S4:E74🎙️🔥 LIVE with Richard Stiennon

Hi, I'm John Maxwell. When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation, I'm proud to say, is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend Bob Fabien Zinga.

Welcome to the Leadership Success Podcast with your host, Coach BZ, where we help you lead with purpose and succeed with impact. If you're ready to grow into the kind of leader others want to follow, this podcast is for you. If you're determined to elevate your success and leave a lasting legacy, this podcast is for you. As my mentor, Dr. John C. Maxwell, reminds us, everything rises and falls on leadership. Our goal is simple: to inspire you, challenge you, and equip you with insights that can transform the trajectory of your leadership journey. Welcome aboard to another episode of the Leadership Success Podcast with Coach BZ.

Hi, I'm Richard Steenen. I'm an industry analyst with my own firm, IT Harvest. I'm a podcast host with EM360, and I cover the cybersecurity space. I've been in cybersecurity since about 1995, and about 15 years of that as an industry analyst. Back in the '90s, you know, there wasn't a career path into cybersecurity. It was kind of being born around us along with the advent of the internet. And as soon as I got into the internet, I just fell in love with it and had to shift careers away from automotive engineering into networking. And then from there I went to PwC. So, you know, by the time Gartner hired me as an industry analyst, I was all in and only focused on security for the last 22 years. The thing that fascinates me about cybersecurity and the industry is that we have a adversary. We have threat actors that are constantly evolving and upping their game in the arms race. We can't determine what's going to happen next because the threat actors are out there on their own also deciding what they're going to be doing next. It's easy to track me. You know, I'm @cyberwar on Twitter. You can connect to me on LinkedIn or follow me on LinkedIn. You can go to my website, it-harvest.com. You can look at my app, which is Dashboard boards.it-harvest.com. And then I curated an entire history of the cybersecurity industry in my book, The Security Yearbook. It includes a directory of all the cybersecurity vendors. So Security Yearbook 2022 is out now, recently published, fresh off the press. And in the meantime, you know, 2021 and 2020 are still available as every year I refresh the data and literally yearbook, so I cover what happened in the previous year.

All right, uh, just so that, uh, everybody knows, uh, actually there is an update to the, uh, yearbook. So we have, uh, uh, 2025 Security Yearbook History and Directory The IT security industry. So I hope everybody is going to get a copy today. So before I introduce my guest today, he is a legend in our field. Let's start with our moment of gratitude, as is our custom here on the show. So that's where we just take one quick moment and we want to be grateful every single day. So every time we meet, we just want to take a moment and be grateful. So if you would, maybe close your eyes and put yourself in your happy place and maybe take a deep breath like we learned yesterday, um, and think about one thing you are grateful for right now. And today I am so grateful that we truly stand on the shoulders of giants like the person we're going to be talking to today. Cybersecurity, I guess today, is a real profession, but when I started, what, 28 years ago, I think it was more like a hobby than anything else. But now we are definitely at the C-suite level. We have Chief Information Security Officer or Chief Security Officer in most organizations. We definitely have a seat at the table. It is a real profession today, and I am so glad that our guest today is really one of the most preeminent cartographers of our industry. So let me see if I can properly introduced him. So I am really overjoyed, privileged, and honored today to be introducing to you Richard Stannum, one of the most respected voices in cybersecurity, industry analyst, author, and founder of ITARverse, which over 3 decades of experience spanning vice president of research at Gartner, CMO at Fortinet, and vice president of threat research at Webroot. And as the architect behind one of the most comprehensive cybersecurity industry intelligence platforms in the world. So that's on dashboard.itarvest.com. So Richard has helped leaders see the battlefield clearly before making mission-critical decisions. He's also the author of the powerful new book, Guardians of the Machine Age: Why AI Security Will Define the Future of Digital Defense. It could not have been more timely. So this conversation matter. And ladies and gentlemen, please help me welcome to the Leadership Success podcast, Richard Stenon. All right. Good morning, Richard. How are you doing today?

I'm doing great after that introduction. Thank you so much, Bize.

Fantastic. No, we are so glad. So glad you are finally here. And maybe to get started, what is one thing you are grateful for right now?

I was thinking for this, you ask an industry analyst a question, you're going to get a long answer. I was thinking back to when I was a very young man. I must have been 24 years old, out of school, but I had my, my own startup. And I was invited to Michigan Business School to talk about entrepreneurship. So I'm up there on a panel with, you know, I'm an entrepreneur and that I've got employees working at Pontiac Motors. But sitting next to me was somebody who had successfully started an internet business and sold it already. And we're talking, you know, like '83, 1985.

Wow.

And everybody asked the question, or somebody asked a question, what is the key thing that takes to start a business, to be an entrepreneur? And I forget what I said, but the guy next to me said, a loving and supporting spouse.

Hmm.

And I remember just feeling that, you know, in my chest, because at the time I didn't feel that I had that. So fast forward a couple of decades and I do have a loving and supporting spouse, and that's what I'm grateful for.

That could be life-changing for sure, especially if you marry the right spouse, right? I was doing a study of the Book of Proverbs. Something that I find so funny in Proverbs, it talks about there is nothing worse than a— which word, which adjective did it years, but basically a woman who just can't stop blah, blah, blah, blah, blah, blah. So he was saying something like, it's better for you to live on the top of a rooftop than to be in a boiling woman, than to be in the house with a boiling woman. So hopefully what we want is Proverbs 31, the virtuous woman. And it's true. When you marry well, your life is so much, so much, so much simpler. Wow. That is so powerful already. So is there something about you that most people may not know?

Um, yeah, I was president of the University of Michigan Juggling Club.

Wow, that's pretty impressive. And also, you told me in the green room— I couldn't believe it— you've written more than a dozen books about our industry. But, uh, one reason why you didn't want to go for your master's back in the day was because of a dissertation.

Yeah, yeah. So I was, um, I all the way through high school, all the way through my life I've dealt with procrastination. As you know, just as I really feel for people who can't complete things because that's so difficult to believe today.

Wow.

Everybody says, oh, how could that be? Because you're so productive. But man, I, in college, high school, grade school, high school, college, I would not complete the assignments. And wow. So I got through aerospace engineering school without doing any of the homework assignments.

Students.

Luckily, I can make up for that because I'm really, really good at taking tests. Yes, I can pass exams but not get the points for the homework. So I didn't think I could ever get a master's degree because at the time they all required a thesis or dissertation. But then, you know, when I launched— relaunched IT Arvis in 2008, I decided I need to write a book. So I The, the one on the screen here, Surviving Cyber War, that was my first book. And if you think about it, it's a contemporaneous history of, uh, nation-state attacks.

Wow.

Which was made possible by the occurrence of the invasion of Georgia by Russia, right? Because there was cyber attacks that went with that, which met my definition. My definition of cyber war is, you know, uh, network and computer attack in support of military operations.

Yes.

So if it's two warring cybercrime groups, that's not cyberwar. If it's gamers shutting down access to the internet, that's not cyberwar. It's got to be, it's got to be military groups engaging. So, so that was my very, very first book, and I realized, hey, if I can write a book, I can go back to school.

Yes.

Get the academic foundation so I can realistically be a historian. It turned into my third book, There Will Be Cyber War. So this, this is basically a dissertation.

Yes. Wow, that is really, really fascinating. And especially we talked in the green room as well, you've never been in uniform. Most people in the industry, they don't even know what cyber war is. And they usually don't even think about nation state or anything like that when they think about their risk register and what type of threat they might be facing. So to me, that's really, really interesting and fascinating. So what do you think, why were you, how can I say this, attracted towards cyber warfare? What was the insight?

Yeah, well, it was the intersection of my profession, which is cybersecurity and cyber defense, with my interest, which is warfare.

Right.

I've, you know, I've been reading classic warfare texts since I was probably 12 years old.

Fascinating.

And so, and I, you know, I'm a real believer in, uh, the close, um, marriage between warfare and technological innovation. And of course, you know, tons of examples out there, but even, you know, modern organizational structure was modeled off of Napoleon's introduction of staff organization to militaries. And that just permeates, right? We're seeing it in action right now in Ukraine as drone technology is, you know, being innovated faster than ever before. All these bunch of people's lives depend on it. And so, you know, it's Ukraine's existence depends on them innovating faster than anything else.

That is really, really fascinating and quite insightful because you're right, I guess Russia invading Georgia is really where I think cyber warfare was born and then Estonia and of course today Ukraine because even in the Navy prior to 2010, it wasn't really a focus but in 2010 is when we stood up what we called back then the Information Dominance Corps, then we found out quickly we didn't dominate anything in the information space so we became the Information Warfare Community but that's my specialty, that's what we do. It's definitely changed the way we do warfare. Even what we did in January, and I think the first time, I believe, in our US Armed Forces, we're starting to use artificial intelligence when we went to Venezuela. And now, of course, we've used it again in what's going on right now with Iran. But it's just, it's almost like mind-boggling how the computer age, artificial intelligence, and emerging tech is really at the forefront of warfare, modern warfare today.

You'll love reading this book because it all hinges on— and the whole thesis is that if you research, you know, revolutions in military affairs, I call it the cyber revolution of military affairs, you'll always come back to a single academic article written about network warfare, and it cites, you know, an example. The only example that's cited is about 1995. The U.S. deployed a carrier group to the Taiwan Straits during a very tense time, and they used the internet in order to coordinate that activity.

Wow.

I tracked down the Admiral of the Fifth Fleet, I guess it is. Um, he was first, he was a one-star, and, and the one-star, you know, in the Navy gets the IT operations. He had a little MacBook that he wandered around with in the halls of the Pentagon and, and on Capitol Hill, and he'd take meeting notes and then he'd print them out, you know, before he left, and people would start asking him for copies of the notes. And so when he was appointed, um, to the Fifth Fleet, he commandeered the command ship and gutted it, tore out all the bulkheads, literally getting rid of the silos that separated them. And back then, you could just imagine it was, you know, a bunch of Silicon Graphics machines for cartography and a bunch of Solaris machines for something else. Rip them all out and replace them with Windows NT.

Wow.

And he built a direct report command staff, and he picked one from surface, submarine, whatever the other division. Yeah. And the only requirement was that they had to have an email address.

Wow.

They all had AOL email addresses. That qualified them to be part of this new warfighting group. So that was all stood up. They had to commandeer satellites. Intelsat was taking some offline. Because, you know, the NSA and CIA didn't let them use their satellites. So they got their own satellites positioned over the Pacific to communicate at, you know, some ridiculously low baud rate. And they coordinated all their activities. And as a matter of fact, at one point, there was a commander that refused to read his emails. They sent him a message that basically, if you don't read this and show up at this meeting, you know, next week in Okinawa, You're gonna lose your job. And that's how they forced, you know, do your email. And that's how they pulled together and could coordinate with the Pentagon deploying two carrier groups to the Taiwan Straits.

That is really fascinating. I mean, that is the story of my own branch of service, and I didn't even know that. That's just— wow. Yeah, that is powerful. Oh, by the way, the reference I was making— thank you so much, Collins. Proverbs 21:9, better to live on a corner of a roof than share a house with a quarrelsome wife. But anyway, hopefully those watching have a spouse, man or woman, who's not quarrelsome. But anyway, so that is really quite fascinating. Which moment do you think made you realize that this wasn't just information technology, but this actually was warfare in a different domain, but absolutely warfare.

Yeah, it's, um, it felt like Estonia, uh, that, right? That's when, when I started to pay attention. I had already been following, uh, Titan Rain, which was Chinese infiltration of mostly U.S. government research labs. That started 2004. Um, Estonia was, uh, 2007.

Yes.

And there was a lot of information, um, uh, kind of warfare going on, but not cyber attacks. And they— so to write my first book, I had to go to Tallinn and, you know, interview the people that were involved in stopping the denial of service attacks that were going on.

Wow.

Um, but there was no military engagement, right? It was cyber. And so that's different, right? That's maybe, you know, Thomas Reed, who taught for a while at King's College and now is at Johns Hopkins, would argue that, well, that's not cyber war, right? There's no convergence of forces and harm done.

Yes.

That Clausewitz would demand to meet that requirement. So he would say that's just disruption, something like that. But it was a year later that the impact, the invasion of Georgia, uh, came out of South Ossetia, you know, Russian territory. And that was literally tanks rolling across the border, which I remember back in 2000 saying there is no cyber warfare. Um, that's— that was on my hierarchy of cyber threats, you know, the top one was cyber warfare.

Yeah.

And I would say there is no cyber warfare because there are no two networked countries where that are bordering each other, where then I don't expect tanks to be rolling across Canada, right, into the United States. Yes, obviously 10 years later every country was networked, and it's an— it was, uh, that, that, uh, tanks would roll across the borders supported by cyber effects of some sort.

That is just fascinating. I mean, I am so glad I am living in the 21st century, the age of AI, because I mean, every day we have new challenges and a new way to apply technology to warfare or medicine. We can do good or bad with it. But you also founded one of the first ISPs, right, to advising global CISOs. What leadership lesson has remained constant through all that change?

You know, I don't think of myself as a leader of people because I've, you know, biggest team I've ever been in charge of is 25 people or something.

Well, you are definitely affecting CISOs all around the globe. So yeah, yeah.

So, but I do gravitate towards thought leadership and, and have, you know, been called out for that. Because I— but the principles behind that is to look ahead all the time and always assume that what exists today will change, because change is the norm for us. It has been my entire life.

Yes.

And do not ever feel nostalgic for the way things used to be, you know, because that's backwards thinking and invariably leads to, you know, just bad stuff when you start to force your image of your childhood onto the present day, which we're suffering through right now from a lot of Federalist types. So it's that looking ahead and accepting that things are going to change. So right now we're, you know, we're still in this debate that is quickly coming to closure, thankfully. But I know last year when I started when I wrote my first piece on AI security, and I made all sorts of predictions about where it was going because the, the— it was all based on this idea that, hey, the internet, the AI is becoming, uh, more and more powerful. Every, every 3 to 4 months it's doubling in capacity. So the intelligence level, the grades it gets on all these tests, doubling every 3, 4 months.

That's amazing.

When you have something improving that fast, it's going to impact every corner of our lives, especially digital ones, and cybersecurity is all digital. So therefore, I just said, okay, let's take their scenario planning and apply it to cybersecurity. The, this team that came up with the AI 2027 report, their scenario was by the end of 2025 last year, uh, most AI research organizations will use AI agents to do the job of their researchers. And by 2026, 100% of all AI research will be done by AI researchers. And we're— and all that has played out. That's exactly what's happening. That's in February when the latest versions of OpenAI and Anthropic came out. They were trained on their own model. The model trained itself. Uh, what do they call it? Recursive self-improvement.

Yes.

That means we're going to see the types of just groundbreaking changes that we've seen in the last 3 months. We're going to see those every month or two from here. We won't be able to even grasp the changes that were made possible and the improvements that have made possible before there are better improvements.

That's crazy. Wow.

Out of control. So a year ago, saying that, hey, uh, in the future we are going to totally automate SOC operations, I got a lot of pushback on that, and I was derided in public forums on LinkedIn, uh, as being, you know, a dreamer, uh, you know, following unicorns, whatever.

Yeah, I guess that's the burden of thought leadership, isn't it?

Yeah, yeah. You know, I've been there before and get criticized for that. Um, and, you know, one of the areas I think that is changing this for people, if you just watch, um, you know, some of the research that's being done on vulnerability discovery from AI. So we know that Anthropic, you know, ran a very, very short, uh, experiment and discovered 500 vulnerabilities in open source Some of them highly critical vulnerabilities. Two of them have been patched so far. But, you know, in open source, it doesn't help to patch. Doesn't mean, oh gosh, now you can tell the bad guys about it. You shouldn't. But we do because nobody updates all of their software like they should.

True.

Why?

Why do you think that is? Because that is really a problem in our industry from day one. Because I think I'm pretty sure it's still about the same. About 5, 6 years ago, IBM had a report where they say 99% of all incidents, all of them, 99% is due to people just not patching the system. So simple, but nobody does it.

First, a couple of things, because I'm going to disagree with the 99%.

The—

I learned my lesson the hard way. When I first joined Gartner, I— there was a new, you know, severe vulnerability in Solaris. And You know, back then in 2000, that's what most enterprises used for their servers. So I issued a Gartner Fast Take, which basically was patch immediately. And so the next week I get calls from CIOs. And, you know, we use these things called handsets back then on the phone. And I could tell it was a room of 20 people. And the CIO says, you're an idiot. We have 2,000 Solaris servers. We have to schedule them for downtime on a weekend. People have to come in in order to take it down and patch it, test it the whole weekend, and then redeploy it. And it will take us 2 months to do that for 2,000 servers.

Wow.

And in that 2-month time period, there'll be another severe vulnerability that needs patching. So that was the last time I ever told anybody to patch now. And You know, and I criticize CISA quite a bit because they've appointed themselves as being the patch now department of government. It, it, no matter how loudly you blare on that megaphone, it's not going to happen. People are not going to patch now. Now about the 99%, the, I can argue that two of the worst cyber events in recent history were because people patched and they patched now. And that is, of course, NotPetya, right? So as a Russian GRU-created worm that they deployed through an update of a software package called MeDoc in Ukraine, right? Spread throughout the world. The timing was such that it was mostly in Europe, and caused $10 billion in documented damage, right? The most devastating cyberattack in history. So that was people just blindly updating, right? If you had been the person who's— who didn't update, the next day you would have said, boy, I better not update. You would have been fine. So the other one, of course, just like that, SolarWinds. So it was the competitors to the GRU, is the SRV. They invaded a US software company and interfered with their update cycle. So once again, patching now has been identified to the bad guys as the easiest way to get into the targets. So therefore, don't patch now. Turn off all of your automatic patches. Do not be Delta Airlines that automatically accepts updates from CrowdStrike to a kernel system that everything runs on. I mean, We go into hours-long discussion about why in the world everything's running on Windows. Why would you do that? But that's, that's where we're at.

So which advice would you give to senior executives listening to the podcast right now when it comes to managing vulnerability and patching their systems?

So sandbox every single patch. So test it in an environment that reflects your own environment. Monitor it for a period of time for command and control stuff. Reverse engineer the software. There are about 4 solutions that will help you do that. There's some AI solutions now that are automatically reverse engineering, so they can tell you the diff. You may have contracts with large software vendors that say you will never reverse engineer their software. They have to change them. And that's the one thing CISA could do right now.

Yes.

Step in and say that is wrong, and you will retract that or change your contracts.

Yes.

So reverse engineering for security purposes is allowed.

Because supply chain management is definitely a big problem. Wow.

Okay.

If nobody got anything else from this podcast, this is definitely it. And so we have someone coming to us all the way. Oh, Alexandru, I I know him, is interviewing him. So we do have a question from the audience. Colin say, do you think immigration and academic sponsorship have aided cyber war? Okay, interesting question. Considering that sometimes people can't help without compromising the system they manage when they are compelled by those who are sponsored their education and immigration. Huh, interesting question. What do you think?

Um, let me preface it by, I'm in complete favor of immigration. I think we should have open borders. Everybody can come to the United States.

Me too, otherwise I wouldn't be here. But yes, yeah, absolutely.

Um, that said, I have personal exposure to how it works. We're talking specifically China, right? Um, so Russia, the United States, Britain, France, everybody, um, manages spies in pretty much the same way, right? They recruit, uh, Joes in the field, and then they manage them, uh, you know, with the— with their handlers. That is different. China, um, kind of by being Chinese, you have to respond when the Chinese government asks you for something. So if you're in a position to know something, they're going to ask you to give them stuff. It's like, it's like working for the mafia, I guess. So I went, I went to speak at a conference on the western side of the state of Michigan in Grand Rapids. And yeah, small conference. I was on a panel and, you know, I forget what we were talking about. Um, and, and then as I was driving home from the conference, I got a call from somebody who was there who told me he used to be with the NSA. And he was— he had stepped into the hallway to take a different call, and when he came back, he saw that a Chinese student had come into the room and sat in the back row and was taking meticulous notes. He sat behind her where he could see what she was writing, and he was NSA, he can read Mandarin, and he said Next to my name, she wrote the note of special interest.

Hmm.

Apparently because I was going to be present, um, somebody was deployed from the local university to go and take notes and report back. So yes, it's a threat.

Yeah.

And I, I guess of those listening right now, I would say it wouldn't be a bad idea to start learning a little bit of Chinese. The way things are going, they may become the number one superpower. Very, very soon by us shooting ourselves in the foot for sure. But one question I do have for you, just because of the, I guess, the experience you have had and really, I think you have the pulse really of the cybersecurity industry across the globe, right? You've worked across Gartner, Fortinet, startups, and your own firm. How did each environment kind of shape your leadership philosophy as it is today?

Sure. So if you think about going back to PwC, right, so that was my first interaction with very large organizations, the Big Four.

Yeah, yeah.

And so, so, you know, we had big banking and transportation clients and technology clients. So I got to see the kind of internal operations of their security, etc., like that. So that was an exposure to, uh, kind of the regimen of a large enterprise. And one thing, a takeaway from that is that enterprises will spend tens of thousands of dollars to have an outsider, PwC, come in and tell them what they could have found out just by asking their own employees. Because that's what I would do. I would go to the system administrator or and tell them I'm doing a security audit. And he said, oh, look at this, you know, we, we've got an e-commerce site and we store all of the credit cards in clear text on the server. And then you write that up and report it, and the board does something about it because PwC. Um, and then, uh, Fortinet, you know, was, you know, uh, fast and scrappy and growing company at the time, competing against Cisco and Check Point.. And that was, you know, I learned about micromanagement, you know, because the sales teams were globally spread around and they could kind of operate fairly independently. Marketing team was in the same office as the rest of the executives. Wow. And you can, you know, so if you're an executive and you need knobs to turn and all that, you're going to focus on the marketing team. That's probably not a good idea to micromanage the marketing team. I don't think it is. I know I don't like to be micromanaged, and I do not micromanage anybody who works for me. It's, it's something I actually learned way back in automotive. So everybody thinks that cars are designed by engineers. They're not. They're designed by draftsman who are, you know, they're geospatially or spatially aware people who actually put the lines on paper and now CAD systems. My job was, as a beginning engineer, was to manage draftspeople. And so I would tell them, I would literally have to tell them what lines to put down on the paper.

Wow.

Right. And then, uh, but it didn't take long for me to graduate to being an engineering manager. Now I just had engineers reporting to me. With an engineer, you just tell them, I want this component ready for production on this date 2 years from now. You tell me what you're going to do. And they— and not only would they tell you, they would do it. So that's the difference between a micromanager and somebody who manages by setting goals and accountability.

Wow, that is quite fascinating. Like I say, you do have a pulse on the cybersecurity industry. Let's talk about Industry Insight for just a moment. Because you have mapped out thousands of vendors. I believe you are the number one company right now in the world with the most tracking of the most cybersecurity vendors all across the globe. So the question I have for you then is what's broken about how organizations currently choose cybersecurity solutions? And everybody watching right now, I believe if they go to dashboard, right, that it-averse, they're going to be able to access your really incredible system. So, uh, what is it you think?

Yeah, yeah, we know it's broken because all the CISOs on LinkedIn complain literally about salespeople reaching out to them, but we haven't created an alternative, right? There's so many solutions, right? There's— today in the dashboard, there are 10,470.

10,000?

Wow.

Solutions, not companies, solutions. So products. There's 4,017 companies. A lot of that growth recently has been the AI security vendors. So the various ways people use to select a product, right, is the one they call Gartner. And Gartner will show them a Magic Quadrant that's got 12 products on it. But like I said, Gartner covers about 243 products out of the 10,000-some products that are out there. So they don't give you full coverage, and they've pre-selected them for you. And a lot of that pre-selection is just based on size, right? It's $10 million or more in revenue, etc. But the best solution might be from a smaller company that's newer, right?

If it's a startup from Israel or something. But yes, Exactly.

So Wiz never appeared in a Gartner Magic Quadrant, right? Wiz went from inception to being the biggest acquisition in our history. Yes, honestly, the biggest private acquisition at all, right? $32 billion by Google without ever being covered. Now mind you, the analysts talk to Wiz all the time and they could answer questions with no problem, but they didn't write research So how do you discover the next whiz? You'd rather select the next whiz now than wait until Gartner knows about it. So, so that's the problem that I try and address. It's like, it's just a simple concept. Like if you're shopping for a car, if you did it right, I mean, the way people buy cars is actually how they buy security products. They say, ooh, I like that car, it looks right to me. And then advertising on TV reinforces it, and finally you go to the dealership, and after that—

interesting—

um, the ideal way to do it, and I talk to people who do do this, right, is they make big spreadsheets, all the cars they got requirements, right? 5-passenger, you know, so many cubic feet of storage space, 4-wheel drive, you know, efficiency, etc. And they limit it to, you know, 3 good solutions. Then they go look at which one to see which one works best for them. Way to do it. How are you going to do that if you don't have data? And they've already done that. We can create that spreadsheet and get you down to the 3 vendors you want to talk to in minutes with our platform.

Yes.

And you know, you can feel comfortable that you've got complete coverage, right? So if you're looking for a new hardware security appliance for your, you know, retail outlets in Perth, Australia, you'll go to Gartner's Magic Quadrant, and you'll see Fortinet, you'll see WatchGuard, you'll see Palo Alto Networks, and a handful of other ones. But you won't see Red Piranha, which is small and based in Perth, Australia. Wow, you're gonna get a lot better service from, from than any of the other ones who don't even have offices in Perth.

True. Wow, that's amazing. So let's talk about your book. You publish them pretty much every year. So the Security Yearbook, the latest one, 2025, history and directory of the IT security industry. Can you kind of tell us why people should read this book and how it's going to help them with vendor selection?

Yeah, there are a bunch of use cases. One is if you're just entering the industry, it would really help if you had a picture of an old guy like me who's been in the industry from inception, right? It's— yes, worked with Check Point Software. Wow, 1993, right? They went—

they went so amazing. When do you think the cybersecurity industry was kind of formed?

I give— even though there was antivirus, you know, but antivirus was, was literally about floppy disks. I remember those days when they all were incepted. Check Point was— yeah, there were many, right? Because BorderWare started about the same time, but I, I peg it all to Check Point. Check Point created the industry for network security. Yeah, we created the channel in the United States. They single-handedly went door to door and converted MSSPs into for Checkpoint. And they— that became the channel that everybody goes after today.

So that would be like '92, '93?

Exactly.

Yeah. Amazing. Sorry, you could continue. Wow.

Um, yeah, so that's— that was the beginning of it. Yeah. But what was the primary—

oh yeah, well, sorry, we were talking about, um, this book.

And so that's the use case, yeah, for, uh, learning about the, you know, how we got to where we are. Hopefully avoiding some of the mistakes if you're a startup founder or something. But for anybody just entering the field, this is it. And the book was even inspired by going to RSA conference in 2019. And every— I was signing a different book and everybody was asking, saying, you know, I came here, this is my first time, and my employer sent me to learn about the industry. And I really felt sorry for them. Not a good idea to learn about the industry from the show floor.

Yes.

So, wow. But the other use case is, you know, I get a lot of people who are, are, you know, our age, and it's almost nostalgic, right? They like to read about, you know, they worked at those companies or they work with those companies, so they remember those days. So there's a nostalgia element there. Um, became the vehicle which I can publish the directory. So, you know, I can't publish a digital version of the directory.

Yes.

I'll create, you know, first of all, somebody in Lithuania or Ukraine will just, you know, publish it for free.

Yes. Yes.

All my books are pirated right away. And, and then there'll be a directory out there that's out of date. But right now we've, we've got 4 competitors, um, all scrambling to build the processes to stay ahead of the game.

Yes.

Wow. You can't give that away. So even though they know, or they should know, they can just OCR this right here. Yeah, right here.

Yeah.

You are that and you'd be done. And so we— so it's a scramble to stay ahead of that constant threat.

And that is really a critical, critical service you're providing to the industry for sure. Thank you so much for that. But let me ask you this, because another key thing is it seems like you believe that complexity, right, not specifically the attackers, really, that's the biggest risk in cyber risk today. Why, why do you believe that?

Yeah, so, um, actually, I, I have a very simplistic picture of cybersecurity. So I don't think you should treat it as being that complex, right? Because, um, if you think about a layered defense model Defense in depth, yeah. Defense in depth, right, which has multiple meanings. One of the meanings is don't use the same vendor across multiple products, right? Because, you know, if your Palo Alto or your CrowdStrike has something wrong with it that it misses a particular type of attack, you have multiple vendors. If you have CrowdStrike and Palo Alto, you got a better chance of catching it. But if you just bought into the platform, then you're going to miss it, right? Then, and once there's something that gets past the platform, everybody bought platform is subject. That's back in the day, um, uh, defense in depth meant having a separate antivirus vendor on the desktop, the server, and the network. So that's why everybody used McAfee, Symantec, and Trend Micro. Yeah, the big three. And that's how it That's exactly how it worked.

Wow, interesting. So what do you think separates leaders today who thrive in complexity from those who are overwhelmed by it?

It's—

there's an element in their makeup. You used the word thrive, which is true, that is usually associated with younger people that enjoy you know, learning new things and challenge, and is usually the opposite of associated with, uh, does not match with, you know, old people who like things to stay the same. So it's, uh, so in that sense, it's a youthfulness. And yet there are plenty of, uh, people our age that have that, you know, life outlook, uh, embracing change, um, looking to navigate through change, right? You're constantly making decisions. Is this a good change to drive forward to? Is this a good technology to adopt? It's a good way to change our business practices, uh, which you have— no matter what, today you absolutely have to change everything you're doing. I don't care what business you're in, between now and 2 years from now, you will change every way you do everything. Everything, right? Or your ERP system is— the one you're using today is going to be dead in 2 years, right? There's no way on earth that the, the Oracles and SAPs of the world can continue to ship crummy products that are so expensive to manage for such a simple task when, you know, a few— it'll seem like a few AI agents just do it for you.

Yes, man, what a change. So let's talk about AI and agenting system for just a moment and all of the, I guess, new threat landscape. You've said that threat landscape is really shifting from networks to the machine's mind, and we're going to be talking about your latest book in just a moment. But what does that mean in practical terms?

Yeah, if you think about it, we're going to shift a lot of responsibility for security and our operations to to agents that are going to be autonomously making decisions for us. And therefore, you won't be able to, you know, attack a vulnerability like you used to because the agent has already seen the vulnerability and defended the vulnerability or patched for it. So you're going to have to shift the target. And there's two directions to shift to: attack the humans and attack the agents. Agents, you know, will be Yeah, are going to be included in that. By attack humans, I mean, okay, now you're going to bribe somebody who has access, you're going to extort them, you are going to, you know, in the ultimate, you're going to break into their homes and force them to give you the passwords, etc. That's always been the high bar for increasing the cost to the attacker. It's forcing them to physically attack. And, you know, hopefully, you know, luckily most attackers are overseas and won't, you know, that is a high bar. It's very, very expensive. It won't be that expensive to attempt attacks on agents and either screw with their underlying model or, you know, poison the prompts that you inject or, you know, figure out other agents they can work around them. Not that— this is visionary, but it ain't my vision. This is William Gibson talking from 1995, right? He saw all this. I don't know how.

Amazing. So why did you have to write this book, Guardians of the Machine Age: Why AI Security Will Define the Future of Digital Defense? That is quite a bold statement, isn't it?

Yeah, I had to write it because that first instance of writing a blog post on Substack in April of last year where I just did the scenario planning and the SOC automation would be the wave of the future, I got a lot of pushback publicly. Privately, the founders of all the companies I knew at the time reached out and said that I was, I was way behind the curve. They were already there, you know, there were 6 months ahead. Um, so I realized that, yeah, this is going to move really, really fast. So, and then there was some impetus. So my publisher for Security Yearbook came to me, uh, early November last year, and they said, you know, um, there's still too many print copies in our warehouse. If we sell the next one, if we put it up there, nobody will buy the old one. So, so we're not going to publish 2026 version. But I was already planning, you know, when I write a book, I need a week in a cheap hotel in Mackinac City, Michigan, looking out over the Straits of Mackinac.

To force you to write, right?

Right, right.

I'm paying $99 a day for this. I better be not watching Netflix.

So that's so funny because I believe Maya Angelou did the same thing when she had to write book under contract, she would get herself in a hotel with no distraction and write.

Yeah. And it's a way that we procrastinators, you know, build up such a barrier to procrastinating that we have to actually just do it, right? And have an accountability partner, the Thus Loving and Caring Wife. And so somebody knows what you're doing, right? So you have to report. Actually been writing all this time. Um, and when I set off to— so I went ahead and I said, well, I'll just write another book. And what should it be? Well, I was already working on a chapter for AI security, which I, you know, I wrote about in the two previous editions. Yes, to the point where last January 2025, when this book was published, there were 80 AI security vendors. Okay. And, you know, starting to indicate to me that something was happening. But when I went off to Mackinac City, I went back and looked at all 512 vendors that have been founded since 2022 to see if I had categorized them as AI security.

Yes.

In 2023, I wasn't covering AI security.

Hmm.

So that got me to, um, 295. AI security vendors in November. And so I wrote the bulk of the book in that short week, but then between November and February, that number went up to 378 vendors.

Wow.

So it was really hard to finish the book and say, okay, this is a cutoff. Some vendors didn't get a write-up, they just got listed in the directory. And right now, today, there are 409.

Wow.

Security vendors. So it's still growing.

Amazing. Amazing. Because something you've said in the book is AI is pretty much reinventing cybersecurity itself. Again, that's quite a bold statement.

Yeah.

Wow. Becoming the backbone of modern defense. Can you expand on that, please?

Yeah. So every aspect of security, starting with the low-hanging fruit, right? The, the ones that are repetitive tasks that you have to do is being totally reinvented. And we're gonna— there'll be a time, I'll talk in a second about how it goes past the low-hanging fruit. But the low-hanging fruit for sure includes SOC automation. So what's, what's, what are SOC operations? Why, uh, you've got a SIEM that collects millions of events and it uses some algorithms to decide which events you should look at when you come into your shift. And you got big lists, you know, that hopefully has 10 red ones that you look at, but probably has 1,000 red ones because nobody likes to make that decision that something's okay, right? And you, you know, you just hire a lot of people to look at them and somehow distribute the workload. For you to triage the alerts. And then, you know, that's Tier 1s. Tier 2s take the alerts that could be something and do the investigation and threat hunting and all the rest. And Tier 3s start the incident response if something bad happened. So all that should be automated. And there are vendors— Command Zero was the first to say we're going to do it all, all the way up to Tier 3. There are 68 SOC automation solutions that will do all— will do 100% triage on all of your alerts. So no more making decisions about what to look at, what not to look at. You just look at everything, right? And you turn everything into a case, do the threat hunting on everything, and take responsive action to those things that you can, that, you know, you just showed.

That's amazing.

Vulnerability management comes to that, right? Owner's task. So you go one at a time, do that as well. Pen testing, breach, red teaming, whatever you want to call it, easily done by AI. Data leak prevention. Data leak prevention is all algorithmic today. AI can use context.

Yeah.

Decide whether the CFO should have sent that email to the chief of ops. And you go, okay, but current DLP solutions create an alert that a human has to look at and investigate. Um, and it goes further and further and further. The one thing that is rare, there are only a couple solutions for, is, okay, what if you got rid of the firewall? Firewall is doing the same thing every day, right? And it's probably one example of where policies are very, very effective, right? No, tell me something that, you know, if you've been to the Pentagon recently, next time you go to the Pentagon, if you're invited in or something, ask them if they still use Telnet. I bet you a case of beer that they still do.

Yes.

Even though it's totally just bad to do that. But a firewall can impose a policy that you can't use Telnet. So you're just not going to use Telnet. Imagine AI making those decisions for you.

Yes. Yes.

You know, it's, it's got to have a firewall to do, or, or, you know, a very simple native Linux tool. And it'll make those decisions. It was like, man, Telnet, I don't like that. Not gonna, not gonna let it happen, man.

It's, we're definitely living in a very fascinating time now. Now it looks like we have less than 10 minutes left. I'm still talking about your latest book. I think everybody absolutely needs to get a copy of this. It is so, so timely. No, not this one. Of course, for cyber warfare, there will be Cyber War is one everybody should get, especially my military buddy, and Surviving Cyber War for sure. But right now we are talking, I guess it's definitely part of cyber warfare too with AI. AI on steroids, really, guardian of the machine age. And like I say, the US Department of Defense for the first time in history starting using AI on live military operation in 2026. That's just, I don't know, it is just beyond belief, just the world we live into. But I guess one question I would like to ask you about the book, there is Okay, maybe this is going to be the last question and then we are going to need to end because we're running out of time. But I could be speaking with you, Richard, for like hours. You have so much knowledge and all these stories about our own industry. But if you had to give a warning to every CISO, CIO, and military commander right now listening, and by the way, it doesn't matter which command they have in any branch of the military, cyber warfare is one of those areas of responsibility for every commander in the military right now. So what would it be if you had to give one warning?

So cast your mind back to between World War I and World War II, and we're gearing up for World War II, you know, the writing was on the wall, you could tell it was going to happen.. And there's this one time and efficiency expert was called in to evaluate the team that was firing artillery rounds from artillery. Yes. And so he watches the whole operation, right? Clear the breech, load the shell, ram it shut, stand back, pull it. The guy's looking at it and taking notes, and he's got a stopwatch, and he says, 'Um, but I've got a question. What are those two doing?' So there were these two people standing 20 paces away at attention, and the, you know, the sergeant in charge says, 'Oh, they're holding the horses.' Yeah, here we were, you know, yeah, at least 30 years since the last horse-drawn artillery piece, and they had not changed the drilling that went into training troops, right? And so the advice is, do not be the person who's holding the horses, right? Question what you've learned to do and what you're trained to do. This applies to doctors too, right? Same thing. Um, and, and really look for efficiencies in adopting the new technology. Everything changes when you move from horse-drawn to motorized carriages.

Wow, we've been through technological transformations before, but really this does feel a little bit different.

Never anything like this. This is completely different, right? If you think about it, everything was improved communications, right? That's the technological revolution. So steam went to locomotives, and, and soon after, the telegraph would stretch along the railroad tracks.

Yeah.

And then the computer and the internet was improvement in communications. IoT, or mobile, improved communications, improved communications. This is intelligence at scale.

Wow. Now, you already gave your advice to senior leaders. But a very important portion of my audience are aspiring leaders, right? They may be cybersecurity engineer or analyst. They want to become CISO at one point or junior officer, and someday they would like to command. If you had the ears of all of those aspiring leaders across America, let's say for the next 60 seconds, what advice would you give them? What should they do tomorrow?

Yeah, uh, the word that springs to mind is specialize, right? It cannot be— you can't start as a generalist. Yes, start as a specialist and then expand from there. Um, people online that, you know, they're experts in Bitcoin, they're experts in W3C, they're experts in quantum, and now they're experts in AI. That's becoming a generalist. Um, and that— I don't know if you should hop from the latest hot thing to the next hot thing, but, you know, be a specialist in system administration for computers, and from there to network administration, and then to endpoint security. And eventually you're a generalist and now you can manage and lead a full team.

That is quite the change from when I was growing up in this industry. Wow. Amazing. Okay, we are quickly running out of time. Is there a question I should have asked you I didn't get a chance to ask, Richard?

I guess you could have asked me for what's going to happen in 5 years because—

Yes, let's talk about that. Can we even think about 5 years from now with how fast things are changing?

You cannot think about 5 years from now because the world's going to, you know, outside of cyber, the world is going to change more dramatically than we can even contemplate, right? We just can't imagine it. Even creating the foundational models are kind of aghast at what they're doing.

Yeah, because I remember even like 10, 15 years ago, every time I take over a cybersecurity function, I would have like a roadmap, you know, 3 to 5 year plan. But today, I don't think that makes sense. You know, within a couple of years, that's going to be completely nonsense.

Well, I can advise, do what I do. If somebody says 5 years, translate it to 5 months. Yes. 5 months. So, and the way things are going to change in 5 months, right now, there's a very small handful of people talking about, you know, the power of AI to solve security problems. In 5 months, everybody will be talking about it. So the, the, you know, the whatever the curve of Fear of missing out is going to kick in, but that within 5 months. So that's by September, everybody will be scrambling to get the resources in order to deploy bots in their SOC.

And that's amazing.

Yeah.

Wow. What a time to be alive. Okay, we are definitely running out of time, Richard, but we have so much more to talk about. But how can we add value back to you.

Yeah, you know, my sole desire is for everybody in the world to know that we have a database of every cybersecurity product and the tools to help refine that, to help you with product selection. So just spread the word.

And that's dashboard, right? italvis.com. Let me make sure to add that here.

Yep.

Yeah, this is such a great, great service. You really provide to the industry, and we are so grateful for that. And of course, they can catch you on LinkedIn.

Yep.

As well.

Okay.

Yep.

Reach out, connect. I'll follow back. I think there are limits on how many connections you can have.

It's 30,000.

I'm 3,000 away from there.

30,000. And yeah, now when I need to connect to somebody, I have to disconnect with some from somebody else. But definitely LinkedIn, Stenon, and then the website dashboard.it-arvest.com. And of course, we want everybody to get a copy of Richard's latest book, Guardians of the Machine Age. And for those who are in the military like me, I think you definitely want to also get a copy of Surviving Cyberwar, and especially There will be cyber war. And for everybody else, security yearbook 2025. When is 2026 going to come out?

There will not be a 2026.

Oh no. Okay.

So there may be a 2027. We'll see.

Okay.

Okay. 2027. Okay. We're going to be looking forward to that. All right. So this is really the end of the show because we've run out of time. So if I can ask you just just one last question, because I kind of like to leave the show on a very positive note. You know, we talked about cyber war, it's very, very scary stuff, but what are you feeling optimistic about these days?

I am feeling optimistic that we are going to solve a lot of the major problems that have haunted humanity since our existence. We'll see it first with health and medicine, and that's going to be a direct follow-up from application of AI to the problems. We're already seeing it in medicine. We'll see it in material science, so there'll be new things that you might not know were developed by AI, but materials are stronger, stiffer, more durable. The question of whether or not we will see improvements in everybody's life is— I'm hopeful, I'm optimistic that we just can't visualize it, but that it will be there and not the devastating loss of jobs that, uh, people are worried about. Because I think the adoption of AI, even though we see massive layoffs that are blamed on AI, right, CEOs always latch on to the latest thing as a good excuse That's thinking Wall Street will like it, but I don't think that Oracle really lays off, you know, thousands of people because of AI. Uh, that far along the AI path yet. Um, but if you do get laid off, move fast, create something with AI. Literally anybody with any technical background or not, or artistic background, can just get on Cloud Code and start making stuff.

Amazing. Well, thank you, thanks so much. Our very last question, and this is going to be it, is what is one word that represents our shared experience on this podcast today?

I think vision, because, yeah, we've been looking ahead.

Yes, well, thank you for being the cartographer of the cybersecurity industry. Definitely would like to have you back when you publish that next book. But thank you for everything you've done and really showing us where this industry is going. I think it's very exciting, a little bit of fear and anxiety, but definitely a lot of excitement about where we are going as an industry.

Absolutely, same feeling you feel when you're standing on top of a ski slope.

Outstanding. Thanks again.

Thank you, Bizzy.

All right, everybody, that was Richard Stannan. And again, get a copy of his latest book, which is Guardian of the Machine Age: Why AI Security Will Define the Future of Digital Defense. I think that is bold, but that is definitely the world we are living in today. And make sure to follow him on LinkedIn, Ian Stinon, and then dashboard.it-outvest.com to get the most comprehensive list of vendors out there in the cybersecurity industry. Okay. And tomorrow, I am glad I'm going to be speaking to the beautiful and fascinating Peggy Sullivan. She's an anti-busyness thought leader, leadership catalyst, and strategist. We're gonna be talking about her latest book, Beyond Busyness: Why Doing Less Is the New Leadership Advantage. So that's going to be tomorrow, Friday. And then on Saturday, I will be speaking to Michael Gibbs, JD is an adaptive security strategist, thought leader, and human-centered leader. He's written a book, It's Not in the Manual. So how do you lead without a map? How great leaders navigate chaos. So that's going to be for Saturday. And as you guys know, we've been celebrating Black History Year since Black History Month in February because we felt like 28 days is not long enough. And for today, which is April 2nd, so I kind of have two vignettes. The first one is the date today. And on April 2nd, 1963, that's Bill Connor there. It was about really when power refuses accountability, leadership failure of the world could see. On April 2nd, '63, segregationist leader Eugene Bull Connor refused to step down after losing the mayoral election. In Birmingham, Alabama. And I came from Tuscaloosa, Alabama, an hour from Birmingham. And people remember all of the pictures he had sent of the dogs against Black kids for peaceful protests. Anyway, I'm gonna play a short video to remember that. But the second thing is the first in African American history, which is American history. It's gonna be our First Lady, Michelle Obama, the very first African American first lady in the United States. So I'm gonna play a couple of short video clips about that, and that's gonna be the end for today. So let me know in the chat, 3 to 5 takeaways from this episode. And again, I hope to see you tomorrow when we speak to Peggy Sullivan. Looking forward to that. Okay, here is a quick video about Mr. Connor, let me get that. Oh, hold on, I think I need to refresh this page.

Michelle Obama is the first African-American First Lady. She will always go down go down in history for that, and she will always be seen as a pioneer for others to follow.

Born Michelle LaVaughn Robinson on January 17th, 1964, in Chicago, Michelle Obama was raised in a blue-collar home on Chicago's South Side. She went to Princeton University in 1981 and then on to law school after her college graduation.

After she graduated from Harvard Law School in 1986, 1988, Michelle Obama moved back to her hometown of Chicago where she began working at a law firm.

She was assigned to be a mentor to a young summer intern named Barack Obama, who then decided he wanted to ask her out on a date. As his mentor, Michelle thought that was inappropriate, but eventually she did relent and they ultimately married on October 3rd, 1992.

Michelle Obama left corporate law to to work in the public sector in 1991. She briefly worked as assistant to Chicago Mayor Richard Daley and later started a nonprofit to help train people for careers in public service. She became an associate dean at the University of Chicago in 1996 and then a vice president at the University Medical Center in 2005.

In addition to being the top breadwinner in the Obama family, due to her position at the University of Chicago, Michelle also gave birth during that time to two daughters, Malia in 1998 and Natasha, known as Sasha, in 2001.

Michelle Obama helped her husband get elected to the Senate in 2004. She campaigned with him while still trying to maintain as normal a life as possible with her daughters and raising them.

When Barack Obama ran for president in In 2008, Michelle took a leave of absence from her work to help with the campaign and still have time for her kids. Michelle Obama officially became the 44th First Lady of the United States when her husband was sworn in as President on January 20, 2009.

She was extremely effective in a number of her initiatives as First Lady, including Let's Move, which was a program focused on eradicating childhood obesity through fitness, as well as her extraordinary work in supporting military personnel and their families.

Michelle Obama, in a time of extreme partisan politics, has found issues that both parties can agree on and that really bring people together.

During Barack Obama's 2012 reelection run, Michelle Obama traveled the country to support him and played an important role in his success. She was so popular and effective on the stump, she earned the nickname "The Closer." Michelle Obama is a phenomenon in the White House.

She has managed to navigate the racial divide in this country, the gender divide, and the demands that she do something meaningful.

Michelle Obama is a popular First Lady. She was clearly a good mother. Clearly a good wife, her husband clearly listened to her, and she was a vigorous, attractive presence.

It's hard to know what Michelle Obama will do after the White House. She has the experience, the temperament, the education, and the visibility to assume importance in many sectors.

Mark Twain is now thought of as America's first celebrity because because he was so good at capturing the public imagination and it became important to him to have a public image.

Thank you for tuning in to the Leadership and Success Podcast with your host, Coach BZ. If today's episode added value to your leadership journey, be sure to subscribe, share, and join us again for more wisdom nuggets on how to lead better and achieve greater success. Success. Remember, leadership is the most critical skill of our time. The world will always need leaders to inspire others, drive innovation, and execute meaningful strategy. So why not count yourself among the bold leaders shaping the 21st century? Until next time, stay inspired, stay committed, and keep leading with excellence.