318 - Beyond the Firewall: The Human Element That Keeps Your Business Safe with Simple Salt's Dylan Evans

Welcome to Listening with Leaders. I'm Doug Noll, lawyer turned peacemaker. I teach executive leaders how to listen to emotions rather than words so that they can become the leaders everyone wants to follow. And I teach those same leaders how to be authentically present, available, and connected to their families despite being insanely busy. I have learned that we are 98% emotional and only 2% rational. Learning how to listen to emotions is, in my experience, the foundational skill of life. Stick around to the end of the show and I'll reveal how you can be on our next guest in 15 to 20 minutes. So let's get started. Dylan Evans, welcome to Listening with Leaders. You are the founder of a company called Simple Salt, which can be found at simplesalt.com. At first I thought you were a cook. And then I thought about my brother-in-law who is an architect in Santa Barbara, California, and his company is called Salt Architecture. And it wasn't until I went to your website that I realized that you're all about internet security. Welcome to the show.

Thank you so much, Doug.

So tell us a little bit about your background and backstory, just so we know who you are.

I think like many people in the security industry, I started with grand visions of changing the world and stopping the crime and getting the bad guys. And eventually, like everybody else in the industry, I figured out mostly what we do is collect evidence to defend against lawsuits.

Okay, I get that as a lawyer.

Yeah.

As a trial lawyer.

So you can appreciate this. And Often regulation is hard, right? When Congress passes a law, it's hard for them to know exactly how it's going to work. And so often we have these laws that mandate a certain rigor in terms of security, but the goofy thing about security is that it changes so fast.

I was going to say that you can't pass laws fast enough. And Congress, of course, today is totally deadlocked. They're probably 20 years behind in technology.

Yeah. And so we run into this interesting, not super common regulatory scenario where what is defensible, what will stand up in court, has almost nothing to do with the set of things that will actually stop crime.

Right.

Because courts lag maybe 10 years behind. That's how long it takes precedent to get established.

Exactly. So are you on the forensic side of this where you're being hired to come in and look at data breaches from the perspective of liability?

No, I have done that and it is not fun. You split the worst. I imagine as a trial lawyer, you're plenty aware.

Oh, yes.

Not my top choice. I think I went, I almost went the contract lawyer route.

Oh, okay. Transactional.

Where you're trying to prevent bad outcomes by being careful and thoughtful on the front end.

So are you doing So is your work in consulting where you go into a company and you survey their systems and say, this is where you're really screwed up and your people don't know what they're doing and we need to retrain them and get them into better habits, that sort of stuff?

Close.

Okay.

But so for almost every cybersecurity company, they deliver defensibility. But if you go out, Google or find a friend and you say, I'm worried that I'm going to get breached, that my customers are going to lose me. You will think that the advice they give you delivers crime prevention, but it doesn't. Delivers defensibility. And defensibility is, is what a fair number of people want. But for those who actually want defensibility, think high-trust professional services, those who really have a lot to lose, the answers are not on Google. Very few people will tell you those answers. Those are the answers that we give.

You're giving me answers that are not on Google, that are the cutting-edge stuff that hackers and criminals on the internet are developing, because it's your job to stay on top of what the bad guys are doing.

Yeah, and as crazy as it sounds, it's not deep techno wizardry. It's—

So I was looking at some of your posts on LinkedIn and it was common sense stuff. Like how you manage your passwords and how you manage your website so that there aren't obvious flaws in your websites where people, the people can take advantage of that kind of stuff, right?

Yeah, man, you've done your research. Big props. Better than me. It is simple stuff. It's like you can get really far by sitting down with a friend some evening and thinking through what would really hurt if a criminal took control of a single part of your business, like someone's account, someone's email, a phone. How bad could it be? And if the answer is months of pain, what's the easiest thing you can do to reduce that problem? And usually it's easy. Usually there are really easy ways that cost almost nothing.

And why are people, why are people such idiots about this then that they require your services?

Because if you hear about cybersecurity, I think there's this endemic expectation that security is a computer problem. It's a technical problem.

Not a people problem.

You even get people in the cyber realm saying, oh, what about the human aspect of security? Like it's this narrow cutout.

Like humans don't count.

No, all security is human. Human security.

I run into these engineering types all the time and they'd be happy for humans to leave the planet.

Yes. And like the security industry has been doing a disservice to the rest of us because they treat us like computers.

Right.

They say, Oh, you need a password that's this long. You change it every 30 days. It's this complicated. You can't remember it. It's gotta be complicated enough you can't remember it. That's what computers are good at, not what people are good at.

So how long you been doing this?

Couple years. I did market research for maybe 4 or 5 years and I finally hit my go-to-market in summer of '23. And then since then, I've been scaling. When you— fun fact, when you— the whole point of your business depends on saying that some trillion-dollar industries are ineffective. Even if that's blindingly obvious to everybody, you need to be credible. And so we're building a content pipeline, providing these easy answers for those who just want to do the reading themselves and not call. But, and that, that takes time.

So what is it that gets you up in the morning, gets you excited to go to work?

Ah, that's an excellent question. I was— and I, I do get up early in the morning. I am excited.

Passion. I can definitely— you're definitely passionate, there's no question about that.

When I was younger, I used to get up at 6 and I thought, oh yeah, that's pretty good. And then since embarking on this mission to provide these easy answers, I've been getting up earlier and earlier and it's gotten absurd. My kids make fun of me because I go to sleep before my 6-year-old does.

I'm up.

My first staff meeting is at 4 AM.

Wow.

And I'm usually up at 3. This morning I was up at 1:48, could not get back to sleep, had to go do a building through your head that keeps you up like that. I just— there's so much fun stuff to do, fun people to talk to. This is a great message. So many people spend so much money on techno gadgetry and big expensive electronic boxes that sit in there on their shelves and blink and make you feel better. And it, it, almost none of it helps. You are far better off thinking, this is what I do well. Focusing on that and then eliminating the points of failure, the single points of failure for the things that you don't focus on.

But wait a second, I'm the CIO.

Uh-huh.

I got 10,000 employees around the world and I have a massive infrastructure, cloud and physically based. Yep. And we, in my business, my company is involved in some pretty important stuff. For which breaches are horrible. How the heck do I herd 10,000 people and get them doing the simple stuff that you advocate? That's Mission Impossible. That's why I want the big flashy machines, because the people are the idiots. What do you say to that?

Oh, so many things. But, but the key— I think there is so much chutzpah in the industry of thinking that people are the problem, that people need fixing, people need controlling. No, you are here to serve the people. They don't have time or energy, or, and honestly, they shouldn't care about your techno stuff.

But I'm an IT guy. I hate people. All I want to do is work on machines because they don't give me any shit.

They're better than that these days. But So, though, what you do as the CIO is the same thing that CIOs have been doing for the past 10 years. If you are not in the IT business, like you're not Hitachi, you're not, I don't know, some large IT company, it's not your expertise. IT is an industry. Is a discipline of a million details done. And I can tell you, given—

I love that, a million details done good.

It's exactly like law, right?

Exactly.

You get credit not for your best, highest quality part of the contract. You get credit for the crappiest, most loose unrigorous part of your work, because that's what people are going to leverage to take advantage of you.

Right.

And if you spent half your revenue on IT, you still would not be as good as an IT company at all these details. And so for the last 10, 15 years, there's been a mass exodus of, you know what, we are bad at this. Let's have Amazon do it.

And that is— everybody goes to AWS, right?

Yeah. And it's a heck of a deal, I'll tell you, because it is spending— you can spend a million dollars in a week without too much trouble. But they will do the details right. They It's like a fortress. I would trust AWS more than any federal government agency with the safety of my data.

Wow.

They do it right. And they have a heck of a reputation for that.

That's right. That's where they made— they didn't make the money selling books.

No, they don't.

They make their money off AWS.

Yeah. Their margin on cheap Chinese crap that gets resold under goofy names is what, less than 10%? AWS, that's where their current CEO is from. Because he made, I think they're at over 50% margin, like EBITDA for that business division.

That's right. So if you were coming in, you would tell people, hey, outsource your cloud stuff to a safe place like AWS and then concentrate on training your leadership to train their people how to be smart about this. Is that a fair summary?

I would go one step further.

Okay.

I would say, do you have any family that went through the Great Depression, that lived through it? And—

oh yeah, my, my father did. He lived in a tent during his childhood. Yes.

And so did your dad have some ticks Okay, he's not in a tent anymore, but he just cannot let stuff go, right? He collects stuff.

Uh, yeah, they were— my parents are passed now, but they, they were a bit hoarder. He was a bit of a hoarder. Yeah, yeah.

And my granny recognized it within herself and spent so much effort fighting this urge to, like, hang on to stuff because it has value. Right? But it's real. I think many businesses have that same urge to grab hold of— if it has value, we can't let it go. And what they don't recognize, especially now, there is more risk in retaining some data than there is value in keeping it.

I hadn't thought about that. That's interesting.

I would, this is probably the easiest.

I guess it makes sense. Why do I need, why do I need to keep files from 15 years ago of mediations that I did? I don't need, who cares?

Keeping tax records past the point of 7 years of 7 of when you're required to. Is only a liability. It can only hurt you.

But I guess that if, I guess if I were really anal about it and I wanted to keep them, I put them on an external hard drive that nobody can get to and unplug the hard drive.

So you would put it on AWS and put it on AWS.

Okay. And let them take care of it.

Let them take care of it. Really good password. Yeah. All the fanciest. But the same is true for many other kinds of data. We think about think about the value of data. We don't think about the risk of data. And there are some awesome clever tricks for allowing teams to continue their work as it is without having access to actually scary stuff.

Hmm. So I'm curious. What is it that makes you so successful at this, aside from your passion?

Yeah, when I started, I was overconfident, right? I read the books on marketing. I had a product that I'd proved out. I had another product I'd proved out. I'd built, I'd like served as a practice manager. I knew how to do it. And then when you come to the point of having to do it yourself, all of it yourself, or at least having to own the mental load of making sure all of it happens, I just fell apart. I found out about myself. I cannot make it happen over and over again. And a successful business is not amazing marketing, it's not an amazing product, it is consistency. If you don't have consistency, you have nothing, right? And I don't have consistency. And so Realizing that about myself and that I could be the smartest guy with all the PhDs or the whatevers, but the most important facet of success is just doing simple things well, high say-do ratios, being dependable. That's gold, right?

Discipline, persistence, patience, consistency.

Yeah, that's what it's all about.

That's what you've learned.

Yeah, it's hard. And so I basically hired a staff to, to be consistent on my behalf because that's not my thing. And they are so good, and I could not succeed without them.

I want to tell you something, Dylan, you have just stated what I think is the number one rule in business success. And I've heard it. I've done 340 interviews over the last 2 years, and every single successful person has said the key to success is hiring the right people and letting them do their thing, getting out of their way.

Yeah. Yep. Deep truths.

That's the secret. And if you want to scale, hire people that know how to hire. I think that's what you just said and that you just recapitulate the number one rule of success in all business.

And man, yeah, that is so true. I guess I got another point to preach. I think we are often too short-sighted in our planning because we think in terms of hiring. We think if this person leaves, any investment I put into them will be thrown away, right? This is the risk. And so very few people, very few businesses really invest in employees.

That's exactly correct. It's really interesting. You should say I'm working on my 5th book called Leadership Empathy. Yeah. Teaching people, teaching leaders how to work with their teams in a way that makes their teams high-performing rather than mediocre. Yeah, it's all about emotions.

There is so much. And so our, our model is different. We hire smart, fast-growing people who, like, they want to perform. They don't want to seem— they want to perform. And we teach them how to do it. And we're probably batting like 35% retention because a lot of people, like, I just started a new guy yesterday morning and he's, it's rough starting this on-ramp of very fast growth. It can be demoralizing until you realize, until you get used to The idea that there is so much distance between you and the you who you want to be.

There's a big growth curve.

There's, yeah. And a lot of people are scared of that distance. It's overwhelming.

Yeah. The trick is to break it into small pieces.

Yes.

And help people move along the way and just celebrate each small little incremental improvement and not try to get them perfect all at once. No, I call it coaching for incremental improvement.

I definitely agree. I'm a hardcore Toyota and lean adherent, and it's— they succeeded in the '80s based on continuous improvement, right?

Kaizen.

Yeah, what can we do better next time? How can we reduce the cost, improve the yields, right?

Reduce waste, and in small ways, not in massive retooling, but what are the small things we can do?

Yeah.

And incrementally that adds up. I was going to say, I tell when I'm working with leaders and I'm teaching incremental improvement, I say, think about your problem employee. If you can get them to improve one thing every single day over 300 days of a working year, yeah, what are they going to be like? At the end of that first year.

Yeah.

If you just one thing, no more, they could have a million things going wrong with what they're doing. All you gotta do is just give them one suggestion for improvement every day. Yeah. And let 'em work on that.

Yeah. A lot of people don't want that life though.

It's, then that's, then it's a, it's not the right fit. If they want to, if they want to work in a nail factory, they can go work in a nail factory. Do the same thing day in and day out. There's a need for that.

Yeah. I think this is absolutely something we feel passionately about. And I was talking to probably my longest, second oldest employee today and reflecting on, she's been with us for 9 months now. Came out of a call center, and between May and October, she transformed so radically, grew so much that she was reflecting that in October she could not conceive of the— of who she would be in October. Back in May. And then she did it again from October to February.

That's massive growth.

And so this is the question: who will she be in June? How awesome.

I was going to say, that's a pretty exciting place to be as a leader, to watch people explode in their growth. That's what leadership is all about. Yeah.

I am— this— I might say this edges out stopping internet crime for what gets me up in the morning.

There you go. Developing your people.

They are worth it. They're awesome.

Yeah. That's the second thing that I hear over and over again from successful people is my people are awesome.

Yeah.

And I love to see them grow. Tell me about listening. Where'd you learn how to listen? The school of people getting angry at you, which proves my point that we have no formal training in how to listen.

So I think it's getting better. I think it's getting better. I grew up in a family that did the active listening. They'd been to the right shrink school, or like—

oh crap, none of that stuff works. I'll tell you that right now. I know that.

And it did not work very well for me. I thought I knew how to listen.

It doesn't work.

And someone, a salesperson— I'm bad at sales. I get too excited and I stop listening. And a sales mentor of mine suggested a book. And like off the cuff said, and it, from my experience, it tends to help people with their marriages too. And you probably know where I'm going with this, but it was never split the difference.

Oh, Chris Voss.

Yeah.

It's interesting. I, he realized I developed the skill of affect labeling at least 8 years before he ever started using it in his hostage negotiation. But when I read his book, it was really interesting that He's— we both cite the same study out of UCLA, the labeling study, Lieberman study. And the difference between Voss and myself is he uses this emotional listening that I teach, only he uses it in the context of negotiation, while I use it in the context of everything else— how to build strong relationships, stop fights and arguments, deal with difficult conversations, calm angry people. My fourth book is called De-Escalate: How to Calm an Angry Person in 90 Seconds or Less. Yeah, I'm familiar with his work. Yeah, and that The book was influential for you. Good.

I read it 4 times.

Wow.

6 months because I had such a hard time with some of the concepts.

Yes. Counterintuitive and counter-normative.

Yeah.

Listen to emotions to calm people down, or he calls it tactical empathy, I think. Uh, term I don't care for, but that's his thing.

Yeah. So one of the bits I remember in particular is Everybody's got like at least 3 voices in their own head going at any time. And so if you want them to listen to you, you've got to get them the voices in their head to quiet down before they have a hope.

That's exactly right.

I was— that was very difficult for me. And I think you're right. I think he wrote this as a direct response to Getting to Yes, right?

Yeah, Fisher and Ury. I'm well, I'm obviously very familiar with their genre, their, right, their work. Roger Fisher and Bill Ury.

Yeah. And it was so big in the '90s, right?

And I, but the problem is they didn't, their, the problem with their book, as I, I wrote a paper on their work and the problems with it, but like everybody else, and even Voss, They tell you what to do, but they don't tell you how to do it.

That, that's the third thing that gets me up in the morning.

And so I'm all about teaching the how.

Yeah, we need to get together for some of this, but I've been, I like, so Simon Sinek says start with why.

Exactly.

And then, so I've been working on this one. You can please make fun of it. I'm still iterating. Start with why, because if you don't know the value that your creating or the problem that you're solving. Everything after that is a roll of the dice whether you're going to solve that thing, right?

Yeah. But I'll just say in his book, and it is a good book, and I love watching his videos. He's a great speaker.

He is.

He does not talk. He only talks about the what.

I know. Yes.

Not talk about the how.

So, there's an idea in IT. They use the what and the how slightly differently. And there's an interstitial step between once you've defined the problem and you're, you're gonna start doing it. And that is like a concrete description of the future state. You have to really get into the details of the future that you think will deliver This—

well, I, I think you're right, but I would restate it this way. You define the problem, and then you examine what's my best outcome, and then how do I get to— how do I get from the problem to the outcome? What are all the steps that have to happen in order for me to work through to get the outcome? And it's those steps that people don't want to work on because they're hard. It's hard. Yeah, it's hard.

In, in my experience, that what I would call the what— that's the future state— is it's very easy to be vague about it. And when you try to nail people down about, well, how is this actually going to work in practice, exactly, they get real nervous because they can't describe it and they don't know how because they're daydreaming. They haven't thought through it.

That's exactly correct.

And so there's this rule in software development that's 20 years old, probably at least, where you write down how the product's gonna work before you're allowed to build any of it. And that, because it's so much easier to change the future state when you're just like describing it. Once people start building it, they become invested. And they'll try to back into their solution.

Right. Because it's easier. Even though it doesn't lead to the outcome that you want to get to. No, I totally get it.

Yeah.

We're running out of time here.

Yeah.

We could talk forever, I can tell.

I think so.

One more question and we'll close out this conversation. So Dylan, what's one thing about yourself that we would never know about unless you revealed it to us?

That is a very difficult question, right?

You said you didn't want— you did say you didn't want softball questions.

No, it's a compliment. That's a great question. I am probably the goofiest dad at my school. I am the least, like, the least concerned with appearances. Going to the playground, saying the goofiest stuff when the friends come over. I think every dad thinks this, but I think I got it in the bag. And I think the other dads would agree. They would say not as much competition. Does not quite rise to your level.

Very good. We're going to end the conversation, but I hope we can talk again soon. Thank you so much, Dylan. You are an amazing guy. Really, you are too, Doug.

This is— yeah, this is great.

Thanks. Doug Noll here. Thank you so much for listening to Listening with Leaders. If you are a successful executive leader who would like to be on this program, please visit podcast.dougnull.com/podcast. If you got something out of this interview, would you please share this episode on social media? Just do a quick screenshot with your phone and text it to a friend or post it on the socials. If you know someone that would be a great guest, tag them on the social media to let them know about the show and include the hashtag #Listening Leaders. I love seeing your posts and guest suggestions. We are regularly putting out new episodes and content. To make sure you don't miss any episodes, go ahead and subscribe. Your thumbs up ratings and reviews go a long way to help promote the show and mean a lot to me and my team. Want to know more? Go to my website, DougNoll.com, or follow me on LinkedIn, Facebook, and Instagram. That's @DouglasEnoll. Thanks for listening, and we'll see you on the next show.