Episode 20 – Leading with Presilience: The Mindset of Adaptive Security

Welcome to Executive Checkpoint, the live podcast for security professionals. Each week, we explore industry trends, challenges, and insights with leading experts. This is your insider access to the minds driving change in our industry.

Welcome to Executive Checkpoint. I'm your host, Tino Urbina. Today we have a great guest, Dr. Gabriel Schneider, CEO of Risk2Solution Group, creator of the Presilience Framework, and a globally recognized voice in security and risk management. Named one of IFSEC Global Top 20 Thought Leaders in Security and Fire for the 4 consecutive years, Dr. Gabriel has dedicated his career to turning risk into opportunity. We will explore how his unique approach to blend adaptability and proactive thinking help leaders not just bounce back from challenges, but grow stronger and more secure in the process. So, Dr. Snyder, welcome to the show. I'm glad to have you. I should say good morning for those of the audience in the United States watching. This is, uh, you're engaging from Australia. What city? Remind me again.

I'm based in Brisbane.

In Brisbane. So good morning and good afternoon.

Good afternoon, Tino. Lovely to be chatting to you.

Excellent. Well, as always, we, we love to, uh, bring new opinions and perspective. And of course, that begins from the beginning. So tell us a little bit about your background, where you started in security, what brought you to where you are today. Sure.

I'm originally South African, so I started my career actually in martial arts. I started training when I was 5. I was a pretty sickly kid. There were some doctors who said I'd never really exercise my whole life. But by the time I finished high school, I had 2 second-degree black belts, and I was on the South African taekwondo team.

Wow.

Um, my year was the year that conscription ended in South Africa, so it actually led to a lot of confusion for me because I wanted to join the army, but there was nowhere to go. So I actually landed up spending a year traveling around the world training and teaching martial arts. I became a live-in student of a guy by the name of Dr. Dennis Hanover, who's considered the godfather of martial arts in Israel. Um, came back to South Africa, started studying marketing and management, and set up a martial arts school and got a contract with a close protection company. to do all their defensive tactics training. And my initial deal was a contra deal where I would do all the close protection training in exchange for the DT training. After about a year, I'd sort of cycled through the whole suite of close protection and started operating. Uh, about 4 years into that, I'd finished my round of studies and I'd switched the things over where I was a full-time defensive tactics instructor and close protector. Set up my first business back in South Africa in 2000, which was a business called Dynamic Alternatives. That grew into one of Africa's leading specialized security risk businesses. At our peak, we had about 150 either protectors or security advisors working in roughly 22 countries, doing everything from training presidential protection teams to fraud investigations. Um, never having formally served in the police or military, it's, it's kind of hard to create a robust career in security. Without that sort of background. So I focused on my academics. I was the first in Africa to get a master's in security risk and later a PhD where I looked at the design and development of a best practice use of force training model. I got a scholarship to study in Australia in 2007, which is where I started my PhD. And our current business, the Risk to Solution Group, was born in 2013 when we realized that there were actually the vulnerabilities and the gaps for a lot of our clients sat between their silos and sat horizontally and vertically between their silos. And the way to tackle that is an integrated risk mindset where we stop thinking that's safety, that's security, that's, you know, residential protection, that's mobile protection, and you actually just understand how threats and risks intersect. I then landed up teaching a postgraduate program in the psychology of risk for almost a decade. through one of the universities that we partnered with. That was sort of my transition from protective security as my mainstay into the psychology of risk and human centricity as my specialty. And, you know, I've continued to grow the Risk to Solution Group through that. I have no doubt we'll talk about resilience, so I won't go into that just yet. Thanks, Tino.

Very great background. And, you know, very interesting on the combination of the discipline of martial arts. We talk about scuba diving, so I'm sure that has some something to do. As well, if not on the business side, to recenter yourself off the business side. But, you know, there's, I'm sure, a point where you went from looking at the world from, you know, risk management as a checklist and more to a mindset. Where does that switch? What, for instance, happened for you to make that? Bridge? You mentioned that. I'm curious about that. Awesome.

So it really started actually, if I go back to my close protection career and then look at our early, our early business, and I'll give you 2 examples. I became fascinated with decision-making mainly because I kept seeing so much bad decision-making happening around me. And I'm sure your listeners, particularly if they're on the executive side of the security function, will be frustrated because often you're talking to people about ways to keep them safe, ways to keep the business safe, ways to ensure bad stuff doesn't happen. And it's kind of a hard sell because if you do your job really well, nothing bad happens. Therefore, people don't think they need you. So that mix of things fascinated me. Equally, running businesses and looking at how we motivate people and how people make decisions. And I'll give you a quick example. At one point in my early business, We, we had about at that point maybe 30 or 40 close protection specialists working for us full-time, and we created this robust training structure to try and keep them at the top of their game. So we actually built a system where they could get an extra 5% if they attended weekly training, they could get another 5% if they passed their quarterly assessments well, and another 5% if their clients liked them. So there's a 15% uplift for performance. And human behavior being what it is, a lot of our people actually found, you know what, as long as my client likes me, I'm not going to get fired. And they've— a lot of them just focused on that one instead of the training standards. So I became fascinated with the psychology piece of why do people make decisions like this when there's clearly a better pathway, a better choice. The psychology of risk component helped me a lot with that. And as we've evolved through this, you know, this is really where the concept of risk intelligence and resilience were born. Because if we can't get people to make great decisions for themselves, what makes you think they'll do it for their team? What makes you think they'll do it for your business? And if you're protecting somebody and you've got to actually make hard decisions that sometimes inconvenience them and cause them discomfort to keep them safe, You have to be very good at communications and influence. So there were all of these pieces that, you know, make somebody a high performer that weren't really being taught much in any sort of security and risk structure. And as, as I started getting more experience with this, the postgraduate psychology of risk program, I'd ask these chief risk officers, chief security officers, chief information security officers, etc., who were coming on our programs, why are you here? Like, you already have a master's degree, you already have the C-suite job you want. What, what brings you to learn more? And almost all of them would give me the answers that lent themselves to roughly 2 concepts. The first one is they kept referring to the way they were treated in their organizations as being the handbrake to happiness. You know, the risk and security functions were saying, you can't do this, you're not able to do this, or if you want to do this, you need to spend all this money to make it more secure. So people would tend to avoid, you know, talking to security or risk and bring it— bring them in at the last minute when there's almost no value and you're trying to retrofit a solution onto something that's already badly designed.

Interesting. I think everybody can relate to that. Yes.

100%. And the second one was around not just the negative perception of risk only, but it was around people. How do we actually get people engaged, motivated, and wanting to sort these challenges out. And that for me became really important. I mean, I'll share a little anecdote with you and your listeners. I talk about it in my first book, Can I See Your Hands? Probably at the peak of my career, I was a full-contact martial arts champion. I was a professional close protector. And this is South Africa. It's a very dangerous place. Phone rang one night. It was my mother. She was on the way to hospital. My stepfather had just been shot in the head in an attempted carjacking. The bullet actually, the bullet actually went through her headrest, so missed her head by about that much.

Wow.

Um, grabbed my go bag, rushed to the scene. Uh, I almost landed up shooting 2 cops who were looting the car. I didn't know they were cops at the time, but luckily I didn't because my life would have been very different.

Sure.

But it created a fundamental shift in the way I think. And I'd love your listeners to, to embrace this idea that a lot of times in our careers, we focus on being the very best version we can be. You know, how good can I be at unarmed combat shooting, planning, threat assessments, risk analysis, etc.? You know, how specialist can I be? The challenge we've got in the way that threats manifest now, whether it's virtual or face-to-face, is that it's highly unlikely that the expert is going to be there when you need them. So how do we educate everyone else? How do we bring them with us? And using, you know, Colonel Dave Grossman's analogy of sheep, sheepdogs, and wolves, you know, I see we've got a bigger mission. It's not just about how sharp do we make the sheepdogs, because that's important, right? We want our security experts, our law enforcement experts to be the best they can be. But equally, how do we train sheep to be able to manifest sheepdog characteristics when there's no sheepdogs around? So we've got kind of a 2-way mission, and, and that's really where this— the, the higher-level concepts of risk intelligence and resilience came into play.

See, it's the human element that sometimes, you know, we always talk about technology and we always talk about what's next when it comes to, uh, applications, and, uh, the missing, uh, element is always that gap, right? And sometimes the blame is on the pay Right? You're talking about guards and the caliber of guards, depending if you're talking to corporate headquarters, when the reality is a lack of understanding of how to motivate humans. John Kotter, Harvard professor, had the book years ago called Leading Change, right? It was a big book back in the '80s. And it reminds me of one of the stories he mentions in the book about a CEO sitting in the board saying, guys, we're going to go in this direction and here's what we're going to do. And everybody agrees. And he gets up and—

He's going to do it.

leaves the boardroom and no one is behind him, right? I feel like security, we fall into that concept of leading, uh, becoming better leaders. So, um, you often talk about resilience as a mindset, not a product. For those of us just still wrapping around our heads on that, um, what does that feel like when someone actually gets it?

Well, the short answer is it feels wonderful because what you're doing is changing somebody's mindset away from a victim mindset of stuff happens to me to an opportunity mindset of how do I capitalize on what's happening. So there's a fundamental shift at an individual level which actually enables better performance and better decision-making to occur. When you get that shift happening in teams or groups, you get better team cohesion, better engagement, and better performance. And then when it happens at an organizational level, all of a sudden, you just see people working together, pulling in the same direction, and getting things done in a way that they weren't able to before. So, I think the interesting point with that is, I look at my own business. This concept of presilience, and I'll give your listeners just a quick snapshot of where it came from.

Sure.

As we were teaching the Psychology of Risk program, originally, for me, it was a fixation of risk and resilience. And this is before COVID before the whole resilience boom, where everybody thought resilience is the solution to everything.

Right.

Quick caveat on that. Resilience has to be built, nurtured, and fed. You don't just become resilient because your HR person tells you you are. This is a challenge for us and we'll talk about that as we move forward. But for me, it was incredibly simple. Risk, and we can take any definition you want, they more or less say the same thing. But ISO 31000, which is generally accepted as the risk management guideline globally, talks about risk as the effect of uncertainty on objectives. So we're talking about uncertainty and objectives, right? It means something hasn't happened yet, otherwise it's not a risk, it's an issue, incident, occurrence, emergency, disaster, whatever it's going to be when it happens, right? So the reality of the world we live in is most of our modern operating concepts were built on the— built out of the First Industrial Revolution. And we— if If any of your listeners are interested in systems theory, it's a very useful tool to add to your arsenal. But practically, we haven't modified the way a lot of those systems work in the last few hundred years.

Right.

So, if you look, if you look at those systems, they're built on 2 assumptions: a high degree of control and a high degree of certainty. So, when you have a high degree of control and a high degree of certainty, rules-based or compliance-based systems can work pretty well. You know, you follow the rules, and if you don't, we all know what's going to happen.

The military.

If you have the ability to implement consequence, you can run a system that way. I look at— when we do consulting, I look at businesses generally in 2 categories: those that are younger than 30 years and those that are older than 30 years. Why do I use that number? Pre-internet age, post-internet age, pre-digitization, post-digitization. So what we're finding is it's kind of hard for executives today because more and more we're not actually running business as usual. We're going from disruption to disruption in the way businesses run. And we'll circle back to where security and risk fit into this because we have such an important role to play in how this all works out. So the challenge we need now is if we have limited control and limited certainty, what do we do to cope? Because you can't be constantly in crisis management, which is the treatment that a lot of businesses use for disruption. Something's happened, we didn't plan for it, we've got a team or a structure that deals with these things.

Right.

But you enter the world we're in now, and there's lots of fancy words for what's going on. You know, polycrisis is one that comes to mind. But realistically, that just means we're dealing with lots and lots of different intersecting pieces that are going wrong at the same time. Equally, we need to shift our thinking to an opportunity perspective because we've never been in this position as humans before where we're so hyper-connected. We have access to the world's information in our pockets. We can talk to anybody, yet people are making worse decisions than we've ever seen before based on misinformation, disinformation, and malinformation permeating so much. So, you know, if we look at where we're going compared to where we've been, what we've got to be doing is understanding what are the skill sets we need to thrive now? What are the things we need to be able to perform through this incredibly fast-paced change we're all living through right now? And ironically, those skill sets are not knowledge, they're attributes. So we talk about 6 core skills that are critical to achieve resilience and manifest risk intelligence. I'll come back to risk intelligence shortly. Firstly, you have to have robust situational awareness. So if you don't know what's happening around you, how can you make good decisions?

Right.

Secondly, we need the ability to make sense and attribute the correct meaning, which fits into critical thinking as a capability. So if you can't critically think, how do you determine whether you're making a decision based on actually what's happening or your perception of what's happening? or information that somebody else has fed you to bias you so you make an inaccurate decision. So critical thinking is really important, but so is the ability to make great decisions. And decision-making is a skill that's very rarely taught, and it's closely aligned to risk management. So from my perspective, that was the transition from security into risk management, was how do we really understand decision-making and how do we get good at it? Then there's the next piece of once you've made a decision, How do you communicate it effectively so people come with you? Much to the story you just shared, you know, what's the point of being, you know, the most inspirational leader in your own head if nobody follows you?

Right?

It doesn't work. Then then the next part is interesting. We have to learn to actually do stuff. You have to act or you have to inact. And when we decide to inact, that means I choose to not do something. It should be mindful, right? I choose not to do something, not because I freeze. And I don't know what to do, but because I've gone through this process of looking at— looking around, situational awareness, critically thinking, evaluating what's happening, using the best methodology to make a great decision, communicating that with my team or my organization or my stakeholders, preferably all of them, and then deciding not to do something. So they're informed along the way. Because one of the challenges we've got in the modern world, and any high-level security expert has lived this over and over, Stuff changes. So what was a great decision, you know, 5 minutes ago might not be the right decision now. And humans don't like that. Like, the way our brains work, we are quite binary. We want things to be black and white. We want to chunk information together. But in actual fact, to thrive in the world today, we need to live in the gray. We need to understand both pieces, but we need to be able to manifest the best versions of ourselves for both. So I like to talk about the skill— the real skill we need now is the skill to learn. We have to be able to learn quickly and adapt quickly, and that's the last core skill in that Brazilian skill set that you have to develop to be high-performing and high-functioning. So the challenge with this stuff was, you know, really this idea of what is risk intelligence. So if we think about intelligence, you, you, you, you, I'm sure, have hired people through your career, as I'm sure many of your listeners have had to hire people. We all want to hire people that have 2 primary attributes, right? They're smart, so they have a great IQ, and they get along well with others. They have good EQ, emotional quotient.

Right.

The problem we found is you've— even when you find these wonderful animals, these Tino Urbinas who share knowledge and interview people and make the world better, not everybody who is smart and good at working with others makes good decisions. So we need a separate variable, and that's where this concept of risk intelligence evolved from. So the idea really, and I like to think about it in 3 mindsets, you've got your compliance mindset, which is I have to do what is legally required to perform whatever the activity is. Now depending on where you are, that might not be so simple. I was interviewed on another podcast a couple of years ago and I was talking about this piece and they had literally had a banking compliance expert on before me and the interviewer made the comment of We've just had this banking compliance expert who mentioned that a bank in Australia has to comply with over 7,200 compliance aspects just to trade. So, you know, part of the challenge is things like that were very well designed when we had control and certainty. In an operating world where you don't have control and certainty, often that compliance slows you down, creates double handling, disengages people. So it's a very awkward balance. You can't comply your way to success. You can comply your way to play the game. So compliance is the ticket to the game, not winning the game. So we have to change that mindset. But it happens on a personal level too. Think about yourself, and this is relevant for everyone listening.

Sure.

If we're experts in risk, and if you work in security, you should be an expert in risk. Yeah, we're evaluating what's happening around us all the time. We're coming up with decisions, etc. So, if you're an expert in risk, you should be looking at what is the thing that you and I are most likely going to die of. And most humans are still dying from heart disease, cancer, and diabetes quicker than anything else. So, if we're good at risk, it's not just about, you know, how quick is your draw and how quickly can you put, you know, 2 rounds into the target. It's, hey, have I been exercising, eating right, sleeping well, and going for proactive medical checkups? Because if you're not doing that stuff, you're not actually doing risk management on a personal level, right? So I like to think on 4 domains: self, others, organization, and societal. Great decisions should have positive impact for all 4, but that's really hard to do, which is why we have to get good at risk management. How do we get good at risk management? We understand risk intelligence, and then we move past compliance. The next move past compliance— and for your listeners, try and think about this like a 3-legged stool Or a triangle. For it to balance, you need the right amounts of each of these. So if I've got the right amount of compliance, great. Okay, I'm not going to get in trouble. I'm not going to go to jail. I'm not going to have regulators filing me. It's going to be okay. Then you look at the idea of resilience, and we go: If something goes wrong, what do I need to be able to do to get through this thing and carry on? So this is where resilience was really born, because as we researched resilience more and more, we found that there were 2 big problems. First one is proactive prevention. When you, when you look at resilience experts, they're looking at when something goes wrong, how do we get through it and get back to where we were before the thing went wrong as quickly as possible and as cheaply as possible?

Right.

The question to ask is, were you in the right place before the disruption? Like, were you heading the right direction Or have you learned something through the disruption which might want you to go a different pathway?

So there's a level of reactionary decision-making, right? Decision-making, right? You mentioned something I think is very valid and interesting that to me translates into failure, right? What percentage of failure has to occur for the resilience to be accepted? I feel We don't like to talk about failure in security because that can mean many bad things, unfortunately, and we've seen them globally. But if failure occurs in a resilient organization, the impact is lessened, right? And it improves because of it. It should be the case, right, if I understand correctly what you're sharing. So in your personal experience, at what point have you engaged with an organization that came from, or because of resilience and applying these concepts or framework, they were able to minimize it? Is there a good example that you can share based on that?

Yeah, yeah. And listeners, feel free to reach out. We've got a whole bunch of case studies of where this stuff has been applied. But pragmatically, I'll just share my own business. So we went into COVID. And much like many businesses, it hurt us. Our training and consulting services died, and we had to kind of reinvent ourselves, etc. I viewed that as an opportunity to develop the resilience methodology, take it to the next level, and apply it within my organization. Yeah, we were doing this for others at the same time. We had a risk culture change project running with a health fund. We had an incident emergency management uplift project running with a rail operator. We had a cultural change project running with a law enforcement agency. So, you know, it wasn't just us. There were lots of case examples where we were doing this stuff. We came out of COVID with incredibly diminished revenue and only 30 people working in our business. Today, we're 320 people with that revenue at 10 times the year after, doubled the year after that. And we've had about 30% growth this year.

Wow.

The only thing that's changed is the application of this methodology through my people. So all my supervisors attend our tactical skills training for free. Any of my managers can attend our graduate certificates and graduate diploma training for free, and we strongly encourage them to do it. Our core values have all been aligned with this methodology, and the way we run the business is literally based on how do we get 2 really important pieces working, okay? And that's the shift to resilience. So we want compliance in place, we want resilience in place. Those are non-negotiables if you want to be in business. You need to, you know, tick the rules, and you need to understand the rules may not be enough and stuff might go wrong. But equally, the next domain, that's the resilience domain, looks at 2 different things. It looks at the critical risk considerations. So when I talk about critical risk, I'm talking about those things that could absolutely destroy you or your business, or those things that could absolutely make you succeed. So we shouldn't only be thinking downside, we should be thinking upside too.

Right, right.

And we should put most of our effort into those critical things, but ensure that we have enough resilience if something else happens. So that's the first part. So that's a combination of proactive prevention for the things that could absolutely kill you and opportunity centrism for the things that could absolutely help you. And then the next piece is learning to do the dance between business as usual and disruption. And that's where this idea of ambidextrous capability is so important in our leaders today. You need to both be a good manager and a good leader. There were times where, you know, we would, we would go, oh, we need a manager for this, not a leader. Or you need someone who can lead and inspire, not someone who can run and operate. In actual fact, in the world we're in today, you have to be able to do both because things are moving so fast. If you can't do both, you apply the wrong skill sets and get a horrible outcome. Doesn't mean you're going to be an expert at both. In fact, we've actually coined the term stactical, which is a combination of strategic and tactical or tactical and strategic for the way leaders need to think now. So realistically, to get sustainable high performance during business as usual and disruption, you need the mindset shift so that you can have the right amount of compliance, the right amount of resilience, and the right amount of presilience in play at an individual, team, and organizational level. If you do that, you're very well placed to be able to capitalize on opportunity, prevent bad stuff from happening, and get better performance out of yourself and your team. So that's really what it is in a nutshell.

The way to me, and agreeing 100% that that should be, I imagine then it's difficult to find the right people to sometimes be both strategic and tactical. You know, at least that's been my experience, right? You hire people and their life and possible education and experience is not one that will give them both. So what, what, what would it take for an organization to find both? Is it, is it the hire? Is it the education? Is it a combination of the two?

It's actually more than that. So it's everything you said, plus there has to be this— the part we found critically important is leadership commitment. So the top of the organization has to understand that the world we're living in is not the world that they might have been educated in their MBA 30 years ago on. It's changing so fast. You know, even if we look at GenAI and the way, you know, generative AI is plugging into everything we're doing, like right now we are in a total revolution. Things are changing so fast, but because we're in it, you don't really notice it.

Right.

So, so to your point, it requires a few things. So the first thing we've found is that it It requires a bit of education and open-mindedness. If organizations and leaders are stuck and they're going, listen, I know exactly what's happening, I'm perfect, the way our business runs is the best, my team is the best, we don't need anything, we found those organizations usually we just wait until something bad happens and then inevitably they'll come to someone like us and go, okay, we weren't as good as we thought they were, or we were. They're very vulnerable. So arrogance is a red flag for us usually. Usually the ones we love to work with are the ones who are somewhere in the middle where they go, we're really good at what we do. We train our people, our processes are good, we're technology enabled, etc., but we'd like to be better. How do we get better? Equally, where we found great opportunity is with organizations who've badly been— badly disrupted and have hurt and are going, now we need to do something different. And that's a great insert for us. So simplistically, to learn about this stuff, as you know, I just published a book on resilience. Um, you can buy it on Amazon or anywhere else. It's doing really well. Um, it was the top-selling risk management book for, for a good few weeks on launch, and it's still, I think, in the top 50.

Congratulations.

So thank you. So that's a good start. But equally, and I'm very passionate about this, like, we've set up postgraduate-level certificates and diplomas in this methodology so that people can get the knowledge themselves and apply it, A, in their own lives, but B, in their own teams and their own businesses. Because what we've kind of realized is things are changing so quick, the scale is so massive that it's breaking humans. You look around and you, you look at our social cohesion, you look at our mental health, it's not great. And if you're a security professional, that just means heightened risk. insider threat, outside, outside risk actors and threat actors, you know, doing crazy things. We've seen all these examples globally over the last few weeks, and they keep coming.

Oh yeah.

So, you know, what are we going to do to make the world better for my kids and yours? How do we make sure the next generation actually inherits a world that's a little bit better than what we got now? And to do that, it's not just plugging in the latest tech, because tech helps, don't get me wrong. But if you think about any software or hardware tool you're using to date, it probably has more capability than you use it for. Whether it's something as simple as Microsoft Word, it probably has hundreds of functions you don't even know how to use. So technology already— and this is not even talking about new adaption or new things—

Yeah, yeah, like, we, you know, we already can't keep up.

So I, I see the challenge for the next decade is how do we get humans skilled up enough to cope with what's happening around us so we thrive and not break, so that we can prevent really bad things before they happen, not just respond to attacks when they do. And it's about shifting the way we think away from we have no control, so we'll just react, to actually what can we control so that if we are forced to react, it's only based on the things that we hadn't prepped, planned, prepared for. And equally, if you've built the resilience capability, even when you're responding to those things, there's still that little part of you going, where's the opportunity here? You know, where's the opportunity to get something good going? And, uh, probably the thing I love the most about security professionals, particularly the ones who've been doing this a long time, most understand that you don't waste a crisis. Like, if something bad is happening and you are the superhero at the moment who's helping to solve it, That is your chance to drive change into your organization. So next time something bad happens and you're the security executive leading the response and recovery to whatever that incident is, don't forget there's a huge opportunity now to change the way people think, to change where budget sits, and to improve the way your organization and your people cope.

Right.

So, you know, fundamentally we're in, we're in an interesting place and there's a lot of opportunity, but you have to be willing to see it and act on it.

Absolutely. Well, and here's a question for all of those professionals listening. If you could whisper a single idea into the ear of this very unique group of security professionals today, what would that be? That one single idea that you would want to whisper into their ear?

Tough question, but the truth of this is no one has all the answers. So a mindset of learning And adaptation is crucial. It's more crucial than it's ever been. You know, in times of war, we know what we're facing. We're facing times of intense confusion, complexity, ambiguity, digitization. I like to use the acronym VUCA— volatile, uncertain, complex, ambiguous, and digital— as a definition for where we're at. That's our operating context. So if you arrive with the mindset of you know, I served in an agency, I know what's going on, I have a few years as an executive, nobody can tell me anything, I'm perfect in the way I think and work and make decisions, you're doomed.

Yeah.

Because in the existing ecosystem, your opposition is not thinking that way, right? We've seen terrorists and criminal syndicates collaborating, we've seen state actors collaborating with criminal organizations, we've seen homegrown radicalization at levels we've never seen it at before. We see cybersecurity as not even the key threat now. We're seeing hybrid physical and cyber attacks as one of the challenges. So none of us have the perfect answer. What we've built is a combination of a few things. We've built a framework, so a way to manage the complexity and the challenges of the world we're in. We've built a suite of tools because you don't always need the same tool for the same problem. We've built a way to shift your mindset. And once you get those 3 things working, you can create a robust, high-performing culture so you can scale it through your organization. And that's ultimately where we want to be, right? You don't just want to be highly reliable anymore. You want to be consistently highly performing. And that's not running as fast as you can all the time. That's learning how to balance what's going on internally and externally. It's a different skill set. So my passion and mission at the moment is how many experts can we train and educate in this methodology? so that they can thrive through the world we're traveling through at the moment and not constantly feel like they're drowning and trying to play catch-up.

That's a great perspective. And, you know, on that sentiment, 10 years from now, you know, what will be your boldest hope for the security industry in the physical and digital world? What will be the evolution?

So, if we do it, if we do our job right, We'll see incredible technological integration. It's funny, I was chatting to, uh, a, a long-standing veteran in the security industry a while ago, and I made the comment about convergence, and she started laughing. She said to me, 30 years ago we were talking about convergence at conferences, and we're still talking about it. And then you've got these different views of, you know, cyber won't converge with physical, and personnel security doesn't converge You know, with frontline access control, etc. But realistically, all these pieces will interconnect and have to interconnect. So strong— if we, if we fast forward 10 years, the security expert will be a risk expert who can leverage technology, understand risk, proactively prevent negative aspects, but be the comfort blanket that enables their organization to respond effectively when something bad really happens. So I know we say that should be happening today. So all of those things I'm describing, almost every CSO would go, that should be me.

Right.

My question to you is, it should be, but in most organizations it's not. Security is still a bolt-on cost center in most organizations, and it's thought of as something that we don't really want to do, but something we have to do. So until we can change that perspective, and that's one of the critical things I'd urge your listeners to think about this carefully. If you can't change people's perspective around security, change the way they think about risk. And that was part of the reason we started looking at resilience as a new way to tackle security risk, because it's less confronting than talking about people coming to shoot you or blow you up, but the outcome is the same.

Right.

So fast forward, human adaptive skills— we should have learning adaptive experts that are not fixated on one domain of specialty. So McKinsey often talks about, you know, the T-shape, where we've got a broad base of skills but one layer of expertise. I think we should have at least 2 or 3 layers of expertise with a broad capability. That's what you should work for. We need more generalists. So we've got lots of specialists. We need people who can go, okay, this is how you plug an access control system into a GenAI system. This is the policy you need and the training you need. This is the way we sensitize it with executives. This is the way stakeholders buy into it. All of those things are different skill sets, right? So we need to grow more and more people with that capability. I believe we're getting there, like we're on the journey. We need more people to buy into the idea that they actually can empower themselves and others to do this better. They're not just passengers on the journey.

Right. Well, this has Expect a fascinating conversation. I think I would recommend all our listeners and the audience to go look for your book. I want to ask you, thinking in your journey in the security industry back when you started, what would be the advice that you will give to yourself with all the knowledge that you have accumulated today? What would you say to that young man in South Africa?

It's interesting because as we grow older, obviously, you look at the world differently. Probably for someone like me, I would be telling myself to be patient because one of the things as a young man I did was I sprinted really hard. I probably had 4 or 5 careers running simultaneously. And, you know, you get frustrated that things don't move quickly enough or that you're not progressing quickly enough. Um, you know, being a bit more patient and a bit more strategic would have been good to tell my younger self, right? But, but equally, honestly, Tino, uh, you know, you're the sum product of everything you've experienced. And if I tweak or change something too much in my past, I might not be me now, right? I have to be grateful for where we've landed.

Well, more the sign for the, the newcomers in the industry listening to this conversation going, wow, this is great, but With this all to start, right, I, I will always say dive, go scuba diving a little more often.

Well, that is great advice, and I would support that too. You know, you started that off with, uh, we, we, your listeners probably didn't hear that part. Tino and I were talking about scuba diving and how wonderful it is, but you've got to have a balanced view on the way you live your life. So if you're starting your career, there's something we talk about and we teach in our resilience methodology. We call it the whole of person model. So if you think about your life, you've got your work life, your virtual life, and your personal life. Most of the time we, we've been taught to separate them, right? You go, I don't bring personal to work, I don't bring work personal, and my recreational stuff is my own, and etc. But if you look, even mine and your conversation now, you know, we're talking to each other across continents using digital interfaces. Um, you know, personal and work and virtual have blurred. So instead of trying to totally strive to separate them, which doesn't work very well anymore. What you've got to be doing is, what are the attributes I can develop in the different ones that will make me better in the others? So those 6 things that we mentioned, let's just take situational awareness. If I know how to look around and gather the right information, I'll make better decisions at work, at home, and online.

Right.

So instead of— so if we just take cybersecurity, instead of teaching people only, you know, change your password, don't click on these links, don't do this, don't do that, If we taught them how to be aware generically, it would be much easier for them to apply that online. So grow your skills. Um, the other piece of advice I'd give any newcomer, and I'm always giving this advice to anyone who will listen, don't just fixate on one pathway. The world is incredibly competitive, and with GenAI coming into the mix, it will get more competitive.

Yeah.

So I often have young people going, well, I've started my career, I came out of the army, or I came out of the police, You know, do I get a degree? Do I do my ACCA CPP? Do I do this? Do I do that? My view is do anything you can that will make you better. Get the qualifications, go to the conferences, build your network, write articles, speak on panels, attend as much as you can, and have that growth mindset as your underpinning driver. You will be successful then. If you leave your career in the hands of others, and you do the bare minimum, there's no surprise you're not going to be a high achiever that people want to pick.

Indeed. And with that, Gabe, I do— I will say we need to do this again. You mentioned making the trip to the US for GSX, so I will see you there. We'll shake hands and have that pint we spoke about earlier. And with that, thank you very much for sharing all your wisdom and knowledge. And like I said, If we want to contact you, or someone in our audience wants to contact you, what's the easiest, best way to engage with you and your company?

Sure, LinkedIn is probably the easiest way to find me. If you're looking at any of my books or speaking type stuff, that's drgavschneider.com. And on the business side, Risk to Solution Group with the letter 2, or Institute of Resilience, both of those will bring you to all of our stuff. But please engage. We want to share knowledge, not hoard knowledge. And we can't do this alone. Tino, thank you for the opportunity to talk to you and to talk to your listeners. And if you took one thing out of this conversation, that's a win for me. Thank you.

Many, so much. Well, and again, to our audience, stay engaged, stay safe, and we'll see you in the next Checkpoint.