S5:E80🎙️ LIVE with Andres Andreu (Multi Tracks Audio)

Hi, I'm John Maxwell. When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation, I'm proud to say, is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend Bob Fabien Zinga.

Welcome to the Leadership and Success Podcast with your host, Coach BZ, where we help you lead with purpose and succeed with impact. If you're ready to grow into the kind of leader others want to follow, this podcast is for you. If you're determined to elevate your success and leave a lasting legacy, this podcast is for you. As my mentor, Dr. John C. Maxwell, reminds us, everything rises and falls on leadership. Our goal is simple, to inspire you, challenge you, and equip you with insights that can transform the trajectory of your leadership journey. Welcome aboard to another episode of the Leadership and Success Podcast with Coach Easy.

It's a combination of two things. One, I don't ever let my ego get the best of me. There's so much to cover in this field that the minute you think or call yourself a quote-unquote expert, you already just did yourself a disservice. I've been doing this 32 years. I'm pretty good at certain things. I don't consider myself an expert. And the second part is what I talked about earlier, that that willingness to make the sacrifice. I don't play golf, so I don't go hit the golf course on a Saturday, but I do sit here and read code because that keeps me sharp.

All right, everyone, welcome to another edition of the Leadership and Success Podcast. So this is the second time we are broadcasting today. And as you guys know, we always start with a moment of gratitude. So my gratitude for today, as you know, like it was yesterday. I am so glad, so happy, so grateful to God that America didn't turn into a rogue nation. We didn't commit a genocide on Tuesday. And it really means something to be an American. Our core values, especially to be in the most powerful Navy in the world. I still believe a force for good. That's who we are. Our core value: honor, courage, and commitment. We respect and support and defend our constitution, rules of laws, and we are so proud to serve our country with honor, distinction, and dignity. So that is who we are, that is what we stand for, and I pray to God nothing is ever going to change that. All right, so let me see if I can properly introduce our guest today. Today, I am really privileged to be speaking to Andres. Andrew is a global cybersecurity executive, CEO now, but former CISO, author, and trusted advisor with over 30 years of experience in tech and more than 20 years in leading globally distributed teams, from federal law enforcement to Fortune 500 enterprises to cybersecurity startup and venture capital advisory. Andreas has operated at the highest level of cybersecurity leadership. He's also the author of a bestselling book, "The CISO Playbook," a practical, no-nonsense guide to leading cybersecurity in today's complex AI-driven world. But what really sets Andreas apart is this: he doesn't just understand technology, he understands how to translate cyber risk into business impact. So ladies and gentlemen, without further ado, please help me welcome to the leadership Success Podcast, the one and only Andres Andrew. All right, Andres, how are you doing today?

I'm good, thank you for having me. And before we start, please, before we start, I just want to express my appreciation for your service to country because, thank you, a lot of us, that means a lot.

Thank you so much. Yes, and I am really hoping it keeps meaning a lot after this presidency, but yes, it is really a great honor, a great privilege, and one thing I really love about the military, everybody I've met the last 21 years, are people who are willing to die, to give their life, you know, for their brothers, for their sisters, to defend this country. I think there is really no greater love than that. And just know what we stand for. I am really overwhelmed every time I see another veteran because it's a lot of them. I'm telling you, especially in the information warfare community I am in, they could double, triple the money they make just like that, but they decide to serve a higher purpose. So I am so, so appreciative. Thank you, thank you so much, Andris. Normally I ask one thing you are grateful for today, but let me ask you, is there something about you that most people may not know when they first meet you?

Yeah, I've been practicing, teaching, coaching judo for—

wow—

42 years now. That's amazing. And one of my original students who started learning judo in my garage who is blind, she won silver both at Tokyo and Paris.

Really?

So she's literally from my garage all the way out there, so I'm very proud of her.

Wow. And I believe they have black belt in judo, right? Yes. And you are a black belt?

I'm a 4th dan, yeah.

Wow, that is amazing, man. That must take like a lot of discipline doesn't it? Yes, that's amazing.

Wow.

No, uh, I have a lot of respect. I know it's not for me, but, uh, wow. But it looks like you— I don't know, I may be wrong, but from what I have seen, all of the martial arts, you are really able to discipline your mind in such a way that sometimes you can even kind of go through pain in order to achieve whatever goal you set to yourself, right?

Oh yeah, I mean, I could tell you, so I have 4 kids, 3 sons, 1 daughter. My 3 sons have all been international competitors.

Wow, that's amazing.

Yeah, I mean, look, they've competed with literally with broken bones, you know, injuries that most people would be on the couch and they still got out there. And that, that's part of the, that's part of the mental game of traditional martial arts.

That is amazing. Like, when you mention that, like, I think a lot of what you did in martial arts really applies in life, even in your profession like cyber security, because so many people, things happen to them and they do happen to us all. Some people will just break and fold and just give up, but others, they will just get through it and endure. And, uh, so what What do you think that is that would, uh, like your children, even when they have a broken bone, they still go through it and they persevere? It's almost like superhuman.

I, I, I'll tell you, it's a mindset. It's a mindset, right? And if you instill it in them early enough, it sticks with them. They're adults now. It sticks with them for life. And I, I always taught my kids and when I had my own dojo, I always taught my students the— probably the most important lesson to me is this: you're gonna fall. Everybody in judo hits the ground, right? So at that point, two things matter. One is that you get up, but more importantly, two, how you get up.

Wow.

Because your body language, your demeanor tells the opponent everything. So if you hit the ground and it knocks the wind out of you and you drag yourself up and you already physically look defeated, you're going to lose. But if you feel all that pain and snap up and you're ready to go, it's a very different experience and a very different message you send to the opponent.

Wow, I really see right there a masterclass in leadership, not just in martial arts, but this is definitely applicable in life, even in cybersecurity as well. How would you apply those principles that you just taught us now?

Well, first of all, be, be entirely, you know, acknowledge the fact that you're going to fail, you're going to fall, because a lot of people are afraid of failure. Just, just embrace it. It's gonna happen. And program your mind to be resilient enough to just bounce back from that and keep it moving. And I think the added lesson in business is if you can do all that and fail fast, you're way ahead of the game, right? Because if it took you 2 years to figure out that you failed at something as opposed to 2 months, that's a— there's a radical difference in there. And so I think being, being agile in your mindset and just accepting failure, it's going to come. It's not going to stop me. You're not going to stop.

Yes.

So it's that mindset to me that, that, that's what matters.

That is really, I believe, the master key to success, knowing that you will fail, but you will recover. And keep moving forward. Wow, that is powerful. Now, Andres, your journey really spans federal government, startup enterprises, and venture advisory. What defining moment shaped you into the leader you are today?

So when I worked in the federal government, I was a full-time employee originally, GS-5, GS-6, I don't even remember. This was in the early '90s, and there was an administration change and they converted my role to a contractor. And when that role change happened, I was the one with the most hands-on experience where I worked in the Title III and the wiretap facility. And basically the contracting company just said, listen, this is simple. You, you're either going to get a boss that we will put here or you need to step up. And I was, I was young, I was in my mid-20s, um, and so I, you know, I wasn't I guess my judo background just kind of took that fear away. And in judo, there's a famous saying, it teaches you a lot of things, but fear is not one of them. I just embraced it and I went with it. And I've made many mistakes in my leadership journey, but I think I've also done some good stuff. So that's how I got into this.

I love what you said. You embrace your fear. One of my mentors says, feel the fear, but do it. Anyway, that was Tony Robbins. So fear is natural, but you don't have to allow fear to paralyze you. Is that what you are saying?

100%. You're going to— if you don't feel fear, something might be wrong with you. Yes, you're going to feel it, but it doesn't have to be debilitating, right? You can say, okay, I have to face this, I got to do this, and just work through it. I think, you know, I think again, it goes back and I stress this a lot, it goes back to mindset. And a lot of people, that mindset is more like defeatist than it is, I'm going to succeed one way or another.

Yes. Wow. But really, again, looking at your background, everything you've done from startup, federal government, enterprise, venture advisory, and so on and on, was that completely different industries? So, Matthew, I guess operating across all of these different vertical, which one lesson translates across all of them?

Mission orientation. And, you know, it is so easy to get lost in certain environments with, you know, politics and corporate messes and all that and lose sight of the mission. And, you know, when I was in the government, one of the, one of the early lessons I was fortunate enough to absorb is that the mission-first model has to be prevalent. Right? I mean, obviously, you know, you try to be a good human along the way, but there's a mission and you need to, you need to achieve the objectives of that mission. And I think that mission-first mindset has just stayed with me. And, um, you know, I, I've been able to— I'm, look, I'm human, it happens. You get caught up in politics and all that, and then you catch yourself and go, okay, I can't get distracted with that, I got to stay focused on this. And that, that has That's been critical.

Yes, yes. And I think focus is another one I believe is a master key of success because we get distracted so easily and we need to learn how to say no and just focus on the priorities. And that's not always easy to do, but I think it's so necessary, don't you think?

Absolutely. And, you know, if you take a look at the world today, right, people are glued to their cell phones and all that stuff. That ability to just, for instance, meditate, sit in silence for any period of time. It's like that's disappearing, that discipline to just sit there and try to clear your mind. And, you know, yeah, focus to me is absolutely critical.

Mindfulness. Yeah, especially these days. I think we need to do more of that with all of the craziness and chaos happening all around us. Just get some sanity, I guess. So, uh, what adversity or failure taught you the most about leadership?

I'm gonna have to go back to my judo analogy. That, that the fact that I, you know, you can accept, or you have to accept, that bad things are going to happen, but they cannot define you. You have to just keep going. I, I, to me, that's absolutely the most important thing that I've transferred over to leadership. Because look, when you hit certain points of leadership— and I know this is going to sound gloom and doom, but it's kind of reality— 90% of your time you're dealing with problems, bad news, you know, stream of endless headaches, right? And then a little sprinkle of positivity in there. And you have to have a certain thickness to your skin to be able to navigate all that, make clear decisions, and, you know, embrace the good that happens and just keep things moving forward.. And so that resilient mindset to me is the key.

Wow. So without naming names, is there a specific experience you feel like you learned the most from?

Yeah, you know, I got to tell you, there was a time when I first left the government. And so you got to understand timing. This is early 2000s. When I first got out.

Yeah, Y2K.

Yes, I survived Y2K in the government and left, you know, right after that, actually. There was a moment at a large corporation where I worked in New York that— and remember, this is pre, you know, pre-cloud, pre-all that. We ran our own data centers, right? Had to rack servers and all that. And the ISP connection for the entire company in, you know, in New York got severed. And when we realized that it was a piece of networking equipment that had gone down, that basically went bad, we had to literally build a computer, a Linux computer. Wow. In 2000, we put 2 network interface cards in it and basically built a gorilla, you know, gorilla style, ghetto style router, plugged two cables in, and the business was back in action until the ISP folks came in and fixed it.

Wow.

That, that kind of, you know, that kind of on-the-fly problem solving, I, I think to me is, is a critical— it may sound like a technical issue, but it's not. It's the mindset that, okay, we got to figure out something now and put it in place now. And this one, this one young man and myself did that in like I guess a matter of hours. And that was rewarding to me.

Yes. Wow. That is really amazing because they also say where there is a will, right? There is a way. And sometimes I think we are limited just by the way we think, our own mindset. But what would your younger self not believe about where you are today?

I wouldn't believe And I, and I wholeheartedly mean this when I say it, I wouldn't believe how many people I've been able to help rise throughout their careers. That's become very important to me because, you know, as an immigrant kid here in the U.S. and, you know, working through the corporate America structure of the time, right? I started in '92 in the government, uh, things were very different. It was hard to kind of claw your way up and get to leadership positions and stuff like that. Over, over my journey, I've run into people that were held suppressed in certain roles, and I could see where they really belonged. And I've been able to move them into that and watch them flourish. And it's just, to me, that's wonderful. That's so important.

Yes, that is really powerful. Now, one thing I want to make sure we talk about while you're here is your bestselling book, the CISO Playbook Security Audit and Leadership Series. So we're going to be talking about it and around it too. And I feel like lots of things have changed as far as the CISO role in modern time. First of all, I'm sure you remember when this— we are relatively pretty new profession because I think this used to be an hobby or a collateral duty for a lot of people until we kind of turned it into our own profession. But I guess one question I have for you is, how has the role of the CISO fundamentally changed over the last decade?

You know, I see the role as a pendulum, right? We kind of— there was a subset of us who came up the technical ranks and started getting into this, you know, and then the pendulum swung all the way to, well, no, you can't be technical, you have to be you know, pure business. And then, then I think a lot of people started to realize, okay, yeah, but we have to protect stuff that's based on technology. So somewhere in the middle is, is reality, is that sweet spot. And I think, I think that pendulum has been a catalyst of change. I think what we have to start getting ready for now— and, you know, I, I'm not a buzzword person, but there's a reality to the artificial intelligence movement Yes. Where does the CISO role fit when autonomous decisions, security decisions start to get made by technology? AI is technology. So if you want to be a CISO and not be technical, but yet your decisions are ruled by technology, you got a problem.

Yes.

So, so somewhere in that middle, in that balanced sweet spot, to me, that's where, where we all should aim or strive to exist.

Hmm, that is so insightful. Let me ask you this then. What do you think most people misunderstand about what a CISO actually does today?

Let's put the what they do aside. I'll tell you the biggest misconception that exists around the CISO role. Most CISOs have zero power where they work. Their position has no power. They cannot go to the application teams and tell them what to do. They can't go to the IT team and tell them what to do. It's a game of influence. It's not a game of authority. And a lot of people think, first of all, they see that C in front of the title and they think, oh, well, you're a corp, you know, you're C-level. Most CISOs are not C-level, right? So that's one reality. But the other one that I think is more important is the fact that they genuinely don't have authoritative power. And so as a CISO, if you understand that, and you develop your game of influence, you're way, way better positioned to succeed than coming in with the 'I am the boss,' you know, that does not work.

That is so true, especially in the startup world. CISOs don't even have a budget at times. And yes, yes, yes. Like, how can you be a C-level executive and you are a team of one. But yeah, it's really interesting how in some industries and some organizations, I don't know, I'm thinking the idea maybe they're trying to find somebody they're going to scapegoat when everything goes wrong because they give you the responsibility, you are responsible for it, but they don't give you the budget, the people, and the authority to actually make changes across the enterprise.

Right, hence the joke, Chief Information Scapegoat Officer.

I never heard that one. Yeah, yeah, yeah, that is so true. Talking about the role of the CISO, where do you think within the organization the CISO should report to?

So, you know, I don't think there's one answer. I genuinely think organizational culture matters a lot in respect to that question, but I also think the size of the company matters a lot as well. So in a larger organization, especially a publicly traded one, I genuinely think that a CISO should be granted the power to report directly to the CEO on par with the CTO, the COO, and all those, because at the end of the day, you genuinely hold responsibility over events that could be highly detrimental to that organization.

Mm-hmm.

And so I genuinely am a believer that they should structurally sit in that space. Now, that comes with— there's a downside to that. And just stay with me, because this is the ugly side, the real side. What that means is that you have to have an executive leadership team that is willing to be part of your journey and accept the risk that comes with that. See, because a lot of executives don't want to accept risk, so they dump it on you as a CISO so that they're preserved, right? Self-preservation is intact. Yes, all the risk is on you. Something goes bad, it's your problem, not our problem. That's, that's a key point of understanding that a lot of folks don't have when they get into these roles.

Yes. Wow, that is so, so critical. So how do you think a new CISO should handle that if they are within an organization where it seems like they don't really don't care much about security. Maybe they have a CISO because their client forced them to, and maybe they give you authority, but it's on paper only, but not really within the enterprise. How do you think they should handle that?

So once you understand that business, you know, and by the way, chapter 2 of that book, Be a Student of the Business, is absolutely critical to me. But once you understand that business, then you can figure out where and how you can show value to the business. Not just, oh my God, I'm protecting endpoints.

That's—

yes, let's just be realistic. To most executives, that means very little.

Okay?

You have to figure out how to inject yourself into those high-level and important business processes and show where you are adding value. That is when they start treating you very differently.

Yes, and I think we have a great comment from the audience. One, Pablo says, uh, it sounds like you are flying the plane, serving coffee, repairing the wings all at the same time. That's how it feels sometimes, isn't it?

100%. 100%. And by the way, putting out the fires as they start.

Yes, yes, right?

Because you're the one dealing with problems, you're the one doing incident response, you're the one overseeing all that. And to your point earlier, BZ, if the, if the budget and the team is small enough, well, guess what? You have to roll them sleeves up and be very much in there with your team to show leadership from the front and actually get things done. Now, if you're an ivory tower, what we call an ivory tower CISO that has a team of 300, it may be different. You can send people to do it. But most, most CISOs don't have teams of 300.

True, true. So you're gonna have to be both operational, strategic, but tactical too, when needed.

And let me tell you, that is, to me, that is a super important point. Because when a CISO embraces that, that I have to be all these things, and you develop your abilities within all those verticals, you start to realize, I, as that person, can actually do so much more. Than just security, because I have been able to keep a very cool head under the worst conditions a company could be under. And I, the next day, have been very strategic in my roadmap planning, and I have handled business conversations, financial. You start to realize, wait a minute, you know, and I can tell you, as someone who is now in a CEO role, all of those, all of those headaches that, that molded me in those verticals have come into play now give me, you know, at least the confidence or whatever to sit here in this role and perform my duties as the leader of the company.

Wow, that is really something. So let me ask you this. For most of us, right, too much to do, not enough resources, people, and budget. So how do you prioritize?

That, that really depends on the company and the mission. So I don't, I don't think there's one answer, and I'm not trying to duck the question, but I think legitimately you have to understand the business. So for example, let's say you're working in an organization that has a heavy manufacturing, uh, presence. You know, the manufacturing is probably going to be priority overall.

Yeah.

And so your mindset has to be that has to continue running no matter what happens. That's a, that's a different mindset than working at an organization where, you know, the most important thing is people get their email.

Yes.

Right. You know, I genuinely think that you have to understand your business to be able to say these are my priorities in order. And by the way, I do genuinely believe that once you study a business, you know, let's say for a whole quarter when you start there, you should be able to actually write those down. These are my priorities.

Yes. Yes. Well, and then it goes back now to talking about the pendulum, the sweet spot being not only you're a technical leader, but you are a business leader as well. So at what point does a cybersecurity leader stop being purely technical and start being a true business leader?

Oh, I can tell you the exact point. It's when you get put for the first time in front of the right audience. So for example, you, when you get to a leadership level where you actually have to go present to an executive leader committee, right, let's say all the C-level, the legitimate C-level leaders from a company, all of a sudden that's an audience you've never interacted with, and you will learn very quickly that tech talk does not work in that room.

Yes.

So you have to stop, literally just turn that off and learn. And this is where you get into the translation point that I always talk on, and you have to start learning how to translate to that audience.

Yes.

And if you are not effective in doing that, I hate to tell you, you will not succeed in this space.

Mm, that's really powerful. Yeah, let's talk about the art of translation because you do emphasize the importance of translation, tech to business. And why is that so critical?

So let me just augment what you just said. So tech to business, absolutely, but also business back to tech and security. You're the one in the middle. You're the one translating.

Yes.

So Look, you— if you don't understand your audience, you'll never understand whether your messaging made it through the way you need it. So I always talk about the divide and conquer approach because that's what I do. If I have 7 members that I have to talk to from an executive committee or a board— and we can talk about boards in a minute— but I like to establish one-on-one relationships with each one because I need to at least understand the mindset of my targets.

Right?

And that way I can also start planting seeds ahead of the, the point where I have to come in front of the entire committee to address something. And so if you don't understand, at the least at some basic level, the mindset of the people you're talking to, you're never going to get your message across. And, you know, the other thing I always tell people, don't be afraid after, like, after a session, don't be afraid to approach those people and get Did you, you know, did my message resonate? Did it sink in right? I mean, you know, you can do this tactfully, right? I'm not saying go be rude, but my point is get a feedback loop going so that you start understanding. Okay, I said it this way, it didn't work. How else can I say it, right? It's a journey and you have to adapt and overcome based on your audience. And I, I am a firm believer, one-on-one That is the key. That is the key. Because if I can plant 7 seeds before I get in a room with 7 targets, I will probably be more successful.

That is a really good way of looking at it. So what about for those people who may be, you know, cybersecurity engineer and architect or analyst right now, but they do aspire to one day become a CISO? When it comes to communication and translation, what would you advise them to start working on now?

Put yourself out there. Go find yourself public speaking engagements. You know, you could probably start small in some local, you know, local events and stuff like that. But put yourself out there so that you get past first the inhibitions of speaking publicly. But second, most importantly, when you put yourself out there and you start engaging with larger audiences, Same thing when you get off stage and everybody's mingling, follow up with people, right?

Yes.

You know, what did you think? Did my message get across? Did you understand what the point I was trying to make? And those feedback loops are invaluable, invaluable, because you in your head— I mean, look, we're all human, right? In your head, you may think, oh my God, I killed it. But when you start talking to people, yeah, you kind of lost me after the third sentence.

You're going, yes.

So you have to create that adaptability to say, okay, what I thought was gonna work did not work. Yeah. Right now, it may work with the next audience, who knows? There is no, to me, there is nothing rigid here. And there are no formulas. You got to be able to get up and mingle with whatever audience is in front of you. And that to me, that is a skill that cannot be taught. You gotta develop that.

Now let's talk a little bit about, I guess, information warfare, which is my domain in the Navy. There was a time where that was really a thing just of the government and the military. But today, pretty much, more and more corporations understand that there are adversaries out there in cyberspace. And just one example, when the director of the FBI is telling AT&T executive, Nobody can use your text because China is reading all of your text messages. That is a very, very big problem, right? So, uh, how is artificial intelligence fundamentally changing the cyber threat landscape right now?

You know, I always bring this down to two things: facilitation and scale. So AI is facilitating a cybercrime movement that is unprecedented. The barrier to entry is basically at zero at this point.

Yes.

As a matter of fact, I spoke at the AI Summit in New York in December and I showed 3 prompts, 3 prompts that could give you a full ransomware campaign with zero skill, all the code written, all the messaging and the entire campaign created. So if, if you get dark LLMs, right, you can't do that on like ChatGPT. But if you get Bark LLMs and you have those type of 3 prompts, anybody can become a cyber criminal. And so the game has changed dramatically. And then, so now it's easy.

And also AI doesn't sleep, doesn't eat, doesn't take vacation or get sick, right? 24/7.

And that's where we get into scale, right? Because now I can run a campaign against an enormous volume of a target continuously, because to your point, it doesn't get exhausted, it doesn't need a break, it doesn't need to take its wife out to dinner, whatever.

Yeah.

So when you, when you combine facilitation and scale, oh man, it, it's exciting and disturbing at the same time.

So what do you think most organizations then are underestimating most about AI-powered adversaries?

I think they underestimate how fast this is progressing, and I think that they underestimate how much they have to go push against their, their organization to say we need to change things. Because think about it, most, most enterprises get into like 3-year contracts with certain product companies, right? Well, all of a sudden, if I got 2 years left on a product that's no longer protecting me because of these changes in the— on the nefarious side, I need to push for changes now. And if that vendor hasn't created the adaptability to deal with those type of attacks, then, hey, we need to make some changes like right now. And so I think— and I can tell you a lot of CISOs I talk to, they know they're behind the curve, but they're stuck because of their organizational reality.

Well, I guess then the question we need to ask is how can we adapt as well? For example, I know in the DOD, usually We are very resistant to change, right? Eventually, especially in the US Navy, I think we are the most resistant branch of all of them. Usually the DOD say do something, the Army is usually the first one to comply and do everything just the way they're supposed to. The Navy, we usually the very, very last, last one. But eventually we do have to get on board. For example, I was quite shocked for the first time within my lifetime. For the first time we use artificial intelligence for a live military operation, right? It was Operation Absolute Resolve. When we kidnapped the Venezuelan president. And it's never been done in a live military operation before. Of course, we're using AI again for this Epic Fury thing we are doing. But I guess the question I am asking, if our world is changing so fast, especially with AI, I've never seen a technology evolve so quickly. What is your advice for most leaders out there, the C-level suite and board of directors, what do they need to do with their organization right now?

I think first and foremost, they have to change their mindset to one of resilience, because you're gonna get hit. Like, let's just be upfront here, you're gonna get hit. So being resilient in the face of that hit, to me, is absolutely critical, because you need to continue business functions.

Yes.

Beyond that, you have to legitimately, legitimately— and I stress that word for a reason— you have to legitimately study and understand the adversary at this point. Forget about the fact that they're using AI. It's still somebody behind that use of AI. And if you don't understand that adversary, their intention, the way they're going to come at you, whether they're going to come at you specifically or not— because let's face it, not all attack groups are going to be interested in your organization.

Yes.

Right. Like, I always use the nation-state attacker concept as a joke, right? If I have a company that sells hot dogs online, what would a nation-state actor be interested in me for, right? Like, you know, so you have to be realistic in terms of what attackers are going to be interested in your org. And once—

but if you are a DoD contractor, that's a completely different story.

Absolutely. You know, they're going to come for you.

Yeah.

You're a clear target, then to me, it's a matter of understanding exactly which groups are going to come at me at a level that I am possibly not ready for. And this is where effective, you know, red teaming that can simulate an adversary, this is where that becomes very valuable.

Yes, I think this is a great segue, you know, to get a little bit deeper into your book. Again, we're talking about the CISO Playbook here, Security Audit and Leadership Series. So I think this book is really widely recognized as a practical, real-world guide to cybersecurity leadership, focusing on aligning security but with business strategy, executive communication, and operational execution. So one question I want to ask you is, why did this book have to be written? Why did you have to write that book?

Well, after writing my first book in 2006 and remembering how much work it was—

Yeah, we're talking about This one, talking about pen testing for web application.

Yes, I had no intent on writing another book, um, but I think what I remember the incident clearly. I was in Switzerland.

Well, I was gonna make a joke. He's writing this, this book, make you lose all of your hair. That was it.

No, I lost it way before that. Don't worry, with 4 kids you can't keep it. That's true. You know, when I was in Switzerland and I was the keynote speaker at a global conference for day 2, and I realized after listening to all the other speakers— well, not all, most of them— they had a very academic approach about how things should be. And I'm like, yeah, but they're not like that, right? Like, in my mind, I'm a pragmatic guy. I'm not, you know, I didn't come to this with an MBA. And they, you know, whatever, risk should be accepted at this level. And I'm like, yeah, but it's not. So what do you do? Yeah. And so when I spoke, I spoke very, you know, very real-world grounded. And the— there was a representative from the publishing company that published that book, uh, in the audience, and they approached me and they were like, you need to put this in writing because people actually are listening. Yes. This and thinking the world works that way, and it doesn't. And so that was kind of the premise, um, you know Then I got, I got really into it once I started writing it, because I realized that there is value in trying to give people real-world perspective, you know, because you walk into an enterprise as a new CISO, and you learned all the textbook stuff. And as soon as you get there, you realize very quickly, oh my god, it is not like that.

True.

Wow.

And I really like what you said, because many times, even when you go to school, you learn about security science technology and so forth is a lot of theories and you have an idea of how it should work but that's not exactly the way it works in the real world. No, that's why I'm so grateful. I know not this Saturday but next Saturday you're going to be live talking to my student at California Science Technology University and I'm so grateful for that because I want them to see what it looks like to actually put this in practice. What do the operators out there actually do? What do they live through? And I think that's going to better prepare them to go into the real world. But going back to your book, though, one question I have is you do emphasize that the CISO role is not what people think it is. What do you think is the biggest misconception? We kind of touched about it a little bit earlier, but specifically from your book, most organizations, what misconception they have about the role of the CISO?

Yeah, I'm gonna have to go back to my earlier point because that to me is the largest misconception. CISOs have no power. Yes, generally speaking, put aside one or two anomalies, most CISOs have no power. They have a title and they have responsibilities, and then they have no authority, and then they have very little backing from executives. And you know, it's almost like you're a necessary evil.

Right?

They, they really don't want you there, but they know they have to have you there, especially if they're publicly traded, right? And so you have to learn how to navigate through those environments and show that they do need you because you add value, not because they have to have you, that they want to interact with you because you are adding value. And depending on, you know, so I look, I always go back to the example of SOC 2 reports.

Okay.

And for the record, because I can't stand when I hear this, SOC 2 is not compliance, and SOC 2 is not a certification. It's an optional report.

Okay.

You opted in to get a report, I guess.

At the session. Okay. Yes.

So, you know, so let's say, let's say a company wants to start expanding their business operations into a new sector. And You look, you know, you start doing some research and you realize that that new sector will not do business with any company that doesn't have a SOC 2 report. So if the company doesn't have one, clear, clear area where you can add value.

Yes, yes.

Or like when I, you know, when I had my previous company, when we started trying to do business in the Middle East, in the Middle East, if you don't have an ISO 27001 certificate, they don't, they don't care how good your product is, they don't want to talk to you.

Right. Yeah.

So again, this is where security starts to add value because you go, hey, I know the biz dev folks are going to start moving into, you know, Saudi Arabia, UAE, Bahrain, all that. If we don't have this certificate, you're wasting your time. All of a sudden now, the business folks go, oh, wait, that's a good point. And that's a business level point. That's not a security point.

Yes, yes.

And that's where you can start legitimizing your position within that organization. And I realize it's a simple example, but I think it's a genuine example that people can understand.

Absolutely, I think it's quite insightful. And also, one of my mentors, I'm sure you've heard of him, Joe Sullivan, he was CISO at Uber and everything he went through. One thing you said about the CISO role not always being treated as a true executive. What about director's insurance? What is your advice on that? Because I think some CISOs think they're covered, but they're actually not covered.

At all, right? So, okay, so a D&O policy is generally based on the bylaws of the company, and those bylaws were probably written way before the CISO role existed. So step number one is get those bylaws and read through them to make sure that by title you are covered or not. Some bylaws are written, you know, more generically to say whatever, any SVP and above is covered. So So there are nuances to the way the company was structured originally. So you have to look at those bylaws. The insurance company will insure based on what's in those bylaws when the company was created. So, um, to— you want to prove to yourself, and this is, this is real because I've done it, you want to prove to yourself whether you're covered or not, go to the insurance company yourself and say, hey, I am the CISO for this organization and I know you guys own the D&O policy. I want a certificate with my name on it that says I'm covered. If they tell you I can't give you that, well, guess what? You're not covered. Yes. So if, if you are covered— because when I did it for a publicly traded company, they gave me a certificate with my name on it, so I knew I was covered by D&O. And there are other policies, by the way. There's also errors and omissions, E&O policies. So, so that's the other thing you got to figure out. Does my organization have anything beyond D&O? They have, you know, and all these other, you know, indemnification policies. And again, same game. Is it based on the bylaws? And if it is, am I covered, right? And this is, this is self-protection that any CISO should, you know, and I cover a lot of this in Chapter 1 of that book. Any CISO should be able to basically ask these questions and go through these steps to make sure that they're going to walk into an environment where they're protected somehow.

Yes.

Yes, because, you know, look, let's be honest. You look at the Tim Brown type situation. Tim was very fortunate that the company stood by him. So because they could have turned their back on him and he would have been on his own. So you need to, you need to cover you this. Listen, when you accept a job, it's a bi-directional benefit, right? I'm good for the company, the company is good for me. And if that's not the case, you do yourself a favor and walk away.

It's really a lot to think about. Now we're saying that the modern CISO really has to be a business leader as well. Do you recommend for CISOs to get like an MBA, or you think that's—

I think there's value to that, but I think you can also become a business leader without an MBA. Yes, I always joke— this is just a joke— but my joke about MBAs is they learn how to talk for 45 minutes and say nothing. You don't want to be that guy, right?

Yes.

So, so you can, you can still learn business language, etiquette, you know, functions on your own, if you just apply the mindset and some discipline. But I don't see anything negative about going and getting an MBA. It's all good learning.

Alright, so from, from your book, then you get a brand new CISO. What do the first 90 days look like? What should they prioritize?

Two things. Well, three things, hands down. Learn the ecosystem.

Mm-hmm.

Build all of the proper relationships, or at least set the foundations for the relationships that you're going to need. And then study the business.

Hmm.

If you, in the first three months, if you can study the business to figure out how they make money, What's the business model, how they operate? Then you know exactly some areas to focus on. On the relationship side, you cannot do this job on your own. You have no power. So you got to align with the folks that do have power that can support you with your initiatives. And then 3, you know, I hate to say to those who go, well, she's a lot to go. Well, no, you need to understand your ecosystem. Because in order to protect the business stuff that you learned, you're going to do it through technology. And if you don't understand your tech, you know, I always go back to the attack surface management example.

Yes.

How many CISOs get to an environment, they deploy an external attack surface management tool, and they think they understand what they look like to an enemy. And then you go, what if they're on the inside of your building? Oh, because they don't understand enough about the security ecosystem to go, wait a minute, We're in a building, there's an HVAC system, a maintenance guy can come in, plug into my HVAC system. Is it on my network? Yes, it's on your network.

Oh, yes.

You see, understand the ecosystem, build your relation, the foundations for your relationships. And then focus on learning that business as best you can.

Yeah, that they wouldn't be on your network unless you have segmentation properly done. And then where you to offer us very specific MAC addresses.

But yeah, it's, uh, even that, even that, BC, I, I mean, having lived on the offensive side, I can tell you that most of that, and ways around it, to a real attacker, you know what that is? That's a nuisance. Nothing.

Yes, yes. At least you are slow. You slow them down so they can go next, next door. You are, you are right. Because to, to me, that's why— okay, let me ask you this. Maybe we align on this too. I believe as an information security officer, you need to understand physical security as well. And for exactly that, that reason, in many organizations they have a chief security officer, maybe, you know, physical security, and then information security is completely separate. And to me, they kind of should be working together. What are your thoughts?

Yeah, 100%, 100%. Listen, this goes back to the, the, you know, the model of penetration testing. So when I was coming up in the '90s in the government, penetration testing meant you penetrated a facility, physical facility.

Yes.

And that translated into the digital realm as well. But my point is, if I can get as an attack team, if I can get one of my people physically on the inside of your environment, that they can literally plug into an Ethernet, an RJ45 jack, Game over. Game over, man. So absolutely, there's a physical component to this.

Yeah. Wow. Now, you did talk about financial literacy, understanding the business of a company, make money and all of that. Why is that so critical for cybersecurity leaders? I am a CISO, not a financial genius. So why should security leaders really learn at least those basics?

At its most raw point, you want to be taken serious by executives. That's the language they talk. So if you can't talk that language, you're always going to be seen as IT. Okay, if you can't come in and talk margins, ARR, you know, all that, they're gonna look at you like, oh yeah, he's tech, he's tech, leave him over there. No, if you come in and you start talking in terms of, hey, listen, if we changed our strategy in terms of security product investments in this way, that could impact our margins in this way, they go, Whoa, wait a minute.

Yes.

His predecessor didn't talk like that. Yes. And so I think it's a matter of raising your profile within an organization so that they see you as an equal at the business level. Now, there's a reality to understanding finance as well, because as a CISO, you manage a budget.

Yes. Right.

And if you don't know how to manage a budget, if you can't look at a P&L and, you know, make sense of it, I'm sorry, you're kind of in the wrong role?

Well, now I think especially when this kind of started, we started having, I think the very first CISO, if I remember correctly, was at Citibank. I think I am connected to him, the very first CISO in the US who had the actual title and position. But anyway, when this started, I feel like, yes, you are a CISO, C-level executive, but not really because you don't really have the authority like a CFO would, would have, or a chief business officer or something. So it's kind of like, yeah, you are at the, at the table, but you'd like at the kiddie table. Like, no, many, many, many organizations, they have a big table and then they have a table for the kids over there. That's what it looks like.

Please, here's what— here's one of the tricks. If you look at the organizational structure, right, the, the real C-level titles don't have like VP or SVP as part of the title. They're just C-level, you're executive. But most CISOs have— I'm a VP CISO.

Yes.

Now that's not 100%, you know, silver bullet. But if you look at a lot of organizations, that's the way they're structured. The C-level folks do not have a level. They don't need it.

Yeah, yeah. You know, that is so true because most CISOs I've had and CISOs I've reported to are usually director or senior director level. Yeah, that's, that's, that's their pay grade within the company.

And, and, and I'll give you another good tidbit because this is another one. When I hear, when I hear this, I always start laughing. And, you know, I try to be respectful of people, but, you know, some people, whatever. When the CISOs start talking about when they talk to the board You never talk to a board.

You've never been in front of a board.

You have provided updates in writing, yes, in an appendix of a PDF that gets to the board. You might go in front of the audit committee of a board, you might, but hardly ever have I ever seen a CISO— I mean, there are a few anomalies, but hardly have I seen a CISO actually go and physically present to a board in session. That's That, that's not the way it works in the real world. You provide your updates in writing, and if they read it, they read it. If they have questions, they reach out to you. And I can tell you undoubtedly, when you sit on a board, when you do sit on a board, you pick up on that very quickly because you realize, where's the CISO? Oh, they don't come.

Yes, yes, yes. Why, why not? Even especially for a publicly traded company, what, they're on 10,000K reports that they do have to produce, many times they don't even mention anything related to cybersecurity at all. And those have to be signed by the CFO and sometimes the CEO as well. So I guess I am seeing that trend a little bit where some C-level executive CISOs are becoming real CISOs. And I think Part of what is going to help us do that is really the value we add to the business, right? So I guess the question I have for you is, how should CISO position cybersecurity not just as a cost center, but really as a business enabler? I think that's really what's going to make the difference if we want our fellow C-level officers to take us seriously. So how do we do that?

Learn the business so that you can figure out where you can show the value-add. That's how you enable a business. You show value-add. And, and there's no one answer because it's so subjective to the business. But like, for instance, the example I gave earlier with the ISO certification or the SOC 2 report, that's a value-add that you can position yourself at a business level. Um, you know, other— like, for example, if you work for a company that makes a product and the product has to, let's say, enforce end-to-end encrypted communications. Well, you can inject yourself into that product stream and add value from a security perspective. All of a sudden now I am actually enabling the business by making this product better. But it's so subjective to the company where you work for. There's, there's no one answer, which is why, going back to— you got to be a student of the business. So that you figure out this is where I can add value.

Absolutely. Well, we are already running out of time. I could be talking to you for another hour or two. So let me ask you this. Based on your book, if someone only reads one chapter and let me— okay, this is going to be a two-part question. One, I want to focus about someone who aspires to become a CISO, and then the other side is someone who is already a CISO. I think The book you've written is good for people who are just getting started or want to start, but also for seasoned CISOs. I think they get a lot of value. So for, from, from, from both sides, they have to read one chapter and one chapter only. Which chapter would it be for the aspiring CISO and for a veteran CISO?

Chapter 2, Be a Student of the Business. I, I, hands down, the most important chapter. If Listen, if 90 days into a new gig as a CISO, you sit down with me and I, and I say to you, how does your company make money? And you can't answer that.

Yes, that is really powerful because I do speak quite, quite often now, 12 to 15 times every year, security summit all across the country. And one question I like to ask is, hey, what are the core values of your organization, CISOs and CIOs? Less than 5% Everywhere I go, they have no idea what their core values are. I think it has to do with— no, I'm not saying what it has to do with, what are they? Because everybody has flyers, they say what their core values are, but nobody knows. But usually anyone I find in those rooms that are in the military, whether it's in the Navy, the Air Force, it doesn't matter, they always, always know the core values of their organization. So I guess the emphasis you are putting on really learning the business, being a business leader, understanding your organization and how you make money, the mission and how it works and how you can add then value as a CISO. That's, that is really the key thing, isn't it?

100%. Everything else is incidental.

Wow.

Look, it's, I'll give you, I'll give you a perfect example, right? This is a real example. If I walk into an environment, and they spent the majority of their security budget on EDR solutions to protect the laptops of all the employees, right? And I look at the ecosystem when I come in, and I go, okay, but wait, The most, the most valuable thing in this company is this customer-facing database that stores PII. You didn't do anything to protect that, but yet you protected all of the laptops. You see where I'm going? Yeah, that tells me that whoever did that did not study the business enough to say this is more important than these laptops. Yes, I have to protect laptops. I'm not saying I have to, but I have to now balance things so that I add some protections here as well. That tells me that person was not a student of the business.

Wow, that— okay, uh, to end, actually, is there a question? Uh, we pretty much running out of time now. Is there a question I should have asked you I didn't get a chance to ask?

No, I thought we followed really well.

Okay, now another question I want to ask you based on your book is, okay, From Good to Great, what do you think differentiates good CISOs with great exceptional CISOs? What's the difference?

Finding that balance I spoke about earlier, and putting your ego aside, because if you lead with ego, or you come into a job with ego, it's not gonna, it's not gonna go well. And, you know, worse off, folks will just not respect you. You know, you have to lead from the front. And I'm just, you know, be humble and learn.

Powerful, powerful. Wow, I love that. Okay, uh, for the last segment, uh, I will just take a couple of minutes. Uh, I'm gonna ask you, what do you think is one of the greatest lessons you have ever learned in life, in leadership, just in general?

That resilience I spoke about earlier. Yes, you're gonna fall, you're gonna hit the floor, get up, get up, and get up with that confidence to keep going.

Yeah, like we talked about the man in the arena. You may get mad, you may fall, but get back up and try that again. That is very, very powerful. Okay. And what type of things are you learning now? I know leaders are learners. What are you learning these days?

Well, I'm running a business now, so it's learning 100% of the time. You know, it's not not a natural thing for me. This is my first role as a CEO. So certainly looking at the larger picture is a grand learning experience when you have to deal with sales, marketing, finance, and then tech and security and engineering and product. And so it's such a wonderful learning experience.

I very humbly hope I can, you know, perform in this role So basically, as a technologist today, you are going to be a student for life.

Oh, 100%, and I'm okay with that. I'm okay with it.

Yes, powerful. Now, uh, who are some of the thought leaders you listen to, or people you, uh, follow that you can recommend?

You know, I, I— there are a couple of leaders in the VC community that I appreciate because they've done this for a long time, and I think they, they add a lot of value. Um, and you can call me biased maybe because I know them, but like Alberto Yepes from ForgePoint and from BGV, I, I find them to be— I mean, forget about brilliant, they add so much value to me throughout my career that I would recommend what they write and listening to when they speak. Absolutely.

Thank you. Powerful. Now, in addition to your two books, is there one book you would recommend to my audience?

Oh, there are a lot of books. It would be tough because it depends on whether you're going to focus on business or—

okay, one, one business book and one security book.

You know, Gary, Gary Haislip's Desktop Reference, I think is fantastic. And Gary's a Brilliant dude, him, you know, him and the team that wrote that, they're, they're amazing.

Um, yeah, I have, I have invited him to, to be on the podcast. Hopefully we're gonna make something work out soon.

Yes. Oh yeah, Gary. Yeah, yeah, he's great, he's great. Um, oh, business, business book, that's a, that's a tough one. I'm gonna have to pass on that.

Yeah, that's fine. I think the, um, because Gary, I believe, and, uh, his team, they actually also have series of books for CISOs, which I think I highly recommend. I should add them to— we have a digital shelf for this podcast where I put all of the books people recommend. I definitely need to add those. Thank you for reminding me about that. Okay. And also, if you had one and only one day to live, what would you have liked your final contribution to be?

I would try to sit down with my 4 kids and share as much as I can with them to hopefully help them through their journeys.

Yes, powerful. And if you had a magic wand and you could solve any problem, what is one problem in the world you'd like to solve first thing tomorrow morning?

Global conflict. I, that's, you know, as much as some people see it as necessity, there's never anything good that comes out of that, in my opinion, whether you win or lose, you know, within what perspective you take. I, I think that, that, you know, true, inevitable in those scenarios.

Yeah, I think we, we need to talk more and fight less. If people got to know each other And yeah, thank you, thank you for sharing that. Okay, we've definitely run out of time, so it's the part of the show where I ask you, what can we do to add value back to you? Thanks so much for spending your time with us and being our master teacher today. How can we add value back to you, Andres?

You know, any feedback based on what, for instance, our company is doing right or wrong, I welcome from all the feedback because I think that's how we grow and learn. Um, beyond that, you know, introductions to potential customers. I mean, I run a business now, so that's important to me, you know.

Very good. And that's, uh, uh, you just have a blog, right? Andresandrew.tech?

Yep, Andresandrew.tech. And, uh, I, I write often enough.

Yes.

Fantastic. All right, thank you. Thank you so much for your time today. The last two questions I have for you is, if you could go back and give a piece of advice to your 17-year-old self, right, being an immigrant in this country but now standing at the edge of this incredible career you've had, what would you say to 17-year-old Andres?

Don't be afraid of the politics.

Wow.

Because, you know, throughout my career, in my early days, I steered clear of politics at any cost. I just didn't want any part of it. But I've come to realize that it's just part of, you know, corporate life, and you have to embrace it. And it doesn't have to always be confrontational. You have to just learn how to play that game and be comfortable in that game. I— it took me years to learn that.

Wow. All right. So we are going to finish, if it's okay. It's going to take probably a couple of minutes with a rapid-fire lightning round. I'm going to ask you a question. Don't take too long to think. Just give me the first thing that comes to your mind. We can?

All right.

So what is one word that defines great leadership?

Empathy.

I like that. Morning routine or practice that keeps you grounded?

I have a PT routine I do every morning.

Book or quote that changed your life?

I'd have to say a coach, and it was one of the VCs I mentioned earlier. Taught me a lot.

Wow. Who inspires you most today?

You.

Thank you. Okay, what is the leadership habit you refuse to compromise on? You will not compromise?

Leading from the front by example.

What is the question every leader should ask themselves frequently?

Does my team respect me?

So how do you earn respect? Because we usually talk about trust. I think respect is a little bit different. How do you earn respect?

By being transparent, being honest to a flaw, even if it's bad news. You got to be honest to a flaw. Being genuine. Uh, you know, I, I think, I think a lot of leaders get caught up in, you know, in the rat race of, of being a leader, and they stop being genuine. Still people. Doesn't matter what my title is and what yours is, we're still people.

Like, basically you're talking about humility and caring. Yeah, that is powerful. Wow, wow. Okay, um, what did you want to be when you were a kid?

A firefighter.

Well, I guess you are fighting fires in cyberspace now.

I guess so, yeah.

3 adjectives describing you as a child.

Ooh, daring, bold.

One more.

And creative.

What about as an adult?

I would say the same.

Very good. So you haven't changed, but very consistent. I like that. Okay, the last question. I do like to end on a positive note because sometimes we talk about some pretty heavy stuff here, but something you are feeling optimistic about right now, 2026, where we're going in terms of the use of technology.

I legitimately, as a positive, I think that we have to stay ahead of it. I think that we also have to keep reminding ourselves that none of this AI stuff, for example, was created automagically. It's still a human behind in the creation of that. This goes back to my concept of the mindset. Understand that human, and then you have a decent perspective of what's coming out on the tech stack.

I like that. So with AI, are you utopia or dystopia? Is it the end of the world, or is it going to be the panacea of human learning?

And I'm more on the positive side. I'm on the utopian side.

Yeah. Good. All right, uh, the final question I have then, uh, is, uh, one word that describes your experience on this podcast today? One word.

Engaging.

Well, thank you. Thank you so much, Andres. And I'm so, so grateful again. You're going to be speaking to my students Saturday next week live on Zoom. And for everything you do and also for giving so much back into the community, the industry. Are you working on your next book now by any chance?

Yeah, we just submitted it to the publisher. It's called The CISO Playbook: The Adversarial Mindset.

Adversarial mindset, that's something we didn't have time to get into. Whenever that's published, we definitely want you back here. We need to talk about that. Thanks so much for the time and for the wisdom and for teaching us today, Andres. Thank you so much.

Thanks for having me.

All right, everybody, this is one for the book. And again, I encourage everybody to get a copy of The CISO Playbook published by CRC Press Security Audit and Leadership Series. And as you've heard, it's been revealed here on the Leadership and Success Podcast podcast, a second book in the series is coming out. We definitely want Andrew back for that. And also get a copy of his first book, Pen Testing for Web Applications. So this is the last podcast for me today. I won't talk about Black History here because I did it in the previous podcast if you want to find out about it. But tomorrow I will have the great pleasure of speaking with Christopher Stitt, an organizational resilience architect crisis-tested leader and a strategist. We're going to be talking about Beyond the Pyramid. Leadership isn't about title, it's about impact. It's the best-selling book of Scaling Pyramids. And after him tomorrow, I will also be speaking to— no, actually, no, I'm not talking to her yet. I'm going to be talking to her on Sunday, but tomorrow I will be talking to Shana Futuros, relationship life coach, certified life coach. She's going to be here and you don't want to miss it. And then on Sunday, I'm going to be speaking to Dr. Rachel Nutz. She's a keynote speaker, Maxwell Certified Coach like me, a tech educator, and she really focuses on friction to flow. You don't want to miss this. So on Saturday, I won't have a guest, but I'm gonna go back to the Book of Proverbs. We're gonna be talking about ancient wisdom and leadership lesson. This is not a religious podcast, but it's about focusing on the leadership lesson from the Book of Proverbs written more than 2,000 years ago. We're going to be focusing on Proverbs chapter 22, but I'm going to be using artificial intelligence to give us the summary and the lessons learned there. If you want to watch the full hour-long podcast I did on January 22nd, it's available everywhere podcasts are. Okay, that's it for today. I hope to see you tomorrow when I speak to Christopher Stead. And thank you so much for watching. Please, in the Comment, let us know 3 to 5 key takeaways from today's podcast. Let's share the knowledge. And thanks again and see you tomorrow. Have a very good rest of your day. Bye for now.

Thank you for tuning in to the Leadership Success Podcast with your host, Coach BZ. If today's episode added value to your leadership journey, be sure to subscribe, share, and join us again for more wisdom that on how to lead better and achieve greater success. Remember, leadership is the most critical skill of our time. The world will always need leaders to inspire others, drive innovation, and execute meaningful strategy. So why not count yourself among the bold leaders shaping the 21st century? Until next time, stay inspired, stay committed, and keep leading with excellence.