363. Unveiling the Power of Cyber Anthropology with Lianne Potter

Welcome to episode 363 of the Brainy Business Understanding the Psychology of why People Buy. In today's episode, I'm excited to introduce you to Leanne Potter, a cyber anthropologist. Ready?

Let's get started.

You are listening to the Brainy Business Podcast where we dig into the psychology of why people buy and help you incorporate behavioral economics into your business, making it more brain friendly. Now, here's your host, Melina Palmer.

Hello.

Hello everyone.

My name is Melina Palmer and I want to welcome you to the Brainy Business Podcast. In today's conversation, I'm joined by Leanne Potter. As the head of Security Ops for the largest greenfield technology transformation project in Europe, Leanne is building a leading edge security team from scratch to meet the needs of a modern retail organization. While empowering her team to think innovatively to create new standards in best practices. Leanne has delivered talks across the globe to share her vision for a new type of security function.

Drawing upon her expertise as a cyber.

Anthropologist through her consultancy, the Anthro Securist, her practical experience as a security focused software developer, and as a security practitioner, Leanne combines the human and the technical aspects of security to evangelize a cultural security transformation. She's on the advisory board for a community enterprise aimed at encouraging diversity in.

Tech, is a published author, podcast regular.

And recently won Computing.com's Security Specialist of the Year for her work on human centric approaches to Security. In 2021, she won two other awards for Security Leaders of the Year 2021 and Woman of the Year in the enterprise category. In 2023, she launched her human centric podcast Compromising Positions in which she unlocks the ever evolving world of cybersecurity from an outsider's angle. Really quickly before we get into the conversation which I'm so excited for you to be able to learn more about what it means to be a cyber anthropologist. I want to be sure you know that there are links in the show, notes for everything including related past episodes, links to articles and books, a full time stamped summary of the episode, and so much more. It's all within the app you're listening to and at the brainy business.com 363. Now let's jump right in. Leanne Potter, welcome to the Brainy Business Podcast.

Thank you so much for having me. I'm so delighted to be here.

Yes, I'm super excited to be chatting with you as well. This is our second interaction face to face in the over, you know, virtual communication of course, and had several messages back and forth on LinkedIn. So I've gotten to know what you do and I find it to be fascinating. So for everyone who doesn't yet know you, can you share a little bit about yourself and the work that you do?

Yeah, well, I'm head of security operations for a major retailer in the uk, but when I'm not being very technically minded, I am a anthropologist, specifically a cyber anthropologist. And that's someone who takes the principles of anthropology and applies them to the world of digital cultures. But in my case, because I work in cybersecurity, to cybersecurity cultures. And what I mean by that is how do we understand culturally the way we engage with cybersecurity? And that could be down to individual users. So, you know, me and, me and you in our civilian life, accessing websites and inputting our passwords using two factor authentication and what sort of impact that has on our daily lives all the way to organizationally and including the security team itself. And I always say to people when they hire me as the anthro securist, which is my consultancy business, that I get asked a lot, come and sort out my security culture. Leanne in my organization by security teams. And I have to turn around and say, actually, before we move on and unleash you to the rest of the organization, let's start with you first, the security team and make sure that they are ready in terms of their cultural awareness of their surroundings, but also their internal culture as a team before we unleash them into the wider world. And the bygoneness of the security function itself is that often it can seem as quite a policing function. And so anytime you've got some sort of authoritarian, someone finger wagging, saying no a lot, you're going to have a lot of resistance. So it's my work as an anthropologist is helping people understand where that resistance goes, comes from and how to find solutions to not quite eradicate it because it's very difficult in the job we do to eradicate it, but at least make it easier and more palatable for people. And that all comes from actually understanding what is it like for people to engage with security controls.

Definitely. And so I know when, so I was honored to be a guest on your podcast and in that conversation and then I, you know, saying, okay, so you said you're a, a cyber anthropologist, like is this a, is this a thing that I didn't know was a job? Or like, what's, what's happening there? So can you share a little bit about how you found yourself in this Space, Yeah.

When you asked that, I actually decided to Google it and I thought, let me see if there's actually any one more of us out there. I could not find. But shall be honest, it was mostly just a post that I've done.

Yay.

So it does. It's a niche indeed.

Trailblazing.

But what I there is anthropologist working in this space. And I didn't start off going, right, I'm going to be a cyber anthropologist and just give myself that title. I actually started off as a just an anthropologist quite a few years back, and I became fascinated at first when I was studying it for my masters in digital cultures in general. So I was really interested in does the cultures we create online in things like Second Life, if anyone remembers that, which is where you had to have your own avatars and things like that, or any kind of virtual space where you have an avatar and you engage with other people. Maybe you build things a bit like Minecraft in a way as well. For a more modern example, I was really interested. Does the same cultural steps apply when we move these to the virtual space? And in particular, I used things like Marxist theory to kind of understand, you know, are we replicating capitalism on these platforms in the same way that we do in the real world into the virtual space? And are we just replicating society? And quite often we were. There was very little difference between the way we were engaging, I hate to say, in real life, because these virtual platforms are quite an outlet for people. And, you know, they are just as important, just as nuanced, just as significant to people's relationships when I was studying them as the real life space, are we doing the same things? And because of that, it was really interesting to think there was a lot of discourse around people saying, hey, this virtual space is isolating, you know, we're not communicating properly. My research showed the opposite. My research showed that the virtual and the what we class as the real space is just as fruitful and meaningful for people. And therefore we have to really consider if that is the case and we'll continue to do so and we can move through these two spaces. What is the impact of all of a sudden our world's becoming quite large. Because think about, you know, before the Internet was a really major thing. You know, you only knew people in your immediate surroundings, really. And then maybe relationships you picked up along the way, and maybe you kept in touch with people on telephone, wrote letters, things like that. However, the virtual world or the Internet has now opened up that space so that we can communicate with Anyone around the world pretty much at any point. And that's what's enabled me and you to talk today and find out loads of information, do that knowledge sharing thing. And I was really interested as a digital anthropologist to understand what we could do to keep fostering those relationships to a positive outcome. Because as an anthropologist focusing on culture, my job is really to research how cultures form, how they thrive and ultimately how they collapse. Because eventually all cultures collapse in some sort of sense. And it's about learning from that and kind of putting on a pedestal, which at the time, when I was studying digital anthropology, wasn't seen as proper anthropology. Proper anthropology, you know, was out in the field, you know, pressing the flesh literally almost in some cases, and, you know, really being a part of that culture in a very physical sense. And so the work I was doing, it was really tough because people were, you know, including, you know, my tutors and things that was like, this is. Seems very ephemeral, but these relationships aren't ephemeral, they are very tangible. And it worried me that we weren't collecting these cultural artifacts and preserving them. A bit like I imagine with things like digital archaeology and things like that, there's a big discussion and discourse around, you know, if we're not saving all this digital media, what are we going to do when it all disappears? Because the problem is with technology is that it does disintegrate, some say in a more alarming rate than, you know, a piece of papyrus would that's been well preserved. But these are incredible important cultural artifacts, these engagements that we are doing online. So I became fascinated with that and I thought, oh, how do I actually get a job in this? And again, at the time, you couldn't type into indeed or anything like that. Digital anthropologist. Nothing would come up. So I decided, okay, right, I'll go work for a charity that was just setting up a new project and I would apply my anthropology there because the same skills I developed as a digital anthropologist could be applied in any kind of sense. You know, just because I had a digital hat on didn't mean I couldn't actually engage with real people. So I got a job at a charity and I was project manager there. And I was given a brief which was solve destitution in Leeds, which is the city I'm in. And that was the brief. Give him £5 million, go solve that. I had no idea how I was going to solve destitution in my local area. I had no idea what was going to come through my door. But we put the word out. And then what I started seeing straight away, and it was almost serendipity really that I got to apply my digital anthropology in this way. People coming into our service and they were facing destitution because they couldn't access digital services online. And at the time the UK benefits system had a big digital transformation push. So it had moved a lot of its services online. Not saying that's a bad thing, you know, it's just the way the world works. You know, everything was moving online. However, in their speed they were neglecting the very vulnerable. People who weren't digitally literate, didn't have access to, to computers, smartphones, things like that. And I was seeing what became known as the digital divide in situ there. So the digital divide for your listeners is the theory that posits that those who do not access, do not have access to online services. Things like, you know, as I say, the benefit system, housing, education, healthcare, even the ability to get a better deal on your gas and electric bills, you are socially disadvantaged and it creates an inequality between the info haves and the info haves nots which can be absolutely detrimental to a person's well being, to a person's status in society and it can cause them to be extremely isolated if they do not have same access to these digital services. And as I say, this could be literally physically don't have access because for a lot of people a computer and a smartphone and then the Internet connection is very expensive or they don't have the skills to be able to access it. So as I say, people were coming into our services and quite often the scenario would be that they would go into a physical building where you used to be able to sign on for job seekers benefits. We called it the job centre in the uk. And what will happen before is you'd go see your caseworker, they would take all your details, they would help you find work, but they would sign something and say okay, so you can have your jobseekers benefits for the time being. So a bit of money to keep you going. But it all got moved online and these people going into the services that they had used for decades knew it very well and they were being turned away saying there's a bank of computers over there, you sign on for yourself now and given no training, no indication of how to do it. And for a lot of people it was more than just a barrier in terms of I don't know how to do this, it was actually quite socially and emotionally damaging to them and they would be quite Often told, oh, go to the library and learn how to use a computer. Now if you are facing severe destitution or maybe you, you've done a blue collar job all your life, you never had to use a computer. Going to a place like a library can be an extremely daunting task because libraries to some people are still seeing as these very lofty institutions that you know, are a barrier to people and so to be said, told, go sort yourself out, go get lessons in the library. In an institution where people don't trust, maybe that can be incredibly daunting. So most of the time I was spent doing that job for the charity was actually just doing these online forms for them. And it seems crazy that there was a 5 million pound project to do that, but that's what needed to be done. But luckily because of my anthropology I was able. One of the conditions of the getting that funding was that I had to write a lot of reports about what I was seeing and my theories as to why these people were in destitution. And so I was able to use my anthropology and say I'm seeing the digital divide here in action. This is what you need to do to enable your tech to be more user centric, to understand the cultural situations that these people are facing. So it was really, really useful for me to be able to apply that. Regrettably, as is the way with working in charity organisations, budgets come and go, funding comes and goes and unfortunately that project was put to an end after about a year. Wasn't anything due to the service we were providing. We just one of those things. However, it really inspired me to think how can I continue to apply anthropology to, to technology? And so I decided to take it upon myself to learn a technical skill. Now I have zero technical background. I had a computer when I was growing up. It was the family computer in the living room. We all took it in turns to have a go. I spent most of my time in the 90s playing on Sims. That was probably the extent of my, you know, technological experience. But I decided I'm going to teach myself to computer program. And so I use a lot of free online resources and spent a lot of time going to tech meetups. So this was before COVID I was quite lucky that the city I live in, it's a huge tech hub and so there I would go to a tech event every single night and it would be a tech event on anything. So it wasn't always cybersecurity, it wasn't always software development, it'd be on anything to do with tech. My favorite ones were ones about user research and user experience because I could really see how that would be a nice bedfellows for anthropology there. Eventually I was job ready and I got my first job in tech and that was working for the nhs, the National Health Service in the UK as a software developer. And I think one of the reasons why they took me on and this was about age 30 there, so I was quite old in terms of retraining for that. They took me on, I think, because in the interview I said whatever I do for you, I'm going to apply anthropology to. So that whenever we create anything, we know that it's created for the end user in mind. Now the NHS has a huge range of customers. The idea behind the NHS in terms of its technology is to be able to be accessible to every single UK person. Now that's a lot of culture to take into account. So it was really, really interesting. So I would do quite a lot of talks in the NHS about how do we really consider the cultural nuances of all the people we were trying to serve. I guess the question is, well, how do you go from software developer to cybersecurity? Well, again, my anthropology spidey senses were tingling when I was doing that job. I really enjoyed doing it, by the way. I loved being a software developer. But I kept noticing there was an engagement with a certain team that was really unusual. It was unusual because they were in their own room, divided off from everyone else. You needed a key car to get in, which I did not have, I did not have clearance to get in. And the only time we'd ever really hear from them would be to fix something and to have a finger wagged at us. And so I became fascinated with this team, which was unlike any other team tech team in the organization because all the other organizations were, it was kind of, it felt, had a very startup feel. You know, we would, we'd get together around whiteboards with post its and we would wireframe things. We draw things up, really collaborative. And then there would be this other team which was the security team and they would just, just act in a totally culturally different way to what the rest of the tech function was doing. And it just fascinated me. And so I was a bit of a nuisance. And I begged and begged for a year to be let into that team because I was just, I couldn't understand how they would ever get anything done by acting this way. And I was quite right, to be honest. And eventually I got let in and I'VE not looked back since. I've been working in CyberSecurity now for seven years.

Nice. What a I I love the description through the journey and showing how everything evolved for you as you're kind of unlocking and figuring out. And I think that's so helpful for people that are listening because so often I will have people reach out and in the space with behavioral economics or behavioral science and saying, you know, oh, I'm in XYZ area and there's nothing here. No one is doing this. What do I do?

How.

How do I even become the first person to do something like that? Of which one I often will say there are probably more people than you realize, but y' all haven't like met up yet and so. But starting to be more vocal about it can help you to find other people that are doing something similar or and like have a have a another approach that's kind of like yours or whatever. I'm going to be linking to my episode with Felicity Heathcote Marks in the show Notes for everyone I know I mentioned her to you. She is does. I think she said cyborg ethnography, which is like a whole other interesting thing. But that's where we talked about, you know, ethnography and anthropology and how they go together and how they're different and and whatnot in that episode. And in the case of knowing that something is important enough to sort of forge the path and be one of the brave ones, to say no, this matters and let me show you why and help to create roles and teams and stuff around it is just is really cool. And I think it's a really important lesson for people to see that this does matter and whether someone, you know, they're in risk or cybersecurity or like you said, software or HR or product development. There's so much I feel like in general, I don't think businesses give enough credit to anthropology. Like it's such an important thing that you don't see in companies enough. And I think, you know, behavioral science, behavioral economics can is doing a lot of the same things when we look.

At it this way.

And so someone who had a degree in anthropology, I think could have very translatable skills in a behavioral type of a role. But when we think about, as you were describing there, the impact of cultures and how we interact and what might that mean? It's, you know, it's all super important for business, both organizationally, internally of getting anything done as well as thinking about how users are going to interact with a product or a service that you are providing. And you know, there are some very obvious ones, like you said Minecraft or, you know, Sims or something where you have people in a virtual world. And I am interested in your thoughts on the Metaverse, but we'll get there. But you know, there other examples where we're having to interact in that digital space. And if you do understand how things might translate and how they might not, or in a surprising way in that digital space is really important. You mentioned a little bit about passwords, and I think in our previous conversation we talked a little bit too about like bank accounts and, and debit cards and physical representation of, of money. Can you share a little bit about that?

Yeah. So when it comes to our digital security, it can seem really ephemeral. But I like to remind people, when you think about security, think about when you lock the door to your house. It's a ritualized security process. So when you leave the house, you barely need to think about, you know, putting your key in, turning that lock, you may jiggle the handle of it, but none of that is conscious. And I know that you've done a lot of work about actually how many decisions do you make a day? That is one of those decisions that you don't really think about except when maybe you're panicking. You think, did I actually lock that door? When you're about four miles away or something like that. But when you think of cybersecurity, it's hard to imagine security in that way, but it really is the same. Now the problem is like real security, digital security has its flaws, and those flaws are the human element. So in my example, as I just said, you might forget to actually do it if you're distracted. You know, maybe you've got the kids waiting in the car kicking off, maybe you're late for something, maybe you've had some bad news, you might forget to lock that door, you might forget to close those windows. Cybersecurity is very similar. And I think if we enable technology to make quite a lot of the heavy lifting for us. So things like password managers and things which I know that people have lots of trust issues with, but, you know, cybersecurity hat on. Here they are, they are very good for you. And I do recommend allowing technology to do that. Heavy lifting helps reduce that human element just a tiny bit. Now that's not eradicate, that's reduce it. And it's, you know, it's a bit like, you know, if you had an automatic lock on your front door instead, I'M working with it that way. And I think also one of the things that makes cyber security really hard to kind of feel tangible as well, is if someone breaks into your house, you know, that that was a person, that was a burglar. You know, you might have a theory as why they're doing it. You know, maybe they're crooked. Maybe it's desperation. Who knows? You can kind of build up a narrative that this would be a physical person. You might see them like the Hamburglar with a striped top and, you know, a little mask on, a little dark mask over their eyes. Who knows? But you could. You know what a burglar looks like. If I say a burglar, however, you say a hacker. Yes. You might have a image in your head of someone with a hoodie. You don't think of them as people, though. And they are. Hackers are people, too. And they also have their own culture. The hacker community very much has its own culture. And now we're moving into sort of the next level of cybersecurity, which is things like ransomware as a service. These are proper organizations. They have HR departments, they have marketing departments, they have customer service departments that will completely own a company for you if you pay them enough money, and they'll give you tech support, like, oh, well, we could do it this way. We can give you discounts. And so they are very, very sophisticated. They are people going to work every day, just like me and you do. And we need to remember that. Now. What's really difficult, however, is when it comes to law enforcement now, we hope when something happens, the police will come out. Maybe they'll dust the prints. Maybe you have a police patrolling your area, and maybe you just hope they keep an eye out. You don't feel like that in cyberspace. You don't feel like we have police patrolling. We kind of feel like we're on our own in cyberspace. In a way, we are, because it's so hard to police in the virtual space. And that's why, you know, you don't really often hear of big gangs getting taken down by law enforcement. You hear more often that people get away with it. And there's a really interesting thing around the language we use around victims of cyber incidents. And again, going back to the getting burgled in real life, if you get burgled, you know, even if you've left the door open, people will be empathetic and such a shame. I'm really sorry to hear that. You know, they would give you condolences and things like that, you get scammed in a cyber attack. You're stupid, you're an idiot. Why did you let that happen? And that's absolutely wrong. That language, I hate that language. It's a language that security professionals use. It's a language the media uses. And that victim shaming, I think is because it's so difficult to find attribution to the actual criminals. So we shift that blame where we would normally reserve for the people who've done wrong, the people who've done bad to us. We shift it onto the victims. And what does that do to the cybersecurity narrative? Well, that causes people to be unafraid of coming up. So cybersecurity incidents are, and scams are dramatically underreported. It's probably way worse than we imagine because people are ashamed of when it comes to organizations. People stop sharing things. Now one of the great, I say barriers as a cyber security professional is that as an industry, you know, other professionals, if something goes wrong, even we get our fingers out and go, oh, you should have done this, you should have done that. When really we should be learning from these cyber incidents. But because there's a lot of shame surrounding it, companies put up the drawbridge. Very little information comes out about how did it happen, why did it happen, how can we prevent it from next time happening. Instead you just get your boilerplate line, which is we take cybersecurity very seriously and we're looking into it. And that's because we have really built a culture in cybersecurity not to allow for failure. And that's wrong because we are all going to fail in this. They are incredibly, and they being the cybercriminals, incredibly sophisticated. Now, as a cyber security professional, and most cyber security professionals do live by this, is we always say it's not a question of if, it's a question of when. So we live on the assumption that we are either currently breached and don't know about it, or that we will be breached in the future. And that's how we live. So to live in constant state of paranoia, that's, that's kind of one of the job descriptions. But living in that way means that you become very self preservationist. And so when I'm applying anthropology to this, it's about understanding and almost in a way applying a little bit of psychology too, and saying these self preservationist attitudes are actually causing you to be in a compromising position. And by compromising, I mean being the one that's going to be putting the organization in a Compromise. And that is because we, if we're so scared of a breach, nobody else is going to help us because they don't want to get involved in that. Nobody wants to be surrounded by that dark cloud of a breach. So then when you're looking at your organization to help and support you either, you know, through you know, learning, training, keeping an eye out, you know, contacting us as soon as something happens, if they feel that you are so terrified of a breach that, that there's going to be a heavy hammer of discipline if that happens, nobody's going to talk to you, nobody's going to want to put their hands up and say, you know, I'll help you out, I'll be accountable for this area. Because I know that you are in a. Cyber security teams are often the most under resourced, underfunded, under loved organization, you know, capabilities in an organization. We need as many eyes as possible supporting us on this. We can't do it alone. But we do not enable people to feel like they have the psychological safety. And I think that is due to the fact that when it comes to being accountable, accountability basically means at some point you're going to have your actions come into question and someone's going to turn around to you and say, why did you do that? Why did you make that decision? And that's a scary thing for humans to be put into that position. And if you've not been given the support, which many teams don't, when it comes to security, because you know that line, again, security is everyone's responsibility. We take security very seriously. If they don't feel it, they're not going to do it. And so the problem is, and what tends to happen is if no one's going to help us, then okay, we'll take it on. We'll put insecurity controls in place, but we won't consult with you because you don't want to be forthcoming. And so you've got this vicious cycle where nobody consults with us, we don't consult with them. So we put in these security controls in place that often impede people's ability to do their jobs and therefore they do workarounds, which are often more dangerous than the actual thing we're trying to protect. And therefore we become more vulnerable. And then that breaks our trust. And then because that trust is broken, we up the ante with our security controls. And it's a cycle. It's an absolute cycle. And so it's really important to use things like anthropology, psychology, behavioral economics to really understand why are humans doing the things they do? And as I said earlier at the start, this call, it starts with the security team. I can't let people go out into the rest of the organization, these security professionals into the rest of the organization without them understanding that they need to change just as much as anyone else. So when I get asked, sort out the security culture in my organization, sort yourself out first.

Well, yeah, I mean, that's the question I was going to ask, you know, following up on this, because I'm sure, you know, people that are listening here now are thinking, oh, okay, like I see the problem, I understand, I want to fix it. And so like if a company brings you in and you're doing some of that consulting and for someone, if they wanted to be, you know, if they don't have the background in anthropology and they're kind of trying to investigate like themselves and other parts of the team to find the root of some of these problems, you know, what is it that you do when you go into work with an organization and, or, you know, what are some tips that you think if someone's looking to kind of start this process themselves, where would you recommend they kind of focus that attention?

So if you're lucky enough to have a user research or user experience team, I suggest making friends with them as soon as possible. The reason being is yes, not a lot of organisations hire anthropologists, not a lot of organisations even think to hire anthropologists, but the user researcher, user experience team is in quite a lot of organisations in some form. And why that's really useful to get involved with them is because they know how to ask the right questions. They spend a lot of time thinking about the right questions to elicit the correct understanding of a process. So for example, a user researcher, you know, helps create an application and then they take it off to be studied by customers. So that, you know, I, I did a lot of this when I was a software developer. It'd be behind a two way mirror, someone would be engaging with your app and you know, the user research would be asking questions like how easy is it to find this document on this website? How easy is it to find this? How did you find the logging in process all these questions that they're asking. But not only is the response to those questions important, user researchers, user experience teams know what is not being said as well. And if someone's really struggling to find something, they might not articulate as struggling to find something. Because if you've never used that website or application before, you might not know that you're struggling to find it. But if you know what your functionality should be, then they know actually these are the cues of behavior that are indicating to me that there's a problem here, that there's, you know, that it's not a smooth process. And so if a security team, you know, is lucky enough to have user researchers and user experience teams in their organization, start getting involved with them and saying, look, I really want to understand. It could be your customers, their user journey through logging in, or it could be help me identify areas where I can ask right questions of my colleagues to understand their logging in process, to understand how they access the products and services they want to do. And from that you're able to one, develop an ally, but also start thinking about your processes and your controls in a much more creative way. And that's really important because when it comes to security, I think we often forget that security can be innovative. There's a real big strong call for innovation in this space. I'll be totally honest with you. I love a magic link. I love anything that makes it easier for me to log into anything. I don't want to remember hundreds of passwords. I don't want to do any of that. I want it to be really. I want to just access what I want to access. I want security to be a almost invisible thing that I don't have to think about always. You know, even, even someone who works in this industry. I want it easy because humans do want security to be easy. We want things to be taken care for us. And when you think of sort of really good digital experiences, you know, like your Netflixes and things like that, to say, to think that you can't get the same thing at work is really painful. And we should be trying a lot harder to make it a really good customer experience when it comes to security. And that's customers in the small C as our colleagues, that's customers in the big C, as in the people we're serving. So that's one way of getting people started on this kind of anthropology journey. The other thing is that one of the things I do and train people quite a lot in is the actual anthropological research technique of participant observation. So participant observation is where you really embody the people you're observing and really understand their culture, the way they work, the way they understand things. It's participant is the key word there. It's not just observing, it's not just being weird and scaring your colleagues by standing in a corner and watching them and things like that. But it's about getting involved. And I encourage teams, security teams, to think where they feel like their biggest challenges are in an organization. Could be the software development team, could be another team, could be finance, could be marketing, whoever causes you the most security stress and spend a few days with them. But you could do this sort of small scale, you know, if you're an anthropologist, you could do it on a nice long scale, but most people are. So do it on a small scale, just spend a few days with them, just sitting with them, talking with them, understanding. And you'll get the same understanding like you would with the user research team. And that's the key of understanding what's being said, because eventually you'll build up trust and they'll start telling you about their security misdemeanors, hopefully. Which tends to happen quite a lot, actually. Once they get used to you, you become the security confessor, which is nice because you need to see, you need to understand the bad to be able to solve it. So it's really important to understand where there's poor security practice going on. And then the other side of it is getting an understanding for what's not being said. What's not being said tends to surprise security teams, which is actually, yeah, they might have a problem with the security team, but they've also got a problem with the data team. And the data team and them don't talk to each other. And then, or maybe, you know, finance don't like talking to marketing and therefore there's a breakdown in communication there. So they go around each other's back there and you'll find actually it's all connected to communication. I think a lot of cybersecurity issues is that lack of communication. It's the inability to be able to understand the other person's constraints, understand the other person's circumstances that might be preventing them from doing things in what we'd call the proper, secure way. And then it's the other side of it is not knowing who they can talk to, how they can talk to them, and what would be the consequences of raising those security questions.

Awesome, I love that. Well, thank you for all that. Great advice for everyone who's listening to kind of start this process and look within. I did say that I was going to ask you about the metaverse. So I would say if you have just a quick tidbit or thought of, you know, as people are businesses, companies, user, considering, you know, either stepping into the metaverse or people that are curious what this means, you know, what are your, you know, kind of quick thoughts on that whole sort of space.

It's an interesting thing. I think there's been a lot of talk about these weird little initiatives that the metaverse are trying to do in terms of the avatars, like who are they appealing to? Some of the avatars seem very. I'm just trying to be a down with the kids and, and I worry that that might put quite a lot of people off. I see value in the Metaverse and I think if it becomes a full fledged thing, it will, it will replicate human society as we know it in the real world. I wonder, however, because there's still a little bit of not quite the Uncanny Valley, which is sort of a Freudian discussion about things that look kind of human but are not quite. We get a lot of that with very human looking robots, for example, and AI kind of comes into play in that, the way we talk to ChatGPT and things. That uncanny valley is still there. I don't think we're quite ready for it. I think we're still seeing it as more of a skin than a substitution. And I think that's because we've actually built a lot of really nice direct communication that doesn't need a separate platform. Whereas I think, you know, 10, 15 years ago, maybe, maybe a bit more, if I get my maths right, when things like Second Life was around, which was a huge, big deal at the time, you know, people could like customize their avatars, people got married because of it and things like World of Warcraft. You know, you hear about people meet on World of Warcraft and got married and things like that. In the real world, we don't really need those platforms as much because we have things like WhatsApp, we have things like, you know, LinkedIn, messenger, where we don't need this artifice of an avatar anymore. We can be really direct, which wasn't there before. And so it really will depend on if people want to continue to either be a fully fledged identifying person, like I am on LinkedIn, like I am on Twitter, like I'm up, like I'm on YouTube, for example, and through my podcast, do I want to be identified as Leanne flesh and blood, or do I want to make the choice and be identified as an avatar on another platform? Now, there might be lots of reasons why you want to be an avatar on platform. You know, that on a platform it might be, you know, if you want to hide any disabilities or anything like that, or feel fearful about any identifying markers or anything like that. Sometimes you might want to just be outwardly malicious and be a bit Machiavellian and do some naughty things online. All those kind of things come into play as to why you might create an artifice of yourself out there. Good reasons and bad. And I think it will really come to fray if there is, if there is more of a need to put that show on. And I just don't think there will be because I think things like if we do have that platform with AI being so good at what it's doing now with deep fakes, with videos and audio, we might just be able to recreate ourselves. I might give myself a little bit of a facelift or a touch up or something like that for these avatars, but it'll still be me, you know what I mean? It won't be like it kind of was in things like Second Life where I could be like a giant cat or something like that. I just think where we've got to be. At the start it was interesting to be someone different. The start of the Internet was interesting to be someone different. I think now we're valuing quite a lot the reality of the human form. And you see that with things like TikTok and Instagram, it's all about praising the human form. You know, the hashtag no filter, for example, that was popular because we were starting to reevaluate the importance of the physical in the virtual space. So I think, I think that it's going to be a time will tell on that. I think there will definitely be a need for a platform like that. Whether or not it'll be avatar based, I'm not sure.

Interesting. Well, I'm excited to see what happens with the metaverse and so much else out in the world around us. And thank you so much for the conversation about what it means to be.

A cyber anthropologist with all of us.

Here today and why that's important for business. For everyone who is excited to learn more about you and ready to connect and whatnot, what's their best path or paths to do so?

Well, I'm always on LinkedIn. I do love a bit of LinkedIn so you can find me under Leanne Potter. You can also, if you liked these chats, I have launched my own podcast, very much inspired by yours, I'll be honest with you. It's called Compromising Positions and on that we interview me and my co host interview non cybersecurity people about cyber security. So we get. We've had your lovely self Molina on there and we've had people like Christian Hunt I've got economics people coming in, people who work in law, as well as other people from the technology field as well, that don't work in cybersecurity. And asking the very pertinent question is like, how would you actually like us to engage with you? And why isn't what we're doing working for you right now? Because the way I see it is cybersecurity hasn't changed much since its inception. So cybersecurity as a function is relatively new compared to quite a lot of tech. It's about, depending on who you ask, 20 to 30 years old. And we've been saying the same things for all those decades, which is have a strong password, don't click on that, and, you know, don't share things. And yet people still have rubbish passwords, people still click on things, people still fall for scams. So if our narrative has been consistent that long and it's still not working, something must be wrong with what we're asking people to do. So the podcast asks that question and you can find it available on all good and bad podcast platforms.

There's no bad. There are no bad podcast platforms.

We love.

Wherever you're listening.

That's where you can find me. And I'd love to for people to connect, reach out if you type my name into YouTube. Luckily, it's all good stuff, but there's lots of talks I've done there on anthropology as well.

Perfect.

Well, we'll definitely link to all sorts of things for everyone in the show, notes to make it easy for them to find you and to get in contact as well. So thank you again, Leanne. It was a lot of fun chatting with you today.

Thank you very much.

Thank you again to Leanne Potter for joining me on the show today. What got your brain buzzing in today's conversation? For me, I really love whenever I get to share the story of someone who has blazed a trail, so to.

Speak, in whatever their area of focus.

Is being able to shape a new space. No one has heard of or bring together two fields that people didn't think should go together. And creating a role for it is so, so cool and, and inspiring. This really is how behavioral economics came to be. And so I love the work that Leanne is doing with cyber anthropology and making that something businesses are realizing is important for them to have as a part of their team.

The research I've started doing in cognitive.

Semiotics and finding ways to apply it.

In business, I believe falls in this area as well.

Remember, just because no one has done something yet doesn't mean it would be a bad idea for you to do.

Whatever that thing is.

Yes, it can be scary at first.

But that doesn't mean you shouldn't do it.

Leanne and I and so many others are here cheering you on. So go do it. And please share whatever you're inspired to do or try with us on social media. You'll find me as the Brainy biz pretty much everywhere and Melina Palmer on LinkedIn. There are links to all my socials as well as Leanne's of course, as well as other ways to connect with her and related past episodes and books, and a full time stamped summary of the episode all waiting for you in the app you're listening to and at the grainy business.com 363 and thank you again to Leanne Potter for joining me on the show today.

It was a delight to chat with.

And learn from you. Join me Tuesday for another brainy episode of the Brainy Business Podcast. It's going to be a lot of fun. You don't want to miss it. Until then, thanks again for listening and learning with me and remember to be thoughtful.

Thank you for listening to the Brainy Business podcast. Molina offers virtual strategy sessions, workshops and other services services to help businesses be more brain friendly. For more free resources, visit thebrainybusiness.com.