Winning Hearts and Minds for Security with Naomi Buckwalter

One of the greatest challenges for a cybersecurity leader is to convey upwards the present digital risks and value of security to protect assets and reputation, capabilities and people. Boards and the executive suite is really where vital support or resistance will be rooted. And today I'm talking with Naomi Buckwalter. She's a virtual CISO, director of information security, former security architect, she's an architect and engineer and founder and executive director of the nonprofit Cybersecurity Gatebreakers Foundation, which is dedicated to raising awareness around the problems in cybersecurity hiring. Welcome, Naomi.

Matthew, thank you for having me. I love the intro.

Now, you and I were recently speaking at a conference together, the Front Lines Briefing, and we had Davina Pruitt, Matthew Rosenquist from NIST, and we were all talking about industry-wide cybersecurity staffing issues, if I recall. One of the things I didn't get a chance to ask you, we didn't have time to discuss, is the fact that you're, you're famous for saying the skills gap is an illusion that lives in the minds of cybersecurity leaders, and there is no skills gap, there's only a demand gap What do you mean by that? Before we get into our normal topic here, what, what do you mean by that?

Oh man, can I match your energy right now? I'm all excited about this topic because I really am. Coffee? Oh my gosh, give me some of what you have. But I— yeah, there is no skills gap because if you take anybody who's really passionate about cybersecurity and they're trying to break in, you talk to any one of these folks, they're building home labs, they're studying for certifications, they're networking, they're going to webinars and conferences, and they're so into it, right? Think about the last time you were into something like a new love or a new hobby, right? You're like, oh, I gotta do more of this. And you talk to, there's so many people out there, right? And you're like, oh, okay, all right, we just got to get you a chance. You got to get your chance. And then they start applying, and then they realize there's so many gates, right? 5 years of experience, a CISSP for an entry-level job, it makes no sense. And to me, that's simply because hiring managers and people in security who are trying to build their teams, they're looking at it all from the wrong way. They're not understanding that to build the next generation of cybersecurity professionals, they need to take somebody as they are, full of potential and critical thinking skills, people skills, all the soft skills that they can use to train into next level of cybersecurity professional. So there is no skills gap. It's a demand gap for entry-level people, a pure demand gap, lack of demand for people with no experience. Think about this. Are we going to hire people from each other? Are we going to solve this problem by poaching, outpoaching one another? Like, that makes no sense. Why are we trying to do that? Like, if anything, that you're just going to make your work harder because now you have to start, start getting people from other companies, paying them 25% more, whatever it is. Like, it's just, we're not going to outpoach each other and solve this problem. So If we're really, really serious about winning the war on cybercrime, why not grow the next generation of cybersecurity professionals? Because they're not groundhogs, Matthew. They don't just pop out of the ground ready to go. You need to hire and train them, take them as they are. And who cares? I'm just going to keep talking until you shut me up. But who cares if they leave? Like, isn't that the whole point, is to build up the security generation after you so you can retire and get fat on the beach? I want to get fat on the beach. I have plans.

I love that message. And I too want to get fat. Well, maybe not fat on the beach, but tan. We'll go together. Tan on the beach. I'll go with tan on the beach. And it's such a great message too, because you're right, you know, poaching and so forth, it's not sustainable and it just creates more chaos. So if we want to have that next generation of security professionals to hand the mantle over to, right, we have to start giving people opportunities. And it's such a great message. And it kind of leads into today's topic in how to communicate cybersecurity, and in this case to the board. I mean, you're great at communicating and advocating for different aspects that help the industry, but the board, right, is one of those big challenges. And although cybersecurity may be led by a CISO, it's really the work and the support to maintain a worthwhile protection it requires support, right? And that includes prioritization and financial backing, which has to begin at the top. And many CISOs have difficulty in communicating and garnering that support. But my first question to you is, why is that? Because many CISOs avoid that. Why is communicating with the board so important? What are those big benefits or drawbacks that you see?

Yeah, I could just tell you right now, I think the main reason why we're not getting a seat at the table is because we don't understand the value of information security. We don't understand our role. Think of all the security engineers out there and you ask them, what's the purpose of information security? They will probably say something like, uh, to secure things, to protect the assets of a company, the confidentiality, integrity, and availability of data and systems. Like, they'll give you the book answer.

That's the textbook answer.

Yeah, except it's changed. Information security is no longer an engineering problem. There is a value proposition that we don't talk about at all, and the business only cares about money. I mean, I know we live in a capitalistic society. That's a whole nother podcast for you, Matthew Rosenquist. We're in a terrible situation where we are now. But like, if you want to be gainfully employed and you want to make progress as an information security professional, you have to start understanding security is there for the business. We are in a support industry. I know it's, it's a crazy thing. The business, it doesn't exist to help the security team. Like, the security team exists for the business. Think about the business as a rocket ship. They're on their way to the moon, right? You as a security professional make sure everyone's wearing their spacesuits, they got their safety buckles buckled in, they got their safety blanket tucked in next to them, like, and everyone is on the same path, and you're just trying to help them avoid asteroids. Or whatever. I'm not a space person, uh, clearly. But like, you are there as a support. You're enabling the business. You're supposed to help them and guide them and help— like, don't help have them run into things. Like, you're going to tell the feature, you're gonna be like, oh, don't worry about this thing because I got it covered, right? You're helping them guide their business and be as risk-free as possible. And that is the point of information security. And you ask anybody who's successful at getting a seat at the table, they'll tell you the same thing. They're like, security is a business enabler. Security is there to support the business. We are a support industry. And they all understand this. It's the people who are not successful that who will answer security is there to secure things. So you talk to any security person, you ask them what is the purpose of information security, it is very telling where they are in their organization, what information security is meant to do.

So I'm a CISO, why even worry about the headache? Why should I want a seat at that table, get in front of them and talk? What's the benefit to me? I'm busy, I got fires to put out here. What's the benefit for the CISO?

Well, I've never thought of that actually. If you really have that servant's mindset and say security is a service for the business, we are a support industry, your success or their, the company's success is also your success. So if you have any selfish or ambitious reasons for doing this, it would help your career if you could have a seat at the table. You would have the visibility across the organization the touch points and networking with other executives, you will now grow as a professional. Just not at— not just in security, not just in the technical stuff, but you can grow in your executive presence. You can grow with soft skills and people skills and networking and all those little things that will help you move up in your career. And a lot of CISOs don't really see that. A lot of security people don't see that. They think it's just— CISOs are like the king of the nerds, right? Like, oh, I'm the king of the nerd, I'm just going to be the nerd or the queen of the nerd. That's what a lot of people think CISOs are. But CISOs understand that we're really just business executives that happen to do security, then start to understand the purpose of information security. Again, ask any security person, what's the purpose of information security? It's very telling how security is seen at that company with just the answer that they give.

And the sexy side of, of, if there is a sexy side of being a CISO, is, you know, dealing with the attacks and the risks and, and the crisis and so forth. Um, but there's a less sexy side of you have to have a budget. You have to manage an organization, you have to have approval for staffing growth and everything else. And if you don't have buy-in, if you don't have the support from the C-suite, from the board, you're probably not going to get the resources that you need. And CISOs should be their biggest advocate. I've seen in some organizations where the CISO doesn't have the seat, they rely on the CTO or the CIO or the CEO to go advocate for them. And sadly, those representatives, even, you know, with the best intentions, can't explain it, can't make it visual, and can't tell that story to show the true value. And if you're not showing true value, again, we live in a, you know, money is king, profit is king. And at the board, if you can't show relevance at that level, you're not going to get their attention. You're certainly not going to get their support.

I agree with you so much. You got to show value.

Yeah, the unsexy side of being a CISO, right? Managing the staff and, you know, getting the budgets and putting in all the backend work. But to show this relevance, right, of cybersecurity, it's really important to also know your audience. And if you're talking to the product engineer or architect, that's one discussion, but talking to the board is something completely different. They have a different mindset and different backgrounds and different objectives. Can you kind of paint that picture for us? Who are these people, these shadowy figures on the board that we have to speak cyber risk to?

Well, hopefully your board has someone accountable for cybersecurity risk. I certainly do on my board. I talk to her, right? So like, if you don't have somebody there, then hopefully you can get somebody. But the shadowy figures, they're in the best interest of the company, you know. They're on the board for a reason. It's so the company succeeds, so they meet their goals, they have good objectives, they can get their business objectives met. Like, those are all very, very honorable things depending on what your business is in, obviously. But you as a CISO now should find that advocate on the board or somebody who is ultimately accountable, even though you might be responsible. That RACI framework, thank you very much. If you are responsible, someone else should be accountable, and it should be at the highest level. If it's not the board, You know, the second best would be the CEO. He or she could help stay accountable to security risk, right? There is no third best. I think that's the only two options for me.

The board, the CEO.

Yeah, there is no third best. I think the latest data survey— No bronze.

There's no bronze in security.

There's no bronze. It's just pain and hurt. But so it just got dark. I think this recent survey, I can't remember who actually did it, but I'm sure it was a reputable place, but they actually asked all the CISOs, you know, I think it was like 33% of CISOs still report to someone in IT, right? The CIO, the CTO, and think about how that translates into cybersecurity budgets or priorities. I think it's a conflict of interest for a CISO to report to a CIO because if information technology is all about the availability of business systems, And then you've got security under them, which is like the CIA, confidentiality, integrity, and availability systems. C and I, confidentiality and integrity, are kind of gonna take a backseat to like availability, which is always the case. It's like, oh, we need to keep these systems up and running. If we patch it, we're gonna take it down for 2 minutes and that's gonna be millions of dollars, but whatever. But there's always gonna be that conflict of interest. And I found personally to be true. I reported to a VP of engineering and it was always a struggle, right? I'm always like, hey, what about the security stuff? Oh, don't worry about it. It's not a huge risk. Don't worry about it. Cause we're going to put it in the tech debt bucket.

Right.

And we'll get to it when we can, but it never got, got to, it's just not a priority because of the conflict of interest. Now the security person can win the hearts and minds, title of this podcast, winning hearts and minds of the board, of the CEO. And they understand you are on their team. You're trying to enable them to be as risk-free as possible to navigate to the moon. They understand that you're on their team now. It's not an us versus them. You have their best interest in mind, so your objectives are also their objectives, you're aligning your information security objectives to business objectives, people on the business start seeing you as a partner and they ask you for your advice. They're like, what do you think about this? Is this an important thing to do? Do other companies do this? And you have to come up with the data, be very data-driven and say, yes, I've seen this in other things. Here's the data that supports this argument and we should do it this way. Right. And they'll say, I'm going to take that into consideration. I'm going to follow your recommendation. That's what you want to see as a security executive. Now, if you see the opposite happening where you aren't being invited to meetings, you aren't talking to the board, you aren't talking to anybody in this executive suite, right? Then you know security is not one of the top priorities of the company, and that's okay too. I will say that is okay. It is a business decision to make security a priority. Now, to me, I think security should always be a priority, but I am biased, Matthew. I will say.

No, no, not in the least. Not in the least.

Yeah, but think about how, how, like, how much data and connectivity we have. We have in the world today. Every company is a technology company, whether they want to be or not. And they have data on people. They have, uh, you know, grocery stores. If ransomware gets attacked, right, you don't have grocery stores anymore. You get pipeline, you don't get gas anymore. You don't have hospitals anymore. Everything is just interconnected these days, and it's going to be even more so, which is now the reason why I'm really standing up and saying security is everyone's responsibility. We need to train and mentor the next generation because they're not going to come out of nowhere, Matthew. They, we need to train them because the veterans that we need now can only be created if they're entry level and we take them now because then they'll be the veterans of tomorrow. That's what we need. We need that because it's just going to get worse.

And they need, as you said, they need the visibility and the priority. And one of the big avenues is to be able to get into that board. And if you are in an organization where, you know, there isn't that direct contact, right? Or there isn't an advocate on the board, that should be your first You know, mission is to make sure that they're aware of it. But again, you know, as you said, they talk business, they talk profit and bottom line and reputation and competitive advantage. This is the language of the board, which is vastly different than the language of risk and attackers and threat and downtime. So how important is it to speak the language of the board as the security professional because you're trying to become that trusted advisor, right? You're trying to help them so that they can make that business decision, the right business decisions around security. How important is it to speak their language?

Oh yeah, it's absolutely important. But you're probably wondering, well, how do I do that? You just have to educate yourselves on what business executives, how they work, right? It's not something you're just going to know. You can't just wake up one day and all of a sudden know how to speak to a business executive, like learn what they know, take an MBA class, right? Like I certainly went and I got a business degree, a master's degree in business. Like that's other things you could do that too. Anyone can do that. I know it costs a little bit, but there are so many free programs out there. You can learn, uh, I don't know, EBITDA, right? Like there's things that the executives will talk about and you're probably just going to sit there not knowing what the heck they're talking about because it's all financial stuff. But you as a security executive really should know that stuff. Because again, your objectives are their objectives. And so you want to be able to enable them. So having that common language and understanding, and back to your original question, you should have a common language with anybody you talk to, quite honestly. And if you can't empathize with where that person's coming from, this is where the soft skills come in. You're never going to be able to communicate with them. If you can't talk to, to an engineer on the DevOps team, and you can't talk to an executive over on finance, like if you can't talk to these people, cause you can't empathize with their problems. They're not going to want to listen to you. They're not going to want to ask you for their— your advice. They're not going to want to include you in meetings. So why not learn? Everyone can learn. All the things are learnable. You just have to have that growth mindset and just be like, oh yeah, I don't know anything about this. Like, this is why I'm not an anti-vaxxer. It's because I don't know anything about vaccines, so I'm not going to be an anti-vaxxer because I don't know any better, right? It's like kind of like those things. I'm not going to be anti-finance because I don't know anything about finance, so why would I be anti-finance? That makes no sense. I'll leave it up to the experts. Right? But learn about what you don't know so you can at least have a common language with them. That went off in a million directions.

Having like mentors or leveraging your community of other security professionals in maybe, you know, learning from what they do or best practices that they handle or experiences, failures that they've crawled out of. How important is that?

Oh my gosh. Everyone should have a mentor for sure. Matthew, who's your mentor? I'm sure you have more than one.

I have several and I do work with other people too.

Yes, we should all mentor and mentee. Pabbie, a mentee. Yes, I do have several mentors. I meet with them regularly. They give me homework and assignments. Same thing with my mentees. I don't have any right now because I'm just swamped, but when I did, I had plenty of homework to give people. We met all the time, right, on a cadence, uh, checked in all the time. Like, so we need more of that in, in our industry. I think it is happening at a grassroots level for sure. However, I believe we're not talking about the right things. Some of our conversations are probably not the right kind of conversations. Like some of the things are, you know, what can we do to be better business partners, right? What have you done that learning those lessons? Share with me, how did you get past this one hurdle? How did you get SOC 2 certified within the 6 months that you did this? Like, how did you do that? Right? Train me, tell me how you did this. I can apply the lessons that you learned to my own company, and you're just gonna evolve the profession that way.

And the, this topic itself, right? How to communicate upwards. I think is one of the most important discussions, and that's one of the ones that I have very early on with the CISOs that I mentor, because if they can't get the attention, if they can't talk with relevance, right, to their superiors and help them, enable them to make good security decisions and support the programs at the right level— again, it may not be what you want, But it's got to be what's right for the organization. Empowering them to make that decision, good decisions, that should be one of the early missions of any CISO.

Oh, absolutely. It doesn't matter if you are the most senior level person at your company, you're effectively a CISO just without the title and sometimes without the responsibility, not the responsibility, sorry, without the visibility. But you still have the responsibility to improve and maintain security postures at your company. However, if that company decides that security is not important, you should be able to let that go, Matthew. You should be able to let it go. Maybe that's not where you want to be in your career and you just, you're more ambitious than that, then you would leave. But if that company decides, hey, we only sell socks, we only have like one single warehouse, no IoT, we have one little website that's on Wix, right? Like, we don't really need security, we don't have any PCI. Like, so, so if the risk there is very minimal and they say we don't want to support information security as much because it's not as important, that's their decision. You should be okay with that. However, I will say, if you've done your due diligence and you explain to the board and the CEO what your value is, they should understand how they can use you in the best way, where you can say, I'm going to help you grow business, I'm going to help you, I'm going to enable you to where you want to be, here's what I can bring to the table. It's not a cost center anymore at that point. You are helping them them grow revenue, grow profits, grow resource, headcount, whatever it is. They need you to help them. And so once they realize that, game on, you could do anything you want. Build trust, anything can happen.

And a good CISO should be leading that discussion. A good CISO should go, hey, I've done the risk assessment, we're a SOC company, we only— we don't have any IoT, we don't have this, you know, here is our risk, it's really, really low. But still be able to show the opportunities. You're right, we don't need a world-class cybersecurity program, we don't need 50 engineers, we don't need a massive SOC We don't need any of that. Here's what is right for our size, our business objectives. And being that, again, that's that trusted advisor coming in and saying, hey, I am the risk expert. You were worried about this. Here's the risk, here's the potential downsides, and here's the recommendation. That's where CISOs can show leadership. It's not always saying, I always need a bigger budget. I just need more, more, more, more, more. It's really understanding that risk in business terms and helping those executives come to the right rational decision on how to manage risk. So, yes.

You said that so well. Yes. Let's put that on a tattoo, Matthew, you and I, right after this. Right on our forehead.

Well, that's going to be a long tattoo. Okay. So, but what are the biggest mistakes you've seen with cybersecurity leaders walking into that boardroom, maybe for the first time or maybe for the hundredth time? What are the big mistakes you see that people should be avoiding?

Oh gosh, I don't have too many examples of this personally, but I have seen and heard others talk about this. And I would say they just don't speak the language. So they're coming in, they're like, here's all our risk, and they just go down the list of all the priorities and critical risks, all down the row here, not really offering the business value and speaking to the businesses what they understand, which is money. They're not tying it back to revenue, they're not tying it impact to cost or impact to the business. And the business folks are just sitting there like, so everything is bad, so everything's on fire. Like, I don't understand, is this— are we going to go under? Like, and so the security people are in there just crying wolf, crying wolf. And essentially that's what we're doing. Like, this is going to happen, it's totally going to happen, impending doom, right? And then they do this over and over and over again, and the business just gets tired of it. They're like, well, we spent $1 million on your security tool. You said that's going to work, and you're still coming every month with or every quarter with another list. This is never going to end. When are you going to show me like progress, right? So the business executives sit there and they're like, well, it's just kind of hopeless. We're just going to ignore you. Hopefully you go away. And that's where the problems start happening, right? They don't bring you in the conversations and you're not a trusted advisor. Instead, what you should do, you should show the business value. You should be like in 3 or 4 slides. You really don't have too much time. I only have like 5 minutes. What's my board, right? Like, it's not a long time. So you have 3 slides and you go, you know, here's the top priorities for the security team. Here's how it aligns with your business objectives. Your company should have OKRs, any kind of objectives and key results. You should tie it back to the OKRs and you should say, here's what we've done this past quarter. Here's what we're doing in the next quarter. And here's the amount of risk that we're going to reduce in dollar terms and everything. If you use a standardized framework to calculate risk, I use Open FAIR, you can actually calculate how much money it would cost the business if something were to happen. And they can also bring, if you want to be special, how much money it would take to fix it. So you say, hey, in, in this $4 million risk thing, it only takes $1,000 to fix. Look at that, right? And you bring the solution. You don't just bring problems, you bring the solutions too.

No, I, I think you're right. And I use a similar model. I actually go in with my board and say, okay, based on all the discussions of what we've discussed pre— This is where your risk appetite is, right? This is what you're saying is okay because it's never we get rid of all risk, right? That's impossible and it would be far too expensive, but we don't want nothing either. So, typically, a board wants somewhere in between that optimal level. So, I show them that. I show them where we're at, right? And, you know, the progress to getting there. And then we have that discussion that at the end of the meeting, are you good? With this risk, right? Because based on your risk, you know, we're probably going to be breached in 3 years, somewhere in there, and we may lose a limited amount. We'll be able to, you know, recover. We'll be able to, you know, minimize the loss, but it's probably going to happen. Or we may have a limited ransomware. This is the risk that you're accepting based upon your financial commitment and the priorities. If you're okay with that, we'll keep moving and making sure that we hit that target. If you're not okay with it, it's a different discussion. Where do you want to be? And if you do want to have less risk, it's going to come with prioritization. It may come with extra dollars and everything else, but let's define that goal and there's going to be commitments to it.

Yes. Yes. Get someone accountable. And it works well.

It works well.

It does. It does. And I'm sure you're highly successful with your board, for sure.

Depends which board I'm talking to. You know, some days more successful than others. But no, that's awesome. So, okay, you had mentioned empathy earlier. What other skills, right? Obviously, there's some level of technical skill. There's some— we've talked about communication skills. You had mentioned empathy. What are some of those big skills? Are those the only ones? What are skills for successful communicators to the board?

Oh, man. Is there a book written about this? I feel like there should be. How to Be a Successful Person in general, like how to to be a human that nobody hates. Although if you're not hated by at least one person, I guess you're not doing it right. I'm sure there are plenty of haters listening right now. So empathy is a huge one because you can now convince somebody or motivate somebody to change if that change needs to happen. If anything, it helps you grow as a human. Your soul learns lessons, right? Another one's critical thinking, data anal— Analysis? No, analysis. Data analysis. Yeah, analytics, right? So words. Speaking is another one. So there's— however, in security, you do have to have the technical. I will say you can't just jump into security leadership being the, you know, just an executive without knowing security. Like, you need security, you need the engineering.

I mean, do you have to be able to read hexadecimal off the line? I mean, What level here? You have to compile binaries. I mean, what level of technical knowledge do you need?

That's a great question. And, and I, I do have in-depth knowledge for a couple of verticals here and there, like application security, security architecture. Those are like my two verticals. I don't know everything there is about reverse engineering. Like, I don't, I don't know everything about all these other things, and that's fine. Like, I'm not supposed to. I hire the team members who do, but I don't have to know that myself. I do have to have at least one or two verticals, I will say. The most successful security executives that I've seen are highly technical in one or two things. They can speak very, very well to it, and they trust and enable the team members who know the other things. And think about all the different subdomains and specialties and subspecialties— there's no way one person's going to know that. But it does help to be highly technical in one or two areas, for sure. So any security executives who doesn't really have that and they really can't speak to the engineers, they're going to lose half their audience. They're going to be like, hey engineers, I need you to do this, and they're going to be like, what are you talking about? You're an idiot. Right. And like, how many times have we seen engineers complain about security people and be like, security doesn't know what the heck we do. We have no idea what they're telling us to do. We don't believe them. We don't have any trust in their competency. Why should we listen to them? They don't understand anything. So kind of like the two verticals I think will be very helpful is the ability to talk to DevOps engineers, understand security in the cloud, understand security and applications, how they actually build applications. Right. Like those are the kinds of things. That I almost feel like every security executive should know if that's part of their audience. If their audience is not them, then that's fine too. At least be able to speak to the audience that you do serve. Yes.

And for those CISOs who don't have that in-depth knowledge and maybe have tried to keep it at arm's length, you know, go back to empathy, right? Why not spend a week, right, and dive into that world of those developers or sustaining operations or or, you know, some group that maybe you haven't got the depth of and at least understand their challenges, right? And that will give you the empathy to help prioritize and communicate, right? Down the road, it'll also earn you a tremendous amount of respect.

Oh yeah.

From those audiences to be in the trenches with them and to feel their pain.

Mm-hmm. Oh, absolutely. Yeah.

Top recommendations. We're kind of coming to the end here. I want your top 3. Give me 3, 3 recommendations for security leaders. This is what you need to do if you're going to be successful in talking to that board and gaining their support.

Whoa. Okay. Putting me on the spot here, Matthew. First one is have a growth mindset.

Growth mindset.

That's my first one. Know that you don't know everything and everything can be learned. So don't give up. You can learn anything there is to know about anything, essentially. I think that's what the internet's for these days.

Believe everything on the internet. That's what I just heard you say.

Uh, you learn everything from YouTube or Matthew's channel. Uh, so, so one thing, growth mindset. Have a growth mindset. Uh, two, be humble for sure. I think that ties into the growth mindset. Humility is such a huge way to build trust. Transparency, humility, because you know, you can— you're fallible. Like, you make mistakes, and that's okay. But if you want to grow as a human and as a security executive, like, having that humility and bringing that empathy and that transparency with other people, they're going to start trusting you and building that, that just rapport with you, right? And so you're not going to come in guns blazing and say you're going to fix this, this, and this, and then leave. You're not like a seagull dropping poop everywhere and flying away. You need to come—

the visual there. Yes, the CISO seagulls. There needs to be comic about that.

For sure, for sure. And like, a lot of executives do that. They just be like, oh, I noticed this one thing is bad, so you got to go ahead and update this thing, and that's it, and you leave. Like, that's not— that's not gonna work.

So, title of our next podcast: Don't Be a Seagull. Don't be a seagull.

Yeah, that's— that's— a lot of us do that. I get that. Uh, you know, I have one more, but I really can't think of another one. I think it all really comes down to soft skills. If you— if you want to think— having that growth mindset, you can learn anything. Being humble and being a good person, that's another thing. And 3, just realize you're not here to, you're not here to be served as a security professional. You are here to serve. And so it all comes down to those soft skills of understanding your role as an information security executive or as a security professional. You are not here to tell people what to do. You give guidance and advice and resources and best practices, and you help them understand the risk. It's all about risk. And if you're not translating that for the board or for anyone you're talking to, they don't understand the importance of security. You have not done your job right. Security engineer, security executive, security architect, whoever you might be, you are not understanding them. You don't have the empathy. You don't have humility to understand what you don't know and how you can bring that information to the person that you're trying to talk to.

And the board is just another team.

Another team.

You know, you got to be part of that team to help the organization get where it needs to go. You play a role.

You are a role player of that puzzle, right?

But you don't get to be a seagull. No, no, no, it's teamwork. And all those soft skills that you mentioned, right, the growth. Yes. And, and bad things are going to happen. Bad things are going to happen outside of your control. And you may have to go into this team that you've now fostered and become part of and give bad news at some point. Again, it doesn't mean that you lose trust. You should have already built that in and let the team know, hey, these are the challenges. We can do X, but something may come up, right? And we're going to try and mitigate it. This is the role. This is— but we're all in it together. Yes. So, and you're— I would agree. The soft skills are hugely—

it's so huge if you want to make progress in your career, for sure. My career never went anywhere until I really started focusing on people skills. It's so strange how that worked out. I used to be a terrible people person. Oh, I still am.

I don't believe you.

I am working on it.

I do not believe you.

Oh gosh. I was No, I was exactly what I, what I hate even now, which is, you know, somebody who didn't understand the role of information security, who wasn't great at communicating risk and just telling people, walking in and be like, this is how we're going to do it, and then leaving. Like, I literally have meetings like that where I'm like, this is what we're going to do. Goodbye. Like, it's not, not good. I used to be a terrible people person, but understanding that it took a while, like, I'm 40 years old. I've had plenty of— I've taken my lumps. I even got fired from a job once. So I realize that now. I'm just like, okay, I needed that to learn that lesson. And now I'm here. I understand the reason for information security. It took a while, but I get it now.

We all have interesting journeys.

Yes, absolutely.

So properly communicating and gaining support from the highest echelons of an organization is absolutely crucial to success for for every cybersecurity program. Naomi, thank you for speaking today and sharing your insights on this important topic. And thanks to our audience. Be sure to subscribe and hit the like button and share a comment, uh, thoughts, or your experiences in talking about cybersecurity. Thank you, Naomi.

Thanks for having me, Matthew.