Masha Sedova, Co-Founder Elevate Security on Human Risk Management

Informing your decisions with intelligence analysis and insight brought to you by the team@oodaloop.com.

Hi, I'm Matt Devoe, the CEO of OODA and you're watching Oodacast. And today we're joined by a very special guest, Masha Sadova, who's the co founder at Elevate Security. So Masha, thanks for joining us. And the first question out the gate is always tell us how you got here. Can you take us through your career and what led you to co found Elevate Security?

Yeah, thanks for having me, Matt. Really excited to be doing this. So I knew that I wanted to get into security from a pretty young age. Initially it was in computer development, but then I was really interested in the concept of attackers, good guys and bad guys. So I actually studied it in school before really you could even get a degree in security. There's a really cool program called Cyber Corps Scholarship for Service. And so there's a curriculum put together to help young students get better at skills in cybersecurity to then help reinforce government government skill sets in the space. So ended up studying it in school, working in defense contractor world for a couple of years. And in that space I got to look at Russian APT threat and threats to US infrastructure. And it was there that I began to realize that a lot of security is people attacking people with a whole bunch of technology in the middle. And when you pull out that far back, you begin to realize it's as much of a human problem as it is the bits and the bytes and the tech stacks that we're looking at. There is an adversary who is, who has intention, motivation and a goal. And then there's their target on the other end. And you can, you can play with this ecosystem and help secure it when you understand both players. And so got to do some work looking at and understanding the adversary. When I, when I was working for Defense Sector and then in 2012, had the opportunity of joining Salesforce, where I got to build and run the security engagement team. And in that capacity, I got to focus on all aspects of insider threat, both intentional and unintentional insider threat, and finding ways to get employees to make more thoughtful security decisions, be proactive about detecting and reporting attacks, secure development practices for engineers and even the security or the ecosystem for Salesforce customers and getting them to adopt security features. And in that work, I became obsessed with this question of what would it look like if our employees wanted to do security instead of had to? What if security wasn't just a checkbox or A compliance exercise because frankly that's not effective for anybody. But how do we actually move the needle in a way that our employees are part of our defense and our networks. And really started focusing that question from a totally different lens. And. And it brought me to the fields of behavioral science, behavioral psychology, positive reinforcement, gamification, and trying to understand how and why we make decisions as. As employees and as human beings. And applying it to security. Fast forward a little bit. Built a world class program at Salesforce that got international recognition. Got a teacher class as a black hat. Was speaking to Salesforce customers. And it made me realize that this was a huge unsolved problem in the security space that was a blind spot for almost all of us. The human element is the soft underbelly of security. And. And when ignored is also our trojan horse. But when unpacked and empowered is a huge element of strength for organizations in helping understand how to defend themselves against attackers. And so started elevate security almost four years ago now with the intention of helping companies quantify employee risk. And then once they're able to quantify it and understand which employees are making good and bad decisions on their network, give them a suite of tools to help with those interventions. So following up with very scorecards or tailored trainings or even leaning into adaptive access based on people's strengths and weaknesses. So I have been obsessed with the question of what is the employee element of security? How does the employee element of security look like? How do we help strengthen it, understand it and help it be part of the equation? Not a forgotten piece of security defense.

Excellent. So it seems like a deliberate word choice with security engagement. Right. Kind of choosing to engage the users, vice dictate or lecture to the users. Can you step us through a little bit? The genesis of that approach because I know it was. It was unique. Despite the fact that we'd been focused on these issues for nearly 20 years, it was a unique framework to bring to the problem.

Yeah. So the secret sauce of my work is the element of motivation. So I'm just going to back a little bit up and give people a little bit of a framework around behavioral science. So for anybody to do anything, a habit or a behavior, you need three things to exist. You need to have the ability to do it, you need to have the motivation to do it. And you need a prompt, something to remind you to do it. There's a lot of literature on this particular equation. And security teams for the longest time have only been focused on ability. I told you phishing was bad. Why did you keep clicking on it? Like, I just keep telling you more about. More about how bad phishing is, and you keep doing it. We fail to recognize there's a whole pillar of that we need to be focused on, which is motivation. Some of our employees don't care about security. Some. Some of them don't know that it's part of their responsibility and their job. They think it's the security team's job to do that, and so there's not an intrinsic desire to do it. They don't understand how security applies to their work. There's a lot of components related to motivation, and the way you tap into motivation is through engagement, which is why that word came into being. Because when we are able to motivate somebody to action and then also give them the ability, the results we start seeing is incredibly notable. And if you. If any of you who are listening reflect on your own lives, when you do something because you want to, because you're motivated to do so, what. The output of what you do is so much more, not just meaningful, frankly, of higher quality than when you're being told to do it.

Excellent. How did you find that transition from public sector to private sector? Was there, you know, any kind of interesting findings or barriers that you encountered as you transitioned from one to the other?

Yeah. Think about this a lot. It was actually a very hard transition. There's a lot of skills I spent time developing inside public sector that I didn't find translated really well to private sector. And it took me a little bit of time to figure out that even though I had a unique set of backgrounds and skill sets, that wasn't like other people in my work environment. That was actually a strength and not a weakness. It's not just public to private sector, but I also, in addition to having a degree in cs, I also have AA in liberal arts. One of the things that I've realized is I got to see connections between things in a different way than my peers who had a more traditional approach to security or into the private sector didn't see. So I'll give you one example, and that is an understanding of cultures and security cultures. The security culture in public sector is so different than in private sector, especially in tech. In public sector, the reason you do security well is because there is an enemy out there. There's like, you have secret information, like, there are lives at stake if you mess this up. And there's a sense of mission and purpose associated with security. That is one very different culture to when you move into salesforce. Or fast growing tech startup where it's move fast and break things. And your whole developer organization is from India, China or Russia and they're your golden children. So you, you have a totally different mindset in which you have to think about security behaviors and security culture in a way of let's everybody do this together. Because we care about the company, we care about what we're building, we care about the well being of our customers. And in order for our customers to succeed, they need to trust us. And in order for us to gain the trust, we need to treat their data with the utmost amount of respect, privacy and security. So it's two very different frameworks that ultimately get to the same outcomes, right? Don't click on phishing, report suspicious activities, handle sensitive data well. But it makes you realize that the same human being that swims in two different types of water needs different types of communication, needs different types of motivation and engagement. And that transition was probably the best teacher that I could have ever asked for, for this particular lesson.

So if we reverse that, if I think back to you keynoted our Fed Cyber event, I don't know, probably five or six years ago now, it's been a long time and it was one of the most popular keynotes we had, and we had had the number three at the Department of Defense, a sitting Congressman. And this session that you talked about changing the game and changing the incentives around security and insider threats was incredibly well received. So if you had to reverse that, if you're going back into the public sector, what would you take with you from the private sector that you think would be most important or most valuable to replicate?

That's a brilliant question. So there's one thing that I have learned that is true across all sectors. So what I did in the tech sector was leaning heavily into gamification, which was badges and rewards and leaderboards, which would not work in the public sector. The public sector appreciates challenge coins, which again, don't translate, but you could do that. But there's one rule that I've and one framework that I found works across sectors and that is the difference between positive reinforcement and negative reinforcement. So negative reinforcement is when we, we do something to avoid a bad outcome. So I put on sunscreen because I don't want to get sunburnt. I don't particularly enjoy putting on sunscreen, but I'm trying really hard not to get to that painful outcome. Positive reinforcement is the exact opposite, in which I know something good will happen to me because of this action. So we train our Pets like this. We train our kids to potty training run like when, when you go to the bathroom outside. If you're a dog, then you get a treat. So I'm going to adjust for my behaviors to go to get that treat right. So insecurity in almost every kind of culture, we lean heavily into negative reinforcement. Change your password or you'll get locked out. Take your training on time or we'll shut down your access. Don't click on phishing links or you're going to get escalated to hr. And there's just a lot of only opportunities to fail, right? At best, like the best news is when you never hear from security and usually when you hear from it, it's a oh God, what do they want? I really would like to stay off of their radar. We can take exactly all of those asks that we have our employees have of our employees and flip it around to positive frameworks. So gamification is one way. Say, hey, if you do, if you report phishing three times in a row, you're going to be top of the leaderboard. But it doesn't have to look like gamification. It can look like kudos or an acknowledgement from the security team ccing your manager and saying, you have an employee who's doing a great job at keeping our company secure. Thank you. If you can do that systemically and measure it, which is a whole other conversation we should get into. But if you can measure it, you can actually tie it into bonus and rewards and recognition so things that people can actually take home and get financial benefits from, you can also use it to elevate values in your organization. One of the best examples I've seen is providing a slide to a CEO for an all hands and say these are people who have gone above and beyond and detected tricky attacks in their organization. They've detected malware instances that had they deployed it would have caused ransomware in our organization. But they did the right following actions where you highlight what the correct behavior is. And we wanted to give them a shout out because while they are in sales and marketing engineering, they have done their job in protecting this company. So thank you. And now I have access and visibility to things because of security, because of good actions, which makes me want to keep doing it more. It's a huge way of flipping this mindset around and we can do it with almost any anything we ask of our employees. So if you have your annual security training coming up, instead of punishing for late behavior, donate a dollar to a charity for every employee who completes it before the due date. I've seen this work incredibly well to get 90% of the company without any nagging in before your compliance due date. So this is something that we can learn from so many other industries and so many frankly, our own parenting skills and apply it to security. Security doesn't have to be the bad news bear all the time.

Excellent. So one of my favorite quotes, and I use it in almost every presentation that I give is the famous Jack Welch, the CEO of ge, and it says you get the behavior that you measure and you reward. So you're talking a lot about some of the rewards and the positive reinforcement and kind of flipping the script.

But.

But if I'm in an organization, how do I measure that? How should I be thinking about progress against those objectives?

Yeah, that's a really great question. And frankly, this is actually one of the areas why I think human risk, employee risk is the Achilles heel of securities because we have failed to measure it so far. We've accepted compliance driven measurement, which only asks us how many people have completed the standard training. That's not actually the measure of risk in our organization. There's a measure of what people know or at least can guess in a quiz question, not what employees do. And so what you need to be thinking about is measuring the behaviors that are associated with risks in your organization and the employees that exhibit good or bad behaviors. So let me unpack that. There's a lot of words there that might be new to people listening. So let's say the risk that I care about is ransomware seems to be top of mind these days. So there's a couple of behaviors associated with that that employees would need to exhibit in order for that risk to happen. An employee would need to click on a phishing email, they would need to download malware, they would need to execute it. There's obviously permutations and combinations of this and they would need to, if they were suspicious at all, not reporting. So those are potentially one more. They might have access to network infrastructure that they may not need, for example, over access and therefore create wider blast radius. So the behaviors that I'm trying to measure is what who am I? An organization in my organization is clicking on links. I really recommend looking at mock phishing, which is helpful, but also real phishing, real world phishing, like a data sets from a proof point, like dataset. Who's reporting, even if they click and compromise. Who then detects and reports it? Who tries to download and execute malware in your machines? You have an incredible Source of this based in your endpoint logs. Even if malware detonation was prevented, you still have a log that an employee had the intention to do so probably not malicious, but are unwitting enough to try to do that. That technology had to step in and you're able to start creating a frankly a user reputation score. How good is an employee calm state even at these type of behaviors that then ultimately introduce risk. And a lot of these data sets already exist in even relatively mature enterprises. You're investing a lot in the tech in your tech stack. I was just talking to someone the other day and said Most say Fortune 1000 companies have between 75 to 100 different security tools already in place. All of those, many of those have logs that intersect with human decision. Who is trying to create change controls in your organization without prior approval or having cleared their backlog of known vulnerabilities. Who's slow in finding and fixing bugs. That's your data sets. So you actually have a lot of these logs around. Who is being more proactive and not. And what that gives you insight into is fundamentally a risk map, a heat map of your organization. Where are you likely going to stumble upon employees who are going to introduce risks to your environment in a way that you would have to clean up after the fact. And so when you're able to do that, you're also then able to tie this back to what we just talked about. Give employees very individual course correct feedback. You can say, hey Stephen, you know you're doing a really good job at reporting things when you detect it, but you're clicking on phishing links five times more than anyone in your department. It's time for us to talk about how we can level those skills up. Right? Do you want to sign up for more frequent phish test practice? Would you like to take a training? Can we talk about what tools you might need to ensure that you're detecting external emails more effectively? So there's ways that we can reinforce when people are doing great with the kudos and the all hands when we know and to measure it. And then we can also course correct when people are off based exactly on what they're doing, not on what they know. Because the difference between Steven and having a perfect test score on a quiz for annual security training and him ignoring red alert banners in his browsing and in his inbox and proceeding are a world of difference. And that's really where the gap is in our capabilities right now. Thinking about knowing and doing and measuring.

Those two things, it seems that Collecting and analyzing that data helps us create learning organizations. I mean, one of the books that I recommended to cybersecurity folks a couple of years ago had nothing to do with cybersecurity. It was a book called Black Box Thinking, and it looked at how our ability to collect and learn from lessons, learn from experiences, contributed to an improvement. Our companies. And it contrasted two different industries. The first was the medical industry, in which even when you had notable instances where there was negligence or failure to speak up or something that happened, it was always attributed to kind of just circumstance. It wasn't something that was documented. How do we. How do we learn from this? How do we prevent it from happening? And the second example was the commercial aviation industry that took the opposite approach. That said, every time we have an accident, let's go and figure out what were the root causes, how do we put prevention measures in place? How do we improve, you know, the public safety associated with flying? So it sounds like, you know, part of what you're doing at Elevate is almost helping create the black box for human risk where now, if we're collecting and analyzing that data, it also allows the organizations to actually drive learning and change organizational behavior, controls that they put in place, technologies that they put in place, what are working or what are not working. Is that kind of a fair characterization?

Totally. Right? Because when you can measure it, you can also figure out when you add a new control or a new intervention, is it as effective as you thought it would be? And when I say interventions, there could be so many things here, right? It could be an email from the CEO to employees that said, hey, this is important, please pay attention. It could be adaptive access, right? It could be stricter 2 FA timeout policies, but then you can start mapping. When you do this kind of implementation of a technology or a process, does it reduce the risk in the way you expect it to? To your point? And you can start seeing this as a system. It's no longer a. We're crossing our fingers hoping our employees will stop being dumb, Right? Like, which is frankly the approach we have today, but truly looking at it much more from a researcher experimental standpoint. As you were saying, how do we learn from what just happened? And how do we apply best practices? Because. And the exact opposite is true. Take a look at the employees who never get popped, who never get phished, who never down the knob. What are they doing right? What are their managers doing right? What kind of systems are they on? Because we have pockets of great in our organizations, hopefully that can teach Us what we should be doing for the rest of the organization. And without understanding who's doing a great job and who's not, we're flying blind.

Sure. No, that makes sense. So, you know, we get a lot of focus on human factors. Right. And I think that was the theme of either RSA or Black Hat in the past couple of years. Human risk. I like how you frame it around the unintentional insider threat. Right. Because we tend to think about insider threats as being malicious or disgruntled. But really a lot of those behaviors are not intentional, they're not purposeful. It's just a result of the bad behaviors. What is your greatest challenge as a company and thought leader in this space and educating people as to the new way forward? Because we seem pretty entrenched in a lot of old ideas. So how do you serve as the icebreaker? What's kind of the biggest challenges and how do you overcome that in the conversations that you have?

Yeah, that's a good question. So I think about this in a couple of phases based on maturity of companies we're talking through. Some companies only focus on phishing as the one element of human risk that they measure and say, no, I'm good. I can tell you how many people click on a phishing account, how many people don't, and it stops there. When in fact, we think about there's a huge ecosystem of things that we do that's good and bad. The way we handle data, the way we browse, how we treat our device, security, mobile, how we share information. There's so many nuances. The second piece is let's just only focus on the bad. There's also really great things people do that helps us with that understanding. The other thing that's just probably the biggest hill to climb is this preconceived notions that employees are the weakest link. That is an absolute truth. And that any investment into the same space is a waste of time and resources. And that the only way forward is deeper investment into technologies, the newer and the shinier, the better. To help course correct for the stupidity of employees. And what that does is it creates an us versus them mentality where there is no desire to understand what the capability is of the employee base. And just it's a complete throw your hands up in the air. I can't figure out how to make an employee less dumb. So therefore it's the employee's fault. It's not my fault to do that. So we should invest in technology. I see that thinking in a lot More I would say old school CISOs. I'd see the newer generation and CISOs who are up and coming understand that if they work with their employees and work with their business, it it's a win win, right? You get to secure your organization, you get to move faster as a business and you're not the dreaded mean security team. You're an enabler for the business to accept the right amount of risk for your organization. So that's probably the biggest mindset shift that I see today.

I would think that the overbearing use of technology and technology controls also is counterproductive to a lot of the emerging cultures like as you mentioned that kind of move fast and break things and the wanting to empower employees. You know, you can stifle creativity by restricting their access to technology, when in reality you can give them that creative space that they need by just helping them adjust their behaviors.

And the other thing, it's kind of a point you just hit on is how much communication transparency should I have with my employees. This is probably one of the newer ideas for people because it's usually the security team sitting here monitoring and we create user reputation scores. And so many of our customers say well, does that make me look like a big brother? There's a second component which you find a way to communicate an employee's progress and give them feedback. That last part is so brand new and such an uncomfortable concept for us in security because yes we will monitor and yes we will take action but, but actually talking to the employee, actually letting them know where they stand, actually giving them the tools so that they're part of a willing participant and helping up level is frankly one of the biggest eye opening experience for many of the customers that we work with because we've seen that when you engage in play with transparency and respect and explain to them why this is important and why you need their help and what you need them to do, 90% of your population is going to join you in helping the company more secure. There's a 10% that is going to be dig their heels in the ground. And I would put that into more of the malicious insider threat. But do not treat the rest of your population with the common denominator of the 10%. Those are two very different approaches around how you tackle this problem. And the majority of your employees will value and respect that level of transparency and feedback and frankly understand security is a problem. They just need more help and guidance around what they can be doing differently.

What's crazy is, you know, one thing that I always articulate to CEOs and boards is that cyber risk is something that needs to be managed like other risks in the business or other opportunities. And if we look at just, you know, getting employees to engage in more productive behavior to allow them to focus where creativity and creation of intellectual property, we do that through communication, we do it through reviews. We address problems with open door policies and hotlines and reporting. So in cybersecurity, again, it seems counterproductive that we wouldn't take an approach that enables that communication and that feedback loop. Because at the end of the day, as you said, 90% of the people once empowered want to improve, they want to do better. They care about the mission in the organization that they work for, but absent of that information, they're lacking the material guidance and how they can actually improve security.

Exactly. We use this model, as you said, so many other parts of the business. Why not in security?

Yeah, definitely. What are the things about elevate security, should we know about? What are some of the key innovations or approaches that you've taken in the market that have resonated well?

Yeah. So I have two different hats. I'm going to answer this question. One I want to tell you a little bit about sort of how we're thinking about this industry. We talked about user reputation, what happens once you know your score, the good and the bad is what you do with that. We've created a scorecard, exactly what we've talked about for transparency, that uses cool behavioral science concepts like social proof, that compares my performance to my peers. And one of the things that I've learned in my career is that you're not going to get everyone to care about security, but you can tie security to things that people already care about. So winning recognition, we just talked about a little bit earlier, belonging, understanding what normal looks like. And if you can give people concepts like everyone else is doing this, you should too. The numbers that we see in reducing phishing, click through rates, increasing reporting are just off the charts because it's reframing that. So we're doing that really cool thing in another area that we're leaning into is once you understand who's good and bad at security decision making, you can think about adapting your policies more effectively. Because CISOs today are kind of stuck in between a rock and a hard place where if you have two loose controls, you have an incident that might happen. But if you have two strict controls, it might be relevant for some, like maybe 10% of the organization, but it might be considerably overbearing for Many other people. But the amount of work it takes to adjust for that is, frankly, unless you can do it in an automated way, you can't really solve for that. So when we think about intervening and helping employees level up, there's a communication, transparency, but there's also an adjustment of controls and policies that will help protect the business up until the point where the employee is able to level themselves up. So that's a super cool place where we're helping the industry evolve. The second thing that I wanted to answer this question is on company culture. So we, when I set out to start elevate, I wanted to make sure that we were prioritizing diversity inclusion from the very beginning. And so Today we are 40% women, 35% minorities, and we have an all female outside board, which is unheard of in cybersecurity and enterprise space. Our leadership team is 40% women as well. And so it's just really exciting because we get, we're doing really thoughtful, my thoughtful, meaningful work that's moving the industry forward, but we're doing it in a way that doesn't look like what traditional security practitioners look like, but happens to.

Be the way the world looks and their employees look.

Yeah, exactly.

Cool. Well, I do want to shift gears and talk about Masha, the leader. Right. So as I know, working in government jobs, you know, a little bit of obscurity associated with that. And then you jump into Salesforce, you know, have a tremendous success, becomes very high profile. Now you're keynoting at conferences into the female co founder of what is a very diverse and kind of leading edge company. What lessons have you learned along the way by way of your kind of professional growth and that, that challenge and transitioning to entrepreneur?

There's a couple, couple of things here. I alluded to this a little bit earlier, but, but this one was a hard lesson for me to learn. And it's in tackling imposter syndrome. When you walk into a room where you think different, you might look different, but all of us have a way that we're different from the people around us because of our unique experiences. And instead of just trying to fit in like everybody else, appreciating the fact that your unique experiences help you connect dots that no one else can. And that takes some amount of courage to do that and speak truth to what you're seeing. Because I'll tell you, when I joined Salesforce and we were doing this check the box training, I looked around and said, this is crazy. I'm working with all these smart People, how is this the right approach? And I remember thinking, I'm probably. It's probably me. It's not them. It's probably like, I should probably just swallow this idea. And I couldn't. I couldn't go to sleep at night thinking, like, thinking, this is the way forward. And so I had to say something about it. Similarly, that level of, like, I have to do something about this, like, I care about this problem enough, led me to leave a comfortable corporate job to start my own company. And so it takes courage to lead into the things that you want to see happen. And it takes a lot of courage to be the first person to do it. But that doesn't mean you shouldn't do it. It doesn't. It actually, that might be exactly what the world needs. When you, Matt, you're a founder, you know what it's like too right to break. I mean, you're the founder of a lot of different new things, so you. You probably can speak to this as well, and what it takes to start something new.

Yeah, I think that's, you know, the courage aspect is definitely part of it. And I often will tell, you know, entrepreneurs, and they'll tell me, well, when is the right time for me to do it? You know, and if you have to ask that question, it's probably not the right time. And of all the time I've spent on stage at Black Hat and Def Con, et cetera, I think the most tweeted quote that I have from the stage at Black Hat was the acknowledgement that we all have imposter syndrome. This is a highly technical, high areas of specialization. You are not going to be an expert in everything. And I think the diversity of approaches and opinions and experience that we bring is a strength to the community that. So we should certainly be trying to get people to have the courage to speak out, to take those risks, to pursue those opportunities, as opposed to saying, well, I want to be the next Charlie Miller, or I want to be that. I mean, those types of goals are great and emulation is great, but even after 25 years, you still get that sense of imposter syndrome in the industry. And that resonated with others as well, obviously, because it was very impactful when I set it on stage.

Totally.

Thanks for raising that.

Yeah. I mean, I have it every day, and it doesn't matter how many keynotes I do. It's just the. Is it. Is it enough? Right? Is it. Is it. Yeah. Am I. Am I doing. Doing it right? Here's the punchline. There's no doing it. Right. You have to figure it out and find your voice, find the things that light you up and find the work that. That needs to be done, that you want to. That you want to do. Because then it stops being work. It starts being a purpose.

And if you don't feel like an imposter, you're probably not challenging yourself, which is fine as well. Like, some people get very comfortable and that's going to be their field of contribution. Right. Not to belittle that, but, you know, you obviously need to be continually pushing the envelope and this recognition that circumstances are dynamic. On utacast, when I talked with Kevin Roberts and we talked about the new normal, and he basically laughed and said, we're fooling ourselves. There is no new normal. Like, the new normal is that normal is disrupted. It's constant change. It's dynamic. It's the ability to adapt in that world that is going to allow people to be successful. And we're seeing that now not only in the cybersecurity community, but even just in industry and in response to the challenges associated with a pandemic. Right. You have to be able to. To adapt and overcome and face those challenges.

Yeah. I really love that. It's a great interview.

This is a great interview. But the one with Kevin Roberts was definitely, you know, he wrote one of my favorite books of all time. So it was great to get to pull those, those pieces of wisdom out of him.

Yeah. But it's no fun to have your. Your bubble burst and says, you mean there's never been a normal? It's always going to be like this. It's uncomfortable.

Yeah, definitely. But kind of is the way of the world. And with all the challenges that we have, you know, with, for example, my children are being schooled remotely right now. Right. It is building a certain resilience. It's showing them that you can disrupt the norm and you can overcome it. It's not going to be easy and it's going to be different, but there is always a way forward. And I think that's an important lesson to have.

That's true. Yeah. Yeah.

We always like to close on, you know, picking your brain with regards to what are you reading right now or what are you watching or what are kind of sources of inspiration for you as you go about your very busy daily life.

Yeah, I think about the way that I input information to my brain. Three categories. One, I like to find thought, leadership and security, one about the world, and one on leadership and growth. So my favorite go to resource one of the people I really like the way that they think about the security space and the trends is Kelly Shortridge. She's pretty active on Twitter, recently published a really great and very zesty article around FOMO Security. She calls out some of our ego driven trends in that article. But in general she's she's a very funny and very sharp writer. I recently came across and this has been now a staple for me in the last couple is in the last couple of weeks is the Aspen Institute and they publish five big ideas every day that show up in my inbox and it's like five things about the world and how things are trending and it helps me just think about what's happening in sort of a bigger, bigger way. So digest the news into like here's things that will actually make me make me more thoughtful human being and I just recently finished up a book on leadership called Dare to Lead by Brene Brown. And if you are a leader or a manager, just a human being. I can't recommend this book enough. It talks about how you lead with vulnerability and how vulnerability lets you connect deeper, inspire more frankly, be more human and how that creates more meaningful connection. And the work of Brene Brown has just been transformative in my life, both in leadership but also on a personal level. So if you haven't had a chance to check her out, please do. And on a personal note, because I'm also human, I love watching. I just finished the Queen's Gambit on Netflix, so please do.

We just started that one episode in.

Yeah, it makes me want to pick up chess again.

It is universally, you know, on my social media feeds is beloved and recommended by people that typically don't take the time to recommend TV shows. So there's a metric there, you know, that they're taking the time to let people know how fantastic a show it is. So look forward to finishing that out. And we'll put links to everything that you mentioned in the show notes associated with this episode as well.

Great.

As well as some links to some of your, you know, we'll link to your RSA talk and some of your other presentations so people can learn more about Elevate Pleasure.

Matt, do people ever ask you on this call what you're reading?

They do. In fact, somebody turned the tables and Jen at OODA actually did a full interview of me on oodacast a couple of weeks ago. So that's posted on YouTube now. I recently and it's funny that you ask because we talked about this earlier, just read Cory Doctorow's latest book, Attack Surface. And Corey is interesting in that, you know, I met him back in the days of, you know, early days of eff, around privacy and security and countering state surveillance and things of those sort. And he went on to become a best selling author. He wrote a book called Little Brother that was about a terrorist attack that takes place in San Francisco. And the surveillance technologies that get put in place that are very, very counterintuitive to what we would think of, you know, imposing on the. The privacy of our, of the citizenry and a group of high schoolers that are hackers that go and disrupt that. And that book, even though it was a young adult book, used to be required reading for my Georgetown graduate students because it educated them in a way that was informative. So the third in that series is a book called Attack Surface. And the protagonist is a woman named Masha who comes out of the defense community and moves to San Francisco and goes to Burning Man. So I had to ask you earlier if you knew Corey, which you do not. So it's just a coincidence. But it's great in that it's this, you know, the divergence from your story is that there is a reckoning for her where she was basically working in the equivalent of an NSO group or black cube or one of those entities that is really kind of creating technology that is being used in very abusive ways by oppressive governments and kind of reconciling that. But it does a great job of taking us through that narrative. It does a great job of explaining those technologies and how they work. And it does a great job of explaining the challenges associated with trying to counter them and how that might be a losing battle. So it takes the approach which is similar actually if you think about the thematics associated with Elevate that we look for technology solutions to what are human problems and that the solution to more government surveillance is not more government surveillance technology is not more counter surveillance technology. It's politics, it's people. So, you know, important message there. So that's my latest. Just finished that up. It'll be in my newsletter review. But you know, but I'm constantly have three or four books that I'm reading at any one time.

Awesome. Yeah, I for the namesake alone have to read it.

You definitely do.

Sounds uncomfortably close.

I have to say. It's a good thing I did the audible versions. I listened to it with my 12 year old hacker, you know, which was great because he asked a lot of questions and learned a lot of things. So. But it's a good thing I did the Audible version or if I had read it, it would have read it in your voice for certainly so triggered early on with Masha the hacker for me.

Well, next time I see your son, I'll tell him I'll try to play up to the fact that that's. There we go, see how far it gets.

Yeah, he probably will sniff you out pretty quick.

Okay, excellent.

Well, thank you so much for joining us. This has been informative. I've loved the conversation. I love what you're doing at Elevate and look forward to more conversations in the future.

Thanks, Matt. Really appreciate the time. Good conversation as always.

All right, take care.

Bye. Thanks for listening to this. OODA Loop production For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.