Episode 6. Future-Proofing Security: Risk Analysis and System Integration

Welcome to Executive Checkpoint. I'm your host, Tino Urbina, and today we have a very exciting conversation with one of the thought leaders in our industry, Mr. Ben Buchko. Ben is the president and CEO of Buchko Inc., a firm specializing in crafting security master plans and implementing innovative solutions across industries like petrochem, industrial, and corporate environments. Ben's extensive experience in risk analysis and strategic security planning has made him a leader in aligning security with business objectives. We'll explore during our conversation implementation of security master plans and the evolving role of consultants and manufacturers, and how organizations can build scalable, defendable, and security driven processes for the long run. Ben, welcome to the show. Glad to have you.

Absolutely. Got it, Tino. So I love the startup music. You know, it's like your walk-on song. Everyone gets excited and pumps up the crowd before, before kicking off.

Well, great. That was, that was the plan. I get excited just listening to it and a little nervous sometimes. But well, then, you know, we know each other for some time. But I'd like to start from, from, you know, the intro to security, your journey in the industry, but more important, what are the early experiences that shaped your approach to your professional life today?

Wow. So, you know, there, I grew up with a combination of really 2 environments growing up. One was my father was in the military for his career. So I grew up on and off military bases around the world. So very structured, very mission-focused and really higher vision-focused. And then I had another part of my life where I spent a lot of time family with entrepreneurs, folks that were working for themselves, you know, not living in that structured world and living out in the country. So that sort of laid an appreciation for how you balance different cultures and different worlds growing up. Always liked, always liked to, you know, technology, things that work together, but for a purpose. And so I started out in engineering. And got my first degree. Now, I didn't get it right the first time, so Texas A&M sent me back for a second one. And started off in the— somewhat following in my father's footsteps. I couldn't pass the physical to do what I really wanted to do in the service, so I went to the nuclear weapons world.

Mm-hmm.

And doing pure engineering, solving real problems. And, and then that's what shifted me into security. Uh, they had a real problem and a real need that I could, uh, that I could work with because, you know, some folks just don't have a sense of humor when a nuke goes up, comes up missing.

Yeah.

So, so it was serious and, and challenging. And then I shifted pure into business. I, I wanted to shift away for Something new after a while, and and that really tied into non-security. But how do you pull a business mission and a business focus, and then how do you contribute with technology and process to make that to bring value? And I've stuck that through as I went in, you know, back into security and and traveling the world, solving solving problems and systems and. every continent but Antarctica. So there again, the culture and the changing and, you know, the commonality is people. They all have similar— you know, there's always good people in the world and there's always folks that'll take advantage of good people. And the common needs come into play. So that really grounded me. And so for the last Coming up on 21 years, I've had Butchco Inc. And with our small team, we have— we've worked on implementing those visions for a variety of industries and everywhere from areas of the world that were really nice to visit and some that you would never want to take your family for vacation.

Well, let me ask you, you just touched a point about diversity and diverse industries. How do you guys adapt your strategies to address different and unique challenges in different sectors? We know petrochem and the corporate environment, that's completely different. How do you guys adapt that philosophy?

Well, the first piece is that when you come in, you can't have delusions of grandeur, like you know all the answers. It, it can't be a dictate. And, and so really what we try and drive, and in the the culture within our organization is everything we have to address has to be with professionality and with integrity. So folks don't have to like the answer, but if it's the real answer, then you can work with them to figure out how to come up with something that will work to meet their mission. And it's always in that vision of We're not in business for ourselves. We're in business to help our customers solve problems that are important and to meet their mission. And as long as we remember that, it's easy to get engagement and then allow people within those environments and those industries to help us with truly understanding and working with their needs and expectations. And then we can bring our expertise to complement it instead of trying to take over what their mission is. And so it's that approach. It helps us by means of really serving the best interest of and buying into the mission of the folks we have the honor of working with.

Yeah, and I think the commitment as a security professional is always That we serve people first, right? The value of our— the professional value that we bring is exactly that. Now, you're a big advocate on security master plans. Can you please describe for some of the folks that might not be familiar with what is it and why is it important for organizations to consider a security master plan?

Sure. The— I mean, it's, it's really— it's the— it's that roadmap to what does success look like for, for this environment and which problems are we going to try and address. So the master plan that starts with the executive, what's important to the executive level, whether you're working direct with the executives or not. You're— the company has a mission, the company has a purpose, they have products, and they have drivers on that business. So the master plan is what is the combination of people, process, and technology that from the perspective of security, whether it be cybersecurity, physical security, or tying in with safety and other operations as you go through. How can those things contribute to that mission? Because if— and in some cases it may be regulatory driven, in some cases it may be financially driven. There's a number of drivers. And so what we really try and capture with the master plan is what's important to solve, What is the— what are the expectations so you know when you're moving towards and when you achieve close to that solution? And then what are the building blocks to get there? Because it's very few of the organizations that we work with are starting from greenfield. They've got an operation. So they, they're still running their, their organization. They're trying to make it better. So the master plan not just addresses where you're going, but it says, how are you going to transition from one to the other? So what's our overall budget constraints and drivers? What are the schedule constraints and drivers? What are the political constraints and drivers? And who are the key stakeholders? And then a concept of What is the concept of what the solution, how it's going to be achieved? It's not the detailed design, but it says we're going to put in— we need video solutions and the video solutions need to serve this purpose for security, this purpose for safety, this purpose for process operations.

Right.

The other provisions, these are regulatory driven. We don't have a choice. These are the things that are nice to have, so we can prioritize it. And from that point, now you've got the master playbook. Every project that comes out of there, if it doesn't fit into that master plan, you know, it, it is, it's not ready to— you don't pursue it, or you know you have to go back and readdress the master plan. But you've got the guardrails on the roadway to success. And you go from the master plan to then detailed plans to design and execution. And so if you screw up the master plan, you're guaranteed to screw up the business.

Right.

Security and everything. So, but that allows you to establish standards and guidelines that are accepted at the, at the senior level of the organization. So you don't have to keep reselling the projects and reselling your, your ideas. Like, there's already buy-in. It sounds like you're just fine-tuning it.

It sounds to me that you're defining the why. Why are we doing this versus the what, right? Which sometimes is very expensive. What do we need to cover this corner with video, right? And it alienates the overall goal for, you know, why are we doing things and the standards that you're reflecting on. You know, I think Abel said master plans help organizations avoid the blind spots or tunnel vision. How do you introduce that approach to these organizations?

Well, the beauty is When you develop the master plan, you have to interact with the with individuals across the major elements of the company. And so it be so there's a positive feedback loop that's always there. If you are tunnel vision on security, whether it be the idea of security or a product or a special widget or a service that You, yeah, you've learned real quick that the, the, the leaders in that organization, whether they be executive level or worker bee level, if they're leading that organization, if you're, if you're not touching what's important to them, they don't give you the time of day and they're not going to contribute to that collective success. And so it's really good for the company. The end user company because they can cut the wheat from the chaff of who's who's developing this master plan that if you're not going down the right path, you're too tunnel vision. They get rid of you quick, and if you if you expand that world, these folks are going to help you know what to include in that expansion. So you have to come in as a that that teaming approach, and and it's a it's really a it's a soft skill approach to get people to buy into that mission. And that's where you have to start with a company vision, company mission, not your own tunnel security mission.

Yeah, so including all the stakeholders and the why for the entire organization. So if an organization is wondering if they need a security master plan, what are the key factors or indicators they should be looking for?

So you hit it on On the why, and in fact we had that discussion earlier this week with a it was with a data center company, and there they had a vision of what they wanted to achieve. But through the initial discussion, it was but they didn't know how to get there. So our first discussion was how does that vision match with the the why aspect of what the company is trying to achieve. Is it getting you there? And it was that first, within the first 3 minutes of the conversation, we pivoted from thinking solution with them to thinking more strategically.

Sure.

And at that point, it was quick to realize that and go back and forth with the value of it tied in their Their budget concerns. It tied in their schedule concerns. It tied in the construction concerns versus the operation concerns. And the fact that they had to not only deploy this solution, they had to plan for a transition from today's operation to the new operation. And they hadn't even thought about that yet.

Right.

So that's what—

This cost and time analysis then goes into that strategic planning, right?

Yeah, absolutely.

So, you know, part of the world of the consultant, right, when you're creating this master plans also is going to include, you know, products and manufacturers. What's the partnership there that you see between end users, consultants, manufacturers? It seems to me that it's been now a commodity more than anything else instead of a partnership. But what's, what's your take on that? What's your perception? Of the current situation?

The, well, I, I, the current situation is it's across the board of, of commodity versus, versus a, a partnership solution. The, and, and some of it matches with, it's the, it's the end user company culture. It's the manufacturer culture, and it's the consultant culture. And everybody has a, a piece in that, in that game. Manufacturers are driven to say, how can I make this product? How can I sell it? How can I be able to support it? How can I get it implemented reliably and quick? So there, there's design drivers to make them, in some cases, idiot-proof to deploy. Well, Now you're thinking more in terms of deploying this commodity. The difficulty is how do you establish a trust relationship in a world of due diligence and litigation to where the end users can, they can trust and engage an advisor, whether that be an internal consultant organization, an external company like ours, or within a manufacturer, their advising team is— unless there's a trust established to where information can be shared, not just what we want to do, but why and what's our flexibility to get there, how much bandwidth do we have to work with? If you keep everybody in a tight constraint, it's harder to make sure you maximize the right solution with the maximum value. But you're taking a risk by opening up the, you know, opening up the, the full view into the company operation, into the manufacturer's operations. And, you know, the sales folks are out there. We're, we're trying to sell, sell, sell, sell, sell. And we've got all these new features. Well, many of our projects, it's— we'll deal with a company that has 10 different areas of features. And we only want 10% of all 10 of those features. So—

Right.

The— I don't need the really exciting, sexy stuff if I don't have the basic block and tackling in place. And then you've got Yeah, if, if you're not a— if you're a consultant and you don't have a big ego, you're probably in the wrong business. So how do you— because, because you, you're always up there. Yep, you're, you're trying to get people to trust you. You're trying to show that you're competent enough and capable enough to be trusted. And then you're trying to get that relationship set without becoming a co-employment problem. For the end user, right? So you're like second cousin. It's great to have you around, but don't stay too long. And and yet, you know, they want to be needed. You want to be there. So the what is to get maximum value for everyone? All the players have to be willing to take risk in communication. of what they do well and what they don't do well and where they need help with the other players. And when you're in a contractual relationship, that becomes—

Yeah.

There's real reasons against that. And sometimes you have a culture. We've had companies that have hired us to be their agent. And they want us purposely to have a confrontational agreement arrangement with manufacturers and integrators and installation companies because that's their model. So, and, and as a— if we're successful as a consultant, our role is we're the matchmaker between a solution set and an end user because In most cases, the end user is gonna be there. The manufacturer, the solution provider, they're gonna be there, and the consultant's gonna come on for a while and then leave. So if we do our job well, we make sure that there's a great marriage between those 2 that can be sustained.

Long term. And you know what?

And that takes risk on our part.

Sure. Well, your name, reputation, and of course, contractual agreement. Right?

Sure. And my name, my name is in this world.

Right. Which makes me think about the way you and I met, right? Uh, you as a consultant and me working for a manufacturer and the conversations we had. Honestly, that, that was probably one of the best things that can happen in my earlier portion of my career to have that conversation. And like you're saying, it wasn't a friendly conversation, but I learned a lot and we established a good relationship and friendship since then. I, you know, uh, but I, I totally understand it because my take now is I, I don't care how much people like the widgets, is it gonna solve a problem? Because then the value is long-term versus short-term, you know. So thank you for that, Ben.

Sure. Well, I kind of think of it as it was a friendly conversation, but on a really ugly topic. Yeah. And you got to— and you were representing the organization that had, had some real ugly at the time. And we got to talk through it. And I think the company grew from it. Oh yeah, which was good. I know it opened up my eyes to some things and, and yours as well. And we did all that over a big crawfish boil, so you never know.

That's true. But you know what, that's a great point. I mean, to me, that, that should be the process that those arms of different organizations, from the manufacturer and the consultancy, should play along. I mean, there is no evolving on technology or benefit to the customer if there is no genuine disappointment on a product, the product or the widget or the delivery of the project or the product if there is no feedback, right? So the ego of some companies to say, no, our product is great. Yeah, possibly, but it's not always true, right? The outside perception and the inside reality might be completely different.

Now, well, and I had just one piece there, one company that I worked with As they were a long-term, long-term customer, still very good friends. We worked our way out of a job, which is common. But I got some sage advice from one of their, one of their senior directors, and his view for the products that manufacturers bring them is that they will bring a grand vision of everything that's going to be provided. He says, I take everything they say and I'm gonna get, maybe I'll get half the value that they work up and try and convince me. If I can get a quarter of the value that they're telling me I'm gonna get, that's where I'm gonna base my project and hope that I get to half the value. Because otherwise I keep getting disappointed.

Right. I've heard different metrics, different approaches from a number of folks that overexcitement by either folks in their end user organization or in the manufacturing organization or the consultant side, you know, laying out all these wonderful things, they just, they don't always pan out and they often do not to the level that Yeah, you know what, this is a good bridge to shift a little bit on, you know, talking about risk-based decision-making, because everything that you're going to bring into the organization, whether if it's a new technology or a new process, is going to either be a plus or a minus, maybe a minus in the short term and a plus in the long term. But defining those processes is going to be key for whatever your, your, uh, So you're a big proponent of risk-based management. How do you embed this into a process for the organization when you create a relationship with an end user?

So we start with the— we start there at the master plan of what are the bounds related to what's your tolerance for risk as a company, and how are you going to measure that? And that starts that discussion of this is In the master plan, this is how we're going to address the risk. And then the challenges are addressed up front of, is there a process based upon one guru in the organization, whether it's an outside guru or inside, that they're the sage of wisdom? Is it based on spreadsheets? Is it based on interviews? What's that process? And we talk through The tolerance for risk, and we talk through, is that scalable and is it sustainable over time? Because even if it's a guru, the guru is going to learn things over time. And so the assessment that they would have done 3 or 5 years from now is gonna provide different results on the exact same data than what they do today. So Those are hard questions to work through because we could spend, we could get into tremendous level of, of detail in a risk assessment. But if you're gonna measure with a micrometer and cut it with a, cut it with a chainsaw, then all that level of measurement, you went too far and you spent too much money doing that. If you're looking for, for better versus worse, or 80% solution versus 20%, then now I'm in that higher level review, and that can be faster. That has the chance to be more sustainable, yet with a lower level of, of accuracy. Because you don't, it's gonna drift. But if you put that into your decision-making process and you understand it, it can be accepted. But you can't have a real, but if everything's gonna be metrics-based and you don't have the metrics based upon that are the foundation is not gonna be solid, then you have a mismatch.

Right.

So that's the key of pick the right tools, and the right people and process to do so. And if you've got a global organization with hundreds of sites, it's not practical for 1 or 2 people to do all the assessments. So you have to have it in a means that the data can be collected that's relevant consistently, and then have that analyzed in a manner that provides the requisite level of confidence.

You know, to me, you bring a great point in that consistency and defendability of what your conclusions you arrive to, right? I think a key element on this side for the end user, and I believe for a company like yours, is the retention of knowledge, right? You're going to have conversations where the experts that you have to bring in different scenarios and different industries is going to have a big impact in the on result. Like you're saying, not one single guru might have all the answers. So that living that ego aside, and, and I'm speaking for both the end user and the consultancy, right?

Sure.

So what's the importance in your group specifically for retention of good solid knowledge and Yeah, just who's that responsibility for, right?

So when we're engaging in throughout our process, and it varies to the degrees, but that when we're doing the assessments, the master planning, the detailed planning, and scoping out projects, Our goal is to get as much interaction with the end customer and their active participation.

Right.

That way, they know how— they know all the reasons when we provide our end product, whether it be drawings, whether it be a design, whether it be a process, whatever it happens to be, or a plan, that the folks that it— to which it's delivered, They were part of the process. They understand the reasons and rationale as to why decisions were made. It's not just a product that was delivered.

Right.

They've got— and so we don't always get the, you know, the companies, they don't always have the bandwidth availability, or for whatever reason, they're not always as participative. But we always bring that up and In the same level, when we provide our overviews, our details, our designs, and our assessments, we try and put in documentation of why we did this. What's the justification? What was the problem it was supposed to hit? And engage that in many ways with detailed use cases and what were the contributing factors. How do you, you know, what's gonna start this use case? What is the result you're expecting? What's gonna be the criteria for a successful use case or not? And how are you gonna measure it?

Right.

So those are ways that as much of that knowledge of how you got to where you are is embedded in, if you're working, that the manufacturers know it, so they know how to how to solve and deploy a successful solution. Your system integration service providers know it, and the end user, the ultimate customer, they understand how this was judged.

Right.

Because when it comes down to a contract, they're going to decide whether they're going to sign, you know, sign the check. And if it's really clear in a way that everyone can understand, it's not just all numbers and check checklists. It's, did we solve this problem? I wanted to protect my front entry and I wanted to be able to identify these things. And so could I do that? Could I tell that I had an armed intruder coming in? Could I tell the difference between an emergency response vehicle and a threat coming in? Could I get through the 5,000 people an hour that needed to get through this entry portal? Yes or no? That you don't have to understand all of the electrons, but you can sure figure out, did it meet my— did it meet my criteria for a successful operation?

Of course. And you know what, I think that you're also, by having a shared vision with all those 3 groups and user manufacturing integration, you have an easy flow to deliver the goods where everybody's happy and understand what the the next steps are. And I think you also build champions, right, in each organization, especially on the end-user side, when the buy-in of a solution is part of their, you know, implementation because they understand exactly how it's going to function. I like to think of it as letting them put their fingerprints on the clay, right? But when the finished product is done, they can see where the participation and, uh, was an insight. So, well, Ben, you know, this was quick. I mean, it was quick. We can keep on talking. I think, you know, people listen and probably, uh, feel like, you know, they can keep on, uh, understanding a little better all these things that we're talking about. But I do have one last question. So, uh, if you could choose any skill that you can master in seconds, what would that be and why?

Any skill I can master in seconds? Well, yeah, I'm a dreamer, so for me it would be able— I would dream of that, uh, that, that I would be able to be a master pilot and, and have my own plane to be able to do so. Uh, I've, I've been able to do a lot in aviation for over the years, but there's always more to learn. That's what gives me that thrill and that sense of being. Professionally, that skill would be, how do I make a positive contact with people and establish a mutual trust most quickly? That would be the skill—

That's great.

That I would go for. And, and in that way, everyone can set high standards and work towards them together. And you can be really demanding on that, but you've established that trust and that respect and that rapport to where it's not taken as offensive and everyone works harder to meet that goal. So, so that would be my, my professional skill that I don't think I'll ever Stop trying to, to get to that capability.

Oh, that's great. I like them both. But Ben, thanks so much for your time today. I appreciate your participation in Executive Checkpoint. Uh, for our audience, stay tuned with more thought leaders coming up. Uh, Ben, I'd like to extend the invitation for another conversation. There's so much more we can talk about. Eventually we'll have a panel where we have, um, different points of view and points of opinion. And we'd love to have you back. So extending that invitation now. And again, subscribe. And until the next time, stay secure and keep innovating. All right. Thank you so much.

That was fun.