is going on. Oh, why? Or whatever. But, but that's why, right? I mean, that, that's why the companies are experiencing all of these geopolitical challenges, because the geopolitical environment is fundamentally more unstable over the last several years than it had been in the decades prior. So To answer your question, I do think that companies are finding different ways to address that geopolitical issue, whether that's hiring a geopolitical person or creating a geopolitical— there was just Jamie Dimon just came out and JPMorgan is standing up a new geopolitical center that's gonna release some reports to advise JPMorgan clients on geopolitics. So I think that is really good and a sign of progress. I think though, we're really in the Wild West days of that. There's no professionalization or standardization to how companies do this. I think when you talk about a Chief Intelligence Officer, whether you want to call it intelligence or geopolitical or national security or whatever, you know, insert whatever. But I know, not to dismiss your point, I know you—

No, no, no, you're fine. You're fine.

In particular about intelligence too. But I think actually the operative word there is chief. And so, you know, because, because a lot of times you'll have these units or that are stood up or individuals who are tasked with these responsibilities, but if they're buried somewhere within the bureaucracy, they're like 3 levels down from the chief security officer, or, you know, maybe they're in the government relations team, but, you know, the government relations folks are like, what, who are, what do you do? That's the challenge, I think, is that mental model where companies are in terms of, hey, we're a business, we're Fortune 500, say, business, and all of a sudden we're dealing with all these geopolitical things. China's a major risk all of a sudden, you know, and I say all of a sudden, I'm being flip, but you—

sure, sure, sure, they're just catching up.

We're kind of catching up. They're trying to figure out what to do about it, but the best practices on how a company should do that in order to operate. As you know, I often use this term of like actor on a geopolitical battlefield, that these private companies are now actors. And again, that's kind of a term borrowed from like IR theory. They're like, in the same way that states are actors on the chessboard, companies are too. And they— that is not something that you can navigate by having like geopolitical analysts that are like, you know, junior to mid-level people reporting somewhere in the security function, right? That's something that you're only going to be able to navigate when you have somebody who's speaking to those issues at the board level or at the, you know, the executive team, the C-suite level. And to just take it one step further, I think that those conversations increasingly are happening at the board level. I think most of the time they're happening at the board level where somebody comes in, like some of the folks that we've got on our team, you know, former ambassadors or CIA chiefs of station, and they'll come in and they'll do a board briefing and the board will sit enraptured because there's whatever they've been discussing all day is far less interesting than like China and geopolitics and the Russia-Ukraine war and whatever. But the follow-through on like, okay, and so what does the company then do? What processes are put in place? What is implemented on a day-to-day basis? Which part of the business is going to lead that effort and operate a whole of organization plan to address associated risks and opportunities? That I think gets lost. So, so I think there's conversation at the high levels. I think there's some investment within companies, but I think the implementation is really challenging.

Well, yeah. So while you were talking, I pulled up this, this report you mentioned. So the Chamber of Commerce piece, because I have the advantage while you're talking, I have a little time on my hands over here to listen to you, but also I have the computer and keyboard and everything.

So you need a guy like the, like Joe Rogan's guy.

What's the, you know, I, I, I do not listen to Joe Rogan, so I couldn't tell you the guy, but, uh, he has a guy. Everybody's got a guy, right? Everybody's got somebody, right?

I can pull stuff up while we're talking. Exactly.

Yeah. I'm, I'm, I get to be both as it turns out. And in this case I was able to, and it is an interesting report and I looked at the 10-K filing, so it goes back to 2009 in fact. So 2009 and what they did is they did an assessment as, as you mentioned of the totality of all the words in these 10-Ks and did an assessment to just see how much was related to geopolitics, basically. So about half of 1% of all sentences in the 10-Ks, it was Fortune 250, by the way, they used for this, about half of 1% in 2009. It's up now to, I don't know, 1.7%, something like that. So it's, you know, it's significant for sure. But the interesting thing, and I'm going to question you on this one. So there was obviously a big spike after COVID, not surprisingly. So between 2009 and 2019, it roughly doubled from half a percent to a full percent. You know, just 1% of all conversation was geopolitics. It shot up obviously with COVID shot up almost doubled yet again, and it's kind of fluctuated since then relatively high. So I don't know how much of this is going to be sustained. I worry about some regression. Certainly there was a pattern again from 2009, 2019, it doubled. So there was a pattern, but 1% of the totality of sentences in a 10-K isn't what I would call a really significant number, which makes me wonder, I mean, they're taking it more seriously, but how much more seriously and how long will that be sustained? Which by the way, are questions you certainly can't answer. I mean, they're just, there's data here. So it's interesting to see. And I don't think it should dominate a 10-K. For anybody who knows what a 10-K is, most of that is just the financials of the company and stuff. It's always going to be a relatively small percentage. That's not what a 10-K is designed to do, but it is designed to talk a bit about the company's, you know, focus and future and some of the impact they expect to see economic and otherwise. And geopolitics I still think probably is more impactful than what's showing up in these, in these 10-Ks right now. But I mean, what are you thinking on that in terms of, you know, do we think this is sustainable? Is this more related to COVID and, and maybe the current, you know, war of say the Russia-Ukraine war? Are people going to stick with this and understand this is a continual thing? Because this has been a problem before COVID before the war, it's always been a thing. It just became something that companies seem to be taking more seriously. But do, do you think we're going to see regression once, you know, pandemics pass away, assuming they do, and, and, you know, wars subside? Or is this going to become the new normal? Do you think people are going to internalize this as this is how it's always got to be? Or is it going to go back to just being like, you know, guns, gates, guards, you know, IT, and not worry about what's going on beyond the horizon?

I do think it's the new normal, and I, I say that as somebody who has plenty of reason to be pessimistic about it, because like you said, I mean, We kind of come out of this world, you know, in the government world, national security world, and then you talk to a bunch of folks in private sector and it has been a process for me of being like, okay, we're really not there in private sector in terms of our understanding of this. And so I have reason, I think, to be pessimistic. That being said, I think that the, you know, there's this quote which is like so trite at this point that I hate that. But it just came to mind, but it's, and I don't remember who said it, so I apologize.

That's okay. I'll find it. You just gimme the quote. I'll probably find it for you.

That you may not care about geopolitics, but geopolitics cares about you. Something, something like that. And I think that that phenomenon is going to force companies to just deal with it more and to factor it in more and to probably build more professionalized processes around how to manage it. And it goes back to, like, how do you predict the future, right? If, if you talk to anybody who's in futures and stuff like that, you look at underlying trends, drivers. And if you look at the underlying trends and drivers around this, nothing is going to— nothing would point to this regressing in terms of the threat and risk faced by companies when it comes to geopolitical issues. Most companies that are dominant today were built in an era of sort of like unabated U.S. globalization, U.S.-led globalization. And so it had been taken for granted for many years that to the extent you needed to worry about political risk— and you remember now everybody talks about geopolitical risk. For a long time, about political risk. And the reason they talked about political risk as opposed to geopolitical risk, I would say, is that when they were talking about political risk, they were talking about, okay, we've got, you know, oil equities in Venezuela and that might be nationalized, as opposed to— so, so in other words, it was highly geographically bound, right? If you were going to invest in a certain country, you might have political risk associated with that.

Yep, sure.

Typically from expropriation. And then obviously there was terrorism, was considered a form of political risk after 9/11. But that was pretty capably handled, I think, by the physical security and corporate security department because it was a physical security issue, right? Like, you know, get, get your bollards in place and, you know, figure out how to kind of do business in Iraq or whatever you needed to do. But that's very different from what we're dealing with now. This geopolitical risk. Is all-encompassing. It's this global contest for power between the United States and China that I am not an expert in predicting the length of bipolar contests, but I don't think anybody in Washington thinks that that dynamic is going to go away for, you know, potentially a decade or decades. So, you know, we're looking at a— you're looking at a 10, 20, 30-year time horizon of this being the new normal. So, yeah, I mean, I think there, you know, of course you could have regression in the way that companies invest in it and treat it, but I think that they will ultimately lose for that because I don't think the threats are going to recede.

Yeah, well, I think— I mean, that's true. I think one of the challenges we have is, is we're short-sighted as a just our culture, right? It's just how we're set up. It's how our, certainly our economic culture, but in general, we're, we're a short-sighted nation. You know, we think, you know, quarter to quarter, you know, business-wise, you know, people, something sometimes have to think, you know, month to month, day to day, week to week, however it might be. We live very much closer to the moment. China's, China thinks in generations. That's their cultural setup, right? They think in generations, they think centuries. They don't think about doing things so they can improve their own lives today necessarily. Generally speaking, obviously there's exceptions to this. Don't get me wrong. But it's more about generational, you know, where do we want to be in 500 years as a nation? Then broken all the way back down to these 5-year plans, of course, but it's all for that longer purpose. And those diametrically opposed thought processes make for some interesting, you know, discussions on where things are going to go. If you look at what China's done, you know, in the South China Sea, for instance, it's a very slow and steady march, you know, to building fake islands, basically dredging up, you know, ground to create islands to then claim it as territory to suddenly claim more You know, territory in the water as a result, right? That's a long plan. If somebody had to sit down and go, hey, what's the ROI going to be on that in the next quarter? You know, how much are you going to spend on that? What are we going to get back on it? It would never happen. We have a tough time with some of these, I think, and it's even crept more in the government space into, you know, how much are we spending? How— what's the ROI going to be? What's the value long term? By the way, just as a side note, the quote you were looking for from Pericles, actually originally it's been paraphrased a lot, but it's just because you do not take an interest in politics doesn't mean politics won't take an interest in you. And it does apply now to geopolitics and, and many people have, have applied this thing. So it's a great quote. It's good to note that just 'cause you don't care about something doesn't mean you shouldn't, or it doesn't mean it, it won't continue to work. You can put your head in the sand and pretend these things aren't real and, and hope they go away. And it's a good example when you talk about, you know, companies and geopolitics, those who choose to ignore this are doing it at their own peril. It's not as though China won't take an interest in you as a company because you just go, ah, we're not worried about China. If you have IP they want, you're a target. If you know, it, it's a problem. Problem, right? If you have, you know, financial interests that can help North Korea, they're going to go after you. If you're, you know, tied to something that's got the geopolitical risk, like you were talking about, you know, in different areas of the world with conflict, pretending it doesn't exist or just being ignorant to it won't keep you protected. On the flip side, if you have really bad security, maybe you won't know when you're attacked either. You know, companies tell us, you know, if you ever hear a company that says we've never been breached, I would suggest that their security team should probably have somebody do an audit. There's a good chance that they have been and they don't know. It's not a great brag point to say you've never experienced a breach. But so, all right, we've talked about this is the new norm. What's the answer going forward then? What do companies need to do to continue to improve upon this, to grow their knowledge, to, to get more proactive, to, you know, obviously I'm gonna throw out Chief Intelligence Officer 'cause that's what I always do at this point. But what, putting that one aside for a minute, or actually adding to it 'cause you're smarter than I am and I'll have better ideas. What should companies be doing? What are we doing to prepare for this next 20, 30-year new normal that you're talking about? You know, to stay competitive and ahead before you lose all your IP and all your access and all your everything and sink as a company and as a country?

Yeah, I mean, I think that to start small— and I think it's important to start small— and I, I just want to comment on what you said about businesses needing to show ROI on this. It's easy for you and I to sit here as individuals who are not employed by large corporations and won't need to be the ones who are going to the board and making the case, at least directly. Maybe we help that, but it's easy for us to kind of sit here and shout into our collective void, uh, everybody do better, right? But let's meet folks, let's meet companies kind of where they are. That is how, right, they do think short-term. And so then in, in companies where, you know, you have to show return on investment on a quarterly basis or something like that, how do you justify something like this? So I think— and, and what is it, right? So I would say start small. I would say if, you know, who are we talking to here? Who are your listeners? CISOs maybe, or, you know, cybersecurity.

I would think so. CISOs, C-levels, you know, you know, any practitioners all the way to the top, hopefully. But yeah, I would think for this conversation, we're probably dealing with more senior people and probably senior intel folks too. People running intel teams or trying to build out their intel teams.

So, you know, I would say for those individuals, I would establish kind of national security or geopolitical line of effort within the business. And this is a recommendation that also came out of a benchmarking report that we did with the Interstate Natural Gas Association of America. It was released in, in April. And when I say line of effort, that, that's kind of chosen intentionally because that could be one person, full-time responsibility. That could be a team, full-time responsibility. It could be somebody who takes it on as essentially another duty as assigned, right? But somebody or people within the company should be tasked with, hey, you are the guy or the girl to track national security, geopolitical, what is going on in this big picture environment relative to our company, and start to advise others in the company about it, right? And at the, at the outset, there may be no formal processes associated with that. There may not be a formal title associated with that. There may not be a chief intel officer or chief geopolitical officer, anything like that. But there's somebody, there's somebody who says, you know, either I've taken it on myself or I've been tasked by leadership to take a broader view. Of these issues. So we go back to the North Korea example we were talking about. In that example, this person would be responsible for tracking what's going on north— with North Korea politically, geopolitically, security-wise, for engaging across the organization on that so that they are talking both to the legal and compliance folks and to the cyber folks. And they can kind of step back and have that broader view. There are a lot of kind of analogies, I think, in the U.S. government system for that kind of role, right? So it's why we could debate— I'm sure you and I could debate for a couple hours, probably, CIA and ODNI and reform after 9/11 of the intelligence community. But what's let's put, put to the side for a second, at least my personal views on ODNI. And the idea was that you can't have 16, 17, however many there are now intelligence agencies who are not effectively coordinated because things will slip through the cracks. We'll miss things. One hand isn't talking to the other, and that creates a much higher risk environment. So you create ODNI, right? At a similar level, uh, or kind of a similar structure. And of course it predates 9/11, but you have the National Security Council system led by the White House. And the intent there is to ensure coordination across the agencies. So not the, not just the intelligence agencies, but the policymaking agencies in the form of the State Department, DOD, et cetera.

Sure.

Those bodies, ODNI and NSC, playing that kind of coordination role, and then staffing that information up to senior decision makers, whether it's the Director of National Intelligence or the president, mm-hmm, enables a holistic view of issues that may seem unrelated, uh, but in fact are related. And so, you know, we could go through a number of examples, on the national security side where that's really important, right? One of the reasons that ODNI was stood up in the first place, 9/11, obviously. So you have on the one hand, the Central Intelligence Agency, which is responsible for overseas intelligence, for example, monitoring Al Qaeda overseas. And then you have the Federal Bureau of Investigation responsible for law enforcement domestically, right? And so when 9/11 happened, and I'm saying this not for you, but for the best, right?

I'm sure you're familiar with it.

When 9/11 happened, there were concerns, you know, as articulated in the 9/11 Commission Report, that CIA and FBI were not communicating effectively. That's part of the reason that 9/11 occurred and was not prevented. And so there you have an example where, you know, you've got two different agencies, two different sets of roles and responsibilities. Unless they are forced to talk to one another and the barriers for talking to each other are reduced, bad things happen. Right. And so you can see— and by the way, now that applies to all other national security things too, right? Like China. Okay. So, so China is using cyber, they're using insider threat, they're using foreign interference. All those things might be handled by different parts of the US government. Unless there is a convener to bring that together, track it as a holistic picture, and staff information up for decision-making, you're not going to be able to address that issue or that risk effectively, right? So it's, it's applying that model to companies, and companies already have their own version of this, which is essentially, you know, board committees and subcommittees, right? That there, there are governance processes for a number of issues across companies to bring in the various stakeholders and staff information and decisions up. The problem is, again, going back to that lack of professionalization, lack of standardization when it comes to navigating these geopolitical, national security, big picture security, whatever you want to call it issues, the governance processes are really, really immature. Immature on the whole across businesses. And I'm sure, you know, there are outliers and there are some businesses that are well ahead of the pack on this, but generally speaking, the private sector is fairly immature when it comes to that. So a long-winded way of answering the, the question that, you know, I would say in the, in the first instance, identify somebody who they might not be the, you know, they're not the National Security Council of the whole company. Yet, right, when it's very difficult to justify resources and spend, identify somebody who can be like the kernel, the like proto, like, like single cell organism of that thing within the business. And if they are, I was going to say competent, but really to do it right, they would need to be exemplary. It would need to be an exemplary individual. Mm-hmm. Who can take that unstructured problem set and drive it forward. And if they are successful, the company in the form of the business units and the relevant stakeholders who are consulted and the C-suite and the board will start to see value. Right. And as, as was demonstrated, you can justify the resources to grow it.

Yeah. And I agree. You know, like I said, I, you know, I, I've banged the drum for years about this chief intelligence officer position. I certainly agree with the concept of, you know, plant the seed, you know, germinate, you know, let it grow. No, it's very unlikely anyone's going to go, okay, we're going to make a big change. We're going to hire a C-level and we're going to, you know, make this huge organizational shift. They're probably not going to if they've had nothing to begin with. Right. But I will say two pieces that would concern me with this concept. I think they're a good idea. You just got to make sure people are aware is one, as you said, you're going to find a pretty special talent for this because you need to find somebody who can speak basically all the languages. Can speak physical security, can speak cybersecurity, can speak the legal and compliance issues, you know, can speak executive protection. That's not— and national security and geopolitics and all those things. That's not an easy person to come by. And then you're going to have to— frankly, sadly, that's the easier part, I think, of the two parts here. Because the second part is— yeah, yeah, you're waiting for this, right? Okay, so first we got to find the unicorn. Let's go look for that. That's— and that's the easy part. The second part is you got to empower them. So, you know, Making people listen is a challenge. So if you hire somebody and, you know, this is why I've advocated for this chief intelligence officer role, because if you hire somebody at such a low role, let's say, as you said, you know, what if this is just a secondary job we add to, hey, we've got an intel analyst, they're really smart, they came out of the government space, they, you know, they know a bunch of these things. They're an analyst in the SOC, you know, an intel analyst on the team. We're going to give them this as their, okay, you're geopolitics now. It's going to be incredibly difficult to get that person So for that person to get the people they need to listen to actually listen, you know, the CISO, maybe you don't even get that far, you know, just some directors, senior directors, but you got the CISO, you got, you know, getting the C-level to listen, getting the board to listen. It's just going to be very hard because, you know, that's just the culture. Unfortunately, there aren't a lot of, you know, C-levels that care about this junior intel analyst's position in the SOC who they've never met before. And that's wrong and it shouldn't be that way, but it is. It was one of the nice things in the intel space when I was in the government, at least. Specifically in the Air Force, you could have two stripes on your arm and be very junior, but if you knew the right answer, leadership was going to listen because we had different motives and objectives. First of all, you know, bombs on targets is different than business. Saving lives is different than business. The other aspect that went along with it that we didn't have to worry about was fiscal responsibility, I suppose, or, or, you know, profit, right? So, you know, that, I think that becomes the other big challenge in this is, you know, you talk about, you know, the need for ODNI. And I believe the concept, good concept, you know, whether it's applied properly, different discussion. But yes, we had things falling through the cracks. Somebody's not got to be able to translate all that stuff and make it work. But the government also can just reorganize and decide to do that and add a whole nother layer and add a whole bunch more cost because it's the government and they print money. Companies are loath to do anything that costs money that doesn't, you know, track directly to ROI, which brings us back to your point, which is start really small. And that brings us back to the other point of how do you get people to listen? How do you find the unicorn? Like, it seems to be this. This endless cycle of small would be great if you had the unicorn and people would listen. So that person's got to be very heavily empowered and that normally comes with a title, which then makes it bigger by definition. Right. So I don't know how to thread that needle. I think you're right. I think starting small can work and will work as long as that person is the right person, which there are few of those, and is empowered that people will actually listen to that person, you know. So whether it's, you know, an advisor to the CISO, for instance, or advisor to the chief security officer, or something like that, uh, you know, so it's got to be something that people will actually listen and take note. Otherwise you're just whistling, you know, in, in the graveyard basically, and nothing's changing. And I feel like that's where we're at in a lot of these cases. Even teams I've seen when they have geopolitical, it's like, oh, that's nice to know, you know, that shows up in a brief someplace and somebody, well, it's interesting, but it seems like it's still the less important thing for a lot of folks. And I get it, everything can't be the number one priority. There's, you know, there's an endless supply of very important things. But for anybody out there listening, for any CISOs specifically, but anybody listening who says, I want to be proactive. If your next answer, when I ask the question, what are you doing in terms of intelligence is less than stellar, you don't want to be proactive. Like you were wishing for it, but you're not planning for it. And that's, I get a lot of those conversations. You wish you were proactive, but you certainly don't want to invest in being proactive. You're just hoping it'll happen magically and then blaming whatever vendors you're hiring for not achieving it because you didn't really invest in this at all. Proactivity takes time. The reason the government is the best in the world at proactive is because they spend an absolute ton of money and time and resources on trying to be proactive because their motive isn't about trying to get the next quarterly report to look good so they can make more money and their stock will go up. Their motive is let's make people not make, make our people die less. Sometimes make the adversaries die more, continue our national power. It's a different objective and therefore a different set of investments on strategy. And until you can invest strategically like that, it's very— I find it to be incredibly difficult to make this work. So, but I, again, I think you're right, for what it's worth, as far as the path forward. I just don't know where to find those people and get them empowered.

Yeah. I mean, so first of all, I totally agree with you, right? If I were—

that's the clip I'm taking out of the show, by the way. That's going to be the headline of the show that goes over. I totally agree with you. All right, cool. That's the clip.

If we were sitting with, you know, a CISO or, you know, head of external affairs or the chief security officer or whoever right now. And the question was, okay, well, do I start small or do I bring in somebody at a senior level? Definitely bring in somebody at a senior level, right? Yes. I, I only make the start small recommendation because I don't think I've ever had that conversation. If the choice is not between a junior person and a senior person, but the choice is between tasking it to somebody on your existing staff versus doing absolutely nothing at all.

Yep.

And I would say task it to somebody junior on your staff. Yep. The point being that anything is better than nothing because at least you may end up with somebody who can take the ball and run with it. And for that, I would say, look, you have a lot of people coming out of Washington, a lot of people coming out of government. A lot of people with degrees in national security who would love to go and do something like this at a private company.

True.

Love.

Yeah, it's a great time for it.

I— and, and those people, for the most part, if they have the right background, they're not going to be experts in cyber, EP, compliance, whatever, but they may be the right kind of person to be able to navigate that multidisciplinary work.

Well, yeah, especially if they've got briefing experience. Like, for anybody who's looking at resumes or whatever, you want great intel folks. Look for anybody who's done a lot of heavy briefing, especially at high levels, because they had to learn to polish their language. They've had to learn to communicate. They've had to learn on the fly some other things that are outside of their depth because you have to in those communications because you have to trust that that SES or that, you know, 4-star or whatever, they're going to ask you a sniper question. You better be prepared for all the possibilities. So I would say for— you're right, there's a lot of great talent coming out of the government right now. Specifically, look for people with intel experience who've done briefings and communications specifically for this kind of a role. They may be great writers, but if they can't leave their desk and tell people, you're still gonna have a really hard time because flat language on paper, digital or otherwise, is just not as convincing as somebody who can stand in a room and take the fire and convince somebody they know what they're talking about because that person that's listening to that analyst has to decide. If I'm going to invest my decision-making power in that person's opinion, and that doesn't happen on paper.

Yeah. And, and I would say, you know, definitely agree with you. You definitely have some people coming out of the intel community who are, you know, analysts who like to write and sit at their desk and do, you know, that is not the right fit for this type of role because you need somebody who can go and do the relationship building. And so, you know, somebody who has interagency experience, you know, did a lot of J— if they come out of the intel community, did a lot of JDAs or like, you know, and they don't need to be an intel person. They could be, you know, one of the National Security Agency, but that kind of experience working, you know, look, like I was a State Department, I wasn't a Foreign Service officer, but yeah, I was a State Department person, but needed to work with a lot of different cultures, you know, worked with the agency on a regular basis, worked with the Bureau on a regular basis, a lot of different cultures, very different backgrounds. Of people, but you know, that, that kind of ability to bring that together, because that's the same thing you would be doing in a company, right? The, the folks who work in the GC's office are a different breed than the folks who work for the CISO. You got to be able to talk to them both and get them both bought in. Yep.

Well, yeah. And the physical security executive protection team, assuming it's not a CISO, that's a whole different group. Trigger pullers, you know, going back to like military days, government trigger pullers. You know, uh, people who wear guns are not the same as desk analysts. They just, it's different cultures and you gotta be able to speak across both because otherwise you'll lose respect for whichever side you can't speak to. Uh, they'll lose respect for you, I should say. And then you're out. Like all these people have to come together. You gotta get the tech people together. You gotta get the trigger pullers together. You gotta get the policy people together, the lawyers together. You gotta have somebody who's got some persuasive skills and they're just, you know, there aren't a lot in the intel community. Intel's full of introverts, but there are some, certainly there are people you did a lot of briefing work and like you said, interagency, you said JDAs, that's Joint Duty Assignments for anybody who doesn't know that. People who've been around, like they, and they've talked to people at different levels in different focus areas. You know, there's 17 agencies in the intelligence community. We don't all speak the same language. We don't all see things the same way. But if you've worked in a handful of them or some joint operations, you have a chance to understand them a little bit better. So yeah, I think it's a great idea. I do for the way forward. It's good to see that there's this much focus on geopolitics. It is growing. I hope it continues to. Because as you said, as Pericles said, right? You don't have, if you're not interested in politics, it still may be interested in you. So listen, we gotta get to the end here. I mean, I could do this all day and I would, but we should get into the, to the closer of the show, right? So for anybody who wants more information, by the way, on, on this, you can reach out to Mark Friedman. I'm sure we can get you contact information. You can reach out to me if you need as well. You know, if you're looking for, for more opportunities to understand this better or work with his organization, understand how to protect yourselves better and your company better, build better solutions, you know, better services or get services from him. I can certainly hook you up. I highly recommend Mark. You heard his resume at the front end. You've heard him talk the whole episode. He knows what he is talking about and these things aren't going away. Like this geopolitics is not going to disappear and it does affect all of us all the time, whether we believe it or not. But anyway, so to move into the closing of the show though, so the name of the show is Unspoken Security. With that in mind, you get the same question everybody gets. Nobody gets to duck it. Nobody has so far at least. Abducted. Tell me something you never told anyone before, something unspoken.

Yeah, so I had to think about this one, and we'll see how you think.

Well, it can't be classified, so it's a little tougher when you're— when I'm dealing with folks. Yeah, so yeah, don't tell me that.

This is firmly, firmly outside of the realm of work. So I've got an almost 2-year-old son, and when he was like a really young infant, like, you know, still kind of in, in our bedroom before he had moved into his own room, I was often the one who was in there getting him to sleep, uh, before he went to sleep at night, because I, I had developed this really good reputation for getting in there and, you know, rocking him to sleep or whatever. And the secret, which—

wait a minute, you're the baby whisperer of the family is what you're telling me?

Here's, here's the—

you're gonna tell me the secret now? Everybody should pay attention because everybody needs this. All right, go for it.

I don't think my wife listens to my security-focused podcast. Well, if she does, she'll find out.

I'm going to find her and send her this.

I was so bored rocking him to sleep for like an indefinite period of time that I would listen to podcasts. And I found that when I would listen to Pivot, which for your tech listeners may know Scott Galloway and Kara Swisher, I would listen to Pivot. He would, it would like knock him out. So I ended up just like listening to Pivot every night as I rocked him to sleep. And there was something about like Scott Galloway's like screaming, irreverent blows that you're just like, oh man, this is the good stuff. I'm going straight down.

This is an interesting, I don't know if I were Scott and Kara, I don't know if I'd be like, I'm in one hand like, hey, I got a listener. I got a subscriber, a follower. That's great. On the other hand, I'm not sure this is the review I'm going for. Yep. We're so interesting. The baby falls asleep while we talk. I mean, I'll tell you, me personally, I'll take all the listeners and subscribers possible. If you're all just using it to put your baby to sleep with my voice, I'm fine with it. I won't be insulted, but. It would be interesting if Scott, Scott or Kara ever heard this, which seems unlikely. Love to get their reaction on how they feel about being the podcast to put babies to sleep. Now, is this something you've passed on to others? Has it worked beyond your child or just is, is your kid the one?

No, I don't know. This, this was my unspoken thing, but now it's out in the public.

All right.

So maybe, maybe your listeners will try it out and you'll get some feedback about it. All right.

Everybody's find the Pivot Podcast. It's Tuesdays and Fridays. New York Magazine actually is the provider, by the way. Kara Swisher and Scott Galloway. I have no connection to them or anything, but I guess for those of you with small children, you have a hard time putting to sleep at night, I guess check out Pivot and see if that also works on yours. Maybe this ends up being a new trend. Good for them. They'll end up with more, more listeners and putting babies to sleep.

I enjoy it for the record. I en— I enjoyed it.

Well, it is a good podcast.

Yeah.

It's not just for the babies. It is a good one.

All right, man.

Well, that's a good one. I appreciate it. That's, I've not heard it before, so that's a new one., and now we'll see what, what people do with that information. But listen, Matt, we gotta close it out here. I, I want to thank you for taking the time to come on. We could have talked about this obviously all day, all night. It's interesting to see how things have pivoted and changed in security and where the future is, you know, in terms of nation states rising up and being a bigger concern, you know, in national security than terrorism, at least for the moment, and what it means from the private sector. So any last words from you before we, uh, before we let everybody leave for the day?

No, just really appreciate it and thanks for having me on, AJ. All right.

Well, thanks again, Mark. I appreciate it. And with that, that has been another episode of Unspoken Security. That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.