S4:E43🎙️LIVE with Matthew Rosenquist!

Hi, I'm John Maxwell. When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation, I'm proud to say, is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend Bob Fabien Zinga.

Welcome to the Leadership and Success Podcast with your host, Coach Beezy. If you need to develop into a better leader, this podcast is for you. If you want to achieve a greater level of success, this podcast is for you. His mentor, Dr. John C. Maxwell, said it best: everything rises and falls on leadership. We hope to inspire you today and provide you with an insight that has the potential to positively impact the trajectory of your life. Welcome to the Leadership and Success Podcast. Imagine gaining the leadership skills that could redefine your career. Join Coach BZ on the Leadership and Success Podcast, where each episode delivers practical insights from world-class speakers, military leaders, and industry experts. We dive deep into what matters most. Building resilient teams, leading through uncertainty, and navigating complexity with clarity and confidence. Every conversation is crafted for aspiring leaders like you who are ready to grow, lead, and make a lasting impact. Don't miss our powerful live sessions and recent highlights. Michelle Hayward on building diverse, high-performing technical teams. Anne Leslie on leading through global complexity and cybersecurity risk. Ron Carpenter, AI exploring faith, resilience, and AI-powered leadership. Colonel Michelle G.I. Gardner-Ince on commanding influence from the battlefield to the boardroom. Chris Robinson on shifting from drift to drive in life and leadership. And Coach Enrique Acosta Gonzalez on mentorship, legacy, and heart-centered leadership. Ready to level up your leadership journey? Tune in on Spotify, Apple, Audible Podcasts, YouTube Live, and LinkedIn Live. Join the movement toward leadership excellence. Listen now and start transforming your success.

I'm Matthew Rosenquist, CISO, cybersecurity strategist and industry advisor. I have my own consulting firm, Cybersecurity Insights, and I'm currently the CISO of Mercury Risk and Compliance. Now, I've always been passionate about technology and law enforcement. My career has now spanned over 30 years, and I continue to be excited every single day in cybersecurity. Now, it may sound cliché, But doing what you love makes a tremendous difference in your contributions, your success, and ultimately your longevity. And I love the chaos, ambiguity, and the challenges that intelligent adversaries bring as part of our industry. Every day I look forward to making a difference. Now, if you can find that passion, it will drive you to give your best, to seek out new challenges, and fuel both your success and happiness. Just keep in mind, your journey is uniquely your own. No two are the same. The key is to find your optimal path. So a little more than 30 years ago, when I first started my career, in cybersecurity, my mentor at the time, a very, very bright woman, she sat me down and she said, "If you're looking to get into this industry and make this your career, you have to know the dirty little secret." Of course I was interested, right? And I'll share it with you today, but just don't tell anybody. It's a secret. She told me security is a losing—

All right everyone, uh, thank you so much for being here. This is Coach Bizzy. I have a very, very special guest today, my friend and easily a mentor to many of the CISOs and cybersecurity professionals out there, one of the top strategists in the world. I'm talking about Matthew Zinkrist, globally recognized CISO, cybersecurity strategist, and thought leader whose 35+ years of experience have shaped how organizations worldwide approach risk, trust, and digital resilience. And he is in the house, a LinkedIn Top Voice, and also recently he's been selected as a Think365 ambassador for cybersecurity. So now with no further ado, let me bring to the screen, if I can find it, Matthew Rosenquist. How are you, Matthew?

Pleasure to be here. Pleasure to talk with everyone.

Fantastic. Thank you so much for making the time. I know you are super, super, super busy, but I think this is kind of important, everything that's happening in the world and AI and all of that. We thought we probably need to just stop and just have a chat. First question I'm going to ask, what is something about you that most people may not know.

I drink an insane amount of coffee. In fact, it's typically between 12 and 14 cups a day.

Wow.

That's my happy place. If I get over kind of 16, I start to get a little twitchy. But wow, since I was 5 years old, so coffee and me, they go together.

That is, uh, impressive. Actually, I've traveled so much, especially since I joined the Navy, and Everywhere in the world, people drink coffee, but I actually don't drink coffee, which is kind of weird, but I drink hot chocolate though.

So I can't talk to you anymore. I'm sorry.

You don't drink coffee? No.

I mean, you have to have standards, right?

Really crazy. Yeah. Because I know I was in Guam, the Sheraton there, and I was looking for hot chocolate for breakfast. They didn't have any. It was coffee only. I'm like, okay, that's interesting. So anyway, so many times I just travel with my own hot chocolate. Anyway, putting that aside, can you tell us— so you've navigated the CISO role at multiple levels, right? We talked about Intel, Mercury Risk Compliance, and all that. So how has the definition of CISO success evolved during your 35-plus-year career?

Oh, wow. I mean, if you go back to the beginning, first off, our industry wasn't called cybersecurity. In fact, it wasn't even called information security. You know, when I joined and was involved, it was system security and it was a dead-end field. In fact, I even started before that and I worked for a company doing investigations for theft, fraud, embezzlement, you know, counterfeiting, things of that sort. So, you know, that industry evolved out of security when computers became important and valuable.

Yes.

They started getting victimized and You know, back in the day, it was about protecting your own server. Many times, you know, your machine was under your desk, but you were an administrator and that's what you managed. And as soon as they started to connect those on networks within organizations and then eventually out to the internet, and we had the evolution of the World Wide Web, you know, the problem became much more challenging. But it wasn't just protecting that system or your availability or your files. As the dependence on digital computing rose and companies then relied upon them, now you're protecting the company reputation, the company assets, the ability to sell and buy, and logistics, communication, everything then became, you know, at risk. And the job, the responsibility of that job then evolved based upon that need, based upon that dependency.

Yes, that is so true because I think when I first started in this field, we used to call it information assurance. So that was after we called it system security, and now it's just all over the place. Now, let's talk about burnout for a minute. I know you, in my opinion, don't sleep enough. I'm worried about you sometimes, but how do you manage with burnout and the competing demand for this job, especially when you are at the very top as a CISO? How do you balance life, work? Because this is pretty much a 24-hour job, right? Because the bad guys, they don't just, they don't take vacation, they don't go on weekends. They are always going after you. So how do you handle all of that? What would you recommend, especially for the aspiring CISO listening to us right now, how to balance it all?

Well, burnout is a really important issue because our industry, there is a tremendous amount of stress and there's good stress in life and there's bad stress, right? You know, being there when your firstborn child is, is, you know, there in your arms for the first time, healthy and crying or smiling, that's stress, but it's good stress. You know, bad stress typically is when you have expectations that you believe you can't satisfy, right? And you feel that negative pressure and it can be grinding. In our industry, we have a high degree of chaos of things that we don't control and cannot see and a high amount of ambiguity where we don't realize what's going on or the, the downstream potential impacts. So dealing with that every day, you don't have a consistent workday or work week You don't know what's going to happen or how bad it's going to get. So, you know, you have to understand that going into it. And I do. I love it. I absolutely love the chaos and ambiguity. I would not function well in an 8-to-5 job where I'm punching out widgets and there's no creativity. I would not survive. I would fall asleep and I'd be done. So For me, you know, it's important that I have that expectation. And for me particularly, I love it. I love dealing with intelligent adversaries, right? And most of them, I would say a huge percentage of them, more than average, are smarter than me. They're more capable than me. I'm working against an adversary that is larger, more powerful, better funded. They communicate and collaborate better. They've got great innovation. They've got massive diversity of thought and background and experience.

Yes.

So it's an uphill battle every day. I love it. I love it. You know, so that's my personality coming into this. And I've been doing this for 35, almost 36 years. And I love every single day, even at Intel, when, you know, we would have our sabbaticals every 7 years, you get several weeks off. About 6 weeks off for sabbatical, and I would look forward to it because then I could go do more. I could go do more keynotes and speaking on cybersecurity and dive into research. I would have a stack of research I could go read because I would have time.

That's wonderful.

So to me, it's not bad stress, it's good stress, but it's still stress and it can still grind on you. And so, you know, having the expectation, managing it appropriately. And my wife does a great job when she sees me stressing or grinding my teeth. She'll come and, you know, gently tell me or physically intervene.

Yes.

And go, what are you doing? You're stressed out. Go relax. Right.

Wow.

So that helps.

No, that is, that is great. So a lot has definitely changed in our field. How do you see the cybersecurity executive today? Because when I first started, it looks like initially it was really a bunch of, you know, uh, geeks, you know, very, very smart, very, very highly technical folks. But every time they opened their mouth, nobody understood what they were talking about, using all type of jargon. So they couldn't talk to the, to the business. The board couldn't understand what they were saying. But past today, what do you think is going to make a cybersecurity executive, uh, effective in a, uh, business environment?

Well, we have to get over several barriers that we've created for ourselves. And I agree with you, the vast amount of CISOs that have come up through the ranks have been technical, right? Very technical oriented. And it kind of makes sense, right? Because this is the battlefield that we're playing on. And so if you put an engineer or a developer or a technologist or an architect in that space, Well, yeah, they're going to fix cybersecurity. And that was the concept back in the day that this is an offshoot of IT and IT deals with fixable problems, scriptable problems, problems that you can predict, mean time before failure, all these great metrics. And so therefore cybersecurity is just a, you know, a hacker, somebody in a hoodie in a basement and they're doing, you know, they're taking advantage of vulnerability. All you have to do is close that. This is super easy. Right. We're just going to fix it. Well, you need a technologist to do that. And if you're a technologist, right, it's just like if you're a hammer, everything's a nail. If you're a technologist, you're thinking like an engineer. And an engineer looks at a situation, defines the problem, identifies a solution, builds it, applies it, and then they're done.

It's—

yes. And yet cybersecurity, they tend to forget You have an intelligent attacker again who may be smarter than you, who may have more resources than you, who may know your technology better than you.

Wow.

They're not going to let you get away with it. Your little fix is laughable and they're going to go around it, over it, or through it. And now you still have the problem. So a lot of CISOs that I mentor, they get to this level of frustration because they really truly thought they were going to go in and fix it. And when they listen to the vendors, the security vendors for services and products, they're using the same verbiage. Oh, we fix this, we solve that.

Yeah, we have a silver bullet.

Oh, okay. We've got this generation of CISOs now. Technical. Look at it as a technical problem. Look at it as fixable. And that's what they communicate. But the reality doesn't manifest that way. And talk about stress.

Yes. Yes.

So there is an evolution here and it's an evolution of transformation for the CISO. We've got legacy CISOs that talk tech, right? And they're only talking tech. They're not talking business. They only see it as vulnerability, you know, management or pen testing, things of that sort. They're not even seeing or can communicate what are the type of people attacking me? What are they going after? What resources do they have? What are their go-to methods? How are they going to evolve? How are they funded?

Right.

They're not thinking in those terms. They're thinking strictly defensively. So, you know, they need to change in this transformation. It's like a cliff that's coming up. We've got two decades worth of CISOs, you know, going to the board and going to the CEO saying, I need money, using fear, uncertainty and doubt to get a big bag of coins with the expectation that it's going to be fixed.

And it isn't.

And they're asking for 20% increase year over year. That is average. They're not getting it, but they're, they're asking, whereas they've positioned themselves as an overhead, a cost center. Now, business majors here, MBAs, will understand if you have a cost center, right, uh, an organization that doesn't revenue— doesn't generate revenue, your goal is to reduce the cost, to introduce efficiencies and reduce the cost year over year. Well, cybersecurity increases year over year, and that does not work in the long term. At some point they say, "Stop, enough," right? And at that point you've lost because you have to continually adapt because the attackers are. So at that point, it's time for the CISO to pick up their bags and move to another company because they cannot succeed. So we've built this structure in and the way we have to move forward is better communication, better collaboration, and for CISOs to transform from technical risk experts to business risk partners, right, to help the organization understand those risks and opportunities. Because again, if you are a technical risk person, you're just there to manage the bad things. You're not actually talking about the potential business benefits. Yes, but if you want continued revenue and investment, you have to contribute to the bottom line and that will be the transformation. Some will transform. I know many of my peers, CISOs, are actually going to get their MBAs because they see they need to be able to communicate. They need to be able to show this.

Yeah.

And there's a lot of CISOs, the technical ones are like, nope, this is what I do. I'm going to deal with number of alerts and so forth. They won't survive. They won't be around in a few years.

No, that is so true. I had to get my own MBA too, I think back in 2017. It really helps to be an enabler to business. I'm sure you have many stories like that. When I first got into this thing, most CISOs back then, they would just say no, right? We were known as the department of no. Business can't do anything because it's too risky. But the thing is, if you're going to do business, you're going to have to handle some risk, right? It's not— if you don't want to handle any risk whatsoever, then shut down the door and fire everyone. But if you're going to be open for business, there's going to be risk. So you need to know what the level of risk is and how you may be able to manage it. But anyway, that's very interesting. Another question, we've talked about this before, but where do you see today, where within the organization, who should the CISO report to? Because when I first started initially, it was almost always to the CIO, to IT. In the past 10, 15 years, that's changed quite a bit. Like me, I've reported to the general counsel, which I actually like. I reported to the CFO, which was very nice because then I had a pretty good view on my budget. And then I've also reported to the CEO, which was nice as well. But anyway, I guess different organizations do it a little bit different. What do you think is the optimum place for the CISO within the org chart?

This has been an ongoing discussion for quite a while in the industry. My opinion is there's no perfect answer because every organization is different. And even within a particular sector, right, you've got different culture within an organization and a different maturity level. So we have to look at all those different things. And I think the first place we start with is accepting the fact that cybersecurity permeates across all the different business units. It permeates through IT. That's an easy one. But it also has to protect things in HR and finance and all your different product groups. And oh, what about your third-party vendors? Yes. And your business risk people? Absolutely. So if we understand it's not a vertical, it's a horizontal that cuts across. Now, if we accept that, then it's more of a matter of how do I effectively partner with these verticals as that horizontal? How do I effectively partner with them, showcase value, maximize what they can do, minimize or manage? Just as you said, we're not here to eliminate risk. We manage it to an acceptable level.

Right.

So how do I work with all those verticals, including the C-suite, including the board, and including third-party vendors, partners, and even customers sometimes Yes. How do I, you know, reach an acceptable level of risk, define that, and then, you know, propagate that? And, you know, one of the secrets in cybersecurity is, yeah, I'm the CISO, but I actually don't manage all the risk. It comes down to the individuals and the business groups and the technologies and everything else. So I need support from all those verticals. I can create a security policy, but if that product group goes, that's not important, just get back to work, just turn all that stuff off and you've got deadlines, right? I'm just a figurehead pushing paper that no one's going to read or follow. I actually have to prove and collaboratively work towards common goals that benefit those organizations and the individual verticals. So it's where to report to. The higher the better, generally. But every organization I've seen it successful under IT, I've seen it successful under Chief Legal Officer, I've seen it successful under CEO, under the president. There's many different areas now, equally, you know, equal time here. I've seen it fail in all those locations as well. So it really kind of depends. And, you know, when I get a board that calls me up and says, hey, can you kind of evaluate our security and our CISO and tell us, is it working? Is it not? What do we need? Typically there is a problem. And, you know, a lot of it is that expectation setting, the communication, and then the collaboration, that buy-in.

You know, that is, that is so key because I, I really believe, yeah, the CISO role is definitely changing. And we need to be able to impact the culture, influence people. I guess that's part of the problem, right? You have a CISO, on paper, you are responsible, but in reality, you don't have any control over a lot of the things you're responsible for. You don't have the money, the people, and the resources. Another business leader is in charge of that. So I guess my question for you is, how do you inspire alignment across executive boards and technical teams. That's what you're talking about. So you have all those verticals, and then how do you make sure that you influence them so they do the right thing for the organization? Like they want to apply your policies, right? Or even better, make them feel like your policies is their own ideas. If you can do that.

Oh, if you can do that.

Yeah. How do you handle that? Well, what would you recommend?

Yeah, I mean, what you're talking about is probably one of the most important factors of whether you're going to be successful as a CISO or not. Is being able to be seen as that expert and partner working with them, the different verticals and the executive layers, essentially everybody in the company to help maneuver in ways that meet those cyber risk goals. And the number one piece of advice that I give to CISOs is you have to make it relevant to your audience. So if you're talking to the product group, you have to know, well, what kind of product do they have? What are their timelines? Right. Understand their business a little bit and how you describe the value and the partnership of what you bring is— will be key to whether they're going to support you or not. And if it's HR, right, I may be talking to HR and their big concern is going to be about data confidentiality. Right. Don't let our records, our confidential records get out. There's HR, there's medical records. So on. Okay, great. And that's what I'm going to talk to them about, about keeping their data secure. And this is why we need this. If I'm talking to finance, finance is a little less— they're okay with confidentiality. I mean, it's important, but the real thing to them is integrity. They don't want somebody going in and moving a decimal point. Or changing where a check gets delivered. Right. You know, and so that's now the value proposition I'm talking to them when I talk to business units. Hey, how can we be a competitive advantage? How can we showcase what security or simply trust or reputation of our company, how that helps you in the market you're in? How will security, privacy, or safety Help your expansion plans into Europe, right? Hey, do you know cybersecurity can be used as part of your good, better, best marketing strategy? Yeah, you can get people out of that freemium category into that first paid tier. Let's talk about how security can do that. Now you have their interest. Revenue, market share, average selling price, margins. You're talking their language.

Yes, right. Yes.

And they're gonna want to partner with you.

So no, that is really, really powerful. I know prior to being the CISO at Santa Clara University, I was a CISO at one of the startups in San Francisco. I must tell you, all of the business executives knew something about sales and revenue. They all were in support of that. So when me as a CISO would enable sales, get on those sales calls, talking with leads and prospective customers, and convincing them that if they were on board with us, our software was secure, would keep the data safe and they could trust us. That's exactly, that's where the CEO would get out of his office and give me a pat on the back. But if you are just there telling everybody, no, no, no, can't do it, not secure, there is no way. Yeah, I don't think you're going to have that job for very long.

No, you're not valuable, right? You're valuable for something that may or may not happen. That's really tough to justify. And at Intel, it was the same way. I had product groups bring me in to big client meetings, especially when they had questions about security or just wanted the confidence, right? They would bring me in and we would have great conversations and they absolutely loved it. They wanted to book all my time and I'm like, I got a day job, cherry pick, cherry pick. I'll come to some of the meetings, but that's awesome.

Man, time is flying. We need to get into the second half of the show where we focus on leadership, which question I ask every guest on the show. But before we do that, is there anything you would like to say or share that you wanted to share today?

Well, you know, there was a little bit in the, in the intro, you know, where it talked about the importance of leadership and for cybersecurity. When I go in and evaluate how mature, how good an organization is, the number one factor which will determine how effective and sustainable an organization is comes down to leadership. And I've seen outstanding leadership and they can do amazing things with a very small amount of resources. And I've seen horrible management leadership have massive budgets and probably do more harm. It would have just been better if they didn't have a cybersecurity program at all. So, you know, leadership, it really is crucial. And so having a leader that has experience and knowledge and a community to rely on is very valuable. And if you, right, the listener wants to be in cybersecurity, wants to be that leader, it takes work. It takes experience. It takes building that network, understanding what works from other people's perspectives, what failed. Right. I learned more from, you know, how other organizations fail than their successes. So we have to be out there. We have to do it. And, you know, in cybersecurity, it's leadership. And if there's a failure in leadership, we're left with crisis. So, yeah, that's what you're going to be left with.

And what is your best definition of leadership?

Ooh.

So again, another great open-ended question.

Yeah.

So my definition of leadership is it's really the marshaling of available resources to maximize their benefit. And it's a force amplifier, right? So the combination of the available resources and talents and people and everything else in combination, they can accomplish much more, orders of magnitude more typically. Than the individual contributions separately. So leadership is about alignment and seeing the opportunities and rallying and acquiring the resources and timing and logistics and everything else to an end result, which is far greater than a lack of leadership would provide.

That is perfect. Okay. I did promise my audience that you would finish your phrase in your KeyTalk. Let's go back to it for just a second, but let me forward it a little bit.

Is a losing— I was interested, right? And I'll share it with you today, but just don't tell anybody. It's a secret.

We're gonna keep it a secret.

He told me security is a losing—

security is a losing what?

It is a losing proposition.

What do you mean by that?

Okay.

Okay.

So, you know, we have to understand there's all sorts of different complexities and challenges, right? We talked about it's different than the single-faceted threats like IT deals with. Like if a server goes down or something, you can fix it and it's back up. We deal with multifaceted. But I want you to consider for a moment that there is a spectrum. Because we deal with trying to prevent bad things from happening.

Mm-hmm.

Okay. So if we're successful, bad things don't happen. But how do you show you were successful?

Right.

You can't measure what didn't happen. Right. So we have a conundrum when it comes to cybersecurity metrics. And if you think about success on a scale, Let's say you have the very best team, very best leader, every possible tool, policy, behavior. Your organization loves you and just lives and breathes security. You are at the pinnacle, right? That's a dream. Yeah, it's dream, dream, dream. Nobody gets there, right? This is fantasy land. But you will experience no or very little loss at the end of the year. Okay, now if I'm the board and I'm spending all this money, right, and I'm allocating budget for security instead of sales and marketing where I get more revenue and all this, I'm going to be thinking, why am I spending so much on security? Nothing bad ever happens. Yeah, I don't need to be spending all this money on security. Okay, okay, so let's go to the other end of the spectrum. Let's say you're horrible, you're wasting any budget you have, and you're incompetent, and bad things are going to happen. They will find you really, really bad things. And at the end of the year, management's going to look at that and go, wow, we were brutalized, brutalized, right? We were embarrassed and we had to pay for security. So the same conclusion, why are we paying for security when it's so bad? Okay, so you've got these two bookends of the spectrum. As it turns out, no matter where you are on that spectrum, it's the same conclusion because you have great difficulty in proving that bad things didn't happen because of you, or the losses were minimized because of you. You can theorize it, you can create some fake metrics, you can postulate, you can use fear, you can do all those. But at the end of the day, it is not impossible, but it is extraordinarily difficult to prove that, especially when at that end of the year and they're deciding budget for the next year, sales and marketing can go, hey, we spent this on marketing and guess how much more revenue we got for it?

Yes. Yes.

Next year we want to double that. Just go ahead and give us that security budget and we can double the revenue. We proved it. We've got the dollars and cents. We can calculate it down to the penny. What can security do? Uh, bad things may or may not happen if you don't give me some money.

Yeah, yeah, right.

It's just not— it's— you are in a losing scenario. You have to understand that and accept that going into it. Be at peace with it and understand that is the burden, that is the mountain you will always climb. In our industry.

True. And I guess you and I, we are kind of crazy in some ways because, no, it's kind of like there is a fire, right? Most people are running away from fire and you and I, we are running into the, uh, running towards it.

Yep.

Just, just the way it is. I guess it's not for everyone, but I definitely love the, uh, challenge. But that's also why I think a security executive has to be a business leader first foremost. You have to be technical, that is a given. But in addition to that, you need to be able to learn how to deal with people, influence across all of the vertical within your organization, be a trustworthy executive that people can rely on and come for advice. Now the other thing, because coming from a military background, chain of command is so clear, so easy, I love it. But first time I started working in Silicon Valley, it's like, Everything I said, engineering was like, whatever. They completely ignored me and there was absolutely nothing I could do about it. I was like, what in the world? That's part of the reason why I was forced to go get the MBA so I could really speak their language and understand what's going on with the business as a whole. But anyway, having said that, now you are also a LinkedIn Top Voice. Do you happen to know why you were selected? What's the secret for that?

The secret? I don't know. I mean, right now I've got about 160,000 196,000 followers. So depending on what—

okay, what do you think? And for cybersecurity, but what, uh, do you, do you, do you think is the reason why they selected you? What is your hunch?

I have absolutely no clue. I don't even know why there's 196,000 people that want to listen to me rant on. Um, I'll, I'll tell you a secret. I started doing blogs and doing podcasts and videos and so forth, simply because at work I was doing things, my job, and then I would see something in the industry and think, well, that's crazy. And it would start rambling in my head. And in order to get it out of my head, I would have to write it down or publish it or do something. So it was cathartic for me.

That's wonderful.

And, you know, the great side benefit is when I started doing that, people, my peers started jumping in and started, we started having great conversations and solving problems and showcasing just total fear and doubt and bad vendors and everything else. And the only thing I can think of is people were entertained or informed and decided, hey, I guess I'm going to follow this crazy guy. Let's see what he has to say about cybersecurity.

No, this, this is really good because, uh, uh, an important portion of my audience, right, are aspiring CISOs and tech leaders and, uh, military commanding officers, especially in the information warfare field. What would you tell, um, an aspiring CISO just getting started? Maybe they are an analyst or an engineer now, or maybe they just become a team lead. What would you encourage them to do in order to elevate their brand? Not just on platform like LinkedIn, but really to be known as a thought leader, someone people would go to for advice or keynote speaker or anything like that. What are certain things that they can start doing now, even though they may not think they know as much as they need to, but Knowing what they know now, how can they build on that?

Yeah, I would say a couple of things. One, obviously work on your communication skills. If you can't communicate, and whether it's in written form or, you know, discussing things or on camera or whatnot, it becomes very, very difficult, even if you have a great message, for people to appreciate that and want to listen to you in the future. So communication skills, hugely important. And again, that goes in kind of the face of these are technologists, right? They didn't take communication studies in college, right? They're not on, you know, Toastmasters or anything. But communication is hugely important. So that's number one. Number two, don't be afraid to share your life and your experiences and the challenges. Now, I will caveat that and say there's obviously confidential information that you're dealing with that you should not share. Right? So be professional, but it's okay to share your successes, your failures. It's okay to pose a question to the industry in a constructive way and to do constructive criticism, right? To drive discussion. Now, I see a lot of caustic— not so much on LinkedIn, but on the other social media sites, right? They're just trying to cause thrash and stir the pot. Yes. Nobody appreciates that. Not in the professional world. But especially in cybersecurity, there are a lot of good questions to ask and there's a lot of questionable things that vendors or people or potential victims are saying that should be questioned and we should have conversations about that. So be bold and don't necessarily hold back. Be smart, be professional, always be professional. But have the tough conversations. That's how we all learn.

That is beautiful.

That's how we all communicate and collaborate. Drive that.

I love it. Yes. Because I think some people are just afraid to try. No, what if, what if? But you just have to get started and in time you will get better. So leaders are learners. What are you learning right now?

Everything. Anything and everything that I can. You know, our industry is always in a state of flux, but especially when we've got disruptive technology like AI and quantum, you know, it accelerates even faster. So trying to keep the brain up to pace with that. So disruptive technologies is one. We're seeing a huge uptick in the capabilities of attackers, the threat agents and the archetypes of threat agents out there. So I'm on think tanks that discuss and kind of profile that to keep up to speed on that. And then the other thing, we're coming in towards the end of the year here, and that's where I start my predictions. And I typically start in October, and it takes me 3 months or more to actually get those honed in that I'm willing to put those out in the world because I'm going to be criticized about it. And I force myself every year to talk about my previous year's predictions because, you know, did I get it wrong? Should you not be listening or reading anything from me? Let's Let's be brutally honest, right? And if I can't do that with my own stuff, I should not be criticizing others. So, you know, I'm trying to look in that crystal ball. It's about the time where I start making notes in preparation for October to understand that.

That is very nice. I really like something you said, fear of failure. I have an icon which I love. One side says failure, the other side says success. So success, failure, two sides of the same coin. And yesterday, I think it was, I published an article about embracing failure. I think many people are afraid to do what you do because they're afraid what other people are going to say. They're going to be criticized. Right. And so how has failure shaped your life?

Oh, I've learned tons more from the failures that I've had. And I've, you know, I'm, I'm not necessarily proud I failed. But I'm proud of what I've learned coming out of that failure because I know I'm not going to make that same mistake again. I know I'm going to be able to communicate that with others and maybe through that they won't make that main— that mistake, right? They can avoid it entirely. So I'm part of that community and we should be helping each other. And failures, it's terrible, right? When you fail at something, it just sucks on so many levels. But understanding that how you come out of it and what you learn from it and then how you share that is transformative. And that makes— that's the difference between intelligent failure and failure to continue to be a fool, right?

So that is so very, very important. You don't have to answer this one, but is there one example that you can share where you really got a transformative experience after going through specific failure.

Yeah.

How about being a parent?

Yeah.

Yeah. Well, we won't get it. We will get into that. Although I love being a parent because it is a constant process.

Yes.

And I get to see the failure in my children too and help them through that. And I want them to fail.

I wish my baby should fail.

Don't tell them. I do. I put them in situations I know they're going to fail. Safely and securely. But I want them to fail because I want them to go through that process.

Yeah, I really wish as a parent, when your baby came out of the womb, you had like a book or something, a guide, what to do.

Owner's manual.

Can you imagine a child trying to learn how to walk? I remember both of my daughters, they tried to start walking and then they fall and then, hey, walk, walk. But then we're like, okay, no, walking is too difficult. You are failing too often. You're never going to walk. Can you imagine a parent doing that? But that's exactly what we do with our life, with our profession. It's crazy. Okay, we are running out of time. We are having so much fun. About 10 minutes left, but I am almost halfway through. So one question I'm going to ask, if you could choose 3 people to have dinner with, dead, alive, or mythical figure, who would you choose and why?

Oh my gosh, I have no idea. Um, uh, 3 people to have dinner with, uh, let's make one of them a chef because I want to know what I'm eating. Let's do that, right? Uh, I don't want mystery meat. Please tell me what you've cooked for me. Okay, we'll start with that. Um, you know, I would love to sit down with— actually, I'd love to sit down with Patton, General Patton.

Yeah.

Um, and talk. I mean, I've been a fan of his since even I was a kid. And I studied his strategy and techniques and challenges that he had, dyslexia and everything else. And he was crazy as a nut bird, don't get me wrong, he was nuts, but he was also incredibly brilliant to be able to transform people into, from, you know, the most incompetent fighting force, right? To just absolute razors. And again, not the nicest person in the world either. But in times where you needed him, he was the absolute right person to do what he needed to do. And so I'd love to kind of talk about that. If I could talk to another leader, Alexander the Great, right? That's an easy one. Everybody probably picks him. Saladin would also probably be another one.

Um, you know what, I thought you might say Sun Tzu.

Sun Tzu, yes. Um, he was brilliant, he really was. Uh, I would almost be afraid to talk with him. I think he would be so ashamed in how we have not evolved. Yes, over these thousands of years, you know, he's like, I wrote this down, do you not know how to read? Did my book or messages not survive? This is It's crazy. And I would, I would, I would be embarrassed. So I don't want to talk with him because I would have to admit and take blame for all of mankind, humankind, in not applying lessons that we should have. So no, he's not on my list. I'm not.

It's crazy because his book, The Art of War, is required reading in information warfare community. There is him and also, uh, Klaus Witt. I don't know if you've heard of him.

Oh, yeah.

Those are the two strategists that we follow very, very closely. But yeah, definitely a lot of what he talks about strategy for military operation can definitely apply in life, in business, and cybersecurity.

Yeah, absolutely. Know your adversary. You have to. Most technologists don't do that. They don't look to see who their adversary is. They're more interested in what's playing field, right? Or the battlefield. Sun Tzu talks about the battlefield, um, and that's technology. And if you're only focused on the battlefield, you're missing so much of— and that's why a lot of security fails, right? We, we only address it from one perspective. We're not seeing the people, we're not seeing the, the adversaries or the processes and If you only look at it from a technical perspective, you will get far, but you will not win.

Yes. Yeah, yeah, absolutely. So if that's the only thing you guys listening right now get out of this podcast, it's definitely worth it. Future CISOs out there, this is incredible. So I'm not going to ask you— I ask everybody about books, movies, podcasts, and all that. I know you don't do any of that, which is—

I don't have time for any of that stuff.

I understand, but let me ask you this for you personally, though. Is there maybe a song, a book, a movie that would be your life's theme or anthem? Anything comes to mind?

I don't know. Something with Robin Williams, some comedy. I don't know.

Robin Williams was a great actor. I love his comedy.

Okay.

Because it's you, I am going to take it as an answer. Okay, let's move on. If you had one and only one day to live, what would you have liked your final contribution to be?

My final contribution? I would want to be on stage as, as I enjoy doing with peers, sharing the knowledge, experiences, successes and failures, and trying to motivate people that, you know, this is an incredible industry. And if you've got the right mindset, you can make a difference. And our industry every single day gets more important. It gets more important to humankind, to our society and how we communicate and collaborate in how we form relationships in the borders we draw on maps.

Yes.

In how we value each other. Cybersecurity, because it protects digital technology, right? Is important and making sure that we trust our digital technology is going to be more important every single day that we embrace this digital global ecosystem. So we have a role to play. It is important and we can contribute to that if we're in the right mindset and we should.

It needs to happen. I know we don't have much time, but I do want to get your thoughts about disrupting you think AI is going to be for cybersecurity going forward?

Massive. You know, an 11 out of 10. I'm not sure how you want me to quantify this, but, you know, a lot of people don't understand. They saw GenAI and they're like, oh, that's AI. No, that's a little piece. I mean, that's a piece of deep learning, which is a piece of machine learning, which is just one little branch of AI. So if you think and you were disrupted by, you know, ChatGPT or GenAI, oh, stand by, right? We're on the hockey stick. We're now seeing agentic AI and it continues on and on and on. And these are truly powerful, powerful tools, which means they're going to be adopted very, very quickly for all sorts of different use cases. And I actually had somebody earlier today ask me, you know, what do you think it's going to be like in 10 years? And I'm like, that's an absurd question. Right. If you were to ask somebody when the internet was formed, what do you think it's going to be like in 10 years? They would have no clue. They'll be like, yeah, maybe we replace the fax machine.

But let me, let me ask you this. 2025 is getting a little bit harder now for kids coming out of school. First, when I went to school back in the late '90s, there was no such thing as cybersecurity major. That didn't exist. Today, there is almost in every university. But these kids are having trouble getting jobs, and some of them are afraid AI is going to take away their job. What would you say to reassure someone like that who really wants to become a cybersecurity professional, even with this AI thing coming and changing so many things in society?

Well, AI is powerful, which means the bad guys are going to use it. They're going to use it to scale attacks. They're going to use it to create more advanced, effective attacks. And as they do that, our current tools and processes and the levels of controls and people we have are not going to be sufficient. They will be overwhelmed. So the natural response is for the cybersecurity industry to also adopt AI. So we're going to need people using AI tools to keep pace with the rapidly evolving threats. AI doesn't replace cybersecurity. Just like AI doesn't replace the adversaries. It's a tool to be used by both to pursue their, their particular objectives and motivations.

Well, you've heard it here, folks. So don't be afraid of AI. Start using it. I think people, cybersecurity professionals who use AI, I think are going to have a huge competitive advantage over those who keep their head in the sand and don't want to deal with it. Because for one thing, you're going to need to secure it if you are the CISO, right? And you can't secure something you don't understand and you don't use. So definitely you need to get involved. Okay. All right. So we actually are out of time. If you give me just 2 more minutes and let me ask you, okay, this is an important question for every one of my guests. So this is the 7th question, really, but technically the last one I ask. How can we add value back to you? You've been very, very generous with your time and your expertise and wisdom. What can we do for you?

Make sure that you're communicating amongst the industry. Make sure you're participating, whether it's on LinkedIn or at a conference, or, or, you know, when you read somebody's paper, provide input, provide feedback, add your experiences. We will only be successful in cybersecurity if we're working together, if we're sharing our experiences and our insights so that we can collaborate and communicate. If we don't, we remain isolated and that's easy pickings for the attackers. The only way we win is we partner together. So please, right, be out there, communicate, share. And if you have questions or concerns, reach— you're not alone. Don't be afraid to reach out to a peer and say, hey, I need help. I don't understand this. Right. And when somebody does that to you, carve out a little bit of your time to help them. We all have to be on the same team. We all have to.

That is so true. And also, I'm going to tell you guys, Matthew, I know, is a very important man. He's extremely busy and all of that. But if someone wants to get into the cybersecurity field or just getting started, and even on LinkedIn, you want to reach out to Matthew, to me, to some of our peers, many other CISOs there, we will almost always take time to talk to you because you are going to be the future of cybersecurity. At some point, Matthew isn't going to be a CISO. He's going to need to— to retire, but who's going to take over? It's gonna be you, right? So it's really in our own best interest to help mentor you and coach you. And that's part of the reason why I do this leadership devotion every single day. And I have this podcast every single day is to reach people like you listening right now. Anyway, anything quick you want to add about that, Matthew? And I know we have to end this podcast in a second. But anything you—

I would just amplify what you're saying. And I would speak to the fellow leaders out there, those CISOs who I know are completely busy and And security engineers and architects, take a little bit of time out of your day, out of your week, and help the next generation of cybersecurity professionals come up to speed. You know, it's going to be tougher for them than us. It moves faster for them than it did for us when we started. So if we don't work and help them, bad things are going to happen, right? We have to be able to hand over. And these are the people that will build that will be protecting your future after you retire as well. So collaborate.

No, absolutely. Okay, really, really quick. I think we can do this in, uh, 1 and a half minute, uh, maybe, maybe less. So you have to think really, really quick. Uh, when you wake up in the morning, what is one problem you would like to solve?

Clearing out my email because it filled up overnight. And so did all my notifications on LinkedIn. So true.

Yes. So which, which problem is it?

LinkedIn.

Right.

And I get a lot of people that connect or have a question and I want to answer those.

Very, very good.

You are not going to meet with everybody, but I want to help out and want to let them know, hey, go contact this person.

Okay.

Or that is a problem.

Right. And what is the most rewarding aspect of your life experience so far?

Being a dad.

Fantastic. Okay, now this one: if you could go back and give a piece of advice to your 17-year-old self— I say 17 because that's how old I was when I came to America— big dreams, big idea, but I didn't have any resources, didn't know anyone. So standing at the edge of this incredible career you've had, what would you say to that 17-year-old?

Pursue your dreams. Don't hesitate, not even, not even a little bit, right? Apply everything you have and contribute the most that you you can for—

What if I fail? What if I fail?

That's part of it, right? If you think you're not going to fail, you're delusional. But that's okay, right? You're gonna, you know, move with purpose. You're always going to mitigate risks. You're going to have recovery plans, and you're going to fail, right? And you're going to learn from it. But pursue what you love. You don't work a day in your life, right?

That is fantastic. I couldn't say it any, any better, because even if you make mistake, even if you fail, I think learning from those failures is important than succeeding, because that's gonna— if you get those lessons, gonna be with you for the rest of your life. Okay, very, very quick, 3 adjectives describing you as a child. We had the end here. 3 adjectives as a child.

Uh, I was a horrible child. Um, I was analytical, I was focused, I love technology, you know, and I was an introvert. I still am an introvert. Okay, I don't like people.

So as an adult introvert, give me two more.

I was analytical, very, very analytical. So everything I did was measured. I thought about it well in advance.

One more.

And I took ownership. I was brutally honest, and so I took ownership for it. I felt that was the only way to move forward.

All right, so we are at the end of the podcast. We went 5 minutes over. Thanks so much for being so generous with your time. But for those listening to us now, I'm actually going to be on Matt's podcast right now. We're going to be recording it. It's going to be coming out when?

Probably in a week. We'll get it published in a week.

And you publish yours both on LinkedIn and on YouTube, right? Yeah. Because if you go to Apple Podcasts, my favorite podcast platform, you won't be able to find it.

I haven't figured out how to publish there yet. I don't know.

Maybe I'm going to help you fix it and not use too much of your time. So this is it, folks. So very, very last question. This is it. One word that represents our shared experience together on this podcast right now. Which word comes to mind?

Truth.

Okay.

It's truth. I am just saying the good and the bad, the ugly and the beautiful, but it's all about truth.

That is so powerful. And I think if you're going to be a CISO, you need to be honest, right? Matt talked about FUD, and many, many CISOs in the old days, they used to use that fear, uncertainty, doubt, and just making people, oh, the sky is going to fall and I need all of this money. But that's not the way to lead. You have to be honest, right? And you have to collaborate, share your experience, just like Matt says. Okay, this is it. This is the end of the podcast unless you have anything else to say, Matt. And thanks again for your time. Beautiful.

Thank you for having me on. We should do this again.

Yes, we definitely should. So until next time. So you guys had the treat today. You talked with Matthew Rosenkrais, I believe one of the premier security strategists in America and the world right now. And that's saying a lot coming from me. So thanks again, Matt. I really, really appreciate it. Okay, until next time, this is Coach Bizzy. And thanks again for being with us. Bye.

Thank you for listening to the Leadership and Success Podcast with your host, Coach Bizzy. If you like what you heard, please subscribe to our channels and come back for more wisdom nuggets on how you make develop into a better leader and achieve greater levels of success. Leadership is the most critical skill. The world will always need leaders to lead others, deploy the next disruptive technology, or execute a business strategy. You may as well decide on counting yourself among the 21st century leaders. See you right here next time on The Lead