S5:E124🎙️LIVE with Ariel Evans (Multi Tracks Audio)

¡Hola! Hi, I'm John Maxwell. When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation, I'm proud to say, is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend, Bob Fabien Zinga.

Welcome to the Leadership and Success Podcast with your host, Coach BZ, where we help you lead with purpose and succeed with impact. If you're ready to grow into the kind of leader others want to follow, this podcast is for you. If you're determined to elevate your success and leave a lasting legacy, this podcast is for you. As my mentor, Dr. John C. Maxwell, reminds us, everything rises and falls on leadership. Our goal is simple, to inspire you, challenge you, and equip you with insights that can transform the trajectory of your leadership journey. Welcome aboard. Welcome aboard to another episode of the Leadership and Success Podcast with Coach BZ.

It's not about precautions, it's about understanding the responsibilities of the board and how the board looks at cybersecurity. Today we see boards and directors being held accountable. Recently, Aon announced that cyber events now rank among the top 3 triggers for D&O, derivative actions. That means that the directors and officers are being held personally responsible for cyberattacks. This is a game changer. What we've seen in the past is that the IT people go into the boardroom, the CISO presents a list of 300 vulnerabilities, the board's mystified. They don't understand cyber jargon, and nor should they. The boards have the fiduciary responsibility to protect the assets. The way to do that is to have an effective strategy. The only way to rebut those types of D&O derivative claims is to show what kind of a program you have in place. That program consists of having cyber insurance, it consists of having the adequate cyber budget, and it consists of understanding how do you prioritize the risk you have in cyber as it relates to the impacts that you have from all the different types of cybersecurity incidents, findings, and vulnerabilities that the company is going to be exposed to. It's the job of the board to provide that level of oversight. It's not the job of the board to actually go and fix things. That's the job of the CISO and the operational cyber team. Well, a couple things with Uber. First and foremost, there looked like there was insider trading. When the executives started selling their shares before they announced the breach. This is a big no-no. You should not do that. You will have SEC implications. The second thing is, is that they didn't disclose the breach promptly. So the new New York State financial services regulation is saying you have to disclose within 72 hours. The GDPR is saying you have to disclose in 72 hours. So there's really more clarity on disclosures. And I think the whole disclosure process is interesting to talk about because you really need to have a policy in place for data disclosures, or data breach disclosures, excuse me. And what we're talking about is, you know, if you identify something that looks like a breach, what is the process for validating it? And then who's owning that process? How does it go to legal? Legal should be a part of that process, they should be involved in the disclosure itself. And then what is your remediation plan? I think some of the times when you see these organizations disclosing, Equifax is another great example of how not to disclose. You know, they were basically like, yeah, we had a breach and we're gonna offer you credit monitoring, and it's like not good enough. And it seems to be a very laissez-faire attitude towards the consumer. And so now you're seeing—

All right, we have a very special show today. And before I bring on my guest, I am going to— we're going to start with what we call here our moment of gratitude. This is where we take just a moment every single time that we meet to be grateful. And part of the reason why we do this, as you know, is because in the military, a lot of active duty service members and veterans commit suicide. It's about 21, 22 suicides every single day. And we do believe that it's not possible to be suicidal and grateful at the same time. So you should already know what to do for those who've been following the show for a while. So if you would maybe close your eyes, Everything we've been able to accomplish so far, I think we haven't been able to do it all by our own. Somebody else helped us get to where we are, and I am so grateful for that. For example, today, the great expert we're going to be speaking to, she's willing to take an hour of her time to come to us and teach us from her experience so we can learn from her wisdom. And I am so, so grateful for that. So let us know in the comments what you are grateful for. And also let us know where you are joining us from, what city, what state, and if outside of the US, which country. And also, if you have a question for my guest, type it in the comments and we will answer live. Okay, let me see if I can properly introduce our guest today. Today I am really happy we're going to be talking about, uh, from cyber risk to business resilience, right? Leading in the age of artificial intelligence and digital transformation. I'm really excited to welcome Ariel Evans to the Leadership and Success podcast this morning. Ariel is a cybersecurity pioneer, a serial entrepreneur, a former CISO, author, educator, AI governance expert and one of the leading voices in cyber risk quantification and digital resilience in the world today. Over the course of her remarkable career, Ariel has founded and successfully exited multiple technology companies, advised Fortune 1000 organization boards, regulators, and insurers. She served as a cybersecurity executive and trusted advisor, educated thousands of cybersecurity professionals and leaders, and authored influential books including Managing Cyber Risk: Enterprise Cybersecurity in Digital Business, and also the book we're gonna be talking about today, Navigating Supply Chain Cyber Risk: A Comprehensive Guide to Managing Third-Party Cyber Risk. This book is so timely. So as organizations increasingly depend on digital ecosystems, AI, cloud technology, and third-party vendors, leaders must learn how to navigate risk while enabling innovation and growth. So this conversation is going to be for anyone who's in the tech industry or one who aspires to be. Part of what you're gonna be learning today is what cyber risk, uh, why cyber risk is business risk, but also practical leadership lessons for aspiring CISOs, entrepreneurs, and executives. And one of my favorite themes from Ariel's work is Cybersecurity is not just about protecting systems, it's also about protecting business value, trust, and organizational resilience. So ladies and gentlemen, without any further ado, please help me welcome to the Leadership and Success Podcast, the one and only Eyal Eivan. Good morning, Eyal. How are you doing today?

Great.

How are you? Good morning.

Good. So, so grateful that you are here. Maybe to get started, what are you grateful for this morning? I guess it's noon over there.

I'm grateful for a lot of things, but I would say first and foremost is my family, my wonderful daughter, her children, my husband, and all the aunts, uncles, and cousins that I have. And everything that I do, I hope will be something that they can follow and use in their day-to-day.

That is so powerful. Thank you so much for sharing that. Is there something about you that most people may not know just by looking at your resume or meeting you the first time?

Um, yeah, uh, I lived overseas for a decade and a half, um, came back to United States recently and, um, had an amazing experience, um, you know, looking and following and traveling the globe. And seeing other cultures and other people and just enjoyed it immensely.

Wow, that is, that is pretty awesome. Which, which country did you visit?

I visited many of them. I was in Israel quite a bit. I was in most of the countries in Europe, you know, looking at Israel from, you know, the startup nation, cyber nation perspective, and spent quite some time in Greece, Portugal, in a number of other countries and really got a lot of wonderful experiences from that.

So, so wonderful. Now, you've built companies, sold companies, served as a CISO, advised boards, written multiple books, like I said in the intro, and helped shape the cyber risk industry. Looking back across your career, what leadership lesson took you the longest to learn?

It's interesting. I guess I would go with there's no such thing as failure because from every experience that you have, whether the outcome is what you wanted or what you didn't want, you learn something. And by learning something, you grow and you move forward in your career and in your personal goals. And I really think that there's no such thing as failure. And the other one is Winston Churchill. I think said this best, is like, never, never, never give up. And I think that's so true if you're an entrepreneur and you're, you know, just starting out or you've been established for a while. You have to pivot with markets, you have to figure out what your next move is, and that's the fun of it too. It's challenging and it's also interesting and keeps you young, I hope anyway. And I love it.

Wow, that is so insightful. Never, never, never give up and no such thing as failure. I guess you can always use failure as a way to learn something you didn't know, right? Which is quite fascinating because especially in Silicon Valley, we, I guess in America in general, we like to talk about the great successes people have had, but we never really go through how they had to fail in order to achieve success that they did. You being a serial entrepreneur with multiple successful exits, what do you think separates entrepreneurs who build sustainable companies from those who simply build products?

It's really understanding the market and knowing if the market is ready for your product. That's one lesson I learned way in the beginning, as I had tried to do something that the market wasn't ready for, and I had to pivot and do something else. If the market's not ready for your product, then you really have to, you know, move on. You can't sit there and say, okay, well, I'll wait 5 years and the market will be ready. That's not going to happen. You won't be around.

That is very, very wise. So, a lot of the cybersecurity professionals who listen to the show, some of them, they dream of launching their own company. And of course, here in Silicon Valley, everybody thinks they're going to start in the garage of their parents and become the next Apple, the next Google, or whatever. But what skills beyond technical expertise you think are essential for becoming a successful founder?

Emotional intelligence is probably number one. Understanding and reading people, knowing what they're really saying. That can be very different from culture to culture. And really, it's important to understand, you know, are you hearing what you want to hear, or are you hearing what you need to hear?

That is Quite powerful. Not what you want to hear, but what you need to hear. Wow. I guess that takes some humility too, doesn't it?

Yes. Being humble is really, I think, the central core principle of success. Being able to listen and weed out what is being said in your best interest versus what is being said in their best interest is definitely a talent and something that you learn over time. And understanding, you know, who are your trusted besties, right? Which I have many of, which I'm— that's another thing I'm very grateful for, by the way, is all of my support I have from my advisory group and the people that I've been working with over the years. They're amazing. I didn't hear what you said. I think we just got cut off somehow.

Oh, sorry. Okay, can you—

I hear you now.

One of the books you, you mentioned my audience should read is Rich Dad Poor Dad, which is a book my audience is very familiar with. And it is true, as an entrepreneur, you, you can't really do everything all by yourself, right? You need to have a team of experts. That's really how you become so successful. Do you think that artificial intelligence may be changing that in the future where people become solo entrepreneurs and they use AI instead of relying on other people?

I do think that it's very helpful. It does a lot of things that you may not have the capital to actually do in terms of research and, collating data and things like that, which is incredibly useful to an entrepreneur. Um, it also can provide you with, you know, if you ask AI, like, who should I talk to about X, Y, or Z? AI is going to come up with a bunch of people that you can reach out to. And I find most people are very willing to discuss things with you. Um, particularly, um, a couple other people that come to mind are the Ravikant brothers. Kamal Ravikant and Naval Ravikant, who've been incredibly successful in Silicon Valley and also have been very candid about when they haven't been successful and what they did to pivot from there and how they changed things for themselves. Those two are amazing. I would highly recommend listening to them. I think they're wonderful.

That is so, so important. Thank you. Thank you so much for Thank you for mentioning that. Now, you have led organizations through growth, acquisition, and transformation. How do leaders maintain clarity and focus when uncertainty becomes the norm?

That's probably the biggest challenge most leaders face is not to get distracted by things that are not primary to your, to your goals. And the only way to do that is to keep your goals in front of your face at all times and make sure that you are actually doing actions that get you there versus actions that take you away from those goals.

Very wise. So what do you think then is the biggest leadership mistake you see highly technical professionals make when they transition into executive roles? Or entrepreneurship?

That's a good one. So one of them would be that they do not speak the language of business. They are very technically focused. They can tell you anything you want to know about that, but they can't translate that into the business value, and they can't get the boards or the senior leadership who make the budgeting decisions to understand what you're talking about. That's one of the things I think I've been able to master over the years, and I'm very grateful for that as well. The technical aspect of it is incredibly important. However, the aspect of really making it happen is up to the business.

That is so insightful. And it's true, especially when you go from individual contributor to becoming a manager and later an executive. You really need to be able to speak the language of the board and the language of the C-suite, which is business and not technical jargon. I guess you almost become like a translator in many ways.

Yes.

Which takes me to the next segment where you've done a lot of work and I think added a lot of value to the industry's cyber risk being a business risk because you've spent years helping executives and boards understand cyber risk. Why do so many organizations still view cybersecurity as a cost center rather than a business enabler?

That's a great one. Unfortunately, because cyber evolved out of networking, which is information technology, and IT has always been a cost center, people tend to still bucket it that way. However, when you look at cybersecurity from the business perspective, it's the number one business risk, but it can also be one of the number one business advantages. Um, we have a lot of different aspects of the business that are intertwined, interrelated to cybersecurity, everything from compliance to legal to audit to governance to third parties. Um, and of course the security itself. And if 95% of your business is an IT asset, which it is today, then 95% of your business value derives from that. So we have to protect those assets and understand exactly what their values are and what their risks are in terms of both the cybersecurity piece of it, but also in terms of credit liquidity and operational resilience and all the other tentacles that your IT assets are actually influencing. And I call it orchestration, for lack of a better way to say it, but it's really about getting the organization to understand that, you know, this is really where it's at for you because this is how you are making your money.

Yes, I guess as a cyber executive, a tech executive, you really do need to understand the business. Let's say you walked into a board meeting tomorrow. You only had 5 minutes to explain cyber risk. What metrics would you present to the board?

First of all, the cyber risk tolerance of the business. How much could they lose in the event of a cyber attack and still remain either sustainable in the case of a mid-sized business or not have strategic initiatives and M&A impacted in terms of larger companies? How much cyber insurance should they have? That is a risk transfer mechanism that is critical to risk management. And then what are the top assets that they're protecting? How well are they protected? And as they grow, most companies growing through M&A, how are they incorporating that strategy into their M&A so that they're not really acquiring liabilities versus assets in terms of their cybersecurity? So there's quite a bit to talk about in 5 minutes with them. But if I was to only have 5 minutes, that is exactly what I would tell them.

That is, I think it is really critical because in my opinion it looks like many organizations I have worked in, the board, they don't actually do their job because in my opinion, that's just me, I wonder if you agree, in many organizations, especially in the startup world, it looks like the CISO or the head of IT and security is the one who tries to define the risk for the organization. To me, that really should be set up at the board level, right? Because what it looks like to me is they looking for a scapegoat and then when things go wrong, "Hey, you are responsible, you get out of here." And I feel like it's kind of upside down. But I guess the question I have for you, because you've worked not only in startup but in large enterprises as well. How should it be set up? Who should actually define the, the risk for the organization, and what should be the role of the head of IT security or CIO or CISO, in your opinion?

So when I look at how organizations are looking at this, It's definitely backwards. As you said, the chief risk officer is definitely the best choice. And that person is responsible for not only cyber risk, but enterprise risk as well. Cyber risk should be a part of your ERM. There's no doubt about that. The CISO should be complementing that role with metrics that actually help that person to understand everything I just talked about. What is the tolerance, how much insurance do you need, what are the top assets you're protecting, how well are they protected, and then building business cases around getting more budget for areas where we are woefully unprotected or where the risk is not adequately protected against the business. And that extends to both IT and OT.

Yes.

Critical infrastructure in OT is something where, you know, 70+% of the issues that we have in OT are coming from IT. So we have to understand that.

Wow, I think that's really a masterclass for every cyber executive out there because in some organizations it seems like the CISO tries to have a budget just to have a budget, you know, just to, I don't know, have technology, I guess, for technology's sake. But when you can actually relates that budget to a specific asset and risk that the organization cares about, I think it makes it so much easier for you to get the support from the C-suite and the, the on-board. That makes a really big difference, doesn't it?

It does. And I think another aspect of that that I'd throw in there is the whole idea of supply chain where you're outsourcing, you know, 60+% of your infrastructure or your services or your system development now. And the risks that you inherit are the risks of that third party. So whatever that third party isn't doing correctly becomes your risk and you have the responsibility because it's your data. So a lot of people think, oh, I've outsourced this to, you know, KPMG or to someone else, right? And guess what? That's an incorrect way to look at it because that's not the case. It's your data and You are making the decisions and you're the one who's going to have to answer to the regulators. So it's really critical to understand that that is the way it is.

That is so, so important, especially in this day with AI. I feel like people need to be more aware just of how much third-party risk they are really, you know, they really need to deal with. I think sometimes we don't even realize all of the vendors that we really rely on in order for us to accomplish our business. So you have also pioneered what I think is critical, is cyber risk quantification, because for the longest we've only said high, medium, low, or something like that. But you actually come up with some numbers that make sense to the business leaders across the organization. Why is translating cyber risk into financial language so important for executive decision-making?

Because that financial risk directly impacts your ability to grow your business. So if you have a cyber event, so let's take a ransomware, let's look at Jaguar Land Rover as an example. Um, what happened? They were not able to restore their backups because their backups weren't clean. They were infected with malware or they were encrypted by the cyber criminal, and it took them almost 2 months to get back up and running. That impacted their whole supply chain. So we were looking at a $1.8 billion loss by that organization. That loss has to come from somewhere. And where that comes from is your M&A and your strategic initiatives, because you can't take it— you could lay off people, sure, but you can't make production if you lay off certain people. So it's really about understanding the interdependency that you have with your information technology systems and the cyber risk that they have and being able to implement technologies, people, process, and tools around them to reduce that risk so that you're not having those kinds of $1.8 billion catastrophes. Wow.

Yeah, yeah, that's, that's the thing. If you don't take care of cyber, you know, it can be really, really costly. I think, again, some organizations think of it as a cost center, but the reality, it's really and investment because if you get hacked, you have a breach, you're gonna be spending a lot more money. So let's talk about boardroom leadership and governance. Again, in my opinion, I feel like in America, our board of directors need to do a much, much better job than they have been doing. What do you think are some of the biggest cybersecurity blind spots you see at the board level today in general?

That's a great question. Well, first of all, it's the metrics that I talked about, not understanding that these are really the metrics that you should have. When a CISO walks into a boardroom with a list of 100 vulnerabilities and then makes that their report, that means nothing to the board. It means a vulnerability is a weakness in a system that can be exploited by a cybercriminal, right? Okay. Yes. You have to understand and manage those. That is critical to your role in operational security. However, that means nothing to the board. That doesn't tell them where they should be investing the money. That doesn't tell them where the risk really is and how that can impact them operationally. That's the biggest problem is the translation of the financial aspect of this to the board. And that's why I created cyber risk quantification and the methodology, which is called the Digital Asset Methodology, which is actually linking back each asset to the, type of risk that they have. In cyber, it's data breach risk, it's ransomware risk, it's DDoS risk, it's regular, and it's long tail also. It's regulatory, operational, legal, etc. So you have to understand like how those all interplay together and what those look like. If you don't have those metrics, then you're flying blind.

So, so true. And for those who are watching, listening to the podcast now, if they wanted to learn more about your cyber risk quantification methodology. Where can they go to get more information?

Um, several places. Um, so our books are available on Amazon, which is Managing Cyber Risk, which is about cyber risk quantification and enterprise cybersecurity and digital business, as well as if you're interested in the third-party stuff, there's Navigating Supply Chain Cyber Risk. But RiskQ is the company that actually has taken all the research and productized, automated, and commercialized it for the organizations to actually have this data. And we work with large companies, small companies, and we work with the insurance as well. And that's something that's really fascinating because the insurance market is finally understanding that security questionnaires are not enough.

Yes. Yes. Wow. And that's on risk-q.com.

Wow, that's correct.

So how should then board members, how should they think about their fiduciary responsibility regarding cybersecurity and digital assets? I think in America, it was around, what, 25 years ago, right, with Enron and all of that. That's when I believe the FTC back then really made, and the SEC, made it a requirement for every publicly traded company to have a, I guess I would say, a financial expert on each board, and I feel like we're going to be requiring a technical expert, qualified technical expert on every board going forward. But I feel like a lot of board members, they have a very good idea of how to handle financial risk, but not really cyber risk. So I guess the question, how should they think about their fiduciary responsibility regarding cyber?

And that's what I've been spending the last decade of my life on, is exactly that. And they need to think of it in terms of the business risk and understanding how that relates back to the metrics related to the tolerance, the insurance, and how much, uh, financial risk they have. And let me give an example of what I'm talking about so the audience can really understand. So let's say that you have you have 5,000 different IT systems and the majority of your revenue comes from 5% of those, right? We're gonna wanna focus in on those, but specifically we're gonna wanna look at a number of things that cause those risks to be over the cyber risk tolerance or over the amount of insurance you have. And those can be, in the case of a data breach, it's the number of records that you have. In the case of ransomware event, it's looking at the ability to recover in a timely and consistent manner. Then the rest of the, what I call the longer tail exposures, like the legal and the regulatory, they're directly related to that. So you want to take care of those two things first and understand that. So if I have, let's say, 10 business applications that I have too many records in those data sources, it's very easy to clean those up with an ILM program, an information lifecycle management program, and get rid of records that are not needed for day-to-day business purposes. A specific example, your HR system that has your current employees, and they have employees that are no longer working for you. There's no need to have those in that data source. They, they do not get payroll. They do not have benefits. There's no day-to-day ongoing need to have those. You would want them maybe for ESG purposes later on, or anti-bias kind of analysis, but you don't need them for day-to-day.

Yes.

And that's very common because we grow by acquisition and we're just getting more and more and more data. And the deal is that you have to pay attention, right? That's just one example.

That is so true. So you really need to know your business and really manage the risk at the level that your organization is actually comfortable managing at the time. And when we were talking in the green room, we talked about insurance as well, right, as being a way for you to transfer risk to a third-party organization. And I guess this may be too much of a generic question, but for Generally speaking, how do you think a board should figure out how much insurance they actually need for their organization? Do you have any tips for that?

Yes, I have, I have a white paper written on that that I'll be happy to provide the audience with, but the general gist of it is this: you have to have an inventory of your assets, you have to have the quantification numbers related to the assets, and then you have to see where there are gaps that are providing too much risk, like number of records or things like that, and then go ahead and make them, um, reduce that risk down to the level of the cyber risk tolerance and which insurance you need. Actually automatically does that for companies by taking into consideration a number of different factors, um, in terms of their risk profiles. And we can tell them that immediately, like you should buy $400 million policy, you should We have a sublimit for ransomware of $100 million. And we also this year, this is when we, something that is amazing in the research that we did was we have been working with the insurance industry to cover on the ransomware side, the amount of exposure they have with warranty programs that allow them to have a zero payout at ransomware time, which is really unbelievable. Yes. So we really focus on how can we help the business and understand what the business needs and translate that from the cyber speak into the corporate speak. The corporation can understand, okay, I've got, you know, $20 million worth of ransomware exposure. I have an insurance policy, but I may not have to use that insurance policy. As a matter of fact, I may be able to get reductions in my premiums if I have the right technologies and the right programs in place with warranties. And this is like, honestly, like one of the most fascinating areas that I've been in in a while. And one of our next books is going to be on cyber insurance. We are the teach and do companies because we know that, we know that you have to understand what we're talking about. And it's all new science.. And we have to explain that, and we have to be clear so that you can understand how the metrics are derived. And, um, the nice thing about the boards is they all understand math.

Yes, you know, yes.

And, and that's, that's one of the wonderful things, is that you don't have to be an expert in cyber to understand what we're saying. You have to be an expert in math.

True, true. Well, that is really impactful. It's not that difficult, but it really could make a big, big difference in any enterprise. So for the people who are listening right now, I think they really need to pay attention. So, two more questions in this segment. For members of a board, what question should every board member ask their CISO on a regular basis? What do they actually need to know from the tech executives?

The biggest thing that the CISO can provide is the baseline metrics related to all of the quantification. So if the CISO is able to provide information around not only the efficacy of the controls, which is what they do have availability to, but is able to connect that efficacy back to the asset and back to the exposure, which is what we do, then they can understand completely what their risk looks like, where they should be providing budget to the CISO to harden the controls, to make things more effective for the CISO to do. And with AI now, there's a lot of automation. And so there's the ability to really hone in on using this technology in a way that can make the CISO's job easier as well. And that's one of the things that the CISO should be positioning with the board is like, listen, I need budget to create these AI agents and things that I want to do to effectively do what we did, which is continuous monitoring. We're doing continuous monitoring on the controls to see if something is slipping through the cracks, which it's easy to do because if you're a fast-growing organization and you are deploying a number of different new processes and systems into your organization, those things can easily, you know, get overlooked, right?

So, so true. Okay, let me ask you the million-dollar question: How can leaders build a culture where cybersecurity truly becomes everyone's responsibility rather than just the security team?

That's a couple different things. First off, training is very important to not only the security team, but to all of the users of IT systems. Security awareness training is really a mandate these days, but it's more of a cultural shift than anything else that the board has to be behind the CISO and not looking for a CISO scapegoat when things go wrong. It's more about, I'm here to support the CISO. I'm here to listen to the CISO. I'm here to learn and understand what it is I don't know and to get clear about how to help them be more effective. CISOs are, you know, they have a 2-year lifespan. They're 24/7, 365. They are burnt out. They are exhausted. And one of the weird things I see happening now is that when organizations are looking for a CISO, They're saying they want them to be AI experts at the same time that they're a CISO. And those are two completely unique and different roles that are not something that you should be bifurcating, you know, or excuse me, consolidating into a single role. It doesn't make sense. The CISO should understand AI from the perspective of the security controls around AI, which is our next book, by the way, which is in publication now, which is called AI Governance The Executive Handbook of Safe and Responsible AI, how to set up an AI program in your organization, what roles are needed, what role does the CISO play, what role does this Chief Data Officer play, which is very important because people overlook that. And the important data is— the privacy piece of the AI is, is critical. Um, and so the CISO is really needs to be supported more, in my opinion, and being able to do their, their role and not being asked to do 3 roles at the same time.

Yes, yes, so true. Now, you've written several books. I'm gonna mention a couple of them, and for those who want to learn more about RISC-U, Enterprise Cybersecurity in Digital Business, Building a Cyber-Resilient Organization, you've also written Managing Cyber Risk, which I recommend everybody to to get. But today, we're going to be talking about this because we only have about an hour for this podcast. But so we're going to be talking about Navigating Supply Chain Cyber Risk, right? Comprehensive Guide to Managing Third-Party Cyber Risk. So I guess the question I have for you is, why did this book have to be written?

Because third-party risk is probably one of the most misunderstood concepts in corporations today. It is the last thing that the security team is being asked to look at. They're too busy trying to get layered tools in place and their SOC teams and understand like just how to do what we call first-party security, which is your own. But the issue that we have with third-party is 60% or more of your organization is outsourced, whether that be systems that you are buying custom off the shelf or home-developed technologies that you're using in those systems that have to be looked at from a vulnerability perspective as well as others. And the cloud services that we operate off of, the infrastructure as a service platform, software as a service, all have specific types of risks that need to be understood. And they're not understood in context. So, um, the real deal is that third party is, is equally or more important at this stage than your first party, and that your third party should be really aligned to your profile, not to whatever else you're thinking out there. And one of the things that we created was a third-party risk exchange to allow companies to provide their security data to us, and we will actually evaluate and provide information on how effective that is. And then they can share that data with their clients, of course, with permission. And the idea there is that you're not, you know, filling out 100 different security questionnaires and providing evidence. 80% of the costs are data gophering related. This is not needed. And of course we use AI in this to also get information that we need. And then you can share that information. It reduces the costs and it gives the organization or your customers a level of unbiased assessment that looks at, okay, this vendor has X, Y, and Z, plus we suggest like what they can do to reduce the risk. And we even tell them how to do it. So it's like, it's a full comprehensive, holistic way of looking at the entire thing. And we believe that that is so important. So when we wrote the book, we were really looking at the way that we do it is we work in committees with our 400 advisors and we put together these there's these research committees that provide this information, and then we codify it into a book and a course, and then we actually take that and we commercialize it and operationalize it with RiskQ so that we're taking the, um, you know, we're standing on the shoulder of giants basically who are struggling with this in their day-to-day, and we're giving them what they need to really, uh, be able to not just tell them how to do it, but actually do it. And that's what I think is so missing when you look at the cybersecurity industry in general. Like, we have vendors that do certain things. We have management consulting firms that do certain things, but we're the, we're the synthesis of both. We're basically going and putting together these types of products and services so you don't have to figure it out from scratch.

That's really, really powerful. So there are many executives who still view third-party risk as a compliance exercise instead of a strategic business issue. Why, why is that mindset so dangerous, especially in 2026?

Uh, a number of reasons. So compliance is has its place, right? Because it basically alerts the organization that there are things they need to do that are, that are critical and that they may have regulatory fines and penalties if they don't. But compliance itself is treated as a checklist. Like, it's like, you know, when you're getting ready for takeoff and the pilots are in the cockpit and they're doing the takeoff checklist, right? It's like, okay, that's fine. But the issue that we have is that nobody goes back and looks at the actual evidence that's in place and says, oh yes, we have MFA in place both internally and externally. Oh, we've got EDR across all of our endpoints and not just this domain or this, this part of the network. We're not seeing the level of what's the word I'm looking for, the level of testing and looking at, you know, is it really in place or not. It's really an attestation, and it's like, that's not good enough. So compliance is always treated by, unfortunately, most companies as an annoying, costly endeavor. And but what compliance can actually do, if you look at it in a different way, is you can actually use that to develop your business case to go back to the board and say, okay, this is where we're lacking, this is where we need budget and this is why we need budget. And that's why the cyber risk quantification piece is so critical because we can go back with return on investment and say to them, okay, a number of different things that you find and tell them what the remediation is, tell them what the cost is, tell them what the benefit is, and build that business case and then let them make the decisions around, okay, this is how I'm going to prioritize it because— and I would prioritize it by financial exposure because that is a hard number that you can count on versus, you know, some kind of a just arbitrary prioritization. Yeah. So compliance, you know, a necessary evil, but can lead to a much more cyber resilient organization if used in the proper context.

So true. Because in your book, you also talk about, uh, understanding cyber risk in context. How does supply chain cyber risk differ from traditional cybersecurity risk management?

That's a very important aspect of this. So let's take, let's take a couple examples. So a technology can have a vulnerability. And if the technology's vulnerability is across your entire environment, your entire IT environment, let's take Log4j as an example. When that came out a few years ago, right? It's like everybody who had Log4j had to go and patch Log4j and get that, you know, up to date. That is a critical aspect. But when you look at that, so that supply chain is related back to the vendor and the vendor's ability to provide you with updates that are patching and maintaining your system. But if you look at it from another perspective, let's again go back to Jaguar Land Rover. Jaguar Land Rover is producing automobiles, so they have a supply initiative that all their parts and all of their folks that are creating and developing and designing their cars, they have that aspect. Then they have the distribution aspect of, okay, my cars are going to the dealers and all of that, right? So when you look at the impact of the supply chain, it's at least 3 times that of the organization because you have impact on the pre-production, you have impact on the production, and you have aspect— impact on the post-production, right? So all of those pieces of the supply chain are impacted, right? And that's why it is such a problem. And you could have SLAs in place with on the distribution side, you could have SLAs on the supply side. You could have a lot of things that you've committed to that are not only causing you to lose financially from the cyber event, but are causing you to lose operationally because you have these SLAs in place and you didn't meet them. Therefore, you're penalized, right? So there's so many aspects of that that you have to understand. By doing an inventory of your supply chain and understanding the context of each supplier. Okay, this is a cloud service provider, this is a system provider, this is a technology provider, and this is just a service provider that does my accounting or they're my lawyer or whatever, right? Each of those have different risks and understanding them in context is critical to understanding what that looks like when you look at the financial piece of it.

Yes. So powerful. Which leads me to when you look at incidents, we talked about Log4j, SolarWinds, MOVEit, and other supply chain related attacks like that. What leadership lessons should executives take away?

I would say first and foremost, this is not something that procurement should be in charge of. Procurement is very good at, you know, looking at contracts and understanding that aspect of it. But when it comes to the cyber piece, I don't believe they are understanding the contracts related to the cybersecurity, like auditing rights, like the security program that they have to have in place and understanding what kind of risks that they have is really key and critical to not messing it up. So I would say that if, you know, when you're looking at third party, it's best to have experts that are related to the procurement process and someone from your cybersecurity organization who is helping procurement or is even leading procurement in that effort would be absolutely critical.

Yes, agree. And what do you think are the biggest mistakes organizations make when evaluating vendors and third-party partners?

One of them is in the beginning of the process, the onboarding process, is not taking into account the level of criticality of the vendor and understanding that and rushing them through the procurement process because somebody on the business wants to get that contract in place, which is understandable, but there has to be a better way. And we believe the exchange is the better way, um, getting that data like right up front so you're not wondering what the heck's going on. Um, secondly, um, is when you were working with the vendors to collect that data, is to help them to be more cost-effective and not to have to fill out 100 of these for every single client that they have. Use something that the information is portable and secure and has been evaluated and audited and reduce the overhead that is associated with these TPRM programs. We just had a conference at Seton Hall University a couple weeks ago on this, and it was all around AI-assisted TPRM and how AI can actually help you with this. And, you know, so This is really a key aspect of TPRM is the exhausting amount of resources that people have to spend on it. The lack of understanding of the context of what you're really looking at and the, the ability to work with the vendor and work with the business to get where you want to go faster and more cost effectively is really something that they need to consider.

That is, it's really amazing how we can use emerging technology to actually become more efficient. It's quite powerful. So based on your book, if a CEO asks you for the 3 most important questions every board should ask about supply chain cyber risk, what would they be?

Who are your most critical vendors that can cause you the most harm?

Yes.

Um, how are those critical vendors, uh, adhering to your requirements for cybersecurity? And what does the program look like overall? Is the program effective? Is the program efficient? Is the program really telling you the data that you need to know? Um, both from the financial metrics and from the risk likelihood metrics that you can have, and how can you manage that better? More effectively would be the three.

So many organizations have thousands of vendors, and I think some organizations don't have a clue who their third-party vendors are. But how can leaders prioritize which relationship represents the greatest risk to the business?

So when RiskQ works with these organizations, we have the asset inventory, and the asset inventory immediately is going to tell you, okay, who are my cloud service providers, who are my my system providers and who are my, um, technology providers, right? So you already can know that. The one thing you won't know that isn't an IT asset is your service provider, like my lawyer, my accountant. But you can learn that through, um, other, other mechanisms. So I think that's really the most important thing to know is that this data is not unachievably difficult to get. It's actually right there at your fingertips. You just don't know where to look for it. For sure.

Yeah. And we kind of talked about cyber insurance earlier, but what role do you think cyber insurance, governance— and I know you're writing a book on that— and risk quantification play in managing third-party cyber risk?

They are all interrelated. So cyber risk quantification is really essential to understand how much risk that particular organization has financially. And if you look at the third-party piece, it's again 3 times more risky than your first-party information. So I think that's really essentially the genesis of it. And when it comes to governance, AI governance is a new science because AI is new and AI governance needs to look at regulation. It needs to look at the explainability. It needs to look at the cyber controls, which are different depending upon the AI you're using. Uh, it needs to look at also the privacy and understand like, okay, my data's coming from where, who owns that data? What's the data lineage? So the chief data officer has to play an integral part with the CISO in understanding how to put that program together, cuz they are the ones that are responsible for data.

Yeah. And if I ask you to get, you know, your tech CEO, I guess, crystal ball and look into the future 5 years ahead, how do you see supply chain cyber risk evolving as artificial intelligence becomes more deeply integrated into business ecosystems?

Much more automated, much more exchange-oriented, where, okay, you've done this once, you don't have to do it 100 times, much more cost-effective. And really a benefit to organizations.

Now, this is an important question. When I read your book, it does focus on managing third-party cyber risk, but the question I have is on leadership itself is built on relationship and trust. What leadership lesson can we learn from supply chain security about building trustworthy partnerships teams and organizations.

Trust.

It's Reagan-Gorbachev. It's trust and verify. You want to trust everybody, but it's your responsibility to verify. And if you don't verify, then that's on you, right? You really need to verify that they are trustable.

So true. OK, we are almost running out of time, but I must ask you this. My last question for the book is, What advice or which lesson from your book, Navigating Supply Chain and Cyber Risk, would you leave to CEO, board members, and CISO, also aspiring tech leaders? If they could have one and only one lesson from reading your book, which lesson would that be?

To treat third-party risk as equally important as you treat your cybersecurity program internally that it is so critical and that you really need to understand the relationships between your suppliers, both on the front end and on the back end. So on the supply side and on the distribution side as well, because if you don't, then you'll end up with a $1.8 possible billion loss like we did with, uh, unfortunately.

Yeah.

Jaguar Land Rover.

I feel like more and more today organizations really understand the cost of not doing cybersecurity at all. And hopefully we are going to get better with time and maybe AI is going to allow us to be a little bit more efficient doing that. Okay, we are technically out of time. Can I ask you for 2 or 3 more minutes to end?

Yeah.

I'm going to call the lightning round. So don't take too long to answer this. I'm gonna ask question, whatever first thing comes, comes out of your mind, that's what I want to know. So, uh, I've already talked and I want everybody to get a copy of your book. We just talked about the Navigating Supply Chain Cyber Risk, but you've also written Managing Cyber Risk and also Enterprise Cybersecurity in Digital Business. All books are available everywhere books are sold. But one question I have for you is, which book would you recommend that you haven't written?

Which book would I recommend that they, that they read? I think that depends upon where they're at in their maturity and their program. So let me explain. So if you're an entrepreneur, This is a wonderful book about how to really grow your business. It's called Profit First. And Michael speaks on podcasts as well as he's written probably 13 or 14 books. Also, he's written Toilet Paper Entrepreneur, which is an excellent book as well, talking about like how do you raise money and how do you get profitable in the beginning? Because a lot of first-time entrepreneurs make the mistake of, oh, I've got to go raise money from venture capital. I did that in my first two companies. Uh, that's another topic for another time. But, uh, you know, if you cannot do that, then, and you can really grow off of your profits, then that's really the key to success. Um, and I, I really value that book.

And you've also mentioned, uh, Rich Dad Poor Dad, which my audience already knows. Why should they read this one?

This is really about, um, understanding money and the value of money and the idea that money management is not unobtainable.

Yes, powerful. Okay, uh, let me see. The next question I have for you is, uh, what is the best career advice you've ever received?

Best career advice I've ever received? Wow, that's a toughie. Um, um, I guess it would be to believe in yourself. And, you know, really focus on what it is you're trying to achieve. Stay goal-oriented and never, never, never give up.

Yeah, Winston Churchill. I love that. So what habit contributes most to your success?

Yes.

Never giving up?

Never giving up.

Powerful.

Okay. What technology excites you most today?

AI.

Yeah, I guess that's what everybody's talking about. Okay, who has influenced your leadership journey the most?

Oh wow, um, when I was really young, before I went and got my MBA at NYU Stern, um, one of the women who I was working with, uh, influenced me greatly, um, and showed me that, you know, this is the— this is the path. Like, get your education, get your credentials, Be a lifetime learner, never stop learning, because things are going to pivot and change faster than you know. And with AI, that couldn't be more true.

Powerful. Now, when we talk about AI, some people dream of utopia, everything's going to be so wonderful, and then others think about dystopia, AI is going to kill everybody. Which one? Dystopia or utopia?

A little of both. You know, uh, yes, it's going to, it's going to change many different, uh, occupations today, like web design, coding, call centers, things like that. But for every job I think that it is going to automate, it's going to create more jobs. And that's why I wrote the book AI Governance, because this is such a critical part of understanding that these new roles need to be in place, or else we're going to end up with mud on our face as we, you know, go into the AI wild, wild west, start coding our little brains out but don't put the governance behind it, and then all of a sudden there's a problem, right? And all the work you did will be, you know, yeah, true, true.

Uh, actually, I'm writing on a paper on AI governance myself, and, uh, yeah, it's definitely It looks like we are living in the wild, wild west in Silicon Valley right now, and we don't have any AI regulation whatsoever. In Europe they do. Even China has regulation on AI.

We don't have regulation, but we do have frameworks. And what I've seen over time is that the regulatory velocity usually is first in Europe and then pivots over to the US, like we saw with GDPR and CCPA. And all the state laws, it's going to be the same thing. Our problem in the United States is that no one will take a federal stance on, you know, putting these things into a centralized set of regulations, which would just be so much more helpful than the state-by-state approach. But I don't think that's ever going to happen, to be honest with you.

Yeah, it's really sad because our privacy law, I think, is from 1974, isn't it? The Privacy Act, and we are in 2026 now, definitely obsolete and doesn't keep up with the modern technology and environment. Okay, so you often help organizations quantify cyber risk. If you could quantify one leadership quality that predicts long-term success better than any other, what would it be?

Political resilience.

Can you elaborate a little bit about that?

So when you first get into a company, you've got to figure out first of all what the political landscape is. You have to understand, especially in big corporate, right? You have to understand who are the real decision makers, who are the people who agree with your points of view without opening your mouth, by the way. You know, listen in the beginning. Listen, listen, listen. And understand, okay, well, who agrees with my philosophies, right? And then align yourselves with them and then open up to them about how you do things and how you can make these things happen. And then you get lifelong, you know, advisors and people that are going to support you and then figure out when's the right time to keep your mouth closed and when's the right time to say something.

I love it, I love it. Imagine a young cybersecurity professional watching the episode right now. A few of them are, and they hope to become future CISOs, entrepreneurs, or offer educator like, like you, or even board advisor. What is the one piece of advice you would want them to remember for the rest of their career?

I would say be a lifetime learner. That The industry and the technology change so fast. Wait till we get to quantum, right? That's one of our next research committees. It's like quantum is going to change everything all over again. So we have to be like always absorbing and understanding the context and implications of technologies and how they affect us.

So true. So when your leadership story is fully written decades from now, what impact What do you hope people will say Ariel Evans made on the world?

That I made a difference in their ability to protect critical infrastructure as well as financial infrastructure and their businesses, and that they benefited from me being on the planet.

Absolutely, I think you are already doing that. So how can my audience add value back to you.

So we have an amazing advisory board. If you are an executive in cybersecurity, privacy, risk, or aspiring to be, you can join that advisory board and connect with me. Let me know that you saw this podcast through this contact. You're on the wrong one for the advisory board. Yeah, that one. Yeah, there you go. Through this Cyber Intelligence— no, no, the other one. The red one. Sorry.

Here we go.

Here we go. Through this contact form.

There's so many sites.

That's all right. Through the contact form here. And if you want to join it, there's a dropdown on subject. Just click on the second dropdown, which is join the advisory board, and then write in your message that you saw me on BZ's podcast, and I will connect with you. That would be great. And if you're interested in anything I've talked about with third-party risk management exchange and quantification and orchestration and AI governance, connect with me on RiskQ. We'll be happy to go through our solutions. They're all modular depending upon the level of maturity that you have and what your biggest pain point is, and we would be excited to work with you.

Fantastic. And also the, the free books which we mentioned before, Enterprise Cybersecurity in Digital Business Managing Cyber Risk. And also, I think I'm— because I'm also an adjunct professor at the California Science and Technology University. I think for one of my classes, I may switch to this book here. And of course, Navigating Supply Chain Cyber Risk, which is very important. Okay, so as we come to a close, we're going to end in just about a couple of minutes. What did you want to be when you were a kid, Ariel?

Oh, that's funny. I originally wanted to be a physician.

Really?

Yes. And I was studying pre-med and then I got turned on to nuclear physics and I became a physicist.

Wow.

And then I realized that that was boring and I got into IT. That's amazing.

I was a pre-med too. Wow, that is awesome. Okay, 3 adjectives describing you as a child.

Inquisitive, tenacious, and studious.

Okay, as an adult?

Probably the same. Okay, good.

You haven't changed much. All right, I always like to end with a positive, on a positive note. What are you feeling optimistic about these days?

I'm feeling optimistic about our future in the United States and the ability to provide goods and services that are secure and to protect our infrastructure, to protect our national security. I do work with InfraGard and other organizations like that, and I really feel committed to to really helping organizations and our government to get where we need to be in this, you know, ever-evolving technical world.

Thanks so much for sharing that because we do need some positive news these days, I think, with all of the craziness happening around the world. And I think we can definitely be part of the solution. So thanks, thanks for that. I don't know if we have any questions from people who are watching me live. Looks like there are about 15, 20 people who are watching, but they may not have a question. That's fine. We are going to end with this. What is one word that represents our shared experience on this podcast today? That's the last question. Oh, actually, before you answer that one, was there anything else you wanted to share? Anything else I should have asked you before we end the show?

I don't think so. You've been wonderful, and I really appreciate the opportunity to be on this.

Outstanding. So one word that represents our shared experience on this podcast today?

Informative, insightful. There's so many words. Informative, insightful.

I am so very, very, very grateful. Thank you so much for taking the time to speak to us today and really, really appreciate your wisdom and your insight. Thank you so much.

You're very welcome. Thank you for having me.

All right, everybody, this is one for the book. And again, please follow Ariel on LinkedIn. So that's linkedin.com in— is it— it looks like it's M. Ariel Evans. And then you— yeah, M. Ariel Evans. And then we have Cyberintelu.online. And if you go to contact, You can become a member of our board if, I would say, if you are a cybersecurity executive or manager. And then also risk-q.com if you need help with your cybersecurity program with quantifying your cybersecurity risk. And also the books we mentioned: Enterprise Cybersecurity in Digital Business, Building a Cyber-Resilient Organization, and also Managing Cyber Risk. And finally, the book we talked about today, Navigating Supply Chain Cyber Risk: A Comprehensive Guide to Managing Third-Party Cyber Risk. I think these books are so timely. All right, and, uh, next week, I believe it's going to be on Tuesday, I will have the pleasure of speaking to, uh, Jean-Marie DiGiovanna. She is the bestselling author of Stop Talking, Start Asking. We're going to be talking about the leadership skill that changes everything. That's going to be, next, uh, Tuesday. And as you guys know, I like to end the show, uh, we study, um, uh, Black History, uh, year, year. We did Black, Black History Month, but that's only 28 days. I felt like that wasn't enough, so we are doing Black History Month. So a couple of things about Black History. One is, uh, today's date, right? Today is June 5th. So on June 5th, 1910, and you can see that on my LinkedIn post to learn more, but a white mob kills two Black men walking home. That was in Texas. A white mob lynched Douglas Lemon and Rankin Moore as they walked home from a community festival in Orange County, Texas. I'm gonna play a short video just about a very prosperous community in Texas during that time. That they decided to completely massacre and burn. But then on a more positive note, we're also going to be talking about the very first African American, but also the first woman who headed the Peace Corps. She was appointed by President Jimmy Carter. Her name was Carolyn Payton. She pioneered the use of group therapy technique for Black clients and also conducting a master's thesis on comparative study of the intelligence of Blacks and whites as measured by the Wechsler-Bellevue test of intelligence. So I'm going to play a very short video about her too. And that's it for today. Thank you so much for watching. It looks like we have one comment from Rick who says, "He's the inventor of patent pending protected WWW and all attendant technologies." Thanks for sharing that, Rick. And even after the show, you can still go ahead and type in your question for Ariel. And we are going to get your question when we play the AI version of the show, which is about 20 to 25 minutes, which is going to summarize what we talked about today. All right. Thanks for watching again and see you next week. Bye for now.

In July of 1910, dozens of heavily armed white men raided a Black neighborhood in East Texas. Newspapers would call it a race war, but of the countless Black victims in Slocum, Texas, every single one of them were unarmed and most were shot in the back. Their goal was to eliminate this thriving Black community. Their reasoning: a hatred for Black independence. I'm Garrison Hayes, and this is Town on Fire. In the early 20th century, the The small, predominantly African American community of Slocum in East Texas was an increasingly rare example of Black prosperity. These Black folks beat the odds. They were landowners, businessmen, and farmers in a largely self-sufficient community. But this success did not go unnoticed or unenvied by their white neighbors. When a series of baseless accusations and rumors began to circulate about Black people in Slocum, things became increasingly dangerous for the Black community. A lie that Black residents in Slocum were planning an uprising against white people, an argument over a promissory note between Marsh Holley, a Black businessman, and Reddin Alford, a disabled white farmer, a social order disrupting moment where a white man was forced to interact with a Black man in authority, It wasn't long before these rumors culminated in an angry mob assembling to destroy this town. After 48 hours of terror, many residents abandoned their homes, businesses, cattle, and land in a bid to save their lives. Among those who had to flee was Jack Holley, a formerly enslaved man who, against all odds, managed to secure 700 acres of his own land. Their own land and developed a dairy, granary, and general store. Hard work that was totally lost in this massacre. Needless to say, this once thriving community was never the same. For decades, this story went unacknowledged in Texas education, though the impacts are still felt today. More than 110 years later, demographic data paints a a startling picture of the lasting legacy of this massacre. While nearby towns boast Black populations of more than 20%, the Black population of Slocum sits just below 7%, a chilling reminder that some wounds take longer than others to heal. This is Town on Fire.

Bennett College hosted the Peace Corps today in a conversation about gender equity and diversity in the world of service. It's time to reflect on the legacy of a Bennett graduate and the former head of the Peace Corps herself. WNY News 2's Manny Franks has a closer look at the history between the two groups. This is a big day.

Bennett has a great history of connecting with the Peace Corps. The very first woman and the first African American director, Director Payton, was a Bennett Belle.

Carolyn Payton, a graduate of Bennett College back in 1945, served as the 8th director of the Peace Corps under Jimmy Carter. Her legacy remembered at her alma mater by the current Peace Corps Director Carol Spohn and Bennett College President Suzanne Walsh.

Having the first woman and the first Black woman in particular come from Bennett College, I think, is just an incredible opportunity for us to showcase the amazing things that women are able to do generally and Black women in particular.

In her short time as director, there was one thing in particular Payton fought hard for.

When I think about Director Payton, I think about the work that she did to maintain Peace Corps' independence as an agency, as an apolitical agency, you know, that is really out there at the grassroots level. And because of her, we're in the position we are today. And I'm grateful for that every day.

Thanks in part to her, President Carter signed an executive order cementing the independency of the organization the year after Payton stepped down. In 1979.

Today we honor her legacy.

One thing is for certain about the legacy of this Bennett Bell.

It is lasting.

Representation matters. It matters that people can see themselves in an opportunity, and that provides hope. It provides a dream. And I think that, you know, having a woman and having a woman of color in that role just says to the world, this is a place again where all people belong and where you can be a leader.

Reporting in Greensboro, I'm Manning Franks, WFMY News 2.

Thank you for tuning in to the Leadership and Success Podcast with your host, Coach BZ. If today's episode added value to your leadership journey, be sure to subscribe, share, and join us again for more wisdom nuggets on how to lead better and achieve greater success. Remember, leadership is the most critical skill of our time. The world will always need leaders to inspire others, drive innovation, and execute meaningful strategy. So why not count yourself among the bold leaders shaping the 21st century? Until next time, stay inspired, stay committed, and keep leading with excellence.