Cybersecurity Vault - Leadership in Crisis with Dr. Alexander Stein

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, cybersecurity strategist and CISO at Eclipse. Today we're going to talk about leadership in crisis, and I'm going to be talking with Dr. Alexander Stein. Dr. Stein is the founder of Dolis Advisors, who specializes in advising CEOs senior management teams, corporate directors, and founders in organizational issues. He's also a contributor to the Forbes Leadership Channel, a member of the FBI Infraguard program, and serves on various leadership boards. Today's podcast is created in part by Eclipse, securing data in transit through any cloud, network, or device. So as we all know, cybersecurity Well, it's tough, it's stressful. The attackers maintain several different important advantages and the stress level can be through the roof for cybersecurity professionals. Leadership, especially during crisis, is a pivotal factor in determining success or failure. So let's get the expert's opinion here and his insights. Welcome, Dr. Stein. Thank you for coming and talking with us.

Thank you so much for having me, Matthew. It's always a pleasure to speak with you, and I'm really excited to talk about leaders and crises with your viewers.

Well, it's two of my favorite topics. I love leaders and I love crisis, right? It, it really shows what they are and what they can be. But what does good leadership, especially in that crisis world, what does good leadership look like?

One of the best things about talking about leadership in crisis is that you get to look at of leaders and crises that come together. In other words, there are lots of leaders that end up causing crises and then there are leaders who are effective or less than effective in responding to crises around them. Good leadership is leadership that can embody poise under duress. Leaders who are able to manage themselves well and maintain their composure, don't lose their cognitive functioning, don't convey anxiety even if they're experiencing it, are able to maintain stability in the environment around them. And you can't have leadership without followers, and so, you know, leaders who are able to marshal people around them to stay with her or him through the crisis and to communicate what their vision is of a solution and to be able to maintain a sense of hopefulness and optimism around achieving those aims. Right? If you've given up hope in a crisis, the crisis will prevail.

Yeah, hope is such an It's such an interesting aspect, right? Especially when things are coming in, and I've been there before, right? Running crisis for large companies. How does that leader, right, in all the things that they have to do, trying to figure out what's going on, what resources they have, right? Who's on that team or other resources? And at that darkest moment, how does a good leader foster that hope?

Well, firstly, it really ought to be hopefully authentic for the leader, right? If you're manufacturing something as a performance, people are going to pick up on it. It's going to be very difficult to sustain that. So, you know, we can talk in abstraction and then we can talk in detail, but, you know, as a global perspective on the psychology of this, People who are preternaturally pessimistic or, you know, typically beset with some form of anxiety or some such are going to be hard-pressed. And sometimes people like that end up creating self-inflicted crises just to give themselves the opportunity to try to master that. And unfortunately, it doesn't always work out, and so it becomes this, like, cycle. Serial project of collapse and resurrection. But let's look at the other types of leaders instead for a minute, and consider what's required. So there has to be a real sense of resolve around what you're doing and what's happened. If you're completely blindsided, it may be difficult to assess properly what's happening and therefore to be able to understand what needs to be done. So let's say there's some kind of black swan event. Assuming that it's not a fast-burning conflagration and you actually have 5 minutes to, you know, take a breath and assess the situation, highly recommended, right? So gut reflexes have their place, but really effective solutions to massive crises require planning, and it requires clarity, and often it requires collaborative process of strategizing, you know, what needs to happen when and where and how. It's not just one person, it's not just a general shouting commands to underlings. So if you have no idea what caused the problem and what's going on and you're flummoxed, the likelihood of coming through it in one piece is commensurately diminished. The best leaders in crisis are the ones who are generally prepared for the crisis to happen.

And that resonates with me because I've been in situations, you know, leading crisis teams and we saw an end result. Something bad happens, something's on fire and you get called and it's a matter of, okay, not only do I have to figure out the scope and depth and, you know, what's— but you also have to figure out like what you were talking about. What's the root cause? Is this the worst it's going to get or is just this just the tip of the iceberg and it's time to pull up the boots because it's going to get a lot worse. And that can be frustrating. It can be frustrating for the leadership and everybody around you, but you have to use your resources together. So getting that, as you were saying, gathering that intelligence to understand, taking that moment to not automatically rush in, hugely important. What other challenges because to me that was the first thing I wanted to do. Something's on fire, you want to get, grab a bucket and put water on it instead of taking that first breath and going, okay, is this bigger than what a bucket will take care of? What other typical challenges do leaders have to pull back and take that moment to strategize or plan with? What other challenges are out there that leaders have to deal with like that?

Well, of course, a lot of it depends on the organizational environment. You know, what is your business in essence? You know, are you technology forward or are you manufacturing? Or, you know, what are your requirements with regard to your vulnerabilities and how critical is that infrastructure to your operations? Is it, you know, are you in financial services or are you cloud services or, you know, something where some kind of breach or hack is basically going to decimate things, or you are going to lose reputational capital or whatever. Or is it a different kind of business where it is going to be an irritating distraction for a while, but it is not going to be massive. So details matter when looking at these things. And from my professional perspective where everything is focused on the human, dimension of it, which in no way diminishes all of the other elements in the array, the technical, the technological, the infrastructure, but it's the decision-making that is always my focus, whether it's before, during, or after a crisis, is who are the people involved, how do they relate to each other, how cohesive is the team, how well do they communicate, what is the level of trust. What is their capacity to function with coherence across different functionalities in the organization, or is it disjointed? That too is a part of preparation. It's not just tabletopping exercises. It's really about what is the culture of the organization and what kind of resilience is intrinsic to it. You know, is it a tyrannical or a top-down command and control type organization where if the leader is faltering or if the leader is mistaken in some way, then there's going to be a cascade effect which may not turn out well. Whereas if you have a group of executives or distributed decision-making where people trust one another, like on a high-quality sports team or an elite orchestra, where, you know, a leader or a captain is important, but everyone is capable of maintaining the highest standards of excellence, and any one member can execute in a way that's as close to perfection as would be needed in any given circumstance, the chances of an optimal outcome increase proportionally.

Are there risks in this decision? Because that's what a leader's doing, right? They're making the decisions or making— driving to decisions. You know, it seems to me that if they're not authorized to make decisions, that they're hobbled. If, you know, and as you mentioned, there's different types of decision-making processes where it's collaborative or just, you know, a single authoritarian one. Each one has pros and cons. How important is all that? And is there a best practice when it comes to that executive decision-making capabilities for a leader in crisis?

I think it's actually a harder question to answer than it sounds. You know, it seems almost as if I should be able to say, well, yeah, sure there is and this is what it is. But it's, it's so individualistic, you know, in some respects this is part of the problem set with respect to elevating chief decision makers in organizations to be able to enhance their decision-making capabilities, because you would think that it could be trained or educated, or you can read a business magazine or watch Cybersecurity Vault podcasts and learn what you need to know. The problem, or the problem is and the problems are, that a lot of what comes in a crisis especially, but not only, is more about character than knowledge. You know, going back to what I said at the beginning regarding, you know, poise under duress, the capacity to manage yourself, right, to not be hamstrung by anxiety or fears, or to be able to communicate effectively, to be able to maintain executive capacities. And I don't mean that in terms of your seat or your position, but your cognitive abilities, right? So because one of the things that happens in high-stress moments typically is a cognitive decline. You know, people freeze up, or, you know, they don't think straight. And things like that. So there are ways to train against that and to improve your abilities in those ways. But there are some people who come to those moments with more talent and more embedded reflexes that are situationally appropriate than others. And it's not always— Those things don't always harmonize in non-crisis situations. You know, there are people who are like just born to be in combat, in a sense. And often they have a background which, for better or for worse, prepared them for combat, which means that there's probably some history of trauma or abuse or neglect or, you know, some life circumstances that necessitated adaptations that enabled them to develop all kinds of skills to survive and to thrive. And so these are people who may excel in really effective decision-making in a crisis, but may not actually be the best leaders when things are going well, or they may not be strategic leaders when you're just looking to grow.

You bring up some great aspects here, right? Because you're talking about skills, you're talking about attitudes, you're talking about experiences. So, what makes that best leader? Is it somebody born with most of the skills that are needed or they're just, as you said, kind of made for that role? Is it somebody that goes to school and learns all those skills, the communication skills, or is it somebody that's just been in the fire for so long, has the scars and the experience, has been tempered hard by the crisis events one after another that they've learned to survive and to thrive. Where do we find this pool of leaders? Because it sounds like you, you know, organizations really need to be careful in who they choose to be a leader in crisis. What kinds of people, born, trained, or experienced, where should they be looking?

Well, I can just say the answer to the nature-nurture question is yes, and we can end the podcast right now.

Ambiguity, we're used to it in cybersecurity. Sure, the answer is yes.

Or the more typical and better answer is it depends.

Yeah, it depends. That's reserved for lawyers. I'm sorry, we can't use that. It's gotta be for the lawyers. That have that one. So, can it be any of those? Is it— and if so, what would be the markers, right? If I had this company and I brought you in and said, "I need to find that right person to be a leader for my cybersecurity crisis team, my CERT team. Go off and find—" What would you be looking for?

So, You know, since you mentioned lawyers, I actually think in my experience, not as a lawyer, but as an advisor to boards and companies who are engaged in high-stakes leadership hiring and assessments, that you want to define your terms. Because speaking of ambiguity, what is the best leader? What does that mean? Not just in kind of universal terms, but what does it mean for your company? So it's not too dissimilar from entering into any other kind of important relationship. If, you know, you, when you were a younger man and you were deciding to get married and you said to yourself, "I'm going to go out and find the best spouse I possibly can," it's a bit vague, right? So you must have had some kind of criteria in mind. Now, not to break the analogy too much by equating spouses and business leaders, my point here in aiming in this direction is that it's really, really important to think about what are those qualities and characteristics in detail, not in general. And even when you start distilling it into its subcomponents. You know, you're going to want all those KPIs. You're going to want competencies, skills, knowledge, experience, you know, and all of the characteristics and attributes of poise, charisma, communication skills, you know, go down the list. It's going to be— your profile is probably going to be very robust.. But it needs to be specific and tailored to your organization, right? So the CISO leader might be different from the CEO or the CFO, of course, right? And not just by skill, and not just by knowledge, training, and education, but also perhaps by temperament. And so, you know, it— my recommendation is that it needs to be an examination of the whole person, not just the resume. And that it really does need to look with precision at the requirements of the role in that organization. So a great CISO in one organization may not actually just be able to flop over into another one and just hit the ground at high altitude and excel, because there are a lot of other cultural factors and particulars about that organization that will be different. Beyond getting to know the people and getting to know the environment. There are many, many differences. So I think part of the issue here is that the idea of the search for the best has this kind of abstract presumption to it baked into that we all understand what the best is. And it overshoots or over-implies looks, that what is best in one place may not be best for another place. Just as, you know, you wouldn't necessarily be able to exchange one spouse for another spouse very easily. Like, we fall in love and we connect to certain things and we're in the right place for really important reasons, even though we don't always think about them or identify them. We can come back to it, but just to put a semicolon there, I haven't yet fully answered your question about nature/nurture, and I—

I know, and I'm gonna hold you to it. I want you to come down and give some more details, right? When I think of a good leader in crisis, and I ended up handing that role off, so I was doing it for Intel. I was Intel's first cybersecurity incident commander. So I owned all attacks against the company. You know, when I handed it off, I looked for about 5 basic traits. Right? They had to understand the context of the environment. In this case, the technology, the infrastructure, all that kind of stuff. They needed to have good decision qualities, right? People sometimes— brilliant people sometimes make horrible decisions, but if they have a history of making good decisions, rational decisions, they had to be able to communicate very well. They had to inspire people, especially, you know, during times that things are breaking, right? Everyone's getting yelled at. And lastly, they had to be able to hold their composure under stress because everybody's looking at them. But, you know, those were kind of the 5 that I looked at. There were plenty other, you know, other minor ones. But if somebody had those 5 things, I'm like, okay, sign them up. Let's throw them in some fire, right? What is your list? What is your tangible list that you would look for?

I love all 5 that you mentioned. They are on my list. All things being equal in a world in which you actually can look for more, I would add some. I think I would include low ego, the kinds of things that gets talked about often as like servant leadership or some such. Right, people that—

Being able to admit when you make a mistake. Yeah, a lot of leaders can't do that. Wow.

Sure, but not just fallibility and not being defensive when you make an error. That's also very important. Let's add that one to the list, but that's actually separate. What I'm referring to here is sort of minimal narcissism. In other words, it's not the me show. It's how can I help? What can I do to enhance the situation? Add value to mitigating problems and solving problems when they happen and not contributing to the problem because I need to be seen as important, right? So to me, that's crucial in excellent leadership.

Yeah, I would agree. I would agree. If it's all about you, you're not the right person for the role. There should be a clear goal, and the clear goal is to go fix this other stuff and help the people downstream.

Right, but since you mentioned being able to admit failure or mistakes, one of the things that I also look for, and I often pointedly ask these kinds of questions when I'm participating in the interview process, is how did you respond when something didn't go as expected? What was that like for you? And what did you do to get through that? And then what did you learn from it? And that also, I would say, is a crucial factor in excellent leadership because there are many— it's impossible to not make mistakes. Everybody fucks up. Everybody gets it wrong sometimes. Then what happens is really what matters. Obviously, you want somebody who makes minimal mistakes. You don't want a surgeon or a pilot who makes lots of mistakes. Yeah. Yeah.

Let's not do that. Right?

But it happens. So, what happens after it happens to me is one of the decisive differentiators.

That really shows a lot about one's character, right? Yes. And the ability— because you're already dealing with a crisis, there's going to be other mistakes and not only your own, but also people that are— right near you that you're guiding. Are you just going to focus on them and demoralize them further, or are you going to move forward and go, "Okay, it was a mistake. That's fine. We're going to adapt. We're going to move forward. Our goals haven't changed. Let's compensate and keep on the path." Right? Absolutely.

Absolutely. That, of course, is immediately implicated in aspects of organizational culture as a whole. Not just departmental subcultures. So if you have a board or a board chair or a CEO who is castigating when people make mistakes rather than, "That really sucks that that happened. Let's put it under the microscope and look at that and see what we can do." Those are two entirely different scenarios, very different cultures And what happens after is also very different. People are less likely to really internalize the lessons to be gained from failures or from crises and be able to implement and execute on that the next time it happens, and it will, when you're in a situation where you're shamed and blamed. Whereas if you're in a situation where it's, you know, recoverable and there's sufficient psychological safety in the culture to permit growth and learning and understanding, and that people still trust each other, the likelihood of mitigating risks is higher, actually. Right? And this is where being able to manage anxiety is enormously important. People who go around thinking the sky is falling, and it's you who caused it are very likely to step into a hole. Whereas people who are like, well, things happen, let's see what we can do, are just more self-aware and more interested in the people around them.

So as we talk about leaders being able to be effective and consistent and comprehensive in what they do, as well as draw in previous learnings during these times of stress and chaos. How important are frameworks or policies, guidelines for them? Are they potentially a hindrance to a great leader and trying to get something done? Um, and they've got the skills to move fast. Um, are they an important, uh, foundation for leaders so that they don't go wild and miss something obvious or failed, you know, keep making the same mistake as they did in the previous one again and again and again. Where is that? Do we need them? Do we not need them? Is there a balance?

Frameworks and procedures. It's a wonderful question. You know, this is a common issue in organizations as well as in societies where you have, you know, grave injustices that are perpetrated in the name of justice, right, or things that are legal but inhumane. So, or things that are regulated and proper but immoral in some regards or intrusive. And so there are plenty of ways in which guidelines policies and procedures will be stultifying and suffocating and destructive to being able to respond, you know, agilely or even correctly. You know, it's possible that you might have to do something wrong to get it right in a sense. And so people who are rigid around that, who are really rule-bound overly compliant on principle, not out of ethics, may be more likely to end up responding ineffectively because they're trying to do the right thing rather than doing what needs to be done right. That being said, of course, it would be a fiasco if you didn't have those frameworks. And not incidentally, depending on what framework you're referencing, many of them are substantial and really important bodies of knowledge and work. And they've been composed by experts. And you have panels of scholars, academics, researchers, practitioners in the field who are drawing on decades decades of experience to put together guidelines to help everyone do the right thing and to be able to anticipate the things that could happen. And so to just, you know, reject that or shunt it to the side because you don't want to be confined by rules is also absurd, right? So I think what we're talking about here is How do you have a healthy balance between the importance of frameworks, regulatory controls in environments where it's really important, other kinds of controls like in financial services, oversight, which is much needed in a lot of technological applications and services, without choking the life out of what needs to be done?

Without hobbling your crisis team and the leadership to begin with, yes.

Exactly. Exactly. And I don't think I'm saying anything here that nobody already knows, but I appreciate your asking me.

So, you had mentioned ethics. So, here's a question for you, right? Where do you stand from an ethical perspective specifically for leadership in crisis? Is it you should do no harm or sacrifice and trade-offs are okay. Where do you want the leader's mind to be? Are there parameters here from an ethical perspective?

Not to quibble with you, as you're the host and I'm the guest, but I'm not so sure that I agree as a fundamental that those two pieces of the question actually go together. In other words, doing what's necessary in a crisis or otherwise isn't per force unethical, right? And avoiding doing certain things doesn't make it necessarily ethical. So, you know, ethics is a very broad topic, obviously, philosophically, and, you know, If it were otherwise, maybe we would have better definitions in technology and society around ethical conduct. At this point, everyone and their third cousin is debating it, and it will probably be such for many years to come. My working definition of ethics is the ability to restrain yourself, meaning that you have options of things that you can do. And not all of them are the things that you ought to do. And knowing that there are certain things that maybe you ought not to do makes it more of an ethical decision. And it gets— I prefer that, firstly because it's more psychological, but also because it doesn't get into the swamp of moralism around it, like what's right and what's wrong. You know, just as a kind of sidebar on this, for example, my background is a musician, so I'm going to throw in a little music history to our cybersecurity conversation here. Okay, bring it on. In early church music, there were very structured rules about what church composers could to use in the music for the church. And so if you deviated from those rules, it was blasphemous in essence, right? You're a heretic. You were a heretic. And so secular music, meaning non-church music, was a revolutionary act in essence. It was heresy. It was a rebellion against those rules, right? So they started using intervals and polyphony and different kinds of harmonic movements that were impermissible by the church, right? So according to church doctrine, it was an unethical act. But if they had not done that, we would not have the entire canon of Western music. The High Renaissance would never have existed. Bach's music which would never have existed. Like Beethoven would never have existed. Everything that's happened in the 20th century wouldn't have happened, right? So it was necessary to have that heresy. So that's different obviously from malicious lack of ethics, right? They weren't firebombing the church. They were artists who were deviating from strictures and doctrine and dogma. And so going back to your question now finally, leaders need to be able to understand what their moral compass is. And ultimately I think that may be even more important, especially these days where morality and moral imagination is too easily dispensed with. It's too— too dismissible in the service of profit or scalability or dominance in the marketplace or some such. And society is already and will for some time to come pay a very high price for that kind of immoral leadership. But in crisis, you referenced the Hippocratic Oath, right? Do no harm. Right? So a doctor should not do harm, should not willfully harm a patient. But if there's something that needs to be done to save the patient, I would say that that's probably permissible. Right? So, you know, do you have to break something to save something? Sometimes.

You know, and it makes a lot of sense. Although, you know, from your music example, it sounds like leaders should be heretics. But maybe that's part of the definition a little bit, because they're going into that crisis environment and sometimes you do, you have to step forward. And I remember talking to one of the follow-on crisis leaders, incident commanders, and they were distraught because they were getting yelled at. And I told them, you can't please everybody all of the time, right? You're in a situation to fix something and you may have to do harm in some way, right? But what ethically, you're there for a job and you have to be very clear on what your goal is. If your goal is to keep manufacturing up, right? That's a different goal than the, you know, resolve the issue in the shortest amount of time. Correct. Because there's trade-offs. You may allow an infection to run rampant in a factory and just close it off, right? And preserve all the other ones and finish your run in one scenario. And in another scenario, you get, "Nope, I'm shutting everything down and I'm gonna clean it all and we're gonna have this, you know, pull the bandaid off quick." But you're gonna make some people unhappy no matter what you do or what you don't do. Mm-hmm. Focus on your goal. Is that good advice? Is that where their ethics should be tied to? Is that end goal of what the people have put them in place have said, "This is what you have to get done." What do you think? Or did I give terrible advice and I sent them down the road of ruin?

Well, we could stay with your example and I can flip it and ask you, "Well, how did that turn out?" It turned out well.

I mean, the senior leaders said, "Yes, we understand." And they always say, "Okay, we want it better. We want less impacts, but okay." But they also made some enemies in different business units because they felt that their priority should have been what that incident commander was trying to achieve. And there was a disconnect, right? If you're the owner of an application or a server, keeping that up is most important to you. And if the incident commander says, "No, I gotta take it down," or, "I gotta take you off the network because you're potentially causing harm," I got to do it, right? Right. That, no matter what you tell them, no matter what justification it is, to them that application or server is their world, right? Right. So it just doesn't matter. You're telling somebody their baby's ugly and you got to do something.

Look, it sounds like you gave good advice. Who am I to debate that with you, especially post facto? I'm not going to Monday morning quarterback your decision. It sounds like you traveled the road that you saw and it turned out well. And some of those internal conflicts are going to be unavoidable. I don't see that necessarily, by the way, as an ethical conundrum. Essentially, you have competing views of ownership of different things. You said one thing was important. Your colleague said another thing was important. You had to disagree on something. And there is friction there, there is a conflict there. And you're right, you can't please all the people all the time, but you know, what is your shared— what are goals, what are your common goals there? So just to go a little bit deeper on it though, my perspective on that kind of executive decision-making or leadership decision-making is to minimize unintended consequences to the greatest degree possible, right? So it has less to do with am I doing the right thing or the wrong thing, or what does the rule say, or what does my colleague want, or like which part of the business are we going to prioritize over others, but really to be able to take as multidimensional view as possible of the scenario and be able to forecast as many variables as possible so that you can understand, if I do this, there are going to be a host of cascading consequences to that. I'd like to know as many of them as possible, and then let's put all of them together, assuming that we can, and find the path that minimizes as many of the adverse consequences as we can. Cost-benefit analysis, basically, right? In essence, I think of it— I mean, I'm thinking of it more in the human perspective. Not in the tangible ones. It's really more the intangibles. But yes, you could look at it that way. Although, although it is possible that the best solution will be incredibly expensive. That doesn't make it a bad answer. Okay.

So, we've talked about a lot of high-level and personalities and so forth or traits and the way people think. Give me some examples in your mind that have in, in history, right, either current or past, whatever, ancient or whatnot, that have manifested these types of leadership skills? Who would you say are some of the best leaders, current or in history?

Well, we don't have a lot of best leaders present on the scene anywhere, so far as I could tell. Um, by and large, you know, the world seems to be dominated by handicapped leaders for various reasons. You know, when we first planned to do this podcast, we chatted for a little while about Zelensky, who catapulted himself in terrible circumstances to become an exemplar of a certain kind of galvanizing and heroic leader. Certainly he qualifies as a leader in crisis. So, you know, he comes to mind at the moment still, even all these months later, as someone, although his name is less in the news now than it was at the very beginning, he remains a potent force. And I don't know him well. I mean, I haven't studied him. I don't know him at all. But he's not a figure as a leader that I can speak about deeply or knowledgeably, except that he does seem to embody the moment, you know, that he has brought to bear in the crisis that was— that has befallen his country and his people, a clarity around certain things and a capacity to bring people together for a cause against the injustices and the criminality that is that they're battling. And, you know, that's a very admirable thing. I would say by contrast, someone else who's in the news constantly but who overestimates himself as a remarkable leader, but I would say is not, is Musk. Who is vaunted as this brilliant trailblazing innovator, but who is perennially creating havoc and in many, many respects, I would say, needlessly undermining his own potential as a leader and a thinker. You know, he becomes, in some ways, in so many respects an example of a figure, a leadership figure who has tremendous capacity and potential, but who thwarts himself vexingly in the service of trying to enhance what's already there. So he becomes self-diminishing in the service of trying to expand himself. And it's just, it's so pathological. And I think one of the things that I find most troubling about him as a leader is the way in which society valorizes him. He's such a figure. I mean, there are plenty of camps where it's like, you know, love him or hate him. But there are so many people who look at someone like I don't mean to pick on him necessarily for too long, but there are people who look at someone like that and say, "Yes, we need more heretic leaders." And I would say, "No, we don't." Actually, we need leaders with a strong moral vision and who have a sense of their understanding of the role of their organization and their capacity to do something for society, not just for themselves or their own enrichment. Zuckerberg would be another one I would put in a similar category to Musk. Maybe this is another conversation for a different episode if you want to have it. But no, I mean, these are troubling times for good reasons. And a dearth of exceptional leadership is chief among the reasons, actually.

Well, I think you bring up a good point, right? Just because somebody accomplishes something great and, and, you know, whether it's Zuckerberg or whether it's Musk, and both have been hugely successful, right, in, in what they do, that doesn't necessarily make them a good leader in crisis. In fact, they can be the one shooting their own foot and really, as you said, hobbling their potential of, of how they could come out at the very end. So that leads me to the question, how important is somebody's desire to be in a leadership position? Because I look back in history and we look at Washington, right, who didn't want to be president. He didn't want to lead. He didn't want to go to war. And yet He led, you know, an army, a ragtag army against the best army and navy on the planet and was victorious in odds completely against him, right? There was no way anybody thought he would win. And on the other hand, you have somebody like General Patton in World War II whose lifelong dream was to lead troops in, you know, in battle against a superior enemy, and this is all he lived and trained for. For both outstanding leadership from getting results. One didn't really want it, the other one did. Is that important?

Yes, of course. Uh, how it plays out, um, matters in the details right there. It's almost impossible for, uh, someone to become a leader, especially someone of significance, right, who has a memorable place in history, whether it's global history or political or social history or business history, as the case may be, who isn't powerfully driven in some way to achieve that. You know, even if you can claim with some legitimacy that you're an accidental leader, meaning that you didn't aspire to it, you weren't campaigning for it, you know, you didn't step on people's necks to get there, it was just like somehow someone like pulled you up and plopped you in, you would leave immediately if you didn't want to be there. There's something about it that's compelling to that person. So, you know, I'm no scholar of early American history and I can't really respond well to your examples, but what I would say as more of a generalized comment is going back to what I said earlier regarding low ego, all right, or the elements relating to levels of narcissism and narcissistic investment in something. People are ambitious or aspirational for lots and lots of different reasons. Sometimes that's absolutely the thrust that's necessary necessary to propel them to the goal that they have in mind, and sometimes it's so intense and so overwhelming that it actually becomes an obstacle to achievement itself, right? So somebody who wants nothing more than to be a leader, it's possible that they can lose sight of what it means to actually occupy the seat once they've accomplished the goal, whereas somebody who The person who maybe is more interested in what it will be to be a leader but is less focused on becoming the leader will be a more effective leader. Does that make sense or was that too—

I think it does, right? And I think no matter where their mindset, there are ramifications of that, both good and bad, right? That person that really wants to be the leader, they may have spent the last 5 years learning and reading and understanding and looking for situations where they can hone their skills. But on the downside, their ego may be so big that it becomes a detriment. True. But on the other side, you may have somebody that doesn't have the ego and that will not be the barrier, but they may not have focused and, and sharpened their skills to be as efficient as might be needed. So, I mean, there's, there's no perfect answer. Again, we get back to it depends. There's a balance, there's pros and cons, and every, every single one of us is different. Yes.

And I mean, yes, we could come back to it depends and, and things like that, but, you know, I would prefer with you as well as with, you know, clients I work with in companies to not be so imprecise. So let me, if we have a minute, come back a little bit to the nature-nurture thing and look at it from the perspective of this last question that you posed regarding sort of the drivers for leadership. And to bear in mind that there are a lot of— subtle complexities inside in someone's history that play out in what the motivations are to pursue or not certain goals. So, you know, there are people, for example, who in essence orient their entire life to, you know, proving that the disapproving parent was wrong and that, you know, what they can do for themselves is going to be evidence of their worth in the world, and it will eviscerate, you know, that experience of neglect or disapproval and shame and all of those things. There may be somebody else who comes from a place of deprivation of various sorts and who makes a decision, "I will never have that in my life again. I'm going to do anything I can to make sure that I have sufficiency, if not abundance, and that I'm going to take care of other people so that they don't experience what I did." And that's their motivation. And those kinds of subterranean details in personal history are incredibly important. Important in terms of understanding where people are coming from, basically. Like, how did you get to be here? Why do you want to be here? How are you going to occupy this place if you are there, right? Because what's, what's going on under the surface for them is very, very influential, but it's not always acknowledged, and it's not always visible, right? You can't get that kind of stuff just from looking at someone's resume or their trajectory professionally, or even in an interview, unless you're interviewing in a particular way that's designed to try to surface that kind of psychological intelligence. That's interesting.

And, you know, I, I couldn't agree with you more that those traits, your history, it's tectonic, right? It is that underlying force that moves people and can definitely, you know, tie in whether they're going to be a good leader or not. So final question for you, because I think some of the listeners here are going to either fortunately or unfortunately find themselves in the position where they are the leader in some crisis, whether it be cyber or something else. And it creates stress and there's challenges. So what advice would you give to somebody who is going to find themselves in these situations where people are going to be looking to them to resolve things, to make decisions, and they're going to be held accountable for it too? Yeah. What's your advice?

I have several responses. Perhaps the centerpiece one is know yourself, right? Knowledge is power. And it happens that the human element seems to be the most inscrutable and the least well-known, even though it's the most common thing. You know, by analogy, it's like people who are in water and are like, "Oh, it's wet, but I don't understand why." Right? So a part of my work is built around helping people understand more about themselves. And the more you know about who you are, how you think, how you feel, what that history is, and what its influences are on the present, the more potency, more effective your decision-making and your leadership will be. If you're living basically in a blind spot or there are lots of different micro blind spots, there are so many things that you just don't understand that can't be compensated for by knowledge and skill and experience and talent because those are things that are omnipresent. Present in you. They're tectonic. Your word is wonderful. Another is to recognize that good leaders don't necessarily always have to have the answer or make the decision. That sometimes good leaders are really good at helping other people make really good decisions and that that's good leadership too. So succumbing to the mythos and the pressure of being know-it-all is not necessarily a good attribute for good leadership.

Yeah, I agree there. It is a team effort. I mean, you may be in front, but it is really a team effort. And if you have not fostered that as a leader, you are going to fail because you cannot solve it all by yourself, and especially in these cybersecurity type issues. Yes. So—

and the last thing I want to say before we end, though, there is one more piece of advice. Is to actually have a moral compass, right? One of the worst things that can happen is to have someone who is indifferent to others be in a position of authority and influence. And, you know, with great power comes great responsibility. And it is so crucial for people in leadership positions to understand that they do have the power to influence the lives around them and the societies in which they work and their businesses operate. And you must be mindful of that. And if you don't take care, bad things will happen, and that will be your responsibility.

Yeah, and I've seen, I've seen great leaders take a poor, mediocre team and just mature them and have them blossom into something that they're doing incredible work, right? They're punching way above their weight. And I've seen other situations where poor leaders have gone into a great team and obliterated them. Yeah, to the point that they were leaving the organization even just with, with a short amount of contact. Yes, a lot of weight and responsibilities on the shoulders, right, of, of leaders. You can do great or you can do a lot of harm.

Yeah, so perhaps the last piece of advice there is that, you know, um, if you find yourself in that position, which is different from attaining that position, um, or in a sense it doesn't matter, grow. Like, don't just Don't just presume that you've arrived full-blown. There's a lot to develop in leaders. There's no such thing as a perfect leader and no such thing as a leader who arrives absolutely prepared for everything. There is room to develop. So do you give the advice to ask for help as well for leaders? Look, this is a whole different topic that I'd love to talk with you about, which which is how do we help leaders ask for help? There are so many people who are entrepreneurs, people in A-type personalities who are in the C-suite or in positions of responsibility and influence who have this self-deluded sense of incredible, impregnable strength and capacity and who view the need for help or the input that they could get as a sign of weakness. And it couldn't be more the opposite, right? Being able to get help, to recognize that you need help, to receive help is a strength, not a weakness. And if there were more leaders who recognized that and didn't reject assistance or didn't dismiss the idea that there are people who maybe know more than they do about certain things and that could be value-added, many things would be different.

Yeah, it's got to be added to our list of what makes a great leader. They have to be willing to ask for help and take that constructive criticism as well. All right, thank you. Our conversations are always so enlightening. Thank you very much. For sharing your insights and your expertise here. And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time. Thank you, Matthew.