PORTRAIT: S624:E3🎙️ Industry Guest Speaker Keyaan J. Williams

¡Hola!

Hi, I'm John Maxwell. When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation, I'm proud to say, is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend Bob Fabien Zinga.

Welcome to the Leadership and Success Podcast with your host, Coach BZ, where we help you lead with purpose and succeed with impact. If you're ready to grow into the kind of leader others want to follow, this podcast is for you. If you're determined to elevate your success and leave a lasting legacy, this podcast is for you. As my mentor, Dr. John C. Maxwell, reminds us, everything rises and falls on leadership. Our goal is simple, to inspire you, challenge you, and equip you with insights that can transform the trajectory of your leadership journey. Welcome aboard to another episode of the Leadership Success Podcast with Coach BZ.

All right everyone, welcome to a very special edition of the Leadership Success Podcast. And, uh, today is going to be our industry, uh, guest, uh, speaker series. We're gonna be speaking with my mentor, Kean J. Williams, all the way from Atlanta, Georgia. All right, for today, I am really grateful and privileged and honored to be speaking to Kean. I think everybody who knows him feels the same way. Today, we are going to challenge one of the biggest assumptions in cybersecurity, that more controls equal more security. That is not always true. In reality, most organizations don't fail because they lack tools, frameworks, or controls. They fail because when it matters most, when decisions become consequential, governance breaks down. So that's why I'm excited to introduce our next industry guest speaker, Kian J. Williams. Kian is the managing director of Class LLC, a global management consulting firm focused on risk governance executive education, and board-level decision-making. He is also a distinguished fellow at the Enterprise Risk Quantification Institute and a trusted advisor to boards and senior executives navigating complex risk environments. I remember when I took the class and passed the EC-CISO exam, the Certified Chief Information Security Officer, Kian was actually one of the few people who actually wrote the book on the subject matter, right, for new CISOs. So he is a CISO of CISOs. So I'm so glad that he is here. And what really makes Kian's work different is this, right? It doesn't just talk about cybersecurity. It translates risk into decision-ready insight for leaders at the highest level of the enterprise, from the boardroom to C-level executive and all the way down. He operates where many of you will one day operate, at the intersection of risk leadership, and enterprise value. Today he's going to walk us through a powerful framework, Rules of Risk Governance. This isn't about a dashboard, this is not about compliance checklist, this is about answering fundamental question: why does the enterprise exist? How is value created and protected? And who owns the consequences when uncertainty becomes loss? And you will hear his framework define 7 non-negotiable rules including governance begins with purpose, not control, authority must match accountability, risk acceptance is a leadership decision, not a technical one, and governance must hold under stress. One of the most important takeaways from this, his work, I believe, is cybersecurity professionals don't just protect systems, but they must also enable leadership to make informed decisions about risk and value. And I believe that requires a shift from being a technical operator to becoming a translator, an advisor, and a leader. And you listen today, I want you to think about this. If you were sitting in the boardroom, could you explain risk in a way that shapes business decision? Because that is really the difference between a security engineer and the security leader. Please join me in welcoming Keyann J. Williams as he challenges us to think beyond controls and into governance, accountability, and leadership. So without any further ado, please help me welcome Keyon J. Williams. All right, Keyon, how are you doing today?

I'm doing well. I feel like I'm about to step into the ring and do a championship boxing. Thank you for such a kind and wonderful introduction.

Absolutely. So the floor is all yours, my friend.

Sure. For those who have heard me speak before, One of the things that I like to avoid is using slides.

Mm-hmm.

Because I don't have any slides, what I invite you to do is organize your notes into 4 sections. Section number 1 focuses on the answer to the question, what is governance and why does it matter? Section number 2, if you're taking notes, what is risk governance and how is it defined? Section number 3 will then lead into the 7 rules of risk governance and how they apply in a real context. And then Section 4, BZ sent me a couple of student questions in advance, and I'll give a high-level overview, and then the floor will be open for any additional questions, comments, or concerns. I'll give you some background to this conversation before I jump into the 4 areas that I prepared in advance. Most of what I'm sharing with the audience today is a combination of 30 years of interesting experience. I had the privilege of serving in the United States Army Chemical Corps, so I was a nuclear biological and chemical weapons specialist. I worked at the Centers for Disease Control and Prevention for 12 years as a contractor, as a federal employee. I had the privilege of being in charge of significant financial investments in public health systems. I've helped organizations become third-party accreditation organizations. For FedRAMP, and I've been doing consulting for boards and for organizations for over a decade. So that experience over the past 30 years is what informs the things that we'll share today. BZ mentioned that we met in part through the EC Council Certified CISO program. A lot has changed from the time that I contributed to the original book to the perspectives that I have now. Some of the things that I'll share in the conversation are based on curriculum that I've developed. I've had the privilege of teaching graduate students at a collection of universities. I also had the privilege of doing corporate training for board directors and corporate executives. So I've done everything that I can to pour my heart out into this conversation today to make sure that people learn as much as possible from the time that we have available. If we start with governance and why it matters, I think this is a very important question. Because a lot of people who use the word governance are defining management activities. There is a book called Corporate Governance Matters that says governance and management are two sides of the same coin. But it's important to make sure that if we're talking about governance, we're talking about how the senior people within the organization, the board and the corporate officers defined by the SEC Act, who have accountability and authority to direct and manage the business. Are making decisions about the direction of the business, the strategy of the business, the culture, the outcomes, everything that's going to be produced, and ensuring that the business delivers to its stakeholders whatever they promised. I say stakeholders specifically instead of shareholders because stakeholders is a much broader perspective that has an impact on governance. Stakeholders are going to include the government, regulators of various types, It's going to include the community where the organization exists, because the way that you deal with the community is an outcome of corporate culture and corporate governance. It's also going to be employees, contractors, vendors, customers, and shareholders if it's a publicly traded company. What that demonstrates is that governance is a very big job, and doing governance correctly is very important. Now, mind you, governance is not management. What happens in many situations is that the people that are leading governance are independent directors on a board of directors. As independent directors, those people are fiduciaries, which has a legal connotation representing that those individuals are acting in the best interest of the stakeholders of the company. Board directors and people that are governance leaders are not employees of the company. But they're acting in the interest of the people who depend on the company. This then causes governance to be the exercise of authority over the purpose, the boundaries, and the consequences that result from the business activity that's in question. I say business activity, but this could apply to a nonprofit organization. It could apply to a military organization. BZ and I were both in the military. It could apply to a commercial organization. But governance is governance. Governance is about direction and accountability and evaluating performance. And management is management, which focuses more on execution. So management is going to execute. Governance is going to decide. Management is going to optimize outcomes within constraints. Governance is going to define which constraints are acceptable, which constraints are non-negotiable. And the boundaries within the organization is going to operate. This distinction matters because organizations fail less often from a lack of effort and more from a lack of decision clarity. When authority is unclear, accountability becomes symbolic. When boundaries are implicit, risk is accepted by default. And in a cybersecurity context, you really don't want the business accepting risk by default because they don't understand it. They don't know the limits and they don't know the impact of risk events occurring. The whole purpose of governance in this context is to solve one core problem. That problem is who gets to make decisions about what the organization is going to do, where it is going to go, and how it's going to get there. And then things that influence those outcomes focus on, on what basis is governance making those decisions and who bears the consequences when uncertainty produces bad outcomes. If you remove governance from an organization, decisions are still going to get made. They just get made implicitly. And then under pressure, you have decisions that are made without accountability. That's not really agility. That's not really governance. It's just bad business. From that perspective, we can now talk about risk governance, and risk governance is much more aligned with what cybersecurity people would consider a core fundamental practice. Risk governance, by my definition, is derived from ISO 37000, but 37000 is focused on enterprise risk management. I like to take that definition, focus on enterprise risk broadly, not limited to cybersecurity, but everything that I say in the definition of risk governance includes but is not limited to cybersecurity, data privacy, intellectual property, digital transformation, and everything else that the audience would be interested in. Academically, risk governance is the leadership discipline that determines which uncertainties an organization is willing to accept in pursuit of its objectives and which uncertainties it won't. You hear in that definition that a component of risk is some measure of uncertainty. If we had more time and for a different session, at some point in the future, we can talk about the philosophy and the science of risk, but risk always has context. Risk always has some uncertainty, and then risk exists between two extremes. I like to think of the extremes as the distance between asceticism and hedonism. On the asceticism side, sometimes people respond to risk in a way that they are doing everything that they possibly can to avoid anything positive or pleasurable or good. And on the hedonism side, you have people that go as far as possible to feel as good as they can feel. And both of those extremes for risk can lead to negative consequences. In the context of risk governance, this is not about calculating risk, but it's— and it's not about managing controls and it's not about dashboards or frameworks. It's about authorizing the exposure that the organization is willing to accept inside of those boundaries of asceticism and hedonism. It requires judgment. It requires authority. It requires a moral willingness to own the outcome rather than blaming people. When one group of people makes a decision, the decision doesn't produce the desired outcome, and then they say, oh well, security owns risk, so we're going to blame the CISO for a bad decision that the business made. That's not really governance. That's poor business management. A critical point in this conversation about risk governance is that all organizations have risk governance, whether they admit it or not. If leadership does not define boundaries explicitly, the organization is still going to take risks. Sometimes they're going to avoid risk, but that leads to stagnation and could cause the business to cease to exist because they're not adapting and overcoming in a competitive marketplace. In other situations, the organization takes on too much risk And the outcome of that risk-taking is that you can't sustain or withstand all of the negative consequences that are associated with the decision, and then you go out of business. In either one of those situations, we're going out of business. So it becomes extremely important that the right people in the right position with the right authority are making decisions about the amount of risk that we're going to pursue or the amount of risk that we're going to avoid. And it becomes a business decision because some of the answers to those questions relate to within the context of the business. So if my business is to provide governance— government services, well, there's only so much risk that I can accept in pursuit of filling potholes if it's a municipality or directing the war effort if it's national defense or any other context. It becomes less detrimental to society if it's just a single business but society is still affected by the risk decisions of the leadership within the organization. A good example of this is— I forget the date, I should have looked it up before the conversation— but once upon a time, Blue Bell Creameries, the ice cream company, caused people to die from eating ice cream, and the courts found that the board of directors failed in their oversight responsibility. So there was no risk governance where they said that Listeria is unacceptable. We're going to do everything that we can with the resources that we have available to make sure that the ice cream manufacturing process is safe and is sanitary and is not going to contaminate people. And because of the failure in their oversight responsibilities, contaminated ice cream was released into the marketplace, and then people who were eating what is normally a delicious ice cream were casualties because of the Listeria. That existed because food safety wasn't a priority. One of the things that the courts found was that the board's failure to provide risk oversight, a example of risk governance, caused the board to be personally and criminally liable for their failures. And what I anticipate is that at some time in the future, because we keep having cybersecurity incidents day after day, week after week, month after month, year after year, Eventually the courts are going to say, given your fiduciary duty for the duty of care that says that you are going to be competent and knowledgeable to do what other people would in the same circumstances with the same resources, eventually it's going to be untenable that the board of directors is not an active and engaged participant in oversight for cybersecurity risk or technology risk or digital innovation or anything else. Often, if you don't do risk governance well, then at the worst possible moment, your governance failures are going to be present and you're going to have to account for them. Fundamentally, risk governance exists to prevent three predictable failures: accountability without authority, acceptance without decision, and boundaries that collapse under pressure. When those failures occur, the organization does not just become reckless, it can become legally, operationally, and ethically indefensible. If you're taking notes and if you're in the United States, a very good example of some of the outcomes of poor risk governance is found in the Department of Justice manual. So in the Justice Manual, they have a standard for the prosecution of corporations. And in that standard, the prosecutor from the Department of Justice, when somebody has been harmed and the Department of Justice is paying attention and is considering prosecution, they're going to ask, was there a program? Did the program work in practice? And did the program have appropriate resources to achieve the required outcomes? And that program from the Department of Justice— the program from the Department of Justice perspective wasn't designed exclusively for cybersecurity, but it does apply to cybersecurity. So you have numerous organizations in the marketplace that might be $3 billion, $4 billion, $5 billion companies, but their security team is 2 people and everything else is outsourced. That's not really a demonstration of a program that's well documented, well resourced, and is effective produ— to produce the required outcomes. It starts to demand that the board of directors and the corporate officers need to be held accountable for underinvestment, just like they reap the benefits and the rewards for good business outcomes that happen within the organization. Now, BZ mentioned my 7 rules of risk governance. The purpose of those rules is really to address risk governance as a practice within the business and make sure that there is a target of opportunity that everybody can focus on. So if, if a company decides to adopt all 7 of the rules, then the opportunity that you have is to say that this is the governance framework to ensure that the company is operating within acceptable risk boundaries. The assumption in my case, because I'm always thinking positively, is that acceptable risk boundaries are going to be defined by the board of directors in partnership with the chief executive officer. The chief executive officer is going to hold the C-suite accountable for execution, and then people at the system and data processing level are going to provide feedback. So if you're familiar with ISO 27005 and the way that they do risk management, you end up with feedback loops where strategy goes down from the top into the organization and tactical results, performance measurement, and other information that informs changes in strategy or changes in direction permeate from the bottom up so that you have bidirectional communication about what's happening. Who is accountable? What outcomes need to be produced? And how well are we performing according to the standard? What the Seven Rules of Risk Governance do is they provide a framework to make sure that you're answering those questions. Rule number one simply states that governance begins with purpose, not control. If the leaders of the organization cannot articulate the value that they are protecting or creating, no amount of controls are going to save them. I talk to many security leaders, and I'll ask them, do you know by the minute, by the hour, by the day, by the week, by the month, how does your organization generate value, and what systems, business processes, and data contribute to that value creation? For those who can answer the question, they're often in a very mature organization, is well documented, that operates very well. For those who can't answer those questions, what tends to happen is that instead of starting with the purpose of the company, they're starting with a control catalog or a control framework, and they're putting controls in place to demonstrate that they're doing something. But that's not only not an example of good governance, but that's not an example of good management because there's nothing that ties the controls to the purpose of the organization. So if we're going to do governance well, we have to start with Why does this company exist? What are we doing? Where are we going? Who do we serve? How do we serve those people? And what does success look like? And if we can answer those questions, then we can start to think, what are our mission essential functions? What are the material risks facing the organization? And then you start to apply limited resources to implement the best controls available to protect the most important aspects of the organization. In Rule Number 2, I focus on value creation as a governance obligation. Again, remember that governance happens at the top of the organization. So the board of directors is going to— is going to contribute to the creation of value within the organization. The board of directors is going to select the chief executive officer. The board of directors is going to influence the performance of the chief executive officer based on accountability and performance measurements and incentive-based compensation. But the board of directors is also going to do strategy, objective setting, create corporate culture, establish rules, and establish boundaries of operating within the organization, and then hold the CEO accountable for executing those outcomes. From this perspective, it's impossible to say that value generation doesn't require governance, or the value creation can happen without governance taking place because leaders are obligated to enable that creation within acceptable exposure. If, if you avoid that part of the process, you can generate value, but you can also destroy the legitimacy of the company or the growth of the company because there's no oversight, there's no direction, and people are doing things in an ad hoc and independent way that doesn't have any oversight that leads to a measurable or expected outcome. In Rule 3, I focus on the idea that authority and accountability must be matched. When the rules were created, I wasn't thinking about cybersecurity people, but in a cybersecurity context, this becomes even more important than the context that it was designed for because there are a lot of chief information security officers or other technology executives that feel immense pressure from the organization to make decisions on behalf of the organization, but they don't have the authority or the accountability to make those decisions. It produces negative consequences from both sides of the house. On the governance side of the house, if the board is apathetic and disengaged in oversight of enterprise risks that include cybersecurity, what tends to happen is that an issue that's brought to the board causes the board to say, "That's not my problem. Talk to the CISO." From the CISO's perspective, if the CISO is making decisions that belong to the board and the corporate officers and the CEO, when that decision is not effective or there's a problem, then the chief information security officer is going to be held accountable for something that the CISO didn't have the authority to decide on behalf of the business. And then the CISO becomes blamed for outcomes that the CISO couldn't control. This is broken governance by design. Escalation is a good thing. The idea is that the CISO sits outside of the three-tier organizational structure as defined by the National Institute of Standards and Technology in Special Publication 800-39. At the top of the organization, all the decisions are made. That's called Tier 1. At Tier 2, you have what NIST calls the mission and business process. In commercial terms, that's just the C-suite. Where you have dedicated executives that are leading line— that are leading lines of business. So you have a chief financial officer. That person is responsible for public accounting disclosures and all your accounting information systems. The chief marketing officer is brand establishment and all the marketing technology. Chief information officer is all of the information technology within the organization. Those people at tier 2 are supposed to execute the strategy that was defined at the board level, not decide for the entire company where we're going and how we're going to get there. If we do it out of order, then authority is incorrectly engaged, and it leads to significant material risk for the organization. In Rule Number 4, I state that risk acceptance is a governance act. The idea here is not that we're going to have a risk acceptance letter that people sign, they're not held accountable for their signature that's on the paper, and it just becomes an artifact that does not lead to a positive outcome. Risk is not accepted because it's tolerated. Risk should only be accepted by explicit authorization by somebody who has the authority to bear the consequences of the decision and within boundaries that are clearly acknowledged, which again reinforces why it's important for the board and the corporate officers in partnership with the chief executive officer to say these are the acceptable boundaries, and then any risk acceptance is formal documented authorization to operate in, in excess of the boundaries that were established. Now, I've said a lot about boundaries, and Rule 5 speaks to that. Rule 5 just states that risk boundaries define the enterprise. Boundaries are expressions of identity and values. They say what the organization will not trade away, even under pressure. Dashboards describe performance, but dashboards are not risk boundaries. Boundaries are what constrain decisions. So if we say it is untenable for people to be killed by the use of our technology, thinking about industrial and automation control systems, every control system environment that I've ever been in there is a safety briefing every time you have a meeting because protecting human life is the most important thing within the organization, whether it's oil and gas and electrical utility, a telecommunications provider, an electric distribution provider. They have very clear boundaries about the amount of safety that they're willing to give up in pursuit of their business outcomes. And this is a good example that other people can subscribe to. The questions then become, What are the boundaries and what are the categories? Generally, risk falls into specific areas for revenue, operational resilience, regulatory harm, the reputation of the company, and safety. I only focused on the safety example in the interest of time, but there should be formal documented boundaries for every key risk area within the organization so that we can say this is the enterprise and this is how far we're willing to go in each of these areas. To produce outcomes that are beneficial for our stakeholders. Rule number 6 states that governance has to hold under stress, which is interesting given my military background. I did nothing special in the military. I was not deployed. I did a lot of training. I taught a lot of people how to do interesting things. But one of the great things about military training is a concept that they used to say, train like you fight and fight like you train. And we went through the same process repeatedly over and over and over again. How do you respond to an ambush? How do you respond to the chemical alarm? Which, which was in line with the work that I did. How quickly do you put on your mask? How quickly you put on your chemical suit? All of those things were ingrained to the point that became muscle memory. And we did it in peacetime because training happens in peacetime. But for everybody who was ever deployed, who was a student of mine learning how to maintain their equipment. They were able to come back safely because the training prepared them to execute properly under pressure. Governance is easy when it's calm. Stress creates all kinds of behaviors within people. Again, if we stick with military context, because I spent a little bit of time in the military, one of the other things that they said that I think applies to this conversation is that in times of stress, people default to their lowest level of, of conditioned response. So if I've never had to make an important governance decision under pressure where all outcomes are bad and there is a best choice from the options available, but I've never felt any pressure, then I'm going to have physiological and psychological things that happen to me that prevent me from making a decision because I've never been under those pressures. It becomes extremely important tabletop exercises and functional exercises and other things that bring governance decision-making into the conversation, at least consider what are the stressors and what are the pressures that are going to shape decision-making, because it's not going to be easy when difficult decisions need to be made. Uh, the final rule, rule number 7, just says that stewardship is required at every level. You don't need board authority to practice stewardship. Everybody in the company can be a steward. Steward just means that you're taking care of something that belongs to somebody else, or you're taking care of something for the benefit of somebody else. You don't need the discipline to refuse silent acceptance— or you do need the discipline to refuse silent acceptance. You want to force escalation. If I see that something's wrong, I need to communicate up the right channels. And we also want to make sure in the scheme of things from a governance perspective, that decision integrity is preserved. So if the board is under pressure, has to make a difficult decision in the midst of that pressure, people may or may not be harmed, stewardship is also going to ensure that we maintain integrity about what was the context, what was the information, what was the outcome of the decision that we made, and why do we make that decision. So that it stands up to scrutiny if things go wrong or if there's an investigation later. All 7 of these rules work together to ensure that if and when harm occurs, leadership can stay truthful. They can say, we knew what was going on, these were the factors that influenced our decision, this is what we decided, and we can stand up and own the consequence of those decisions. BZ, I'll pause for now. That was what I prepared for the time. That we had available. How do you want to address the questions that your students put together?

Yes, uh, thanks so much. This was really, really fantastic, not just for the student, but I think for veteran CISOs too. We can definitely learn a lot from that. I know you didn't plan to do this, but for all of the CISOs that you still train, I know from time to time I am in your cohort, how can they reach out to Class LLC and be part of your training?

Yeah, the easiest thing is to connect with me on LinkedIn. Um, if you choose to send an email, if you send an email to info, info@class-loc.com, one of my team members will pick up the email and make sure it's routed to the right place. But I like to have conversations with people. I think the difference between me and ClassLOC and other training providers is that I'm not in business to treat— to train the maximum number of people I'm in business to make sure that the people that decide they're going to invest in our programs are successful with the programs. So we're more of a high-quality, low-volume kind of operation than a low-quality, high-volume operation. So I'm more than happy to talk to anybody who wants to have a conversation.

That's wonderful. Okay, we have our first question from the audience. Daniel says, Kian, boards groom the bridge and leaving the CISO in an impossible job. Apathetic spectators into true Level 6 safeguards who own risk acceptance as a core act of governance. So the question is, I guess, how do you turn CISOs into true governance leaders?

Well, one of the things that becomes important, and this goes back to what I said earlier in the conversation, Governance belongs to the board and the corporate officers. And so the CISO is going to generate output that is consumed by the board and the corporate officers, but the chief information security officer is rarely going to be in a governance position unless that person is on the board of directors of another company, not within their own company. Now, it, it doesn't mean that the position is inferior. All I'm highlighting is that the act, the act of governance is different than the act of management. The chief information security officer, along with other people in the C-suite, are necessary managers in the company to execute strategy and produce outcomes. But by academic definition, if you went to the state insurance commissioner for any of the 50 states in the United States, or you looked at the, at Section 16 and the Securities and Exchange Commission Act, the role of the CISO does not meet the definition of corporate officer, and it doesn't meet the definition and the roles and responsibilities as a governance function. So it becomes very important that we distinguish using formal definitions and regulations. And what is the insurance commissioner going to say, or what are the regulators going to say, that the position is valuable But the CISO is not a governance position, but neither is the CIO, and neither is the chief marketing officer, and neither is the chief human resources officer. There are a lot of valuable positions, but governance belongs to the board and the specific limited set of corporate officers that are designated by the SEC Act.

Well, that is very, very important, especially in the age of AI. Most CISOs I know are not covered by the director's insurance, although they think they might be. And I believe one way you can know for sure is to call your insurance company and ask them to send you a certificate with your name on it. If they can do that, you are covered. If not, you are not a director or corporate officer of your company, which for most CISOs, that is not the case.

Well, that's a bit of a misnomer. So once upon a time, I almost started an insurance company. My wife was teasing me about this earlier because because I would— it requires an astronomical amount of money to start an insurance company from scratch. But one of the things that you'll find if you look at state and national regulations for directors and officers insurance, every employee of the company is covered as long as the employee does not perform an illegal act.

Hmm.

And so I don't need— I don't need to, and it's not legitimate for me as a CISO to get an individual D&O policy that my company didn't underwrite or provide, because there's no such thing as an individual directors and officers policy. Now, if, if you want to give your money to the insurance company, insurance companies will sell you liability policies. But based on the academic definition of directors and officers insurance and the way that it applies in the marketplace, the company is accountable for all of the employees within the organization and their behavior on behalf of the business. And as long as the person is acting as a representative of the business, the directors and officers insurance should cover them without a specific named individual needing their own exclusive policy. Now, what ends up happening is that directors are exposed to unique set of risk, which is why it's directors insurance. And corporate officers are exposed to a unique set of risks, which is how it's called directors and officers insurance. But D&O covers all employees.

Good. Very, very good. So one question I should add is, how can cybersecurity professionals effectively translate technical risk into language that enables board-level decision-making, especially for those executives that are not very technical?

Yeah, so I have a couple thoughts about that. One, if we're still talking about governance, the board doesn't govern details. The board governs exposure, trade-offs, and consequences. So a cybersecurity person, if you're— if you assume that your output, the output of your work— I'm working in a security operations center, I'm doing risk management, I'm doing incident response— The output of my security work is going to be input that helps the board consider what exposure do we have, what tradeoffs are we going to need to deal with, what consequences does the organization have to respond to. And they're going to use cybersecurity information to drive the decision-making process. What I would then say to cybersecurity people, whether you're a CISO or you're an entry-level analyst, is that you want to pay very close attention to the alignment between the output that you produce and the value that it's going to have to equip the board to make smart decisions. And so now it's not even about translating security information into the language of the business. Now what ends up happening is we're saying anything that security communicates to the board and to the corporate officers is going to be valuable to help them make decisions within the fiduciary responsibility and the oversight duties that they have. You know, is there initiative that demonstrates that we're failing? And if we're failing in an area, what decision does the board need to make? And what information needs to be provided so that they can choose between multiple options? Anybody at any level of security can do that. That's not exclusive to the CISO. But what would be awesome, you know, if I were ever a CISO again, one of the primary things that I would do is equipped all of my analysts, all of my managers, and all of my directors to give me great information so that the information doesn't have to be sanitized by me. I just look at it. I verify that the context is appropriate. I pass it down the chain because everybody is equipped to provide information that's valuable.

Wow, that is great. Okay. Another question I have is authority versus accountability gap. In many organizations, security leaders are held accountable for risk, but they do lack the authority to enforce decisions. What practical steps can we take to realign authority with accountability?

Well, so I will argue that one way that you cannot fix this is through training. So you can send board people to all the training in the world, but knowing something and doing something are two different things. And so part of the way that you address authority versus accountability is by governance design in the first place. There's got to be, you know, the board chair, the corporate secretary, somebody has to decide that we're going to do the right thing because it's the right thing to do, not because it's a regulatory requirement, not because we're having oversight from a third party, but this is going to be the sequence of steps that we take or the collection of actions that we subscribe to that define well-designed governance within the organization. For security people, so I admit that it's challenging. So let's agree that the marketplace is stupid. Companies are firing security people for bad reasons. And what individual security people are going to have to decide is, one, do I do what the company tells me because I have bills to pay and I have a family to take care of? Or two, do I not accept accountability for things that I don't have the authority to carry? Because it's the wrong thing, and it's not serving the stakeholders of the company? Well, I'm privileged to have the, the opportunity to always choose number two. No, I have a biblical worldview. I trust God's will for my life. Not everybody believes the same things that I believe. But I do recognize that if I have wife and children at home, and babies to feed and mortgages to pay, that it becomes very challenging to make the right ethical and appropriate decision.

Yes.

But if security people continue to accept accountability for things that they're not accountable for, it's never going to force the board and the corporate officers in the C-suite to accept accountability that belongs to them. And so the only way to fix that gap is to change how governance works. Within organizations. If you do it well, let's say that we're describing an ideal situation. I know the ideal doesn't exist anywhere, but there should be a method of structured escalation. I'm a security operations center analyst at my level. I see a problem. What is the escalation path so it gets all the way to the board so that they can make a decision? If I were king for a day, the only thing that would ever go to the board is something that meets the definition of material. Because if it's not material, management can address every risk or every problem that's not material. But the board needs to know about material risk in a timely manner, and early enough for them to make a decision. And then for that decision to be executed, so that the company can take action. What tends to happen is that if the organization says security owns risk, what they really mean is that security is going to absorb the blame when something goes Yes. If the organization says security is a component of enterprise risk, and the board and the corporate officers and the CEO and the C-suite are responsible and accountable for enterprise risk, and we trust security to provide timely actionable information, that's a good example of stewardship. That's a good example of everything that I've talked about. And it's something that I've seen in multiple organizations.

Yes.

So we can joke about all the horrible organizations that are in the marketplace. But there are some companies that operate that way, according to the textbook, and they have very good outcomes. There, we won't say that there is no risk. But risk is managed and has oversight by the right people, which then causes the right resources to be applied, which then allows the organization to operate within the boundary, instead of living outside the boundary with no control.

Whatsoever. Fantastic. Okay, the last question will come from my graduate teaching assistant Pedro. Pedro says, Kian, would you please provide any suggestion for governance dealing with AI attacks?

I would argue that my previous question answered this question. So one thing that you want to be very careful about, and, and for the graduate students, I encourage you to think deeply about this. Remember that I said at the beginning of the presentation most people are describing management when they use the word governance. And so one of the things that we want to measure is, if somebody is saying AI governance, are they saying that the board of directors is going to set the acceptable boundary of taking risks with the use of AI? Or are we talking about AI management, where the C-suite and directors and managers within the company are doing things like responsible AI or identifying AI systems, those are not governance activities, those are management activities. Yeah. And so I think the industry is not serving itself well by calling everything governance when most of those governance things are management. If we come to that conclusion and we have consensus, then I think the answer to your graduate student's question is how can we make sure that we make effective risk decisions related to the use of AI within the company.

Yes.

And now the answer is, under what circumstances is AI going to enhance a business process, which then produces all kinds of other prerequisite things?

Yes.

Do we have an inventory of our business processes? Do we know the business processes that are material? If we go to something like the Open Group Architecture Framework, do we have business process modeling notation and specific information about the data layer and the network layer and the communications layer and the infrastructure layer for all the systems and business processes that exist within the organization. And then under what circumstances is AI going to make it better, make it worse, or have no impact?

Hmm.

If it makes it worse, we shouldn't do it. If it has no impact, we shouldn't do it. And the only time we should adopt artificial intelligence artificial intelligence to enhance a business process is if, is if we can provide evidence that artificial intelligence is going to make the business process better. Every other situation, why would we spend money to make the situation worse? Or why will we spend money on AI adoption to increase our risk for a business process that's fine without AI and is not going to be better with AI? Those are really executive management decisions, not governance decisions. The board at their level is going to say, this is where we're going, this is what getting there looks like, and these are the boundaries that you need to operate within. Based on that perspective, that's how I argue that what we're calling AI governance is really AI management, and it requires appropriate, well-conceived decisions from the leadership of the organization. But that doesn't really go all the way up. To the board level, in my humble opinion.

Wow, that is really, really fantastic. Okay, so this is all the time we have. Before we go, you did mention this book. Why should my audience read this one, Corporate Governance Matters?

Well, they shouldn't read that one because the fourth edition just came out.

Oh no.

So I would say get the fourth edition. But one of the things that becomes very, very valuable, even if you're not on a board of directors, is to understand how boards work.

Yes.

You know, what is materiality? Why does it matter? What does the board do? The more that I understand about my stakeholders within the organization, the better I can frame the problems that we face, and I can make recommendations on how we're going to solve those problems. That becomes very, very valuable. Actually, uh, if we add a book to the list, Seth Godin had a book called Lynchpin. It talked about being indispensable regardless of your position in the organizational chart. If you read the 4th edition of Corporate Governance Matters, and then every outcome that you produce is in a format that can be consumed by the highest levels of leadership within the organization, you actually are going to be indispensable. They're going to say, hey, BZ, everything that you give us allows us to make an actionable, informed decision that creates value for the business. We're going to keep giving you bonuses, we're going to keep giving you recognition, we're going to keep you around and never let you leave. Because what you're producing at your level is so valuable, it makes the entire company better. Hmm.

That is, that is really powerful. And then the last one is this book, you are a co-author, Modern Cybersecurity.

Man, you really went into the archives and found all the greatest works.

Yes. So why should we read this book?

So if you read that book, the chapter that I contributed was about metrics. If you cannot measure and explain something that you've done as a trend over time, it's really just interesting information. So the chapter that I contributed— well, honestly, all the chapters in the book are great. I think my chapter is great because a lot of people struggle with metrics. So I did put a lot of thought into performance measurement metrics and what is going to drive decision-making. It complements this conversation very well. If I'm sending— if I'm giving something to the board and saying, here is actionable, defensible information, if I enhance that and say, this is the trend over time, this is where we were 5 years ago, 3 years ago, 18 months ago, we are on a growth trajectory, we need to keep investing in this area, but here are areas where it produces no value. Now you end up in a position where I'm using metrics and reporting to justify targeted use of limited resources in the company. Yes, if I'm the one CISO that never causes the company to waste any money, I'm going to retire from that company if I choose to.

Yes, yes. Wow, that is powerful, powerful. And the other book you just mentioned was Linchpin by Seth Garden.

Yes, that's the last book I read before my first CISO job. So I will give that book credit for helping me change my mind, my heart, and my attitude about the work that I was doing and the impact that I could have. Other people saw it, and then it led to some really interesting outcomes.

Yes. Well, well, thank you so much for your time. Normally we keep this to 30 minutes, but you had so much to say. And I'm so grateful for the time today, sir. Really appreciate you speaking not only to my class, but to my big audience. So I think it's making a difference in the industry. Thank you so much, sir. I appreciate that.

It's my pleasure. Thank you for having me.

All right, everybody, this is one for the book. Again, follow Kian, very easy to find on LinkedIn. That's linkedin.com/Kian, and then his website class-llc.com. Again, he's the CISO of CISOs, right? I think every CISO needs to have a coach, and Kian is the best one. In the business. And again, get a copy of his best-selling book. He has a chapter there, Modern Cybersecurity: Tales from a Near Distant Future. It's available everywhere books are sold. Thanks again for watching. Just tomorrow, I am going to be back here with Master Sergeant, now Dr., Joseph Gross Jr., U.S. Air Force, and we are going to be talking about his leadership journey. So that's going to be our regular podcast tomorrow. I believe it's 6 PM California time, so 9 PM Washington, D.C. on the East Coast. All right, and whenever I have a chance next week, we're gonna go back to the book of Proverbs. Uh, we did Proverbs 21 last time, so we're gonna do Proverbs chapter 22. Again, this is not a religious podcast. It's all about, uh, ancient wisdom and leadership lessons, uh, that is still, you know, I believe, um, applicable today, still relevant in 2026, even though This book was written more than 2,000 years ago. All right, that's all I have for today. Thank you so much for watching, and I hope to see you tomorrow and next week. Bye for now.

Thank you for tuning in to the Leadership and Success Podcast with your host, Coach BZ. If today's episode added value to your leadership journey, be sure to subscribe, share, and join us again for more wisdom nuggets on how to lead better and achieve to greater success. Remember, leadership is the most critical skill of our time. The world will always need leaders to inspire others, drive innovation, and execute meaningful strategy. So why not count yourself among the bold leaders shaping the 21st century? Until next time, stay inspired, stay committed, and keep leading with excellence.