S4:E45🎙️ LIVE with Coach BZ on the Cybersecurity Insights Podcast

¡Hola!

Hi, I'm John Maxwell. When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that That's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation, I'm proud to say, is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend, Bob Fabien Zinga.

Welcome to the Leadership and Success Podcast with your host, Coach BZ. If you need to develop into a better leader, this podcast is for you. If you want to achieve a greater level of success, this podcast is for you. His mentor, Dr. John C. Maxwell, said it best: everything rises and falls on leadership. We hope to inspire you today and provide you with an insight that has the potential to positively impact the trajectory of your life. Welcome to the Leadership and Success Podcast.

Imagine gaining the leadership skills that could redefine your career. Join Coach BZ on the Leadership and Success Podcast, where each episode delivers practical insights from world-class speakers, military leaders, and industry experts. We dive deep into what matters most: building resilient teams, leading through uncertainty, and navigating complexity with clarity and confidence. Every conversation is crafted for aspiring leaders like you who are ready to grow, lead, and make a lasting impact. Don't miss our powerful live sessions and recent highlights: Michelle Hayward on building diverse, high-performing technical teams, Anne Leslie on leading through global complexity and cybersecurity risk, Ron Carpenter AI exploring faith resilience, and AI-powered leadership. Colonel Michelle G.I. Gardner-Intz on commanding influence from the battlefield to the boardroom. Chris Robinson on shifting from drift to drive in life and leadership. And Coach Enrique Acosta Gonzalez on mentorship, legacy, and heart-centered leadership. Ready to level up your leadership journey? Tune in on Spotify, Apple, Audible Podcasts, YouTube Live, and LinkedIn Live. Join the movement toward leadership excellence. Listen now and start transforming your success.

Welcome to Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about the challenges and opportunities of cybersecurity leadership in a world that is becoming much more dangerous. And I get the pleasure of talking with Bob Zinga. Bob is the Head of Information Security, Information Warfare Commander, US Navy Reserve. He's also the former Chief Information Security Officer at Santa Clara University. He's a podcast host, a mentor, keynote speaker, and board advisor. Bob has an illustrious career in cybersecurity leadership, and we are very lucky in chatting with him today. Welcome, Bob. Thank you for coming.

Thank you. I appreciate that.

I'm really, really glad to be here.

Yeah.

So given your depth of experience, how are you seeing the security of our digital world changing?

I see that in this century, right? The 21st century, the way things are going, I kind of add, I don't know if it was a, premonition or what, but when I was 17 years old, just came to America originally to be a doctor, but eventually I became a cybersecurity professional. But back then at 17, I kind of knew, I don't know where that came from, but I knew that in the future, 3 things would be important for me or anyone else in America and the world who want to be successful and thrive in this next century. Number one was technology. That's when mid-'90s, the internet just blew up. So I knew that wasn't gonna stop. It would just get more and more advanced, which it is.

And then number two, I felt like leadership.

You need to be able to lead people because by yourself, you can only do so much, right? In order to go far, you need to have a team and you need to be able to deal with people. Like even as a commanding officer in the Navy, it's like people are your greatest asset, but also sometimes they're like the greatest friend in the rear end you've ever had, right? Depending on who they are. So you need to have the ability to work with people who are easy to work with, but also with those who are not easy to work with. The ability to work with people who are from the same generation as you, who have the same background, and those who also are much older or much, much younger. So it's a big, big difference. They have different motivation and being able to, and also in America being the melting pot that we are working with, no white, blacks, no diverse people, men, women, and all of that. So you really have to become an expert in dealing with people if you are going to make it in the 21st century. That's really what I felt like. And then the very last thing was business. You also have to have the basics for business. Part of the reason why I eventually got my master's in business administration. So to answer your question, the way the digital world is evolving now, especially now with AI and quantum computing, which is just around the, uh, corner, which might maybe accelerate AI into AGI potentially. I don't know. We will see your super intelligence, or maybe that's just a dream. But the way I see that as a security professional, number one, you need to be more than a technical leader, right? That's a given. But you really have to be able to help lead the organization, not just be impacted by the culture, but actually impact the culture of your organization. Where security becomes everybody's business. Security awareness is not just for the cybersecurity team, but it's for people in HR or people in finance, people across the entire organization. And also kind of turn the security function in such a way that it enables business. It becomes a partner to all of the other functions across the entire organization. I think we need to do that more and more and more because I'm sure that has been your experiences too.

Except for the Navy, everywhere else I have been, Resources are always a problem.

There is a constraint. We don't have, you know, enough money for you to do whatever you need. So you need to do a lot more with less, right? And that's where I think your leadership skills are really going to come in and your ability to influence other people from other departments where you may need to borrow a budget from HR or from engineering or IT in order to do things in security that's going to benefit the entire organization. You need to be a better communicator, right?

So people need to understand what you mean and how your security program is going to help them, right?

What's in it for me type of thing. So you need to show how security adds a competitive advantage to all of the other business functions working together to accomplish the end goal and the mission of your organization.

So I think in the 21st century, security leaders have to be much, much more than just a technical expert.

They definitely need to be more business-minded.

So, you know, you had mentioned those 3 things: technology, leadership, and then business knowledge. If we look over the past 15 or 20 years, right, people coming up through the leadership in security, cybersecurity, and whatnot, what area do you think has been kind of the strongest suit of those leaders, and what areas are kind of the worst? For the leaders we currently have in place?

Yeah, I think in the industry, it's been technical. We have a lot of very, very strong technicians. And sometimes some of the CISOs I've had, they still want to be hands-on for some reason. I don't understand that. They shouldn't have time to do it. But I think even me, when I became a manager, it was very, very difficult for me, right? Because usually when you are selected for management, it's because you are good at what you do. You're an outstanding individual contributor.

So you're doing it so well.

Now the business thinks, okay, we need to promote you so you can help other people do it.

But then you're like, these other people don't do it as well as I do. And they're going to mess up and they're going to need time to learn. Let me just do it.

So that is one thing I really, really had to learn as a leader, to really delegate and let go. But even if they make mistakes, that is okay. They need to learn through their mistakes and they need to learn how to do it too.

To the quality versus the standard of the organization, but then also not tell them exactly how to do it, but allow them to use their own mind and imagination.

And they may actually surprise you. I've been surprised a couple of times, by the way, some of my direct reports went about doing things to get to the same result.

So I guess you need to focus on outcome and also empowering people to do it because that also gives them kind of skin in the game, right?

I'm not just like a robot, but I actually have agency and I want to do something. This is my part of the puzzle, right?

I take ownership of this.

I think it gives people some pride as well. They wake up on Monday morning and they want to go to work because they have a project, the team depends on them, and they feel like, no, they are the only one who can do it. I think that really helps out with, again, the cultures that you are building for the security organization, but also the entire organization. So I really believe by doing those things, not only you improve the morale of the security team, but you also impact the greater culture within whatever organization and industry you are leading.

Yeah.

As a leader, I mean, I've always enjoyed the position of being the least competent in the room. I love surrounding myself with hugely competent people and I'm there to give the strategic direction, but they're the ones that figure out those tactical issues, right? In achieving that particular mission or objective. And I'm just kind of the orchestrator. I'm going to pull it all together. I'm not the smartest one. Oh no, far from it. But I'm organizing all these really smart and creative individuals. And then I get to learn, right? I get to see the magic that they can do. And I appreciate that. And I think, you know, they appreciate that. They appreciate being given challenging problems.

Opportunity, yes.

That they have to use their skills and their talents, and they feel accomplishment when they do.

Yes.

And being part of a community that recognizes that and embraces that. And even if you make a mistake, that's okay. You're still the smartest guy doing this, right? None of us could do any better. Yes. How can we help you? You know, that's a great environment for a leader to foster and for people to work in. That's the kind of team people want to work in.

Absolutely. So one thing about leadership is you really want your direct report to want to come to work. And then once they get there, you want them to want to do the very, very best that they can. And General Powell, one of my great leaders, is not with us anymore.

But he used to say, right, with management, You can only get to 100%. That's it.

That's the math. You can go over it.

However, with leadership, you can get people to go to 110%. Why is that?

It's because of the motivation and the will.

Because some people will do just enough not to get fired, just enough to do exactly what their job— have you ever gone to someone and they say, oh, that's not my job description? And I think that's not the right attitude to have. If you are in security, yes, security is what we hired you for, but you're supposed to be impacting finance.

HR and all of those other departments too.

So having the mindset, I want to help, I want to add value, makes a huge, huge change. So the first question you asked me, yes, I think technical skills is really where we've been stuck for a long time.

And I really believe we need to move into leadership. We need to move into business now more than ever before, right? Because the truth is security, IT, even the legal team, for the most part, we are kind of like cost centers to any organization. We cost a whole bunch of money. But we never bring in any revenue, right? So when I was CISO here in Silicon Valley for an AI startup, one of my main goals was to prove to the leadership that yes, security can at least help bring money, right? So being on those business calls, talking to prospective customers, saying, hey, you guys would not have got this deal if I wasn't around. It's because I convinced them that they could trust us. That's why they were able to sign in.

Or like one, One KPI I was using there, it used to take them at least 3 to 4 months from the time someone was interested in the deal.

And many times the reason why people wouldn't sign on the deal is because they wanted to make sure that their information would remain secure and private. And then when I got on board, I was able to show that we went from 3 to 4 months to only about 30 days. And that's what I was tracking. And that really showed to the to the leadership of the organization.

Yes, security is important.

We need to put more money there because it's actually helping us bring in more revenue. But that may not be like, for example, when I was CISO at Santa Clara University, we don't sell products, so there wasn't really anything I could do there. But whatever organization you work for, try to find a way, how can I bring value? How can I get all of the other business functions to trust and support and partner with security? To help them do their job more securely and easier. I think that's really the mindset you need to have. Starting to think as an entrepreneur in a way, but really being business-minded and using leadership skills, influence to affect all of the other people. Because the truth is, as you know, as a CISO, you have a lot of responsibility on paper, but you usually don't have any control over things that you are responsible for. And you really have to rely on the other folks to do the right thing. And I think it's going to play out where we are now.

Yeah. And I love that perspective of value, right? Providing more value. Yes. Avoiding bad things, you know, attacks and impacts and so forth. That's definitely important. Regulatory compliance also very important. But there is more to that story. And I love your KPI, right? The time to close the deal. That's a great KPI, right? Because you're contributing to that. And time is money and getting revenue on the books and all these things. And that's important to that business group. That's important to the C-suite. And that's important to the board and the investors they represent. So you're talking their language.

Mm-hmm. Yes. And we really need to get out of speaking technical jargon that nobody understands.

I think, again, that's another reason why I felt like I needed to go get a MBA so I could speak the language of business because I think sometimes senior management don't really understand what security does. It's like they put money there, it goes into a black box, they're doing something trying to keep us safe, but they really don't see the value. And in some of the jobs I've had as the head of security or CISO, I really had to prove to the leadership that yes, I need to be here and this is why, this is what I bring. And now we had the discussion when you were on my podcast where security is kind of like a losing proposition. Sometimes it's not very easy to prove something that didn't happen, right?

What is the value if you're saying, okay, we didn't have any cybersecurity incident this year and it's because of me, but how are you able to prove it?

Now, when I was at the Defense Language Institute, I was the EDU for their EDU network, right?

They've been on the DATML network for a very long time.

But as you know, DATML, a lot of it is classified. But even if it's not, they have a whole lot of security controls that they have to put in place, which made it impossible to learn languages like Russian, Arabic and Chinese.

So they couldn't go to any other site. I mean, they just, the teachers could not do their job.

So that's why they brought me in. They said, we want to go that EDU. However, because we are Army, we are DOD, we still need to make sure we put those security things in place.

Right.

When I was there, I kid you not, we're being attacked hundreds of thousands of times, almost a million times every single day. So what we were able to do to show to the commandant of the Base there is, okay, look, we get attacked this much and this is only what came through, but look at what our technology is able to stop.

And I was able to prove that by going through the logs of our IPS. And then we updated our whitelist often and we did a lot of things to prevent exploitation of our crown jewel of our data. But what I'm saying is try to think outside of the box and think of ways where you can prove that yes, the budget you are spending in the security program, it is adding a lot of value, and this is the value it is adding. I think that makes a huge, huge difference.

Relevance and value, right?

Yes.

And it's not just for security. It's for any organization in the business.

Absolutely.

You have to be able to show that. We are not immune from that. We can't just use fear. Oh, there's bad things going to happen. We actually have to show it over time if we want to be sustainable.

Yeah. And when you talk about fear, right? There is a thing, F.E.A.R.

Fear, uncertainty, and what is the—

Doubt.

Doubt.

Yeah.

So, and no, the sky is falling. The sky, like, remember Y2K, the world was supposed to come to an end. Oh yeah.

All the code programming. Yes.

And planes were going to fall off of the sky and all of that. But come to find out, no, none of that happened. So again, as a security leader, I think you have to be honest, right? You have to be frank.

You really need to be in a position where people in the enterprise can trust you, all of the other business leaders and senior management.

So don't overhype things.

Like right now, I think AI is completely overhyped. It doesn't make sense. But eventually, I think what we think AI can do is going to be able to do in time, but we are not there. Right now.

And of course, every vendor's now anything they did, like even back in the day, we used to do heuristic, right, with some of the security thing. Now everything is just labeled AI. So much machine learning. Now it's AI. Like everything they can think of, AI, AI, just because they can sell it. And some companies now are evaluated way above their actual value.

They don't even bring any money just because it's AI.

Oh, look at that. It is.

It's worth more than a billion dollars when in reality it's not even worth $100 million.

So we really need to stop doing that because in the long term, that's not going to help us, right?

We need to stay grounded, but we need to be frank and work with our teams and management to get the budget that we need in order to do the jobs that we can do. I think that's really where it comes down to.

You know, it's a great point. And I want to come back to the value. Of specifically leadership in cybersecurity, right? Leadership tends to have a much greater value in situations where you're dealing with chaos or unpredictability, ambiguity, intelligent adversaries, and so forth. And cybersecurity seems to fit that bill because we do have those things that we have to deal with. We've got people and technology and processes and adversaries. But if we look at the adversaries, and I kind of want your viewpoint here, what are the biggest areas around those adversaries or threats that makes them more dangerous in this cyber world? And you'd mentioned AI, right? They're using AI tools. But what is it about those adversaries? It's, this is not an IT challenge where we're trying to fix a server or network bandwidth or something we know how to do. You don't need leadership for that.

Yes, I think there are a couple of things. So AI, which we mentioned for sure, because with AI now, it's becoming very, very difficult.

I don't know about you, but I would say maybe 5 years ago, if you showed me a deepfake, I could tell you this is not real, this is just trash. But today it's extremely difficult to tell the difference.

Like even now with AI, I am building an AI twin.

Coach Bizzy AI is what I call him. Looks just like me.

But sometimes when you look at the picture of the photo, it's like, this is me. Like I can tell the difference between this generated picture and reality. And if a cybersecurity professional can't tell the difference, you know, what chance does the average guy out there has? Like I have to have special tools in order to tell for sure that this is fake and this isn't. So it is getting better and better. Like I just remember When it first started, when they would make representation of people, they would have 4 fingers, 6 fingers, and it was just so easy to tell. Yes. But today it's just not possible. And also they use AI to weaponize targeted phishing, misinformation campaign, and this deception and all of those things, which are things that people are doing right now.

And I think with a traditional cyber security team and tooling capacity we've had up to this point, it's going to be impossible to fight against this. There is just no comparison. So we are going to need to use AI tools too in order to build security and our defenses. Now, the other one is supply chain and third-party risk, right? Everybody remembers SolarWinds. So now instead of going downstream, they go upstream, and then from there, they infiltrate dozens of downstream victims. And for SolarWinds, they were there for what, almost a year?

And nobody even knew about it. So that's very, very, very scary.

And there is so much interdependence right now, right? Tools that you use for managing your infrastructure, all of your vendor, but not just your vendor, but their vendors and then the vendors of those vendors. So it's very, very, very complex, but there's definitely something I am quite concerned about. And then also, of course, identity and access. Exploitation.

And I'm sure you heard about those people mostly from North Korea, they've been getting some IT remote jobs and pretending to be things that they are not. And even acing interviews, there is now AI software you can use that's going to change your face. So now people are asking them to stand up, to turn around, to make sure they are real.

Do a little dance.

Yeah, it's just crazy. Would have you imagined?

No, it's like everything that was science fiction just a few years ago is becoming reality right in front of our eyes. So the risk isn't just data loss, I think is really eroding that trust and the customer, the partner, even the employees, right? They will abandon companies that they just cannot trust with their data.

Now, unfortunately in America, we don't have a good privacy law.

I don't know why that is. Maybe it's because of political reason. Europe is much, much better than we are. Now we have the 1978 Privacy Act, but that's really an outdated law that's not relevant for today's age. But I guess Congress doesn't have the will to do the right thing.

At least in California, we are trying CCPA and all of that.

But yeah, but we're going to get to a point where people are just not going to be trusting companies that cannot keep their data secure because it's just too much at stake.

So are you concerned about quantum computing moving forward? Do you think there's going to need to be leadership in trying to manage that potential freight train?

Yeah, that's one thing that really keeps me awake at night, right?

Because when we talk about security, we're talking about confidentiality, integrity, and availability. We've always relied on confidentiality because of all of the encryption and things, especially in the Navy Department of Defense. Now we go to war, we don't want the enemy to see what we are doing. And we really rely on encryption hardware and sometimes software. So with quantum computing, if you can break that encryption in like 2 seconds and you get access to everything, that's a real problem.

Even this is out there and this is not classified.

It is open source now, but China has a whole lot of our information that's encrypted.

They cannot get to it.

But data storage is extremely cheap, so they're just hanging on to it.

Once they are able to break into the encryption, they're going to get access to everything. So it is really crazy. Just know the horrible things that could happen. It's really funny.

I grew up a Christian, and when I was a kid, sometimes when you go to church, they would scare you, the end of the world and all of that.

But it's like I didn't see a way this world could end. I couldn't see a possibility. But now I can tell you of 100 ways we can end this world. Right now with all of the technology we have.

Actually, a few weeks ago, I was very, very scared with the conflict in Iran. I was extremely scared.

And thank God nothing happened. But just like that, that could have started World War III. And it's just amazing how this world is so fragile.

Even our democracy is so fragile. Like at any point in, at any time, things could just explode and get to a point of no return where life wouldn't be the same as we've come to know it.

So I guess we are living in very exciting time. I think there is a lot of challenges and a lot of threats, but there are a lot of opportunity as well.

So I want to make sure I say that too, because I am so glad I was born in this period of time in history.

Right.

I don't think I would have made it when my grandparents, especially my great-grandparents were alive, but right now it's very exciting. There are opportunity and there are things that you can do to improve to prove yourself and to position yourself in such a way that you become a problem solver and you become a part of the solution and not a part of the problem, right?

So you deal with a lot of people in leadership position and help grooming them and helping them either move into a position or elevate as part of that. So tell me, in the cybersecurity world, what does it look like when you don't have good cybersecurity leadership? Now don't mention any names here.

You don't need to.

But what kind of characteristics do you see? What kind of problems manifest with poor leadership in cybersecurity?

I think it's really in any field, but now cybersecurity specifically, when it comes to leadership, the definition I love is what my primary mentor tells me, Dr.

John C. Maxwell. He taught me that leadership is influence. Nothing more, nothing less. And I think that is so true. The ability to influence other people where they want to do the right thing, they want to collaborate with you. And they do not push back, especially when they see the value that it would add to themselves and their function. So when it comes to leadership too, I think another part of that in exercising influence is really emotional intelligence, right? Not just being self-aware, but being aware of other people, how you treat other people, your direct report, your supervisor, all of your peers, all of the other business functions across the enterprise. I think that makes a huge, huge, huge difference, right? I think Maya Angelou, I believe, was the first one who says, people will forget anything you said, but they will never forget how you made them feel. That's really the thing that sticks with them. So you want to be the type of person, the type of leader that people want around.

Oh, here is Bob Fabien Zinga. I'm so glad you are here.

You're going to help me solve a problem. You are a solution.

Not going to be complaining and bringing me more problem. I already have enough problem. Don't bring me more problem. Try to help me find solutions, right?

So that attitude of collaboration and treating people right, I think is going to make a huge difference. Some of the worst CISOs I have ever seen, they really didn't care about their folks.

And I think people know it, right? One example on a podcast this morning, I was saying one of the worst boss I've ever worked for, like after the weekend you say, oh, Bob Fabien Zinga, whatever, how are you doing? You start telling them, oh, this is what happened. It's like, okay, whatever. Okay, you are a workhorse, these are the priority. It's like work, work, work, work. We don't care about your personal life. We don't care if your wife almost died, whatever. You are at work.

We want you to work.

And that is not good because basically what that's going to do, your people are going to do just enough not to get fired, just enough to do exactly what you say, but no more.

Right.

But, um, when they, uh, that's why I really love the Navy because I can tell you for sure, the person to my right, the person to my left, if they need to, they are willing to take a bullet for me. I'm not related to them. I don't, I don't know them, but they are willing to do that. And I'm willing to do that for them as well. So how do you get a bunch of people to be willing to die for one another? I don't see that in Silicon Valley. Ah, where do you see it? Where people are willing to sacrifice for a much greater cause, for love of country, love of God, and the national— it's like, there's got to be a way to lead people so that they value something much higher than themselves. Because everybody is selfish.

That is our nature. But how do you get them to really, really value people and want to add value and go above and beyond and do it voluntarily.

That is really, really the key. Now, even in the Navy, when I got in 20 years ago, I think it was very much, you know, I guess let's say male toxicity.

I know I am the boss, I'm the alpha man. And, you know, I say you jump, you say how high, that kind of thing.

But really the truth, one of the best skippers I've had actually have been women. But the truth is, if you are really in charge, if you are a leader, you don't have to say much.

You don't have to raise your voice because people know that you are already a leader. And then when you open your mouth, when you speak, they listen to every single word that you say, and it makes a huge, huge impact.

So I think definitely knowing your people, loving your people, caring about them, but really, really caring about them.

I think that's really what makes the biggest difference.

Because even when you do that, when you go through hard time and everybody from time to time, you're going to go through a lot of challenges.

People are going to be willing to stay longer. To work harder in order to help the company and their leader and their function.

But if they are mercenary, they're just there for the paycheck. As soon as somebody else gives them $2 more per hour, goodbye.

Right? So there is absolutely no loyalty or trust or anything like that. And that's really not what you want. And even like in the Navy, for the most part, people in the industry with the same skill set make a lot more money, sometimes even double, especially in Silicon Valley. But those people are willing to stay. And do that work because it matters, right? So you really have to get to what motivates people, how to bring them in and get them to buy into your vision. It's simpler to say than to do it, but I think that's really the challenge of leadership. And those leaders, they can really do great and wonderful things with smaller and fewer resources because they they got the key that unlocked almost unlimited potential, and especially when people absolutely want to and not have to just because they get paid to do the job. So I think that's it.

Well, those are powerful concepts, right? Loyalty and trust and sacrifice. Do you think that is part of the evolving expectations that organizations have for leaders?

Well, in the industry, I don't know if you are going to expect that from everyone, but this is one thing I would say though.

I think it's important to have the right culture. Like in Silicon Valley, all of the startup and all of even publicly traded company I have worked for, they would have flyers about these are company core values and all of that, but that's nonsense.

They don't believe any of it because when push comes to shove, they just do whatever, and it's not aligned with the core value they said the organization believes in. Actually, even for most people outside of the military, just ask them, what is the mission of your organization? You ask 10 people, you're going to get 10 different answers. How is that possible? What are the core values of your organization? You're going to get completely different answers. But in the Navy, like this morning, I talked to someone who's been retired for more than 10 years. I say, what are the core values of SEALs? Honor, courage, commitment. It's like ingrained into our brain, like at the molecular level. I could be sleeping at night, you wake me up, my core values, honor, courage, commitment.

Ooh, yeah.

So, but in the corporate world, we don't do that.

I know exactly what the mission of Navy is, what the mission of my unit is, and what my portion of it is, what I need to do, what my team relies on me to do in order for the units to be successful.

So I think that has a lot to do with the culture and I think companies that do extremely well, they just have a much better culture and they don't order, but they encourage people to act the right way.

And when they do, they get rewarded accordingly. Now, one simple example I'm going to give you, how many times have you seen someone get promoted, get rewarded just because they did one thing the company wanted as part of the mission, bringing in revenue.

They are horrible to their staff, but still they bring in too much money.

We are not going to fire them.

In our core value, or even the HR handbook, we said this is not acceptable, but still we are going to promote them and not promote somebody else who is completely aligned with what you say are your core values.

So I think what needs to happen is the company needs to really be authentic and have integrity and really do what they say they do. It doesn't matter who you are, even if you are the CEO of the company, these are the rules, this is what everybody needs to abide with. So you have to lead by example. And the minute you stop doing that, I think what's going to happen is your best people are going to be looking for a job somewhere else. They're not going to complain, they're not going to say anything, they're just going to get another offer and get out of it.

So I think integrity is extremely important.

If you have core value, really think about what those core values are and what is the culture that represents your organization. And then you have to stick with it no matter what, no exception. And I think that's going to allow a lot of organizations to improve significantly.

I think that's kind of what happened at Microsoft when Satya became their CEO.

Microsoft came from way, way, way back to now becoming again, you know, one of the most valuable companies in the world. I talk with a lot of the executives, just the changes that went through with this leadership, it was just like night and day. Nothing wrong with Steve Ballmer, who was president before, but definitely the leadership style completely different. Many of them were very scared to go to work and to do the right thing, but now it's become a learning organization.

It's okay to make mistakes.

As long as you learn from those mistakes, right? Kind of like we do in Silicon Valley, where you have psychological safety. You can ask questions. Just because I'm your boss doesn't mean that all of my ideas are correct and I need to be challenged.

Now, respectfully, professionally, but I do need to be challenged at times.

So building that environment where people can speak up when they need to, where they don't feel threatened, where they feel they are being cared for, I think that really goes a long way into making everyone productive.

But again, that's not a technical thing.

That has nothing to do with setting up firewall rules or anything like that. But it's really dealing with people. And like we say, people are the most important resources, asset of the organization. But guess what? The very first time that an organization goes through some financial difficulty, first thing we're going to do is lay off half of the team.

It's like, okay, then you didn't mean any of that. You know, and like one company I work for, one of the core values, I'm telling you on paper, I'm not kidding.

Dinner at home with your family.

I'm like, wow, I've never seen that for—

I'm like, that's wonderful.

But guess what? Most people stay at work at 7, 8 PM still working and nobody ever—

and then the day you start to go home to have dinner with your family, people look at you like cross-eyed.

Like even they have things like, okay, in this company, this is so wonderful. We don't have vacation days. You take as much vacation as you need. As long as your supervisor is okay with it, you can even go for a year if your boss agrees. But the minute you take 2 weeks vacation, like, what's wrong with you? Where have you been? We need you here. So it's like what they're saying doesn't match with what they are doing.

And I think as a leader for your security function and for your organization, you need to start doing, mean what you say and live by it. I think that's going to attract a lot of people who want to add value and encourage others.

Well, that kind of organizational level cultural change, completely powerful, right? Do you think the cybersecurity leader, do you think they're in a good position to drive that kind of change across the organization?

I think they should. As a CISO, I think that is really part of my job.

Now, again, of course, there are some things that are completely outside of your control, right? Especially when it comes to budgeting and things like that. But one thing you can do again is use your soft skills, your influence to try to persuade people to do the right thing.

Now, it's not always easy, but I think it is a must because we are like in the Navy, for example, a lot of time we really are in a, not only a constrained environment, but we get attacked quite a lot, right?

So there is not really a lot of room to make a lot of mistakes.

So you really have to utilize the resources you have to the very best of your ability because there is this, I guess, asymmetrical warfare now with technology. The price of technology is getting cheaper and cheaper, storage and hardware and all of that. So you don't even have to be a country, you don't have to be a nation state, you can just be one individual.

You could spend maybe $5,000 or something and you can build something that is powerful enough where you can do a lot of damage. So we are living in a world now where I think with the advancement of AI, emerging technology and all of that, where it is becoming easier and easier for people to use the tools available to them to cause great harm.

And the problem with being a CISO is You have to be right 100% of the time, but the bad guy only has to be right one time.

If they can succeed just at one time, they could take the entire service down.

So it is very, very challenging. It is not easy.

But I think as a security leader, you need to do the very best you can to really influence your peers and senior management, senior leadership of your organization.

You really need a true seat at the table.

In many organizations I've been in, they say the CISO is an executive, the chief something, but in reality, it's not the C-level anything.

It's just a director or a senior director in reality, because they're not even invited at some of the meetings that are critical for the strategic goals of the company, which doesn't make any sense. So I guess you have to bring in your own chair if you have to, but at least you have to be in the room, even if you don't say anything.

You at least need to know what the company is doing, where they are heading, so that you can come up with a plan to have mitigation controls in place to safeguard the data of your company.

So I think it's important if you are a CISO to be a real CISO, and the C really needs to mean something.

And I think it starts with influencing your peers and all of the other people across your organization, right? You have to be visible and you have to have a desire to be helpful.

I don't know if I may have mentioned that earlier, but one of the first jobs I had here in Silicon Valley, it was impossible to find the security team. You couldn't find us anywhere. Because, you know, like in Silicon Valley, in most companies, it's almost like it was architected by the same architect. It's like open space.

Everybody has those desks there and working together.

Now, senior management, like the CEO, may have his own office or or something, but even in Ministero, the CEO is even out there with everybody else. But in this company, security was nowhere to be found. You had to go far, far, far on the other side of a building on another floor in order to find the security team. But even when you took the time to take, you know, 10, 15 minutes to walk all the way there, you couldn't get in the room. You had to have a special key that only the security folks, geeks, had. So it was like we were telling them, we don't want you, we don't need you, go away. We are not here.

To help.

We are our own silo doing our own thing. And then all they would see would be an email from senior security engineer Zinga telling them, hey, you are doing bad. You need to patch your system. What are you doing, engineer?

So, and then those people would just ignore me because they're like, okay, who are you?

I already have too many things to do. I'm not going to add on to what I'm doing. So this is a real example that happened to me and I really had to learn from it.

So what I ended up doing is, okay, most of the engineers, I was in Palo Alto where the HQ was, but most of the engineers worked in San Francisco.

So what I decided to do every first day afternoon, I would leave Palo Alto, actually no, first morning. Actually, I wouldn't even go to Palo Alto.

I would go straight to San Francisco every first day. I would spend the day there. They got to know me. I got to know, as you know, Agile methodology, they do a lot of pairing and stuff. So they got to put a face to a name and see that I'm a real person and I really care about them and what they're doing.

And also, no, feeling empathy, again, that emotional intelligence, being aware, yes, I know it's tough and you have a lot of things to do, but listen, this is very important. What we are doing, if we don't do this, you know, we could get hacked and then, you know, especially this company, we were definitely going to go public and everybody was going to make a small fortune.

And if this happened, that's not going to happen.

So it's in your best interest to help me do that. So anyway, With time, they started trusting me.

And then when I send those emails, it's like, okay, I know you and I know where you're coming from. And then we'll work together in order to solve those problems. But so I guess in a small way, even as a security engineer, I was able to impact the culture of my world. Maybe not at the CEO level or the vice president of engineering, but they are engineers, the senior engineers, they knew me and I had definitely an impact on them and they had an impact on me. So I think No matter where you are at whatever level you are at, it doesn't cost much, right? To be kind, to reach out and to try to help.

Nobody is going to say, no, I don't want help from security.

Actually, they're going to be glad if you offer some type of help and then vice versa. So it's that culture, I think, that really needs to be built. And as a security leader, I think you have to be in front of that. All of that.

Well, it sounds like you, you know, went out of your way to build the rapport and to be able to show and communicate that value of partnership. Yes. And that you're all in it together. It's teamwork. It's the opposite of getting a phone call from somebody behind a locked door that's just telling you no, or you're wrong, or go fix something. It's somebody that's with you and accessible and wants to help you and wants you to be successful. I want you to be protected against these other bad things. You're on the same team and you have that trust. And that, again, emphasizes that value to them, to their project, to their team, to the company, to the shareholders, investors, or whom, you know, whatever. Hugely important.

And like, even when I was enlisted in the Navy, right, when I became a commanding officer, my two leadership maxim, which, you know, I guess sometimes you don't even have to be sat down and taught, you know, you, you, you just, you just get it. I mean, it's like you're just in such an environment that's dynamic where it happens every day that you, you just become what your environment is. So two leadership maxim I've grown up with in the Navy is, uh, uh, mission first, people always. You cannot accomplish your mission Without your people, you take care of the people, the people will take care of the mission. Extremely, extremely important. And then the second one, I think that's just as important is one team, one fight. You alluded to that.

It's not us against them.

It's us together. How can we work together in order to do this?

And so it's like, you know, when there is an incident or problem, it's not blaming someone.

Okay, this is the problem. How do we solve it? And then what can we learn from that?

And whenever we have a lot of after-action report and all of that.

We always go back, like the X-Pilot I talked to today, for every single mission they had, even when it's extremely successful, first there is a debrief and then they go to the execution. And then after that is the after-action report, always what went right, what went wrong, and what can we do better. So it's, I think that learning culture, that really makes a huge, huge difference for any organization.

Continuous improvement cycles.

Yes, absolutely.

So cybersecurity is ambiguous. It's expensive. It creates friction to the business. So what messages do you communicate to those other C-suite officers and to boards to help them understand how they can help make cybersecurity successful, valuable, and sustainable over time? What messages do you give to them?

Well, I think as the CISO, you definitely need to elevate security to the business level. I think that is a must, right? There's no if and but about it. You are a business leader, one who leads one of the other business functions within the enterprise. And you really have to integrate cyber into enterprise risk management because for most businesses, they understand financial management very, very well. And I think you can handle cyber risk, IT risk, the same way you do financial risk.

It's really the same thing.

And being able to talk in that way, in a language that your peers understand that senior management understand the thing is a huge plus.

I think the pro and the con, and again, sometimes you don't always have the last say, but they should definitely listen to you and your recommendation.

Okay, if this is what you want, the budget you've given me, I can give you that. But if you give me more budget, this is what I can give and here are the risks. Now, one thing I've had to do, especially in Silicon Valley, because sometimes I'm afraid they would hire a CISO just so that you'd be the scapegoat when something goes bad.

They don't give you the resources, they don't give you the people, they don't give you the budget. And then when anything goes wrong, oh, you did it, it's your responsibility. So what I started doing was, okay, I put it in writing.

Hey guys, red flag here.

This is an issue.

We really need to get to this. And then what I would do, I would say, this risk is moving from the cybersecurity function into the sales function or engineering or whoever actually owns the the system and the responsibility to patch or whatever it might be. So I officially move the risk from cybersecurity to over there.

So if anything goes wrong, don't come to me because I am telling you this is a problem and we need to do something about it.

I used to meet with my board once a quarter and those things I would elevate to the level of the board, right? Because the board job is to oversee risk so that they can maintain the fiduciary duty to the stakeholder and All of that.

But the thing is, if things are bad and the only person who knows, and in most organizations I've been in, cyber reports to IT and your CIO is like, okay, whatever.

And then it just cut it off there.

It never goes to the other C-level executive, definitely never goes to the board.

So the only one who knows is the CIO is not going to do anything about it because he's your boss anyway. So it could shut down and go back doing whatever cyber trick you are doing. That is a problem, right?

So again, it's the culture, elevating cybersecurity to the business level, but really investing in the culture too, not just tools, right?

Training employees, cybersecurity awareness, doing drills, tabletop exercises.

Like one thing I love to do was phishing campaigns.

And some of them was a little bit, risqué, but that's what the bad guys do, right?

I guess sometimes you may have to clear it up with legal.

Like, for example, this one time for this one company, I knew this was going to almost get me in trouble, but it was important that I did it. It was about bonuses and bonuses is huge, especially in Silicon Valley, because sometimes your bonus could be more than your annual salary.

So, uh, I tricked them.

I made it sound like it came from HR that they were going to open this file. About their upcoming bonus and about half the people in the company did, which was wrong because if it was malware, we would be in big, big, big trouble.

So that was a great learning exercise.

HR didn't like me after that.

But whatever you can use to kind of gamify cybersecurity, because sometimes cybersecurity privacy is kind of dry, but kind of make it fun, make it where people want to be engaged and they are learning something. I have really never had a cybersecurity training where people would sleep on me.

Never, ever.

Because I try to really keep the energy very, very, very high and also get feedback from the audience.

It's not like going to a great lecture. I am the boss and I am in charge and I'm going to speak in this monotone voice for one hour and you, my pupils, take notes and learn from the master.

No, no, no, no. It's like back and forth because I can still learn from people, even people who just got started in their profession because they have, you know, experiences and viewpoints that I do not have and that could help.

Anyway, making it very engaging, sometimes even funny, within reason, but just getting people engaged and interested. Like, why do I need to listen to you for 1 hour to talk to me about cybersecurity?

Show them what's in it for them, not just at work, but their personal lives too, right? Some people, like for example, one thing that happened to me and that happened to a lot of people in the military.

I'm sure you heard about, um, OPM.

There were, there were—

Yes.

Yeah. And anybody, everybody in the military at least has this secret clearance. So my social security number, all of my background investigations file with somebody in China. So what can I do about that? So that impacted me very, very badly, even today. But now what's even worse now, I raised my hand.

I wanted to sign up. I wanted to be enlisted and then an officer, but my wife didn't raise her hand. My daughter didn't raise their hand, but for them to do the investigation on me, they have to get the information on my spouse and family. So now even my daughter's social security number is on somebody's home computer in China.

She, that's, that's just unacceptable. Right.

So when people understand how it could impact them financially and personally, then they pay more attention.

Yeah.

This stuff is important because is going to prevent me from going through this heartbreak. So I think that is important. And then the other thing we kind of touch on too is adopting a continuous intelligence-led learning organization, just moving beyond just the annual audit and this type of thing, but really paying attention in customer retention and market confidence. Because when you talk about customer, any C-level executive is going to be absolutely excited about that.

When you talk about revenue, they're absolutely going to love you. So trying to find a way for cybersecurity to support that.

And I think that's really what's going to make a difference going forward.

So you've covered so many different areas, so many different topics, and cybersecurity leaders already have a ton of things to to do and things that are broken or need to be improved. So my last question to you, how should cybersecurity leaders, the ones that are listening to us right now, right? How should they act to take advantage of opportunities? How should they proactively manage risks right now? What's the one thing you would recommend them to do tomorrow morning?

I think 3 things in the world we live in. So like you said, the bad guys are already using AI and it's almost like asymmetric warfare against us. So we need to use AI too in order to combat that. And I know a few CISOs and security professionals who just think AI is a fad and stuff. They don't want anything to do with it and they think it is too risky and which it is, but I think you have to use it, you have to understand it and you have to play with it.

Nice, safe environment.

I think there is a lot of control you can put in place to ensure that your data doesn't get out of your storehouse.

Because the truth is your people are using AI right now, right now they are, whether you like it or not, whether you have a policy or not, they are.

So you need to embrace it and help them do it in a safe and secure way. Yes, we can use AI.

These are the tools we have approved and so on.

So I think you have to lean into it. In this day and age, I don't think there is a way around that. Lean into AI. But the other thing that's extremely important, I think, is really raising cybersecurity to engage with the board, right? Above just senior management going to the board to translate threats into business terms, right? To align security with revenue, revenue, revenue, revenue. I think my job as the CISO is to help bring in more and more revenue.

Don't be a friction to that, right? But do it in a safe and secure way and think, okay, maybe we cannot do it this way because this is way, way too dangerous, but I propose maybe we can do this this way.

Risk are reduced and it's the acceptable level of risk for our organization.

Again, you don't have the last word. If the board decides they still want to do it, make sure it's in writing.

You told them, you know, whatever happened, they don't need to come here and fire you, right? You did your job, right?

And I think executive sponsorship is very nice to like, we had the discussion on my podcast about where should the CISO report to? I think the true answer is to whoever is a senior executive in the organization who cares the most about security. If you have someone who cares about security, whether it's the CFO or legal or engineering, if they do, I think that's where the CISO should be reporting to because they're going to give you a lot of top cover, right?

They are going to stand with you when you are against all of the other members on the board who don't want to. Do security because it's going to slow them down and reduce sales. Someone who can impact the culture and kind of like nudge the organization in the right direction. I think that is important. So when you start a job, first 90 days, try to figure out who those people are.

And it doesn't always have to do with your title because you can be a director, you can be a vice president, you can be a C-level, anything, but nobody listens to you.

Everybody ignores you. I mean, you can even just be an engineer, an analyst, I mean, everybody flocks to that person because of their personality, their influence.

They don't have a title.

They are not a leader in the organization, but because they impact people and they make them feel a certain way, they listen to that person. So I think it's good to have what I call cybersecurity champion in all of the other functions, where it's not just you, but you have people in each one of those departments that are going to value and elevate security in finance, in HR. Or whatever function they belong to.

And then I think the last thing, most important, we kind of talked about it throughout, but it's really investing in people. Mission first, people always. People are your greatest asset. We know that intellectually, but sometimes we don't know that in our heart.

That's not how we live our life, right? So people need to upskill their skill, provide money for training where you're like, okay, AI is not going to take your job, but we're going to teach you to use AI to be more productive so you can be more strategic and let AI do most of this tactical stuff, especially things that are repetitive that you can use automation for.

Like the first Silicon Valley company I worked for, we had a great saying there.

We always try to eat our own dog food. But if we have a software, a tool or something that we do manage, or because we were part of a, I guess a conglomerate, our parent company owned a bunch of other software companies too.

So if we didn't have it in-house, then we would look at our sister company if they had something, if they did, there is no way we're going to spend our money with Microsoft or with somebody outside of our ecosystem.

So we eat our own dog food first. And I think that is a great thing to, a great mind to have, try to maximize the resources you have, not prevent people from doing what they want to do because they're going to get to do it anyway, but give them the tools that are approved, that have been vetted in order to do it.

Yeah, you want to do this with this software.

That one is not safe, but here's another one that is safe that's been vetted. You can use that. So you still get to get your outcome and we are supporting you into doing that, but just in a safe and secure way.

So I think that is important.

And for me, from my own personal experience, I think it's also still important to prioritize diversity. It's not just being Black, white, women, disabled, gay, and all of that. That's important too, but definitely diversity of thought, right? Because one problem I've seen in a lot of Silicon Valley company, they tend to hire people who have the same experience and background as themselves. Or sometimes even at one point, Facebook was only hiring people who came out of Stanford for some reason.

I think that's a huge, huge, huge mistake because basically everybody that is coming on board into your organization, they all think the same way. So basically, if you have a blind spot, everybody on your team has the same exact blind spot. So you need somebody who thinks differently, who's going to tell you, hey, no, I see something that's not right here.

We need to think about that. So diversity is extremely, extremely important. Also, you know, generation today, I think we have what, about 5 generations working in the office now.

Old people don't want to retire.

We have presidents who are about to die off in office because they just don't want to retire for whatever reason.

So, and then you have brand new kids like my children, Gen Z, they're now starting to work in the industry and it's like a a bunch of people from different generations, different motivations, different backgrounds.

But I think that diversity definitely helps you make better decisions and ultimately be more successful.

No, I absolutely agree. You have to break that echo chamber. So thank you, by the way, so much for sharing your cybersecurity insights today with us, especially around leadership. Very much appreciated.

Yeah. And I think the last word I would say is lead with humility.

Especially when you become a CISO, sometimes, you know, it can get to your head. I'm at the top of the food chain. I am the man. But the truth is, no, you are not the man. You are the servant. Your role is to help and serve the people who are working with you, give them all of the tools, all of the opportunities that they need so that one day they too may become a cybersecurity chief. So I think being humble, knowing that you are not the smartest person and you don't have all of the answers. I think that is going to help you more than anything else when you are at that type of leadership position.

Because my mentor, again, John C.

Maxwell says, if you are the smartest person in the room, you are in the wrong room because you're not going to learn anything. You need to get to a room where you are not the smartest and where you listen more than you speak. So you have to be humble, but always willing to add value. So that's all I'm going to say. And thanks again for inviting me to your podcast. I've been trying to do this all a while, so it's really great that we're able to make it work today. So thank you.

Absolutely. And Bob is the Head of Information Security, Information Warfare Command for the U.S. Navy Reserve. And he has an incredible podcast as well, Leadership and Success Podcast with Coach BZ on LinkedIn. So be sure to check that out as well. And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders, to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.

Thank you for listening to the Leadership and Success Podcast with your host, Coach BZ. If you like what you heard, please subscribe to our channels and come back for more wisdom nuggets on how you may develop into a better leader and achieve greater level of success. Leadership is the most critical skill. The world will always need leaders to lead others, deploy the next disruptive technology, or execute a business strategy. You may as well decide on counting yourself among the 21st century leaders. See you right here next time on the Leadership and Success Podcast with Coach BZ.