S4:E82 🎙️Building Trust and Cultural Awareness to Counter Insider Threats

Hi, I'm John Maxwell.

When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation, I'm proud to say, is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend, Bob Fabien Zinga.

Welcome to the Leadership and Success Podcast with your host, Coach BZ. If you need to develop into a better leader, this podcast is for you. If you want to achieve a greater level of success, this podcast is for you. His mentor, Dr. John C. Maxwell, said it best: everything rises and falls on leadership. We hope to inspire you today and provide you with an insight that has the potential to positively impact the trajectory of your life. Welcome to the Leadership and Success Podcast. Imagine gaining the leadership skills that— What if your next keynote speaker could bridge the worlds of national defense, Silicon Valley innovation, and global leadership? Meet Bob Fabien Zinga. Award-winning keynote speaker, US Navy Information Warfare Commander, and trusted executive in technology, leadership, and strategy. With over 20 years of proven leadership in the US Department of Defense, the US Navy, higher education, and the high-tech sector, from startups to Fortune 500 companies, BZ delivers keynote experiences that inspire, challenge, and equip leaders for real-world impact. BZ speaks with authority on cybersecurity and national security, strategies to safeguard critical assets in an age of constant threat, artificial intelligence and emerging technology, how to innovate responsibly while staying ahead of disruption, leadership and corporate governance, building resilient, ethical, and high-performance organizations in any environment. Every keynote blends military precision, Silicon Valley agility, and boardroom strategy, delivering practical takeaways that leaders can apply immediately. Audiences leave inspired, informed, and ready to lead with clarity and courage. Whether you're hosting a global conference, corporate summit, or leadership retreat, book BZ to energize your event and empower your audience to lead in a rapidly changing world.

Hello everyone, this is Coach Bizzy. Thank you for being with me today. I was supposed to have done this earlier today, but I didn't have any internet this morning, so I'm glad that the internet is back. So you guys can guess what I'm gonna be grateful for today. So let's start our moment of gratitude as it is our custom. If you would please, if you can close your eyes, put yourself in your happy place, take a deep breath, and Think about one thing that you are grateful for today. And today I am grateful for power, for emerging technology, for the internet. It's really amazing. In 2025, it's very, very difficult for me to do what I need to do to live my life without the internet, and I'm just grateful that it is back in my home now. All right, if you would type in the comment what you are grateful for today, I would very much appreciate that. So, uh, today is going to be a very interesting podcast. A couple of days ago, myself and Marco, we were invited as subject matter experts at, uh, Cybersecurity. It was moderated by Francisco. We talked about building trust, okay, and cultural awareness, and that's what we are going to be talking about today. So I'm gonna play you the about an hour-long podcast, me and Marco talking about Insider Threat and cybersecurity. And also, as you know, this is Hispanic Heritage Month, September 15th through October 15th. So the Hispanic Heritage Month really is in between the Insider National Insider Threat Month, which is September, and then October, which is National Cybersecurity Awareness Month. So that's exactly what we talked about. And what you are going to learn is how to recognize common indicators of insider threats without confusing them with cultural differences, why trust and cultural competence are essential for countering insider threats, and also how to shift from a surveillance-driven model to a shared responsibility approach that empowers your team. The role of leadership in setting culture and driving security-first mindset across the organization. AI amplifying cyber threat risk and what you can do to lead with vigilance in the age of automation. Why diversity and representation are not just social values but security assets that improve resilience, creativity, and decision-making. We're also going to be talking about the non-technical skills like networking, communication, emotional intelligence, and adaptability that will accelerate your growth as a leader, and how to apply universal leadership principles—trust, inclusion, vigilance, empowerment—to both military and tech environments. And finally, we also going to cover practical coaching takeaways you can act on today to inspire trust, champion diversity, and lead with confidence. All right, without any Without further ado, let me play the 1-hour expert panel. That's me and Marco, and it was moderated by Francisco from Cyber City. Here we go.

Awesome. Well, I think we're officially live. Awesome. Well, thank you so much everyone for being here. Thank you to my panelists for being here today. I think I'm super excited for this event. I have two fantastic people here with me today with combined, you know, combined experience of over two decades each. So very happy to have you guys here with me today celebrating Insider Threat Month and Hispanic Heritage and Latinx Heritage Month. So without further ado, I think I'll give you— I'll give a brief introduction of you guys. And if you want to add anything else that I missed. You guys have a ton of experience here with what I'm seeing in front, a lot of certificates and a lot of acronyms, so please excuse me if I miss something. So with me here today is Marco, Marco Palacios. He is the Pacific Hacker Association's president and global MDR customer service manager at Fortinet. Marco started his career in IT and spent over a decade in IT operations before transitioning to cybersecurity. He is a blue teamer by heart, and he has spent the last 8 years specializing in defending organizations and building and implementing modern security operations. He's also the co-founder of the nonprofit Pacific Hackers Association, where he mentors, um, and advocates for veterans and underrepresented communities to help them find non-traditional paths in cybersecurity industry. Also, Marco served in the United States Air Force, and he was deployed as part of the Operation Enduring Freedom He holds a master's degree in cybersecurity, a bachelor's in information systems, and a lot of acronyms and certifications in cybersecurity. So welcome, Marco. Also with me here today is, is Bob Fabien Zinga. He is the CISO at Santa Clara University and information warfare commander in the US Navy Reserve, currently serving as the commanding officer, a CEO equivalent, of a 72-member unit supporting a dual-hatted Commander, Naval Warfare Command, and Commander Task Force 1010. Hopefully I said that right. He is— he has more than 26 years of experience in certified information technology with expertise in leadership, secure enterprise information technology, business and operations, corporate governance in several industries including higher education, federal government, defense industrial complex, tech and consulting. So also welcome BZ today here with me. Super happy to have you guys join me in this awesome event today. We're preventing insider threat awareness and Hispanic Heritage Month. Awesome. If I missed anything, yeah, feel free to add. I'm super happy to have you guys here. Um, today pretty much what we're bringing you guys—

I guess one quick thing. Yeah, I'm no longer a CSO at Santa Clara, but I am definitely in the Navy. I've been a CSO, CIO, and CTO in the US Navy. Um, but good, thanks for mentioning.

Yeah, no, sorry about that. Okay, I think I, I might have missed to update my, my bio here, but thank you for that. Awesome. Well, um, Yeah, so today we're here, guys. A little bit about the— for the audience, what we're doing is we're talking a little bit about insider threat, how it begins with trust, cultural awareness, and understanding the diverse perspectives that strengthen our resilience. We are also observing Hispanic Heritage Month in conjunction with threat awareness and how recognizing diversity brings on powerful contributions from Hispanics and Latinx professionals into national security and cybersecurity overall. So I think I'll ask some questions that I have here for you guys, and I guess we can, if you guys want to, you know, break it into answering both of them, I'll ask in the order that I see you guys here on my screen, but feel free to interchange. I guess I'll start with what are some of the common indicators for insider threat, BZ, that you see today in today's organizations, and how, you know, how does some of that cultural competence help in recognizing and addressing these incidents? Insider threats that we see today.

Okay, if I may, I think Caroline is taking care of the screen. I would like to show this one insider threat presentation, just one page of that. Can you show it? Go ahead. Yeah, perfect. I just want to show this one little screen here. When we are talking about Mosquitto and Dicato, first of all, when it comes to insider threat, this really has to do with the US government, right? Being in the Navy, I've been in the Navy for more than 20 years now, so we have what we call OPSEC, and we always want to make sure we have operational security over everything we do. So it protects not only classified information but also non-classified information that if the enemy got access to it could figure out what we are up to, where we are, troop movement and things like that. But sometimes though, your adversary isn't always someone who's your enemy. Sometimes people within your organization could potentially become an insider threat, knowingly or unknowingly. So it's something that we focus on a lot in the in the military, and we have to report, you know, all of those things to our security manager. That's not exactly the way it works in the industry, but in the military we are pretty strict. So come on, and then to get back to the question that you have asked, for example, unusual data access, right? You kind of see most people who work for this organization in the Navy, for example, maybe they normally work from 9 to 5. So if you see someone always coming in very, very early or leaving late and getting access to sensitive data. Why are you getting access to those data when it has nothing to do with your job? So that's one red flag. Sudden financial stress is something we look at into. Either you got into debt and you really need money, you cannot pay your mortgage or whatever, and then you are more vulnerable, right, to be solicited by the enemy so they can give you money and then you can provide them classified information, for example. Or sometimes also it's not financial stress, but coming into a whole bunch of money all at once. All of a sudden now you are driving Mercedes-Benz when you used to drive Honda or Toyota. Now you live in a big mansion when you used to rent an apartment. Where did all of this money come from? So in the military, we really think about these things. Disgruntle employees. That's one thing. Or sometimes people try to bypass all of these security policies and measure and control. Again, you can take this slide down, but just to kind of show you, these are a lot of the indicators that we would be looking at. But what I would also say is we have to be sensitive with cultural competence, right? Right now we are celebrating Hispanic heritage in the US, and you have to avoid misinterpreting some of the normal cultural behavior as well, whether it's the communication style or family obligation or norms around authority. So I guess what I'm saying is security professionals need to differentiate between genuine risk and then cultural misunderstanding to reduce false positive and building trust. Yeah, I think you bring, you bring a good point.

Um, and that's, that's an interesting point from a, from a, from a U.S., U.S. Army and U.S. military, um, point of view. Marco, you also have U.S. military, uh, background, but you also have non-profit, uh, involvement. Um, how do you, how would you define, uh, insider threat in in this perspective, from nonprofit and also from the consumer and private industry perspective?

Yeah, definitely. So I mean, I think, well, first of all, Bob covered it all and pretty well. So it comes back to culture. I always say that, you know, and in fact, the principles of information security are people, technology, and processes, right? So since we're focusing on the people side of things, Culture plays a big role in this because it really depends on the organization and the culture of the organization. Like he gave an example of the military, the government, very strict, very like, you know, you have to follow orders, you have to do this. Well, you cannot apply the same thing in a startup, right? Or maybe in a corporation, depending what type of corporation it is. If it's a government contractor like Lockheed Martin, etc., then yes. But if it's something like not to that point, then it's maybe more relaxed, right? So it really depends, again, going back to the culture, how it was created. And that's from that point on, you know, there's different factors, right? Corporations and government tend to be more political, where even nonprofits and startups are kind of like laid back and those type of things. You know, they tend to be more more for the people, asking them what they want, what they need, versus corporates and military and government. Sometimes it's just— sometimes you're just a number. Let's just put it plain and simple. Sometimes you're just a number. They don't really care what you feel, how you feel. It's more about the mission comes first, right? So it's basically what it is.

Yeah, makes sense. And You both mentioned something interesting. I think you both touched on the point of security-minded culture and fostering this type of culture, this security-first culture in the environment, whether it is government or whether it is, you know, in the public. BZ, how would you say companies nowadays and organizations companies or governments could promote more of that security-forward, security-first mindset when it comes to insider threat nowadays?

Yeah. I think especially in the industry, because when I first moved to Silicon Valley 11 years ago, I was having some serious trouble adjusting to the way we do business in Silicon Valley. It's definitely not the Navy., right? It's not the DoD, or now they call it DoW, Department of War, whatever. But anyway, uh, it is definitely not, um, the military, right? It's not like we have top secret information, or it's not like people are going to die if we don't do security correctly. Probably worst thing is going to happen, we're going to lose money, or maybe our brand might be affected, right? So completely different world. So when, when you say security-minded culture, I think especially in the industry One thing from my experience I think that's critical is really building that shared responsibility, right? That's how I think you need to kind of frame security. Because in the industry, in my opinion, in my experience, it's not like in the network, no. I am the CISO, the CIO, I can tell you what to do. I say jump and you say hi. In the industry, I tried, it doesn't work, right? Engineering is not going to listen to you, we're not going to do anything you say unless you are able to influence them, show them what's in it for you, right? And kind of say, okay, this is the mission of the organization and work with me so we can work together, collaborate in order to do it in a safe and secure way. So how can we share this responsibility? Also get their feedback and their input, pretty much get all of the other business functions to buy into your security program, if that makes sense. So shared responsibility, I think, is really, really huge because if you go about, oh, security is surveillance, like within the military, you're gonna be out of a job before you know it. It's just not gonna work. So I think you also need to emphasize empowerment. People need to feel like they are empowered. Transparency, what you are doing. It's not like 20, 25 years ago when I first started in cybersecurity, it seems like cybersecurity was completely cut off from the business, kind of a silo by itself doing our own thing. And we were kind of known as the department of no. Anything you want. No, no, can't do, not secure, no. So we were in the way of business. But what I'm saying is, no, you need to actually support the business, right? You need to be able to enable the business in a safe and secure way. So emphasize empowerment, transparency with the policies, the procedure, the governance, everything that you do, the technologies that you are using, and then also education. I think education awareness really, really goes a very, very long way. So people understand what's going on and then they understand what their responsibilities are and then you can kind of test it and kind of make it fun too. Like my last job, I really used to— next month, right, October, National Cybersecurity Awareness Month, I would make it like a really, really fun event and even get a bunch of stuff to give away from vendors and really get people interested in cybersecurity, not as something I have to do, but understanding why it is important to you and why you should do it. Not just here at work, but at home too, right? Building those new habits and making sure we enforce them in a positive way. Again, it's not about punishment, it's not about, hey, if you did the wrong thing, you're a bad person, you're gonna get fired. No, no, it's like, how can you add value to the organization by doing whatever it is that you do in a safe and secure way? And I believe storytelling is another very important key thing, especially when you have diverse voices, which I think we should have a diverse workforce and kind of help normalize vigilance and have value rooted in care for one another and mission readiness, not just suspicion. Because if you're not careful, when you are too security-minded, you can really have a lot of negative effect where people start turning against each other. What you want is people working together. Yes, we are human, Sometimes you make mistake, you watch my back and I watch yours. So that's the type of culture environment you want to foster.

Marco? Yeah, one of the things I want, and then by the way, all those points are good. One thing I definitely want to mention, it starts at the top, starts with the leadership. You know, the leadership is the one who's gonna drive the organization and they're the ones who are gonna tell you, you know, how you have to conduct, how you have to react, how you have to, you know, have that security-minded organization, right? They are the ones who will have to advocate for security. You know, at the end of the day, once you start forming your teams, right, it becomes— it almost becomes natural to have that collective responsibility of every half, you know, like, you know, be secure all the time. If you don't do, guess what's going to happen? And explain those type of things, spell it out. Hey, You know, spies exist, and it's not just in the movies. Spies exist, and just watch out. Like earlier when Bob said, you know, in the military we have that OPSEC, COMSEC, you know, terms, right? Like, you know, situational awareness, security awareness, and such. But, you know, in the outside world or the private sector, it's not like that, right? Unless you have that, you industry, or you're in the industry, or you have that leadership that is always telling you, it's like, hey, look, look, look around you. Even when you go outside, you know, especially for the ladies, like, it's already— it's getting dark now, um, early in the day. So, you know, look who's around, you know, uh, and stuff like that. But at the end of the day, it comes back to the leadership and the, uh, and the, uh, culture of the organization. 100%.

And I think, you know, you guys beside your day jobs and beside all the other things that you guys do, I think you guys take on an educator role. Marco, I've been to several of your Pacific Hackers events and I've seen you up there. BZ, I'm sure that you in your roles at the university and in your day job, you guys take on this educator role explaining things. What would you say would be some of the best— and this open question to you guys— what would be some recommendations or some tips that you would give managers nowadays and leadership positions to take on that educator role and be able to diffuse information and knowledge downstream in a way that is both inclusive and also pushing this, not so much as you said, Bisi, the security first, the distrust, that mindset?

I don't know. The way I think about this, I think it's a proverb, you catch more flies with honey than vinegar. I feel like you need to make it fun and also, clearly shows why it is important for the people to understand this, to understand the basic security measure and why it is important. I think that really makes a big, big difference. And like in these days, I think people pretty much understand that cybersecurity is important because of your privacy, because people could get inside your money, like your bank account, they could wipe you out, right? Those are real things that could happen to you. Your identity could be stolen. So I think at the basic level, all of us, we are pretty much selfish. We care about ourselves more than we care about everybody else, which is perfectly fine. So I guess you want to make sure you have that shared responsibility, that people understand, okay, this is important. And also, if something bad happens, we are on the front page of the New York Times, not for good things, but because we've been hacked, you could be out of a job, the company could go bankrupt. That is why it is important to you as well. And then that being said, no, I don't think it's a good environment to be where everybody is looking over your shoulder and being suspicious and treating you like a criminal. But I think you do have to trust your people. You have to inform them, make sure they are aware of all of the security awareness protocol and standards from within your organization. Like Marco says, no, the culture will depend from command to command, from organization to organization, but within your culture, making sure that people have the psychological safety where they can speak up and not feel like if they do, something bad is going to happen to them. This way they can let you know, hey, there might be a problem here, I think we need to focus on that. And when people make mistakes, and they will, I think you need to also show some grace, but give them opportunity to maybe go back to the training, but really give them a positive experience and not feel like if I do one mistake, I am done with, because in an environment like that, I feel like it's not going to help you in the long run, but especially making it fun because I think if people do the right thing, just as an example, last organization I was, head of cybersecurity and IT at Directly, an artificial intelligence startup in San Francisco. One thing I used to do every quarter, I will have a phishing campaign, right? I would send them a phishing email and making sure to see that they understand the training, they're not going to click on links, they're not going to click on attachments. Now, before, a few people who did, we said, okay, not a big problem, go back and do this training again, 5 minutes, 10 minutes, it's not like hours and hours. And then for the people who did the right thing, not only they didn't click on the link, not only they didn't click on the attachment, but they also reported it to security. Those people, they went above and beyond because by doing that, I'm telling everyone in the enterprise, now security can go back and find that email because if they send it to one person, they probably send it to all of us or at least a couple more people. So we can go into our mail server and delete that email from the sender or the email that has the same title, this way nobody can even see it or do that. Then I would give them a virtual security champion award, and then I will let everybody know, celebrate what they've done. Then they feel good, everybody says good job, high five, high five. I didn't give them any money, I didn't do anything, but just that alone, it's going to change the culture for the entire organization because next time Andrew or Bob or Megan say, I want to be the next security champion. So it really makes it a lot of fun where they are learning and then really doing the right behavior for the organization. Marco?

Yeah, you know, so I believe now, especially nowadays in the era that we're in with a lot of technology and AI and everything, it's just becoming more like proof what you, you know, like show me the proof, show me that it's real exists because I have all these security people telling me do not click on the link. What happens if I click on that link? So it almost becomes curiosity, right? So, you know, one of the things that, and like Francisco said, we do a lot of events with Pacific Hackers and our events are like zero to hero model. And we have like the 101 model where we, you know, we're teaching you the basics. You know, we really like to, you know, to show that to people that, you know, this is exactly what happens when you click that link. You know, that will go to an A/C tool or maybe it will download an attachment, right? And this will out of, You know, explain it like in pieces, but like with actual data. And I think that's one of the things that our current, or like most of the, uh, uh, or it's getting better, but some of the security awareness trainings are lacking on that. You know, they're just showing the, the, uh, the information, but it's not really giving you the context. Like, okay, all right, yeah, it's a lot of, you know, BS. What if, like, now I'm gonna against that, I'm gonna actually gonna click on that, see what happens. I don't care if I get nailed by the IT security team or whatever. I want to see what happens. And, you know, if we start showing exactly what is happening, if that happens, guess what? People are going to be like, oh, okay, then I'm not going to do it. I'm going to share on the chat, there's a movie that was created by the FBI about 3 years ago. It's called Made in Beijing. Where it actually shows the consequences of insider threats, how it started and everything. And without obviously, I already cannot say a country's name, but this goes just to any other country who wants to take advantage and stuff. When people don't realize that this is actually happening, they'll hear all these political rallies and say, oh, this country is doing this, this country is doing that, they want to take over the world, blah, blah, blah. Well, that's just a lot of, okay, well, how? Well, this movie definitely shows how. If we recall, and Bob might know more about this than probably me because he has been in the industry longer than me, but APT-1, when Kevin Mendiant fine, you know, the first APT, APT-1, when, you know, this, um, the Chinese Library of China, uh, cyber unit was, was found stealing, uh, IP from U.S. companies for over 10 years, and that was 2006. So 10 years, that was back from '96. So they already have, you know, all these technology advances, and if you recall, and again I always like to show the facts. I just don't like to talk just to talk. If you see a lot of the products that were created in the early 2000s, you have like the US version and then you have the Chinese version almost identical, right? And you're like, how does that happen? One of the biggest cases, and we all know about this because it was in 60 Minutes and all that, Nortel Networks, a Canadian company, telecom company, and make network equipment. They went bankrupt. Why? Because they stole all their IP and basically the products they were trying to sell, another Chinese company were selling it, the same thing for cheaper. And guess what? As a consumer, well, you want to go for whatever is cheaper if they're providing the same service and product, right? So anyways, enough, enough to say on that because we can go on and on. But the whole point about this is the fact that, you know, people need to know what happens if you do harm, or like if, if you click on that link, what happens if you click on that link? What happens, you know, when you open that attachment? Where does it go? Like, how is people like looking into that?, and stuff like that.

So yeah, yeah, I gotta, I gotta, I gotta add that movie to my watch list. I recently rewatched Black Hat with, uh, Chris Hemsworth, the Thor actor. Uh, I love it. So I'm definitely gonna put that in my watch list. You mentioned, uh, Marco, you mentioned— I think this makes a fantastic segue and transition— you mentioned AI. And Bob, you mentioned earlier the, uh, shared responsibility model, which reminds me a lot about AWS and learning about the AWS, they have the shared responsibility model. With the advent of AI and how big it is becoming nowadays, and it's, it's, it's, you know, it's, it's even not just on a professional, corporate or level, but a lot of regular users and people back at home. I mean, like, my mom sends me sometimes questions like, oh, this is what ChatGPT told me. Okay, well, take it with a grain of salt, mom, whatever you do. And, you know, take it with a grain of salt. Don't go just listening into what it says. Developers are using these tools to develop nowadays. What risks do you think— and I know, Bob, I know you've done some work with AI too in Cuba and in Puerto Rico. What do you guys see are the risks for insider threats nowadays? With the boom of AI and then just all these AI tools being involved in our everyday, from work to, like I said, the regular, regular users, mom and pop at home.

Do you want to go first, Marco?

Yeah, I just want to share, well, since you're talking AI and going back to what I said earlier, I mean, there's a case still pending, right? You can go and still pending in the courts, but there was this Google— ex-Google employee that got a VP of an AI company in China. And going back to what everything that we say so far, like, you know, exfiltrating data and all that, everything has— he did. And then all of a sudden, like, with this, you know, he was making really good money at Google, but he obviously was going to make like probably 100 times what he was making at Google in this new company. Well, you read the story, the day that he was traveling to China, that's when he got caught by Secret Service. So that explains it all that with AI, you have to look at it from different perspectives. You have— it's, well, and at the end of the day, it's about trust. You have to trust the tool, but you also have to understand what are the sources of how is the language model being trained and such. So it's fine to trust the tools, but there's always going to be, like you said earlier, just don't believe everything it says. Still do your research because there might be something in there that might not make sense. And with insider tracks, I mean, you're giving out power to people who are creating these models. And today they're working at this company and tomorrow they work in this company. It just happened recently with this guy who got hired by Meta. Right? So with a lot of billion money. So yeah, I mean, now— and that's not insider trade, by the way. That was just a legit, like, I just got an offer, a better job, I'm going to the other company. Well, guess what? That guy was the one who's creating a lot of these things. So now it makes you think, like, okay, so should I trust now the Meta AI versus the other one? You know, it just opens a lot of questions. And there's unfortunately, it's just there's no right or wrong answer. It's just like, take it as you go, but don't— again, don't trust everything that it says.

Still do your research. Yeah, and I think one thing I would add to what Marco just said is, with artificial intelligence, another thing that scares me is the automation, right? Because AI doesn't sleep 24/7, doesn't need to take vacation leave, sick leave, or any of that. So people, especially if they are intentional, They can now use, and they have, let's say, privileged access into your network. They can use AI tools to automate data exfiltration and generate deepfakes and do a whole bunch of damage automatically. You know, it's completely automated. What used to take them 5 or 6 hours, now they can do in 5 minutes or 10 minutes. So we have to be a lot more vigilant. But also, you know, data sensitivity and model training. How many of you, especially companies who say nobody uses AI, it's our policy, I bet you people are still using AI. And what's even worse is they could be using ChatGPT, Copilot, or whatever it is, but now they are using your internal IP, right, your intellectual property. And all of a sudden Microsoft has it, OpenAI has it, and Claude has it, or whatever AI tools they are using. So employee, again, with access to sensitive data might inadvertently leak them by uploading them to public AI tools. So something we need to be worried about that we didn't have to worry about 10 years ago. But it's also the adversary now. You mentioned APT from China, APT-1, That's a nation-state, so they have all of the money, the resources of a nation, and they're going after you. I mean, and they are relentless. So the good thing, even when we talk about the election back in 2016, when they use Facebook and all of that, allegedly Russia did that, but by knowing you, and especially with social media, people say where they were born, what they like to drink, what they like to watch, the music they like to listen to. Now they know exactly who you are. They have that psychometric view of the person in such a way that if they put something in front of you, it's going to be very, very difficult for you to resist because it's almost matched to your DNA, to the person you are, to your psychological profile. And then it's much, much easier for you to say yes, whereas before they would try a whole bunch of stuff, but most of it is not going to work because, no, you— like me, for example, I don't drink, I don't smoke, so you can come with all of the liquor you want, all of this smoke or drugs, I am not interested. That's not how you are going to get me to click on the link. But if you know exactly what I like, what time I get up, how long it takes me to go to work, who is my employee, where are we located, and we do all of this even when you just take a picture with your phone. Many times without you knowing it, your GPS location is already built into the picture. There is a lot of things they can know about you. At one point, I think it was the Chinese, they would use your Apple Watch or whatever you use for exercise,, and they will see a bunch of military people running and moving places. So now they are able to put one and one together and know exactly what you're doing or what you are about to do. But I mean, having said all of that, what I'm saying is with artificial intelligence, those foreign intelligence services, and that's all they do, and they are very, very good at it, they can use AI-powered social engineering to identify and target disgruntled employees and more effectively recruit them much, much faster and a lot more precise because of social media and AI that can now pretty much speak to your brain, basically give you something that is going to speak to you and it's gonna make you more than likely to say yes when you normally wouldn't be. That's why again, I think awareness is so important. Yeah, I think you guys bring fantastic points.

I have heard, I mean, I'm not sure the extent of the truth on this, but I have heard that some big companies like Meta, Google are paying a lot of money for some of these engineers, AI engineers, uh, just to, just to keep their IP that safe and just to, you know, get ahead in the, in that, in that, um, in the industry. So I imagine though the types of risks that, you know, even, you know, other countries offering some of these engineers additional money or, or additional things just to get their hands on, on some of this information or, or proprietary, um, intelligence and knowledge would post. But I want to transition now, guys, a little bit more. We're also celebrating Hispanic Heritage, and Marco, I know you have, you, uh, uh, heritage, Hispanic heritage yourself, and Bob, you've done some work with other organizations to bring in more representation and to the Hispanic community. You've done work in Puerto Rico and Cuba on how AI— we can use AI to bring awareness. In what ways do you guys see that diversity and different cultural perspectives initiatives bring in or benefit national security as a whole, having all of this included, diversity in national security?

I don't know if you want to go first, Marco, but one thing I would say about that, I think diversity, equity, and inclusion is very important. In our country, in America, we say, you know, out of many, one. We are this melting pot, and I think that is what makes us so strong and really the envy of the world, right? And I believe it is so important to be an American but to also keep that heritage from wherever you come from. Like me, I am African-American originally from the Congo, very proud of that, but I am an American as well. So having a diverse team, I think, really, really makes you a lot stronger. Actually, The stats now show not only more diverse teams actually make a lot more money, are a lot more performing than homogeneous teams. We have data for that. So specifically for the Hispanic, I can go back in the military, for example, World War II codebreakers. A lot of what we were able to accomplish wouldn't have been possible without Hispanic Americans. During the Cold War, a lot of the intelligence officers had significant role in us winning the Cold War. I don't know if you know, but Colonel Lisa Carrington-Firmin, she's the very first— I really was surprised— the very first colonel in the U.S. Air Force. Can you believe that? And she is Hispanic. For example, Elizabeth Augusto, who's at BNY Mellon, she's a security executive, so The contribution has been a lot from the Hispanic community into national security, cyber security. I think bilingual skill, very important, our resilience and cultural fluency. Another thing I really love with Hispanic in general, there is this familismo. I've got to learn. They really love loyalty to family, to community. And when they come to work, they also have that loyalty to your org organisation, their values and the country. So I think Heritage reminds us that security is about people, people first. You know, in the Navy we say mission first but people always, but basically at the centre of it are people and people need to come with who they are, they need to feel accepted, they need to feel like they belong and they have something to provide. So it's not just about policy, it's really about people, so that's why I think it's important and why it should be celebrated.

One thing you mentioned earlier, Francisco, is a key word here, and I think it resumes everything what Bob said. It's about representation, you know. If we continue, you know, coming from the Latin, you know, Hispanic culture, if we continue doing the jobs that we normally people see us doing, we're never going to change things. We're never going to be able to to let people know that we're capable of, right? And thus we're not gonna be trusted. And I think going back to what we said earlier, it's about trust too. So it's my struggles and that's again the reasons why Pacific Hackers exist, right? Because of the struggles that I went through when, you know, pretty much all my life, right? And it was shared by other individuals who co-founded this organization too. But yeah, I mean, at the end of the day, this is telling people, especially like within us Latinos, it's like, hey, you know, there's actually people doing this somewhere else, you know, and we have people. So don't think that, you know, you're alone. But we need more. We're definitely in the percentage of how many professionals are in this industry, both in tech and security, we're definitely like in the probably in the last 5% nationwide, right? We need, you know, while others excel like in the 25, 30 plus, right? So we definitely need to improve that. And one way again to do it is representation, you know, start creating these, you know, well, organizations like, you know, Pacific Hackers, RACI Cyber, you know, things that are, you know, that are focusing on Latinos, but also, but also make it diverse to where everybody's welcome, not just because it's a Latino-oriented doesn't mean that no one else can come, right? No, make sure that you invite everybody, right? So I think that that will be a way to fix some of these things, you know, from a cultural perspective.

100%. I mean, I agree with— I was also born in Latin America, so my experience, I feel like has been a little bit different from some people, and I think that has helped me also build resilience in the field. It also has brought a distinct set of skills that I've even, you know, I've been able to apply professionally and, you know, throughout my life. So talking about that, how would you guys say that different culture, like different cultural backgrounds and experiences, cultural experiences and personal experiences add to cybersecurity and the field of security as a whole? What are some of the benefits that we see when we're not so monotone, where we're not thinking in the same, you know, in the same way? We share different experiences, different backgrounds, and that— what does that bring to, you know, in your perspective?

Yeah, I'll take this one really quick because it just literally happened to me just recently, and also like in my everyday job with my customers. Definitely, again, comes back to the culture and how you grew up and such. What I've seen with a lot of my Latin customers is the fact that it's kind of hard for them to say they have to pay attention and also invest in cybersecurity. Because the example I want to give is like recently I went to Mexico to do some legal paperwork, and nowadays they're finally getting into technology, right? So without going to mentioning the organizations or anything like that, I have to get my digital signature that I could have actually done it remotely. Well, they want me to show up in person, see my face and all that. You have to go through all these security phases, you know, just from getting to the building to like, you know, I don't know, it was like 3 checkpoints to the point where like they asked, you know, they asked me for my USB. That's where they were going to place the, you know, the digital signature. And me thinking as a kind of like as a hacker, it's like, what if I have a hidden, you know, script that as soon as and such, right? So, you know, so the moral of the story here is the fact that they invested so much in security but not so much in cybersecurity, if that makes sense. And going back to to the cultural aspect of it is the fact that—

I don't know if it's— Right?

They don't really put the money in cybersecurity because they don't see that as like, well, what could happen? Like, if we get hacked? And again, especially the executives, they don't really know what happens when they click the link, right? Comes back to the education, right, the training. So again, that's pretty much what I have to say about that, but it definitely, it comes back to the culture, right?

Yeah, and one thing I would add, Francisco, before I talk about the benefit of diversity on a team, like this is a book, for example, from one of my mentors, right, General Colin Powell. I came here to America back in 1996, and after 9/11, I joined the Navy. As an E-1, the lowest rank in the military. But in my mind, I knew it's possible for me to become a senior officer. I'm not sure, I think military is online.

I see circling.

Can you, can you still hear me?

Yeah, I think, I think there's a little bit of issue, but we can, we can hear Bob.

Okay, okay, good. So, oh, okay. I kind of knew that, yes, uh, it's possible for me, I can become a senior officer in the most powerful navy military in the world because 'Kellen Powell did it. If he did it, he looks just like me, then I can do it too.' So really, representation really, really, really does matter. If everybody is white, everybody is middle-aged, and everybody is male, then it's like, 'Okay, that's not me, so it's probably not possible.' So, and I also really truly believe all of our industry should reflect the diversity in our country, and that just makes sense. But talking about that benefit of diversity, let me think of 3 or 4 things I think that are really important, especially when we talk about national security or cyber security. One is the broader perspective and problem solving, right? Cognitive diversity, having people who think completely different, that really adds so much to the organization. And in cyber security and national security, adversaries tend to exploit blind spots, right? But when you have a diverse team, it's less likely to think in a single channel way, so that really adds a lot. Stronger trust and engagement as well. When people feel like you can be who you are and you are part of the team. So by becoming a sailor, a member of the U.S. Navy organization, doesn't mean that you are no longer Black or Hispanic, you are still that, but you are also one of us, you wear our uniforms. That provides psychological safety, you know, you belong here. And then there is improved performance and outcome. I mentioned earlier, I believe it was McKinsey and also the Harvard Business Review, they did studies and consistently teams that are diverse, they outperform homogeneous team in profitability, which businesses like that, making money, creativity and decision quality, always, always outperform them. And then finally, if I can add one more is also that heritage as a source of resilience as well, your cultural values. Like I said, for example, John speaking in the Hispanic community, no, familismo, family loyalty, but also ubuntu, right? I am because we are. So that built into a framework of resilience and ethical responsibility. So heritage stories of migration, sacrifice, overcoming adversity inspire perseverance in teams facing modern challenges. So I think because of all of that, diverse teams are a must. We must be. But the thing for me is you do have to be intentional about leading a diverse team. Otherwise, all you're going to get are white male on your team because that's where you look, but you have to be very intentional. I want this team to be as diverse as possible so we can have all of those benefits and give everybody a chance.

I agree 100%. I think I want to save the last 10 minutes as we come to a close, guys. I think there might be some audience questions. I also encourage the audience, if you have any questions, post them now. I'm just going to go through here in the order that, that they came in and share it with you guys that so we can address them. So I have here from one of the LinkedIn users, for, for aspiring cyber professionals, especially those from the Hispanic community, what is one non-technical skill that you believe is most critical for building a successful career? Also, how can one leverage cultural fluency and community ties as a professional strength in the cyber field?

When I go first, Marco.

Yeah, I'm just thinking about that one because I can see it from different aspects. I will just summarize to this, and I don't think it's just in particular in cybersecurity, but definitely that's what helped me to speed up my cybersecurity career. It's about networking. The more you network, the more you know, because remember, you can be a subject matter expert or a jack of all trades and master of none. Regardless, you're always going to know less than the person next to you, so know that and understand that it's okay not to know everything and to ask questions. The more, again, the more you network, then you're gonna find out that, oh, this person knows more. Instead of seeing it as a bad thing, it's like, oh man, you know, I'm dumb. Well, no, the opposite, right? Like, ask, start asking questions like, oh, well, so how do you do that? You know, and you have similar, you know, you have some background on the subject. Well, now you're gonna, right? And that's just one person. Imagine if you meet two people and three, and you know what I'm saying? Eventually, those are the people who are not only going to teach you something like skills, they're also going to even give you the chance to find a job and such, right? So I think networking is a bigger aspect. How you do it? Well, I mean, depending where you live, we are very spoiled. I'm going to use that word here, spoiled, here in the Silicon Valley area. 'Cause we do, especially, as in Hackers do a lot of events, you know, twice or three times per month. And we have now like three conferences, right? Some other places like where I used to work or I used to live, we didn't have anything. Like, and that's the reason why I moved to this area because we didn't have anything. And now that I go back and see that the people I, like my old circle, right? They're still in the same place that I left them when I left the place I used to be, right? So again, here you have the— we have the opportunity to move around and swim like a fish, right? Now, it's where you're going to take your career. That's the question. It's actually a question to you, like how you know, how you want to do it, right? So yeah, that's my two cents on that.

Yeah, and if I can add to what Marco said, I think location is important. However, being a technologist, we do have, you know, the internet, social media, and all of those things. Like, even right now, all of us, we are in Silicon Valley, but we are in completely different cities and locations where we are meeting right here on, on StreamYard. So Don't let the distance be the reason why you don't, right? I think you need to reach out. There's a lot of virtual meetup for aspiring cybersecurity professionals as well. So you— I think it's really a way of thinking. We talked about resilience earlier. Don't take no for an answer, but try to make things happen. Because I think in the cybersecurity, I think we are still relatively a young profession. We haven't been around for too long. And people who are CISOs like me right now, we really want to help people who are trying to become CISO or get into this, this career. I think almost everybody I know in this small community really, really want to help. They will take 5 minutes, they will take 10 minutes to talk to you, to mentor you, and really give you great ideas. So always reach out, even on LinkedIn. Okay, I don't know this person is CISO of this bank or this organization, send them a LinkedIn message. Hey, I am trying to get into cybersecurity, you have 5 minutes, can I talk to you? I am telling you, 9 times out of 10, they will always reach back. But someone says non-technical skills. Probably one of the most important ones, I think, is communication. You need to be able to communicate, not just technology language, but actually preferably in business terms, in ways that all of the other functions within your organization can understand. What in the heck you are talking about so you can have an impact. Earlier we also talked about storytelling, so putting it in a way where you inspire people and where they understand why it's important to do what you're saying they should do. Collaboration and teamwork, like Marco says, networking. But I think critical thinking and problem solving as well. You don't have to have all of the answers, but I think it's also your attitude, but always willing to learn, lifelong learners. Really what we are called to. Back when my grandparents were still alive, they went to even high school, that's all they needed. They done for the rest of their life, they're never gonna have to open a book again. But my generation, I'm gonna be learning and learning and always learning. Even when you get the PhD, it doesn't matter, you're gonna have to set up your mind, I will always be a student, because the technology is just increasing in an exponential way. It's impossible to know everything. Even the experts today don't know everything. There is to know about AI subject. So really, I think that open mind— Marco talked about that— but I think also cultural awareness and emotional intelligence, I think, is extremely important as well. I often say, when I came to Silicon Valley, what, 11 years ago, the IQ in this place is just off the charts. We have some people who are so smart, but most of them are not so very nice, right? They don't really They're not very much aware of themselves and aware of their surroundings, right? The way you treat people, the way you make them feel, showing feelings of empathy. And that really, I think in Silicon Valley, we have a lot of work to do with that. So that's a non-technical skill that I believe if you become a manager, or even if you don't have the title, you can really have a huge impact on your team in Silicon Valley right now. And people are going to like you and they're going to come to you even though you are not their boss and you don't have any leadership title whatsoever. Just again, the way you make them feel. And then the last thing I would say, just know the ability to be adaptable because things change. Something may be the most important thing right now, but something's gonna change in national security, in the industry and technology, and then all of a sudden it's completely obsolete and you have to do something completely different. So you need to be, Okay, not to know what the next thing is and be able to adapt quickly. So that's the last thing I would say on the subject.

I just want to add really one thing that I just to also summarize what he said. While networking also invests on not just learning the technical skills, but the soft skills, okay, that's very important because doesn't matter what industry you're in. You're like one of my former college professors used to say, If you can explain it to my— for my grandma can understand, then you're doing, you know, a good— you're going to be a good communicator. So again, it doesn't matter what it is. If my grandma can understand it, then yeah, you can do it. So that's it.

Awesome. Yeah. Thank you so much. Thank you guys so much for that. I love all those points. As somebody with a technical background, I would 100% say that networking with my university, colleges, community around me has definitely been an important part of my career. And I encourage everybody in the audience and everybody out there, if you're a technical person and you're more to yourself, try to be more open or find a friend who is outgoing and step out there, network, connect with your community, connect with your college, connect with university. Your company. Uh, but yeah, go ahead and network. Um, with that said, I think we're coming up on time, guys. I, I want to thank you both for, for being here today with me. Um, oh, well, I've been saying it's like a lecture for me. It's, it's— I've been sitting here learning from you guys a ton. Uh, you guys have brought up, uh, some fantastic points, uh, fantastic learning experience. I want to thank you guys for being here today with me. For the audience, go follow Bob Fabien Zinga, go follow Marco on LinkedIn, connect with them. Remember, networking is your best non-technical skill right now. Follow them on socials, connect with them, ask them questions. And yeah, I want to, you know, this, we're here today with Cyversity. Follow us on social media, follow us online, connect with us, connect with the community. And if you have any questions, feel free to reach out. But with that said, thanks, Marco. Thanks, VZ. I appreciate your guys' time today. And yeah, I hope we can stay connected in the future, do some more stuff. Absolutely.

Thank you. Awesome.

Thank you.

Thanks so much, guys. Take care now.

Bye. All right, that was the 1-hour Cybersecurity Expert Panel that we did on building trust and cultural awareness to counter insider threat, honoring Hispanic and Latinx contribution in national security. All right, I don't see any question, but I would like to acknowledge Alex. Thanks so much for being here, Alex, from West Texas. And Alex, you can also let us know what is one thing you are grateful for today, or if you guys have any question for me, please let me know. Right now I don't see any question on LinkedIn or YouTube. However, we also broadcast on Twitch. Usually people play games there. I don't think they listen to me very much, but someone with a call sign Zurion1991 said hi. So thank you for watching or letting us know that you saw us there on Twitch. All right, we are going to bring this to a close, but before I do, let me share my screen really quick and I'm going to give you, um, what you really need to get out of this. So I, um, let me make it bigger. I, um, I'm sharing my screen. So I wrote this article right after the, uh, expert panel, Building Trust and Cultural Awareness to Counter Insider Threat: Honoring Hispanic and Latinx Contributions in National Security. So here I'm really focusing on the leadership lesson, right? I don't want to get too technical, but basically write your non-technical skills that matter. And coaching takeaway for aspiring leader, if you want to be a leader, whether it's in security or in any business, I think trust is the foundation of security, I say, but business, it doesn't matter what you do. You need to be able to build trust, right? Because when you do business, you have to deal with people. People are the people you interact with, no matter what you do. Whether you're a doctor, a lawyer, a computer expert like myself, or in the military, you're gonna have to deal with people and you're gonna have to develop trust. That is super important. And you don't have the technical skills to undo that, right? I think in life you need IQ, which is intelligence. I think technical skills fall under that. But you need EQ as well, emotional intelligence. But then you also need AQ, adaptability, right? And those are things that you can learn that does not require you to be technical in any way. Again, having the trust of your people and having them trust you, cultural competence, I say, is non-negotiable. It's very important, especially in the time we live in, right? 2025. Since I was a commanding officer at Ginochs, Suffolk, in Virginia, for the first time of my life, right, I was working with people from 5 different generations, from Gen Z all the way up to the baby boomers, and we were all working, you know, in the same place. And diversity is just going to be a part of life going forward. And you need to be able to deal effectively with people from different generations, but also from different cultures, right? And then also says leadership sets the culture. So as a leader, you decide what the culture is going to be like, and then you also make sure that you model it for your people, for your organization. So I say celebrate diversity as strength, and it is. You don't really want a monolithic team, right? You need people who think differently, who come from different universities, different background— male, female, Black, white— and I think that's going to make your team highly, highly performant because this way, everybody doesn't have the same blind spot, right? So we can really learn from one another and do so much better together. And then the last thing I say is invest in people, not just tools. So really, when it comes down to it, really, leadership in cybersecurity, in privacy, national security, it's really all about people. In the Navy, I've learned mission first because you do have to accomplish your mission. That's the reason why you are on the payroll. However, people always. Your people are your most important asset. Take care of them and they will take care of the mission no matter what you do. All right, that's all I am going to say. And thank you, thanks again for being, uh, with me. I'm gonna be back tomorrow, and tomorrow we are going to have a, uh, uh, I believe we're gonna do the 10-minute AI recap of the conversation I had with Chris Irving. You do not want to miss it. We had the 1-hour leadership conversation last week, and tomorrow we are going to have a 10-minute recap of that conversation. I'm going to be here at around 6:30 AM Pacific time, so 9:30 AM Eastern time. All right, until tomorrow. Thank you. Thank you again, and see you then. Bye everybody, this is Coach BZ. Thanks for watching. Until next time, don't forget to like, comment, and share.

Thank you for listening to the Leadership and Success Podcast with your host Coach BZ. If you like what you heard, please subscribe to our channels and come back for more wisdom nuggets on how you may develop into a better leader and achieve greater levels of success. Leadership is the most critical skill. The world will always need leaders to lead others, deploy the next disruptive technology, or execute a business strategy. You may as well decide on counting yourself among the 21st century leaders. See you right here next time on the leadership