E11: How to Become a Trusted Advisor in the Cybersecurity industry with Dave Reeves | Sales Leader OT Security Tenable

Welcome to The Switchkey Show. This is your host, Preet Saka, and today I'm joined by Dave Reeves. Now, Dave is a rare cybersecurity executive who has worked in the Army. He has founded and exited 2 successful businesses. He's worked on the client side consulting to major banks and mining companies. And then he has been growing US vendors like Leidos, Forescout, Tenable, and now Delinea. Dave, welcome to this conversation.

Hi, Priya. How are you? Thank you for having me.

In our past conversations, I was fascinated about your journey because most people tend to join vendors, stay in vendors, join partners, stay in partners. But you've really had— have this wonderful— you've had very multifaceted experiences, which is why I wanted to have this conversation. Let's get right to it and tell me How did you end up getting started in the industry?

Cybersecurity was actually called information security or IT security back in the day, so it wasn't really always cyber. So, I guess I joined the Army as a 17-year-old, did an apprenticeship in the Army. So, I did the electrical apprenticeship and then did night school and did electronics and radio. Obviously, worked a fair few locations around the place. Got out of the Army, ended up in Canberra. selling to federal government, working in federal government and selling in the federal government space, which was good. And like most of us, followed a girl somewhere or a partner somewhere and ended up in Brisbane. No one had employed me. So I basically bounced back into cybersecurity.

Wow.

In Canberra, I actually did some work. I did work for the embassies around the world, which got my interest back into the cyberspace and what we see at an international stage. That was a bit more around the Canberra piece, but ended up in Brisbane, couldn't get a job. At that stage, so ended up starting my own business. Was lucky enough to meet probably someone that's been a mentor most of my life. That sort of we I did work for RSA in the early days as a consultant. That's the late 90s, and started a business on the back of that. That business was called BSEC. Ended up being acquired by Deloitte in the mid 2000s, which was good. But we had offices around around Australia. So I think it was Sydney, Brisbane. And Melbourne. And during that journey, I came back to Melbourne in around 2001, which is the city I grew up in, which is good.

Wow. And then from that exit, what came next? Was it consulting to clients on the client side or back to another business?

I went skiing for 6 to 8 months, which was really nice. And then You got to enjoy some fresh air and get outside, which is great. I think B-Sec opened my eyes up a bit to the enterprise space. We did work for mining companies, for banks, for that sort of stuff. We were actually— there was myself and business partners were the ones that were very early on in starting the OSSEC conference, as it was then. That gave me a sort of bigger picture into what went on a bit more behind the scenes, got a bit more involved with different vendors and that stuff. After B-Sec and got back and went, got the skiing out of the veins, I ended up doing some consulting into— it was a transformation of a mining company. It was good. And that was the first GFC, which I think was around 2007, '08, '09 sort of thing, which was good. It's good times.

Wow. And I think you touched upon something which I think is so important. I meet with and talk to so many leaders who are nearing burnout. They are under pressure, time poor, overworked, and just aren't refueling and recharging. So, you know, when you talked about going skiing, I think that is critical because if you don't manage your own energy or get energized, there's no way you're going to give that energy to anyone else around you, right?

Correct. Yeah, I think you need— everyone needs to have a break. And I, for me, it's every 7 to 8 years. It seems to be a number that get out and have a break and change the view and change your scenery and mix it up a little bit. So, I ended up— after that, I ended up working in the banking space for about 12 to 18 months, which was really good. It was quite a transformational piece of work, but it gave me some really good insights into a few different technologies and the thought behind the technologies and what those guys were trying to achieve. And that was the emphasis on where I started Shell'd from. So, I saw some technologies, I saw some opportunities in the market space in the Australian New Zealand business, and that's when I focused on bringing together the skill sets that could actually build and deploy those technologies. So four large organizations. So in the Shell days, we did work for most of the major banks, undertook work for mining companies, and it was the top end of the system. But from it's interesting from a risk point of view, the banks would never have signed off on the size or to do large-scale work for them, but they. always be happy to sign off on smaller pieces of work dealing with in those days, which was a smaller organization. So banks are very scared around the risk word and they look at it slightly different.

And I want to drill into that a little bit more as we get into the conversation. But tell me, it's really interesting that you come out of, you exit from a business, you take a break, you go and consult to banks and mining companies, and then you go and start up a company, and now you are mentioning you're working with banks and mining companies. So tell me a little bit more about how valuable or useful was that experience working on client side and then coming in back as a service provider or as a— having your own company to secure more work from banks and mining companies. How did that synergize?

I think it's really interesting when you work all sides of the pie. You get to see how the organizations think about risk, think about strategy, what's next for them. And that's really the piece that I was trying to fill in is understanding the threats in the market space, where, I guess, what we call the cyber threat landscape, but also some of the tools and some of the controls that can be added to mitigate some of that or control some of those risks. It was there. That was the opportunity for me. And it's a challenge. challenge of the opportunity is the bit that I like. Like, it's, it's the road less trodden is always more interesting.

And tell me a little bit more about having had that experience. What did that do for your credibility as well as the value proposition back to the banks and mining companies that you'd actually worked inside of them?

Yeah, that's a good question. So most of the large organizations don't want to deal with organizations that don't deal with large organizations. So, they're risk-averse by nature. So, if you've worked in the bank before, it's very easy to work in another bank if you understand how they do risk, how they do tech risk, et cetera, how that flows. And then also then obviously deploying and selling solutions into the bank, given that you understand how they work, it makes life a lot easier. So, it's that you understand how they work, how they operate, the funding cycles, how they think about—

Mm-hmm.

Rolling out strategies. It gives you that visibility that you might not get if you just work for a vendor or just worked for a system integration company, etc. Yeah.

And would you say, would you recommend that to someone who is on a career path? Because often people get so caught up on feeds and speeds, features and functions versus actual the business impact. How does someone increase their ability to actually be an advisor? The word trusted advisor gets thrown around, but how do you actually build that experience to go back and be a valuable advisor? We're talking about whether it's a cybersecurity sales rep, somebody who's in the industry but actually wants to be taken more seriously by CISOs and other executives.

Yeah, no, good question. I think it's from my point of view, the insights that a team member has got from working on the client side is invaluable. The best reps you see on the vendor side have probably come from industry, have probably worked inside on the client side. So, they understand. It might be mining, or it might be education, or it might be banking. But that learning that they've had on what makes that organization tick is invaluable if you're trying to pitch services or product to that organization. And they don't think in 3-month chunks. They're thinking 1, 2, or 3, or 4-year bites. So, To understand how to best position yourselves for that journey with them is highly important.

No, that makes sense. So, you start Shell, you're working with these companies. Take us forward from that point where you left off in terms of your career story.

Yeah, obviously, I left Shell and I didn't complete the journey at Shell. We had other stuff to do. It was good. Again, I went on another career break, had kids by that stage, wanted to spend more time with those and watch those guys grow up. And then for me, it was into the other side of the pie. So I was now working in the vendor space. The vendors always intrigued me. I was in Canberra and it was the very early days of Cisco in Australia. So it always intrigued me how those guys ticked and how it worked. So I think there was, you know, in those days, it was the top first sort of 15, 20 employees at Cisco in Australia. We used to, we worked in the same serviced office as those guys. And that's, it's always intrigued me. It was always something I wanted to get involved in. And something to do. And a couple of my mentors in life had always been on the vendor side. So, it was, I'd always had good insights into it, but it was something that to me, it was something I needed to do. And it's opened up more horizons, more view. I've had a couple of opportunities to work across Asia Pacific, which is phenomenal to learn about different cultures, but also to understand how different parts of the world work. And that's also intriguing.

Fantastic. That's fantastic. And so what I'm hearing you say is that as the SI, you're really focused on bringing a host of solutions to achieve an outcome for the business. As a client, you're really getting into the actual business itself and understanding what makes them tick and understanding.

Yes.

And then as a vendor, you're getting far more broader regional experience across what's happening across the APAC landscape. Can you, for each one of those, let's start with the— maybe let's start with client, then SI, and now vendor. What are the benefits of actually doing a stint in each one of those?

That's a good question. So, on the client side, let's say banking, you get a really good view. They're running a multi-year strategy to do something. So, you get a really good view and you're doing a lot of work around analysis of what's coming, what the threats could be. looking at that alignment between business and technology, they get risk really well. Mining, oil and gas are probably the 2 industries that understand or were the early adopters of risk, but banking gets risk really well. So, they've got a very controlled view on what they can do. Maybe not as nimble as you'd like them to be sometimes because they're big organizations if you work in those. So, that's good fun. It's learning and it's a challenge and it's not as fast as some people like it to be. If you're working in Europe in the system integration space, you can bring a number of different tools to clients because clients get comfortable with your organization and they look for you for different animal— different animals— different solutions. So again, it's around people, process, and technology. It's not just a technology play, it's the people process as well, which is just as important. So you might be looking at different solutions and working in different parts of the business, but it's very much statement of work focused or outcome focused pieces of work. Whilst a vendor is a piece of the pie, it's not a complete piece of the pie. It's a part piece of the pie, but it's very much a technology play and there's less reliance on people and process. So each one has a different view. From a positive, from a, say, a client side, the enjoyment in achieving something, coming up with a strategy, hitting the funding gates, looking at the risks that you're controlling. System integrator space, it's getting the first PO. It's meeting new people. It's bringing on new clients. It's different set of challenges, and then obviously doing really good stuff with the staff along the way is important. And then from a vendor point of view, it's it's focused on its quarters. It's quarter by quarter, and it's you know it's it's how to outposition the competitive solutions, how to get your solution in first or your product in first to into that space, and how you do that. It's all different challenges, all part of the pie, but. Different challenges, different learnings.

That's fascinating. It's really useful. Because I'm thinking about people who are managing their way through the technology industry. And I have, on a daily basis, I'm either talking to people who want to build, to get into cybersecurity, and those who are within cybersecurity trying to figure out how to navigate that next move so that they are more valuable to clients. And as a result, more valuable in their own careers. Risk keeps coming up. And I think that regulated versus unregulated, there are different perspectives. And I think people, as they become more experienced in their— in the cybersecurity journey, I think they need to develop an understanding and appreciation of risk. Tell me a little bit more about why is risk important? Why is that something that people need to develop a really good understanding? And how is it important to these industries right now?

You use the word regulated. For example, banking fits in the APRA space, so they've got to meet certain— they're obligated to meet certain things. If you take in credit cards, it's aligned to PCI DSS standards. If you're an operational technology company, you do mining, you have OH&S obligations, you must meet them and exceed. For example, in the cybersecurity space, it's much easier to do work in the— to get funding or to do work for or to sell solutions to in the regulated environments. Much better. They also seem to understand the risk around the loss of license or the inability to transact because of loss of a deed to operate, which is in the energy space, they typically work under deeds. So, you can lose the ability to do work in that space or loss of revenues if you don't meet your legal obligations or your regulatory obligations.

I understand that. So, What are some of the mistakes in thinking or mistakes in actions that have impacted client-side executives in that risk management? Because every now and then you hear— probably nobody wants to hear— but there's been a breach or something significant has happened. Take us upstream, really before the event, and what are the things that people are— mistakes that people are making that they're not managing risk? And why is it important to manage that risk?

Understanding the risk and the areas that you probably don't have the controls in is highly important. So, the larger organizations, they look at the risk, then they look at the controls, which is a word that's been around sort of 10, 15 years, and the value of a control, and is that control working as designed? So, that's from a risk point of view. From the large organizations have a really good strategy team, so they're thinking 1, 2, 3, 4 years out on their cybersecurity strategy. So, what do they need to implement? Where do they need to get the move to, et cetera? They might be taking a lot of the equipment from on-prem premise to a cloud environment? What's the— is that exposing them to more risk? They've got to work through all that sort of stuff, but they've also got to make sure they've got the established controls in place to minimize the risk around what they're doing.

And so, what are some of the key components that, let's say, an account executive needs to appreciate to be able to engage executives in a meaningful risk-oriented conversation?

That's a good one, actually. One of the Guys, the other day, asked a question around, it was around password management, actually, and who had the part, who could access the password and who actually, who had the, who owned the risk associated with password rotation when the passwords were going offsite and all that sort of stuff. They actually weren't aware of what was happening behind the scenes. And it so happened that a risk person was in the room and took up and ran with it. So, they actually then understood that being able to articulate in a risk fashion what the technical limitation was of the existing solution. And that risk person in this case has gone off and run with and achieved the funding to buy the software and the services to actually mitigate the risk in this space, which was, yeah, it was actually, it was really good because in that case, the guy, the salesperson only been briefed about an hour before. He said, think about the questions you need to ask to try and tease out if they actually understand from a risk-based view what the technical limitations on how they're doing stuff today was. Which is a good story.

What are some of the other components from a risk point of view that an account executive or a sales leader needs to appreciate when leading a team which is trying to engage a major regulated company or an enterprise account?

That's a good point. So the regulators have a list of requirements you need to achieve. So to understand what those requirements are around the different facets of those requirements. And then also, then look at how the company manages and reviews their risk. So, what their risk register looks like, what the inclusions are in from a cyber point of view, how well it's broken down. Once you understand that, you actually understand where you can move to. And it's a game of cat and mouse in the case of how you talk to someone to understand where their risk lies, how you tease out that information around their risk, It gives you really good insights into what they're thinking, what they potentially need to do in the future.

This has been really good. As we start wrapping up now, I guess in terms of what advice do you have for someone who is building their career in the industry? How do they become a really valuable partner or advisor to security executives, more so from whether it's an SI or a vendor point of view, typically someone in a sales or a presales or a leadership role, which is engaging with these executives, 3 to 5 bits of advice you'd give?

Yeah, get really good mentors. I think that's important, that understand what you're trying to do. I've been lucky enough to have 2 of them, one very early on and one in probably the last 5 or so years. And that might be on personal life as well as business. So learn from those guys. Don't be closed in your thinking and be open to learning, which is, I think, is highly important. You've got to be, you've got to be open to learn and also, and you've got to, you've got to put the effort in to learn. And from a more day-to-day and a technical point of view, from a, if you're in a sales role, it's obviously it's urgency, but it's understanding the client, understanding how they operate, understanding what The markets they work in, are they regulated, are they not regulated? What's normal business as usual? Look for those. So, do your research on the organization. Take time to learn. Don't think you're going to turn up and sell them the latest widget, etc. Just actually understand what they're about before you actually talk to them. Understand what their roles are. Understand the differences in the roles, which I think is highly important. Yeah. And then, keep your eyes open. Look for new technologies of what's coming to market and why different organizations are looking at new technologies. from a vendor side is important and see where it all fits together in the ecosystem. It would be slightly, would be the views, but start, I think mentors is a really good place to start with and who to bounce ideas off with. We've all had those people in our lives that we can bounce ideas off with and, you know, throw some stuff around that was a good idea.

Yeah. Look, I cannot agree more with you because I, on a daily, weekly basis, speak to so many people who are mid-journey and trying to figure out what's the next best move, what's the next best step. And I think that you can clearly tell those who are growth-minded, open-minded people.

Yes.

And those, those who are not.

Stuck in thinking.

And it starts compounding. The growth-minded people are leaps and bounds. They're situationally aware. They are, they can see and spot the opportunity. They know, they have a greater sense of timing and know what's happening versus those who are starting to slowly fall behind. And it starts compounding in how they are seen both by their peers, by their partners, and by clients.

Yeah, yeah. Right?

Yeah, tell me more about that.

I think you've got to be yourself. Well, you can't be something you're not. So if that's, if your makeup's a certain way, You've got to play to your strengths. But you also can learn as well at the same time. Yeah.

And even on that, again, I think when people can sense if someone is being themselves, being authentic, rather than trying to just sell something to them. And I think that combination of authenticity and growth-mindedness is just really a recipe for success. Because I'm just— the next big breach or the next bit of news is you just don't know when it's coming because we're in such a dynamic environment. So, you really have to be adaptive to be able to survive, right?

Yes.

Yeah.

There was a fairly major— a vendor's got issues at the moment. A security vendor's got issues at the moment. And it's whether you're on the client side or you're a vendor, everyone goes through ups and downs. And if they have been breached, you've got to support them. And if vendors are putting a lot of money into making products secure, but there's always going to be breaches in the vendor space as well, or vulnerabilities in the vendor space as well. It's not really the mistake you make. It's how you get over that mistake and how you move forward and what you learn from making mistakes. Everyone makes mistakes. We've just got to admit them and move on and understand how we can stop that from happening again.

Yeah. Wise words. Wise words, Dave. Thank you so much for this conversation today. This has been really good. So, I appreciate it. you and I thank you for joining us, Dave.

Thank you very much, Preet. Love to see you again.

All right.

Thank you.