Why CISOs need to read the room

0:04James Wilson: Hey everyone, I'm James Wilson and welcome to this Risky Business Features episode with Brad Arkin. In this episode, Brad and I are talking about how it's more important than ever right now for a CISO to know how to both read the room and to respond authentically and effectively when there is a change of mood. You know, and what prompted this was just looking at how different the approach and I guess risk tolerance is around AI right now. We went through this period of madness, shall we say, when it seemed like everyone was installing OpenClaw and agentic workflows were everywhere and this was just the future.

0:41James Wilson: to now maybe I think there's sort of a collision of the question of does AI being used everywhere by everyone actually deliver benefit for an organization as well as you know I guess the the awe as we now sort of look at what real systematic agentic cyber security attacks look like when they manifest these two things and probably a combination of a lot of other things are causing a bit of a change of mood in regards to what the expectation is on a CISO and a security team right now. And so this episode talks you through, you know, first of all, what Brad's seeing in the industry, but then Brad and I talk about, okay, but so what?

1:21James Wilson: So, you know, how do you catch those signals of change? How do you respond to those? How do you do it in a way where you don't look like you're just sort of candle in the wind going whichever way, but also don't get stuck in your ways and don't be seen as this person that's just always too rigid or perhaps always too relaxed, but rather that you're adopting the right stance at the right point in time to get the right outcome for your employer. And so I'll drop you here where Brad talks about what he's seeing and hearing, not just from the cybersecurity practitioners that he interacts with, but also the more senior leadership in an organization that might be leading those security functions.

1:57James Wilson: Enjoy. The mood shift is definitely something I've been picking up from a bunch of different angles. And so some of this is in the security crowd, and some of it is with people that are a notch or two up from the security leader. And so I've been hanging out with, you know, CFOs or head of technology or head of engineering, the people who'd be the boss of the CISO sometimes. And, and the kind of conversation I've been getting at dinner parties, you know, someone would come up to me and they're like, Hey, I'm worried about my CISO. I don't know if I have the right leader. And let me tell you some of the things that are happening and tell me, should I be nervous?

2:32Like, does this make sense? Does it check out? You know, give me a, give me a gut check on this one. And basically, I think what's happening is the frantic innovation experimentation at all costs mood has shifted. People now realize it's going to be a long slog. It's gonna be a lot of work. And we need to figure out how do you do the right tooling and infrastructure and all the hard work that comes with integrating this new technology into the way we do whatever it is we're trying to it done. And the heroic CISO that would kind of just, you know, bury their concerns and find a way to be okay with it.

3:08They are now, the leadership around them is looking at them and saying, you know, shouldn't you take away the punch bowl? Isn't it your job to rein us in a little bit? You know, we've run a little wild on some of these things. And so I thought it'd be really fun to dig into this and just talk through, you know, how to read the room and how to start to show up differently from before and the idea that you have like different personas that you would inhabit depending on what the vibe is like and and then at the same time what is the planning work and the investments you can do before you go into the big meeting to be prepared especially if you pick up on a tone shift you know mid-conversation and then you can flip and be prepared so that you're not saying oh i'll have to get back to you on this i need to go do some of the homework now

3:52James Wilson: What are those high-level personas or, I guess, modes of operation that a security leader should be in? You know, I can sort of picture it from an engineering perspective, but curious to get your thoughts as to what's almost like the different archetypes of security leadership personalities. Yeah, so I think the first one is my kids talk about a main character moment when you think that the world is built for you, it revolves around you, and it turns out you're not actually the main character. And so the CISO who cannot let go of being the main character, and in every meeting, every board meeting, they want to be the most important topic, they want to get the center of attention, top budget, winner, like all of these things, often security needs to just take a back seat and be in the room.

4:38You may go the whole staff meeting without speaking because you're there to just soak it up and listen to what everyone else, what their priorities are and what their problems are. And so, you know, in most companies, the CISO is there to deal with regulators, deal with customers, make sure the audits pass, make sure that you're getting customers the answers they need. And you need to tend to your budgets, execute on your plans. But they don't want every moment to be, you know, seat of the pants crisis where you're freaking out, you're barely, barely keeping it together. And so that like mellow, just get along, you know, get your job done, find a way to swallow most of the risk that's happening and don't cause a lot of trouble.

5:18I think that is a persona that CISOs have to understand how to play. And then there's the, and you talked about it before about wartime CISO. And so when there's a crisis, when there's a big incident, when your hair truly is on fire, then you need to be able to take over, be the main character, say you all work for me until this is resolved and we're going to get to the bottom of this. But then as soon as it's done, like the company usually doesn't make business by you spending all the money. And so then you've got to learn how to as quickly as possible back out of that and then go back to being part of the wallpaper and disappearance of the background.

5:55And so those are the two. And then you can do a good job or bad job in how you handle these two primary personas. I guess there are others, like I'm thinking about during M &A, due diligence and transactions, you might have to be more or less assertive. So it's not a binary one or the other. I think there's a spectrum with different behaviors in between. But those to me are the two extremes.

6:16James Wilson: Yeah, that's exactly it. It's two extremes. But also then you're talking there about the externalization of those two extremes, how you show up and how you interact. But there's also the internal tension that you're holding. Like is a security leader perpetually actually always hair on fire, but they're just having to contain themselves? Or is it the other way around? Like what's the, you know, the analogy of like be the duck on the lake, right? Calm and smooth and serene, but the legs underneath are just paddling. Is that what's going on in the head of security leaders, despite what they're trying to externalize?

6:50So I think this is highly individualized and different people have their own styles for how they handle it. And the security leader that is constantly, you know, snapping pencils and grinding their teeth and, you know, the duck below the surface, you know, just going like crazy. I think they wear themselves out pretty quick and they can wear out the people around them as well. And so you've got to be able to calibrate how big a deal is this really in the scheme of things? And is it worth staying up all night and not being able to sleep and, you know, snapping your molars because you're grinding your teeth at night and like all of these things?

7:29Is it really worth it? Or can you take a deep breath and put things into perspective and say, you know, we've we've we've been through problems like this in the past. We can deal with this. And so so I think that's a personal style thing in terms of how much you want to freak out. I think it is always useful to be planning and trying to be prepared for when you shift from, you know, outwardly mellow to intensity. And so having, you know, because if you've done your homework during the peacetime era and you've got lots of plans and lots of things that you could go much faster on, you know how you would do it if you had to.

8:10that's the kind of thing that you don't want to have to improvise on because you know the world will throw enough unexpected details that you'll have to improvise plenty already but any planning you can do in advance I think you want to get that done but doing it in a way where you can ebb and flow and not wear your team out around you because you don't want to be constant crisis because that that works in the short term but long term it'll wear you out wear out everyone around you and and your boss your leaders up and then the team that's doing the real work below you in the org chart. And so for me personally, my advice is always take a deep breath, put things in perspective.

8:44Is this really, you know, the time to go, you know, critical and melt down like that? Or do you take a deep breath and try to say, well, you know, what's the productive thing we can do right now? How can we feel good about the work that's getting done at this moment? And then just go home, unplug for eight hours, you know, get some sleep and then come back tomorrow. We push the rock up a hill again.

9:03James Wilson: Right, right. So there's a couple of different elements to it right there's a self-awareness piece to understand i guess your own intrinsic inherent way of operating right know know yourself to know are you prone to panic you know do you actually thrive in those sort of high pressure scenarios are you the kind of person that needs actually a lot more structure you've got to know what your own tendencies are before you can even think about how you layer on a way in which you're going to perhaps modulate those those characteristics to show up in the right way in a certain situation. But before we get to sort of, I guess, the practicals of how you authentically show up in the right way based on having read the room, the other aspect of this is you've got to know what signals to even tune into to know how to read that room.

9:51James Wilson: So where does that, how does that, what advice do you give as to how to actually or get attuned to the right signals to be able to even have a hope of working out which persona to show up as in any scenario? You need to figure out within the organization who are your primary stakeholders that you're trying to keep happy. And so at a lot of companies, if you're the security leader, you might work for a CIO or head of engineering. And so your boss matters a lot. In my experience, general counsel, head of internal audit, whoever handles the customer interface. So that could be like chief revenue officer, head of sales, customer success, customer experience.

10:27There's different labels for these things. But basically, your signal you're getting from your customers, and what are the things that the people that care about the customer vibe, how do they read the situation right now? And then regulatory risk and exposure, and the people that read those signals, this is legal, internal audit, that kind of crowd. And then there's always going to be certain powerful personalities, depending on in whichever environment you're in. And so you need to figure out politically who are the people that their voice matters the most. And then you start to develop basically a dossier on each of these people.

11:01And what do they care about? What are their hot buttons? What gets them excited? And so it's an easy one that the head of sales is going to care about friction that's slowing deals down, anything that leads to churn and existing customers not renewing, and anything that leads to deals that should have closed not closing in the quarter, and things that are drifting across the boundary. And then just noise. So if customers are having trouble, they're getting angry, all of that is going to be absolute top of mind for what the head of sales is working on. And so you want to make sure that whatever balance of who owns, which aspects of that work, that you have a channel to communicate with them so you're getting the signal fast and that you can explain, I'm on it, here's what we're doing, or we're falling behind, we need to do something new and different.

11:48And I need more money and more priority. We need to change the way we've prioritized certain other activities that are happening. And you don't want to wait until you're perceived to be asleep at the wheel. And then you get some big escalation. Because if someone has to come in and ring your bell really hard, you waited too long. And so for each of the people that really matter, what do they care about the most? What's that? And it may not be an explicit dashboard, but you should have some sense of how do they think things are going? And then what are you going to do about that? And if you have the luxury of frequent contact and one-on-ones with these people, that's fantastic.

12:19In the old days when we were physically in the office, you could see their body language when they walked past you. You know, where they like, you know, going out of the way to kick you in the shins as they went by. And then also their perceptions are shaped by, you know, might be chief of staff or sales ops or, you know, whatever the different people where they get their information flow. And so figuring out not just who the principals are, but who works for them, that feeds them a lot of where they get their signal. And then how do you connect with them as well? And so once you have these sources of telemetry, then you can achieve some level of situational awareness as to how you're perceived to be doing.

12:59and if the program that you're leading is failing to delight a significant enough portion of stakeholders then you got to figure out how to how to change things and and then you may you may gradually move on the spectrum from laid back to intense or it may be something you have to flip in the middle of a meeting or overnight um so these are things you have to read the moment and decide what's what's the most appropriate response but even you know some of those signals

13:26James Wilson: that you mentioned there, I guess there's some that are going to be more overt and sort of an official channel, you know, reading dashboards, looking at reports, right, having regular leadership team meetings. But, you know, different people have a different, I guess, ability and comfort level dealing with, I guess, more of the subtler signals. You mentioned sort of body language there or even, you know, forming close enough relationships with someone that they will just have, you know, almost like an offhand remark to you that can give you a whole lot of information. But building up the ability to receive those signals that you're not going to get through an email, that you're not going to get through a report, that you're not going to receive in a staff meeting, that can be really taxing.

14:08James Wilson: In your experience, how much of that is just a not negotiable, you got to knuckle down and build those relationships. You've got to have that, you know, spidey sense sort of awareness of things. You can't just rely on what's going to be emailed to you. Is that super important or can you sort of rely more on, I guess, more official sort of channels of communication? Does that make sense? Yeah, so I think the bigger the organization that you're a part of, the more the people angle matters. And so if you're great at the technical pieces, but you're perceived to be coming up short, the reality, like at that point, it just doesn't matter at all.

14:47It's just how you're perceived and stakeholder management, you know, that becomes the whole game. and it's, you know, you can be an introvert nerd and shake your fist in the sky and say it's not fair and this is just not what I signed up for. But at the end of the day, you know, when I think about sales guys, so there's two numbers that matter. It's what your quota at the start of the year and what your attainment was at the end of the year. And so you could be handed a small quota and then over deliver or you could be handed something completely unfair and ridiculous and have an amazing year but fall short.

15:20And so it's about what are they expecting you to deliver? And how do you manage that up front to say, this is what reality looks like. Here's what I think we can do. This is the stretch goal. These are the things the world may throw at us. Here's how we're going to deal with them when they come up. And if you can have really good communication in advance about bringing true understanding of what you're stuck defending as you talk to people on the outside, outside of the security org. So you're stakeholders that you're trying to deal with. Then you can then be more fairly assessed about how you're delivering against that.

15:57But if you just sit with your back to your stakeholders and you just try to do the best you can, they may think things are really rosy. And then the second that gets shattered in their mind by reality intruding, and then they'll be really disappointed with you because you weren't giving them clear communication about what's going on. yeah and so there's there's different everyone has their own unique style about how they can be successful uh but having good communication is a must and much of that communication is going to be in the unofficial channels you know so it's not going to be like board decks and things like that those matter also but i think it's it's the conversation during the coffee break and it's the way you catch up with somebody before the meeting you know that that's your chance to really get a lot of this work done that needs to happen in order for you to be perceived to be

16:46James Wilson: successful yeah i certainly have experienced the uh the the inescapable truth that the larger the organization is the more there is a gap between how important what you do is and how you do it right if you're in a large organization you can produce a cracking result on on whatever dimension it might be but if you do it in a way that has ruffled feathers or you know annoyed people along the way or, you know, made people feel that they were left out, that successfully is going to mean nothing, right? And in the smallest of small companies, maybe you can get away with, you know, means justifies the ends, but you certainly can't in a large organization.

17:26James Wilson: Okay, so we started off with the premise of we feel like there is a change in the room in general, especially around, you know, the risk appetite for AI at the moment. we've talked about how you know the challenge for a security practitioner is first of all to know yourself and your own tendencies and then to know how to get connected into the right signals that are going to help you modulate the way you show up and navigate that spectrum between hair on fire uh versus uh you know cool calm collected everything's fine why don't we get into the realm now of let's assume you've picked up on a signal but you're kind of unsure what does it mean right How do you go from that moment of something's different and then take stock of, okay, but so what?

18:12James Wilson: How do I know what to do with this realization that something feels different in terms of whether it's risk appetite or whatever other signal it is that you've picked up that's going to have some sort of implication for security? Yeah, so I think in an ideal world, you would be established. You've got your shadow network of information flow that you've already instrumented. So you've got all your different touch points. You're able to connect with somebody. And maybe you're in a big meeting with the big boss and you get the impression something's changed. And you can go talk to somebody afterwards.

18:46It might be the chief of staff or someone who's in the meeting before you that you weren't invited to. and just say, hey, I feel like something's going on. What's cooking here? And they'll just say, oh, he was up late last night, no problem. Or they're like, oh, this is going on. You need to know about this. And so if you get your spidey sense tingling that something is happening, you've got to have a way to follow up on that. And so whether you go and talk to the person directly, and hopefully you've got a level of relationship and connection and access where you can go and seek clarification.

19:17Or if you can't go to that person directly, you'll go to adjacent people who might have insights to offer. And then together you try to figure out like, what's going on? What do I do about this? So I'll give you one anecdote. I was recently, I was out and about somewhere socially, and I was talking to a friend of mine who's the CEO of a company. And this person had been very happy with security leadership within the company. And this was a security leader who customers were happy, you know, audits were being passed budgets made sense you know no squeaky wheel things were just getting done and then they had a near miss the near miss uh didn't flow the information flow didn't come to the ceo the way it should have and so the ceo was like oh man i need to go chase to get details like what else am i not hearing and so now the ceo went from you know blissfully ignorant not paying any attention to security because there's other priorities to now all of a sudden saying this feels like a big deal i'm anxious there's probably you know there's dry rot and i'm going to just put my hand straight through the wall like as i dig into this and so then he started the ceo started chasing the security leader saying give me more details i want to know more about this and the ceo didn't read the tone shift and so this they're sorry the security leader didn't read the tone shift from the ceo and so the security leader stayed in the frame of it'll be fine.

20:42Don't worry about it. Like, I think I'm, you know, things think pretty good. And the CEO saying, no, no, no, this was almost a disaster. What are we going to do different? What are we going to learn from this? And it's like, oh, well, you know, we've got these plans, but the plans weren't mapping to sitting up straight and saying like, like we absolutely have to get on top of this. And so what the CEO wanted to see and experience from the security leader was a snap shift from late back to wartime. And he was, it's really funny because the CEO was telling me, why isn't this person chasing me and yelling at me and telling me he needs much more money, much more resources.

21:17We need to change everything upside down. I'm ready to sign away all of that because I know how important it is, but he's not even asking. And so it makes me think the security leader that I've got in place is not the right person. And so we're going to have to shuffle and make a bunch of changes. And I wish I didn't have to deal with this right now, but this is too important to screw up. And so in this anecdote, the security leader should have picked up on the tone shift, should have been chasing his boss and the CEO of the company and saying, here's what almost happened. Here's why it didn't.

21:55We got lucky. We were a little bit good. Here's the things we can do to make that much less likely to happen in the future and then go much deeper than that and say and with this near miss experience we've brought in the aperture of the kind of things we're looking for and we discovered eight other things that freak us out and so you know as we prioritize them these are the most important three we should go chase all of them and triple my budget for next year and if you can do this in good faith and you're not just trying to like feather your nest and get more headcount than the guy you hate you know on your staff, you know, like a peer, you know, has the same boss or something.

22:29But if you can genuinely say, like, I now have a clarified insight into our risk posture, I've clarified insight into the business priorities and how important it is to drive the potential for these occurrences lower. And based on all of that, we need to change our behaviors. And what I found is that it's usually most appealing if your budget asks or not, I need all the money, but rather, I need a little bit of money and I need engineering, IT, like these groups outside of my org to shuffle how they prioritize things in order to do more work for me. And that may mean they need more money or headcount or they just need to defer work for other stakeholders.

23:11And so in this example, as I was working with the CEO and trying to help them out, this was a clear example where the security leader just completely was blind to the tone shift. and then may end up getting rolled out of the organization as a result because they are not inspiring confidence that they're taking it seriously and they're on top of it the way that leadership needs them to be.

23:31James Wilson: But the flip side to this is that while in that anecdotal example, they've missed the tone shift, which is getting them sort of viewed as not taking this seriously or not the right person in the role. But the irony here is, of course, if they had been at the CEO's door telling them they needed this budget, they needed pre-prioritization, They needed to fix all these things before that near miss. There would have been a perception of this guy's not the right person in the role because they're always hassling me for stuff. So one of the problems here is how do you, you know, and also I've worked with people where I've come out of each one on one and just gone.

24:07James Wilson: This person just latches on to whatever my concern is of the day. I'm not getting anything novel out of them. Right. If I walk in there and say, oh, I'm a little bit worried about this new dashboard thing that we're acquiring, that becomes their primary concern. It's not what I wanted them to do. Right. So there's an art here of, first of all, authentically changing your stance and approach and also knowing when to fully pivot towards something that seems a concern versus, you know, thinking about the old crucial conversations framework, right? You never say I disagree with someone. You say you agree with what you do have common ground on.

24:41James Wilson: Then you bridge what's different between the points of view. And then you compare those two things and that gives you a healthy conversation. but you know in order to i guess what i'm asking is the advice you give makes a lot of sense but the problem is how do you do this authentically and continue to build trust along the way yeah so i think in a perfect world you have 100 accurate insight into current status and a crystal ball about what's going to happen and you're able to prioritize what's the optimal investment strategy to prevent the likely bad things from happening yeah and how many roles have you had that in well you know i've you know if you give me letter grades along the years it's been better and worse at different times you know but so that's that's what you strive for yeah and so you always want to you never want to suppress and fake a rosy situation when there's not um but but basically you you got to know how squeaky can the wheel be you know this quarter this week uh you know this budget cycle and so you don't want to suppress and completely lie and say things are great but you just say, here's what I'm most worried about.

25:45Here's the incremental spend that would make the biggest impact. And then here's where I would draw the line of, I think we should invest in these candidates and then we could keep going. But like, I think this is what makes the most sense right now. And so you can always say like, like if something bad happened tomorrow, maybe something low on your list with new information actually belongs a lot higher, or you should have just gone deeper and spent more money overall. You know, maybe the list was actually pretty good. And so if you can do things like that, I think that's a good way to convey what you know to be true.

26:17In the anecdote that I was sharing with the CO and the CISO, basically there was an organizational blind spot where a non-prod environment had become shadow prod with real data. And no one really knew about this, except for the people that were doing dangerous things. And so it had become an arbitrage where doing prod was hard and annoying because of all the security checks and everything else. And so the clever engineer said, well, we'll just pretend it's non-prod and then we can just do all the dangerous stuff. And it'll be really easy. And so in this case, the security leader should have said, shame on me.

26:56This thing was labeled non-prod. I believed it. We now understand that it's effectively prod because of the data types that are being managed and acted on within this environment. And so our prod landscape just 4X'd in terms of the amount of complexity. And when you look at the relative hygiene between true prod, fairly okay, and then non-prod, just terrible. And so step one is we got to get non-prod up to prod standards. And this is a lot of work. And here's what it's going to take. And we now need to look more broadly about what are all the other dark corners of non-prod that may actually be similarly encumbered with prod data.

27:35And so that was a real, like, we just got smarter as a security team and as an organization. And there was a bunch of people that were guilty of bad behaviors. And so, but how are we going to deal with this? Like, now that we know this, you know, we know this is true. And so to me, when I read the situation, the idea that the list this person had before, Or in some ways it makes sense because he said, this is what prod security control environment should look like. And that's actually a good starting point. And so he said, well, we just need to now acknowledge this other stuff as prod. And then it just created an enormous amount of work.

28:12Or we need to actually make this thing live up to its non-prod label, which means we're going to have to evict a bunch of stuff. So either way, it's a lot of work for somebody. And let's, as a company, figure out how to deal with this. And then you don't go into the background until that gets resolved. And so either it's a big migration project for Eng, it's a big security project to uplift this non-prod environment that suddenly is realized to be prod. These are different ways to handle that.

28:37James Wilson: But that approach that you just mentioned there in terms of how you would handle that, how much of that comes from your extensive experience and therefore someone's not going to learn that unless they're just doing their years and building this. How much of it is though actually sort of like, is there frameworks behind this that can help guide the way to approach this or is there actually preparatory work that you can always be doing to make sure that you're really equipped to deal with this situation? I'm just trying to think of if someone might be listening to this and just going, that's great, Brad, but you've been in like CISO-like roles in huge companies and of course you know how to deal with this.

29:16James Wilson: How would you help that individual understand that it's not about having to work years in those roles but there's other ways to learn how to deal with that moment of oh i need to change the way i'm operating here yeah so i think the so the planning scenario planning and how you present status risk future you know investment candidates that that's the kind of thing that you can there's lots of places where you can get you know examples of board decks or talk to people you know phil venables has a book coming out go read that you know so there's a lot of places we can get information on that sort of thing um how to determine how to best react in different situations in my experience like the first three ten times i do something i'm pretty clumsy and the the more reps i get the better i get at it and you it's very hard to create uh game time true like five fire scenarios.

30:17And so then the second best thing you can do is just practice on it. And so like every day when you're, you know, listen to Risky Business News podcast and you listen to all the like enterprise tales of woe and then think about what if that was my environment? What if that was my company? How would I handle that? What would I deal with it? And so, you know, we were talking last week about the refrigerators and, you know, these things were potentially just on the raw internet, but was it part of the true IT landscape or not? But you can imagine, what if something I didn't know existed, the Pelotons and the company gym, they suddenly went haywire and it led to a big problem.

30:55What would I do about it? How would I handle that? And so do we have the network visibility and telemetry to understand all the things within our environment? What are the caught out and having something that's insufficient? How do you race to catch up? And then how would you talk about it? And so the same way that you can practice to do media interviews and you can do, you know, talk to yourself in the car when you're driving somewhere. Yeah. You can, you can practice these things as well. And it's nowhere near as good as, you know, getting the really angry question in a board meeting and having on the spot come up with a good answer.

31:30Like you don't really know what that's going to be like until you've done it a few times. But the more that you practice under friendly, easy environments, you know, you get a little more like limbered up and better at it. And so giving yourself exposure to the opportunities to practice, hearing how other people and how they handled it, and then, you know, inventing scenarios for you to do your own scenario planning. These are the types of things that I think help you get there faster. But, you know, when you, now when you shift gears, and we talk about like this executive presence, and so you might have the right answer in your head, but if you start stuttering and fumbling and, you know, You can't get your sentences out because your teeth are chattering, because you're so nervous.

32:11You've never been yelled at like that before in front of other people. That's tough. And so you've just got to have the exposure to understand how you react when those situations actually happen.

32:22James Wilson: Yeah, yeah. Actually, if I can take a moment to impart something I learned that I think had a huge impact on my ability to get comfortable in those situations, it was from every year if you were doing a talk at Apple's Worldwide Developer Conference, you would get coached by this incredible speaking coach. The same guy would coach the WWDC presenters who was also like Steve's go-to man for keynotes. And he would make us basically give our presentations in front of a couple of our peers, but we would record them. And after it was recorded, we would all sit down and watch it back together straight away.

33:01James Wilson: And that is the most horrible confronting experience. but if you can get comfortable with that you it's a night and day difference in terms of just the level of comfortability of then walking into that boardroom right if you've gotten comfortable to the point where you can watch yourself back on video and not cringe and not be like oh my god i hate the way i do that i hate that visual sort of verbal sort of tick that i do there you'd be surprised how much of that that is like a subconscious sort of leg up when you do walk into that boardroom because you're no longer worried about the ums and the ahs and the things that you're doing you can actually focus on the the content anyway just yeah i've i've found that really helpful in the past.

33:36You're exactly right. And it's the feedback loop on how do you get feedback on how you're doing so you know what to work on and improve. But then it's the reps. Because if you record yourself once, watched it, hated yourself, and then didn't do it a second, third, fourth, fifth time, you don't actually learn from that. So you've got to do the reps to get over it.

33:57James Wilson: Yeah, 100%. You're not going to walk out of that the first time and just go, aha, all my problems are solved. It's probably on the 10th or 12th week that you start to get actually comfortable with this yeah yeah that's exactly right and and no matter and this was also interesting is no matter how good somebody is they can always get so much better like like you think of the very best communicator you know the the person you just would would die you know if you could be one-tenth as good as they are yeah but but even that person could get 10 times better than they are right now and and the best people i know at communication you have like one-on-one maybe a staff meeting, one presenting to 10 or a boardroom with 15, 20 people in it.

34:36And then up to 10 ,000 person auditorium kind of presentation skills. And some people translate well across halls. Some people spike optimally with one audience type and then they do poorly with others. But the people that I know are the best, they never stop practicing. You know, there was a head of sales at Adobe who was an incredible stage presence, just really, really good. And I was talking to him about like, how did you get this way? And he's like, dude, I'm not there yet. And he's telling me even, like, it seems like he could just roll out of bed and just nail it. And he's like, no, like I was up early this morning, like reading lines in front of the mirror and, you know, like working on, you know, because certain senses don't roll off the tongue.

35:19And so he's got to edit. Yeah. And the effort he put into this in his craft, you know, having been doing it for a very long time, I was very impressed by it. So that stuck with me.

35:30James Wilson: No, I think you're absolutely right. That craft thing, it's not just going to come from the day-to-day doing your job. You've got to put in that extra effort. Hey, as we wrap up, we've sort of approached this from the perspective of we started off with that anecdote of, you know, you having a conversation with the CEO where they said, look, I'm not sure if my security leader is the right person for the role. and we looked at all the reasons why someone above you in the organization can reach that point of view. I want to just flip it around quickly and say, how do you go about having a conversation to maybe try to change that perspective where someone says to you, look, I'm not sure my security leader is the right person for the role, but you actually know they are the right person for the role and it's not necessarily, and that's where you've got to sort of separate things out, right?

36:14James Wilson: There's the person and there's the role. The person might actually be the right person for that role, but it could be something about the role. It could be about the expectations. Have you had a chance to sit down with someone, that senior leader, that CEO, CFO, COO, and actually say to them, I actually kind of believe they are the right person for the role, but maybe your understanding of the role or the expectations is not up to speed. So the way that I think about this, and I think of it, you know, the board's job, when you're a security leader talking to the board, it's do we have the right leader?

36:46Does the leader have the right plan? And is the plan properly resourced? And so you can have the right leader and they may, you know, you may say, hey, I want to see V2 of this plan. Like I'm just not one over by the way you're thinking about it. And how many times you have to do that before you say maybe you don't have the right leader? You know, if you're on V19, you're like, maybe, maybe we're not going to get there. And then you might have great leader, great plan, not properly resourced. And so like, I know how to deliver success. This is the most efficient way to get there. I need 100 units and you're giving me 12.

37:18It's just not going to happen. Nobody is going to be able to deliver success with this. And so when you're talking to someone who's up the chain from the security leader, this is where you get into questions of, is this person set up for success? And frequently, you're not going to get the perfect dream leader that's just perfect in every way possible. And so if you get someone who's technically excellent, but they're not great at building those bridges to other parts of the organization. So how can we pair them with a buddy who can help paper over these types of shortcomings? Or maybe they're good at something else, but they don't have the right technical chops.

37:54And so you want to see them bring up like a CTO-type technical tech lead or something for the team who's going to help them out on the areas where they're weaker. So there's lots of ways when you're rooting for your security org and the leader may not be perfect today. And then you say, well, like honestly, if we're to try to replace this person, we may not be able to get someone half as good. So as imperfect as they are, they're the least bad we can get. And so then how can we change the context and the environment? And so giving them more access, more visibility, more resources, but sometimes, you know, pouring money on top of somebody who's already in over their head, like that's just going to make it worse.

38:34And so then you can say, well, like, I think they understand what needs to change, but they're not able to execute. And so then you can maybe pull aside, you know, like in a lot of works, it might be the CTO or CIO and go to them and say, like, your job is to make their plan succeed. And this is you can't you can't let it fail and blame it on them. Like this is yours to deliver and you're going to do 80 percent of the work. And you can decide how you want to say that in front of the security person or off to decide. There's a bunch of ways to handle that. But I think figuring out how do you divvy up the work properly across the organization?

39:09And that's a way that you can kind of change the odds of getting the outcome you're hoping for.

39:14James Wilson: Yeah, yeah. I've heard this euphemistically referred to as having a sponsor for the project. You know, you're working on something and all of a sudden someone comes along and says, hey, you know, the board's decided I'm going to be your sponsor. Yes, exactly. Yeah. So they can put their, you know, their political thumb on the scale, give you a higher chance of success. Yeah, that's exactly right. Yeah, that's actually, I've heard that word too. You need a sponsor. Yeah. All right, man. Well, listen, it's been great to catch up with you. As we've been saying, the mood in the room definitely does seem to be changing, especially around risk appetite and AI at the moment.

39:48James Wilson: So hopefully this has given folks a bit of an insight as to as a security leader or any sort of senior technical leader, how to read that room and what to do about it so you don't end up being that person where people are wondering, have we got the right person in the role? Thanks so much for your time, Brad. Yeah, it's been fun. Thank you.