Matthew Webster, founder and CISO of Cyvergence, spent 30 years in cybersecurity after a philosophy degree and outdoor rescue background. He argues leadership and psychology matter more than pure technology, and advises aspiring CISOs to build technical expertise first, then prioritize emotional intelligence and communication skills.
Chapters
¡Hola!
Hi, I'm John Maxwell. When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation, I'm proud to say, is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend, Bob Fabien Zinga.
Welcome to the Leadership and Success Podcast with your host, Coach BZ, where we help you lead with purpose and succeed with impact. If you're ready to grow into the kind of leader others want to follow, this podcast is for you. If you're determined to elevate your success and leave a lasting legacy, this podcast is for you. As my mentor, Dr. John C. Maxwell, reminds us, everything rises and falls on leadership. Our goal is simple: to inspire you, challenge you, and equip you with insights that can transform the trajectory of your leadership journey. Welcome aboard. Welcome aboard to another episode of the Leadership and Success Podcast with Coach BZ.
Hi everybody, my name is Matt Webster. I'm the founder, CEO, and CISO for Cyvergence, a New York City cybersecurity firm. Uh, it's my honor to speak at the Health Cybersecurity Summit, which will be held on November 27th at the Javits Center in New York City. I will be speaking about building global healthcare cybersecurity communities. I look forward to seeing you at the Health Cybersecurity Summit. Don't forget to register. Thank you so much.
All right, everyone, welcome to another special edition of the Leadership and Success Podcast. Thank you so much for being here with us. I have a special guest waiting right now in the green room, but before I bring it on, as is our custom, Let's do our moment of gratitude. This is a part of the program, and we do this every time we meet. We just take a moment to be grateful for something. And part of the reason why we do this, for those who've been following us for a while, is because in the military, it's about 21, 22 veterans that commit suicide every single day. So I believe that it's not possible to be suicidal and be grateful at the very same time. So if you would just close your eyes, put yourself in your happy place, and Think about one thing you are grateful for right now. And I think today I am really grateful for America, our country. It has so much, so much hope and so much potential. I know there is a lot of trouble happening around the world and wars and the economy and all of that, but even in the midst of all of these things, I still have hope for America. And I know From the very origin of our country, right? We really stood on a lot of aspirational goals and values. Now, all men are created equal. That was really, really revolutionary. And I believe in America. So let us know what you are grateful for and type it in the comment. Let me see if I can properly introduce our guest today. So today I am going to be speaking to Matthew Webster. He's a Freetime Chief Information Security Officer Executive advisor, founder of Cyvergence, and author of Do No Harm: Protecting Connected Medical Devices, Healthcare, and Data from Hackers and Adversarial Nation-States. With nearly 30 years of experience, Matthew has helped organizations across healthcare, finance, and government build cybersecurity programs that don't just check boxes— excuse me— but programs that protect missions, enable business and save lives. Matthew's philosophy is simple and quite powerful: cybersecurity fails less because of technology and more because of leadership misalignment. So ladies and gentlemen, please help me welcome to the Leadership and Success Podcast, the one and only Matthew Webster. Thank you. Good afternoon. Thanks so much for being here. And I am again sorry for the mix-up this morning. I think I had it at 12 noon instead of 3 PM, but I'm really glad you are here and that you are available. You're gonna be one of our master teachers today. I'm so excited about this. Maybe to get started, Matt, what is one thing you are grateful for today?
I mean, to me, just being alive today. I mean, we're seeing something for me Transformation energizes me. It's something that excites me. There's more knowledge at our fingertips. We can move things in different ways. And, you know, we're not stuck in the Stone Ages. I would not like to live in the Stone Ages.
Me either.
That is one of the things I'm thankful for.
That is so powerful. Simple, but really insightful. And what about something about you that most people may not know when they first meet you?
Um, I mean, if you meet me, you just meet me for the first time, I mean, you'd never know that I've got a cybersecurity background. I mean, but you know, if you see me all over LinkedIn, et cetera, here's one thing that people may not realize. I've actually got an interest in the outdoors.
Hmm.
Um, I used to be in search and rescue when I was younger and could do those kinds of things. So, um, I've had avalanche survival training and all this other kind of crazy stuff too that helped to influence. And that was where I came from when I was younger.
Wow, this passion for the outdoors, that is quite something. Wow, that is good to know. So can you take us back to 1997? I think that was a pivotal year for you. What first drew you into cybersecurity, and when did you realize this would become your life's work?
Um, well, you never quite realize. You don't know until you know. But I mean, what I did is, um, I took a course at the time. It was a 9 or 10-day course in the CISSP through SANS. And that was like, I learned all the stuff I didn't know and all the stuff I wanted to know. And I realized just how much I needed to learn. And I went and got like 20 different certifications. It just let me— ah, you know, I got a lot of the, uh, networking certifications, a few Cisco certifications and Microsoft certifications. And like, wow, this stuff is what I want to do. This is cool. So I, I really just like, well, basically jumped into that and went, how am I able to move forward? So I just have been reading books ever since, and I've pivoted a lot over the years, but it's something I very much enjoy.
That's really fascinating. The CSSP class you took from Sen, was Sean Harris one of the instructors?
Um, I don't remember who it was. Let's call it 20 years ago.
I don't know. Yeah, yeah, because I, I took mine from Sen too. I think it was, uh, in 2009, and Sean Harris was teaching it at that time. She's no longer alive, but she was one of the best faculty I've ever met when it came to the CSSP. Yeah, she was really—
Her book was great. I read her book. It was one of the many books I read for the course.
Yeah. When I talk to my mentees now, I ask them, this is the only book you need to read. Read it from COVID to cover. You are going to pass the CSSP. Although it hasn't been updated very much since she passed away. But anyway, thanks for sharing that. So you've been a CSO, like I said in the introduction, 3 times now. What defining moment shaped your leadership philosophy the most as a CISO?
If you talk about the most, it's actually all the bad stuff that's out there, you know, because you learn more from mistakes and the way people behave than you do from calm waters.
Yes.
You know, and that's something— I mean, when you talk about leadership, leadership is forged, you know, and that's where you learn the most lessons, is where you get the most out of it. So I have dealt with a lot of interesting characters over the years. This is not my opinion, but I was talking to somebody recently who deals with CISOs all over North America. It's much rougher in New York City, and we have got some characters here, characters and a half. And I have learned a lot because I've been forged in fire. So I have completely changed my philosophies many times over. I said, hey, I was wrong about that. Let me grow and change as a human being. And that's what I brought to the table over the years is all of those sort of processes. So it wasn't any one thing, it was a whole bunch of things that have happened over time and learning what that big picture is and what those costs ultimately are.
Well, that's, that's really something. Yeah, I actually, when I first came to this country, I came through New York City. It might as well be like a foreign country because, uh, you guys in New York are quite different. It looks like you don't smile, you don't, you don't pay attention, don't say hi. It's just like business, you know. But anyway, uh, so, uh, let me ask you this then. Who are maybe some of the, uh, mentors or thought leaders that kind of shaped the way, uh, you think and lead today?
Um, there's like a long list. I mean, I came from a background of philosophy, number one.
Wow.
My undergraduate degree— and this may shock a few of you— is called Philosophy of Social Theory Integrating Political Science and Economics.
Wow.
I was always the big picture guy, and I started out in IT, and IT is fantastic. I love IT. But, you know, always I'm asking these bigger and bigger questions. And so I wasn't bound to stay in any one place as a result of that. So when you talk about— I could list a whole bunch of philosophers, and some of them I agree with like one or two points, other ones I agree with a lot of it.
Wow.
I can just go on and on, uh, about different stuff. I really liked a lot of the existentialists. That was the stuff that lit me on fire when I was like 18, 19, 20 years old. Usually people get towards the end of their lives in their 50s, they're like, well, I better study this existentialism thing. I'm like, no, no, no, I'm studying this when I was 18. In my college, I took every single course related to existentialism that I could.
So that is really, really cool because I know in the military, you know, the Navy, the other branches too, we talk a lot about Stoicism. That's the philosophy we like. Like, there is this one we read a lot, The Daily Stoic by Ryan Holiday. Philosophy is quite important, but I know there are people listening to us who are aspiring, uh, IT and cybersecurity professional. Usually people who study philosophy don't end up in IT. The focus for the most part has been STEM, science, technology, engineering, and math. So how did you go from philosophy to IT? How does that transition work out for you?
Well, it's sort of funny because 30 years ago, this is what was the stories that I was hearing around in New York City, because either you get a philosophy degree, you're either going to become a comedian Or you're gonna go into IT.
Really?
Wow. Those are the stories that I heard as a kid. So to me, just like, but what happened to me was I was just working at the university, happened to, you know, say, hey, this is cool, whatever. And they said, hey, do you want to be the leader here? Sure. I had no idea what that meant. I had no idea what the background was. Some IT experience, and I was the technical lab aide and all that kind of stuff.
Yes.
But Then I became the leader within several months because I was doing such a good job at organizing, putting things together, etc. So that's kind of how I fell into the IT role. And I could see a ton of things that were like, something's off here, but I don't know exactly what. And I needed to learn that. So I was like, I really honed into what I don't know and use that as my way to jump forward. And that just kind of gives you this whole analytic perspective.
So that is so, so key. And I want to encourage people who are listening, because especially students who may be in college now, and maybe they're not studying STEM, but they really would like to get into cybersecurity or IT. I feel like we've restricted our field so much for so long. I think we really need to open it up. Even if you're studying music or philosophy or art or whatever it is, I think there is room for you in the cybersecurity field. Wouldn't you agree?
Yeah, I actually think that it's 100% critical, especially if you're ship positions. If you are hyper narrow focus, cuz this is one of the things that I do, you know, just on IT, IT, IT, your head is down. You're not looking up, you're not looking out, you know? And so like I've got a podcast and my podcast, I'm bringing in leadership experts. I'm talking about doctrine of all things, you know, I'm looking at things from all these different perspectives. I'm not just taking this little tiny cyber world and saying cyber for cyber. I'm learning financial skills. I'm learning how to communicate with others. I'm learning how risk management is going to change that whole conversation. Like we learn a lot of the wrong tools and we end up with this, you know, from a corporate standpoint, how to miscommunicate. And we're learning all the wrong lessons in cybersecurity from a leadership perspective. That's something I'm striving to change, you know, getting into technology, you know, et cetera. I can go on and on. I'm a very passionate person, as you can tell.
No, this is so key. I think one thing you have to have is, I guess, intellectual curiosity, the desire to learn. But I think no matter what you've done up to this point, you can definitely get into technology. That's one of the best fields ever. Especially right now, my focus is more like on minorities and women because I feel like we are still way underrepresented in this wonderful field. But yeah, this is definitely where things are happening. And now with artificial intelligence, it looks like, no, it's just gonna get further and further, if that's even a word. But it's quite exciting. So one thing you have said in the past is cybersecurity fails more from misalignment than technology. I think I do agree with you on that. But what does alignment actually look like at the executive level?
So that could be a several-hour conversation just into itself. It is a deep, deep question. But some of it is you don't know how to communicate. Like, a lot of CISOs don't know how to communicate. They think they're communicating. If I go in there and say, well, we've got an 8.9 CVE, and you're talking to a CEO, they're going to think, what are you talking about? And they're going to be— they're going to get frustrated, they're going to get angry. You know, a lot of people don't even understand the language. Like, risk— let's take risk. And I am huge on risk. I love risk management. But, you know, a lot of— there's a lot of products on the market that say, well, $100 million risk. So then they walk in with $100 million risk, like, buy me something, and then they get no respect because they're producing one number. And that is not a good way to have a conversation. It's one of those things I want to change. But the challenge is so many CISOs, and I have been there myself, we're so busy, have so many things to do, we don't have time to even think about doing the right thing. And we want the easy button. And the easy button is actually the hard button, but people think that it's the easy button when really it's about having the communication and establishing the right communication, establishing the right relationships and taking the time to understand the business. But most CISOs are so busy and buried under IT that they don't have time to do things properly. So I understand where a lot of that stuff comes from and why you don't have that business alignment. Yeah, you know, I mentioned briefly doctrine, there are certain documents that are very much oriented towards doing doctrine properly, if they're used and integrated to the organization. We talk about incident response plans, there's a lot of reasons why a plan is so important. Because you're going to screw up in the moment, you can make misjudgments, people are gonna be yelling and screaming, tempers are up, and this needs to be done first. And that even CEO is going to get yelled at, like, no, you establish all this stuff ahead of time to get get rid of all that. Yeah. And then you follow a plan because like you look at the type of thinking you're doing, you know, let's take the system 1 versus system 2 thing. System 1 is, hey, hey, here's what we do. Let me just get it done.
Mm-hmm.
System 2, you're being more thoughtful. And a lot of people aren't thinking about this system 2 thinking, and that's what you need to get in the incident response plan. Yeah. So everybody's on board, everybody's aligned. That is good corporate doctrine. You know, and things— people aren't thinking about these types of things from that perspective, but that's what I do is I kind of bring a lot of this stuff in, try to mulch it all together to get corporations to be better aligned. And I could go on and on, but I'll kind of stop it there for now.
No, this is really wonderful. And some people thought doctrine was only for the military. It's not. I guess me, I come from both worlds, the industry and military as well. It's really nice to see how they sometimes overlap. But one thing you've said that is key, and I've known a lot of organizations, especially in the startup world, they would have an incident response plan, checkbox, now they say they're compliant. But the thing is, they've never touched it in the last 2 years. No change, no review. They do not test it at all. What do you recommend organizations do once they actually get a policy document or a plan. That's not the end, is it?
No. To me, that's the very beginning. You get that and then you start to do something. So, for example, and I know companies that are terrified of doing this, I have met so many of them, but you want to get the business involved. And a lot of people are terrified of that because of the massive judgment that they either feel or they know is going to come down from the business leaders. Oh, you're not prepared. You're not this, you're not that. And I've heard horror stories about CISOs that like, oh, something And they're fired. And there's all these stories that are out there that probably you have heard many of them, have your own stories to tell, you know, and that's part of the issue. You need to get the business involved. Now, if the business is not willing to be involved and they're like shutting everything up, you know, maybe you should look at other, other companies because that's not going to be a healthy organization to work in. Not that New York City is healthy from a leadership perspective. We've got a lot of problems to work through, and I've seen and worked through a lot of those issues. With a lot of different companies.
Yeah.
But you've gotta make sure that you're creating that alignment, making sure they understand what those needs are, put them together so they can get it. Take a standard business case. Mm-hmm. Business cases are a great place to get aligned, but a business case, if you're doing it once a year, you're doing it entirely wrong. The same thing with the incident response plan.
Yeah.
That's something that needs to be tested. The best ones are doing it like 4 times a year. And they're trying different scenarios. Great. I mean, everybody talks about ransomware and that's gonna be an expected one to have. And you do that once a year, but if you're doing the same ransomware event 4 times a year, you don't know about anything else. And you know, who's failing? You know, I would say you need to go get the rest of the leaders involved if you're the CEO, because in the disaster recovery plan, which bleeds out in theory, the incident response plan, You're going to say, what are the priorities? Yeah, you've got to get it worked out with your staff because if you're waiting as a CEO to determine what order to get things done, or maybe the teams are yelling at the IT team, say, no, you need to do this first, I'm more important because of this or that, you know, yeah, chaos in your hand, you're amplifying the number of problems. And so this is about how do you do things more orderly and faster, because if you're doing this and switching and switching and switching That's not fast. Yes, you're not helping the business in the right way. So that's what I do is I try to create, you know, this good alignment. Everything is perfect. Everybody wants to say perfect, but you know, perfect sometimes is in the eye of the beholder. But when you're talking about take, get a plan, follow it and stick to it, and this is what we're going to do, and you establish that ahead of time so you're not in the middle of 10,000 political battles between the chief revenue officer, the chief financial officer, the CIO, the CTO. Work it all out ahead of time and then say, no, this is what we're going to stick to unless there's a damn good reason to change. That's how I look at it.
No, that is, that is really, really great. Now let me ask you a follow-up on that. Okay, you've got your, your plan, you're testing it at least once a year, which is what most security frameworks says, but no, yeah, yeah, preferably once once a quarter. Same thing with pen testing and all of that. The more you do it, I think the better prepared you will be. However, once you go through your plan once, tabletop exercise, simulation or whatever, then of course you are going to have to get some lessons learned after action review. There are some things that are not going to be quite right that you will immediately see needs to be updated or changed. So what do you do next? Do you just take all of your notes and put them in your drawers and forget about it? What should I do?
No, no, no, no, no. Yeah, it's the worst thing to do. You need to make sure that you update it, make sure that the business has their say in that, make sure that the business is communicated without— with everybody else. This is our strategy in an emergency. We hope it never happens, but this is what we're going to do because you don't want them to come in and just start fighting like that. And so you need to look at all those different scenarios and, and play along with that. The IR plan is just so foundational. Because people don't understand the psychology too. They study a little bit of psychology and what happens. You aren't making good decisions when stuff is hitting the fan. Just, it's just a pure reality there. You know, you go back to the systems 1 thinking, and that's why you've got to turn off that system 1 thinking. Let's follow the plan so you're getting things done in order and you're avoiding a lot of that chaos and all those other problems because you just paying attention to this. Like, you don't have to say, um, well, stuff's gone down, what do we focus on first? Yeah, you know, that's why this stuff is so important, because it's the difference between a great company and a, uh, maybe we'll get through this. Yeah, this company, you know, it should be an excellent question to get the basics of corporate doctrine figured out for organization. At least that's how I heard it.
Absolutely. That really makes the difference, I think, uh, with between average CISOs and those who really make a difference, because it does take some planning. So let me ask you this: how do you build trust with boards and executives who may not understand cybersecurity deeply like we do?
Yeah, that's, that's a very, very common problem. A lot of people— like, I see a lot of posts out on LinkedIn like, oh well, everybody needs AI governance, and if only the board were involved and only this. Well, more than 90% of boards don't have any experience with either IT or cybersecurity. Now, I know that there's some legal changes coming up soon where the boards are gonna have to take some responsibility. But, you know, when you take a look at like Change Healthcare, you know, they had a senator that was involved that had no clue what was going on. Like they had no IT background and they were the cybersecurity expert. You know, and you see, and I could spend an hour just on that, but there's a lot of problems there. So what you need to do is really talk their language because a lot of them come from a legal background. A lot of them come from a lot of different backgrounds, but there's very few professionals out there from an IT and/or cybersecurity. So if you get that, you're in a blessed situation, but it boils down to being human first.
Yes.
Get to know them. Talk to them, have conversations. And I've been in cases where I've been working 90+ hours a week and this is just the standard. You're expected to do that. You're like, the last thing I need to do is communicate with somebody. But it's probably the first thing that you should do is get to know them and find out, like, how do you communicate? You know, it's the same thing with the whole executive team. How do you communicate? Are you a baseball fan? Let's talk about getting to first or second base. What, what's a home run for us? Resonate with them a lot more. So using different forms of communication to get the idea across is absolutely critical from my perspective. Um, but the same thing on the board, you know. But also the other thing is keep it short, you know. If you were talking for 3 hours on techno geek stuff and we're gonna— well, we were looking at doing a protocol, the routing protocol, like Shut up.
Yes.
You know, what you need to do is say, look, here's the gap. Here's why we think there's a gap. What is it related to? What business functions is it going to have? What is the impact of that downtime? Having talked with your CFO or others, you get that buy-in so you don't have people doing this in the middle of a board meeting. Because if other people are doing that, you're losing credibility fast.
True.
But give them options. Say, here, we've got 3 options that I can see. Option 1 is we're going to do X, option 2 is Y, and here's the impact of both. We actually did a cost-benefit analysis and have determined that this is the most likely. And it's based on, you know, not a single number like $100 million risk. It's contextualized so people can understand it and use language that an average ordinary person understands. You know, hot standby routing protocol, HSRP, not the type of thing you want to have in conversation.
So, no, that is really powerful. And it seems to me like, you know, I don't know, 25, 28 years ago when I first started in this field, almost all of the CISOs were all technical. But it seems to me like there is really a need for Chief Information Security Officer, or just a cybersecurity executive in general, to become more of a business enabler. Would you agree to that?
Let me share with you the extent that I agree with you. I have got a course called Becoming the Next Generation CISO. That's what I focus on throughout the entire course. It is non-technical, but I am focusing on how do you communicate with others. You know, I talk about a lot of about the relationships, but also I talk about personality types and how do you deal with certain sticky personality types. We all have had them, you know, but it's a matter of do you recognize them and then what do you do? You know, how do you play the politics without being the bad side of politics. A lot of people, politics is bad, and I understand the nasty flavor, especially in New York City. I've seen it. But on the other side of the house, but how do you use it from a protective standpoint in a good manner that's going to help create the right type of alignment? You know, it's not like you have to just, well, bury our heads and walk away. Like, no, we are Jesus. We have to be part of the good positive change within the business? How do you create a system 2 thinking in terms of how you're going to communicate with everybody else around that? How do you create that? A lot of people aren't focusing on that system 2, and a lot of CEOs like, nope, I know the answer, I've got that off top of my head, I know, I know.
Yeah.
And if you've got that kind of attitude, you don't know, and you're not using that system 2 thinking and flow and creating a methodical process for governance and how things are going to reach up to senior management is absolutely critical. You know, all of those things are part of the process, but this is like, you know, something that could take hours to sit down and explain what that actually means. So I'm very passionate about this particular subject, but yes, I wholeheartedly agree with you.
That is so insightful. Now, uh, how should leaders think about risk versus compliance versus resilience?
So that's a really good question. I love it. Um, so I mean, obviously compliance you have to do, and it depends on how deep the compliance is because you have to take a look at the context. And I've worked with like 10 different frameworks, so I can jump from one to another. I've done everything from like the old school SAS 70, which I don't count in the 10 different frameworks, which is, hey, are you following your policies and procedures? We don't have any. But the reality is, you know, you have to understand a lot of the bigger context. Like, I have worked with companies, even large, medium-sized companies, for example, that have zero security. Like, I had, for example, a director of security when I was going through doing an assessment ask, huh, so what's the difference between this reactive and proactive cybersecurity you're talking about?
Hmm.
Inside My head exploded. I paused for a couple of seconds just to reflect on it and collect my thoughts. And then I explained it. They're like, wow, you know, it was just— I had opened a brand new world for them. And this is a director level. But the reality is, you know, going through and doing it, the CIO had no clue either, you know. And it's a big challenge when you're working with a lot of these companies. They don't even know the A, B's and C's of this. So let's start there, you know, because a lot of compliance, they miss a lot of things. Oh, IoT, you can ignore that, push that off to the side. SCADA systems, push that off to the side, you know. But you also have to have a framework for how you're going to communicate risk. Unfortunately, um, to be able to create that framework and really do it properly, it takes a lot of effort on the part of the business, you know. And it depends on the structure of the organization. So if you've got the three lines model, for example, A lot of times, sometimes the CISO is going to help that translation. Sometimes it's going to be a chief risk officer, a different type of CRO that's going to help with that and explain exactly where that's going to go. So the risk is part of it. We all, we've all heard that, you know, compliance does not equal risk. I mean, that's been burned into us for like the last 15, 20 years in cybersecurity. We know that we live that every single day. But the challenge is when you talk about compliance, I think that it, it's both a good thing and a bad thing. It is a cudgel to at least do something, you know, business partners are demanding SOC 2, but, you know, I was in a conversation last night at an event and, you know, SOC 2 Type 1, I know is not a good standard, but at least it's something.
Yes.
You're getting the ball rolling in the right direction. And it does have, and a lot of the standards do have risk management within that. But are using effectively. When you talk about a standardized risk register, it is not an effective means of communicating with the business. If then you then have to take the output of risk register, go through, put it through something else, put it through a bunch of other things, have somebody who's going to be on your side to say, let's take a look at this, put it together, and then you start putting in the numbers and then you start creating the business case. It's a lot of, a lot of massaging that's going on. It is not a decision engine if you talk about the traditional risk register. Now I do a lot of more advanced risk registers that are decision engines, but that's a whole different process from the traditional risk register, which everybody talks about. Even stuff when you— yes, low, moderate, high. Well, what does that mean? The reality is when you go in and do things, you're not communicating risk from appropriate means. What does that mean to the business? High risk? Well, like if you talk about a vulnerability, we've got high, high vulnerability or critical vulnerability. And what does that mean? What if it's on an old system that has no data on it? You have it turned off for, you know, 51 weeks a year out of the year. It's got no appreciable data, but you're on Windows 2000. You know, it's not good, but the risk is low if you consider, you know, hey, you've got several layers of firewalls and blah, blah, blah.
It's contextual.
Yeah, the risk is much lower. And so you've got to look at the context for that. And that's something I think a lot of cybersecurity people get wrong. So when you talk about compliance, we're used to this, do it everywhere. It's got to be done. We're freaking out. And it's, it's actually detracting us from our ability to do a good job from a cybersecurity perspective. When really, if we're business aligned, and I did not get into everything what you mean, what I mean by business aligned. You're going to be able to focus on what it cares about. And that's something that's a foreign concept to many CISOs. That's why it's so important. So then you're getting into the other part is resilience. You know, there's this stuff.
Yes.
We, I mentioned the HSRP, the hot standby, you know, you need that because you got to have two firewalls. One goes down, the other one stays up, you know, but it's a lot of different things, but you've got to focus it in a business-oriented fashion. You know, you don't want the business to break when something happens. Something small happens and your entire business goes down, what are you going to do? So that means you've got to have backups, you got to do this. There's all kinds of stuff that goes into that resilience discussion. I'm very passionate about it. Yes. But I like the, the NIST terminology. It's not a great compliance framework, but, you know, identify, protect, detect, respond, recover, and govern. Yes. When you talk about all that, you start building it and you have all that stuff, you're naturally going to be more resilient. But that's where you have to do is, you know, if you build all that stuff, you've got to make sure that you've got backups even for the systems that you have. So you have a backup bank. What about pay? The pay goes down. Do you have an alternate means of paying people?
Mm-hmm.
Are you ready? How long can you survive for? Can you survive for 1 month? Can you survive for 3 months? How much of an impact is that going to be industry-wide? But reality is we don't have time to boil the ocean. If you're going and chasing after every single vulnerability, in an organization, you're doing security wrong. You can't, you can't eliminate it all. So the reality is what's most important. And I know there's a lot of challenges out there I can talk about. You know, when we talk about, you know, what are the interconnectivity between the various systems and, you know, is this system going to be down and does this one connect into all other systems and all the different challenges that's going to be part of the big picture when you're talking about corporate resilience. And a lot of that to me goes back to understanding the business first and building resilience, because nobody's 100%. I've never heard of such a crazy animal as 100%. But at least if you're saying, hey, here's the core things that you're— that are important to the business, you get them to buy in on it.
You've got—
they're part of the decision-making process. You're working together. You're not speaking an alien language when you come in and say, here's a concern that I have. You know, I met one CISO, for example, after Change Healthcare happened. He was very happy because he could say, I told you so. Yeah, you know, there are people out there that are like that. But at the same time, it does show you that we need to really think about what do— what happens if this goes down? What are those scenario analysis like and how does that fit into a risk management program? You know, when you talk about things like GRC, governance, risk, and compliance, to me GRC should also include enterprise risk management. And so to me, all of these things need to fit together to do better, to create a good resilient organization, because it's about communication. Because in this CSF, you know, most— a lot of people miss them as the implementation tiers. They automatically jump into CMMI, which CMMI is fantastic, I have no issues with it, But that doesn't mean anything from a business standpoint. You know, how resilient are we? And if you've got this alternate strategy, you're disconnected from the network so it doesn't go down. So you've got single sign-on to an Active Directory environment that's completely compromised. That's not good resilience.
Yeah.
When you take into account all of these things, that's part of the approach that I take to be holistic across compliance, risk, and resilience. Hope that answers your question.
Oh, yes, absolutely. No, it's really good to think in this way because I feel like in the past, a lot of CISOs have been extremely technical and just focused on the technology when you really need to look at it through the eyes of the business function across your organization. Because if you can't really enable the business, then there is really no reason for you to be there. So how do you then balance the speed with security, right? Business need and risk mitigation. How do you balance those?
So no CISO has ever encountered that issue. No, it is definitely a big issue. Because that's one of those things too. Because like, for example, I know one CISO who's stuck in a situation where anything that comes off on his plate, he needs an answer in 5 days. Otherwise, you didn't answer and you're saying it's perfectly fine.
Wow.
And it's like, you know, and the only option you have is AI against AI. But this is where I like to have a security committee and have conversations with others, because you're not going to win it over like, no, we've got to be compliant. They're going to bat you upside the head. Compliance is a means to an end. And so this goes back to what type of thinking you want to get into that systems thinking. You know, and you get into scenario analysis. They might 100% agree with you, but they may not really understand why they're thinking business, business, business. What about this case? I didn't think of that, you know, and then you start doing that and you're not going to win overnight. This can be a year's process, but you start getting them to say, what are these what-ifs? And then there's the politics game. You know, how do you get people on your side communicating with you from a variety of different standpoints? And getting them on board with those risks and building and building that momentum until something starts to break through. You know, because if you're trying to do it on your own, you're going to fail more often than not. And the goal is to create something that's reasonable for everybody, not just from a cybersecurity perspective. The challenge is most CISOs are very— don't have enough time to get things done and trying to do what I'm suggesting. This takes time, but that's good leadership. Yes, leadership is about your ability to influence others. And if you are stuck down here, you don't have the ability to.
So powerful.
The jobs are not even set up properly to even do leadership. Then leadership's sort of this IT thing for the CIO or the CTO, depending on the type of company, you know. And that's some of the challenges a lot of businesses don't understand what they don't understand, so they don't even know how to ask the right questions. And then they get annoyed at this techie CISO who's doing what he or she should be doing, and it creates a lot of challenges.
So that's, that's really powerful because I, I gave a keynote presentation— was it last week?— in San Francisco, uh, CA Vision CIOC. So we're at— for about 25 minutes I talked about cybersecurity not just being technical thing, but actually a leadership thing. And I've seen that you've talked a lot about that too. Why is leadership so important, especially at director level or above in cybersecurity? Why does leadership matter?
Um, or why doesn't it? You know, so let's take an extreme example. Everybody 100% says cybersecurity is a cost center, everybody hates it, and you're sitting there, what are you going to do about it? Are you going to out-technical them and like, let me use my Spock thing, I can't do it, you know? Well, let's be logical about this. You get thrown out the door. And a lot about— a lot of leadership is about inspiring others, but it doesn't mean that you're like going rah rah rah. Let's have a conversation through that and slowly starting to change people people's mind to go get the right thing done. And let's say then after 6 months everybody magically just agrees with you after all this leadership stuff, you know, the ability to get things done is a thousand times easier.
Yes, yes.
So this is why having these kind of security committees, getting people on board, telling stories, talking about case studies and what's happening here, have you thought about it from this legal standpoint? Yeah, all of this storytelling is a critical part of what a good CISO should be.
Powerful. Really helping to shape the culture. So let me ask you this, because you have worked across healthcare, finance, and government, what lessons transfer across those industries?
I mean, a lot of it does. I mean, you talk about compliance, it's everywhere.
Yeah.
That's part of it. You know, um, but I mean, a lot of it is just, you know, the compliance will be part of it and the risk is going to be part of it, and then governance. And they all have different types of governance. Like, when I've had people in my course where I'm teaching CISOs, some of them are like coming to financial services and they're like, you have so many crazy ways of influencing people, you know, because they just want— they want to click the button. And it's true in government too, like, well, you've got to do CMMC, you've got to do FISMA, or, you know, whatever it is. FedRAMP and a bunch of others. But that's a whole different ballgame than what you're dealing with in, say, healthcare. Like, yeah, it's interesting looking at a lot of the roles, like, we'll accept any type of, uh, compliance environment, you know, and they're thinking heavy compliance, they're thinking healthcare. Well, yes, if you're doing high trust, it's much tougher, but those are very different types of models between federal government between financial services and commercial, like healthcare. And HIPAA, most people ignore it. Like, I'll even walk to my doctor's office sometimes, I'll see the HIPAA compliant sign, like, are you really HIPAA compliant? No, no, not really. You just have, you just have a sign. Okay.
Yes.
You find all this stuff that's out there. And you talk about healthcare, it is a completely different, you know, you can have, like, you showed my book on the site, but you can have up to 16 different devices per bed.
Wow.
Medical devices. Most of them have no security on them. So you've got to use a different model for doing security for healthcare than you would somewhere else, because the problems are exponentially more complicated when you've got all these systems that nobody's protecting properly. Yeah, they're critical to people's lives.. And so, you know, the strategies you're going to be using from an architecture standpoint, the strategies from a communication standpoint, because when you're dealing with government, you just have to do it. It's just like, we've got to be FISMA compliant, we can lose our contract. But in HIPAA, what's the key thing? Lives. You have to save lives. And they also have the rock stars. Like in New York City, it's highly competitive. You know, they want the rock star doctors to come in who are able to do all these surgeries or all these other wonderful things, and they're great, great people. I fully support them. But, you know, they're pulling for their resources, and they want to, because if they get too frustrated, they're going to leave, go somewhere else.
True.
All of a sudden, they're not going to have the people coming into the hospital system. So it becomes a different type of balancing act from a perspective when you're looking at all this.
Yeah, that's really And interesting, uh, as you know, in the military we've had so many breaches in the past. I think everybody in China probably knows what my full Social Security number is. But when I, when I go see a, uh, doctor, I never, never give them my Social Security number. They always ask for it for some reason. Like, no, what you need to know is I am insured. Here's my insurance card, here's my insurance number. That is all you need. And then I asked them, okay, how are you going to protect it? What type of encryption do Is this protected address? Is protected in transit? What are your privacy policy? Of course they don't have any answers for any of those questions.
But 140-2, we're going to 140-2.
Yeah, but it's just interesting how people like to get your personal information even when they absolutely do not need it. But yeah, it's just the world we live in. So I want to go ahead and spend some time, man. We're already running out of time. I can't believe this. We only have about 15 minutes left. I do want to talk about your bestselling book. Book, Do No Harm: Protecting and Connecting Medical Devices, Healthcare, and Data from Hackers and Adversarial Nation-States. But before I do, we have at least one question from the live audience. Let me see. Denise Francis says, that's true, worlds apart. Thank you, Dion. I think she comes from Canada. Can you let us know where you are watching us from, Dion? And then Daniel Young has a question for you. He says, how do we design people process and culture so the human firewall is as resilient as the medical devices and critical systems we are defending? That's an interesting question.
So that's a tough one, but from trying to get people on board, it's a process because you remember, you know, the doctor is busy focusing on being a doctor. They're focusing on being the best doctor they can possibly be. And I have nothing but respect for that. I don't expect them to own my world, you know, because the thing is, you take a look at it like, do you want multi-factor authentication in emergency care, you know, situation? Well, nope, we need emergency surgery. Well, let me get out my key fob here. Looks like here I put in my— which password was— can we reset my password?
Yes.
If you're in the middle of doing that, that's going to create some real challenges because you're like, security, versus human life.
Yes.
You know, so some of this we're not going to be able to change and it may be imperfect. And I just want to own up to that. You know, sometimes like every single certification that you get is going to say what comes first, human life or cyber? It's always human life. I'm sure it's still true today. I mean, that was true 20-some years ago when I got the CISSP. But a lot of this, you can do a lot of security training. I've done videos and things like that for people. A lot of it is just talking about things from the upper organization standpoint, getting them on board. It's about building the political alliance up at the top and then having that wash throughout the corporations. Like when I was a global CISO, that was part of what I did too. I trained throughout all of the organizations to get them on the same page. But that's what it takes. Get, get your lawyer involved, get your chief human resources officer involved. How can you help? How can you tell those stories? You know, because once you get out there and start talking, what happens is, we're the finance department, what, what can we do to be better? Oh great, I'm so glad you asked. And then you can go have those conversations. So that's really valuable from that perspective to go build that bridge. And so what I really do when I focus on organizations is what are the bridges that I can build to make this better? It's never going to be perfect. If you're expecting perfection, expect to spend a long time crying.
Yes. But really, that goes back to leadership again. So let me ask you this. This— oh, by the way, you met someone live. That's good. We should start a comedy show soon. Okay. This book, why did this book have to be written? Why did you have to write it?
So it was a lot of different things. A, it was sort of a curiosity of mine to go dive in a little bit further. B, I'd been in and out of healthcare and around healthcare organizations for many years. So my first CISO job was at something called a RIO, a Regional Health Information Organization. So what was happening is we were collecting healthcare data from all over, but also having been in sales and worked with a lot of companies and seeing the different challenges with IoT, because IoT is just the worst, you know, and there is a way forward in this, you know, but it's a very tough way forward. Um, you know, and, and so looking at how many hacks are coming in, you take a— they're not the most hacked, like Pentagon is far worse, of course, but healthcare is the third most targeted industry, at least several years in the running. I have to check for 2025, but several years in the running, it's always been the most targeted industry.
Let me guess, that's after the finance, right?
Finance and probably some places like the Pentagon. Um, but When you look at it, so you've got these, all these defenseless technologies that are out there sitting in healthcare. How do you protect them?
Mm-hmm.
You know, and so you need a whole different mindset to approach things because they don't have any native defenses. You know, a lot of them, you install your EDR and MDR services, you voided the warranty, get outta here. But I just wanna protect it. Too bad. You know, And that's the way a lot of the medical devices are created. And so when I wrote this, and I know some of the laws have changed since then, it's a little bit dated now, the book, but when I wrote it, we did not have a lot of protection. The Veterans Administration had the best step forward where they worked on a public-private partnership to go out with, to create something called UL 2900, which is a cybersecurity standard for medical devices. Wow, that is massive. If you get UL 2900, you know, because the reality is too, some of these medical devices are massive. Do you want to— if you've got a giant, uh, resonance scanner and it's going to cost you $5 million, you replace it because, uh, well, we can't patch it? No, we can't do that on a quarterly basis. You know, you've got to keep these machines for several years. And so there are very real cost-benefit analysis that have to be made, people are going to ask, what are the alternative strategies? And that's where you get into like network zero trust or, you know, deep packet inspection, all these other geeky technologies to try to find a way to protect it because you can't use standardized mechanisms for the most part when you're looking at things. And a lot of them too, they don't need— even if you're used working off a Windows system, which is fairly common, you can't patch that Windows system. So they will have— I think at the time when I wrote the book, it was like 1,111 vulnerabilities that were out for Windows 7, you know, a lot of those were critical. I don't remember the number off the top of my head, but now when you look at it, it's way, way, way beyond that. And so when you've got these old systems that are out there, which is so common, you have to find a better way to protect them because traditional, you know, antivirus and things like that do not work. You can't even install file integrity monitoring or whatever in many cases. So these are huge challenges that the industry had to figure out how to handle. And that's what really was part of the impetus behind writing the book. We had problems and we had no solutions, no good solutions that people were thinking about.
Yes.
So that goes back to your leadership and how do you change the mindset of others around, because that's really what's more important than all the geeky tech talk. You can let the people, the techies, handle a lot of that.
So yes, and that's, that's really a, uh, a real, uh, problem. But, uh, you did frame cybersecurity in the book as a patient safety issue first and foremost, which I, I agree. Can you kind of expand on that? And by the way, I think your book is more than 400 pages, so it is a real book. It's not like a pamphlet people would buy on Amazon. But yeah, can you expand on the patient safety issue?
Well, it's all over the place. Like, for example, you talk about insulin pumps and things like that. People have hacked their own devices.
Wow.
And then put in the wrong amount. Sometimes the doctors aren't giving them what they need, or they feel like there's some other issue that's going on. And if they're doing it, anybody can do it. Because part of the problem is you're looking at a full system, because you can go back to a hospital or an EHR or a company vendor that has all this stuff and is connected in hospitals and things like that related to certain vendors. But it's a full ecosystem. So you might be going from your phone, which has no patches and maybe has no antivirus or any type of protection on it, you know, protect systems within that. So healthcare more than a lot of other organizations. So this exists everywhere. You've got, you know, the dark web, this is different than the deep web, you know, it's got all of these connections that are happening throughout the organization. Like 70% of it is all about legitimate business connections, you know, a percentage of that is going to be about healthcare, but you've got these non-protected environments. And so people are going to try to figure out how do I make this better for me personally? And so when you look at it, and we also, there's like a Homeland, uh, episode that was dealing with that where somebody decided to try to kill somebody by changing, I think it was a heart monitor or something like that. Those kinds of things do happen. They're very rare, but they can happen. So the other part of the how, it's a real big problem is some hospitals close as a result of ransomware.
Yeah.
But also if they go down, what about people dying? You know, that's another big issue. If you've just wiped out the whole hospital, they're likely to pay because human life is at stake.
Yeah, I believe the first time it happened in the world was in 2020, right? 6 years ago in Germany, ransomware.
Oh, yeah.
The power went out and they were transporting a patient to another hospital, and on the way, the other patient died, technically because of a cyberattack.
So I think— I'm trying to remember if it's the right case, I might be wrong on this, but I did talk about that case in the book. But what they found out anyway, even if it were available, they probably wouldn't have made it anyway.
Yeah.
So it's highly unlikely that somebody is going to die from that, but it can happen. I think I did read about one other case that's happened. So we're talking about an extremely unlikely situation to take place. But you're still talking about, you know, what do you do if somebody's got some kind of problem with X, Y, or Z? But the reality is now when you've got these monitoring devices, because now a lot of the elderly are using the monitoring devices to go check them, they're trying to detect the problems that we may not be conscious about on our level. And they'll get somebody out to help you right away to hopefully stop the problem from happening. That's saving the taxpayer money, you know, and that's really valuable. So I'm all in favor of using this technology in a way that's gonna better human life, uh, have us live a little bit longer, have us a chance to be around our loved ones longer. You know, these are all very positive things. So when you're looking at patient care, I, again, I'm a big picture person. Like I was talking about, all of this does fit together. It all fits together in a very human way that we all care about.
Yes. Well, I think your book is a little bit depressing because when you talk about all of the issues we have, it's like, how in the world do you protect what is unprotectable? Well, especially when you talk with IoT devices and they have everywhere zero protection. Like you say, some of them, if you even install some type of software, security software on it, you void the warranty. So for people who are listening, just at a very high level, give us just a little bit of hope. What strategy should they use? What can they do? Even a couple of things that might significantly reduce the risk in environments like that.
Sure.
I'm going to aim the comments more at the hospital because I think that's where— and they're stuck into some different issues. Like there's something called HL7, which is from the Stone Ages. I'm exaggerating, but it's kind of true. Basically, you're sending something in clear text. Like, why are you allowing ClearText protocols in the modern age? But you find things like that that are out there. But, you know, when you're talking about IoMT, et cetera, the network is probably the best way to do things, whether you're talking about the Deep Pack inspection, and some of them are set up specifically for those devices. Some are gonna be detecting, hey, we know you're using a medical device, we know there's an upgrade, we've detected that you're not, you don't have it updated. Let's get that information out because you can't use a traditional vulnerability scanner even with a dissolving agent because you go scan it, you're going to void the warranty. You can possibly take the whole system down, which I've seen stuff like that too. So you're going to use this passive means of doing the detection on the network for a lot of these devices, but you can also use protection too. So for me, it's about how do you section it off? That's zero trust. So this is using firewall access control lists, backholes to VLAN ACLs and all those similar sorts of technologies to be able to block off an area so attackers can't get to it. But also, and I've heard stories of people doing this, even unplugging stuff. Well, I don't know where it goes and just plugging in, creating problems. You know, they just feel like plugging in their laptop rather than using Wi-Fi. You know, you're gonna find weird things like that that can create problems. Now your laptop is compromised. That's gonna create a compromise elsewhere. So that's probably the best thing that corporations can do is, hey, if you've gotta have this HL7 ancient technology, get into a modern system, then transport it elsewhere. And then make sure that you're using modern authentication and things like that. And I hate to go down this route too, but now, and I know it's the thing, I love AI, There are a lot of problems with AI. You know, I was, I was in this program where I was helping some companies, you know, look at their cybersecurity posture and things like that. And one of the companies that was out there was very interesting. They were just trying to help get agents, AI agents, to connect into Windows Active Directory, rather than having full access to do whatever they want. You know, those are some big problems. And so I was at a non-human identity summit. Yes, um, they were throwing on the number of non-human identities now being 443 to 1.
Wow.
Like, when you talk about PAM, I think it was CyberArk put out this report, it was 80 non-human identities to 1 just a few years ago. But now with all the agents running around the number that was thrown around there was 443 different types. Now, some of this does include APIs, it does include, you know, service accounts and all those other things that dive into it, but still, that's 443. And we've got AI that's, you know, non-deterministic. It's able to make decisions on its own without a human in the loop, and it's doing all these different things. There are lots of stories out there that I Everybody here has heard about the problems with AI. You know, I gave a keynote last week and it was both IT and security. Everybody was nodding. The business is saying faster, faster, faster. IT is like, but you know, and it's creating more and more damage. And a lot of times when they create problems, you know, they're wiping whole systems, they're deleting data out of databases, you know. Well, we just— it's an easy way to get rid of the problem. It's a risk, get rid of it. You're creating a bigger risk. And even if you have AI fighting AI, trying to do that, a lot of times, well, you're absolutely right. You should just wipe all of production.
Good job.
What?
Yeah, yeah. You remind me, I think it was Google, right? Was it last year? Their AI completely deleted a critical hard drive. But then it says it was sorry. So at least That was nice to know.
We'll just call that a whoopsie moment.
Yeah, but I can't believe we've already run out of time. Can I ask you one more question about your book before you get to closing? Man, I could be talking to you for hours and hours, man. I had a lot more questions, but yeah, that's going to have to be for another time. But okay, maybe the most important thing for the executive listening now, whether they are the CEO of a hospital or members of a board or have a business leaders. What are maybe some of the top actions in healthcare organizations you think they must take immediately to reduce risk after they read your book?
I mean, the network is a good thing, but the next thing I would do is tell CISOs to take my course. You know, somebody actually said who took my course, it's like getting a mini MBA because that helped them to communicate. You know, I helped them how to look at the financial skills You know, for example, I'm talking to a chief financial officer and I mentioned value at risk. And there's also conditional value at risk, which are a different risk terminology than CISOs and others are used to. He about fell out of his chair, you know, but that's the thing. Like part of what I do is I create communication from a risk standpoint across organizations. And that's really important because if you're not communicating risk you've got some bigger problems in your organization.
Yeah.
So that's what I would do— help the CISOs communicate, get them out from underneath just doing this IT stuff. And you're gonna need some time to get up to speed to know how to communicate with you. I do coaching for CISOs too. I do a bunch of other things. And the biggest problem is all about communication.
Yes.
And if you know how to communicate, things are going to be much easier than they would be otherwise. So understanding leadership, understanding how to communicate, understanding how to communicate risk and all these other things completely change the game for you as a CISO. So that's what I recommend.
Awesome.
And the people can reach out to you at your website, cybergents.biz, right? And yes, be able to take the training. That is so important. Okay. We are technically out of time. So let me ask you, just so I can close this, Can you give me 5 more minutes and we— Oh, absolutely.
I can stay. Sure.
Let me do this quickly. Again, very, very grateful for your time today. I think my audience is learning a lot. Let me ask you this for the very last segment. What do you think is the greatest lesson you have ever learned, whether it's leadership, life, or just in general? Greatest lesson you've ever learned.
So it's— I will say there is a type of personality called a dark triad. Um, this is a concept that psychologists came up with in 2002 to talk about the convergence of three personality types. One is narcissism, two is psychopathy, somebody who's a psychopath, and three is Machiavellianism. Those types of personality types you have to be very, very careful of in the leadership circles. Most companies have them because they are attracted to powerful positions. But you need to know how to defend yourself against them, how to detect it early, how to put up your boundaries, how to deal with them. Having dealt with one, I mean, the extreme nature— we talk about villains who twiddle their mustaches, much Star Trek reference there. But, you know, we think about evil, you know, we see stuff on superhero shows and all kinds of things. But there are people who are really one step away from being what people would call evil. They're going to do stuff, but they're trying to achieve their own goals, and they have really twisted perspectives all around. I've got to look good. You know, you've got megalomaniacs that are out there. Make me look good or I'm going to destroy you. And they think that they destroy organizations. So that was probably one of the most powerful lessons for for me, and I learned a lot from that. How do you survive it? How do you deal with it? You know, what are the things, signs that you look for? Those are lessons. I go into that probably about 3 hours worth in the CISO training, but also shows up in politics and all these other things.
Yes.
So you know how to protect yourself. It's not like you can snap your fingers and just automatically do stuff because you're going to get yourself in regulatory problems if you bow down to their demands. Yeah, so understanding the politics and how to play politics is a core part of that. And that probably was the most powerful lesson I have ever learned in leadership.
Wow, the dark triad, I've never quite heard it said like that. Is there like a primary resource where you learned that from?
There are so many different resources. It is all over. I've also learned that there in MBA programs, they do have a psychology course, and they've been talking about this for a long period of time. So when I was talking about MBA, I was not just talking about the financial skills and other things.
Yeah, yeah.
I'm teaching about real strong personality types, and some bullies are dark triad and some are not. You know, you have to take a look at a lot of the context. Some of these are survival mechanisms, but understanding personality is key to your success as a CISO.
That, that is really key, especially nowadays, because, you know, generally speaking, the world, even America seems to be turning toward autocratic tendencies. Maybe not completely dictatorship, but that's the tendencies most countries have around the world in Europe, in South America, in Africa and everywhere. And usually those— you talked about the dark triad, that's usually what drives it in a leader. So it's good to be self-aware, but also to be aware of those tendencies in others. And knowing how to deal with it. I think that's really key. Well, I've never had someone talk about that, and I've been doing this probably for what, probably 250+ interviews I've done now. You are the first one to mention that, and I feel like it is so, so timely. Thank you. So I know leaders are learners. What are you learning these days?
Oh, I'm like a sponge in all kinds of stuff. You know, like my latest book I just started reading just yesterday is on Radical Candor. Um, such a— even though I'm just getting started in it, I don't feel like I'm fully able to talk about it yet. Yeah, it's such a great book. And they've got— even if you disagree with some things here and there, and I think I will ultimately, but I'm withholding judgment until I read the whole thing. But that's just an example. I've been doing a lot of different psychology, uh, work and things like that.
Yeah, like Kim Scott, right? Radical Candor. Yeah. Powerful.
I'm all over the place.
Wow. So is there— what is one of the greatest fears you've been able to overcome, if you're willing to share that?
Oh, yeah. I mean, from a fear perspective, it's what do you do with that? Because people don't understand what these dark triad do. You know, they manipulate other people to go screaming and yelling at other things. They're referred to as flying monkeys. And just the amount of stuff they can do. It is a really ugly thing that destroys cultures and destroys people. That's probably the worst problem that's out there, and I'm just barely scratching the surface here today. We cover that for hours in the CISO course.
It's crazy. People come here to learn about cybersecurity, or you give them a masterclass in psychology. This is just amazing. I love it. Okay, uh, if you add to, uh, If you could have dinner with 3 people, right, they could be alive, dead, or even fictitious character, which 3 people would you choose and why?
Well, since we're dealing with a fictitious environment, I'm going to give you a sort of fictitious answer. I wish that I could take myself 10 years from now and go back and talk to my 20-year-old self.
Actually, that's a question I ask. I say, what would you tell I usually say 17-year-old self standing at the edge of this career you've had. So what would you say to 17-year-old Matthew?
I would spend hours teaching him about the world.
Which advice would you give 17-year-old Matthew?
I would say, you know, open up to a lot of stuff, but also like I made a lot of mistakes like a lot of other people. I didn't jump out of the womb like that. But I would really try to look at, you know, try to be very broad-minded because like a lot of technical people, I like, oh, tech, tech, tech, it's gonna solve everything.
Yeah.
And then you grow up and you get your bumps and bruises, you're like, oh, it doesn't, you know. So I would— and the thing is, like, things like emotional intelligence, that didn't exist as a framework or set of skills that you had when you were younger. But I would say here are some things that you need to focus on.
So you— wow, powerful. Yeah, intellectual curiosity, powerful. So that's one person. Who are the other two?
Um, I'm not sure. I guess I just— I'm kind of like guessing off the top of my head here. Um, I would probably want to talk to somebody fun, just kind of see what a different perspective would be. Um, I'm always interested in more and more perspectives. Um, but I also think it'd be interesting to talk to an old philosopher to kind of get viewpoints on things.
Since you, you are a philosopher, that's what you studied in school, who is your favorite philosopher?
So this person is usually misinterpreted, and I don't like the misinterpretation, so I'm always kind of hesitant to talk about him. But, um, there is one philosopher, his name is Nietzsche, and I don't like how he's misinterpreted because he was twisted a lot by his sister. And even the big mustache that they have, he never would have had a mustache like that when he wasn't starting to go insane. You know, he was a very clean-cut person, didn't like that. So that's why I'm always a little bit hesitant. But he's such an interesting thinker. You know, when you look at the depth behind his thinking, he was so far ahead of his time, which led into postmodernism, and his thinking led into that. Like, one of my— one of my— here's one of my favorite quotes from Nietzsche. He asks, what therefore is truth? And he's kind of answering, um, back to himself. A mobile army of metonyms, metaphors, and anthropomorphisms. In short, some of human relations which have been embellished and transposed poetically and rhetorically, which after long use seem firm, canonical, and obligatory to a people.
Wow.
Truths or illusions about which one has forgotten that this is what they are.
Outstanding, outstanding, outstanding.
What a genius.
Yes.
So far ahead of his time.
Man, not only we got a masterclass in psychology now, in philosophy as well. I'm so glad you are here. Now, you've already mentioned a couple of books. What about this one, Measuring and Managing Information Risk? Why should people read that book?
So that is not my book. That is Jack Jones sitting next to me, one of the grandfathers of FAIR, the factor analysis and information risk. I just happened to be there and I got his book book for free at one of the FAIR conferences here in New York City. And I do think it's a fantastic book. I do think there's a lot to pull out of FAIR. And you can talk with him. I actually had him on my podcast, but it is like something that could be used to bring into enterprise risk management because it's very flexible and enterprise risk management should be speaking the same language as cybersecurity risk management.
Sure.
Quite often they are not.
True.
But yeah, that's where that came from, that particular book. But definitely a good book. I like a lot of the work they're doing at FAIR. Jack Jones is fantastic.
So, okay, what about this book, Cyber Elephant?
Yes, The Cyber Elephant in the Boardroom. So that another is a great one. So that is, um, Matthew Gorge, um, who wrote that book. So he had put that in there. So that was kind of a funny scene too. I didn't even know that book was there, but I ended up having him on my podcast as well. But he talks about the 5 pillars. And to me, this is another one that is a very good book to read. And some companies are actually using that as the reporting framework up to boards because it connects a little bit more with the board of directors. So I'm trying to remember what all of them are, but like the data infrastructure and a few other things and crisis management is another one of those things. And you use that as your framework to communicate with board. So instead of like using this CSF or some of these others, the framework, very easy framework, there's rules to interpret things in different ways, but as long as you're being consistent for your organization, it's perfectly okay. You know, you can map that over to, um, all kinds of things like CMMI and so on. So it's, it's definitely a great framework to play with.
That is really powerful because we do, we do read, uh, a lot here. And of course you've already mentioned This one, why should we read Radical Candor by Kim Scott?
Why should we read it? Because it's really interesting. And it also, like, what's interesting about it is it kind of points a way towards being candid. Now, I do think as a leader, you have to adapt your style to the people you are around. And it does talk about that. The question mark in my head right now, is it going to go far enough? Because it does mention cultures in there. So I don't want to say it's completely oblivious. It is not. But, you know, it's kind of like the distinction between nice and kind. You know, nice is like, hey, you look so wonderful. Meanwhile, you got like a bunch of pizza sticking off the side of your face. You know, that's nice. That is not kind. But as a leader, you know, you need to give transparent feedback, but you don't be a bad person about it. And that I think is really important because I think that's important for leaders because if you like boy, they're doing terrible, and you don't tell them. Hit them at the end of the year. Well, you're fired. What do you suck? You know, that is not— you're not being a good leader. That is a nice leader, but I actually think that's more of an able than a nice leader.
Powerful. Providing, uh, candid feedback in a caring way, that is powerful. I've always loved my bosses who always told me the truth, exactly what the embargo was, the requirement. And then once you meet those, then you do expect fairness, right? And that's powerful. Okay, so we've definitely run out of time, but let me ask you these two questions and then we are going to end. If you had one and only one day to live, Matt, what would you have liked your final contribution to be?
I think I would just want to talk on Zoom and let the whole world know here's some of the lessons I've learned. I mean, that's what I'm doing. Yes, I've created the CISO course, but now I've created something called the Cybergent Cybersecurity Leadership Exchange, where I'm teaching people all about the details behind the psychology of things. And when you get into the psychology, holy smokes, it is— you have a completely different viewpoint of the world when you start together, because it radically affects things. Because to me, the big problem is in the United States We don't believe in mentorship. We don't believe in coaching to a large degree within corporations like China with all the problems that they have there. They've started introducing that and I think we need more of that here, but they do it on a per team basis.
Wow.
To get things going in the right direction. I think we need more of that because if we do that, we have more caring that's going on. But also most corporate structures aren't set up for that. Most CISOs— and I've been stuck in this today— you know, in various places, you don't have the resources to get everything done. If you don't have the resources, how are you going to help protect the organization properly?
Wow.
And you— how do you do the mentorship? Like, no, you can't get a level 1 employee in there. You don't have time for that sort of mentorship. Yes, you've got to get a level 3, 4, or 5 in there. And that's a big problem, you know, because you're really dependent upon it. A lot of companies like, nope, it's now, you need to get everything done. Here's the thing, you work 90 hours a week, You know, you can't be a good person when entirely when you're trying to focus on stuff because you're so focused on that objective. The myopia, myopia really does start to kick in there. And that's part of the problem I see with the leadership strategies of modern organizations today. You know, I really do take such a vastly different viewpoint than others when looking at things because 50% of people in the United States want to leave their jobs. Most people heard that 50% of CISOs want to leave their jobs and like, oh, that's horrible. It is, don't get me wrong. But welcome to America.
Wow.
It is such an ugly world when you start to look at things. And what I want to do is change the world, you know, for the better, help people to realize there's a better way to approach things.
So powerful. And the way people can get in touch with you, of course, on LinkedIn, Matthew Webster. 208783, and then your website, savagence.biz, and they could get information about your class and coaching or mentoring that you offer. Fantastic. Thanks so much for sharing. I've used too much of your time, so I do need to bring this to a close, although I could speak for you for probably another 17 or 20 minutes, but we do need to bring this to a close. So the last question I'm going to ask you then is, because I want to end on a good note, and also of course we want everybody to get a copy of your bestseller, Do No Harm. It's available everywhere books are sold. So the last question I have for you is something positive. What are you feeling optimistic about in 2026?
I would say where humans are going. I mean, to me, that knowledge is going to come. We're going to be bumpy. We all know about the problems with AI and business and the arguments and things like that. But ultimately, what's interesting The NACD put out a set of standards that companies should be following, and they're more profitable. And what's interesting, when I give talks, I like to ask the audience questions if it's a small enough audience.
Mm-hmm.
I will find out which ones are the better ones. The ones that are better are the ones that are communicating with one another.
Yeah.
So we've got the models for how to be better, how to be more profitable. We're just not embracing them. You know, most companies don't embrace a lot of those standards, a lot of that communication. So we have the tools. All we have to do is get other people on board with it. And a lot of people don't necessarily take that in. But if they do, you're going to be better off as a company.
Hmm. Quite insightful. Now, for the young people who are listening to us now, who aspire to one day become a CISO, what if you had the ears of all of those young people across America? What would you tell them, like, in the next 60-second things they need to focus on or do tomorrow?
Be broad-minded in technology, focus on that for 5 years, but then really focus on your emotional intelligence skills. Look at your political skills, look at how do you communicate, learn the communication skills, because if you can't communicate, you're never going to get anywhere. To me, that's the— that's short, short version of it.
That is so powerful. Again, it's not technical, but it is about emotional intelligence, communication, and Leadership. So powerful. Okay, this is it. Thank you so much. I'm so grateful for your time. Very last question. Actually, before I ask you that one, is there anything else I should have asked you? Anything else you want to talk about before we end the show?
I'm good.
Fantastic. Okay, very last question. What is one word that represents our shared experience on this podcast today?
Fun.
Good. And thanks again. We went 20 minutes over, but I have so much to talk with you about. And also for everybody, Matt Webster is going to be one of my industry guest speakers for my class at California Science and Technology University. I'm teaching CSCMB 624, Network Security and AI. I think it's going to be Saturday of next week, and I'm so, so grateful that you are taking time to really speak to the next generation of hopefully cyber executives here in Silicon Valley. Thank you so much, Matt. I appreciate it.
Thank you.
You too. All right, so this is one for the book. And again, get a copy of Matt's book. It's not just for people in the healthcare industry. This could be applied in any industry across the board. Cybersecurity: Do No Harm: Protecting Connected Medical Devices, Healthcare, and Data from Hackers and Adversarial Nation-States. And also make sure to connect with Matt on LinkedIn and CyberGents. That is. Wow, this, uh, was quite a podcast. Now, before I end, as you guys know, we are still celebrating, um, Black History Year. That's what I call it now because 28 days is just not enough to celebrate, uh, Black history. And like you guys know, I kind of have two vignettes to celebrate that. So one of the things is that I talk about to today, right? Today I believe is March the 30th. So I tried to go back into history and try to find out, uh, what happened on March the 30th. And I'm going back to March the 30th, 1961. That's in, uh, the not-so-great state of Mississippi. On March 30th, 1961, the state of Mississippi made a deliberate and strategic decision to fund and amplify a national campaign to preserve racial segregation. That was because it was going to become illegal to segregate folks, but Mississippi was very, very adamant. They wanted Black people to be separate from white people, and they had a lot of reason for that, including, I guess, the dilution of the purification of the white race. That's only like in the 1960s, not in the 1800s, not in the 1700s. That's only what, 60 years ago. All right, so that is one thing. And then the other vignette about celebrating Black History Month. Sometimes people may not realize this, but the President of the United States is the Commander-in-Chief of the US Armed Forces. That means he's a member of the highest rank person in the US military. And of course, the first and the only African American Commander-in-Chief of the US Armed Forces, has been President Barack Obama, who was sworn in on January 20th, 2009. And again, I have a post about that on my LinkedIn page for those who follow me. So to end the show, I'm going to play briefly a quick video about Barack Obama being our very first commander in chief. And I will be back tomorrow. I will have a great discussion with Captain Nicholas Crowe, a PsyD, U.S. Air Force veteran. He's a crisis-calibrated psychologist, a strategist, and architect. We're gonna be talking about leadership under fire, psychology from the cockpit to the boardroom. I'm gonna make sure to ask him about, uh, the dark triad too. He's a psychologist. That's, that's, that's gonna be fun. And then whenever I get a chance, uh, this week, we're gonna go back to the book of Proverbs chapter 22. This is not going to be a religious podcast. We're just gonna be talking about ancient wisdom and leadership lesson from the book of Proverbs. We've already, uh, gone through Proverbs 1 through 31 in January for about an hour. This is going to be done with artificial intelligence, 15 to 20 minutes recap, and we're probably gonna do this, I think, on Wednesday. But, uh, and then I'm gonna have another guest, uh, for you on, uh, Thursday. Uh, he is one of the leading, uh, cybersecurity architects in the world right now, uh, Richard, uh, Stinnon. Uh, many of you may know He's going to be in the house, in the green room this coming Thursday, and I really, really look forward to speaking to him. He's really a giant, a legend in our field. Richard Steynen, cybersecurity industry cartographer. He's written so many books, but we're going to be focusing on his latest book, Guardian of the Machine Age. We're going to be talking about agentic AI and cyber war. Leadership in an Autonomous Threat Landscape. Actually, Richard also has a master's in cyber warfare, which is very strange because usually people who study cyber war, people like me in the military. So we're gonna see it from a different perspective. So I really look forward to that. Okay, this is all I have planned for you today. See you tomorrow. And I'm gonna play this quick video about our very first African-American commander-in-chief and have Have a wonderful rest of your day. Bye for now.
Let's be clear about something. Barack Obama has been one of the most consequential presidents in recent American history.
You can't say it, but you know it's true.
In the past 8 years, he has completely transformed the American healthcare system. He got tough reforms to Wall Street passed after the biggest financial crisis in decades. He appointed 2 of the 4 women to ever serve on the Supreme Court, both of whom were part of the historic decision legalizing same-sex marriage. He put in place the toughest climate regulations in American history. He opened the US to Cuba for the first time in half a century. And he reached a peaceful settlement to the nuclear standoff with Iran that lasted for a decade before he took office.
You can celebrate or bemoan these accomplishments. Liberals will think they're great. Conservatives will think they're awful. But it's hard to deny that they're big deals.
So where do we start?
Obamacare is a big fucking deal. For at least 100 years, the big goal of American liberals on domestic policy was to get a national health insurance program done.
A lot of countries implemented universal healthcare in the 20th century: the UK, Canada, France, but the US always lagged behind.
There were attempt after attempt after attempt by American progressives of both parties to try to get the US to where everyone else was going, and each of those attempts failed. Teddy Roosevelt failed, FDR failed. FDR failed, Truman failed, Nixon failed, Carter failed, Clinton failed. And then Obama succeeded. And he established for the first time in American history that healthcare is a right.
The plan still leaves millions uninsured, but it laid a foundation for universal healthcare.
To understand what Obama did for foreign policy, you kind of have to go back to a moment in 2007. This moment in particular.
Would you be willing to meet separately, without precondition, during the first year of your administration in Washington or anywhere else with the leaders of Iran, Syria, Venezuela, Cuba, and North Korea in order to bridge the gap that divides our countries?
I would.
And the reason is this: that the notion that somehow not talking to countries is punishment to them No preconditions, which has been the guiding diplomatic principle of this administration, is ridiculous.
So this was considered a gaffe. The safe thing that you were supposed to say is, "Yeah, diplomacy's great, we'll talk to some people, but there have to be preconditions. No preconditions is silly." And this is what other Democrats did say at the time. But he didn't accept that.
And with two of the countries listed in that question, Iran and Cuba, Obama led some of one of the biggest changes to those diplomatic relationships in recent history.
I'd be remiss in not mentioning the importance of the fact that Obama is the first Black president.
After 8 years, it seems obvious to point out.
But—
The history of America is a history of learning to deal with racial diversity and with the legacy of white supremacy. In a very real way, the history of America is the history of race relations. There's a famous photo that still hangs in the White House of a black toddler in the White House who has to touch President Obama's hair because he thought it was great the president had hair that looked like his. It seems cheesy, but it really is a big deal that a generation of black children are going to grow up knowing that they could be the president.
Overall, it's a pretty extensive track record.
So you can generally divide American presidents into two two camps. There are the ones who were maybe a little good, maybe a little bad, but are sort of forgettable— Grover Cleveland, Benjamin Harrison, Zachary Taylor, William Howard Taft, Bill Clinton. And then there are the ones who were hugely consequential, either for good— FDR ending the Depression, winning World War II, Lincoln winning the Civil War, George Washington establishing what a president is. For ill. Andrew Johnson destroying Reconstruction and subjugating Black people for a century. Andrew Jackson committing genocide or ethnic cleansing against the Southeast Indians. I think it's hard to argue that Obama is in the sort of iffy, eh camp rather than the big consequential camp. He did a lot. He accomplished a lot. And I think in the next 10 or 20 years, when we have a bunch more presidents, many more of whom are, are sort of all right or maybe slightly bad, but, but ultimately forgettable, we're going to look back and realize what a rare thing a presidency that active and that accomplished is.
Thank you for tuning in to the Leadership and Success Podcast with your host, Coach BZ. If today's episode added value to your leadership journey, be sure to subscribe, share, and join us again for more wisdom nuggets on how to lead better and achieve greater success. Remember, leadership is the most critical skill of our time. The world will always need leaders to inspire others, drive innovation, and execute meaningful strategy. So why not count yourself among the bold leaders shaping the 21st century? Until next time, stay inspired, stay committed, and keep leading with excellence.
More from Bob
S250:E4🎙️LIVE 🇺🇸America 250: President Barack Obama Leadership, Service, and the Power of Hope
S250:E4🎙️LIVE 🇺🇸America 250: President Barack Obama (Multi Tracks Audio)
S5:E157🎙️ LIVE with CMD CMSgt Dennis L. Fritz, USAF (Ret.)(Multi Tracks Audio)
S5:E156🎙️ LIVE 🇪🇸 Leadership Lessons from the FIFA World Cup 2026 Champions (Multi Tracks Audio)
S250:E3🎙️ LIVE Leadership Lessons from America’s First Documented Family of African Descent 🇺🇸📖