Driving Consumer Trust with Security and Privacy

When you have security and you have privacy, the reality is in order for me to do really good in security, I need to have the support and the interoperability with privacy. And I believe the reverse is true as well. You can't truly establish privacy unless you also have the confidence in the security controls as well.

Hi, I'm Mike, and I'm here today with Ben and Matt, as well as our new friends and partners Michelle and Brian. And today we're going to tackle the multiple operational governance, economic, and brand benefits of considering security and privacy data processes and practices and economic and business opportunities through a unified lens. Ben, why don't you start us off and give us a picture of the broader security privacy markets that we're going to be talking about?

I mean, I think from our perspective, Mike, as we see, kind of, we look at the cybersecurity industry and how it's evolving. We've talked about this a little bit in prior podcasts, but, you know, I think the old, you know, John Chambers quote of there are only two types of companies, you know, those that got hacked and those that don't know they've been hacked, it's just increasingly true these days. And I think, you know, CISOs and CIOs involved in security are really catching up with this fact now. And therefore it's, you know, prevention technologies is not sufficient, sort of ongoing monitoring and protection solutions Excellent as an additional layer. But you know what? Even beyond that, you've gotta have strength in layers. And the latest layer I think that's getting a lot of attention is just the underlying data and securing that. I think we've seen that in a lot of our sort of M&A and private equity work. We've seen data security manifested in identity access and control. We've seen some of the largest deals this year with Tema Bravo acquiring SailPoint, for example, an identity access privilege management provider, SecureLink, another critical access provider. We've also seen kind of legacy email companies turn into data loss prevention companies and subsequently transact, you know, the likes of Proofpoint, also a Thoma Bravo acquisition last year, Digital Guardian acquired by another software business, HelpSystems. And at the same time, there's this boom in governance, risk, and compliance, which is really on the edge of traditional cybersecurity. And, you know, it's an area that we've been incredibly active in recently. And so lots of sort of middle-sized businesses, it's a much more fragmented landscape, a mixture of software and services. And I think, you know, all of that in the context of an increasingly muscular regulatory environment, which is telling all companies that you really have to look after your data much more carefully, particularly if you've got your customers' data. I think it's starting to morph into a new word. And I know I'm not alone on this podcast, but I think we're starting to talk about privacy.

Mm-hmm.

Interesting.

And so we'll come back to this later, but the areas of governance and risk and compliance have been, it seems, the minimum viable solution for both privacy and security. And we'll talk about the degree to which there are other things than those three to to look at in the area of the intersection of security and privacy. So let's get into who does what in the world of security and privacy. Each of Matthew and Michelle have had significant security experience or privacy experience at Fortune 50 companies. So Michelle, let's start with you. Remind us of your prior roles and give us a sense for what you did in the world of privacy.

So I have performed a number of different roles and with different flavors and nuances that we'll get into. I started out actually putting together a business case to leave the legal group in my first role as Chief Privacy Officer at Sun Microsystems. I then left there when we were acquired by Oracle to actually lead a sales team for security and privacy. And so that was the tip of the spear. They already had a CPO that was both in legal, and they had a head of strategic policy that was a global policy lead at that point in time. Then I went on to Intel McAfee, And I was brought in actually post-acquisition into the McAfee side of the house. In that role, I actually did lead the California legal office as well as my role as a business leader as CPO. So I sort of had that schizophrenic, both a business person as well as a legal responsibility in that role. And then my final big co role was actually under the COO as the first Chief Privacy Officer For Cisco, and to put you in the time and place, that was just in time for GDPR to be passed, for Safe Harbor to fail, and the run-up to get into global compliance for a company who is investing in its very first privacy professional at that late stage. So that's sort of the run— the ring around the ring of fire in the data center for me. And we'll get into what all of those nuances and different roles and placements mean.

Yeah, just, and just to be clear, it sounds like in their first role at Sun, you reported to the CPO, who I assume reported to the CEO. In the second role, you were legal lead and CPO reporting to, I presume, the CEO of McAfee?

No. So the first role, uh, well, so I had many roles at Sun. I was there for 10 years, but I was reporting initially to the CFO and then got moved over to the head of policy, uh, who reported to the head of an organization that they called People in Places. It was basically public policy, HR, IT, security, the whole megillah. And then as I moved through that role, I reported directly to that People in Places lead. And then I finished off the role as Chief Governance Officer for Cloud. So I had security, privacy, ethics under the CTO for cloud governance and evangelism at that point. When I was in McAfee, I was reporting directly to the general counsel. And then at Cisco, I reported to the chief, quote unquote, the chief trust officer, which was a blend of privacy, security, security engineering. Myself and my team started privacy engineering under that role and rubric, and we had a little bit of governmental oversight, FedRAMP, that kind of stuff.

Got it.

And in the case of both Cisco and McAfee, would you describe the budget for your function relative to others, peers, or whoever you want to compare yourself to as, I don't know, fulsome, moderate, small, or nonexistent?

I would say to anyone entering into the field of play, particularly if you are first in seat, every single one of these roles was the first of its kind. In Sun's case, there were 1 of 5 of us that even had any role called chief privacy officer in the world. So I would say it's a roundabout way of answering your question is I started too low with budget with a promise that we would grow and never do that. Never do that. Go in and figure out what the real budget needs to be first. So I grew in seat and I borrowed and I begged and I persuaded others to share their bounty with me to get the job done I needed to get done. But I did not have enough budget is the real answer to your question.

Got it. I'm going to talk about tying to business leadership, but I think I'm going to wrap that up with our general opportunities point. But the question will be, and as you can anticipate it, to what extent you had good engagement or any engagement with product or solution leadership. But let's pivot to Matthew. Matthew, same question for you. Describe your role at Intel to start.

All right, well, I've been doing security for over 30, now 34 years. I spent 24 at Intel, and this was at a time when security, it wasn't even called cybersecurity.

Security.

If you go back 30-something years ago, Intel didn't have a chief information security officer. It was buried deep in the IT world and bowels. So I actually justified, built, and managed Intel's first 24/7 security operations center. I landed and led our crisis response. So anytime Intel, anywhere in the world, our digital assets were attacked by hackers or whatnot, I led the team and I ran it. And, you know, I progressed in a whole bunch of different firsts, built out the cybersecurity M&A team, cybersecurity strategist for all of our worldwide manufacturing to protect all of those where downtime is very, very costly and painful. My last role there, after doing things, for example, once we bought McAfee, working with strategies with McAfee and, you know, owning the security roadmap for all the security features in our core chips, you know, the CPUs of Intel. My last role was actually owning and building out the security for a billion-dollar product group, right? Our artificial intelligence group. And so I reported into the executive there who owned that P&L. And from there, I've moved on from Intel and I'm a CISO of companies. And throughout my career, actually, I advise governments, academia, and businesses on emerging threats and industry best practices.

Great. And so let's go through the checklist of things I— we just heard from Michelle. So organizationally, at your apex of your security role in Intel, were you reporting into a technology lead at some level or more of an executive lead?

When I was building and managing the security operations center, which was the heart of all security, cybersecurity and Intel, protecting the infrastructure, that actually reported into the CIO, right? When it was protecting AIPG, that reported into, you know, the P&L group, the billion-dollar P&L group for artificial intelligence. So it really depended on where I was and what the objectives were at the time. Sometimes P&L, sometimes infrastructure, sometimes partnerships with, you know, other companies and acquisitions like McAfee, so on and so forth. So you need security everywhere, right? When you need to protect your infrastructure, you need to protect your products, and privacy is the same way. You have to be able to do the same. So a lot of the same circles with a lot of the same people, just different perspectives.

Yeah, and I think, you know, privacy is a less mature function than security, or certainly less well-funded. So I'm going to ask you the budget question here, which is contextually different because security is funded by nearly every company at some level. Do you have a sense as to whether you felt well-funded in your role, well-funded or sufficiently funded, or did you always feel like you were begging for scraps to get the basics done?

Yes, mostly you're begging for scraps, right? There's an ongoing joke whenever there's a cyber attack. It's terrible, it's horrible, we always don't want that to happen, but it becomes a fundraiser, right? Security is not relevant until it fails. When it fails, that's when the purse strings open And investment is willing to be made, both privacy and security. Unfortunately, we suffer from the reputation that we don't add anything to the bottom line. We're not directly contributing to the corporate goals. And all that is wrong, right? But that's the perception. We are a cost sink, minimize it, put it on the back burner, and maybe if it's needed someday or if something happens, then fund it and invest it. And we deal with a constantly changing and evolving environment. So even if you do fund it great this quarter, next quarter there's going to be a whole bunch of new needs. So it is constantly chasing adequate funding and you have to justify it.

Great.

Let's pivot to the hazards of what I'll describe as non-alignment, which is to say that each of you in security, security and privacy has a set of activities you do some of which overlay, some of which are complementary like cogs in a wheel, some of which are discrete and separate that don't interact. And then I guess what I'm wondering here from each of you, first Michelle, then Brian, then Matthew, then Brian, what are the hazards of non-alignment that you've seen from each of your security and privacy lenses respectively?

No, I think, I think that's a good way of putting it. So, so my goal and objective is that data maturation over time. The misalignment happens where there's sort of two things that happen. One is what a safety blanket problem and an M&M problem. The M&M problem is I've had many security people come to me over the years and saying, I'm going to pick out of this bag of data the PII, personally identifiable information, without them being privacy professionals, mind you, but I'm going to not tell you about what the processing is going on. I'm not going to involve you in crisis management and tabletopping. I'm not gonna talk to you about all the tools that we have to do application inventory, et cetera, et cetera, et cetera. I'm just gonna tell you when I feel like telling you about the green M&Ms that I'm gonna pick out of the bag without knowing what the colors are. So that's the M&M problem. And that's a big misalignment because I can't do my job if I can't see the landscape of risk. The other is the safety blanket problem, which is I've heard that secrecy is the equivalent of privacy. Dear readers, it is not. So if I have encryption anywhere, regardless of my sloppy key management, regardless of my identity mishaps, I somehow believe that privacy is done. And privacy gets stiff-armed and says, please write me a beautiful policy that makes all sorts of magical unicorn promises, but I'm not going to align with you and tell you what the real risks are, tell what the balances are, the trade-offs, and add to the encryption pipeline of protection that little cute little security blanket a more fulsome and time-bound strategy. So I think not having that, whether you're doing M&Ms or whether you're doing security blankets or a combination, you're really missing out.

How about you, Matthew? From a security perspective, where do you see missing— missed opportunities or redundant activities vis-à-vis privacy?

Well, I think we have to understand, and I love that two cogs that are working in sync together. Metaphor, because when you have security, you have privacy. The reality is, in order for me to do really good in security, I need to have the support and the interoperability with privacy. And I believe the reverse is true as well. You can't truly establish privacy unless you also have the confidence in the security controls as well. So the risk is, if you're not close together, if those cogs aren't touching and you're spinning all by yourself, You're going to fail. You cannot achieve the comprehensiveness, the effectiveness, and surely not the economies of scale that you need. You're gonna be wasting money. You're gonna be wasting time. You're not gonna get to the objectives that you, that you expect when you expect them. You're gonna come in late, right? Over budget and underappreciated. Whereas when you get those cogs interoperating together, then you get scales of efficiency. Then you understand— both sides of the house understand where they play, how they work together, right? And how you can be comprehensive. And at the end of the day, sustainable, because you don't solve privacy once. You don't solve security once. This is something that is continual, and we have to adapt to new regulations, to new threats, to all of this. And again, if you're separated, You lose that economically, from a performance perspective, and even from a leadership perspective. You start losing grasp on who's doing what and why, and a lot of ugly surprises tend to be the result. May not happen today, but I guarantee you it's going to be next week or next month or next year, and you're going to be scratching your head thinking, okay, we have to completely rework this. This is just not— how did this happen?

Right?

Those are the words that we hear at some point in time in the future. How did this happen? If we don't get them together, you hear that a lot more.

Thanks, Matthew. And Brian, I know you've done a lot of work in the field in this along with Michelle. What, what, if anything, have you seen in this area of the hazards of non-alignment? Because we're going to turn to you in a minute and ask you about the opportunities and the common areas, but let's start with the what's not working from where you sit.

Yeah, I mean, the hazard of non-alignment, I like to think of it kind of talking about what Matt says, how did this happen? And I make a metaphor I like to use is it's like having a car, right? And if you think about your car being out of alignment, you might not notice it at first, it might not be a big deal, but obviously it's causing extra wear and tear on your car, which causes extra costs, right? You might not be getting the gas mileage you think you should be getting because your tires aren't quite going where they're supposed to be going. In a severe case, you'll get wear on those tires and they become bald. And if it's not exactly where it should be and you're not doing the kind of constant checking, the baldness may be on the interior of the tire, and then you're going to have a flat. And at worst case, you could have an accident. And so the danger of not being aligned is exactly that, that it usually is something that's not very obvious. It's not always like, oh, security is doing its thing and privacy is doing its thing and they never even talk to each other. It's always much more subtle. And I find that the real danger of non-alignment is the subtle risk that you're taking that you really aren't aware of that is disproportionate in outcome.

So let's, let's flip that and talk about the areas of commonality between the two, where the cogs do flow together, where there actually is overlap in activities of various work streams, or activities of various sorts. What, where do you see, you know, the obvious low-hanging fruit for a lot of greater alignment, however that gets done?

Well, I think it starts with, with this risk idea. If you look at any of these, uh, of the cybersecurity frameworks or the privacy frameworks or any kind of effort that's been done on a larger scale to help people get their arms around these problems, they all begin with risk. And so the risk assessment and the working together on risk and understanding risk is, is a commonality that is just fundamental to privacy and security. And the second thing is, when we talk about risk, we're talking really at the nitty-gritty level. It's, it's data risk, right? It's dealing with data. Data is the big issue. That's the reason why we have this privacy thing. That's the reason why we have cybersecurity. And so this, this cooperation on data is another just fundamental commonality that I see. A third one I like to talk about is the people who do privacy and the people who do cybersecurity They're working in a highly technical, highly regulated, very complex field. And so the people themselves tend to be— I mean, the work tends to be the provenance of subject matter experts, right? So you can't just go and hire off the street and find a really qualified senior cybersecurity person or a really qualified privacy person. They tend to be people who have highly technical expertise, and they tend to be hard to find. And therefore, you want to maximize, uh, everything you're going to get out of that person because they're not going to be a lot of them out there. So you're constantly going to be dealing with this under-resourced environment. And so you need to have people who are able to cross-train and fill the gap. And that's why privacy and security obviously work together quite a bit. And then the last thing I would say is, everywhere we look, if we talk about the so-called ESG rubric, I mean, governance is security and privacy. And so it's obvious, it seems obvious, even though it doesn't seem always to come out in practice. That security and privacy should be joined at the hip for that matter.

Thanks, Brian. So, um, let's pivot now to the opportunity side of the equation. And broadly speaking, they fall into sort of more effectiveness, more efficiency, more productivity, some layer of cost reduction, and some, if you like, business benefits that relate to branding and, and solutions. So I'm going to open up to all three of you to sort of chime in in any order you'd like. But where do you see the greatest— where do you see the main opportunities if you were to tick off the top two or three? Maybe, Michelle, you can start and give us your top three punchy benefits or opportunities from this alignment.

So I like that we're talking about COGS as interoperable functionality. And it also stands, of course, for cost of goods sold. And so in a modern organization, We used to talk about digital transformation, like in 2019. Isn't that adorable? It seems so quaint now. We have all been digitally transformed. So if you are in a digital environment, if you depend on knowing who your people are, what you're selling, how you're selling it, guess what? Welcome to the world of data. So cost of goods sold of having high-quality data will produce high-quality decision-making. High-quality situational intelligence, high-quality agility. So those are my, like, punch, punch, and punch.

Anybody else?

Yeah, I think there's several different benefits, right? When I've worked with organizations that had great privacy people and we worked together, we did a much better job in understanding what data actually existed and being able to classify that, because both sides need that. So you get a better understanding of your environment and managing the life cycles of data. And things like that, again, help enable the business. That in and of itself doesn't generate revenue, but it helps those groups stay in compliance and protect them from bad things happening and keep their availability as well as their confidentiality of data and systems and, and integrity of all that intact. So we're enabling the business. And I think as we move forward and as the industry, the consumers look at these different products and services, they also want to feel confident that their data isn't going to be used or misused or used against them, right? That becomes a competitive advantage. I think there is a time as we're moving forward and we're seeing it, right? The non-traditional kind of competitive tax where you can, when you have the appropriate infrastructure, security and privacy and other things, right? And safety. All bundled together, that, that becomes a competitive advantage. And now you are in a space where you can market that, you can go after greater market share, you can raise your average selling price, you can do a good, better, best type of model. And it gives the organization much more business flexibility. And it all comes down to, yes, trust. And, and is that what consumers want, having security and privacy? Working in lockstep opens those doors.

That's my point.

I couldn't agree more, Matthew. I mean, that was, I wasn't gonna try and compete with the others on this call on the operational efficiency that it might create. But I think kind of from an external market perspective, I'd actually tweak what you said, Matthew, and say it's already an opportunity for brand enhancement that we've seen, you know, some businesses that we've supported. I mean, I take the example of a business that we did an assessment for recently, that was a business intelligence software that aggregated data effectively on behalf of other businesses. And its primary selling point and the way it could justify a premium price was the fact that it did so in a way that was compliant with GDPR and California Privacy Act and all other relevant acts. And it— and for high-risk industries that was deemed critical. So a subset of the market that was deemed critical. And, you know, I think that that kind of subset of the market is expanding all the time. And that very specific, you know, clearly core to their value proposition type offer is just the tip of the iceberg. Because I think, you know, all sorts of businesses that aren't only like aggregating that aggregating others' data, you know, for kind of their core product are gonna start, I think, being asked about these kind of questions even if they're not putting it front and center on their website.

Yeah, I was gonna double down on that. We did a study actually where we provided a great deal more transparency on a data enriched and enhanced and potentially risky product. Not only did we show that we could compete, particularly in the European theater where we did our testing, and they're very sensitive and have very specific laws and lots of regulation everywhere, and diversity within the European community. Don't think for a minute it's one ubiquitous rule set. The thing that we proved, you know, we're not necessarily sales guys and gals, But we said, you know, several million a quarter we thought was kind of nifty. Well, when you're in a $100 billion organization, it's nifty, but it's teeny. So what we did then is compare. So when you're doing a deal with someone that you trust, where there is data saturation and there is data sensitivity, what then happens to the ancillary marketplace? Well, it turns out that if we proved trust in this tip of the spear, we received a 10x boost of hardware in our traditional marketplace, stuff that was just basic pipeline stuff. Once you buy that hardware, once you tune to my TransparentNow data processing technology in your digitally transformed world, you're incredibly sticky. All of your ancillary services can go on top of that. You're not losing market share. And you're not creating churn in your own market share because of this, this small noisy piece. You're making that piece quieter. You're making it more trustworthy because you're showing what you're doing. You're showing your homework. You've done your privacy engineering proof points. And now we can show maybe not causation, but definitely some delicious correlation. And that's when you get invited into the room to sit on the head of secure— the head of sales staff, which was my experience in that particular case, that's when you get invited into the boardroom to say, how can we compete better with these operational costs? How do we relook at digital transformation as fuel going forward and not simply risk management and compliance looking backward?

Yeah, this is a super interesting topic, and maybe for another show, uh, we could cover off on how different sectors— how it changes by sector. So if you're— I mean, I find the most interesting conversations around Apple's leading with privacy given its model. It doesn't do any downs— it doesn't have any downside for Apple to say we're upfront in privacy vis-à-vis Google or Facebook because their model is different. Their customers— there's a different sort of dynamic going on there, so they could— they can almost use it independent It's not that you're buying an iPhone because it's safer. It's that you're buying Apple's world versus Google's world or Facebook's world. It's an Apple versus Facebook or Google thing. And I think the— again, I don't think we want to get distracted here, but I think it's an interesting thing to look at each sector and ask the question, how important is it for John Deere to lead with privacy and security versus Google? I mean, clearly Google and the tech companies were all very sensitized to that. I kind of wonder if the answer changes, the importance significance of the impact changes if you're in a consumer goods business. Doubtless there is value to saying, you know, showcasing it and showing your homework, as you say, Michelle, but I wonder if it has the same impact across different industries.

I— let's, let's come back again, because Caterpillar and John Deere are perfect examples where you think, you know, IoT in the field, guess what people really care about? Guess what people are going to care about in the summer of 2022? Food. And figuring out how do we maximize who's working in the fields, are they safe working in those fields, what are the liabilities there, what are the efficiencies there. It's, uh, you know, food and the agro environment that didn't seem particularly privacy sensitive, turns out they're incredibly data sensitive. So I think this is a great conversation for another day of like surprising ways that privacy and security touch businesses that you wouldn't think would be terribly sensitive.

Yeah, I mean, there's a great example. There's a very large American automaker, and one of the new revenue streams that they were talking about is because all their vehicles are connected, right? They're actually tracking where the vehicles are going and so forth, and they wanted to aggregate all that data and basically have that as a sellable data set, right, to show where people drive and how fast and where they're going and stopping and and so forth. And it's great for marketing, it's great for other, you know, types of industries to sell to. Yeah, but again, you don't think about that just being a car man. I'm buying a car, right? They don't care. There's nothing private about that. Oh no, because they know where you're at at all times in your vehicle.

Well, you're buying a computer in a car is what you're buying, and every— every computer—

it's a GPS. You're driving a big GPS and they're gathering all the data. By the way, they're also tracking what radio stations you're listening to. Right? What web pages you're going to on the infotainment thing, how many people are in the car, right? Are there car seats in the car, right? And they can start profiling all these things. So yeah, a great discussion for another time. And it's not only, okay, what are the industries doing now, but we need to dial that timescale forward. What is it gonna be like in 3 years or 5 years? Because they're still gathering data now thinking, how am I gonna monetize it then? So it's, it's, you also have to look forward.

Yep. All right, let's turn the corner here to kind of operations and tactics. So for Michelle, Brian, and Matthew, you know, what sort of, what are your top 3 tips and tricks, which are not hopefully generic and vanilla, but give us some real, somebody would pay you to give this insight kind of thoughts about operationally, tactically, if you're talking to the CISO, you know, the CISO and the CPO, and you're trying to get them moving in our direction, moving in this direction, what would your top tips be, Michelle?

So I'll do— let's stick with travel for a little bit because Matthew's like blown my mind. Like if you decide to become a junior data broker, please call us before you go. For the love of everything. That is like a liability tornado waiting to happen if you do it wrong. So I would say one thing is understand, first of all, what are the rules of the road? What are your business objectives? Before we start about staunching risk or talking about externalities, like, what are the business rules that you're playing by? Are you trying to grow? Are you trying to preserve? Are you trying to expand into a geolocation? Are you changing the way that you're treating your employees or hiring or firing or expiring, uh, business opportunities? So first know the rules of the road of business before you even get into our stuff. And then I'd say, know the flow before you go. Data has got a lifecycle. So where is it? What is it? When is it? And do you even have the ability to get a handle on— know the flow before you go?

Hey, just two clarifying questions for you. Actually, one on the business rules piece. You said you want to know the rules in terms of— What business are we in and where are we headed revenue-wise? And then operationally, if there are any constraints or things that we're thinking about, is that the broad categories you would put a bucket?

Yeah, I'm talking about sort of for privacy people in particular, and I know this is a, it's a strong muscle for your security brethren that you can leverage, which is situational intelligence. So I can make a lot of sort of academic conversations and talk about other breaches that have happened and what's going on on the hill, in whatever hill, Beijing, DC, Brussels, wherever. I am much more effective if I get down with what are we saying publicly about who we are and what we do. So let's go back to our tractor companies. We are now internet of things people. Or one of my favorite customers is a— like, they're the fancy peripherals company. So they are known, and you will pay extra for their peripherals. As a result, they have really high fidelity video. They have really high fidelity sensor data in all sorts of different sensory environments. And they've gone into ruggedized environments like medical places, like schools, like elder care. So That environment tells me a lot about what is the fragility and the vulnerability of the people that I'm protecting with my strategies and methodologies, how important or competitive is the business market, or limited are the funds to be spent on this type of thing versus buying a new MRI, for example. And then I can really act as the professional that I am. I can put myself in the seat and say, this is what we're capable of in 30, 60, 90 days. And that will launch you into what I'm hoping to be a 5-year plan. And these days, a 5-year plan gets thrown out every 6 months. But by being able to simulate and model the types of information that would be strategically available based on where I'm going, based on what I've said publicly, based on what I wish that I'm not saying publicly yet, or company that I may acquire to add to my capabilities, Now I'm being in the seat. Now I'm a business thinker. Now I'm somebody who is truly creating and committing to strategy before I get into those just foundational things like data catalogs, data mapping, activity diagrams, like the stuff that has worked in compute and strategy for the last 100 years.

Mm-hmm. Nice. Matthew, thoughts on this?

Yeah, I mean, if, if I'm talking with the, the CEO or even the board, right? Often they really want those benefits. You know, when you say cost efficiencies, great, bring down my cost, I love it. There's privacy, there's security, you guys can work together and be more efficient, great. More effective, oh, you can do what you need to do in security and privacy faster so we don't have to wait for you. It doesn't delay our product releases anymore. It doesn't do— I love that, right? You know, we have to figure out what is that path to get to those types of benefits, especially if you're going to be, more than just enabling the business. If you're going to— and this goes back to what Michelle said, you know, there are business goals, typically profitability, for example, right? If you can actually contribute to the profitability, to the bottom line, yes, I'm very interested. But in order to start doing that, you have to have that collaboration. And collaboration is based on familiarity and trust. So, you know, you have to push it down to get those privacy and security leaderships to talk together and work together. And one of the most important things you can do is make sure that they have joint goals. Their goals are overlapping because they need to be interrelated. And whether it's a single person that's driving that or it's two different organizations or five different organizations, they need to have joint goals and be held accountable to those in alignment to the benefits that you want to get. This is a journey, right? We need to set the foundations. So establish that collaboration. And prove it by having attestable goals, joint goals across those domains. Now we can start getting down that path. And if I were a CEO or I were, you know, on the board, I would then have in my mind, I now want to challenge, right? Because every company is different. There's no single one answer. I would sit down and challenge, hey, privacy and security, how can you make my business better? Right? And sure, we're going to be talking about risk mitigation. Absolutely. You know, we're going to be compliant with regulations. We're not going to be hacked as much. We're not going to have as many data breaches. Great. That's one piece. Now also tell me about this competitiveness. Right? Tell me about how we could potentially spin this. Marketing could use this for a good, better, best strategy to move people from our freemium product over to a paid product. Right. That's putting dollars on the bottom line, moving from green to red or from red to green. Right. Where we want to go. You know, show me what we can do and let's get there. Right. Show me the opportunities, not just the risks. Risks are boring to me. I assume you're just going to take care of those for pennies on the dollar. Show me the opportunities as well.

Thanks. How are you, Ryan? Anything, anything to add here?

Well, I guess I'll try to drill down a little bit more into the more granular detail because we hear a lot of times about these, these big ideas and they're super important at the kind of strategic level, but then we're left holding the bag on how to execute. So I'll just give a couple things that I think are profoundly helpful. They line into what Matthew just said and what Michelle said earlier. Number one, in terms of establishing this commonality and working together, take a look at your training program. Right? Are you training, or are you just taking attendance? Right? Are you actually teaching people to do something and forcing them to work together? Are you involving them routinely in exercises that are common? So you have a breach incident. If you do breach response training, is it just your security team, or is it security and privacy? And they're working together routinely. And you can also expand that training out to look at champions programs. If you do not have a champions program, you are shooting yourself in the foot. And security champions are kind of a thing. Privacy champions are relatively new, and the privacy team can learn a lot from how security does it. And so if you do something like that and get that instituted and established, that ties right back to that cost reduction, because now you have people who understand both sides and can sit in on— Jill can sit in on Tuesday when John's on vacation, and now you don't have to hire that temporary employee for a week or two. So those kind of things you can do. And then one other thing I'll say We look a lot at frameworks, right? We always talk about a security framework, this kind of framework, that kind of framework. Actually look at the framework and make sure both sides are using the same one.

Yeah.

And it sounds stupid, but we've seen it in gigantic ginormous companies that we've dealt with, and the security team's using NIST and the privacy team is using the CPA, right? So just totally different standards. One's very generic, one's very detailed. Get those people on the same team, make sure they're using the same framework, and make sure that that aligns. That's a super easy thing to do, and sometimes it's a little painful because you have to get people working and understanding it, but it's a great thing to do. And then the last tip, again, back to getting people working together. When's the last time you actually did a no kidding, honest to God, sat down with everybody and did a data mapping exercise? It's painful. It'll take you a week. You got to get people in the room. The, the learning you will get out of that. You will have such a profound understanding of what's going on in your organization. And at the end of that exercise, you'll instantly have a list of the top 10 things we need to do today to get everybody on track and get this thing fixed. It's, it's really, really powerful. Highly, highly recommend you do it.

Yeah. Brian and I have never walked into an organization and done a data mapping exercise on even one process and not had refinements that are in the GC's ownership. In the technology group for standard IT stuff, for security, for privacy, for metrics to the board, it cannot happen. So if you're following through on your data maps and understanding why they're there and where they're going— and I highly recommend you do this before you try to buy a technology that's just sort of sniffing for stuff. There's a lot of good stuff on the market. Highly recommend that stuff. But know why you're using it and know how you can leverage it. By sitting down and actually doing this people exercise of like, what do you know, where do you know, is really, it sounds pie in the sky. I tell you what, it's not just pie, it's a whole meal, people.

It's a whole meal.

And Ben, thank you for that. That's a great perspective of the internal dynamics. Let's talk about what one can do strategically outside, Ben, to advance the cause here. What thoughts do you have on?

Yeah, well, I think there are a bunch of different ways. I actually think one way is to kind of prove your value, go in, you know, prove your value. Value by actually having a really good discussion like that and getting people around the table and doing that sort of thought exercise of where the data resides. And clearly, that's something that Michelle, Brian have a lot of experience doing. I think the other approach is to try and say, OK, well, I haven't got the buy-in to do that yet. So what does the plan look like? And try and help. Something again that we have experience doing, try and plan out what would the process that you need look like. And allied with that, why should you do that process? I know Matthew talked a lot about it. But actually, we spend a bunch of our time, Michael, as strategy consultants actually quantifying things on behalf of our corporate clients. And this is another quantification problem. To solve. And yes, there's some stuff on the cost side that may not be sexy, but I think it's very easily quantifiable. And you know what, we actually spend most of our lives on the revenue side. So we can bring that, we can think about, you know, sometimes it's a what you have to believe exercise, but it's, you know, if you can improve your win rate with this subset of customers that we think this will resonate with by 5 points, then this is the implied value. That sort of exercise, and it doesn't have to be a boil-the-ocean effort, can yield incredible buy-in as a result. Yeah.

And I guess I would add to that that this exercise is very much of an internal to begin with. But the outside-in view might be, what are my peers doing? What are folks who are like me but not directly like me doing? And how are they benchmarking? Thoughts on that, Ben?

Yeah, totally. I mean, benchmarking is a tool that we use to demonstrate lots of things and can be a very effective trigger of, oh, are my peers doing this? Oh, well then I better do it. And I, you know, I think used as a— used in conjunction with the kind of opportunity, which is kind of the carrot and the stick, I think that can be an incredibly powerful way of saying, look, you know, here is the potential opportunity and the reason why you might do it. And you know what, you're not really not going out on a limb by doing this. In fact, all your peers have already done this. So there's a burning bridge here, do it.

Good stuff. Any final thoughts? Because I think we're going to try to close on something we've talked about as a group, but we'll throw it out there, which is this— the cogs is a very effective way to think about security and privacy working together as discrete and separate entities. I don't think any of us is necessarily in favor of putting a new head of all things security privacy at chief trust officer, but I think that's an interesting topic because it does unify a single point of contact. Certainly the alternative is to do more alignment, and certainly that's something everybody should do, but any thoughts about whether the conversation we're having warrants a new role or redefinition of existing roles or merging of security and privacy into some sort of cohesive oneness? Any thoughts on that?

I'll take the first bullet as the annoying lawyer in the room. And give you the, it depends, and what it depends on, which is what they teach you that your first night of law school. Like, if you don't have the answer, say it depends. I need to do some research. The reality is it's sort of the thing that says culture eats strategy for lunch, and software is eating the world, but data is biting back hard. The reality is if you have a very strong hierarchical culture and people actually are command-led and they are, you know, because Brian said so driven, and they will actually do that and attest to that and conform to that. There are industries that are highly regulated often, or they have a highly charismatic leader or whatever it is. Then you can have perhaps this unified leader. It has to be a leader that has enough emotional maturity to know what they don't know. The worst thing in the world is to get somebody who's very tilted on one side or another, or only risk pointy hat, um, you know, accountancy sort of bent. That mature leader, if you have that pyramid structure, has to be capable of ingesting very specific deep specialty knowledge into their metrics and coming up with these shared metrics. So they have to be sort of not kumbaya if you're command and control, but you have to have that maturity at the top or it all falls apart. Otherwise, if you do do a more horizontal model, you have to really clearly define how do these cogs work and what do we do when inevitably there's turfdom, there's co-ownership, or there's just personality clashes in the teams. And so you've got to get that stuff right. This is hard stuff. And it's high-stakes stuff. So you're going to find people who are competing for money. You're finding people who are competing for attention or expertise. And so this is where you sort of go back into this hardcore leadership led by hardcore metrics that have been agreed upon to sort of smooth the way when those inevitable cogs meet a little grease.

So we got about a minute left. Anybody want to offer anything up here in the final 60 seconds?

I'll take a shot at it, right? At the end of the day, when something really bad happens, let's say a data breach, and, you know, the board and the executives look into it and realize, wow, wow, this was egregious. We really don't have good synergies between privacy and security, and this kind of just fell apart. At that point, it seems to make a whole lot of sense to put a single person with their feet at the fire going, you're accountable for fixing this, to make sure that there is good synergies and make sure that, you know, if it's a data breach and it does happen by chance, it's a small one and we're able to, you know, contain the damage and recover from it quickly. And best case, we don't want that data breach to even happen. So you're in charge. Great. If you feel that your organization already has that good strong position, to be able to protect from those bad things, you know, the regulators coming in and going, hey, you guys aren't even close, right? You know, let's, let's see how much you're going to owe. 4%. You know, if you feel that you're already there, maybe that decentralized or whatever on your model, you know, your model currently in place, maybe that's sufficient. But if not, do you really want to wait until something really bad happens before you decide to put overarching ownership and accountability in place? Probably not, right, if you want to avoid that situation. So it's a business decision, and there's, there's pros and cons for everyone, but it's something that people should look at with the right forethought and seriousness that it takes on how they want to be during a crisis.

Terrific. Well, I'm pretty sure we're going to be talking about this again and again and again. So, so Michelle, Brian, Matthew, and Ben, thank you for the time. For those of you listening, thanks for joining us, and stay tuned. We'll be back to you with another, uh, cybersecurity and privacy program. Thanks again.