Unspoken Security Ep 7: If You Aren't Using Intelligence You're Chasing the Threats

being able to take information that you can get and glean that intelligence from that, and then use that to get it to the right people, like our executives or our defenders, or whoever that is that needs that, that intelligence to help them make decisions to either protect a building or protect a network or bank accounts or whatever it is, you are ahead, a step ahead of the actors, right? And that's really where you want to be.

Welcome to Unspoken Security by ZeroFox, the raw and gritty podcast for cybersecurity professionals who want to understand how threat actors are leveraging the internet. In each episode, your host AJ Nash engages with various industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding security. Ultimately, the lessons learned will enable security professionals to take an intel-driven, proactive approach to physical and cybersecurity that extends past the perimeter. Let's get started.

This is how legends are made. Hi and welcome to another episode of Unspoken Security, brought to you by ZeroFox, the only unified external cybersecurity platform. I'm your host, AJ Nash, and for those who don't know me personally or are first-time listeners, I'm a traditional intelligence guy who spent nearly 20 years in the intelligence community, both within the US Air Force and then as a defense contractor. Most of that time was spent at NSA. I've been in the private sector for about 8 years now, primarily building or helping other people build effective intelligence-driven security practices. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I'm also deeply committed to servant leadership, which is why I completed my master's degree in organizational leadership at Gonzaga University. Go Zags! The goal of this podcast is to bring all of these elements together with some incredible guests and, um, authentic, unfiltered conversations. Even debates about a wide range of challenging topics most of us are faced with today. This will not be the typical polished podcast. You may hear or see my dog. She's right over here right now. People may swear here. We may argue or debate, and that's all okay. Think of this as the podcast, you know, this podcast is like a conversation you might overhear at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. So today our guest is Lisa Ackerman. Lisa's an Air Force veteran, security and intelligence expert, and the current Deputy CISO for the British multinational pharmaceutical and biotechnology giant GSK. Lisa, to help the audience understand you and better connect with you— like, obviously we know each other because we've been friends for a while, and you should pick better friends— but to help the audience connect, can you tell us more about your background and a little bit about, you know, your current role at GSK? What's that look like?

Absolutely. Thank you for having me on the show. I really appreciate it. Glad to see you put this together. Uh, so as AJ Nash said, uh, my name's Lisa Ackerman and I'm currently the, uh, Deputy CISO and Vice President of Cybersecurity Strategy and Solutions at GSK. I've been in place for almost around 10 months now and recently coming from the financial sector where I was the global head of cyber threat intelligence. And then prior to that, I worked for the US government in some capacity. My entire life. So I joined the Air Force right outta high school. I was a SIGINTer, for those of you who know what this is, did it, it, da, da, da, did it, it. That's my role. Only I listened. I didn't actually send it. So I was in the Air Force for a bit, like I said, signals intelligence. And then I got outta the Air Force and worked for many large and small contractors supporting the government. And then did a stint as civil service in the middle of my career where I was an information system security manager for a military base. So I've seen a lot of different things. I've had a lot of different kinds of roles. Never focused in one particular area other than intelligence for almost all of that time. I've been working in cybersecurity since the late '90s, and I am very passionate about teaching people about cybersecurity and cyber awareness. I actually just, I was quoted saying as it should be second nature, like brushing your teeth.

Hmm.

Also, it should be like, uh, crossing the street, may, whether you look left or right, if you're in the other part of the world, make it just part of who you are because cybersecurity is everyone's responsibility. I like to use intelligence to support that and being threat-driven in everything that I do. At GSK, my role is different than what I have done in the past. Here, I'm actually responsible for our cybersecurity architecture and engineering, making sure that we build the right solutions for our defenders to protect the organization. So taking what I've done and applying that to what our defenders need, it's a really good benefit for GSK, I think, and for me, 'cause I get to learn a lot about building the solutions that we need versus just using them.

Yeah, that's very cool. I remember when you said you were going to move over to GSK, how excited I was for you. I mean, it's an interesting gig, right? A huge company, massive landscape. Obviously everybody knows who GSK is. And I say that out loud for those who may not realize the branding. GlaxoSmithKline is— some people may still remember that name, right? But GSK is everywhere, right? And I was really excited for them, frankly, as much as for you, because I, you know, we go back a ways. Obviously we'll talk about your background, but I think they were very lucky to get you in. And to have a chance to really, you know, add to their skill set and get stronger and safer. So it was pretty exciting. And, you know, as an intel monkey myself, seeing somebody with an intel background moving in that CISO track— I know we're going to talk a little about that going forward— is interesting, right? There aren't a lot of folks who came out of the IC, came out of the Air Force and, you know, intelligence backgrounds who've moved into that track yet. I think we're starting to see more of it. So I definitely want to dig into that a little bit and see, you know, hear from you on how that's been going and how that feels. But I'm pretty excited about Learning about that and obviously, you know, thrilled that you were able to make it today. You know, we're lucky to have you, to have you with us. So, and interesting for anybody who didn't recognize the dit-dit-dot-dot, you know, obviously it's Morse code. Elisa was what we would call a diddy bopper in the Air Force. You know, she was Morse code. I was a linguist. So we sit next to each other a lot of times. It's just her language is all dits and dots and ours is something that you might get to read on a menu at a restaurant. So very cool stuff. Similar backgrounds. All right. So let's jump into the heart of the discussion today. So, Today's podcast is entitled, If You Aren't Using Intelligence, You're Chasing the Threats. Now listen, that, that's a pretty bold title. You know, I, we helped come up with it. So, you know, obviously, you know, we both feel pretty strongly about the concept of being proactive. I know that, right? You know, we talk a lot about proactive security. You know, it's, you know, if you talk about, say, looking at JP2-0, you talk about being on a, on a proactive scale, you know, and, and everything else is reactive, right? And, and I'm a big believer in that. You know, I've, I've leaned into that heavily. I know you have too. You've, you've built teams and career off of this. So, you know, with that as the foundation for the chat, I do want to take a look at some comparatives here. You know, what do you see having come out of the government space and been in the private sector now, uh, and having such a wide aperture, you know, what do you see as the biggest differences in how we think about security, physical and cyber really, you know, in the private sector as compared to say military and defense backgrounds?

So I think, um, it's changed a lot just since I've been in the private sector. When I first came into the private sector, I got asked a lot, Why intelligence? Because a lot of private entities did not really have a big intelligence organization. Some of the bigger firms did, right? But the smaller ones, no. But we've had a lot of events since then that have actually turned people's heads and really want to understand the value of intelligence. I used to laugh actually when I got the question, what, what value is there in cyber intelligence? And I would just laugh because to me it's second nature, like I mentioned before, right? So I think about that kind of stuff all the time. But the layperson does not. You know, you've got our kids who are all over TikTok and don't understand, don't understand why anybody would want their data. They don't know the term influence operations, right? Or even other social media, you know, we're, we're so prone to brag about what we do and how we do it. And then just kind of changing that mindset, right? Even from a physical and a cyber perspective, you know, in the government, physical and cyber were together. Right? We, we hand in hand, we did it. When I was civil service, I actually was part of a group called the Threat Working Group, and we brought in physical and cyber threats, and we talked about it as a group and decided, you know, do we need to raise or lower our threat or information conditions? You're familiar with that term? We did it as a group, and we took that recommendation to the base commander, and then we implemented controls around that, right? Either to protect the base or our users, our network. I mean, I was doing phishing exercises before phishing was even a thing. So, you know, it was, it's just an adjustment, right? And so, but physical and cyber were very much together. In the private sector, you see a little bit of that, depending on who's running operations, but generally they're separate. But during COVID and the Russia-Ukraine war, you really started seeing those come together. Because intelligence brings in a lot of information and it could be related to fraud at an ATM. It could be related to protest at a building, you know, you wanna make sure that you're getting that information to the right people because the whole value of intelligence is decision advantage.

Mm-hmm.

I mean, you can sum it up in those two words. If the more information that you have, the better you are equipped to make decisions and smart decisions at that. And so trying to bring that concept in, 'cause a lot of organizations are very risk-focused. Mm-hmm. What's my risk of this? What's my risk of that?

Mm-hmm.

Well, a really good friend of mine, uh, that you and I both know advised me once that you can't understand your risk without intelligence. And I heard that, and I took that, and I drive with that, right? But really, if you think about it from that perspective, it puts, it puts it into perspective, right? Being able to take information that you can get and glean that intelligence from that, and then use that to get it to the right people, like our executives or our defenders or whoever that is that needs that, that intelligence to help them make decisions to either protect a building or protect a network or bank accounts or, whatever it is, you are ahead, a step ahead of the actors, right? And that's really where you want to be, regardless of who the actor is in this case. But my, my take on it.

No, I, I think you're right. I mean, those are some excellent points, right? And you know, I, I think the difference between the government side and, and the private sector, right? Obviously I came out as well. And I think the first one was the big one, right? You said like, just helping people understand like why, what's the mindset? What's intelligence? Why do we think about it this way? You know, why does it matter? Like I spent a lot of time on the, just what is intelligence? I was surprised at how much. Time I was going to put into explaining that, which is nobody's fault. It's just my ignorance having come out of the government space. You know, we spend so much time doing this. You know, you said you've been doing this your whole life, right? I know, you know, before we got on, you mentioned you went in right out of high school, like you were 17 when you got in the Air Force. Yes. So like literally your entire adult life you've been doing intel. I was a little bit older. I went in my early 20s. But the thing is, yeah, this is all normal for us. Like this is how we think. I didn't realize how differently we in the intel community think. Until I started making comparative notes with just friends and you talk about just anything from going to dinner to traveling, whatever, and you realize that what we think about is just different, right? That's second nature thing. I still look for exit paths when I go to restaurants and people don't do that. Worst case scenario thought process pop into my head on all sorts of things. People are like, oh, you're a downer. I'm like, no, I'm not negative. This is just how I think. I don't think this will happen, but here's the worst case. I like to prepare in advance for stuff. And you just realize, like, it's like you said, second nature. I've been doing it for decades. So security, you know, that's right. Yeah. Every restaurant, you can tell when we get seated, you know which side of the table I want. You know, people are with me, don't have to ask, you know exactly which side of the table I'm going to want, you know. So, you know, we go into movie theaters, I'm looking for people with packages. People like, oh, you know, I had that happen. It wasn't that long ago. Well, now it was because I'm old. It was a few years ago in Maryland. We had folks show up. We went to a movie. It was one of the Batman movies. And somebody came in with a suitcase and sat down next to us. Now it turns out the mall in Maryland where I used to live is near the airport. I guess it wasn't an uncommon occurrence for people to have delayed flights or whatever. And so they'd catch a movie, but there had just been a serious attack at a movie theater somewhere else in the country. And I was very unnerved. And this guy also was just acting sort of sketchy. And so, you know, we ended up leaving before the movie started. I was like, he sat next to me. He was in a perfect spot if you want to blow up the theaters in the middle of the theater. Like he had all the right locations. I was like, I'm sure he's nothing, but I just couldn't get comfortable. So I left and had to talk to the manager. I got my money back, but I also was trying to explain to them, maybe there's a better policy here. Maybe you can lock up bags someplace where they— I couldn't. I mean, they had no understanding why I was this guy. Why would I even think this way? I was like, no, I don't know. I can't. But I was like, this is— that's just the way we think, right? And so of course I ruined the night for myself and my date who, you know, we were fine. We didn't see the movie. The theater did not blow up. We saw the movie another day. Yeah, but I couldn't not see it once I saw this guy and I kept watching his behavior and I was like, there's just something off here. And maybe there was, it just wasn't that apparently.

Do you often get accused of being paranoid?

Oh yeah, often. And I try to tell people I am not paranoid because, you know, you know, I'm just prepared. There is a difference, right? I don't think these things are going to happen. I don't tell people, you know, scenarios and start planning them out like I think it's coming. I do these things to be prepared. There's a difference. It's subtle and can be lost on people, I think. But no, I don't consider myself paranoid. Now, there's also the old joke, if you think everybody's following you, you're not necessarily paranoid. Maybe they really are, but I don't think they really are.

Yeah, I just tell everybody I'm not paranoid, I'm educated.

That's right. And that's the challenge, right? So I will say a couple years ago, I mean, listen, for the last several years now, the country's had some turmoil. I don't have to go down details, we're not getting very political. Let's just say the country is not in agreement on a lot of things. There's a lot of things going on. And it's become challenging, right? And we've seen some of that obviously in security. We see it in physical security and cyber, and we see, you know, fomenting of discontent on social media and where that goes. And we've seen more, you know, random acts of violence and whatever it might be, indoctrination. So there was a point a few years ago now where I was like, you know, I need to start preparing for some worst case scenarios. And so I sat down with my girlfriend at the time and said, I need to get you prepared so you don't think I've gone crazy because I'm about to do some things that you might think mean that I've just somehow snapped. So I want you to know exactly my thought process here. I'm just as rational as I was yesterday. I've just reached a point where I think there's some decisions I'd like to make and some things I'd like to acquire for worst-case scenarios that I didn't currently own. And so I didn't go full prepper. I didn't dig, you know, dig a trench in the backyard. I don't have, you know, pallets of MREs and, and all that. But I did buy some things that I didn't own that I didn't think I would need. And I said that, but I was like, But if you do, I'm a big believer in, you know, better to have it, not need it, than need it, not have it. And being prepared isn't a bad thing. You know, when the pandemic happened and people were stocking up on toilet paper, you know, I bought 50 pounds of dried milk and, you know, and like 10 pounds of yeast. I was like, I got a year's worth of milk and yeast. Things really go bad, toilet paper won't be our biggest concern, frankly. You know, I also bought guns and ammo. You know, I can get all the toilet paper I want. I suppose if things— if you really think society is going to end, I don't think toilet paper is going to be your solution. But yeah, it's, you know, those kind of things, right? But like you said, so people don't think you're paranoid having that discussion, be like, listen, I haven't snapped. Nothing's changed about me. These are the reasons I'm making these choices. I know it's an edge case and it probably won't matter, but I don't want to find us in a bad spot and have to explain, I knew this was a possibility and I didn't prepare for it. I thought about it and did nothing, you know?

So I'm never out of toilet paper now though. I'll tell you that.

It's funny when that run happened just by pure luck because I'm ADD and don't pay attention to things a lot. We had just bought like 100 rolls. And so I went out and bought 100 more. I had an endless supply. It turned out to be toilet paper very quickly. I didn't mean to hoard it.

We just, we bought it.

Yeah, probably. I mean, we buy it, you know, bulk, bulk buying places and we just happen to have a bunch of it. I did buy an inordinate amount of hand sanitizer. I have gallons of it still probably around here and masks and, you know, all those things. I did buy some stuff, but I mean, I bought like water purification stuff in case things went really, really bad. You know, I went in some directions where we could be more self-sufficient. Built the house here and I'm in the process of making it more self-sufficient. I'm probably going to get a whole home generator for the twice a year to probably get used, but I don't want to be without power. The power grids are changing a bit and I don't want to be in that position. I might put solar on the house. It's preparing, but again, not going down too far down the rabbit hole. And that's tough, I think, for folks like you and me because like you said, we're educated, we've seen a lot. It's easy to say these things are possible, Because they are, we know they are, and others may not realize they are, but they become more probable for us if you see them a lot, I think. And I have to remind myself how it's improbable. So it's possibly improbable, which I realize is a whole nother thought process people don't have. I've had to explain how many times— I gotta ask you, how many times have you had to explain to people the difference between possible and probable and likely and less likely and more likely?

And more times than I can count.

All the time I try to explain to people, you know, I don't speak in absolutes very often. I try not to. But the diminishing possible problem is big, you know, and in most people's lives, it's not, it's just that they're almost synonymous. So Intel people think differently. We speak differently. So yeah, I found that that was something I really had to explain. So I, when I first went into the private sector, I was working with an organization who was in the process of signing an agreement to do business with a company in a nation that could be challenging. I'm going to really kind of clean this a bit so I don't crossing lines. And so I had a private discussion and said, have you talked to the State Department yet? And this person looked at me like I had 3 heads and said, what, why would I talk to the State Department? I said, well, there are some challenges with the company you're talking about and some of the individuals. I'm curious if you've, you know, done the security assessment, et cetera. And I was clearly alien. And I finally had to say, I said, listen, I don't know how to be too much more clear about this. You know where you hired me from. It's my first job in the private sector. Our first conversation, I am aware of the company and some of the people you're discussing. You're going to have to draw your own conclusions as to why I might have that awareness already and whether what I'm saying makes sense. It wasn't persuasive at all. They went ahead and signed the contract anyway. It didn't matter. And I was like, okay, this is a whole different world. I can't explain everything I need to explain. And some people just aren't going to see things the way I see them. And so I spent a lot of time instead trying to mitigate risks that were related to that relationship.. I was like, all right, I'm just gonna help from that side. But I realized in that moment, and you know, these were experienced professional executive people. They didn't get here from nothing. Mm-hmm. But I saw we had a complete disconnect on something that they just had no background on. And, and I'm sure I seemed paranoid right away. Like, we do business all over the world. It's not a big deal to do business with some of these foreign companies. I'm like, some people you gotta be more careful about. So I, you know, oh yeah. Yeah. It's, it's remarkable. And I think another good point you mentioned was, you know, having worked with the threat group. Where physical and cyber were together, right? Where they worked hand in hand. I don't know about you. I've seen, I think that's improving it from what I'm, my perception is that's improving in private sector, but it didn't used to exist at all, right? They were just sort of siloed. So I just, have you seen the same thing that that's connecting more now?

Yep. Absolutely. I mean, especially during COVID and then again with Russia and Ukraine, like for, for COVID, you know, I was in the financial sector then and information sharing is huge there, right? And we were getting lots of information, both physical and cyber and legal and retail. I mean, we were getting all kinds of information to share. And then you start seeing protests at, you know, different kind of facilities because of either they were creating a vaccine or something to do with it, right? And so we would share that information with our physical security people. And then, you know, if we have locations where those protests were happening, they were able to take that information and go, you know, put protections in place or, you know, notify the residents of those buildings that there's going to be protests and get defenses ready. You know, those kind of things are very important. And then where I'm at now, we have manufacturing facilities, not just, you know, we don't just do everything online, right?

Sure.

We, uh, not are not just a pharma company, but we also do manufacturing. So we want to make sure and share that information as we get it. So there's really big, uh, shift, if you will, in, in especially like with Russia, Ukraine, where that's at, you have people who are in global locations near, they might not be in the war zone, but they're near it. And imagine an errant missile hitting a NATO country.

Sure.

A lot of different problems, right? So using, but using that intelligence to inform our decision makers on, do I need to move my people? Do I need to, you know, make some changes? Do we need to have more resiliency in place, which is another thing we could Yes. That's done. Yes. Right? But how, how do you take that intelligence and use it to your advantage again? And, and I'm starting to see a big shift, or I've been seeing a shift, uh, in that physical, um, cyber relationship. It's very, very critical.

Yeah, you make excellent points, obviously, and, and the connection between physical and cyber and, and those, those potentials that people don't necessarily think about. Like you said, you know, what about an errant missile? I'm sure There are people doing business right now in countries that are adjacent to the hostilities who are like, well, we're hundreds of miles away. We, this isn't our problem. We're politically neutral on the subject. Nobody cares about us. And, and helping people understand bad things can happen that aren't intended. You can become a target by accident, or somebody can perceive you as part of their target package, even if you haven't. You may think you're neutral, but somebody might have decided you're not. Something you did, you know, feeds a third-party, you know, supply chain, whatever adversaries will will decide who they want to go after sometimes. And helping people understand you may not be uninvolved just because you want to be uninvolved or intend to be or plan to be or are trying to be. You may still become involved and become a target, right? Both physically or through cyber. I think that's a really, really good point.

Well, insider threat's another use case, right?

Yeah.

If you think about it from an insider risk or insider threat perspective, I've heard both names used, right? But the more that you can connect those dots between what somebody's doing physically and what they're doing in the cyber world, and you start connecting those dots, you can really paint a big picture and it gives you a lot of good evidence if you need to go after someone or actually help to prevent things from happening if you are sharing information and, and do that collaboration. That's, that's another really important use case for physical and cyber.

100%. And I think you make a good point about, you know, whether— I think it probably should be called insider risk and not insider threat, right? It's— I mean, we can have this discussion, right? It's the threat plus opportunity gives you that risk factor, right? I think most people are really concerned about what's the risk of something happening, whether it's an insider or outsider. There's threats everywhere, I suppose. The disgruntled employee is a threat, but if they have no— if the disgruntled employee has no access to anything, the risk is pretty low, right? The disgruntled employee is a 1-day-a-week groundskeeper who never even get inside of a facility. The risk is probably pretty low. If the disgruntled employee is a C-level executive with, you know, with access to everything, the risk is much higher. Uh, everybody in Intel or an insider already knows this, of course. So I think you make a good point about the risk. And you mentioned that earlier, and it was a point I probably should have doubled down on. You know, Intel helping people make informed decisions, which you've said a couple times. Intel is about decision-making, right? And I think risk is a huge part of this factor, is people want to make decisions based on risk. We can't stop everything. You know this, I know this, everybody listening I'm sure does. There's always going to be a risk. You know, the goal is to be able to quantify it and to manage it and to accept what that is and, you know, mitigate what you can. And I think that's the key piece, you know, that we talk about with intel and becoming more proactive and understanding everything. We don't want to have risks that we don't even know exist, right? So with that in mind, I got to get to the next question. I keep telling people there's 3 questions all we have for the show, and it sort of is. There's a lot of sub-questions in there. I'm going to get poked by people, I'm sure, but I am trying to stick to the 3. And so the second one we had on here, you know, without violating any confidence, obviously, can you talk a bit about your journey? So your last role, you know, before GSK was at State Street. That's where you and I met, obviously. And I'm interested in your journey there. You went from being the new hire to eventually the global head of cyber threat intelligence. I mean, you built and led this, this incredible intelligence team that was responsible for, you know, helping with informed security decision-making, right? And I think it's a unique journey. You know, I, I, I was excited to be friends with you and to walk through that and see how it progressed because a lot of organizations don't have intel or they do, but they're struggling to get traction, to get, you know, buy-in, to get funding, to become important, to become valuable, to become impactful. They're always worried the next budget cut's gonna be, you know, they're gonna go first, et cetera. And so I'd love to know more about your journey and dig in a bit on your journey at State Street from new hire to, to what you built there and the successes again, without violating any NDAs or anything like that, of course.

So.

Yeah, let's talk a bit about that though. How's your path there?

Sure. So I was actually recruited to go to State Street by Mark Morrison, who I used to work for in the government. So, you know, they were— State Street was smart in bringing somebody in from the government who really understood operations, right? And so he was brought in as a CISO over at State Street, and him and Dee Moran were there, and I worked with both of them my time around DIA. And he's like, I told him I was looking for something, and he's like, well, I've got, you know, I've got something in mind. And actually, I was seconded when I first went to State Street. So I didn't go to State Street in a sense. I was hired on by State Street to support the Financial Systemic Analysis and Resilience Center. So up to this point in my career, I had been active duty military. I had worked for large and small contractors, C2 contractors, and been civil service. So I'd done like almost everything you could do for the government, except I'd never been a partner with them. And so this gave me an opportunity to come out of, you know, directly supporting the government to partnering with the government to help in this mission to protect the critical infrastructure of the financial services system. So really big mission. I was very mission-focused. I still am. You know, this was protecting your retirement or your money. You know, for State Street's behalf, it would be retirement. But for, you know, other partners that we had, your ATMs that you went to to get money out of, or, you know, your bank accounts where your check was deposited, things like that. So we, we have the systemic risk, which, you know, could proliferate across the, the the financial system. And so, I was actually brought on board by Mark and Dave to make sure that we set up our intelligence function. So, I was intelligence lead for that, and I actually helped build the FSARC at the time. Now it's just the ARC, so we dropped the financial sector. But yeah, it was really good opportunity to take everything that I had done in my past, and I had helped Mark stand up a couple organizations previously, so he knew I had that experience. So, really establishing those relationships with our government partners and our peers to determine and define what does it mean to, you know, not just identify the risk, but to protect against those systemic risks and threats to the financial sector. So partnering with the government was a big deal. So I did that for about a year and then I went to State Street. So I can't say I went back to State Street because I never worked there proper. And then I worked as the SecOps director. So I was the security operations manager, I guess. I handled incident response and all of our security tools and intelligence, and we had a couple MSSPs. I did that for a few years, and then 2020, you all know what happened in 2020. Well, we had a CISO change there, and, you know, I got a peek. That's actually probably when I really got interested in the CISO world. I got a big glimpse into what that took and what, you know, what it, what it means to be a CISO. And, and I guess probably started thinking maybe that might be, you know, something good for my career path. But we got a, a new CISO in towards the end of the year. And then she asked me to focus on intelligence. And so I became the head of cybersecurity intelligence for State Street. And in that, I was allowed to build a team, which I have to say was a rockstar team. Love that team still. And we built out adversary modeling, which some people call threat modeling. I like to call it that because everybody thinks of software, but trying to identify those threat actors deemed the greatest threat to us so we can make sure we had the defenses in place, brought in the right tooling that we needed and the right people and just developed a bunch of products and had to fight for budget, had to fight for, you know, all of that to be able to get there.

Let's talk about that for a second. So that's where, sorry to interrupt you and dig in on the hardest part, but that's where people talk to me a lot about, hey, If you get to the point where they hire an intel professional or somebody internally, you know, gets it and wants to do this, right? I hear over and over again, the challenge is getting buy-in, getting budget. You know, how do I convince leadership that this is going to make us safer? It's proactivity. I may or may not have metrics to support it right away. Like, do you have any insider tricks on how do you, how do you justify, you know, budget and a process? Like, you know, do you come in and ask for a giant number? Do you come in and say, I just want a little bit and try to, you know, nibble away at it? Like, what was your secret to success?

Yeah, I think first and foremost is being able to tell a story. Even as a CISO, you have to be a good storyteller, right? And it's, you got to show that return on investment. What is it that you're going to get out of this tool? How's it going to impact my risk? How's it going to impact my bottom line? How's it going to enable me to make better decisions? So, you really have to be able to tell that story and why we want to invest in this program. I was very fortunate that my CISO understood the value of intelligence.

And so, well, yeah, Mark, right? Or was Mark gone by then?

And Liz. Liz was the last choice. And she definitely understood intelligence and the value of it, which is why she asked me to build that for her, right? And so, not everybody is that lucky in that they get somebody who actually just already understands it. So, while storytelling is important, the support at the top is probably the key. So you have to have that across all of cybersecurity. You've gotta have that support at the top. And I mean, even like now you've got SEC saying we've gotta have CISO presence or, you know, that kind of skill at the board level. Yeah, thankfully. That much of an important aspect of all business, right? Cyber's a business problem. It's not a security problem. And so, you know, you wanna make sure that you have that buy-in and then don't ask for an elephant. Like take it a bite at a time. Like, I don't wanna buy some big, beautiful, majestic elephant. I just need this one capability. And then you get that capability working, then you add another capability. 'Cause be realistic, if you try to buy everything at once and you don't have the people, you can't build it all at once.

That's right.

No, you gotta do it a little at a time. I think that's the best way to do it in order to be successful. At least that's what I've, I've found it has worked for me. So that, that's how I would go at it is just a little bit at a time and then Be a very, very good storyteller.

I think those are, those are huge points. I will say it's interesting. So I, I took a slightly different path, but not entirely, right? So the last, you know, large project I took on to build program, I did have a leader who was advocate, which helps, didn't have Intel background, but this was an advocate. And so I, I wanted to go a little bit of a shock and awe. I was like, let's find out if you really wanna invest in this. Like, let's look what the far end's gonna be. So I, I projected out like perfect case scenario, global team, different areas, all the tools and everything. With a really big number, knowing I couldn't get it all today. But I was like, let's find out. What I didn't— what I feared, and you overcame this, but I feared getting a little nibble and then just not getting any more, right? And it's just enough so they could check a box. And now I'm frustrated as an intel guy because, you know, we have a small team and we can't actually accomplish anything. I can't count the number of companies I've run into where massive team and you find out their intel is one person and that person actually has three other jobs. You're like, you're not really doing intel. So I came in with like this giant grandiose picture. And then from there it was okay, it's stages, right? Okay. We're not gonna do all the day, but these are all things about, but I want you to get the budget now. I was telling the CISO then, I was like, we should try to secure all of this. So it's available. I got very lucky in that we got almost all of it. And then I spent it all immediately because, you know, good old government background. When you get money, you spend it. You don't sit on it because they can take it back any day. And so us, we spent a lot really fast, people, tools, everything. I also hired a few people from the government, so I had people with background that could hit the ground running, which helped. And then lo and behold, when budget cuts came, they came looking to cut things. I said, well, you can't cut anything. I've already signed 3-year contracts with everybody and we've already hired these people. There'd be no reason to get rid of the people. You've already paid for the tools. Can't get rid of the tools because we're already contracted. You might as well keep the people. So, uh, yeah, old government trick for anybody who's never been in the government. When you get budget, uh, we've always been taught, make sure you spend it and spend it, spend it well, but spend it quickly and spend it all. Yes. Don't leave any behind because they'll assume you need less next year. And locking in 3-year contracts, you know, I was able to justify it. We did get better pricing, but I also knew it insulated my team from cuts. I had a hunch budgets were going to cut eventually, and you can't— they're not going to cut something that's already paid for and committed. They're not going to cut the people that are doing it because they might as well at that point, some cost. So, but I think, I think your point on storytelling is huge, you know, being able to explain. I think you mentioned two things we talk about all the time, which is you got to be able to tie it to somebody's risk. Uh, and somebody's bottom line, right? That's all, in my opinion, that's all I've seen that leadership cares about or can care about, frankly, is does this make us safer in a measurable way or does this make us more money? Uh, either cutting costs or raising revenues, right? If you can't do those things, it just seems so hard. So it's nice to hear that you had the same, the same experience in terms of trying to get the budget through. And then, so, so, okay, you've, you've, you've been recruited, you've moved your way up in the company, you've been, you've had a change in CISOs, another brilliant CISO comes in and you guys want to go intelligence driven. And so you're building this intel team and you're, you're taking bites away. So then how are you reporting back and showing those metrics there that risk is lowering, that, you know, progress is happening? I need more. We need to build the next layer. How are you doing that?

I think the work that we were able to do during COVID and Russia-Ukraine really helped. Not to keep going back to that, but we really had the spotlight on us. So at first they're like, why are you reporting on COVID or Why are you reporting? What do we, you know, what, why are you reporting on the Russia? I mean, we were reporting on Russia-Ukraine before it happened, right? Like we were trying to prep and we had some people are like, well, this isn't going to impact us. And we're like, oh yeah, it will. You know, you just don't know how yet. So we just, you know, trying to get that in. And then during COVID we actually briefed every single day to our C-suite. Here's the threats we're seeing here. You know, here's what we're going, what's going on around the world. And bringing in a lot of the data that we were getting from our information sharing channels that we had. And then we really just got, and it became where people started knowing who you were. So we, we actually presented our value, you know what I mean? On a daily basis, people were seeing what value they can get out of the work that we were doing. And it just kept growing from there. And so when Russia, Ukraine kicked off, it was immediate. Like we were running the daily briefings. We were running all of that to, to advise our leadership and our peers on what they needed to know from that perspective. So, I think those two events were instrumental in our success because when we said we needed something, we were able to get it and justify it because they were able to see the results immediately. It wasn't like strategic activities. This was tactical activities that happen every day, right? But then, you know, by being able to build out our team, then we started being able to be really strategic looking out with, Okay, we've got this stuff going on. These are the long-term impacts. These are the things we need to think about. We started getting involved in M&A, which, by the way, if you don't have Intel involved in M&A, we'll talk about that.

Oh my God, please do. Yes. Preach. I've been talking about this too. Gotta get involved. M&A is not just, do they fit our portfolio? Do they have any open lawsuits against them? And no offense to people doing M&A. I know there's more to it than that. And you're a lot smarter than I am in a lot of business stuff. So I'm not trying to pick fights.

So, so much value. Awesome.

So much value.

Yeah. Yes. Please get Intel involved. The threats, it's unbelievable. The risks that people take on and don't realize it. And they're like, oh, I didn't realize we bought a pig in a poke. But you sure did.

Yep. And then during COVID also supply chain attacks, right? We were able to, oh my gosh, like we, we just rationed the support there on all of our third, fourth, fifth, I just call it nth party. And then you learn, oh, by the way, yeah, I've got this third party, but they've got two other, you know, vendors that are working for them that are preventing me from getting that service. That really shined the light on that. So all these different scenarios were, were proving the value of what we were doing. So we didn't just have the support of, of our team, but others in the company because they started coming to us asking for help. So it was really good. You know, anytime we got in any kind of new business function or trying to build something, they would come to us and ask for help. So really just that being able to show and be on the, on the stage on stage, if you will. We were providing regular briefings, we were regular products out, and it was just, it was great. We were rocking and rolling. And it's geopolitical events have a huge impact on business. And I don't think that that's well known.

Talk about enough or accepted enough. I agree.

Yeah. So I think that's, you know, one of the things that we probably should talk about more because there is a cause and effect there, right?

Sure.

Sometimes it takes a little longer to realize it, but there's definitely cause and effect there.

But I think that's They're so successful.

Yeah.

And that ties into the, you know, obviously again, the name of the show, right? Yeah. For this episode, you know, talking about if you're not, you know, if you're not proactive, you're chasing the threats, right? If you're not doing intel, by definition, if you're not doing intel, you're not proactive. I talk to CISOs all the time. They all say they wanna get ahead of threats. We wanna be proactive. And then I ask 'em how much they're investing in intel and suddenly the crickets are chirping and I have to give the bad news that you're not proactive. Like by definition you're not. Well, you know, as soon as we got a signature, we reacted or we, you know, we took action. Well, that you reacted, it was in your environment already. Even if nothing bad happened yet, I get it. You're early in the reaction side. But you're reacting. Proactive is being able to see things that haven't happened yet. Like, like you were talking about, why do we care about Russia and Ukraine? Why are you talking about this? A war hasn't even broken out yet. But an intel leader says, we've got to look at the possibilities, the potentials. Now, you can't look at everything. Of course, we can't spend on every possible scenario. So, but that one seemed like a likely challenge. You, you obviously were able to see it as a lot of other people, you know, did and said, hey, this could have major impacts on, you know, global economics and shipping and all sorts of different things, right? And to be ahead of the curve. Now, I suspect when things started happening, you picked up a lot of credibility along the way. Like, well, Lisa told us this was going to happen, or this might happen. At least probable, possible. Again, the terminology we use, because I've seen some of the same things. But as you said, people, I think there's still not enough discussion or investment or willingness to invest in strategic, because metrics can be difficult. We tell you about world events every day and you know what's going on. And potentials, et cetera. A lot of those things don't become anything, or they do in 8, 9 months and you've forgotten somebody briefed you 8, 9 months ago about it. But if you don't understand the global picture, you know, people talk about globalism all the time. We're all connected to everybody at this point, pretty much, right? Whether it's supply chain, whether it's financial systems, whether it's pharmaceuticals, we're all kind of connected, right? So I think I still struggle with organizations that are just tell me about threats to me. Like, I was really, really myopic. I get that that's important. Don't get me wrong. We'll always tell you about threats to you. Some go, well, just my industry. Okay. It's getting better. Well, just my geography. I'm getting a little better, but it's really all of the above. Right. And helping people understand that because a lot of those things in my experience, and you tell me if you're seeing it differently, the further away you get from the target, from yourself, the metrics get tougher. Right. Because, you know, I, okay, Russia, Ukraine, 2 months before it happened. Well, why are you telling me this? Well, here's the importance to it, but I can't tell you today the money we spent and the time we spent making this report. You can't do anything with it. Like, it's not actionable, right? So a lot of folks keep talking about actionable intelligence, actionable, actionable, which I think is really, really important, of course. But I spend a lot of time saying you got to also remember the value of informational because that often becomes actionable. You know, I used to say in the government, you know, we had tens of thousands of intel analysts and everybody's not focused on just China, Russia, North Korea, and Iran. Somebody is studying Bolivia someplace. I don't think Bolivia is a threat to us. I haven't heard anything about it. But if tomorrow Bolivia becomes a threat, tomorrow's way too late to start learning about Bolivia. The government prints money so they can, they can hire people to sit in corners and study all the countries. And we can't do that in private sector, of course, but it feels like you've got to be able to expand that aperture, right? And that's why people like you, like intel leaders in these positions who, as we said, think differently, see the world differently, are able to stand and can tell good stories to prove the points, are able to say, I see some things that you might not see. I mean, probably a more polite way to say it, but you know, I see the world differently. And there are some other things on the horizon that I think are worth investing time and energy to understand. Because if bad things happen, you're caught on the back foot. I mean, imagine if you hadn't done that work at State Street and prepared for the possibilities with Russia and Iran— Russia and Ukraine. Now you're on— sorry, I know— Russia and Ukraine. Yeah, I'm not making new news over here, anybody. I don't think they're at war. Uh, Russia and Ukraine, or as you said, as COVID was kicking off, right? How's this going to affect us? You know, M&A, I mean, you mentioned that. I got to dig in really quickly. I won't call out names, but a while ago I had a customer, a different company. They were massive pharmaceuticals. It turns out was not GSK. They were an Intel customer and they came to us and said, hey, we've got a challenge. Our CEO has just publicly announced a partnership with a quote unquote non-government organization from China, and we don't know anything about the organization or any of the risks or threats. And I said, okay, well, that's challenging. This isn't quite M&A, but it's in the ballpark, right? So we did the research. We had a brilliant person do this. And lo and behold, this non-government organization in China, you'll be surprised to know, wasn't quite non-government. Turns out their office was co-located with, well, it was TPLA at the time, I think. And all the people that were on their, their org chart, well, we got pictures of all of them in Chinese military uniforms as well. And so then we have to report this negative news back that says, hey, I got some bad news for you. You should probably not do this arrangement. Well, we can't. It's already public. It's already announced, et cetera. I said, well, then you should expect all of your IP to end up in Beijing because there's massive risk here. There's massive threat. There's a pattern here that suggests now, even if you tried to back out, they're probably just going to try to steal it from you anyway. And sadly, the response to this wasn't, thank you. Oh my God. Great intel. We should try to at least prepare ourselves, look for things. The response was, we can't tell our CISO this. We can't tell our CEO this. We'll get fired. So they fired me instead. I was like, oh, okay. Well, that'll go well. I'm sure that fixes your problem. Like, feel free to turn the lights off and pretend that the room isn't infested. You'll be fine. Like, it's good. Yeah. I don't believe anybody still from that org works at that org anymore, but I mean, it was a wake-up call for me when I realized, you know, yeah, yeah. I was, I mean, it was a wake-up call for me. It was the one that crystallized, I got to start telling people more about get us involved in M&A, get us involved in partnerships before they happen, because I don't think I'd quite talked much about that until that moment. I realized, oh man, we're way late now. I would have hoped they would have asked us the question before they did this, but also we hadn't educated them that this is an area where Intel belongs or we should help. So I owned some of it too. I was like, man, we've got to start banging the drum. Please don't get into partnerships without talking Intel. Please don't acquire companies without talking Intel.

Go on. Yeah. And pre-deal.

Yes. Pre-deal. Yeah. After it's too late. Yeah. I can't help you then. Right. Once the horse is out of the barn. Don't, don't ask me what we should do at the door. You're right. No, pre-deal. Like, I've worked with orgs now. I work on intel requirements a lot with organizations because, as you know, most organizations don't have intel requirements. Most don't even know what they are. It takes somebody like you or me or some others out here to say, hey, we got to talk about how to make this systematic. And I talk to people in those intel requirements about, you know, acquisition. M&A is one of the categories I talk about. And who do you work with on this? And how do you get into that cycle? How do you get in with the execs and the lawyers, etc., and show value because they all want to do well. And if they understand the risks, and I'm sure every one of them probably has a horror story about a company they bought and didn't realize. How about that third-party risk? Company looks great, they're clean. Well, if you dig a little deeper, you find out that the next layer, everything they do is in some area that's either physically risky, hostile, or maybe they're not vetting people well who they're hiring. And there goes all your IP out the door because they got somebody in a third-world country who's underpaid and has a chance to sell your IP. I think those are all areas where we have opportunities to educate folks on how to be more proactive. Again, this whole proactive approach, get ahead of the deal, get intel involved. You're already paying for this intel team. You bought the tools, you bought the people, you got Elisa on board who's amazing and sees the world differently and has brought in these rock stars. That was a great team. I'm sure the one you have now is great too. You got to use them. You know, I tell people a lot of times it's about value. You've already spent the money. You want value. Put intel into more places, stop burying it in the SOC. I mean, I know you think this way too, like rise it up, right? And you did some of that, right? You were able to elevate intel and support more groups like Insider, as you mentioned, and Physical and all these places. So like it was amazing to see that journey, you know, and what you did there was outstanding. But now I got to transition, right? So we got one more question. So now that you're not doing that, now that you're on the CISO side of the wall, right? You're not actively doing intel. You're not leading an intel team. I know you used to work with them. Now that you're on the CISO side, Right. The dark side, perhaps. Sorry, CISOs. So, but now that you're over there, I may have a couple questions with it, kind of a question, sub-question. Like, first of all, are you still an advocate for investing in intel-driven security? It's easy for me to talk about all the time. I'm an intel guy. People say, well, he's a vendor. Of course he advertises for intel. They sell it. You know, but now as the customer side, which I consider CISOs to be customers, are you still an advocate for investing in intel-driven security? And then the The second piece is, what if anything, being on that side of the wall, what if anything do you see differently? How's your perception changed, your perspective changed on intel, on security, on all these things we've been talking about?

Yeah, so that's a really good question. So 1,000%, definitely. I mean, if you can't tell that by what I've been talking about, I'm quite passionate about intelligence. And I see my role now as, you know, taking intelligence to the C-suite, so to speak, making sure that they can understand the value of that intelligence. Again, for decision advantage. But being on this side, I can, you know, see how we can better use intelligence to support our operations. You know, it's, it's really important to, to be able to connect those dots, so to speak. And you're right, there's not a lot of intelligence professionals on this side of the house. So we have kind of a different perspective. And again, we think differently. So we're going to be thinking about risks differently. We're going to be thinking about threats to those risks differently. And being able to make sure that folks around me understand that value. Luckily, our CISO here understands the value of intelligence. So you see a theme, I'm working for people who understand the value of intelligence. So, you know, I think it's so good because, you know, when they don't understand, it's harder, but when they do, they're understanding and getting that value out of it. So even my boss's leaders want to see that intelligence. So it's really heartwarming to see that transition and that happen around the company. So, I think it's really good to have that. You still have to think about the bottom line. You still have to think about your return on investment. You gotta make sure you've got the right partners. You gotta make sure you don't have overlap of your tools, you know, things like that. So, looking at it from a holistic perspective, do we have the right protections? Do we have the right capabilities? And so, part of my job is to make sure we have those right tools, right? My team's responsible for building those tools. If we don't have them, and make sure that the defenders have the right tools to secure the company. So, seeing it from that perspective, it actually is teaching me in the same process. I'm teaching them, but they're also teaching me because I was brought here to help build what we need, because I know what we need, because I've been there, right? And seeing that part of it is really good. But on that return on investment, it's always about, you know, what am I getting for my dollar or my pound in this case?

Right. British company. Yes.

Yeah. We've got the right stuff in place. I think that's really where I'm seeing the value. And it's a two-way street for me now. I think you're always learning in your career. You never should stop learning. And this is yet another path for me to, to learn. And I just think it's good, but that's my perspective.

So you mentioned, you know, that you've been lucky in that the last few places you've been, you know, you've worked for CISOs that understood Intel, right? And now you do as well. Is that luck? Is that, is that intentional? Are you interviewing CISOs? Are you choosing positions? Are you, do you read a CISO's resume before you decide if you had an interest in going there? You know, I, I will tell you, you know, I do. So, you know, I, I've gotten to the point now where I, I have friends who say, you know, what do you think about this gig? And I've, I generally start by reading the CISO's resume first. I'm like, uh, this is likely to be what this person's background, based on the background, this is likely to be how they think about things. This may be a harder path. This is somebody who's a straight technologist. Now maybe it won't be. I don't discount, but, uh, you know, whereas somebody came out of the government, I'd be like, all right, this is the org they were in. They really, they're probably going to be really deep on this, et cetera. Have you done the same things when you've made these moves to kind of, you know, say, is this a CISO I think I'm going to blend well with? Are they going to get the value of intel? Is it going to be a harder sell or an easier sell for me?

Absolutely. I mean, I think that you're interviewing as much as— you're interviewing them as much as they're interviewing you when you're, especially when you're at this level, right? And you're going into a new place. And I actually, you know, told my current CISO, it's Mike Elmer, and I said, if you want me to come, I'm bringing intelligence with me. I can't not, because that's my life. You know, that's who I am. It's, it's inbred in everything that I do. And he just smiled. He was so happy, right? And he says, you got it. I said, because, you know, that's how I'm going to be. And really, I think, you know, he mentioned that one of the values that I bring is that threat-driven lens of being able to identify what threats can make our risk be realized. And that was a lot. We talked a lot about that before I decided to make that move. So it was really important to have those discussions so that he can understand, you know, what I'm bringing to them just as much as I'm going to get out of that relationship as well. So, So it was very important for me to still be able to bring that intelligence lens. And even though I'm not responsible for intelligence, still be able to impart my experience in, you know, been doing this forever. So, you know, I've got a lot to teach, I think. So the fact that they were willing to let me do that was really good and necessary for me.

That's, yeah, I think that's fantastic. So being on that side, so I'm going to ask, you may not be able to answer this one. We'll see. So, you know, we talked earlier about the frustrations in building intel teams. A lot of times, especially on the CISOs, is, you know, winning them over, getting budgets. You know, listen, I'm going to focus on the budget one for a minute, right? Is, you know, budget and value, etc. Now that you're on the other side and you get to see the bigger budget, the CISO budget I don't see on my side when I'm begging for, for my, you know, change, is, is, do you see it differently? Is it, do you have better understanding? You don't necessarily have to share anything. I'm not asking give away any secrets, but better understand how CISOs think about budget versus how I think about it when I'm trying to build an intel team. And, you know, without giving away too much, are they right? Like, should I stop beating up CISOs trying to get money out of them? Should I— is there something we should be doing on this side to better understand and connect? As if it was just going, you're not spending enough on intel. I mean, I just said that earlier. You want to be proactive, you don't spend on intel. You know, I admit there's some blaming to that and some finger-pointing, which isn't necessarily constructive. So, Is there anything you've learned on the other side of the fence that you can throw over and help say, here's some ways to better connect on these things?

Yeah. So, first and foremost, Intel's not the only thing the CISO spends money on.

What? What?

I didn't know that either. So, I figured I'd share that.

Well, you really have drank the Kool-Aid now, haven't you?

So, I used to always think it was just me, but, you know, we have myriad of different, you know, capabilities that we're trying to provide for the organization. From governance, risk and compliance to resiliency, our SOC operations, intelligence, you know, all the different functions that we do. And you only have a certain amount of money to be able to spend across all of that. So, you have to have very good, strong leaders under you that also know that, and they're realistic about what they come back for and ask. And then you always have to have, you know, things in the background and making sure that we're spending the right money on things. It's kind of like auditing yourself, right? Making sure that, you know, if intel needs something, do we have to take that away from another area? And it's really about a balancing act. It's about making sure that we're putting our money where we need it the most, and then rebalancing that a lot, right? You can't start at the beginning of the year and say, this is what we're going to spend our money on, because things happen throughout the year, things change, and you need to adjust. So it's being able to adjust as well, but have good program managers, you know, good chiefs of staff, good leaders that can help you with all this, because a CISO can't do it by themselves. It just—

who does the CISO trust the most? I know this is a generalized question, but who do you, in your experience, who do you think the CISO trusts the most when they go to advice? You know, they've gone through all this, you, you've talked to all the vendors, you've, you've tried to figure out and juggle what's staying, what's going, we don't have enough money for everything, etc. Like, who generally do you think has the most— is it the chief of staff? Is it the person who runs the SOC? Is it their puppy dog on the car ride in? Like, who do you think is the CISO whisperer?

So, I think it depends because there's so many different functions. I think in a lot of ways, the chief of staff does. I think a lot of ways, the SecOps person does. I think it just, it truly depends on what's actually going on. And that's why I stated you have to have strong leadership across all your teams. Those people have to be able to communicate and talk about the problems or whatever it is they're seeing and be able to negotiate amongst each other so that when the CISO asks, We're not telling different stories. We're all on the same page. We're all in this mission together and we're all fighting for the same thing. And we, it's a give and take, right? So I think it depends. I'm not to dodge your question, but it's good.

No, I figured it might be.

I've seen it in different ways, right?

Yeah, that makes sense. It was not gonna be an easy question. I mean, there's, there's no one answer, I'm sure.

How's that?

You're the CISO whisperer. All right. That's good to know. All right. I got to talk to Lisa offline later about that and see how they're, how they're doing. I know they're Intel driven, so. I'm sure, you know, Zero Fox would be happy to chat with you guys about all the things. That's right. I'm sure, I'm sure we could chat about that for a while. All right, so we're rolling in on the end here. Those are the 3 big questions, but, you know, as with every episode, I like to close. I got a bonus question for all the guests, which is kind of a challenging one sometimes, but, you know, the name of the podcast is Unspoken Security. So tell me something you've never told anyone, something that's, you know, so far been unspoken.

Wow.

Huh.

You talk about a few things. I think, man, I think probably whenever I took the role at State Street to come into State Street, our CISO between Mark and Liz was Adil Saeed. And the first thing he wanted me to do was MSS recompete. And I said, are you crazy? He says, why? And I said, because I don't know State Street. I don't know operations. I'm an intel professional. You know, I don't know this stuff. He's like, you're going to be fine. You're neutral. You're not jaded. You're going to be able to make the right decision. Sure. Okay. About halfway through that process, I want you to be a SecOps director. Are you crazy? Now, for me, talking to a CISO, I'm asking twice if he's crazy. Right.

No, you're going to start your new job.

Yeah.

And he goes, you're going to do great. So he was right. Both times he was right. Like he was able to see something in me. To do it, I didn't have the confidence in myself to do it, right? I didn't think I had the chops. And then, you know, fast forward a little bit, we had our lead incident responder had left and I had to get called into to do incident response because it rolls up to me because my responder was there. I was scared out of my mind. I was like, I don't know how to do this. I've never done this before. So, I get on the phone and what I haven't told you is that I am a certified FEMA instructor for teaching emergency response disaster management.

Oh, wow.

I said that wrong. Disaster response, emergency management. And so I actually teach this to civilians on how to be safe in your neighborhood. And I've had incident commander training and that just kicked in and I just took charge and I did fine. And I was like, I was afraid I was going to make the wrong decisions. I was afraid I was going to say something stupid, you know, cause I'm, I'm not an IT kind of person. I mean, I've had IT since, but I'm not an IT person, you know? And I, and my training just took over. And I guess the point of that is like, if you're in a situation and you think you can't do it, just rely on what you know, you know, go back to what you know and you'll be fine. And it, and it really was, it, it was, it was hard, but it was fun and it was good. And in the end, I learned a whole lot. And, uh, the incident response, I actually love doing incident response. Today.

So now, did anybody know? Either did you tell people, hey, I don't know what I'm doing, I'm gonna figure it out, or did anybody figure it out? Or did you— is this a fake it till you make it?

I'll admit it today, that, that one call was a fake it till I make it thing, because I was on this— on the inside I was scared, on the outside it was fun.

I think, you know, it's funny, this is becoming a bit of a pattern. I've had some of these conversations. Obviously I'm early to do the podcast here, we don't have a lot of guests yet, and some, some that haven't, you know, been public yet but will eventually. But there's a, there's a bit of a pattern in our industry, uh, I think, and I don't know if it's other industries, the only one I know, a lot of people have a similar, maybe it may not this, it's a different piece, but a lot of, I had an opportunity to do something. I wasn't quite certain I could or couldn't do it. I hadn't done it before or whatever, but I, I just jumped in and did it right somewhere between, I, I want, you know, about taking the risk and, or about having confidence in yourself or just, you know, it had to get done or, or I wanted the job or whatever it might be. Right. There's, it seems I'm starting to wonder if that isn't something in the nature of people in our industry. That it's just, I'll figure it out. Like we're, you know, a lot of bright, bright, confident people, not arrogant people, but confident people say, you know what, it's gotta get done. I'll figure it out. And not one yet has said it didn't work, right? Not one has crashed and burned or failed or anything. They have in fact just figured it out. And I think it's a good message to hear. And, and it's from people high up, you know, CISOs and deputy CISOs and, you know, CEOs and leaders saying, yeah, this is, this is a thing. Now, obviously I wouldn't, tell anybody, like, you know, don't fake a bunch of things on your resume. Don't lie about your background. Don't, don't, don't bite off more than you truly can chew, which I realize is a tough question where you're like, why, I can't do this. Can I? Can't I? But like you said, leveraging past knowledge, you know, the FEMA training makes perfect sense. Incident commander's incident commander, you know, in, in a sense, right? Mm-hmm. Makes perfect sense. You had the training in you, you know, I have, I have times where I've taken things on, it doesn't make sense. I'm like, ah, somewhere in the military training or intel training, I've got something that probably relates to this. I can figure this out. Oh, sorry. My dog has an opinion on the subject apparently as well.

Exactly.

Yeah.

Yes.

Yes. Right. It's good. She's actually warning me. This is how it works. This is my warning system here about threats and risks. But yeah, you know, it's being able to leverage past experience and say, yeah, I probably have something in the file. And it also helps to be old like I am now. You aren't, but I am. And have all these experiences. I'm worried because I'm going to start forgetting the experiences I should be leveraging and then I'm probably going to be done for. But no, I think, I think it's, it's a thread, right? I think it's, I think it's great to see, you know, that you did that and then you were successful and I assume it, you know, built confidence. You said now you felt, you know, you really like incident response, right? It's like a cool thing, right? You know, fighting fires. So thanks for sharing that, you know, with me and with the audience, because I think it's a message people can't hear enough that I don't know of anybody who's made it, whatever made it is. I don't know if you feel like you did. I haven't yet. And I don't know. Right, exactly. That's the other thing. None of us think we've made it. Everybody's like, oh, I think you've made it. I'm like, I made what? But I don't know anybody who's at some established level who doesn't have one of these stories where they took a leap and they did a thing. Or this isn't the case here, but we've all got a failure story someplace too. I'm waiting for people are going to start telling me some of their failure stories because I've got plenty of them. But you did because you're like, hey, I got to take a shot. And just being able to grow and learn from those. I think it's challenging coming up to think you have to know everything. We talk about applying for jobs. You see the job description. I don't have this. I'm a year short here. I'm like, oh my God, please just apply. And the only time I'm going to mention it is for this show is because here I see that there's a big disparity in that in guys versus women. Like, I know dudes who have no experience, no qualifications, like, um, you know, I haven't heard of computers. I could probably be the CISO. Let me throw my resume in. And I know brilliant women who somehow convince themselves, well, it says 7 years. I only have 6 years and 9 months. I should wait to apply. And I, I'm, I'm, I'm like, oh no, go apply. Trust me. Like, that's. That's a unicorn, you know, description. You're brilliant. You're qualified. You know, have you seen that too? Oh, you've been, you've been doing this a while. Yeah.

Oh my gosh.

Yeah.

There's actually statistics out there around that, you know, women have to be about 100% qualified to apply. Whereas men don't. And even like when I was applying for my civil service job, they wanted a doctorate.

I'm like, seems reasonable.

Yeah. And I was like, no. I still applied and I got it and I got promoted twice. You know what I mean? So it just, don't let that stop you. Whoever you are, if you have a desire to want to do that job and you think you're even remotely qualified, go for it. Who are they to say don't apply, right? Whoever they is, but you know, go for it. You never know because sometimes the opportunities that you miss out on are the ones that you don't even try for.

100%. And some of those vacancies sit for a long time because people don't apply, right? You know, you can't. Yeah, it's the old cliché, 100% of shots, you miss 100% of shots you don't take, right? But it's true. You see vacancies that go months and months and months. You're like, gosh, I wonder why nobody's taking it. And then for a while people are like, well, it must be an undesirable job that nobody's taking the job. Like, no, maybe nobody applied because they wrote a terrible job description that created a unicorn status and everybody self-selected out of the position without trying. I'm a big advocate in applying. Like, worst thing that happens is you won't get interviewed or you won't take the position, whatever. Don't hurt. Applications don't cost a lot of money. Those government ones take a lot of time though, so you better be committed if you want to work there.

Very long time. I actually turned down the job once because I was offered a position, uh, with the government and it was going to take 8 months to place me.

8 months. I hope they are getting better at that and working on that. The government struggles to get some of the best talent, I think, just because they run out of time. Like, people, people can't do that. And then, of course, they may not be competitive financially either. So 8 months, by then you get a job in the private sector, it's harder to reel them back in. But anyway, that's a whole different topic for another day. Absolutely. So listen, we're, we're gonna wrap up here. Thank you for coming on. First of all, Lisa, thank you for making the time. Thank you for all you've done to make, you know, for State Street safer and now what you're doing at GSK. Thanks for being my friend. Obviously, I appreciate it. It's, it's great to be able to talk to you, not just here, but elsewhere. I learn from you all the time, and I'm gonna keep doing it. I took some good pieces just out of today that I hope others did as well. You know, but I, I appreciate you being on, uh, with me. I hope we'll be able to get you back here at some point. You know, I'd love to, to talk more about things that we can share with folks, but, but thanks for coming on Unspoken Security today. I look forward to talking with you more here and elsewhere. I look forward to more opportunities. And thanks for everybody who's listened to this podcast. I hope you'll continue to tune in and I hope we're both entertaining and informational. And if we're neither or one but not the other, feel free to let me know. Please try to be kind about it. It's not the easiest gig, but, you know, throw tomatoes if you need to, whatever it takes. But anyway, that's it. We're going to wrap up this episode of Unspoken Security. And until next time, Thanks everybody. Talk to you soon.

Thank you.

That's a wrap for this episode of Unspoken Security, brought to you by ZeroFox, the only unified external cybersecurity platform. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.