Episode 03: Embracing Innovation and Finding The Way Forward

Pioneering solutions, transformational technology, and inspirational leaders. I'm your host Connor Sherman, and this is the Confident Defense Podcast. Welcome to the Confident Defense Podcast. I'm your host Connor, and today we've got a really special guest, a pretty amazing individual, Bob Fabien Zinga. He's truly a visionary and senior-level cybersecurity technology risk executive. He is a senior information warfare officer in the US Navy. He sits on the Forbes Technology Council and is currently the director of security at Directly. Bob, welcome to the show.

Thank you so much for having me, Connor. Appreciate that.

My pleasure. As you know, like, the reason we have this whole show is because we really want to take individuals who are on the forefront, who are pushing the envelope, who really see around what's coming around the corner when it comes to innovation in security. So when you and I got talking and I realized that you've just had this incredible experience getting to where you are today, you literally sit on an innovation board on the Forbes Technology Council, I was like, I just had to get you on the show. So I really want to— we got a bunch of stuff I want to dive into, but I want to start with that technology, the Forbes Technology Council. You've published over 14 articles here on Forbes. You are a powerhouse and an insightful individual when it comes to what's happening in the security community. How did this whole thing come together? How did you get connected with the team at Forbes?

Yeah, that was pretty interesting. They actually invited me, right? I believe her name was Nicole. I can't remember her last name. She was like, "Hey, it looks like you should be on our council." So I took the call, and it didn't take very long. Like, within 10 minutes, I'm like, "Yeah, I'm in, I'm in." please sign me up right now. Of course, Forbes is a magnificent brand. Everybody knows about Forbes. So yeah, and then I accepted the invitation. That was back in October. I think it was October 28th, if I remember correctly, towards the end of October. And I've already learned a lot since then. It's kind of sharing what you know, helping the community, but also learning from your peers. Some of the leading Fortune 500 CTOs and CXOs really around the globe. So it's been a great experience.

It's gotta be pretty special being on part of a team that really is that champion, that innovative voice, because some of the articles, as I was stalking you in preparation for our conversation, I was definitely reading through the articles and doing my homework. And you know, what I see is like there's a recent article, and I'll link to all of this in the show notes, But like when they talk about 15 digital payments that are coming around, they're gonna change the way people do commerce. Like, so there's your, here it is, your voice in the midst of all these other incredible thoughts as well. Like what are some of the topics or what are some of the areas that you think that are worth highlighting and mentioning that are changing and there is some innovation coming into?

Well, I think the only thing we know for sure is not change is here to stay. I can't even remember who originally said that, but it is really, really true. I mean, especially in the area we live in today, especially in Silicon Valley, where we've always been leading in innovation around the world for a very, very, very long time. But one thing I believe is we really need to build more and more leaders, right, in the world today. We've all of the changes happening and the advancement of technology, automation, right? And there are a lot of jobs already we know that are never going to come back. Robots have taken over, and I think there's going to be a lot more changes in the future. And especially like 2020, who could have thought, you know, this little pandemic that started in China would pretty much change the world, uh, the way we knew it. So, um, Things change, there is a lot of disruption and you need to adapt. But I do believe one skill that is really crucial is learning to be a leader, kind of put yourself ahead of the curve if you can. Because I think no matter what happens with technology automation, there will always be a place for somebody who can lead because that's just something that is needed. And it is kind of strange though, I'm trying to think back When I first came to the US, back then I was a pre-med student and I instantly knew that was like in the '90s, right? In the mid-'90s. I've really, I've never seen a computer before. The first time I really touched a computer was in 1997. I was very afraid of the computer, but the way I got over my fear is I took that one computer where I was working, I completely set everything apart. I took all of the components out and then I put it back together. I'm like, okay, I can do this. I did it again and again, and my fear of computers just evaporated. And I've been really, really enthused and very, very much excited about technology. But anyway, my original point was when I first started my career, I kind of knew no matter what you did in the world, whether you are, I don't know, a doctor, a lawyer, or whatever it is you do, you need to know about computers, technology. It's going to have to be a part of your life. And you also need to know about business. I just felt like those two things we are crucial no matter what you did. And of course, no, technology has definitely revolutionized the world and the way we live, right? I cannot even spend like half an hour without my iPhone this day. It's just amazing how much a part of our life and work it is today.

Well, speaking of that blend of like security and business, I'm so glad somebody else saw this too, because that's what I got my degrees in. I'm like, I'll get my trade in cybersecurity and my degrees in business, and hopefully, you know, there'll be some value here. So, you know, either we are both on the right path or we're both equally crazy. No, I think you're absolutely right. There is a sense where every company has become a technology company, and now it's our job to use that technology not as just from an operational perspective, but really that competitive advantage. And I think the next logical extension of that is every company is security company. And you can, again, you you use that as like a burden or it becomes that competitive advantage in the marketplace.

Yes, and that really became very clear to me, uh, when I moved to Silicon Valley. I was working for a startup called PayPal, and one, one thing we used to say is that every single company is a technology company, they just may not be aware of it. So we are going to provide our platform and allow them to complete their digital transformation, and that's what we did. I stayed there for like 2 years and a half. It was really a great, great time, and I learned a lot.

So let's go back to that notion you mentioned about leadership, right? As like the meta skill of all of the technical skills, being able to lead in that capacity. What are some of the things that you'd like to see in the security community as it portrays to leadership? What are some of the changes that we should be thinking about to build better leaders, more diverse leaders, more inclusive leadership in their community?

Well, there is a lot. I have a lot of mentors. One of my mentors, my leadership mentor, Dr. John C. Maxwell, says something that always stuck with me, you know, he says, "Everything rises and falls upon leadership." And I think it is true, not just in cybersecurity technology, but really throughout life, right? Leadership is a very, very key skill, but I think at its core, leadership is really all about influence. Like you mentioned earlier, I've been in the U.S. Navy Reserve for 16 years now, and to the military, leadership is to the Navy kind of what location is to real estate. It's really all about leadership, no, leading people, men and women, in times of war and peace. And if you're gonna have people follow you and they know that there is a good chance, no, they may not come back, you better be a pretty good leader, right? So, uh, that is really, really, uh, critical in everything we do in the service. But I, I just feel, feel like, uh, cybersecurity, I think, is a, is a really great, uh, field, right? I'm, I consider myself very lucky to have stumbled upon, uh, security. I think we are relatively young compared to all of the other professions out there. I think it's probably what, maybe 10 years ago that it became an official profession, because most people prior to that, they just did it as a hobby, right?

Sort of being an Instagram influencer. I think we're the youngest industry out there. Finance has had how many hundreds of years and we've had 20?

Yeah. Yeah. So yeah, I think leadership is very, very important. And one thing that kind of amazes me is when I started, what, 15, 20 years ago, I used to look up, right, to security experts, all the experts. I want to learn from them. I just want to listen to what they have to say and learn and grow. And, uh, 15, 20 years later, I am now one of those ex-experts. I really feel like I have this burden to kind of help shape the next generation, right? Because we really, really need more and more people in this field, and things are just going to get worse and We need people who are qualified and who really know how to do, how to run a security program and really reduce risk, right? From my military background, to me really cybersecurity is a national security issue, right? Because when we have nation states who come here, like SolarWinds is one great example of that still. Our intellectual property. And now in cyber, you could even shut down lights and generator and do all kinds of damage, really, because again, everything we do today is tightly integrated with security, whether it's flying an airplane or whatever.

Yeah, sorry to interrupt that because I want to unpack that point for a second. But to your point of turning off the lights, we've seen that Russia did that to the Ukraine, right? A few years ago it went dark and it wasn't an accident, very deliberate over time. So getting into power grids, turning that off, turning off hospitals is a real thing. And then, of course, SolarWinds. So let's— you brought up SolarWinds. Let's go there. What are some of the lessons we could learn from SolarWinds? Because I mean, this is still ongoing. It's not stealing headlines at the moment, but it's still unraveling. It's still unpacking.

Yes. And I think it is pretty much going to take a while for us to really learn the significant impact of that. I actually wrote an article about that, I think within a week. Of us finding, finding out, because it was really a crucial, probably the most impactful hack we've ever seen in the US, impacting not only the US government but leading Fortune 500 companies, even some of the leading security firms in the world. So this, this is quite serious. And if you go to my Forbes article, you will see I mentioned 3 Specific things. Give me just a second here. Okay, here it is. It's really funny how you look for your own article here. But yeah, 3 things I did bring up right away is the notion that really every computer system is vulnerable, right? One of my mentors used to say this, back in 2001, when I started security. It's like the only way to be 100% secure with a computer system is to not use the computer, put it like in a box and sink it. Then you are 100% hack-free. But as long as you turn it on and put it to the internet, it will probably get hacked. So that's just the reality of life, right? So you have to manage risk. You cannot completely remove the risk, but you need to be able to manage it. And that's what a good security program is supposed to do. But I think another important point is security is much more than just technology, right? Technology is very important, and especially when people just get started, they are really in love with technology. They want to get all of these great technological skills, which, which, which is fine and dandy, but at some point you really have to go beyond the technology. You kind of need to understand your organization, what the strategic objectives are, what you're trying to accomplish, and then everything else, you know, beyond technology that is related to what you are trying to do and to accomplish. And in many, many ways, I think of cybercrime really the same way anybody would think of any other crime, right? Usually 3 things come into play. One is somebody has to have a desire to get whatever it is that you've got. They have to want it. The motive. Yes. And then number 2, they need to have the skills in order to be able to steal that thing from you. And then number 3, they need to get the opportunity. That's why most people, they lock their doors and so forth. But just by locking your door doesn't mean nobody's going to get into your house and steal whatever you've got. But it just makes it more difficult, right? It kind of keeps honest people honest. They try to open the door, it's locked, okay, they go do something else. But if somebody really, really wants to get into your stuff, they're probably going to find a way. All it takes is just time and opportunity. So hopefully the way we manage our security program, we kind of remove that opportunity from those bad guys so they can go hack the business next door and not mess with us. But, uh, and then, uh, the The last thing I mentioned was that security really needed to be elevated. I have been in the security field for quite a while now. The only exception is probably the military, where Congress pretty much gives us all of the money we need, and when we run out, it seems like they just print some more. But in the real world, everywhere else, you know, resources are limited, and you really have to do the best you can with the resources available to you at the time. But what I have noticed, especially when I was a consultant, is a lot of businesses, they do sing the praises of security and privacy and trust and data security and all of those things. But then when you look at their budget, how they actually spend their money, most of the time they don't spend enough in something they say is crucial or extremely important to them. And to their client. So I feel like in this time and age, security really should be elevated. And we've had a lot of discussion with a bunch of my peers now on where I should security report to. Traditionally, it's been the CIO, sometimes to the general counsel or legal, or sometimes engineering or IT. But I just feel like for an organization that takes security seriously, you really need to consider having the security function reporting directly to the CEO or even to the board of directors.

But so that's interesting you mentioned that.

Yeah.

No, I think, I think I know it's that it's like, and I get that, but it's like, my goodness, wouldn't, what an interesting world that would be, right? When you have to talk, when you are directly responsible to the CEO of the organization, I feel that like you really take security from being a feature of a product set, feature of a technology, to being a function of the organization. And that switch changes budgets. It changes the caliber that you hire for, you know, hiring someone to run your security program. If it's baked under the CTO or baked in the CIO, okay, they're technical, they can't talk to the board, that's fine. You might hire that person. But if they're reporting to the CEO, they have to know the business, they have to know the market, they have to know all these things that a CEO would expect. And so the caliber of whom you're hiring to run your program also changes pretty greatly as well.

Absolutely.

Going back to your leadership point.

Yes. And one thing you mentioned is extremely important because I have seen it day in and day out in the industry. Many, many times people try to kind of add on security at the end, what is bolted on instead of security being baked into the, software development lifecycle process. So it is very, very important to think of security from the very beginning when trying to figure out, okay, we've got this great software, this great application. Oh, but we forgot about security, kind of like an afterthought. That's definitely not the way to go.

And I was just having a conversation with someone who actually has blended the roles of CIO and CISO, and he's the CIO/CISO over at Wiley. And we were just having a conversation here on the podcast, and he was talking about the same thing. It's like he has built this community, this organization where security is built in, not built on, out of the product lifecycle. So it's to your point, it's in that SDLC, it's in the CI/CD pipeline, it's there upfront because we thought about it when we thought about the feature we're going to bring to market. You know, it's like it's a first-class citizen.

Absolutely. And I really believe for a lot of organizations, especially small small and medium-sized organizations who are looking to grow, if they put the investment in now, it's really going to allow them to enable sales too. Because the biggest companies in the world, Fortune 500 companies, they really, really do care a lot about security. And if they see that you really thought about it and you take it very seriously, they would want to partner with you.

Yeah, that's a really good point. This idea that security again is a feature of the business. It's a function of the business that gives you a competitive advantage if you do it well.

Yes.

So what are some of your thoughts around changing behavior in organizations when it comes to viewing security, prioritizing security, and really elevating its function in an organization?

Yeah. So if it is not already there, you really have to impact the culture. Fortunately or unfortunately, I guess it is easier said than done. But one thing that is absolutely crucial is you need to have the support of senior management, right? The people who sit at the table and who decide the strategic direction of the organization, those people need to buy into the security program because if they don't, then I feel like everybody's just wasting time, right? I remember I also helped out with the security question of the CISSP exam, which I believe is a gold standard for security certification out there. But back in the days when I took the test back in 2009, man, that's a long, long, long time ago. One of the questions that kept coming up was, you know, the answer would be, yeah, you need to have senior management support. But yeah, it's not just a question on an exam, but that is really, really, really really, really crucial. So I think as a security professional, you really have to see yourself as an evangelist, as a consultant, even though you are a full-time employee. So you are an advisor and you want to make sure that your voice is heard and that you are telling the people who can make the decision, hey, this is important and this is why. Hey, this is a risk and we need to address it. And that goes back to what I was saying about leadership being really, really crucial, not only in all of the areas of life now, but specifically in cyber security, right? Because many, many times you will not have the authority to delegate tasks to people because they don't report directly to you, but you need to be able to influence them, influencing them into doing the right thing for the organization, right? And that is, that is really, really key, being a part of the culture so you can kind of change it from within. As an example, some of the things I have done directly since I came, prior to me we didn't celebrate National Cybersecurity Awareness Month, which is every October. So the very first time I had the opportunity, I just took it and went with it. We had a lot of presentations and we tried to make it a lot of fun and giving away a whole bunch of gifts which I got from our third-party vendors that were very, very glad to support that initiative there. But just making it fun, exciting, and I think at the end we gave away $500 Amazon gift card. So kind of bribing people to come to the presentation so we could choose one of them to win the waffle. But anyway, doing things like that, making it like a game and really getting people engage and talking about it, I think those are some of the ways you can use to kind of change the direction of the culture.

So it's like engagement at the top, making sure you've got all the right people understanding about security, and then gamification and engagement in the middle and bottom of the organization.

Yes, absolutely.

And I love that idea of using your third parties. They have swag coming out their ears, you know, and it's just like if you give someone a pair of like Slack socks or Okta socks or something, you know, Exactly. People will do a lot of things for a pair of ox socks.

Yeah, but the truth is that there are some organizations like the US Navy, you know, I really feel very, very privileged to have been a part of that, where you really don't have a choice. You have to be secure, period, because if you are not, people are going to die, right? So that is not the case in Silicon Valley. In Silicon Valley, you're not secure, well, maybe you're gonna lose a client or two, but then eventually, you know, you're gonna be able to get back and make more, more money. So for those organizations where security is absolutely crucial, they definitely get it, and they usually finance and support security, give you absolutely everything you need to be successful. But again, like I was saying, in the real world, that is not always the case, and I think it is a challenge for security professionals. So I feel like part of our job too is to kind of be a teacher, kind of instruct, educate both the leadership and also our peers and the people at the lower levels where we are and kind of change the culture of the organization so that we embrace security easier, especially when you can show that having a secure infrastructure and application would enable more sales, which Every company is all about sales, so.

You know, and the fact that like aligning sales, excuse me, aligning security to be an enabler of the sales function of that enterprise sales, when you're trying to go after big fish, they really care about the data they're handing you, right?

Absolutely.

They want to know that they did their diligence on the people they brought in. So third-party trust. So I couldn't agree more. Like this is, I think, is a bit of a layup for the security community. It's like, okay, if you wanted to prove value to the organization, go get your SOC 2 Type 2, go get your ISO certification, you know?

Absolutely.

So go get the things your clients are looking for so that you can help drive business.

Yes. And one thing about certification, especially when I was a consultant, I think some people are a little bit confused. They feel like if you are compliant with a specific security standard or whatever, that you are secure. But really compliance and security are two completely different things. You can be perfectly compliant to PCI, just ask Target, but not be quite secure, right? So I think as a security professional, yes, you have to be compliant and it is helpful. And sometimes I've even used compliance in the past in order to achieve security, right? Because the organization will spend whatever they need to do to be compliant so they can sign a deal with Microsoft or whoever the customer is. So I think sometimes you can definitely use it to fund your security program. But I think really keeping the eye on the ball, managing the security risk of the organization, and again, being a trusted advisor and letting the people who make the decision that yes, this is important and this is why, and being able to talk to them in a business term. Earlier we talked about when I was saying technology and business, this is another reason why you don't just want to be a techie and and speak your technology jargon that no business executive can understand. You need to be able to translate that into a business language so they know exactly what you mean and how critical the risk might be. And that's also a way, again, for you to get more funding when they understand where the money is going and what the return on investment would be.

Yes, when they can see what the output's going to be, because it is such a nebulous thing that we're solving for. We're dealing with mitigating risk that might not happen from the adversary that you can't see on a technology that you don't understand.

Yeah.

Like, that's what they're hearing.

Absolutely.

They're like, oh, okay. Oh, you want this certification so we get that deal? Done. And then I think the art and science of being a security leader is using these wins and these opportunities to say, great, let's all arrive here safer than what the standard's calling for so that we can, you know, You can use these opportunities to increase silently in the background the security standard.

Absolutely.

So talking about like paradigm shifts and things that are changing, you know, I've had some pretty interesting conversations. You mentioned this thing once where like there was this paradigm shift in how you were viewing your security program to move away from the legacy and embrace the newer ways of thinking. Thinking about things. And one of the ideas you came up with is like, or that you expressed, was this: the internet is our network. And I just, I love that idea that like we're beyond the LAN and WAN, DMZs, decentralization. It's like, nope, the internet's our network, let's go build for it. So can you unpack that for me? And like, what are some other paradigm shifts that you think as security community we should really be bringing to the front of our mind?

Yeah, uh, I think that was back in 20 2014 when I moved to Silicon Valley, the very first startup I worked for, it was very, very interesting because prior to that I had higher education and government experience, and everywhere I've been we had those huge data centers and servers and stuff, and you know, you have everything on-prem. So at this location, and I go, I'm like, okay, where's the data center? We don't have any data center. It's all in the cloud. The email, it's all in the cloud. Absolutely 100% of everything. In the cloud. I'm like, wow, this is quite amazing. So how in the world do I secure the data we care about in this enterprise knowing that it is not in a specific location right here in our environment? Well, it's kind of changing the way you think about security. Again, those security principles and controls, really, they remain the same, but just the way you apply them would have to change, right? And if you forward then 6 years later, 2020, with this global pandemic again. At Directly, we are a cloud-first company. Thank God for that. Because when this pandemic hit and everybody had to work from home, well, no problem, because everything is in the cloud. They can access the cloud from the location in San Francisco, and they can do it from their home no matter where they live in the world, as long as they have access to the internet. So that was really a huge, huge, huge plus. So I think There are still some organizations, for whatever reason, they are very, very resistant with moving to the cloud. The US Navy was one of those because they were like, it's not secure enough, we don't really trust them, it's not our server, we don't have our guards around and so forth. But yeah, but eventually we kind of kept in because it just makes business sense, right? You're saving a lot of money and it can be as secure, even more secure than anything you have on-prem depending on how you set it up. All of the controls you have in place. So if there's anybody out there who's still, you know, doubting why they should really complete their digital transmission journey, you just have to think about 2020 and the global pandemic. So again, anyone who invested into the IT infrastructure prior to that wasn't affected as much as everybody else.

Yeah, the ability to be like, okay everyone, here's your laptop, just have fun, you know, it's like It is pretty incredible to see that you can pick up these when you are a security leader bringing in these paradigm shifts. I think DevSecOps is another paradigm shift. This idea that you need to engage in the company, move, move, shift left, take security upstream, engage it so it's built into the process. It's another one to engage with.

Um, yeah, yeah. One, one thing about DevSecOps, right? So I've, I've been working in engineering-centric organization since 2014, so the past 7 years or so. When you— that's when I was first exposed to this concept and the agile methodology, right? Prior to that, at the University of Alabama and the US government, it usually takes us, you know, 6 months or a year to produce code. But in Silicon Valley, it's like every 2 weeks, they have 2-week sprints. I'm like, what in the world? So it's like they are really producing code at the speed of thought. Really? So, uh, it really takes a while for kind of security to catch up. So I think when you are in an environment like that, one strategy I have used that seems to be working pretty well is to kind of, you know, take baby steps at first, right? I think it's Martin Luther King who said, no, before you, you can only walk, and if you can't walk, uh, crawl, or something like that. So I think it's very, very important in engineering-centric organizations that are extremely agile to start with taking care of the security as soon as the code has been published. So I'm talking about an emphasis on red teams, penetration testing, bug bounty program, and things like, like that. The code has been published and here we are just hack the egg out of it to see what your vulnerabilities are and try to fix them before the bad guys discover them and exploit them. I think you do need to start somewhere. And then with time, like what you mentioned, is trying to shift security to the left. And you really need to bring it as close to the developer as possible. Like right now at Dworkly, we are starting a program where we are going to actually have the developer scan their code before they are merged into our primary repository, right? And this way, if there are any vulnerabilities, they can be fixed before the code is published. That is really where you would like to be. Again, it is a journey, it is a challenge. You need to use a lot of skills that have nothing to do with technology, people skills, being nice to people, using soft skills and making them understand and really influencing them in order to do the right thing for the organization. Because that is going to change the life of the developer a little bit, but if you think about the return on investment, it is going to be huge. Because another thing about that is, I'm sure all of your listeners are aware of the blue screen of death, Microsoft, right? We came to find out it was one specific developer that kept making the same mistake over and over and over and over again, and that's why we kept seeing the blue screen of death from Windows 95 when I started using it to XP and beyond. But anyway, but if you can find mistakes—

What?

Yeah, what? Yeah, that is, that is, uh, exactly what I, what I, what I, what I was told. So, uh, as, as you know, you Humans, we are creatures of habit, right? Once we do something one way, we tend to keep doing it the same exact way. So basically it was the same coding mistake that was being made over and over and over and over and over again. So by having a program where you actually check the code of a developer and you teach them what the issues are and how to fix them, then that really changes their career where in the future they will never be making this mistake anymore. They would have learned. From it going forward. Just something to think about.

That makes complete sense. And I also think like, talking— go back to return on investment there. If you find a security vulnerability, it is still in the hands of the developer. They just got done writing the code.

Yes.

They can go fix it. Like, it's there. No one knows the code better than the engineer who wrote it.

Absolutely.

And so this is the time to empower them with the tools to help them elevate their code.

Yes.

By the way, just to— I took a quick look. Martin Luther King's quote: "If you can't fly, then run. If you can't run, then walk. If you can't walk, then crawl. But whatever you do, you have to keep moving." That is leadership right there.

Yes. Yeah.

It's such a powerful statement. I mean, just— and talk about like, we often look for perfect in security program, but it really is, as you were mentioning, progress over perfection.

Perfection is a mirage really, it doesn't exist anywhere. You only need to have small improvement and then do it over time. Like even if you just improve 1% every single day, in 100 days it's going to be 100% better than when you first started. And one thing about that too is many times when you make small changes, usually you don't see the effect right away, right? Just think about this, everybody knows you shouldn't be eating bad food and healthy food and so forth and eat healthy and exercise. Just imagine if someone ate, you know, one of those very unhealthy burgers of Pixar or whatever your favorite bad food is and they gain 50 pounds on the spot, like on the spot, nobody will be overweight in this country. But the thing is it takes time, they eat like that day after day, weeks after weeks, month after month, and before you know it they're 40 and they have huge, huge bellies and unhealthy heart issues and stuff. But it started with just one, one, one mail, right? So before we can see— because we cannot see the effect of what we're doing, uh, right away, sometimes it kind of gives people a false sense of, uh, sick of security. But really what I'm trying to say is, um, once you start your journey in a really continuous improvement in whatever security program you are a part of, don't be discouraged if you don't see the return on investment just yet. It is going to take time, but the accumulative effect of what you are doing will definitely show itself in time.

Right. And whatever you do, just keep moving.

That's right.

That's right. So let's talk about— I want to zoom out a little bit and look to the future. We have AI on our doorstep. We have machine learning. It's really becoming a toolkit for a lot of decision-making that's going on. But AI is really influencing and shaping the future of the security community. And I was curious your thoughts on this. As it's disrupting jobs in the security community and it's either bringing in new threats, it's bringing in new solutions, it's bringing in new toolsets.

Yes.

What should we as a security community, what should practitioners be looking to do to retool to get the most out of AI?

Well, I think probably one of the most important things, at least for me, is, you know, you have to be flexible and you have to have a teachable spirit, right? There is no way anybody today can know everything there is to know about anything. That's just not possible. When I was a PhD student, my mentor used to say— he had his PhD back in the '70s, he knew absolutely everything there was to know about microbiology, period. But by the time I was going through this program in the year 2000, it's like, there's just no way you're gonna be able to know everything, because knowledge is really expanding exponentially, right? So it's just impossible to ever catch up. But I think it's very important to have the humility to know that you don't know everything. I believe that was Socrates who said All I know is that I don't know anything. It's like the more you know, the more you know what you know and what you do not know, right? I think it was Secretary Rumsfeld who was talking about the unknown unknown and all of that. But the reality is we are really living in a very exciting time where we just have to be nimble. We have to be flexible and we have to be willing to learn. I must say, prior to coming to Silicon Valley 10, 15 years ago, I really felt like, you know, I kind of knew everything there was to know about securing, I don't know, infrastructure and system on-prem. But of course, with the advent of the cloud, the internet, and all of that, that's pretty much out of the window. So I have to become a student again, over and over and over again. So I feel like that's a very, very important characteristic for anybody in the security field to have, just to know that you're not going to know everything and you have to be willing to learn. All right, so that is very, very important. Do the research and find out. Now, one thing about technology, automation, machine learning, and AI and all of that, it is true, a lot of jobs are going to be displaced. I can't even predict now, if I could see in my crystal ball, probably entry-level position like security analyst and that kind of thing, you probably are not going to need human beings to do that anymore in the near future because a bot can do the analysis much, much faster and better than any human being can. And they don't need sick time, vacation time, or benefits. So that is probably going to happen in the next 5 years or so. But having said that, like I was saying earlier, leadership is one of, I believe, the most critical skills in this area right now because we will always need human beings who have leadership skills in order to lead the implementation of whatever technology we come up with and also lead people, right? So part of the reason why I work at Directly today— about 2 years ago I joined the leadership team there because part of the reason was I wanted to learn more about artificial intelligence. We are into what we call CXA, right, customer support automation. We use machine learning and artificial intelligence to completely automate customer support. So we do have a few, there are a few other companies out there in our niche market who kind of do what we do, but one thing I think that separates us from the competition is the fact that we don't just do artificial intelligence, but to that we also add expert engagement. So we have human beings who are experts in whatever the field might be, the software or the technologies that then help make our artificial intelligence even smarter, right? And I think that collaboration, that contribution between machine and human, I think has worked very, very well for us. So I guess I've said all of that to say, yes, eventually, I guess, robots are going to take over the world, but there will always be a need for the right people who have the right skill set.

And it goes back to, I think, what you said earlier, just a moment ago, which is having that teachable spirit.

Yes.

I think this is— obviously, you're right. There's been significant displacement when there are more mature AIs doing these particular discrete tasks. But for every— I think the statistics I keep hearing is that for every time, like when the internet came out, for every job that it displaced, it created 2.3 more jobs. And we're going to see the same thing with the next exponential that comes in place. Every time we disrupt a job, there'll be 3 or 5 more that comes up because we'll have new caliber of problems to go solve for. Like we have to go figure out how to defend against deepfakes, for God's sakes.

You know what I mean?

So it's like we've got a whole world ahead of us. So I think that's really incredible, though, that you chose a company to partner with to come in as a security leader because you wanted to learn more about the artificial intelligence side and be a part of that journey as they are transforming the way that customers interact with this customer service, which is now an artificial intelligence-powered customer service.

Yes, yes, absolutely. And I really like what you said there. Personally, I believe formal education is still important, right? That's the reason why I spent so much money to get two graduate degrees in the first place. But it is not everything, right? You are not done educating yourself once you get a bachelor's or a master's. To me, that's really just the beginning. So now you know how to do basic research, you know how to ask questions. And something my mentor used to tell me many times Just asking the right question pretty much gives you 50% of the answer of the solution right there. So learning how to write, how to communicate, all of that is very, very important. But really, you don't know anything because in my estimation, if you are like in a cybersecurity program now, by the time you graduate in 3 or 4 years, you know, you get your bachelor or your master's, everything you've learned is pretty much obsolete by the time you get that paper degree. So I think it's important to have that foundation and kind of build from there. But don't think that, oh, because I have this little degree from Harvard or whatever school you went to, I know everything there is to know, because you do not.

Couldn't agree more. It's just, it's constant. If there's constant change, there's going to be constant learning for us to keep up and adapt. Well, Bob, as someone who has been publicly quoted as saying, My superpower is my unshakable determination to succeed. I want to just say it is evident through your certifications, through your insights, through your publications that you are on this track to truly transform and influence the future of the cybersecurity community. So for that, I just want to thank you and also just thank you for coming on the show today and really taking a moment to explore and unpack these, these categories of conversation with us here today.

Today. Thank you so much, Conor. Really was a great privilege to be here. Thanks.

And everyone who's listening today, I would say connect with Bob, continue the conversation on LinkedIn. We'll have the links below in the show notes on YouTube. And if you've enjoyed today's conversation, please hit the subscribe button, give us a comment, and reach out to Bob over on LinkedIn so we can continue talking. Okay, until next time, thank you.

Thanks.