Nate Fick on Dynamic Leadership and Adapting to Change

Informing your decisions with intelligence analysis and insight brought to you by the team@oodaloop.com hey, welcome to Oodacast. I'm Matt DeVoe, the CEO of OODA, and today we have Nate Fick, a general manager at Elastic, joining us. So, Nate, thanks for joining oodacast.

I'm glad to be here, Matt, thank you.

You've had a fascinating career, transitioning from the military to to think tank to venture capital, to working in cybersecurity and now kind of cyber and tech in general. Can you step us through your career and kind of how it progressed over time?

Yeah, I'm happy to. With a caveat right up front that the great lesson for me is these things only make sense in hindsight. Looking forward, it's always been, at least for me, very hard to foresee the next step from any point along the line. And then you look backwards and think, okay, that kind of makes sense. But I came out of college in the late 90s. I'd gone to Dartmouth and most of my classmates, something I observed in college, and this is probably true of many people, is people come in with a thousand interests and seem to get funneled into just relatively few narrow paths coming out. And I wasn't at the point where I wanted to go to law school or med school or be an investment banker or be a management consultant. And I wanted to do something different. I liked team sports. I liked the outdoors. I had this sort of public service impulse. And so I ended up joining the Marines. And it was pre 911 peacetime and spent a couple of years as an infantry officer in the peacetime Marine corps. And then 911 happened. And by virtue of timing and circumstance, I took one of the first American units into Afghanistan in the fall of 01 and then into Iraq in the spring of 03 and learned a lot about leadership in pretty high stakes, high pressure environments in my early 20s in the Marines. And I really liked the military because of the real responsibility that it puts on the shoulders of young people. And I freely admit I'm one of the lucky ones who came out of it physically and psychologically intact or more or less. And the great leadership lesson that I took from my combat service in the Marines was the opportunity to work for some terrific leaders and to watch them kind of in these very high pressure, high stakes environments. And I pulled one of my bosses aside once and I said, hey, sir, we would follow you through the gates of hell. And in a lot of ways we have.

Why?

Like, what is it that you're doing that's inspiring this kind of followership in us. And he sort of dismissed the question, but he followed up with me later and he said, you know, Nate, I don't really have a leadership philosophy, but if I had to boil it down, it's this, officers eat last. And there was this idea that with rank comes responsibility, not privilege. And he was the kind of leader who would sleep less, who would carry more weight, who would expose himself to more danger. And he just did it kind of naturally. And I think that, that we all instinctively recognized it. So I left the Marines as a captain. I realized that it wasn't how I wanted to spend my, you know, the rest of my professional life. If I had three or four lives, I'd love to spend one of them as a military officer. But it wasn't. It just I felt again, by virtue of timing and circumstance, I got to do so much in a very short period of time, and it was time to move on and do something else. I wanted to take that experience of building and leading teams and try to do it in a civilian context. I went to business school to tread water and figure out how to apply that experience to a different context and ended up again in a way that you can't plan, running a nonprofit, the center for New American Security. Michelle Flournoy had started it. She went into the government as the undersecretary of Defense for policy and asked if I would run the place. And I hadn't gone to business school to run a nonprofit like that wasn't in the cards for me. But I loved the mission, I loved the team. It was a chance to lead something and shape a culture from the beginning. And my business school classmates met candidly, looked down their nose at, at nonprofit leadership and management. And in hindsight then having a decade of kind of high growth tech and larger company experience later, I realized that nonprofits are a great leadership training ground because you don't have money and stock options to throw at people to persuade them. It really all comes down to mission, vision, values, culture. And so that ended up again being a really formative and valuable leadership experience. I at the same time was an operating partner at Bessemer Venture Partners. I've been an end user of a lot of security technology. As a Marine, Bessemer was building an investment thesis in security. I got to know some of the team there, really liked them like the firm, and so spent then almost a decade at Bessemer and ended up as the second CEO at Endgame, a company that had raised a series a was going through a leadership transition. And so I showed up on day one in the software business with military experience and an MBA and some nonprofit experience, but really otherwise kind of a fish out of water. And what I realized is I think that the core tenets of leadership across all these different contexts are pretty similar. And the big one at endgame, maybe for me was CEO really ought to stand for Chief explaining Officer. Something I realized as companies grow, especially during that high growth period where you're changing so much that it's a different business almost on an annual basis, the job of the CEO is to build context and build shared understanding of what's going on. And that requires saying things until you're blue in the face and then saying them again. So. So if I look back on it, just to summarize, I think that notion of servant leadership in the Marines, and then the focus on mission, vision, values, culture from the nonprofit world, and the focus on communicating and over communicating in a startup environment, those are probably the sort of tenets that I think I'll bring to any leadership experience I have from this point forward.

Excellent. Along the way, you wrote a book, One Bullet Away, which my copy is pretty beat up because both myself and my daughter have read it and highlighted it. So it's got, you know, the dual format she highlights a lot prettier than I do with squiggly lines, et cetera. But what was the catalyst for writing the book, and what did you hope that folks would get out of it in reading it?

Yeah, you know, again, these things seem linear only in hindsight, but I had never written anything longer than a college term paper. And I got out of the Marines in 2004, you know, pretty, pretty early in the, in the campaigns after September 11th. I'd done my two combat tours and I was getting rotated out to a desk job for a while, and that's wasn't what I wanted to do in the Marines, so it was time for me to get out. I was in a unit at that time, a reconnaissance unit that, that where we could pick our own replacements. It was sort of a tap system. And the guy I picked to take over for me and take my marines then back to Iraq on another tour was a great infantry officer named Brent Morell. And Brent was killed In April of 2004 in Fallujah, you know, literally doing my job. And it affected me, you know, deeply because, because I, you know, I had essentially put him in the role. And I felt like at that point, you know, we heard from journalists and we heard from generals and we heard from politicians, but we hadn't heard a lot from the people who were on the ground. And so I, I had a bunch of journals, I had a bunch of pictures. I had, you know, pretty, pretty recent searing memories. And so I just sat down and started writing. And I thought, you know, maybe I'll publish it, maybe I won't. I'll stick in a desk drawer and show it to my kids someday. But that was, that was the genesis of the book.

Great. So just kind of to capture that there a couple of things. One interesting highlight that I found that was actually my daughter, as I mentioned, we kind of both read it back several years ago, is where you talk about being at the risk of dismissal for failure to adapt. Can you stop us through the process of how you learned to adapt? Because your career, as you described it subsequently, there's been a lot of adaption to be successful. So I'd love to get your thoughts on that.

Yeah, it's funny, I was kind of an unlikely, in some ways, member of the military, or at least I thought I was. And people have this notion of the military as like goose stepping automatons. And you know, actually my experience was there was a lot of room for free thinking and innovation and problem solving and creativity. But that all comes later. And early on, you know, there's a focus on conformity and like getting you to be a part of this unit and part of this organization. And that was a hard adjustment for me. I mean, you come off a, you know, a late 20th century college campus and you get your head shaved and all of a sudden like you're a number. But that is an important part, I think, of the psychological transition. But I had a hard time adapting to that. And even now over the bar at our home, I have a framed letter of reprimand that I received from a boss who pointed out that maybe I had issues with authority. So there were aspects of military life that, that were challenging. But fundamentally, I made my closest friends in uniform and I'm profoundly grateful to have done it. But I think that a more kind of natural expression of my personality was more in the entrepreneurial ecosystem.

Got it. It seems also in reading the book, and you can correct me if I'm wrong, that you kind of adopted a little bit of a stoic perspective as well, kind of living in the moment and taking advantage of the moment. Is that a fair character or am I misreading that?

It's a really astute characterization. No one's made that observation to me explicitly before, but. And I don't even think. I don't mention this in the book, but something I had in my rucksack the whole time I was deployed in the Marines was a copy of the Meditations of Marcus Aurelius. And I think that's as good a guide to living in combat in the military as any, and just having a, you know, a deep sense of kind of peace and equanimity with where you are, because you're, you know, you're literally facing death every day. And even worse, you're. You're ordering people or exposing people to their deaths every day. And that can be psychologically, you know, incredibly corrosive. And you got to find a way to reconcile yourself to doing that and doing it, trying to do it well and trying to do it with, you know, a moral sense and a sense of purpose and honesty and transparency, and. It's hard, but, you know, in the kind of truest sense, I guess there's nothing new under the sun. And the Stoics were there, you know, 2,000 years ago. So that was very much something that mattered to me. And I love that you picked up on it. Thank you.

Great. I always like to think I'm a thoughtful reader, so I'm happy to have kind of picked up on that transition. Do you feel like that that kind of guides your life now as an entrepreneur and executive in a technology company?

You know, I think it's something to aspire to. I'm wildly imperfect at it, but I think every entrepreneur can identify with the emotional ups and downs. Right. I mean, it's such a roller coaster. One day you think I'm building the most important business in the history of my industry, and the next day you think I'm on the brink of ruin and embarrassment. And you can toggle between these things so quickly. And I think that whether you're, you know, in a military unit, in combat, or whether you're in the early stages of building a company, I think as a leader, you feel a profound sense of responsibility for the people. You know, all these people who've thrown their lot in with you, all these people who are relying on your judgment and your decisions and their reputations and their livelihoods and their ego, like all these things are at stake. And. And I think that one of the journeys that I won't say I went through, because I think I'm still going through it, but I'm a lot farther along than I was before is taking those ups and downs and compressing the amplitude. Try to be a Little bit more steady, a little bit more even. And just tell yourself the good days are never as good as they seem. The bad days are never as bad as they seem. And there's a real value in consistency and being level headed, come what may.

Excellent. Yeah, I've always found that from a leadership perspective. I think I've found, especially in startups, I have more stress about my employees putting food on the table and the impact to them than my family personally. And that's something I've always tried to reconcile until I finally accepted and said it's okay. That's the essence of leadership, is that you're taking responsibility for others. So obviously that weighs heavily. Gotta get that thematic as well.

I think it's a really good thing, Matt, you know, and I wanna work for people and on teams who have leaders like that. And so it's a good, it's for, I feel like it's a good behavior to try to perpetuate. We had a company picnic once at Endgame, you know, early on when it was one of those times when like things felt very precarious to me and I didn't know how it was all gonna turn out. And I just, I remember looking around not only at the employees, but at their spouses and their kids and like thinking about all the braces and all the eyeglasses and all the school tuitions and all the car payments and all the mortgages and like all this stuff that all the, you know, peaceful home life and everything that depended upon on us, you know, doing this well and doing it right and Frank getting lucky too. And yeah, it is a real sense of responsibility and you know, there's a lot of cynicism I think today about business writ large. But the fact is, you know, businesses are such a, such an intrinsic part of so many of our lives, our employers, our spouses and employers, and we rely on them for so much that I think if you're going to be an entrepreneur today, I hope that, you know, you can believe in the power of businesses to do good in society, you know, to do good by their employees, to do good by their communities. And I think that the, I don't think that's in any way at odds with, with a profitability imperative.

Yeah, no, I agree. That means to spend money. You know, as a business person you want to take care of the employees, but you can make a strong business case as well for taking very good care of your employees. At Fusion xmr, we paid for the very best health plan I could provide and we paid 100% of the cost and a lot of employees said, well, why would you do that? Or we could save expenses. And my perspective was that healthcare is a huge stressor for families. It's a huge distraction. If you gotta go get three referrals to make your way to the ear specialist to check on your kids issues, that creates stress and anxiety. And if there's something I can do that at the end of the day is not a huge expense. It helps minimize that stress in that environment. It makes them also more productive as employees. It's beneficial to the employees and you're taking care of them. But there is a business benefit as well to treating your employees as well as you can, certainly.

And you know, I think in security, and it's true in many industries, but I think it's definitely true in security. The talent market is so tight, right. And everybody is in a sense a free agent. And you gotta persuade people to join your team, you know, commit and give their time and their energy to what you're trying to do. And that absolutely requires you to treat people really well.

So how did you find the transition to security? That was a question that I wanted to ask you. It is a fairly tight knit community and you came in primarily as an outsider. You had the military experience but didn't have the cybersecurity experience. So how did you adapt to being a leader in the cybersecurity community?

Yeah, yeah, I think it's a work in progress for me still. I'm, I'm not the kind of security entrepreneur executive who's going to be on the blackout review board. That's not me. Luckily Jamie Butler on our team is. I think you are. And I'm not a guy who's been steeped in this stuff since I was 14 years old. But I think that the security community is motivated by an incredible sense of mission and purpose. Like that's if I boiled it all down to like, you know, what are the, what are the sort of the tenets of this community? There's like a really healthy technology geekdom for sure. And there's a massive sense of purpose and a belief that what we do matters and that what we do is intrinsic to, you know, basically. I mean, I don't think it's hyperbolic to say like the future, the future of the economy, the future of the nation, the future of the world. So throw me into a group of really smart and mission committed people and I think I can find my way. I've been really fortunate to work with an Incredible team of security technologists over the course of the last decade who have helped keep me honest.

Excellent. We have a great reputation, as I mentioned, it's a tight community, lots of information sharing and tremendous amount of respect for your leadership, the style and what you've done with the team at Endgame and now at Elastic. So you're definitely doing something right because you have a great reputation as a kind of outsider who came into the community to lead some of these, the hyper geeks.

I appreciate that. Thank you.

I want to transition and ask you a little bit about kind of the world in general, but I'd love to hear more about what you're up to now with Elastic. Endgame was acquired by Elastic. And so what are some of the important issues that you're working on there right now?

Yeah, for sure. Maybe, maybe I can answer that by kind of going backwards a little bit and telling a little bit of the story that brought us to this point. Because, you know, I think that, that, you know, teams go through these journeys and I know you did, you know, leading the team at Fusion X over, what was it, seven or seven or eight years, like about the same duration as my journey at Endgame. And over the course, course of those seven or eight years, like I think we as a team began to develop based on experience, some, some really deeply held kind of core convictions about where things were going and what really mattered. And they almost exist like, sort of like at the level of philosophy. But, but I'll try to tease, tease them out a little bit because they informed what we did. One was a belief that this incredible tight knit nature of the security community is almost Shakespearean. It's like the community's greatest strength. But it can also, it can be a weakness and there can be an inclination to draw the dark curtain across and say, hey, either this is classified or this is, you know, you wouldn't understand. Just trust us. There's a little bit of a black box in parts of the security community. There's a little bit of this black box ethos and not everywhere, of course, but it's there. And you know, we, I, we developed a conviction that more openness in some sense and security was going to be a good thing. Good for culture and recruiting and diversity and inclusion and just the idea that we're in this competitive talent market. I want to be able to fish in every part of the pond to build a team. Good for customers who generally aren't served by black boxes, generally aren't served by vendor fragmentation. Good for the users who generally are best served by a rich ability to customize and to develop a workflow that fits into the way that their team or their business operates. So there was this emerging conviction in our minds that openness was going to matter and was going to be a big important part of the future. There was an emerging realization in our minds that, that the data problem was becoming increasingly overwhelming. Right. That for a few years we were focused on the kind of, I'll call it the front end of the product. And by that I don't mean the user experience necessarily, but I mean features and functionality that are in security, kind of caught in this never ending cat and mouse game with the adversary where every attacker TTP results in a new defender ttp. And while we were kind of pursuing that kind of game of 10 foot walls and 12 foot ladders, we realized that we had re architected the back end of the product a couple of times in order to try to keep up with the overwhelming data challenge. And the second time we went through that process, we ended up long before joining forces with elastic. We ended up choosing Elastic as the back end for the endgame product because it solved the scale and speed issues that we thought were going to be increasingly like core and prevalent in what we were doing. So there was this openness issue, there was this core data issue, there was a cultural issue and sort of a belief that every aspect of technology obviously requires a lot of innovation. Something that's unique to security is the fact that you've got a living, breathing human being on the other end of the connection. Right. And so it introduces this different competitive dynamic, not only market competitive, but like adversary competitive. And so all of those things kind of led us to, as I look back on it again, these things sometimes only make sense in hindsight, led us to combine endgame and Elastic. I reached out to the Elastic CEO Shai Bannon and we got to know one another and it was clear that elasticsheritage as an open source business and hundreds of millions of downloads of the Elastic stack globally and big global community of users. This organic grassroots, bottom up enthusiasm, coupled with the core elasticsearch and the Elastic Stack and the ability to make sense of vast amounts of data in a way that we thought was differentiated for a long time and culture, like back to that point about talent and people and recognizing that like if we're, if we're going to join forces, we need to bring the team along or else the value goes away. And I was going to have a really hard time bringing the team along. Into a combination that they perceived as legacy or like stepping backward. It had to be a step forward in an exciting direction. So anyway, that's the backstory to kind of get to where we are today.

And so today the focus is. It kind of reminds me of a conversation I had with Max levchkin probably about 2011 around when is data science going to have an impact in cybersecurity? And we said there's kind of a pathway where three things needed to happen. First, cybersecurity wasn't collecting the right data. I mean, we're collecting data, but it wasn't the right stuff with the level of granularity. And I feel like with Endgame, you help to start solve that problem. Second, you're going to have to be able to store it en masse to be able to do the real data analytics, which is kind of the elastic piece. And now the combined entity is. You have to be able to apply the data science to the data that you've collected to solve those problems. So it sounds like that casual conversation we had around his whiteboard has been really what has evolved in the end game. And the elastic combination.

Yeah, I think that's right. And I'm never going to have, you know, like, my credibility will always be questioned in this because it sounds like I'm talking my own book, but I absolutely believe those three pieces. And I would even add a fourth, which is like, you know, it's not enough then to be told, hey, you got a lion in your house. Like, you got to enable some sort of response that is actually going to be, you know, timely and appropriate in a business context to solve your problem. And I think that we have those four elements now by kind of taking a decade plus of massive commitment to the core data problem at Elastic, and then injecting a couple hundred people with their proverbial 10,000 hours of security expertise and say, okay, this is a powerful combination. And so I think that a customer lament that I heard all the time at Endgame and that I think that many in the security market identify with is we had security users in the SOC who were making these kind of devil's choice decisions about what data they kept and what they ended up on the cutting room floor for cost reasons or for retention reasons, even absent cost, but just sheer likability, and we can eliminate that and eliminate those kinds of decisions and say, okay, you need the ability to ingest all this security relevant data or potentially security relevant data. You got to be able to store it for some meaningful period. Of time and make sense of it and act on it and do it all in a cost effective way. And, oh, by the way, do it in a way that doesn't add to the vendor proliferation and fragmentation in your, you know, in your, in your environment. And so that's kind of fundamentally the problem that we think we can solve.

Excellent. Yeah, happy to. You know, as a guy who runs a company named after the OODA loop, I'm happy to add the act component into that cycle. So. Yeah, cool. You mentioned kind of the unique nature of cybersecurity and that you have the living, breathing adversary on the other side and you wrote the Harvard Business Review article that I wanted to write about turning the map in cyber. So step us through, kind of your perspective. What do you see as kind of the threat environment out there from a cybersecurity perspective?

Yeah, so one of the realizations I've had as a, you know, as you said, an outsider coming into this community is that I think we all, we all bring our own kind of experience and some preconceived notions to any problem that we're working on. And some of my preconceived notions and experiences are apart from this community. And I've tried to apply them here in ways that might resonate. And that idea of turning the map around was something that was drilled into me and the Marines. In that case, we did it literally right. If we're launching an attack or doing a reconnaissance or something, literally take your physical map and turn it 180 degrees and look at your plan on the map from the perspective of your adversary. It can be really illustrative. All of a sudden you realize, like, oh, man, you know, from this hilltop, they have a line of sight into exactly what we're doing or what we wanted to bring that kind of bring that perspective to bear in cybersecurity. And that meant, I think, stating, trying to state that the best defense in cybersecurity is not a good offense, at least not at the, not for a company. You know, it might have some validity for nation state, but not for companies. And the most effective defense is informed by a very fine grained understanding of offense. And so, you know, we wanted to take some of the best offensive operators we could find out of places like NSA and the Air Force and, you know, other parts of the government and task them with building the defense that they didn't want to encounter when they were, you know, when they had the American flag on their shoulder. Right when they were doing things on behalf of the Nation. And at a conceptual level, that framework proved to be pretty helpful. So sorry I lost the thread on where I was going with that, but that's the mindset. Yeah.

Yep. No, I definitely can relate as, you know, 25 years as a Red Teamer, that's getting the perspective that we've taken is the outside in or even with the mirror image training that we did back in the Terrorism Research center days. The idea was to get the good guys thinking like the bad guys, to better understand perspective from an adversary perspective. Is there a particular attack vector or set of attackers that you're most worried with or that you think we need to be concerned with?

Yeah, it's interesting. I tend to look at activity in the cyber domain without getting into a semantic argument about whether this is a domain or something different. But online activity by geopolitical adversaries in my experience, tends to track somewhat their behavior elsewhere. Right. It's another tool in the pursuit of national objectives. So sort of, this is an oversimplification, but let's go like major actor by major actor. You've got the Chinese who are involved in a whole of government, whole of economy, whole of society, geopolitical competition with the United States in a lot of ways to define norms, values, if not globally, then at least in a large portion of the earth in the 21st century. And they're using every tool, I mean rationally and understandably using every tool at their disposal to do that, including, including cyber tools. The Russians are, you know, more disruptive, more. Let me finish on the Chinese. So think about the systemic long term. And systemic and long term, I think are two good hallmarks of Chinese cyber activity. Systemic and long term compromise of intellectual property, and particularly defense related intellectual property in the United States. And then building a social graph of people in the United States who are or potentially will be in positions of national influence and responsibility. And if you sort of turn the map around and think about geopolitical competition from a Chinese perspective, those are smart and rational acts in my view. I think the Russians are a little bit more of a wild card, right. Economically a lot weaker, demographically a lot weaker, a little bit more prone to kind of tantrums on the world stage. And you see that reflected in the cyber world. You know, Iran similarly, you know, you can sort of track changes in Iranian cyber activity pre Iran nuclear deal, during the period where the deal held and then kind of post deal. And the North Koreans are like a total wild card. And it's hard to ascribe like totally rational behavior to you know, to North Korea. So I mean, those are the big adversary actors. I think the technique that is probably most prevalent, most disruptive for most organizations is ransomware. Sometimes ransomware is tied to nation states, sometimes it's tied to criminal groups. But that's just in terms of sheer prevalence. That's probably what we see more than anything else. And then the last piece is in security. In my view, offense has a structural advantage. The proverbial dollar of offense beats a dollar of defense generally. And what that means for most companies is I don't care if you're spending, if you're a Wall street bank spending hundreds of millions of dollars a year on security, you are still going to be structurally disadvantaged if you're up against nation state adversary. And so this is one of those places where even a free market entrepreneur can raise a hand and say, we need the government very tightly involved in this space because only the government can marshal the power needed to deter nation state actors in cyberspace. If we leave it up to individual companies, even big companies, they are going to lose. And so we need to have a credible deterrent policy on the part of the US Government. That's really hard to do here for a bunch of technical reasons.

Putting your Bessemer hat on, are there technologies or principles that are emerging, either cybersecurity or at national strategic level that you're encouraged by, that will contribute to helping, I don't want to say solve the cyber defense problem, but at least contribute greatly to it over the next five to ten years?

Yeah, for sure. I mean, I'm not sure that we're, you know, everybody's hope is that you're going to see some silver bullet and there's going to be like a shift in the balance of power. I don't think that's likely. You know, we used to say in the Marines we didn't encounter a lot of problems that had silver bullet solutions, but we did encounter a lot of problems that had thousand lead bullet solutions. And you know, that's a little bit of the case here where it's like the, the combined energy of a lot of technologists and a lot of entrepreneurs and a lot of government policymakers and a lot of intelligence community folks. All of that together can perhaps tilt the balance in favor of stability instead of instability. There are a lot of interesting areas, I think one that Covid has highlighted. And Covid generally, I think in this space has been an accelerator. You know, it's as it has in so many areas of the economy, it's accelerated Transitions that were already underway. It has accelerated attention on problems that we all knew were problems, but they've become more urgent, more pressing problems because of the, because of the changes globally due to the virus. One of the ones that I think is really interesting is supply chain visibility, supply chain security, you know, the idea that risk federates across these interconnected environments. And yeah, it's, it's the take, turn the map around. Like, if I want to attack the F35, I don't attack a major defense contractor. You know, I sort of look at the soft underbelly and the mom and pop contractor that is, that is daisy chains down the supply chain. And so, you know, it's really interesting to think about how we can apply particularly some of the, some of the, you know, data science and visibility principles that we're applying in other parts of cybersecurity and federate them along those, the supply chain. You know, I think that's a, that's one of those places that can, you know, can move the needle in the right direction.

Excellent. Cool. So, want to close up with a couple of questions. One kind of from a leadership perspective, you know, what is one piece of advice you'd give to somebody that's, you know, on their, early in their journey on becoming a leader in any of the domains that you've worked in? You know, and I always like the ones that are backed by some sort of operational experience or something that happened to you. So is there a short story that you can share that led to a leadership lesson learned for the audience?

Yeah, definitely, Pearl, that officers eat last. Get in the back of the line, not the front of the line. And I think that drove home for me the importance, particularly early in your career, of looking at every job interview as a two way street. You are hiring your boss just as surely as your boss is hiring you. And the people who I can credit with whatever semblance of success and gratification I've had In these last 20 years of professional life, it's because I've worked for great people. You know, I had a wonderful boss in the Marines who taught me so much. I had a board chair, Richard Danzig at CNAS who taught me so much, a board chair, Chris Darby at Endgame who taught me so much, and now a CEO at Elastic and Shy Bannon, who is, who is just a, you know, I hesitate to say a natural because I know how much work goes into making it look natural, but people who make good ethically based decisions, who communicate well. So, you know, I think hire Your boss. And don't be shy about it. When you're 21 years old or you're 22 years old and you're sitting there and you really want the job, it can be so tempting to compromise and say, oh, it's got the title, it's got the computer. You know, I'm not sure about the person I'll be working for, but we'll figure that out. I would say optimize for who you're working for and who you'll be working with. And the title, the comp, all that stuff will come later.

It's interesting. I think it's also, you know, in the turn the map perspective, it's important for the bosses to realize. Right. That the importance of them being interviewed. I always like to share a story about someone I was trying to pursue to come and join the Terrorism Research center team. And we had lunch together with somebody that I knew from past work, and she had turned the job down. She'd turned the offer down. And then a couple weeks later, she called me up and said, hey, I've decided to come and take the job. And she said, there's something that stuck with me about all the conversations that we had. You never once said, come work for me. You said, come work with me. And that always resonated for me that as part of that interview process, you're building a team. And in a perfect world, you're building a team of leaders because as the organization grows, you have to have people that step into that leadership potential and run different projects, et cetera. So I think that's important to remember too, that if you're the boss, that you want to be creating that environment that people are going to want to work in as well.

Absolutely.

Definitely will link to your book so people can check that out. But I always like to close as a final question with, what have you read recently that's really resonated with you that you would recommend for the audience?

Yeah. So one, not to go, you know, too, too far down the, you know, business reading path. But this is one I don't read a ton of business books. I prefer to read other books and then try to find lessons for business. But I did read a really incredible book called Drive, which is about social science around human motivation and why people do anything but really fundamentally, like, what are we humans looking for in the organizations where we end up choosing to spend a lot of our time? And the author, Daniel Pink, kind of distills it down to three very simple points, and they're mastery Autonomy and purpose. So all of us have this desire, this intellectual curiosity to develop mastery in something, to get good at something, to learn something and then to demonstrate it, to be able to refine it and practice it and work on it and improve it. And so we should think about building teams where people can do that, where they have the freedom and the flexibility to do that. And then autonomy. None of us appreciates having somebody mucking around in every aspect of what we're doing. You got to be able to do your own thing. Even if you're working in a larger organization, you have to have the freedom to create and the freedom to experiment, the freedom to fail, the freedom to do your own thing. So we need to create workplaces where people have autonomy and the purpose. You know, why am I getting up in the morning and spending my one precious life on this, in this company, on this problem, in this team? And people need to have a clear answer to that. And that's like an emotional answer. Not. It's not a comp answer or a PTO answer. It's an emotional answer. And I took a lot from that book in terms of thinking in a more structured way about enabling people to develop mastery, to enjoy autonomy, and to really kind of, in their guts, understand the purpose.

Yeah, I have to add that one to my list. I haven't encountered it. I think I've read other books of his because I definitely recognize the author name, but haven't encountered that one. Cool. We'll link to that book recommendation in the show notes below. Thanks again for joining us. It's great to see you and catch up, but lots of great wisdom imparted for the audience and appreciate that.

Matt, I really appreciate it. You're certainly one of those leaders in this community as an entrepreneur, as an executive, as a thought leader. And thanks for everything that you have done on behalf of all of us and helping create the. The culture and the sense of purpose in the security community. It's a real honor to be with you. Thank you.

Well, thank you. Thanks for listening to this Ooda Loop production. For the latest analysis on cybersecurity, technology and global risks, please visit www.ooda loop.com.