Unspoken Security Ep 55: The Dangers of Performative Leadership in Tech

You have to be humble. You have to lead with humility because what's gonna happen is your ego is going to prevent you from learning, whereas humility is going to accelerate growth and learning. So for your own sake, you should be humble, right? In the military, I'm sure we stole that from the army. The most thing you have in common, it looks like we steal a bunch of ideas from the army, but the 3 C's of leadership, right?

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry. Hello and welcome to another edition of Unspoken Security. I'm your host, AJ Nash. Spent 19 years in the intelligence community, mostly at NSA. Been building and maturing intelligence programs in the private sector for, I don't know, 10, 11 years now, something like that. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! So I continue to be deeply committed to servant leadership, and this podcast, it brings all these elements together with incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. It's not your typical polished podcast. My dogs make occasional appearances. People argue and debate here, and they swear. I've been known to, and that's all okay. Please think of this podcast as a conversation that you might hear at a bar after a long day in one of the larger cybersecurity conferences. That we all go to every year. These are the conversations we usually have when nobody's listening. Now today I'm, I'm really excited. I'm joined by Bob Fabian, BZ Zinga. So he's a cybersecurity executive, Naval Information Warfare Commander, host of the Leadership and Success podcast. He's got over 28 years of experience across the defense sector. He's got Silicon Valley startups, higher education. He's been the CISO at Santa Clara University, virtual CISO for Fortune 500 companies. He's held senior security roles at Groupon, Pivotal Software, and at the Defense Language Institute, where I'm a graduate of. They're probably not very proud of that. I wasn't very good. In the Naval Reserve now, he serves as commanding officer of a 72-member unit supporting Naval Network Warfare Command. He's also a Forbes Technology Council member, EC Council certified CISO Hall of Fame inductee, and serves as a board advisor for the United Cybersecurity Alliance and the Arizona Cyber Initiative. So I don't know how I tricked him into coming on the show. Don't tell him he's too good to be here, but he definitely is. BZ, is there anything you want to add to that bio?

No, not really, but in agreement, I was saying I was really pleasantly surprised yesterday. They selected me as a top 50 global thought leader and influencer for cybersecurity in 2026. That was by Thinkers360.

Wow.

That's a great, great honor and privilege.

So that's awesome. Yeah. I, and I appreciate you being here. I mean, the resume speaks for itself, right? I mean, you've been doing this a long time and interestingly, you know, you've got that military background, the government space, you've also got the private sector. So, you know, those are different environments for those who haven't been in both spaces. It's unusual to find somebody with such a depth and breadth of knowledge and experience, and specifically not just in the tech side, but the leadership piece, right? You know, I mentioned in the opening that I have a master's in org leadership. I, and I like to get that in the show, but sometimes we don't have that. You know, some episodes are just tech this, and, and they're interesting stuff, don't get me wrong. I shouldn't say just, but I really love having an opportunity to talk more about the people aspects. And then so today we're going to talk about the dangers of performative leadership, you know, particularly in tech. And I'm very excited about this. I, again, I really appreciate you being here because I couldn't think of a of a better expert to talk to on the subject, really. But as we jump in, when we talk about performative leadership, you know, to you, what does that mean? What are we talking about?

Well, so thanks again in the intro. So really, when you look at my career, it's really mainly, right, the US Navy and the reserve component as an information warfare commander, but also Silicon Valley, especially the last 12 years, right? So basically, I went from the Navy cyber war room to the Silicon Valley boardroom. So what I do care most about, especially in cybersecurity today, I think is leadership. Leadership that actually shows up for people, right? Not optics, not slogan, not quarterly talking points, but real leadership rooted in values that don't shift when they become inconvenient. I think personal leadership is extremely important, especially now in the age of AI because AI might be able to do a lot of things that men, people, women can do, but AI absolutely cannot lead, right? We need people to do that. So I know that leadership isn't easy, you know, when it's popular, it's revealing when it costs you something, right? And that's where really performative leadership quietly does most damage, I think. So when you ask, when we talk about performative performative leadership, what are we really talking about? So in my mind, when I talk about performative leadership, I'm really talking about leadership that prioritizes appearance over accountability. Two different things. So it's when leaders say the right things publicly, but they make very, very different decisions privately, right? There is incongruence. There is absolutely no integrity. So it's values on a website. And Silicon Valley, almost every business I've worked for, they have those flyers about the core values on the wall, but they never hardly live by those. You know, they don't hire or fire by those. It's extremely rare. They usually, you know, would promote people who have high performances and bring in the money regardless of how they add or take away from the culture. But in any way, so what I am saying is it is really For a lot of businesses, it's not values in a budget. I guess that's another way to say it. So for example, DEI, right? Diversity, equity, inclusion. It was really big now after George Floyd in 2020. And now that we have a brand new administration who's against it, all of those organizations, most of them, they've changed their mind. Like they never really believed in it. So it was just performative. So they, they didn't have any stand whatsoever, any skin in the game. They didn't mean what they said, but they said what they believe was the right thing to say in order to make a quick buck. That's, that's pretty, pretty much if we have to be honest, that's, that's really what happened. Well, so I, I think it's not just, you know, DEI statement or mental health post or people-first language that disappear the moment they become politically uncomfortable or financially inconvenient, you know, like it is right now in America. So to me, performative leadership is really transactional. But so it asks, you know, what's popular right now? What protects me? What helps my brand right now? I mean, if it changes tomorrow, then they will just change, you know, on a dime. But I think the real danger with that though, especially in cybersecurity, is people, they really can spot inauthenticity instantly, right? When trust erodes, psychological safety disappears. And when people don't feel safe, they stop speaking up. That's really a big, big danger. I can't remember who said this, but someone had said, you really have to be seriously worried when the people in your organization, those who are more engaged, stop talking. That is very, very, very dangerous because that's really how breaches happen. That's how risks are found silently, right? In security, silence is never neutral. I believe it is dangerous, at least from my opinion. So if performative leadership is about optics, I believe the natural question becomes, in contrast to that, you know, what are the indicators of genuine leadership.

Yeah, no, I think you make a really good point. I think, by the way, and I have the advantage of Google— Tim McClure, I believe, might be the first person who made that quote. Yeah, a few people have. I, again, I have the advantage of Google. I'm actually Googling it as you ask. I knew the quote too, but it is a famous quote, you know, when the people who were engaged, people most passionate, when they stop talking, you know, that doesn't mean things are great. You know, a lot of people are like, oh, silence is good, nobody's really raising concerns. No, that's probably a really bad thing. When people stop raising concerns, they don't feel like they're safe to do so anymore, or they feel like leadership doesn't care. They've given up on trying to convince anybody. Quiet isn't necessarily a good thing. But I think it's great you mentioned that, you know, you're talking about performative, you know, you made a really good point, you know, that the winds of change with the EI, right, is a good example of that. You know, some organizations went all in on it, and then when the winds of change came through on politics, they went all out on it. You go, okay, well, they never cared. And some have stuck, you know, and said, no, this is who we are, this is who we believe in. Just as when the sweep came in, some said no and didn't. And so, you know, they're— that's their values, right? They didn't, they didn't move with the winds. This is who they are and what they believe in, for better or worse. People can make their choices there, but this is who they are. I think those who move back and forth, you know, you recognize there's, there's like an ethical issue there. They're doing what's convenient, right? What's, what's in their best interest, they believe, whether it's politically or economically. And it's unfortunate because, in my opinion, you can't really walk a lot of that stuff back. Now, that isn't to say people don't learn. You can change. That's fine. You can change once, I suppose. But if you keep changing back and forth, it's pretty clear you're just going where, where the flow is and that you don't really have an ethos of your own. And so, you know, I'm curious when we talk about that, you know, what happens to an organization when the leaders abandon values, you know, when they're under pressure and they abandon those values? What are, what are the long-term pieces, you know, that become an issue with that?

Yeah. And I believe from your background similar to mine, you were in the military. You went to DLI and then you had experience at the NSA too. So if I was going to ask you, what were your core values as a service member so many years after you've left the military, what would you say your core values?

Integrity, service before self, and excellence in all we do. That's Air Force core values.

Exactly. For me, U.S. sailor is honor, courage, commitment. And it doesn't matter which sailor you wake up in the morning or late at night, they will tell you exactly the same thing today, 20 years from now, or 20 years ago. It's really built into us, right? It is a core. To who we are. That's who I am as a sailor. It's not just something I am performing. It's really who I am at my core. And I speak about 8 to 12 times or so every year. I go to security conferences and summits. Sometimes I'm a keynote speaker and I love to ask this question. What, who knows who the core values of their organization is? Except for people in the military, 99% of people have Absolutely no idea. Most of them may have, yeah, I think there is something about caring. There is something about respecting the customer, but they don't know what those core values are. And it is really, really sad because if you don't know what your core values are, how in the world are you making decisions? And here I'm talking to executives, CISOs, CIOs, CTOs, people in charge. If you don't even know what your core values are, how in the world do you make decisions every day? What are you working toward? What do you represent? What do you stand for? Again, in the military, the Air Force, even though I think is a little bit subpar, but not the Navy, the Army, all of the other branches. We know exactly who we are, what we stand for. It's drilled into us day in and day out. And I think that's really what we need because that's how we should be making all of our decisions, especially when it's critical and especially when it's under pressure. Right. And I think the specific question you asked was what happened, right?

If, if, so can you ask the Yeah, what happens if the leaders abandon those values? You know, when they're under pressure and they go ahead and give up those values, you know, what happens to the organization then?

Well, you really lose integrity, trust. And I think trust is probably one of the most difficult things, you know, to really earn. My mentor taught me, rank is rented. No matter what your position is right now, eventually, you know, not gonna be in that seat of power anymore. But trust is earned. Earned. And leadership is really how people feel long after you have left your post. Really the impact you've had on people, how you made them feel. That's really what leadership is all about. And that's based on trust. And if people cannot trust you, they cannot work for you. Now, of course, one of my primary mentors, Dr. John C. Maxwell, I've learned so much from him. One of the books, just gonna make a quick plug here.

Sure, go ahead.

You'll find one of leadership Great, great book. It talks about level number 1, which is positional leadership, right? That's when people are going to obey you just because of your position. You are the CIO, the president, the CEO, or whatever your title is. So they're gonna do whatever you say because they need a paycheck.

Yeah, it's not, they don't have a choice. It's not leadership then. It's just they're gonna do what they have to do. It's hierarchical.

Yeah. It's the lowest, lowest form of leadership. But when people trust you, when they like you, when they want to follow you, then you go from level 1 to level 2, and that is so important because then they see someone who is equitable, who is fair. You may have high standards, and many of my bosses have had very, very high standards, but you are fair and you are persistent and you treat absolutely everybody the same. That really builds trust because your people should never wonder, where do you stand? Is the boss on this side or that side? They should know exactly where you, where you stand on things that matter all the time, no exception. That builds trust. They trust you because they know they can rely on your word. It's not wishy-washy. One way you are for diversity and the next day you are not. Like, who are you? Right? So that is why I think it's so very important to know exactly who you are, what you stand for, and really live your life by those core values. Live a life of congruency, right? Where what you say and what you do align. Another way I've learned that in the Navy is when they say that the audio doesn't match the video. So whatever you're saying and what I'm saying, there will be no trust. And those people, again, they're gonna do what you say because you, you give them a paycheck, but as soon as they can, they will find another boss because they cannot trust you.

100%. Well, and you made a really good point. You talk about core values, right? And a lot of people don't know the core values of their organization. And as you said, from a leadership standpoint, Why? What are you doing then? How are you making decisions? And what it comes down to, I think a lot of times, is then you have leaders in different organizations, they're applying whatever their values are, and therefore you have this whole inconsistency across an organization, which people have seen. You transfer from one part of the organization to another and everything changes. Things that were fine aren't anymore. Things that were off limits are things you do now. So you don't have a culture that's corporate-wide. You have one that's just business-unit-wide. But the other thing I've seen is that you have— obviously the leaders don't necessarily know what the core values are. And neither does the team. I've seen the opposite happen though, where I've seen people work against core values. And you may see somebody who does know the core values and, hey, this is a direct violation of our core values, and they resist, or perhaps it even becomes an HR issue depending on what kind of core values we're talking about. And have you seen some of this? And I'm going to tell you my point first, just so I don't set you up. I've seen that not go very well. I've seen organizations that have these core values on the wall, and then you see a high-ranking leader who clearly violates those core values, just something that's unethical. The person who is affected following proper protocol, hey, I believe in the core values, I study these, I believe in this company, I'm following the process. And lo and behold, that person's not there in a few months. It's not officially retribution, but funny enough, the organization ends up valuing the person who they decide is more value to the org, which is this higher leader, which again takes away all your credibility as an organization. I think I've seen it happen and every time it happens, I've seen people go, well, the core values in a company don't matter. As you said, most people, I don't think really necessarily believe them anyway. They're just things you put on a wall, but it ends up—

That's where you know all our most engaged employees, they go silent.

Exactly.

They just quiet. Yeah.

Yeah. It's unfortunate to see. And so the other thing is when we talk about silence, so this is a tough one. We're in a, there's always been difficult times, but I'd say we're in difficult times right now, right? However you want to look at it. Almost everything is political in some form or fashion now. You know, there used to be the old days, it was like, hey, don't talk about politics or religion at work, right? And most people were, yeah, keep— it's almost impossible now because things that didn't— weren't political are now. You know, all you like Nike, so wait a minute, somebody's boycotting Nike now. Oh, you know, it's a really good, you know, cup of coffee. Well, where'd you get it from? You know, I, you know, it's impossible to have conversations without something feeling political, right? But some things are, are happening in this country and, and I have a question about neutrality versus ethics, right? So we're dealing with whether it's racial issues, whether it's the immigration issues, possible government overreach, some of these things that are happening. And I just saw a story the other day about corporations, CEOs that are finding themselves in a difficult position of you don't want to lean too far out into the politics. You don't want to do that. You don't want to upset the government. You don't want to upset— you want to be able to sell to everybody, right? So people from all spectrum. You want to be able to sell to them, so you don't want to pick a side sometimes. But sometimes doing nothing is picking a side, right? Some things aren't about politics, they should be about human rights and ethics and things. So I'm leading up to a question with a lot of talking, but is neutrality ever ethical for, for leaders, and specifically for cybersecurity leaders? Or, you know, is it one of the things we have to take a stand and live with that stand?

So when it comes to neutrality, I, I do want to be careful because I do believe that you should focus on your mission, the mission of your organization and watch your fingers. Everybody is working on something else, no, kind of stay, swim in your own lane. I think that's definitely a thing. However, having said that, as a leader, I think it goes back to your core value, what you stand for. Martin Luther King is probably one of the best persons who said that, you know, when he says that for those who are silent, he said something like, you know, injustice What did he say? MLK said something about—

I believe he said injustice anywhere is injustice everywhere.

Something to that effect, right? That is exactly it. Because when you see injustice and you don't say anything, by you being neutral, basically you've made a decision. When harm is foreseeable and you stay silent in the face of known risk, that is a decision and often the most dangerous one. So What I would say, really fall back to your core values. As you know, in the military, we always, you know, train the way we fight, or we fight the way we train. So whenever we are under extreme pressure, we always fall back to our level of training, right? So I guess what I am saying as a leader, you need to know exactly who you are, what your core values are, and if something is just unjust and doesn't align with those core values within your organization, as a leader, you do have to speak up. You cannot just ignore it, act as, act as if that didn't happen. Another thing that one of my skippers, a mentor, told me was, especially when I became a commanding officer, he says, as a CEO, if you see something that is misaligned with your standard, right, and then you don't say anything and you just let it go by, that becomes your—

that's the standard, right?

Yep. Yes. So that's why you know, but I think it really comes down to caring about your people, right? And then we say mission first, people always, but you really cannot accomplish your mission without your people and you really truly have to care for your people. I think there is no way around that. So that's kind of where I would stand on that.

Right. I absolutely agree. You know, and this is, I mean, violent agreement, right? This is part of the reason I was very excited. You know, again, my, my background in leadership, you know, organizational leadership, but servant leadership, you know, Gonzaga. So I'm a, I'm a big believer in people. I've always said, you know, if you take care of the people, people take care of the mission. You know, I was drawn to, to that line of, of education from my military service because I, I worked with some really good leaders, but I also worked for a lot of people that I thought were just managers. And you can see the difference, right? You know, for anybody in the Air Force, I don't know if, I don't know if the Navy does the same thing, but in the Air Force there are chiefs and there are E-9s. Chief is, is an E-9 rank, but if you're called an E-9, it's about as big an insult as it gets. And people won't call chiefs E-9 to their face.

Same thing in the Navy. Yeah, I would say 99.9999% of E-9s are actually chiefs. But yeah, yeah, from time to time you would find someone is like, I don't know, what did you make chief? I have no idea.

Exactly. And I, and I learned from that and said, you know, I want to get better at this, I want to be more knowledgeable. And, and I was lucky enough, you know, to— I was practicing servant leadership before I knew the term when I was in the Air Force. And I was lucky enough to— because I modeled after some really good leaders. But it does make it difficult because you do have to take these ethical stands If you want to be a leader, first of all, people won't trust people if they, again, if they don't believe you're going to be standing up for anybody or anything, then there's no point in following you. But I just found it to be hard to stomach when I saw people who shifted too much. You're like, oh, they don't really have an ethos. They're just self-serving.

Yeah. And most of what you're saying, AJ, I mean, I completely agree. If I can plug another book.

Sure, plug away.

Gets Off Fire, Steven Pressfield.

Gets Off Fire.

Page 412 is one of the best, best definition of leadership I have ever, ever read. So this is the servant talking about his king who died during this great battle. So the conquering army is like, okay, what's up with your king? I have never seen this because they were way, way outnumbered. Basically, they fought to death. It was a suicide mission, but still his people all followed him there. So, and then the conquering king asked the servant, so And then his answer: "I will tell His Majesty what a king is." No, he's talking about this king who just passed away valiantly fighting for his people with his men. He says: "A king does not abide within his tent while his men bleed and die upon the field. A king does not dine while his men go hungry, nor sleep when they stand at watch upon the wall." A king does not command this man's loyalty for fear, nor purchase it with gold. He earns their love by the sweat of his own back and the pains he endures for their sake. That which comprises the harshest burden, a king lifts first and sets down last. A king does not require service of those he leads, but provides it to them. He serves them, not they serve him. Stay in. If you are that kind of leader, I'm telling you, your people will follow you to the gates of hell.

100%. Yeah, it couldn't— I mean, obviously I couldn't say it better. It's a fantastic quote and it's a fantastic message that I absolutely believe. You know, take care of people. I've worked with folks and said, listen, you don't work for me. Like, I know how the org chart is. Yeah, it's fine, but you don't work for me. Let me be clear, I work for you. All right, because of two things. I mean, well, I have to believe in it. I've always told people, I'm the iron umbrella. Everything's going to fall on me. I'm going to keep you safe. All I ask of you is please tell me If you think things are coming, so I get ahead of it. I don't want to catch bullets in the back, but my job is to give you what you need to be successful and then get out of the way and get everybody else out of the way so that you can do that. I believe in that. But the other thing I've told teams is, listen, you guys can get me fired a lot faster than I can get you fired. I don't want to fire anybody anyway. Just understand, if all of you decide I'm an asshole, I'm getting fired. Like, that's how it's going to work in healthy orgs. You all start saying you don't want me here, I won't be here. So, you know, you get to decide who runs this place. My job is to, like I said, serve the people and give you what you need. My role and my title, all that does is give me more opportunity to help other people. And that's the goal and that's the objective. And I've worked in some organizations where people, and that's more my opening line when I come in and you see the room full of people, because they've been in corporate worldwide, they go, yeah, whatever. It's like the core values. And I've told people, I don't expect you to believe a word I'm saying right now. I'm not worried about that at all. You'll see it. You got to live the experience. I got to live my words, and then you'll see it. And the first time I end up getting in the way of a bullet or something, you'll go, geez, I guess the guy's serious. And that's totally fine. You got to prove it, right? But I'm a big believer in, like you said, if you do that, people will listen. And to me, leadership isn't about power. It's not control. It's just about trying to help people. That's all I want to do is make the world a better place. And there's so many poisonous and toxic work environments. And self-serving people. And I just like, I don't want that. I just want to be in a position where people go, okay, here's a place where I can go and I cannot hate every day, every minute of every day. I just want to go in and do good work and I can trust, you know, when things go wrong, it'll happen. Like, don't worry, just tell me so we can get in front of it. It's not, nobody's gonna, it's not a big deal, you know, it's not, unless it was malicious and, you know, it's fine, accidents happen. Let's just get in front of it. That's a healthy thing. Otherwise you have organizations where people hide everything because they're afraid, you know, toxic organizations where people rule by fear. Then, you know, you end up with like a Saddam Hussein to get to the, you know, the biggest parts. Saddam Hussein, you know, picked a fight, went to war basically because he thought he had technologies he didn't have because none of his people told him he didn't have it. Because the last people that told him he didn't have it, he killed. After that, nobody gives him bad news. So he, so he thinks he's got this whole burgeoning weapons program that doesn't exist because the last people he said couldn't do it, he killed them. Well, next people kept telling him he had progress. That's how it works. And that's how it'll work in any environment. If leaders, you know, rule by fear, people won't tell them. As you said, they'll stay silent. So I'm curious now, transitioning a little bit, same topic, but when we talk about intel, or talk about leadership specifically in tech, now I've heard you say before that you think the biggest cybersecurity risk isn't technology. It's not endpoints and malware and yeah, it's people. So, you know, I'd like to get your thoughts on this. Why do you think the biggest security risk today is actually people?

Well, as you know, when we talk about technology, especially cybersecurity, we kind of have three pillars, right? It's the people, which I think is the most important one, but there is technology and then the governance policies and so forth. I think we are only really as strong as our weakest link, right? That is why—

it's true though. It's very true.

Yeah. Because people use, right, social engineering and that's how you can have the best technology in the world. If I cannot hack your system, I can't hack your firewall, but I can hack your people, then I will have access. They're just going to give me the keys to the kingdom, right? And there are many, many ways you could do that if you are a good— if you are good with, you human relationship and even manipulation, you can pretty much get people to do exactly what you want them to do. So really, if you even look throughout our history, really every major breach you can think of, at least everyone that I have traced, really goes back to human decision. I believe it was IBM, that was maybe in 2021, '22. They used to have an annual report. I don't know if they still do that, where they say that 99% of all of the breaches that year were due to some type of human error.

Oh, sure.

Right. Ignore warning. Engineers go silent. They don't speak up when they should. Misaligned incentives or leaders prioritizing speed, image, or cost over risk. And also, even here in Silicon Valley, for the most part, when I was a CISO, I usually reported to engineering. The VP of Engineering or the Chief Technology Officer. And okay, he's my boss, so I'm telling him, hey, we have this critical vulnerability, I believe we need to focus on it and fix it. Like, no, I have another priority, maybe later. So what do you do, right? Because leadership really determines whether these failures are anticipated, mitigated, or ignored. So that's why I believe that people believe biggest risk far above technology.

Well, exactly. And then I'll give you one more example and then I want to follow up. But I've talked about business email compromise, right? The world talks a lot about ransomware, right? It gets all the headlines, all the news. But business email compromise causes exponentially more damage. 10 times, 50 times. I can't remember what the numbers are these days, but they're much, much larger and doesn't get talked about much. And my personal opinion has always been, and I've told people, business email compromise. And by the way, for anybody who's listening or watching or doesn't know what I'm saying, business email compromise is a phishing attack. That eventually tricks somebody into giving away money, either paying a bill that doesn't exist or, you know, it's, it's normally something to that effect. But the reason it happens is because—

click the link, download the attachment.

Yeah, exactly. And the reason it happens is because of a cultural issue. A lot of times, a lot of, you know, the, the stereotypical is somebody leaning into, you know, accounts payable and saying, you know, I'm the CEO and I need you just to pay this right now. Send this money, this place, whatever. And, and, and you know, that person's nervous and, but they try to say no. CEO leans on them.

Oh, you on, on that. I have a very good story.

Oh yeah. Yeah. Well, let me, let me finish this real quick because they may relate, but I've told people, I said the challenge there is in that moment, the person in accounts payable has to decide their own personal risk. What am I more likely to get fired for, saying no to the CEO or sending money where it shouldn't go? Because this guy's yelling in my ear. And I think a lot of these happen because it's culture, because the answer is, hey, I'm better off just send the money. It's not my money. They probably won't blame me. They probably won't fire me if I say no to the CEO and it's him. I'm getting fired. Whereas I've said, listen, if you have a culture that says, here's two things. One, in order for any money to move, somebody has to give the daily code, whatever it is. It could be the most simple thing. It doesn't matter. It could be rudimentary. It's enough to slow these down. And two, I don't care who's the one asking. I don't care how loud and aggressive they get. Every person in the organization has the authority and is protected from any harm for saying no. And that's it. And the CEO, and maybe this, it really is the CEO, maybe it really is urgent. Well, you should have had the code. That's how it works. You know, now you have accountability as a leader. To do your part. If that happened, business email compromise would almost be evaporated because that person wouldn't have any of the pressure. When the, when the threat actors come in and they scream and they yell, whatever, the person would just chuckle and go, I know you're not the CEO, the CEO, I know you're not that person because you'd have the code. And you also wouldn't be getting more and more mad at me because you know I can't do anything about it and I'm protected. So it would end this. But the culture, I think, is a bigger issue than the technology. So I'm curious about your story that relates to it though.

No, you, you are absolutely right. But also, now it might be even more difficult now because of AI and deepfake. Some people can really make you believe things that are absolutely not, not true. But, but what happened to me, a company in Silicon Valley, shall we name nameless, but what happened is the person was reporting directly to, we call them head of people, basically chief human resources officer. And the CHRO was only like 3 feet down from where their desk was. As you know, it's Silicon Valley. We usually have open floor plan and everything. And anyway, this person gets an email supposedly from the CEO asking them to send the CEO the entire W-2 form for all of the—

Oh sure, the tax, the tax scam you get every year.

Yep.

Yep. The entire payroll, right? Yeah.

Without thinking, she just went ahead, sent. So that means my tax information, including my full social security number, gone. Event to this hacker. And what I didn't understand is, no, Your boss is only 2, 3 feet away.

You can walk over and confirm it.

Exactly. So sometimes I guess you can't really help stupid, but the consequences though, what happened for all of us employees for the company, they tried to pay for 2 or 3 years for—

Sure.

Yeah. Very much after the fact, because that year I was actually on orders. I went, I was in Japan. I was in Yokosuka, Japan. April comes around. I'm okay. I need to go quickly do my taxes first week of April before the 15th. And for the first time in my life, I say submit and the IRS comes back and says, Bob Zinga, you've already done your taxes. What are you talking about? I'm like, no, I didn't. Basically, yeah, they use my social security number and then they try to steal money from the government. Since that day, every single time I do my taxes now, the IRS has to send me a very special PIN number and I have to use that PIN number every single time, whether I do it by hand or electronically, so they know it is me and They know to send me my money back. So my life is affected for the rest of my life now.

Permanently.

Yep. Permanently because of that. So I guess more and more people see the impact, right, of data breaches, and I can understand why it is important, why security and privacy is actually important at a personal level, not just for the organization and not just for the customer, but for each individual too. But yeah, you really need to build that culture where people don't feel afraid to ask questions and they don't feel afraid to speak up.

Yeah, 100%. And I've seen a lot of those scams and they're the people, like you said, they get affected and it could be years later. You know, there's these data dumps are everywhere, but it can, it can happen at any time. And that's exactly the point. That payroll scam comes up every year at tax season. Every, I normally have written something about it or talked to somebody and said, this is going to happen. Your accounts, you know, not your accounts payable in this case, this will be your HR groups, your payroll group. Somebody's going to impersonate a C-level and say, I need, I need all the, all the W-2s or I-9s or whatever, you know, whatever they want. The answer is always no. You know, at least it's go check. Why? Yes. Why would the CEO need that? But putting that aside, again, it's just you got to have a check in there. You got to have a secondary system to that and then a culture that goes with it, right? You have to have that security culture where both the safety culture of people safety of, hey, you're allowed to challenge people. We appreciate that. We want that. It's in the betterment of everybody. But also the security culture of thinking security first and hold on a second. Does this make sense? What's the risk with this? Maybe I should double-check on it. But I'm curious in that way, you know, we talked a little bit, that's a security failure, obviously, you know, and I, I talked a little bit already about the psychological safety and how that increases, you know, cyber risk. But what does trust actually look like operationally in a cyber, you know, in a security team? Not just culturally, but operationally, what does trust look like to you?

Well, a couple of things. I really believe trust is really the foundation of leadership. You cannot do anything unless there is trust. I mean, it's just a must. There is nothing beyond that. So your people, they do need to trust you. That is one. But they also need to trust one another. Now, I guess psychological safety is part of that too, that you trust that when you speak up, nobody's going to make fun of you. When you speak up, people are going to listen to what you have to say. They are going to consider that you are an important member of the team, right? And usually, especially now in the military, like you and I, we've served in uniform, we have a chain of command and it's pretty strong. But even when I was a commanding officer, for example, I remember because when I joined the Navy 21 years ago, I wasn't a commander, I was a seaman recruit, E-1, lowest rank in the entire military, even though as a civilian at the time, I was an IT director at about 12 people reporting to me. I already had the bachelor's degree. So I did have, having no zero military experience, I did have a lot of industry experience. At least it was quite considerable, but because my rank was E-1, everybody completely ignored me, right? So I told myself I would never, never do that if I had the chance or an opportunity to be in charge. And that was my opportunity. So basically I was trying to create a culture in my command. To make sure that Siemens Zinga would be proud to be a member of the team. Where Siemens Zinga would have the opportunity to speak up when he or she had something to say. So I wanted to create an environment where my people would want to come there, and once they got there, they would do the very, very best work they could. So you really have, again, it's not performative. You have to, not the, what is it, the rubber meets the road. You have to be real. And people have to feel it, building trust, modeling integrity, right? Creating belonging, right? Taking moral responsibility. I think people can really feel that and you cannot fake it, right?

Yeah.

Yeah. I really think trust in cybersecurity is so important because every major breach, you know, traces back to human decision, like I mentioned earlier. So you can patch a system. But you cannot patch human. I guess the best thing we can do is really training and trying to build that culture where it's inclusive and people really feel like they can, right, participate and they have kind of skin in the game. So to me, it also has to do with clear escalation path, right? Leaders who back their people publicly and blameless postmortem. I don't want to assign blame. I just want to know what is the problem and how do we fix it? Because as a leader, if one of your people makes a mistake, you made a mistake.

It's your fault. Yeah. It's your responsibility as a leader. Yeah, absolutely.

When the team does the right thing, then you share the glory with everybody on the team publicly, right? Decision that security voices really, really do matter, not just during incident, but during planning and budgeting as well. So that's what I think trust is like.

No, I agree. I had one commander and that was very early in my career. And that was exactly how he led. All failures are mine. All successes are, are yours. And I've always tried to model that because I really believe in it. Because again, yes, if you're, if you're in leadership, ultimately it's all yours. Like, it has to be if you're, if you're an ethical leader. Maybe I don't understand that particular technology or that job, you know, I don't do everything everybody in the team does, but ultimately it's, it's on me, you know. I, I didn't provide them enough training, enough guidance, enough mentorship, you know, a, a technical mentor obviously wouldn't be me, but it's, it's ultimately got to be my responsibility. If things go well, yeah, it's everybody's, you know. You pass it to the people that did the most and make sure they get the credit because they're the ones in the front lines doing hard work. I'm a big believer in that, you know. I think that's something that, that we really have to, you know, continue to work on, you know. And you talk about, you know, that trust, right, and that ability to, to build that trust and to, to make sure that you live that way all the time, right? And, and that's, you know, that's— organizations that don't have that aren't particularly secure organizations. Usually people end up hiding more and more things.

Absolutely.

That's how you get people to try to pay ransomware on their own on the side because they don't want somebody to know they got hit. 'cause they're embarrassed or ashamed or they're worried about what happened. And you end up with, you know, that's how you end up with all this architecture that's not covered.

Resilience. Yeah. Yeah. Because another thing you said, sometimes when I hire people, I don't really care much about technical skill because I can teach you that, especially the way it's done in my organization. But character, I cannot, right? Either you got it or you don't. So I would say hire for character and then train for skills, because I guess it's probably how I got my first chance into IT, you know, back in 1997, what, over 28 years ago, because it's like that catch-22, right? It's like, hey, I want this, this job. I want to do this, this IT work. It's like, do you have any experience? No, I don't have any experience. Well, how can I get experience unless you give me the job first?

Exactly.

And you kind of have no, no, you are hungry. You are a good person. You have Integrity, I can trust you and I can teach you. And then, you know, all of this technical stuff you can learn.

But anyways, no, I agree. It's, it's, yeah, I hire people for the people, you know, within reason. Obviously you have to have some basic skill. We all know that. I'm not saying you can hire anybody to do anything, but I'm a big believer in that. You know, I've talked to people like, I only want to hire rock stars. I'm like, well, first of all, I'm not building a rock band, so that's a weird way to hire people. But, but at the same time, I don't know if that's a great idea. You know, we've seen that, hey, we've sat in sports, you get a whole team full of stars and they can't work together. If you hire all-stars, everybody's A players, then everybody expects to be at the top. You're going to have a really competitive environment. I coached high school football and I used to say to people, do your job. I want people in the right spots. It's not a more or less valuable, but if everybody wanted to be the quarterback, we wouldn't have much of a football team. Do your job. Let's get people in the right places. And if somebody's really good at what they do, but hey, they don't want to work extra hours, they're not big on overtime, they're doing their thing and they're leaving, that's fine. That's perfectly fine. You know, they, they're probably not going to advance a lot necessarily. I mean, they might technically, but they might not, but they're fine with that. And I'm fine with that. I don't want to vilify that person. They're part of the team. They're doing their piece, you know. And you mentioned like rank in the military. It's, it's a great point, you know, that, and, and the same thing happens in the civilian world. And I've always said to people, the right answer is the right answer. I don't where— don't care where it comes from. It often won't come from me. If I'm in the room and I say something and it's stupid, tell me it's stupid and tell me in front of people. I don't mind. I got the skin for that. You don't have to with everybody, but I'm not right just because I'm the person in the role or in the seat, you know? And I was lucky enough, I was in the Air Force, as you mentioned, you know, Air Force a little different from some services. We're kind of the corporate military, depending on who you ask.

They build the base first. Yeah, you guys always build the Gulf Coast first.

Build the Gulf Coast first and then the base around it. Exactly. And then on top of that, I was intel. But one of the things I was lucky enough is it's one of the few areas I think in the military where rank, I mean, you have to be respectful, but you can disagree as far up as you want if you're right in intel. Because Intel is Intel. And I, early in my days, I was a linguist. I wasn't particularly—

or could die.

100%.

Yeah.

But I was having an argument. I will tell you, I was, I was an E, I was an E3 at the time, so Airman First Class. And I'm having an argument with a disagreement, I guess, with a captain, a major, as a captain, I believe, Air Force Major, so O3. And he's basically telling me to shut up and color, and I can't because I know he's, I know he's wrong in this case. I don't have a choice. And ends up going to the commander, which I didn't really want it to. And your mission to speak Fali. Yeah, well, that, that wasn't going very well. But ultimately what it came down to is the, the captain had an opinion, I had an opinion, and the commander asked me my thoughts. And I said, well, you've invested, you know, quarter million dollars or half million dollars to teach me the language and the culture and all the things about this country, because I was a linguist, and I'm pretty confident the captain doesn't have all that information. So yes, I believe I'm correct on this. He told the captain to shut up and sit down. And that was sort of the end of the captain and I never really got along. But that was sort of— that's okay, his career ended poorly. That's a whole different story. But But that was the point, was if you're right and you can support it, right? Don't just come and say, I think I'm right. But if you can support it, the right answer's got to be the right answer. And that particular captain who didn't last long in the military and wasn't much of a leader was wrong but didn't want to admit that. And I have the rank, I'm telling you what to do, just do it. Didn't have any of the requisite knowledge to have the disagreement. This, you know, this was a discussion about a foreign language, information in a foreign language related to a culture that this person knew neither of those things. And even as a poor linguist, I knew these things well enough to know he was wrong. So having a culture to say, listen, the right answer is the right answer. I work in tech a lot. I don't write code. I'm not technical in those ways. I have different skill sets. Tell me what the right answers are. And, you know, I'm not going to lean in and tell you you're wrong. You know, the point is to get the talent in the right places. It doesn't matter what sleeves, what you have on your sleeve or on your collar, or, you know, what your title says on your business card. The right answer has to be the right answer.

Yes, actually, from what you say, I have another story. It really humble me. I think for the entire time I was really privileged and honored to be a commanding officer, the number one leadership lesson I've learned is you have to lead with humility. Mm-hmm. Because in my life, over and over again, I usually start at the very, very bottom, from E-1 to E-5, you know, from junior, most junior enlisted to now a senior officer in the most powerful Navy. I started as a tech assistant, pretty much an intern, and now I am a chief information security officer in Silicon Valley. But the thing is, As you achieve more and more and you get more and more responsibility, sometimes your head tends to get big and you are so proud and your ego kind of gets out of check and you absolutely do not want that. You have to be humble. You have to lead with humility because what's going to happen is your ego is going to prevent you from learning, whereas humility is going to accelerate growth and learning. So for your own sake, you should be humble. What in the military, I'm sure we stole that from the army. The most new at the time, it looks like we steal a bunch of ideas from Bjarne, but the 3 C's of leadership, right? Confidence, which is good. You do have to be confident as a leader. For some people, their confidence is just way out of bounds, right? And then in addition to confidence, you need to have the second C, which is competence. You have to be good. You need to know what you are doing. You have to perform, right? You, you, you have to actually win. And then the third C, which I think is probably the most important, is connection, connection with. People and caring for them. But one story I wanted to share, I had a very important issue I couldn't solve myself. So I reached out first to my senior team, my executive officer, my senior analyst leader. We tried to figure it out, nothing. And then, okay, I included all of my department heads. So that's my entire leadership team, probably about, I don't know, 12, 15 of us. We couldn't figure this thing out. It's been like months. I'm like, okay. I have to come up with a solution. So I decided to open it up to the entire troop, to the entire command. And then an E-5, junior enlisted person, in less than 5 minutes came up with the solution. So wisdom doesn't respect rank. Anybody anywhere can tell you what the solution is if you are open to it, if you are open for feedback, right? And again, that's why you do have to be humble because from what that person said in that meeting, we were able to solve a very important problem. Problem to me. He really made my day and helped us achieve a very important portion of our mission that quarter. So you have to lead humbly. You just have to.

No, you make a really good point. You know, when I was young, I was— for anybody knows me, they already know— I was pretty cocky, I guess, when I was young. I've always had confidence. Let's go with that. And maybe, maybe a bit cocky. Maybe more than maybe. As I've gotten older, I feel like I've gotten— again, to say I've gotten humble sounds horrible, right? Humble people don't say that. But I, I feel like I've toned some of that down.

I think, yeah, you are no longer involved.

Exactly. I, I think what happened is I got old enough to figure out all the things I didn't know, right? It's just, I had— the more you learn, the more you realize what you don't know. You're like, oh my, I thought I knew a lot, but it turns out I didn't know anything, right? And, and the more I go through life, the more I realize how much I don't know. And it's like, okay, I, I gotta really kind of pull it back. I'm not perfect by any means at this, and I'm still, you know, I have my fair amount of confidence with it, but I like to think now it's more of a there's a lot to this world. I know a sliver. Even if I'm good at that sliver, it's so very little comparatively, and there's so much more to learn, and there isn't enough time. And so it does become more of a, hey, how are we all going to get things done together? Because you're going to bring skills I don't have, and you're going to bring skills I don't have, and you're going to bring a point of view I don't have, an experience I don't have. And it's better to just say, hey, let's get the right group together of all these things. And it's not a better or worse or a more or less, as you know, you know this and I don't, so you're smarter than me. Well, you are in that area, and it might be the same in reverse. Yeah, that's fine.

Just keep your ego in check. You're going to be successful if you don't care who gets the credit.

That's right. Just get it done. Now, listen, I want to move on to another topic. What's that?

Go ahead. The age of AI.

Yeah, that's the next one. Yeah, the age of AI.

Knowledge is really exponential. It's impossible to know everything there is to know. For example, when I was a PhD student, now I am what they call ABD, all but the dissertation. That was about 26 years ago, year 2000 to 2001. I was a candidate for PhD in micro— biology, University of Alabama.

Wow.

My primary mentor, he had his PhD back in the late '70s, early '80s. He told me 20 years ago, I knew absolutely everything there was to know about microbiology, everything.

Not anymore.

I— but today, 20 years later, he's like, no, it's just impossible. So really, one of the master skills I have is the ability to ask question and find answer. I may not know all of the answers, but I kind of know where I should be seeking to get those solutions. But I guess I'm saying all of this to say, in the age of AI, we really need each other. And sometimes you will be surprised where the solution would be coming from. It has nothing to do with rank, it has nothing to do with age, it has nothing to do with gender or race, but you have to be open for the answer. And I think it will eventually come to you if you are humble enough to listen. Because you're right, I think Socrates, I believe, is the first one to say it, right? The more I know, the more I know that I don't know anything.

Exactly. Yeah. It's, you become aware, right?

Ivan. Yes. Yeah.

And, and as you said, it's, it's knowledge is exponential, right? It's, it's, you can't know everything. The person who gets the doctorate and is the top of their field today, if they never studied another thing in 10 years, everything they know will be baseline. I mean, it might, some of it might still exist, some of it might be erased by other science even.

Absolutely.

But they definitely won't know what's going on today. Right. So it's that constant learning. But in terms of AI, I'm curious, as we're moving into this whole age of AI, what worries you the most about AI adoption that leaders aren't actually talking about enough publicly right now? I mean, we got— everybody's jumped in. That's no problem hearing about AI. It's going to do this. It's going to do that. It's amazing. And it's going to change the world forever. And we're all going to be superhumans on it. But what, what to you, what are the things people, leaders aren't talking about enough that concerns you in this move?

Yeah, I think in the age of AI, we just said knowledge is really exponential. It's impossible to know everything. I kind of envy my grandparents, right? Because back then, They didn't even need to have a high school degree, and when they did, that's really all they needed, and they were set for life. Never have to open another book in their life, but in our generation, that's not the case. You can have a PhD, two doctorates, it doesn't matter. You're gonna keep on learning because that's just the kind of world we live in. Where I am in Silicon Valley, pretty much what, every 6 months or so, there is new innovation and new technology. So basically I'm gonna be a student for life. That's, that is a given. So what worries me most about AI adoption? Well, one thing that worries me is we might be automating bias, right? Accelerating decision without reflection and really confusing efficiency with wisdom. I think that's something that worries me more and more. Because in this age of AI, another thing that's very important, I believe really, is ethics. Ethical responsibility.

Yes.

Especially when it comes to cybersecurity, because there's gotta be some type of accountability, right? Because that doesn't disappear just because the system made the decision for you. So, and especially in the military, to me, human oversight is crucial. It's absolutely critical. We cannot be having those machines making decisions and then shooting missiles all over the place. No, no, there's gotta be some human Oversight. Now, I know AI is going to help you be more efficient, right? Do things faster, but you still need to have the control with the human touch because I believe leaders are responsible for outcomes, not for excuses.

Yeah, well, and you bring up a good point there, accountability. So years ago now, when I was still in the government space, I worked on a project at one point. I was hired to work with this team that was building a capability that was called Cyber Intelligence Preparation of the Environment. Originally, it was Cyber Intelligence Preparation of the Battlespace, but SecDef didn't like Cyber being called the battlespace then, but then it became the environment and eventually it became kill chain. But the concept at the time, a lot of it had automation and the idea was, you know, we had a lot of operations researchers and scientists and brilliant people. And the idea was to create, you know, to map paths and patterns. And really originally it was kind of going to be a magic box where you put information in and it would tell you the answer. And I remember when they first hired me, I was like, I don't know why you hired me. I'm an Intel guy. I don't know the math you're talking about. I'm not an operations researcher. Am I in the wrong interview room? They said, no, no, we have the people for all these things. We need some intel people. We need to validate if this will actually happen, if it'll work, etc. I was like, okay, great. And we started and I said, this will never, this will never work. And they're like, what do you mean? I said, no intelligence person worth their salt will take the machine's answer. The magic box said so and then go do something with it. I got to put bombs on targets or I got to, I got to do things kinetically. I said, unless you can show me the workings, if you can show me the backend and how it all works, and I can trust it, then that's fine. It's really fast. It can be faster, et cetera. But without that, I'm going to take your answer. I'm going to go back and re-engineer the whole thing. I'm going to reverse engineer the whole thing, go back to the beginning to prove it anyway. I've got to validate it all because eventually my name goes on it. And if it goes out, a bomb goes on a target and people die, I can't say, you know, it turns out it wasn't the right target. I can't say, well, the box said so. And now it's— I look ahead now, you know, I look where we are now, you know, 10 years later or whatever. And I go, well, apparently now we're just going to do that. Apparently now that's where we are. AI just tells us we're just going to make these decisions and nobody's, you know, asking what's under the hood. You know, we couldn't understand it if they showed it to us half the time. And people are just saying, yeah, this is all right, the box said so and we're going to do it. And I worry about where that, where that accountability is going to be. You know, our leaders just going to hide behind and say, well, the box said to do it. You know, we brought this technology in, blame the vendor who's going to say, well, you know, hey, we got a little thing at the bottom that says it's not always right. You're supposed to double-check this stuff. Well, how am I going to double-check, you know, the million lines that you just handed me on the short term that I have to work with? And it was very convincing. You know, where are we gonna land, do you think, in terms of, you know, ethics and accountability? You know, and, and again, you also talked about, you know, bias. I worry about, you know, when I was in the intel world, if you had one analyst who didn't properly apply standards, some people knew that, be like, all right, don't talk to him. 'Cause every time you talk to him, he's gonna tell you it's Russia. It doesn't matter what it is, he'll always say that, or it's always China or whatever. You're like, that, that person's so biased. Save it until we think it might actually be there and let him go down that path.

Yeah.

And that was fine. But now if you get that stuff poured into an AI, the entire organization has that same bias, right? Especially if you're eliminating intel people, just letting the AI be your intel team. Now, now one bias became everybody's bias, and it's not that hard to poison some of these technologies and poison some of these inputs. So, you know, where do you think we're gonna land in terms of accountability and ethics and, you know, oversight on these things? Humans are, are designed to just go fast and easy, and, and we're being pressured for all this, you know, volume. Are we just going to end up succumbing to it until terrible, terrible things happen repeatedly and we recognize it's a mistake? Or do you think we're going to be able to get ahead of this and understand the importance of oversight and ethics and human involvement in these things still?

Yes. And actually, I am writing an article now. It should be published today. I'm thinking deeply about AI and how we get to trust them. I've already written one where people feel like AI is alive. Absolutely isn't, but that's the impression some people have. And also there is psychosis as well.

AI psychosis. Sure. I wrote something on that a while back.

Yeah. Actually, I think just very recently, it was actually University of San Francisco. For the first time, somebody was diagnosed by what they called, I think, AI-aided psychosis. Basically, some people are really losing their mind because AI tends to please, right? And I think they can become delusion accelerator. So we, we, we really have to be careful about that, that, you know, sycophancy is always being the yes man and, and trying to please and then, you know, mistaking a simulation for sentience, you know, thinking that they are alive. I guess it's also called anthropomorphism, right? And also there is also the being isolated, you know, sometimes sleep deprived and trying to feel like you are developing an actual relationship with a machine.

Sure.

And it's kind of like a perfect storm for mental health. But again, the very first clinically described AI-associated psychosis was done here at UCSF. And it was a 26-year-old woman who was convinced that she could bring back the AI twin of her dead brother. And it is just crazy, but it really could happen to anyone. Of course, we've heard also of the case of the 14-year-old, right? In Florida, fell in love with a chatbot. And decided to commit suicide so they could meet in AI heaven and have kids or whatever. So it really can be very dangerous and already some lives have been lost. So you, that's why you really need ethics and you really need not just to think about profit and capability, but not, but not only what are we doing, but are we doing the right thing and then how to do it because I think safety, privacy, security And ethics are very crucial, very important. Actually, it was today, Eric Schmidt, I'm sure you know. I've never met him, but he's my mentor from afar. I really appreciate everything he's done and the work he's doing with AI now. He had a post today and I mostly agree with what he says. This is Eric Schmidt after all. But basically he was saying that, you know, America is on the right path. No, we are moving forward with AI and China is doing their thing, but Europe is kind of paralyzed. They have just too many regulations and they don't have any infrastructure. So what I told him, I don't know if he's going to reply, but I mostly agree with everything he was saying. But the nuance I wanted to tell him, again, no, he's a legend. He's a living legend. Who am I to talk to him? But no, but based on everything I have learned, what I'm studying, because I think about these things pretty deeply, I told Eric that the nuance for me is that in Europe, no, they don't just need to get in the game, which I think they do, but on AI infrastructure. However, they also need to get it in, to get in the right game, right? Doing it the right way. Because a massive investment in compute, energy, and open model is non-negotiable if Europe wants technological sovereignty. But talent without, you know, silicon power and scale will always migrate to where execution is possible. So I think we are aligned on that, but I do believe the bottom line is infrastructure without trust. Now we were talking about trust, about that will not win the long game, maybe temporarily, but not the long game. So I think we need both. We need to have those guardrails. That's kind of the way I look at security, right? DevSecOps or SecDevOps. Yeah, you want to move fast at the speed of light or 4, that's fine. We need to have those guardrails as long as you are within this guardrails, you can move as fast as you need to, where security doesn't stop innovation, right? It's not the department of no, but we do have some guardrails and you have to move within those.

Yeah, it makes sense. And, and, and because AI showed up, you know, apparently to the outside world, at least I know it's been developed for a while, but commercially, it just felt like it just arrived, right? And everybody just got handed all these tools and not much training, not much oversight. A lot of it was free at first. So it just, it just handed people this stuff. I, I fear, and because that raised so much money and the valuation so quickly, that, that we're going to be doing this in reverse. Like, the heart— the cart is ahead of the horse, Rao, and we're going to have to turn around and get out in front of this. I think the, the audits, you know, the AI accountability, AI audit, AI oversight, you know, LLM management, you know, some of these things, these are going to be growth areas, you know, for, for work. Because somebody's going to be the gatekeepers of these. Somebody's got to be a neutral gatekeeper. You can't have the company that invented the technology also be the ones to tell you, no, no, it's safe, don't worry. It's— that's a bad idea. You know, we don't have car manufacturers rate their own cars for safety. We have somebody else that does that, because otherwise, I promise, they would all give themselves very high marks on their safety. There's a reason we have agencies to do that. We're going to need the same thing for these things. Nuclear Regulatory Agency, things like that. We don't let people manufacture potentially dangerous things, not inherently dangerous, but potentially, to also tell us they're safe. Right? And right now, it feels like that's where we're at, is they're going, no, no, trust us, and here's some policies. And most people, including power users in some cases, really don't know how a lot of this stuff works behind the scenes. We're figuring out as we go along. We're prompt engineering. And, oh my goodness, that shouldn't have been the answer we got for that, should it? You know, early on I knew people who could— oh, they say you can't do these dangerous things with it. No, with the right prompting you can get AI to tell you a lot of things. You can tell it, it'll tell you how to build a bomb step by step. It just doesn't know it's telling you that. And of course then they go and they fix that, and then you find a new way to trick it into telling you dangerous things.

Exactly.

And doing things that are supposedly against the rules.

So I suspect regulation for sure. One of the latest articles I, I would— I think it was last week It was about, no, surveillance, security, and really the leader's dilemma. This article was specifically focusing on ICE, no, how they have so much technology now and they can get so much information, not just on non-illegal immigrants, but on US citizens as well. So how do you balance that? Because the truth is our laws are way outdated. Technology, you know, is far ahead. We are not— was it Privacy Act of 1974? We are in 2026 now.

'74, yeah.

Thanks, Richard. And upgrade, right? And we, we need those laws to kind of keep up with technology and the modern times.

Yeah, no, you're exactly right. One last bit and then I'm going to get us closed out of here. Just, Chip, just to touch on the AI psychosis you mentioned. So I, about a year ago, a little less maybe, I'd have to go look up the dates, but some friends of mine and I were talking about some of this stuff and, and a good, a good friend, a bright guy, wrote a really interesting piece on LinkedIn about this. He was ahead of me. I was in the process of writing something. He beat me to it. He didn't steal my ideas or anything. He wrote his own thing. So I made some, some slight changes, but I wrote something that actually was, you know, here's a selfish plug. It's on the Unspoken Security blog, Security Whispers. I wrote a piece on this, did a bunch of research on it. I actually tied it to insider threat. So I, I took a lot of what we knew but said, hey, this is how insider threat's gonna be forever changed because a lot of the things we believe and plan on, well, they're also based on a rational actor. When you have somebody who's gone down this, this AI psychosis path, everything changes. It's, it's a very different thing.

Yeah. It's for sure.

Yeah, 100%. And then right behind that, the New York Times wrote an interesting article on this piece as well. So AI psychosis is a problem that people should look into. I think it's more likely to affect people who already have preexisting mental health issues, maybe under the surface, but it could affect others. And as you said, you can go way down the path. You can believe things that are just very dangerous and all fictitious, well beyond just falling in love with it.

I believe it was the founder of Uber at one point who thought he had discovered the secret of the universe. Yes, exactly. Crazy.

Yeah, it's, it's, you can, you can go very, very, very dangerous and scary places with this. And again, the guardrails, you know, I know of somebody who went down this path and I, you know, I've, I've gone through and officially these platforms have rules that, oh no, if they see this kind of behavior, they're supposed to shut you off.

Yeah.

And I've got reams and reams of printouts that say, well, this should have violated the policies, gotta shut off. But they didn't. Well, the platforms, first of all, they're very big. They may not have all the oversight they need yet, even internally. And they're not necessarily motivated to shut people off who are paying. I'm not saying that was all intentional or anything. That's why I'm not naming platforms, not pointing fingers, but there's a lot to ask there to ask the platform to, to self-manage these things.

Yes.

And don't count on the policies to be those solutions. But listen, we're, we're gonna wrap up here. We're running outta time. We could do this for hours and I, I absolutely would. I, I, you're fascinating. I could talk to you about AI, I could talk to you about tech, I could talk to you about leadership. It's, it's amazing and I, it's been a fantastic conversation. But as we're drawing to a close, Now, the name of the show is Unspoken Security. And as you know, everybody gets asked the same question to close out. So with that in mind, tell me something you've never told anyone before, something that till now has been unspoken. Hmm.

Well, maybe something I don't say often. There were moments in my career, both in uniform and in tech, where staying silent would have probably made my life easier.

Oh, yeah, that's a good one.

Speaking up for people for inclusion, for fairness, might cost me political capital. But sometimes as a leader of a— it's not about politics, but it is about doing the right thing. Back to what your core values, who are you as a human being? What are your core values? What do you stand on? I am an immigrant. I come from another country. I wanted to be American. Right now, it seems like we are losing a lot of the freedom we've taken for granted for a very, very long time, which is very sad. But again, you know, right is right. It doesn't matter. Like, I really love— I think it was John McCain. Again, I'm not Democrat or Republican or either side. One thing he said, and I know he was a naval officer, so good for him, he's like, no country before party. I think we need to go back to that place where we are US citizens first and foremost. So much in common, whether you are Black, white, a woman, gay, straight, it doesn't matter, we have this one thing in common, being one nation under God. That should mean something to each and every one of us, regardless of your party affiliation or your beliefs. So I think every time the temptation was in fear, right, maybe it's fatigue, right? But really what I've learned is silence doesn't keep you safe, you know, it just delays accountability. I've been talking about trust and accountability for quite a while. So what's unspoken for many leaders, I think, is they know what is right, but they are afraid of being alone when they do it. So leadership isn't about being fearless because I think everybody feels the fear, but courage. That's why my core values, honor courage. You have to have that courage because yes, I am afraid just like everybody else, but I will act in spite of my fear, right? It's about deciding what you are willing to stand for than if you stand alone. That's very powerful. So especially in cybersecurity, where trust, I think, is everything. People are watching what you protect and what you are willing to sacrifice. So that's—

I mean, you're right. It's incredibly powerful. It's— and pervasive. I've certainly seen that. You know, it's, as you said, it's not all being fearless. If somebody was fearless, they're probably— they're they're psychotic then. Like, we're supposed to have fear. It's part of us. Courage isn't being fearless. Courage is the strength to overcome that fear and still do what needs to be done. You know, whether that's physical or whether that's, you know, doing the right thing as you pointed out here, you know, and obviously for those who haven't paid attention, I got, you know, if you're watching the show, I've got my Minnesota, a Minnesota shirt on. I have several. I'm from Minnesota and I live in Minnesota. So with all the things that are going on, yeah, we're, there's a lot of people being tested right now on doing the right thing, doing the ethical thing, you know, whether it's the politically correct thing, whether it's the safe and secure thing. There are some—

do the human thing. Yeah, do the human thing. Because I think courage is contagious. Because sometimes everybody is paralyzed by fear because, you know, usually what people do, they will use somebody as an example and just, you know, chastise them. And many people, oh, I am afraid, what if it happened to me? But if you have the courage to speak, guess what? You're going to give permission to everybody else to have the courage to speak as well. Because I think leadership isn't proven by what you post, it is proven by what you preserve. Your values, your people, your integrity. When it would be easier to let them go, that's leadership.

100%. I couldn't say it better. Not going to say anything after that other than thank you. Thank you for being on the show. Thank you for being you. I thank you for being such a great leader. I think we need more. The Navy, I'm sure, could use more. Everybody could. And so could Silicon Valley. So I'm glad you're there doing these great things. And thank you for taking the time to be here. For coming on and to share your wisdom. I really appreciate you and this has been a fantastic conversation. For anybody out there who's listening or watching, I hope you've enjoyed the show. Feel free to let us know, send feedback, please like and subscribe and all the good things. If you don't like the show, don't tell anybody. I don't need any bad press. Just keep that to yourself. But you could at least privately let me know why you didn't and I'll try to make things better. The show isn't about me, it's about the guests and it's about who has the time and energy to sit and listen and watch to try to hopefully put out, you know, content that matters, it's meaningful and it's entertaining and it's interesting and it's educational. So, you know, thank you everybody for taking the time to do that. Thank you again, BZ, for being on the show. Really appreciate it. And with that, I'm gonna go ahead and wrap up. So for everybody out there, this has been another episode of Unspoken Security. That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.