Season 2, Episode 01: Live with Keyaan Williams

Welcome to the Leadership and Success Podcast with your host, Coach BZ. If you need to develop into a better leader, this podcast is for you. If you want to achieve a greater level of success, this podcast is for you. His mentor, Dr. John C. Maxwell, said it best: everything rises and falls on leadership. We hope to inspire you today and provide you with an insight that has the potential to positively impact the trajectory of your life. Welcome to the Leadership and Success Podcast.

All right, everybody, I am very, very excited today. It's 2022. Can you believe this? So happy New Year to everyone, and I hope you had a great holiday. And to start this new season, season 2 of the Leadership and Success Podcast, I couldn't have a better guest. It's one of my coaches, my mentor, And also my friend, his name is Keon Williams. Everybody knows him, he's a superman, great, great guy. He has so many talents, he does so many things, sometimes I wonder if he even has time to sleep. How are you doing today, Keon?

I'm doing well, Bizzy, it's good to be here with you.

Absolutely, and just to get started, can you kind of tell us about your leadership journey, how you got to become the Keon Williams everybody loves so much?

Um, you know, if I'm being honest, my goal is not to turn this into a sermon, but I give all the glory to God for the way that things have come together. You know, I graduated from high school, I went to college, I partied my scholarship away, and then I ended up in the Army. And that's not really a plan that people have when they graduate from school, but it is probably one of the most significant blessings in my life. Because the Army was really where I started to learn how to lead. You know, being in the Army and being a noncommissioned officer is a really interesting experience because my goal as a sergeant is to equip the people who are in the command leadership position to be as successful as possible. And I get none of the credit. And so as the sergeant, if everything goes right, the captain, the major, the commander gets all the credit for a job well done. If things go wrong, it's all my fault., and I get thrown under the bus. And the cool thing about that experience is it teaches a significant amount of humility because now it's not about me. It's about helping the unit accomplish the mission that they set out to do. And because my military specialty was chemical weapons, our mission was to save people's lives and clean them up so that they could keep fighting the fight that they were meant to fight, I guess, is the best way to describe it without giving away trade secrets for the US Army Chemical Corps.

Wow.

And so, um, after that, because of my military background, you know, there were all kinds of doors that were opened simply because I served. And those doors kept leading from one great thing to another great thing to another great thing. And along the way, nothing was just out of what I did individually, but it was because other people took an interest in my success, gave me good advice, pointed me in the right direction.. And all I had to do was listen and apply and execute what I learned from other great people. And it allows me all these years later to be able to run a company, to be able to influence others, to contribute to the success of others and get paid for it. Because I get paid a lot more as a consultant than I did as a, you know, a member of the US government when I worked as a federal employee. And I definitely make a lot more than I did as a sergeant in the Army.

Yes, and talking about that, for a time you really worked at the CDC, right? And especially since this pandemic started, everybody has been talking about them. Can you tell us a little bit about your experience there?

Yeah, the CDC was a cool experience. You know, before— for the last couple of years, the CDC has been an interesting organization. What I think people don't recognize about the US government is every time the presidential administration changes, all of the people in leadership across the federal government change because the new leader gets to pick their people. And it's not a bad thing per se, but what it is, is it's very disruptive. And so if you go back to my military career, I served under Democratic presidents, I served under Republican presidents, but in the military, the mission is the mission. The Army does what they do, the Navy does what they do. There's not significant change there might be significant differences in priorities, but the mission of the Chemical Corps has been the same for decades since World War II. We're not changing what we do. In a civilian situation, you're going to have changes because of political winds shifting, because of differences in perspectives. And so it was extremely disruptive. And so since this is a leadership podcast, you know, that was another good opportunity to exercise humility, to exercise patience, to focus on why am I really here and what value am I delivering to the organization? And that has just carried on. I think the coolest thing I did at the CDC was I was the security person behind the PEPFAR program, which as of today, the President's Eradication of AIDS Globally program— PEPFAR is the acronym. I can't remember the exact word, but they've spent $70-something billion to eradicate AIDS globally.

Wow.

And that is a lot of money to spend on a global initiative, but it also required significant logistics, human capital resources, information technology. There was a lot of data that was moving around when you talk about de-identifiable patient information and all of the information related to the AIDS epidemic. I had the pleasure and the benefit of being the security person behind the scenes making sure that we provided confidentiality, integrity, and availability for something that we spent a lot of money on. And so that was a cool experience, among other things. And it gives a lot of perspective. You talk about doing something with a big budget.

Yes.

$74 billion has a lot of commas, but that budget didn't go directly to security. You had to find ways to integrate security into the real mission, which was to do research, to learn all that you could learn, about a disease that was causing harm to everybody globally, regardless of their race or their creed or their country of origin, and eradicate that. And so it was a cool opportunity to see how you position a very important activity into an organization and integrate security into the business without cybersecurity being the priority.

That is extremely important. If there's anything I've really learned from you, That's it, man. I've taken probably 3 or 4 of your Cybersecurity Executive Masterclasses, and every time I take it, I always learn something new. But I think probably one of the most important things, especially coming from the government military background, is doing security in such a way that you are fully aligned to the business strategic objective of the organization. Can you tell us more about this? I'm especially thinking about people listening to us now who might be cybersecurity professionals or just getting started. And they just want to be technical, technical, they just want to learn about the technology, but don't care very much about the business. Can you enlighten us?

Yeah, the cool thing about cybersecurity that helps people to be extremely successful is understanding how you contribute to that success. What I have observed in my experience, so this is not exclusive, I don't know everybody in the world. But most cybersecurity people started out as IT professionals, They have strong technical backgrounds. They know technology very well. They could explain technology to a 5th grader, but they can't explain why the technology matters or how it contributes to the business. And so, one of the great outcomes that I had at the CDC, there was this non-technical business executive named Ken Williams. No relation, just happened to have the same last name. But what Ken had me do was he said, "Keon, every time you need to give a presentation, I want you to run it by me first so you don't sound like an idiot. Now, that's not what he said, but that's what he meant. And for the first couple of iterations, every time I brought him something, he said, "This looks like it's very technically sound. Looks like you know what you're talking about. I have no idea what it means." And through that experience, it gave me a very good opportunity to think about the audience that received the message and make them the priority rather than thinking about my perspective as the communicator of the message. Message. Because if the people who receive the message have no idea what I'm talking about, it serves no purpose and has no value. And so part of what I've been trying to do with the Cyber Executive Masterclass is to get people who have spent 5 or 10 or 20 years in security leadership to shift their thinking and transform their approach so that they are presenting information to the business that's relevant to the business, that helps the business understand how security is going to add value and helps everybody accomplish the meaningful goal, where the goal ultimately is to reduce risk so you can do what you're going to do.

Yes.

In my business classes, you know, the thing that we talked about in business school, because I do have an MBA, was all— it's always a widget. You're producing widgets. How do you produce widgets? How many widgets are you producing? But if you apply that to a security conversation, what it really boils down to is, to what extent do you understand the entire widget manufacturing process. You know, does your company mine the ore or do they use a third party to mine the ore so that the ore is smelted so that it's boiled down to something that's purified and then put into a machine and then stamped out and then you end up with a widget? Most security people couldn't describe that process if they were the CISO at a widget manufacturing company. You know, the same thing applies to healthcare. I worked at the CDC and had I stayed at the organization, I would have gotten a master's in public health so that I could have the same perspective as the people that were doing public health science and epidemiological surveillance and all the things that people at the CDC do.

Yes.

I had a desire to understand their work as much as possible so that when I talked to them about the context of security related to their work, it's like, hey, this guy gets me. He understands me. Now we can remove barriers and have a real conversation about what needs to be be done. And it's one of the things that I try to encourage people to do in the Cyber Executive Masterclass or in any other session where I'm teaching security people so that they can communicate effectively, effectively with their business counterparts.

Well, that is so great. And for everybody else who's live online right now, please let us know where you are joining us from, what city, what state. And for some of my mentees who might be on the call, What would you advise to somebody who's really trying to get into this cybersecurity field, right? It looks like cybersecurity is really expanding right now and everybody wants to get into it, but there seems to be so many barriers of entry. It seems like more today than there was when I first got in back in, what, 2005, 2004? What is your best advice for brand new beginners?

Well, I have a factual statement and then I have advice to address that fact. So the factual statement is that when you look at hiring for cybersecurity, most people don't know what they're talking about, or they don't know what they're looking for. And that's not disparaging in any way to HR professionals. But if you look at most companies across the board, most companies that are hiring security people have a person in charge of security. And that person has less than 10 people working for them to perform a business function that has about 50 moving parts simultaneously.

Yes.

And so the security executive in the organization, having limited resources, looking for somebody else to help them, offloads the process of finding the most qualified candidates to an HR person who doesn't really have a security background. Now, I'm generalizing, this is what happens in most cases. I know there's some really great security companies and search companies that do a better job. But in general terms, Somebody who knows nothing about security has the mission of finding a qualified candidate to fill a gap that is significant within an organization where they don't have enough people doing the job that needs to be done. And in that situation, from a human behavior perspective, people have a tendency to boil it down to a checklist. And so the number one item on the checklist, if you're trying to break into security, is you need to have a CISSP. Now, no disrespect to ISC², they're a great organization. They have produced great training materials, but it requires 3 to 5 years of experience to qualify to take one of the most difficult tests that exists because the CISSP covers 8 domains that no regular person is a master of. You know, I teach CISSP, but I only teach one module because I'm an expert in governance and I need 7 other people who are experts in 7 other areas to competently teach the other parts of the exam.. But that is the exam that they use to measure the capability of an individual. And so I might take the test, I passed the test, you know, I got a passing score. But I need to be hired as an identity management person. But I had to do all this studying about governance, or I had to do all this studying about encryption and encryption processes, and things that were required for the test that don't reflect the work that I'm doing in the real world.

Correct.

And you compare that to the alternative where you have great cloud certifications from AWS and Google, which make a lot of sense for people who are doing cloud security, or you have great infrastructure certifications for specific functions. But because the HR profession, who doesn't have a strong background in cybersecurity, is trying to hire people, they have set the CISSP as the high watermark without considering that there are a number of valid certifications that represent the work that people are actually doing. And then on top of that, a lot of HR people don't have enough wisdom to properly define the work that needs to be done. Now, you imagine that you see a job requisition that says, I want an entry-level candidate with 15 years of experience in a technology that has only been around for 3 years.

Yes.

For somebody who is new to the profession, they can't even argue against that. They just say, oh, well, I'm not qualified because they want 15 years of experience. I've never heard of this technology. Yes, I can't do this, that, or the other thing. There's an alphabet soup of requirements. And what it does is it exacerbates the skills gap, because we're not properly aligning the real work that people are doing with the qualifications that are necessary, on top of the willingness of the organization to invest. Time and energy to develop talent and be willing to bring on entry-level people and allow them to grow into the role that they need. And so now we're looking for entry-level experts who we don't want to pay for their expertise. And now you have a bunch of people that can't get a job. And so if I were king of the world for a day, the approach that I would take instead is I would take some of the best people that I've had supporting security programs that I've run in the past. You know, we had a technical writer who was an excellent communicator. And so every time we wrote policies, the technical writer reviewed the policies to make sure that, hey, people who don't speak cybersecurity understand the cybersecurity policy that describes the requirements that they have. Or I've seen really good marketing people provide great support to the security program because marketing people are adept at connecting with people's thoughts and their feelings and their emotions and driving an action. Based on their feelings rather than overwhelming them with facts and statistics and technical mumbo jumbo that makes up the language of cybersecurity. And so thinking outside the box and encouraging people with humanities backgrounds adds a lot of value because it's really only 50% of cybersecurity that's technical. The other 50% is human behavior and policy and governance and oversight and understanding risk and responding to risk properly. And so for your mentees, for people who are listening, for people who are even just considering this from a leadership perspective, evaluating the entire picture and thinking about how everything works together is going to allow organizations to develop teams that are multidimensional and multifaceted and are going to produce the best value because of the diversity of background and experience of the people.

Yes.

Rather than having 10 people who all know how to do reverse malware analysis, but nobody can write a piece of paper that says, "Hey, how does this work and why do you care?" Yeah, and you mentioned the word diversity.

I think diversity definitely matters. I believe you agree with me. When I first got into this field, I remember pretty much 90+ percent of everybody was a white male, kind of like middle-aged white male. I didn't see anybody that looked like me. Almost always I was be one and only minority in the room. That's, that's changing a little bit. And I'm seeing more and more women, which is, which is great. But I feel like as a, as a whole, cybersecurity needs to definitely be more diverse. Do you have any ideas about that?

I am probably the wrong person to have a conversation about diversity in the United States, simply because my perspective is uncommon. You know, personally, I was born in Italy. I grew up in Panama. My father was an officer in the Army. And so what I looked like on the outside had no bearing on any decision that anybody made about me. The only things that mattered were, am I behaving the way that an officer's son should behave? And am I meeting the standard that was set by my parents, by my school, by the activities that I was engaged in? If I'm being completely honest and transparent with you, I didn't know I was Black until I moved to Georgia and started going to high school. Because up throughout my life, in all of those situations, it didn't matter. You know, when I lived in Panama, I was American. You know, in my business life, when I've gone to Johannesburg or Botswana or other places, I'm not Black, I'm American. Or there have been situations where I'm the only minority in the entire country of Singapore that I've seen for an entire week. But they care about the value that I bring and the expertise that I am contributing to the exercise more than they care about what I look like on the outside. So those experiences for me personally have made me biased towards cognitive diversity, where you look at the way that people think and feel and act and how the differences in the way that people think, feel, and act when you combine them together allows the activity or the group or the project— or the organization to have multiple perspectives that then are beneficial for a variety of people to think, feel, and act differently. Because there have been numerous situations documented over the last couple of years where you have people who all look different on the outside, but they all think the same. Now, if we were comparing racial diversity to cognitive diversity, the cognitive diversity is going to produce better results.

Yes.

And the racial diversity doesn't really matter because everybody thinks the same way., or they have the same emotional response to a trigger or to a situation. And if we all look different but think the same way, how do we adjust and consider what other people are thinking or how they're going to respond to the same thing? It would be like having 50 Democrats. It would be like having 50 California Democrats because a Democrat in California statistically has a different perspective than a Democrat from Delaware.

Just as random examples.

But if, if you take 50 people who will— who are affiliated with the Democratic Party and they're all in San Francisco, because of the environment, because of the things that they encounter, because of shared beliefs, they're all going to have the same perspective about a situation. But then you start adding people from North Dakota, which not everybody has been to, or you take somebody from Puerto Rico, and then you take somebody from the Ukraine, and then you take somebody from Canada, they're all going to have a different perspective that adds flavor to the recipe rather than having 10 pounds of flour and no other seasoning. You know, if you put it in cooking instead of focusing on political parties, if I had a cake and I only had flour, it'd be a horrible cake. I need eggs, I need butter, I need cinnamon, I need vanilla, I need sugar, I need a variety of things to come together to produce something that is appealing to everybody who experiences it, rather than the same bland ingredient in varying amounts, is going to produce two completely different outcomes.

Well, I really like what you talked about. Cognitive diversity is definitely critical. Now, if some of the people watching us now, some of them are hiring managers, right? In my experience, people tend to hire people that look or sound or think or feel and act like them, right? Kind of a similar background. What would you advise a hiring manager, especially in cybersecurity, to really seek out those, those people who think, feel, and act differently?

Well, I think there are two approaches that you can take. One, my opinion is biased because I've done this program. But Chabatov has a great book called— that focuses on uncommon mindset. And so, you know, he grew up in Eastern Europe. There are some nuances in Europe related to pre- and post-communism and Russia and how all of that worked. But he, in his book, he probably has $10,000 worth of studies and analysis to talk about different approaches to achieving cognitive diversity. One of the books on my desk, I'm reading, I'm reading Think Again by Adam Grant. It really just requires that you do a little bit of research. You have some understanding about how people think, and then you use tools that are avoiding biases to identify the best candidates. You know, I did a podcast a couple of years ago and I said, if I were to hire somebody, the best way to hire them is to have them use the voice modulator so they sound like they're doing ransom demands. So I can't tell whether it's a male or a female. I don't know the person's name. 100% of the evaluation is based on their ability to perform a task that is required within my organization. And then I just pick the best candidate from that pool of people where I don't know the gender, the background, the location, the accent, or anything else. And they're just willing to do the work that I have available at the price that I'm willing to pay in the format that we're planning to do it. It's the best way to find the best candidate. Then if you have 50 people in the organization who happen to be of one gender or race or creed or color or nationality, that is a random outcome because of the way that we perform the evaluation of all of the candidates. And it probably increases the likelihood that even though everybody looks the same, you have a lot of diversity in the mindset and the thinking of the individual. Now, if you don't have time to do all of that, um, Daedra Diamond has a great program for cybersecurity people that they remove all those biases. They have a platform, it sets people up so that they can contribute their answers to capabilities and questions and performance measurements. And then the employer can pick at random who is the best, most qualified person without knowing anything about them. And it allows them to hire the best candidate regardless of physical or national or relational or religious or any other attribute. And it helps overcome the tendency that people have where socially and psychologically, we tend to want to work and hang out with people who think like us and act like us and have our same beliefs. But that doesn't always produce the best business outcome because you need people who think and feel and act differently. So that you can find what is the common ground amongst all those different people to produce the outcome that you're looking for.

Well, very, very well said. I have so much I want to talk to you about. It's almost like, you know, a kid being in a candy store during Christmas time. You have so much knowledge and wisdom, and I definitely, you know, I've been able to enjoy and really take part of all of the knowledge you've brought to so many of your students. I could be talking about ransomware or Log4j vulnerability that happened last month. Actually, let's talk about that because everybody is talking about it. So it's 2022. What is your take on kind of how that vulnerability happened, how it was exploited, and more importantly, the response, right, from the cybersecurity community pretty much globally?

I think there is a huge opportunity for a strong leadership response related to Log4j that we should have had after SolarWinds about a year ago. And so we're having a conversation in January 2022 that is the same conversation about a different issue exactly a year later. So about this time last year, I had the opportunity to give a presentation to one of the chapters for the Society of Information Management. Which is a great organization. Most of their members are CEOs or CIOs, but it's all we have to do is substitute SolarWinds for Log4j, and I could regurgitate the exact same presentation that I gave last year. I think the issue when you really look at it is how are you doing vulnerability management in your organization combined with supply chain management? Because a significant number of technology solutions that organizations use leverage open-source software and open-source components. And so there is a solution to that problem. The question is, how effectively do you implement it? You know, if you look at the National Institute of Standards and Technology, they have a control catalog with hundreds and hundreds of controls organized into 18 control families. But one of the controls deep in the minutia of that catalog— and it probably exists in ISO. I've seen it in other security standards, but it's just flaw remediation. If I had— if I'm in a leadership position and I'm leading the security function to the best of my ability, one of the things that we're going to evaluate and have a plan for is how do we respond when a critical vendor or supplier of services has a security problem that we have no control over? But we're affected by. You could address that through your contract management process. You know, in some of the contracts that I write for my customers, I say, hey, we need to have a process for flaw remediation and for vendor incident response so that if my vendor is the root cause of the incident, I'm not activating my incident response team per se because I can only do so much. But we're having the vendor provide resources and solutions to help us solve the problem. You know, that would have worked for SolarWinds, that would work for Log4j, that will work for almost anything that you encounter. But it requires some foresight and strategic planning in advance so you can think about, hey, what is the worst that could happen if I am acquiring goods and services from third parties? I had no control over their development process. I know that people are going to throw things out there to get them in the marketplace. And then they'll patch and fix them later. Under those circumstances, what is the best approach for me to reduce the risk that my organization is exposed to? The answer to that question now covers every type or category of security incident we could ever deal with that's caused by vendors. And then the answer is going to be customized based on different organizations. The government has a lot of power to control that. Because the way that DFARS and the Federal Acquisition Regulation work, you force people to meet requirements because they're making sales at a level where it's hundreds of millions of dollars in some cases. Or if you take, uh, Microsoft and Google and their fight over the DOD contract, we're talking about billions or trillions of dollars. At that level of purchasing, the government can say you are gonna provide some level of assurance that you did security engineering, that you have a flaw remediation plan, that you can support incident response. But at the same time, there's no reason that consumer organizations can't do the same thing. Because if every consumer organization that purchased goods and services had similar requirements, the providers of those goods and services would provide more secure and more resilient systems, which reduces everybody's risk overall.

Absolutely. So I'm going to change lens a little bit. We have so much in common, you and I. And one thing, even when you started, you really started by giving praise to God for everything you've gone through and where you are in life now. So being a man of faith and a family man, how do you kind of integrate your faith with your business and profession and career?

Well, so my marketing manager has completely revised my website, so I don't know what's on there right now. But if we look at the 2021 website, You know, one of the things that I thought was important was declaring my faith publicly so that people know who they're working with. You know, people know in advance that I'm a man of faith and I govern my actions and my decisions based on what I believe to be true in the Bible. Well, then it influences people's expectations of me. You know, if I say we're going to apply the fruits of the Spirit to everything that we do, and I'm going to be patient, and I'm going to be humble, and I'm even in some cases going to be long-suffering, because not all my customers paid me on time. Well, then you know what to expect from me. You know what kind of behavior I'm supposed to exhibit. You know if I'm in or out of character. You know, some of the outcomes of that are that I don't drink alcohol because I work in ministry at my church. And it's not that the Bible says you can't drink, but as a leader, I have the obligation to set an example because I might be able to drink a beer and not have a problem. But if one of my congregants says, oh, hey, look, Keon's drinking a beer, so I'm going to have 10. And then he gets into an accident because of my example, I haven't set people up for success. And so using my faith background to guide my behavior and the way that I interact with people and the way that I treat people influences outcomes from a business perspective, from a personal perspective. And in all cases, I'm at least consistent. People know what they're getting when they're hanging out with me regardless of the situation. They know that I'm always going to be the designated driver. If you ever see me drunk in a ditch, I've been drugged, please call the police and help me because I'm just, I'm not a drinker. And I don't hold it against other people. It's just the things that I choose to govern my life influence the behavior that you see from me, whether it's business or personal or anything else.

Yeah, you've definitely been a great role model to me. And one thing I must also say, right, we talked about leadership and success on this podcast. And Success is great, and I want people to be more successful, but what I have realized over and over again is whatever physical achievement you are going after, right, it's really exciting as you're on the journey to achieve whatever it is you want. If it's an MBA, a new car, a million-dollar home, or whatever your goals might be, but almost always once you achieve that, then that happiness, that joy just dissipates. So I really feel like in life if you're really going to be successful, there are things that are much more important than just, you know, money, wealth, or any of these things that we weren't born with and that we're gonna have to leave behind anyway, because one day everybody is going to die. So I feel like you— there is really a sense, a purpose in life, and in my opinion, it's really to make a big difference in your community and in the lives of other people. So it goes beyond yourself. One of my mentors, Dr. John Maxwell, who is one of your Mentors too, because you are a certified GMT member, we always talk about the difference between being successful and then pretty much achieving— which word did he use? Significance, right? Going from success to significance, where it's not just about me, myself, and I, but it's about what you're doing for other people around you, for your community. But let's talk about that a little bit. We're already running out of time, I can't believe it. We're just getting started here. But tell me about your GMT journey. How did you get to be involved with the John Maxwell team and get certified as a speaker, coach, and trainer?

So I've been doing executive coaching for years. I used to do Toastmasters because once upon a time, I was terrified of public speaking. And it did not contribute to my success as a security executive. Because one of the things that you'll find when you're a CISO is that you never know when people are going to call you to the front of the room to explain something to an entire audience. And so it just wasn't constructive for me to have stage fright and to be afraid of public speaking. And one of the people in my Toastmasters club said, you know, if you really want to take this to the next level and be a good leader, I had a great experience with John Maxwell. They're having a sale. It turns out later that I didn't know at the time, but he was a John Maxwell team member as well. So I got a referral. From somebody who had been through the program, who was applying it to their work, who had realized significant success. And then they were just encouraging me to have the same opportunities. The great thing about John Maxwell is it helps me kind of refine and reevaluate what I thought about success and what I thought about leadership and how it works. And so even though my goal and my aspiration is not to be a paid public speaker, I still integrate the coaching into the work that I do. I use it with my team members. For my executive team, if we hit our revenue goals, I'm taking all of the leaders within my company to the John Maxwell Experience in the fall so that at least everybody understands where I'm coming from. We all have similar perspectives about why I do things the way that I do them. And hopefully, it'll be a blessing to them as well. Because the entire program and what John does and what he promotes has been a blessing to me. So much so that I have about 10 of his books on the shelf. And Developing the Leader Within You, the 2.0 version, there's a lot of great content that I've shared with other people just talking about how do you influence and who do you influence and when and where and why. All of that relates to my interest in organizational behavior and what drives people to do what they do, because ultimately that influences security much more than any technical failure because people are the root cause of whether things go right or wrong. And sometimes it's the people on the IT side that are doing the controls because they were lazy lima beans or they were tired or they overlooked something or they had mad, bad motivations. But there's also human curiosity. You have people with great intentions that want to do the right thing, but if you send them the right formatted phishing message enough times, Eventually, they have just got to click that link to see what's on the other side. So understanding how people work and how to encourage them and how to change their mindset and get them to focus on overcoming some of those natural urges and desires, I've always found very interesting. And my participation with John Maxwell has given me the opportunity to kind of shape and form and direct it in a way that's constructive and useful and repeatable.

Wow, that is just amazing. And also, just for people listening right now, most people do not know that, but John Maxwell actually used to be a minister. He actually still is a minister, and he told us that everything he's ever learned about leadership, he took it straight out of the Bible. Everything. It is pretty amazing, and most people do not know that. So now it's the favorite portion of the podcast. We only have about 20 minutes left. Maybe I can get an extra 5 or 10 minutes from you if you can. But, uh, those 7 questions, favorite 7 questions I have to ask every, every guest. And almost all of these questions come from Papa John too. But number 1 is, uh, what is the greatest lesson you have learned? What is the secret of your success?

Um, I'll give you the greatest lesson that I've learned that other people can learn from also. So So I'm a huge fan of Dr. Martin Luther King Jr., among other people. But one of his favorite things that he said that I continue to quote in other places is that the ultimate measure of a man is not where he stands in moments of comfort and convenience, but where he stands in times of challenge and controversy. And so in my profession, there's always something controversial, or there's always some kind of challenge. And it always helps me to reflect about, you know, who am I? Really at the end of the day when nobody's looking, and how can I use that to turn this difficult situation into something that's going to be valuable or successful, or just let me reduce risk just a little bit so that fewer people are impacted. And that has been a good mode of operation in business. It was extremely important in the Army because what I did in the Army influenced whether or not people lived or died.

Yes. Wow, that is fantastic. So what, what do you think is the greatest leadership advice you have ever received?

The greatest advice, I still have to give credit to Mr. Kim Williams. Just focusing on the recipient of the information is probably the best thing that I've ever done. Because it changes the way that I structure and format things. I continue to fail to do that with my wife, but with everybody else, I have gotten pretty good at understanding where are they coming from? What are their concerns? What is important to them? And even if the information is the same, framing the conversation in a way that resonates with the audience and the recipient is the best thing that I learned from hanging out with Kim. And it has allowed me to be extremely successful in a lot of places.

Well, well said. So question number 2, what are you learning now?

Right now I am studying human and organizational behavior. So the books on my desk right now, because they're right in front of me, Predictably Irrational by Dan O'Reilly, Think Again by Adam Grant. And then Chaba, I had already read Uncommon Mindset, but Chaba recommended another book to me. So I have another psychological book that's coming in the mail. That I plan to read next week.

Wow, that is fantastic. What really gets me is so many people who are just getting started in cybersecurity, they really think it's all about technology. But like you said earlier, it's really 50% tech and 50% everything else. So we really need to have people who have a different mindset, a different way of thinking, feeling, and acting to really join this growing industry, right? And For number 3, how has failure shaped your life?

Oh my goodness, I fail all the time. It's really interesting. And so I, you know, I'm doing a lot of reading on psychology now. But in years past, I spent a lot of time reading about entrepreneurship. And the cool thing about failure is not that failure is awesome. But it's that there's always a lesson in the failure. I mean, you know, I would argue that my business is successful. You know, we'll hit the 6-year anniversary of this business in July. But over the past 5 years, I probably failed more than I've succeeded. But every one of those failures helps me refine what am I doing and why am I doing it. And is this thing that I'm doing the right thing to serve my customers and to benefit myself and the people around me and the communities that I'm interested in? The challenge with failure is not taking it personally because my identity is not in what I do. It's just what I do. But using that failure to identify, hey, what did I think wrong? Or what did I plan wrong? Was the issue with my execution? You know, getting to the point where you don't take it personally and it's not about you and you evaluate the situation holistically has been a great learning opportunity that I couldn't have gotten anywhere else.

Thank you so much for sharing that, because I think most people, when they look at successful people like yourself, they feel like you kind of walk on water, you never have a bad day. But the truth is, people who are extremely successful usually have a lot more failure than success, and that's how they become successful. So for question number 4, who do you know that we should know? Who are some of your mentors, thought leaders, people you are following that we should know about?

It's gonna sound interesting, but Katherine Marshall is one of my favorite people right now. Katherine doesn't do anything related to security, but she was a fitness expert for years. She started a program called Simple Fat Burn. So hanging out with her, I was able to lose 40 pounds, which transformed my life physically. You know, when I was younger, I played football, I was in the Army, I did kickboxing when I got out of the Army. When I stopped working out, I started expanding. And so you talk about walking on water, I just float. I'm really— I used to be really buoyant. And I'm trying to reduce it. But hanging out with Catherine has been a huge blessing because she is a non-technical business executive who's been very successful. She's helped numerous people grow their income to 7 figures. And I learned so much about marketing and communication from hanging out with her. That I've been able to incorporate into my business so that I combine the things that I already knew with the things that I've learned from her. And it has produced great results and has helped me refine even more, you know, my conference, my training, my consulting, and all kinds of other things.

Well, we definitely need to get your LinkedIn profile and have our people follow her because it's quite amazing the impact she's had, or Already. Now, as part of question for the, uh, second portion of that is, if you could choose 3 people to have dinner with, who would you choose and why? And they don't have to be alive, it could be historical figure, that is fine too, or even science fiction.

Well, science fiction opens it up and makes it really interesting. Um, if I could have dinner with 3 people, it would be Red Fox Eddie Murphy and Steve Harvey. And so I pick all three of them intentionally because they're comics. Um, I am in school for stand-up comedy, and so comedy is on my mind. I have a homework assignment to work on comedy every day for the next 30 days. I will do a live stand-up act on February 7th But the interesting thing about all three of them is that they were all successful over more than a decade. You know, Red Fox was doing comedy for maybe 30 years that I know of, and he's since passed away. But at the time that he was doing it, Black comics weren't really the thing going in the United States. And nevertheless, he was extremely successful. You know, the other comics like Eddie Murphy is interesting because you think about his— I think his most successful stand-up comedy act was Eddie Murphy Raw, and my sensibilities are too delicate to, uh, listen to it today. But then looking at the way that he transformed his delivery and his approach and his content and what inspired that, I find very interesting. I believe it was because of his children. I don't know for sure, I've never had a conversation with the man, but I think it's really interesting how somebody reinvents and transforms themselves after they've been successful compared to trying to reinvent yourself to be successful. He had already made it and still changed course and continues to be successful and do some really interesting things. So I think that has good business application, and it's also interesting from a comedic standpoint as well.

And what about Steve Harvey?

Steve Harvey is an interesting person. I don't know him personally, but he is acquainted with people that I know very well, and he's another interesting situation. Where his comedy has transformed over the years, but he is sought after. He shows up all over the place. He's hosting all kinds of events. You know, his, uh, life story, if you're to read his biography, is extremely interesting. And it is another interesting case in which, you know, somebody overcame a lot of adversity, is at the top of their game, has overcome the plateau effect, and is still advancing and transforming and is in high demand. I think those are 3 really interesting people from a comedy perspective, but also are 3 interesting people from a business. And how do you respond to and deal with the success that you've achieved?

Yes, and another thing I've learned from Steve Harvey is to never, never quit, right? I don't know how many times this guy has had so many events that for most people would have just, you know, paralyzed them and they would be out. But he keeps coming back and coming back. Like, was it like 3, 4 years ago you had more than $20, $25 million to the IRS, and within a year he was able to fix it and keep going. It is quite amazing, the resilience some of these people have developed. So for question number 5, what have you read that we should read? What are some of the best books you've read recently?

Well, I challenge everybody to read the Bible from COVID to cover every year. I strive to read the entire thing. Some years I make it, some years I don't. But there are all kinds of interesting things about the way that the world works and human behavior and interaction. I really, really like some of the psychology books that I mentioned. Again, Predictable— Predictably Irrational is fascinating from what I've read. I'm a huge fan of Think Again. The best book that I've read in the last 10 years or so, I would definitely add Outliers to the list by Malcolm Gladwell, Developing the Leader Within You 2.0 from John Maxwell, Boundaries from Dr. Henry Cloud, Linchpin from Seth Godin. Finance and Accounting for Non-Financial Managers was extremely valuable in the work that I do. Because if you're a, if you're a leader, You need to budget, you need to justify spending. And it was a great way to take very complex concepts and put them in terms that I could understand so that then I could build a budget. I can do profit and loss statements. I can do financial statements. I could read balance sheets. There are a lot of things that I can do financially as a combination of that book and what the, the grinder that they put me through in my MBA program. I would add Calculated Risks to the list. It's a medical book that talks about risk and statistics, but it's really interesting because it has some really good examples about what people say versus what they mean. You know, there could be a risk that they say, you know, you have a 150% chance of being better, but 150% of something that's less than 1% still isn't a lot. So people throw statistics around in medical situations. And so that's relevant for COVID, but they throw it around for other things. And when people start to understand how you communicate medical risk in an effective way, it transforms the way that you talk about business risk and the impact that it has on activities. Uh, Storytelling with Data was really good. And then A More Beautiful Question is a great book because you learn a lot by asking questions to people and being open to the answer that they provide. Without filtering their answer with your judgments. And so those are all great books. You might tell that I read a lot, but those are good books. And I, um, I definitely would have them all on the list.

Well, that is fascinating. I'm going to be adding links to all of those books in the comments. But definitely, uh, something that if you want to be a leader, I don't really see a way around that. You have to, to read, right? You, you've got to know what is out there. So for, uh, number 6, what have you done that we should do? What is one action you have taken that has positively impacted your life?

Um, I think regardless of your faith background, even if you have no faith whatsoever, it is— it has been extremely valuable for me to get up an hour earlier in the morning. For me personally, I read the Bible. I have a devotion that I read through. I listen to meditation music. I just sit down and think. But all of those things kind of prepare you for the day, you know, taking time to read other people's thoughts. And right now my thoughts are Leviticus, which is extremely boring, and Genesis and Matthew. But just, you know, reading the word and meditating and not thinking about my work also helps me separate my identity as a person from the job that I do. And so my job could be completely horrible., but that has no bearing on the value of me as a person. And my ability to recognize that comes from having that separation, from spending the time in prayer and meditation and study. And I have been very even-keeled and peaceful in the years that I've been doing that. I wish I had started doing it earlier.

That is so, uh, critical in life, no? Like, kind of like I mentioned earlier, success is not just about, you know, achieving what, whatever is out there, the physical one. I think emotional health is extremely important, especially, you know, coming out of this pandemic. I think we realize it now, it's more important than ever. Can you tell us more about kind of like the criticality of really maintaining a great emotional wealth? Because I feel like even in Silicon Valley, things have changed drastically. What Silicon Valley was in 2020 and today in 2022 is definitely not It doesn't seem like the same society because back then, no, it was really a badge of honor to be working 16, 20 hours a day and just going after that money, and life was very, very fast. But now it seems that people want to spend more time with their family and also take care of their own emotional well-being. You want to tell us more about that?

Yeah, I think the moral of the story is that balance is important. You know, because I own the business and because of the obligation that I feel to serve not only my family, but my employees and their families. I honestly work 12 to 16 hours a day, Monday through Saturday. But I also set Sunday aside for worship. I try really hard not to do any work on Sunday unless I just have a thought and I have to write it down. But having that work-life balance, even in a 16-hour day, if I get up at 5 and study the Bible for an hour, and then I work, and then I exercise from 6 to 7, I still have from 7 to noon to get in 5 hours of work. And then I take an hour off for lunch. And then I have from 1 o'clock until whenever I stopped working to get things done. And the benefit of the pandemic is that I'm at home with my children. So I can have breakfast with my children. One of my daughters walks about 2 miles with me when it's not too cold in the morning. You know, I'm hanging out with the kids all throughout the day. It's not working nonstop in an office 50 miles away from home. It's working diligently for a purpose, but still having breaks and meditation and family time and other recreational activities mixed in that allows me to work that amount of hours for the last 5, almost 6 years in this company and, you know, achieve the amount of work that I did before. And if we apply it to a military context, you know, I was not a direct combat person, but I did combat support. So everything that the infantry can do, I can do, and I can do my other job, which is personal and equipment decontamination and biological surveillance and all the other things that the Chemical Corps does. But even in that situation, for people who are deployed, there's still a work-rest cycle. You know, you work hard all day, you know, you have your, um, you have your different missions and duties without getting too complicated from a military perspective. But you also have downtime. You know, we— I played a lot of football when I was in the Army, and we, you know, we did a lot of joking around and laughing. So even though the job was hard, we still found time to rest. We found time to recover. We found time to breathe so that when we're doing the hard work that needs to be done, we know that there's something waiting for us on the other side so that we could relax and recover and get ready to keep fighting. You can apply the same kind of principle to just the things that we're dealing with in our work and what's going on in the world today.

Well, well, well said. So it's 2022, January now, today the 5th. So most people have New Year's resolutions and they usually try to follow them for the next 3 weeks or so, and most of them kind of stop. But, but what is one, one thing, one action that you are thinking about taking in 2022? Or something that you, you think will positively impact your life going forward?

There are two things that I think, um, other people can emulate as well. I plan to read at least one book per month about a subject that I'm not an expert in, and so by the end of the year I will have read 12 psychology books. I know a lot about Vulcan mind meld and Jedi mind tricks and everything else, and then, um, What I found in studying other leaders is that exercise is very important. And so I think I have another 30 pounds that I'd like to lose by the end of the year. But if I lose 3/4 of a pound per week for 52 weeks, I can lose all the weight that I want to lose and still be healthy. But being in good health gives you a lot of energy, and it also gives you good resilience when we're dealing with viruses and diseases and other things. So if I'm healthier and smarter by the end of this calendar year, I will have accomplished my goals.

That is fantastic. So the last portion of this question is, if you had only one and only one day to live, what would you have like your final contribution to be?

I'd like to skydive from the edge of space. When the Red Bull guy did it a couple of years ago, I was like, that is totally awesome. Given what I know about fluid dynamics and the atmosphere, If you're going that high in a hot air balloon and you need stabilizers because there's not enough atmosphere to create drag so that you're not spinning out of control, that's one thing that I would do. And as I'm doing it, hopefully it will inspire other people to do something great and amazing with the last day that they have to live.

Well, thank you. Thank you so much for your time today. I really appreciate that. We're right at the top of the hour. So the last question I have for you is, how can we add value to you? What could we do to make a difference?

There's one thing that I think would be really constructive. I started a new program this year. It's called Ask Me Anything. And the goal is to answer any question that people have about any subject as long as it's ethical, legal, and moral. If I don't know the answer, I will find somebody who has the answer. But, you know, having worked in security education and certification training, the one of the greatest barriers to entry is just knowledge. And so I figure if I just give knowledge away, and I answer people's questions, and I set them up for success, then it's going to be a great contribution to the world. And I will benefit from that contribution. Because smarter people working in this profession and smarter people doing just other things is going to add a lot of value. Like, I'm never going to be a reverse malware analyst. I'm never going to be a technical security person. But if I can help the next generation of technical security people get into the profession because I was willing to spend 5 or 10 or 15 minutes to answer their question, I think that's a win and everybody benefits. If people want to engage, the, the easiest way is to send an email The email can go to— I gotta pull up the address because I don't have it memorized. The email can go to anything@class-llc.com. Um, I'll post some of the answers online. I'll reply to the person directly. Starting in February, once a month, I'll actually kind of walk through the items like, um, Johnny Carson used to do his top 10, and we'll just make sure that people are as well educated and informed as possible. And it's as simple as sending any email to anything@class-llc.com. The only criteria, it's got to be ethical, legal, and moral. You know, I'm not dealing with foolishness or debauchery. I'm not trying to help people drink or create chemical drugs. But if it's a professional question and I could give a good answer, I am more than happy to do so. And I have a team behind me who's helping me answer those questions as well.

Awesome. I have gone ahead and I have added the link anything@class-llc.com. And, uh, can you talk a little bit about your, uh, Cybersecurity Executive Masterclass? I think it's the best class I've ever had, especially when you buy into the class, you have the ability— and I think you are the only one in the world who does this— to take the class as many times as you, as you want. Like I said earlier, probably taken at least 3 or 4 versions of the class already, and I'm going to be taking class again in February, right? That's when your next cohort is, because now you've reduced it to exactly 8 weeks. And I am really excited about the new format and what you are doing.

Yeah, the course is cool. In the beginning, I focused exclusively on Certified CISO training from EC-Council because I wrote most of the book. So it'd be ridiculous not to promote something for which I wrote the book. Uh, I found that prioritizing the practical use of the concepts and helping people build real security programs added a lot of value. So over the last couple of years, I've moved away from focusing so much on the textbook. I mean, people still get the book, they still get the certification, but walking people through, hey, what would you do in this situation? Has provided a lot of value. Um, I also found that doing it as a couple of hours once a week over 8 weeks, is a better learning model than just cramming it into a 5-day bootcamp. So it's not really a bootcamp, it's a cohort. It's more like a college class. Um, the great thing about it, if we're getting people really excited, is that IAPP has allowed me to integrate the Certified Information Privacy Manager content within the course. And so people sign up for the Cyber Executive Masterclass, they can either get Certified CISO as a credential,, or they can get Certified Information Privacy Manager if they're focused on privacy management, or they can get both because we're covering all the content for both certifications in one 8-week cohort. Um, our pricing is changing, but through next Friday, people can get the lifetime membership in the program for $3,500 to do one certification, or they can get both certifications for $5,000. Which is a better deal than some other technical courses. Because now you're a lifetime member, you get 2 certifications. And it's in some cases is even cheaper than a college semester. Again, if people just shoot me an email, I'll send them the link so that they can get the old prices, the price is going to go up. A couple of business strategists have said I'm crazy for giving away something so valuable, so cheaply, but $3,500 is pretty reasonable. Or $5,000 for 2 certifications is pretty reasonable, especially when you consider that you have lifetime access and you consider that this is designed for business technology security and privacy leaders. And so you don't have to be a cybersecurity expert. You don't have to be a technical expert. You're gonna benefit if managing cybersecurity risk is one of your goals or one of your priorities. So I've had board members, I've had CEOs, I've had CIOs, I've had CISOs. I even had a chief financial officer do the program once. Everybody learns something. And the collaboration is extremely valuable. BZ, I think you said once that one of the benefits that you get is that you hear the conversation with different people. And those different people represent different organizations. And so the lifetime membership has value because you always hear from another perspective, what are people doing for governance, for communicating to the board, for capital planning and investment control, for security spending, for incident response, and for a host of other activities. And adding the privacy content is really important because IAPP covers privacy globally. So, you know, what does Canada say about privacy? Or what does Brazil say? Or what does China say? What does CCPA say for people in California? There's a lot of value packed into those 8 weeks. And there's no pressure to take the test, because people can keep coming back and doing it over and over again, until they're comfortable. So much so that my 16-year-old daughter took the program, and is going to take the CIPM certification. And hopefully that sets her up for some scholarships, because she's so young and will be so accredited.

Wow, that is just amazing. Yes, I believe you are completely crazy mentor for doing so. But that's the best thing out there. And everybody who follows me, please, Register for the class and if it's okay with you, Kian, I want to put the link there. They have until Friday. They all need to sign up like yesterday because the other huge benefit too is like if you have like the CSSP or any of this security business certification out there, you are required to have CEUs, continuing education unit, at least 40 or so for most of them. But you can just take this class over and over again and you're going to meet all of your requirements. That's why I've taken this class I think 4 or 5 times already and I'm going to take it again. Next month. So, and like Kian said, probably the best benefit is you have the ability to actually speak about other C-level professionals. The discussion is really what is extremely, uh, useful. You always, always learn something new. Is there any— anything else, anything else we can do, Kian, to add more value to you?

Well, I'll say one more thing about the class. Um, instead of posting the link, if people are interested and they email me, I will personally get them plugged in I will personally answer any questions that they have. They can skip the website, we'll have a real conversation and make sure it's a good fit. Rather than having people just sign up because they're excited about this awesome conversation that we're having. The only other thing, if we talk about adding value, we do have the ability to take donations. One of the things that we do with the donations, we call it the Cyber Career Lab. But my plan starting this year, because we didn't hit the revenue goals, from donations last year is to take 100% of those donations and apply them as scholarships to get entry-level people security certifications. And so, um, again, if somebody just wants to email me, ask me about the program, ask me what we're doing with the Cyber Career Lab, I think is going to be really valuable. We had a cohort of that program with the YWCA in Chicago, and, um, it has been a lot of fun celebrating success with the people who have passed the certification. We focus on Security+, but I teach them a lot more than they would get just hanging out with CompTIA. But I am a CompTIA training partner. And so they give me a lot of resources to make sure that people break successfully into it. Anybody who's willing to donate, they're contributing to directly helping somebody else get into the profession. I think that's a cool thing to do. I'm just glad that I have the opportunity to be the one to facilitate that.

Yes, thank you so much. That is so great because I know a couple of my mentees also watch all of your YouTube videos. At one point, your ad was there and again, completely free. You don't charge anything. It's just such a great resource to the cybersecurity community. Again, I am very, very happy to have talked to one of my mentors today. Keyan, you are really a treasure to the cybersecurity community for sure. Thank you so much for being here. Happy New Year to you. Sorry, we went about 10 minutes over, but I feel like you have just so much to offer. Again, everybody who follows me, please follow Keyan for sure. You're not going to regret this. Until next time, Happy New Year, everyone.

Thank you for listening to the Leadership and Success Podcast with your host, Coach Beezy. If you like what you heard, please subscribe to our channels and come back for more wisdom nuggets on how you may develop into a better leader and achieve greater levels of success. Leadership is the most critical skill. The world will always need leaders to lead others, deploy the next disruptive technology, or execute a business strategy. You may as well decide on counting yourself among the 21st century leaders. See you right here next time on the Leadership and Success Podcast with Coach BZ.