Latest / Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance / How to Scale Cybersecurity Consultancy | Interview with Bevan Lane

Transcript

How to Scale Cybersecurity Consultancy | Interview with Bevan Lane · Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance

• 0:00
  Dejan Kosutic: Welcome to Secure and Simple podcast. In this podcast, we demystify cybersecurity governance compliance with various standards and regulations and other topics that are of interest for consultants, CSOs and other cybersecurity professionals. Hello. I'm Dejan Kosutic. I'm the CEO at Advisera and the host of Secure and Simple podcast.
• 0:21
  Today, my guest is Bevan Lane. He's the CEO of Infosec Advisory Group and expert in ISO 27,001 compliance, AI, and cloud security, and speaker at various conferences and podcasts. Now what is interesting about Bevan is that he has grown his consultancy from zero to more than 10 employees, and now it has two offices in South Africa and in London, UK. And he has I mean, his consultancy has clients in five continents. So Europe, Asia, Africa, Australia, and North America.
• 0:57
  So it's really a remarkable success. So in today's podcast, you'll learn on how to scale cybersecurity consultancy and really how to make it successful in this, I would say very competitive market. Welcome to the show, Bevan.
• 1:13
  Bevan Lane: Thank you very much. Yeah, it was interesting talking to you and then realizing it's nearly all continents and I think it's 23 countries in those continents. So it's good fun to have got to that level.
• 1:24
  Dejan Kosutic: Great, this is really impressive and great to have you here. So what inspired you really to start with this consultancy business and once you're out on your own as a cybersecurity consultant, can you take us back to these early days?
• 1:40
  Bevan Lane: I think a lot of things is always gonna be like timing and and sometimes getting the right person to to push you. So funny enough, I've I've been doing a consultancy for twenty something years, but only actually really started a company when a client said to me, stop doing being a single party. You're just basically an independent contractor. And you've got so much to give, so we're gonna give you a contract, but you must actually bring in people to help us with this contract. And you must train them, and you must start mentoring them.
• 2:16
  So a lot of this company thing was was not me wanting to do it. Me sort of being forced to do it. And and that is, I think, what a lot of entrepreneurs do. You get to a point where you realize, well, well, I actually have to now go beyond just being a single person. And that client gave me such a good contract with and that I could hire three people to do work, three junior people, and actually, at the beginning, tried with people with experience and then changed that realizing they weren't the right people.
• 2:44
  And from that point, I certainly had, well, you've got a company now. Go. You've gotta now run it. You've gotta go do something with it. And and I think a lot of entrepreneurs have done that.
• 2:53
  They're like, oh my I've actually got to do something now because I've got staff and I've got a company, I've got to grow something.
• 3:00
  Dejan Kosutic: Okay, so what you're saying is that it's not kind of have been planned to really expand your number of people, it was more like, okay, got the contract, now I have to fulfill it, right? How do you manage this kind of a growth of people? Mean, how do you select, because you already said that you didn't select the right people at the beginning, but Yeah. How do you know actually? How do you know which people to to hire?
• 3:27
  Bevan Lane: Again, it's it's it's you learn through the process. So the the first round of people I I went with do contractors, We hire people with five years experience in cybersecurity, and we give them into this job. And then by that, I thought, well, because they've got five years of cybersecurity experience, I can actually work as a CEO and grow the business and not necessarily managing these people because they've got more than five years experience. I have a like I said to you, so the one of the three then became one of our senior consultants, but I realized at the same time when I was interviewing people that I found two or three young people, people 20 years old, who were actually passionate about getting cybersecurity, and I found them on one of these programs, one of these programs where you have to try and enter a competition to get into cybersecurity. And I could see the glint in their eye.
• 4:18
  I could see the the enthusiasm, the excitement, and and I actually then the two older people, you guys are just so jaded, and you're not really giving me what I needed. So I brought in the young people. And our business model largely over the last five, six years has been every year, we now get those people who are now passionate, heavily involved in the business to interview people to find people like them. And one of our things is you can't be in cybersecurity because you want a job. You gotta be in cybersecurity because you want to be in cybersecurity because you have that glint.
• 4:53
  You have that I call it a spark. I can see the spark in you where you show an interest. You're excited about it, and you really want to be in this industry. You don't just want, you know, a job because you can't find any house or because you've heard that people pay well in cybersecurity. Mhmm.
• 5:10
  Yeah.
• 5:11
  Dejan Kosutic: This is interesting. I mean, focusing on enthusiasm as as the main criteria. Yeah. It's it's and and besides this, let's say enthusiasm, do you find also some other characteristic which predicts the, I would say, successful hire?
• 5:25
  Bevan Lane: It's an adaptability. Gotta, know, even in auditing, you know, it's a lot more structured and formal. I still need somebody that can actually be flexible and adaptable because I might say to them, well, we've got this new standard, and we need you to learn it in a week, and you got an audit to do. Or we might need to tell people, you know, we need help now on the implementation side because we're a relatively small company. We're as big as we wanna be at.
• 5:51
  So flexibility, adaptability, but people skills are critical. When I'm talking about enthusiasm, we're looking with somebody that a client can see, and they're they're happy to see the auditor. You know? They're not they're not terrified of the auditor. They they enjoy the experience largely with most of the work we do, and and they understand people and understand that, you know, I want people that can go out and build relationships with people.
• 6:17
  So probably the number one thing is that. It's sort of the people skills, but the enthusiasm, the spark is almost as critical as that.
• 6:24
  Dejan Kosutic: Okay, sounds good. And how do you then train these people once they once once you hired them?
• 6:31
  Bevan Lane: So at beginning, it was very much a mentorship thing. So I would spend the first year retweet taking people and they would go on jobs with me, and they would learn how I do it, but they also learn how what was wrong with my stuff and what how they could do it better themselves, because you get your own habits, you know, as as you can imagine. And as you've been doing this for too long, you almost you do things in a way that maybe you're missing a few things or you just know things automatically that's very flexible. So Mhmm. They would take what I taught them and make it a lot more structured and and build on that and then say, well, the environments are changing.
• 7:11
  How do we go from there? So I did a lot of mentoring the first two years. After the two year period, then you've built a structure of people that you don't have to be mentoring all the new people coming in as much. But a lot of people when these these youngsters come in, they they do want that. They're like, well, Kevin, you've been doing this for a long time.
• 7:30
  You've got this name. We obviously want to be mentored by you. So Mhmm. You still have that as a thing, but now we've got a more structured courses now. So we've built our structured courses internally, and then also we've got access to, certain companies, other training.
• 7:46
  So Mhmm. So we're looking and building. So we say to guys, get the security plus. Look at the EC Council stuff. Look at, you know, Look at all the big guys, and then we then put them on a path in terms of training.
• 8:00
  But I've got access to a lot of courses because I'm a trainer, so then I can actually do some of that training for them and then allow them to do self study. So we get everybody who works for us to literally do probably two or three courses in their first year and then a lot of the internal stuff.
• 8:17
  Dejan Kosutic: Okay. And in your experience, what kind of, let's say, training or mentoring shown the best effect? So what is the most effective in this, let's say, first couple of years when these people are introduced to the job?
• 8:31
  Bevan Lane: The most of it is the shadowing stuff. So, you know, you can you can take somebody through a course and then say, okay. We're gonna talk about security policies or we can talk about auditing. We're gonna talk about implementations. And and when they're on the course, you can try and tell them stuff and try and give them practical examples, but they're just getting the theory.
• 8:49
  So, really, the the biggest one is, we're gonna do an implementation. Come on the implementation with me. I'll show you how you don't do anything for the first month or two, and then you then build into components of it. So we do a lot of that shadowing at the beginning where they don't do much. They're just there as an extra party.
• 9:08
  But then, obviously, we're assessing them, and we're seeing how interested they are to get involved in. So in that first one, we're still gonna give you bits of work, and we're gonna then start to to track you and see how well you do that. Okay. But, yeah, that's probably at the end of the day, I think all consultancies really do that. A lot of consultancies might put somebody and just teach them for three months and don't do any work, but I I still think the best way is still the shadowing approach.
• 9:33
  Dejan Kosutic: Uh-huh. Okay. And once you actually find a really good, let's say, consultant that will work for you, are you not afraid that they will leave the company?
• 9:44
  Bevan Lane: I think the word afraid is is what you can't be afraid, but you must understand that it's it could happen and it does happen. Mhmm. So and and, you know, why am I doing this? Why are we we doing this? We're doing this because we see that there's a big cybersecurity IT auditing gap in in especially in the developing world Mhmm.
• 10:04
  But everywhere in the world. So that's why I'm bringing in youngsters and training them because, you know, there's a lot of people who move between companies, but I'd rather train up people, get them through things in a certain way. But you've gotta know that some people are gonna leave, and and we have seen that, obviously. But what you gotta do is you gotta offer them something which shows them a path, shows them the structure, shows them the strategy, shows them that, you know, I'm because of my age, I'm not gonna be there forever. So if we can build this company, there must be opportunities for you.
• 10:36
  And and that's where I think the people that have been around for some of them close to four years now have seen that and gone, yes. I can see it. I can see the growth. I can see a strategy. I can see something for me.
• 10:48
  Mhmm.
• 10:48
  Dejan Kosutic: Yeah. But it's That's interesting.
• 10:49
  Bevan Lane: Not easy.
• 10:50
  Dejan Kosutic: But it's always it's always a challenge really to to keep the best people. But yeah. It's it's And you are in a position of the CEO, right? So do you still do consulting work or are you mainly focusing on growth or what is really your role now?
• 11:06
  Bevan Lane: So I do very little consulting work, but I still do some. And what I was always trying to do is position myself in more in in security strategy work or, you know, virtual senior virtual CISA type advisory consultancy, but and I did training. But I I haven't done any training this year as an example. So this year, I've mostly done sales development structure, you know, redoing, looking at our strategy, more sort of CEO work. But occasionally, I still do consultancy.
• 11:40
  And I still think I will do you know, even if I get the company to 50 people, and I still will want to do some consultancy, because it keeps you fresh. It keeps you excited. Gets you involved with clients. So but very little. How much do do you do consulting Dejaune still?
• 11:57
  Dejan Kosutic: Not really. And I'm missing it. Yeah.
• 12:01
  Bevan Lane: I do very little, but I still do some. Yeah.
• 12:04
  Dejan Kosutic: This CEO stuff is really managing whatever, finance and people and everything. I will sometimes rather be consulting.
• 12:16
  Bevan Lane: Should like everything yourself. That's the trick, isn't it really?
• 12:20
  Dejan Kosutic: Yeah. And how do you actually plan to bring your company to, let's say, 50 plus employees? So what is the kind of the main leverage here or the main strategy really to grow such a business?
• 12:35
  Bevan Lane: So I shouldn't have said 50 there, but, yes, I did. I don't think we will get to 50. I do think we'd rather want to use automation and and change processes because there is a huge evolution in auditing implementations right now where people are using software as a service tools largely or using automation, finding ways to do this cleverer. And and, you know, when you're looking at the big boys like the Microsofts, for example, you know, they're starting to come into this field and do a lot of it sort of through automation. So you're realizing you as an auditor and implementer consultant need to change.
• 13:15
  So in the future, what I'm hoping for is to find a number where the company is bringing an income, but I'm not constantly hiring people. I'm Mhmm. Getting people to do things using the the way things are evolving, automation, changing the auditing, changing the implementation. So I I don't think and that'll allow you really to scale because then you could have one consultant auditor doing 10 implementations at the same time because they're really using these services, these structures, these processes. Okay.
• 13:46
  And and I went to a conference last week where one CISO stood up and said, my biggest concern is we are only allowed to use tier one auditors, but the tier one auditors are not immersing themselves into the way the automation and AI is moving. So it it was very interesting to see him say that and going, yes. We've seen that. We've gotta do that. We've gotta get ourselves into that way of doing work.
• 14:12
  Dejan Kosutic: Mhmm. So it's interesting. So basically, you're saying you're going to scale in terms of outputs, but not in terms of headcount. Right?
• 14:19
  Bevan Lane: Yeah. Yeah.
• 14:20
  Dejan Kosutic: Okay. Great. Interesting approach. Okay. Speaking of automation, so how do you see this consulting slash audit role change because of all these softwares and AI tools and so on?
• 14:35
  Bevan Lane: Yeah. I mean, I'm I'm surprised all the time, so I'm not sure I know the answer to that, but I do have ideas on it. And the one thing for me is the the the audit process, you know, very onerous, spend a lot of time from the the clients. Now with these new solutions, you go in and you get the evidence and you spend less time. It's a lot less onerous for a client by doing that.
• 14:58
  And that's why you can do a lot more audits at the same time as an example. And the same for implementations, you can take a lot of it. And my biggest thing when I go against competitors is a lot of the competitors are we are the best ISO people. We know everything. We will keep it to ourselves and only tell the client so much.
• 15:19
  And and and when you're doing a, like, a, you know, a a a first meeting with a client before you even win the job, the guys will say to me, but you've told us so much. The other other guys don't tell us. They keep it to themselves. And I say yes because they've stuck in that old way where you've got your toolkit from Dejon, and you then go to the client, and you then almost to go pretend that you're the only one in the world that knows so much. And I think that attitude, we blow that out the water because you say, guys, anybody can do this.
• 15:53
  Anybody can do this if you just spent the time and you get the understanding. But we can help you with it by doing it this way, making it easier, making it less onerous on you. Yeah. And I do think that's really where the the big change is coming at, but it's gonna change constantly. And and if you're not gonna go with that change, you're gonna be extinct as a consultant.
• 16:14
  And and that's what I've been saying to people.
• 16:16
  Dejan Kosutic: Yeah. Definitely. I mean, there is a huge change in the way that consultants will are working. But aren't you afraid that consultants will, you as a consultant will be out of of job because of this AI thing?
• 16:32
  Bevan Lane: Again that afraid word, If you're afraid, you shouldn't be doing this because you've gotta go with it. You gotta say, guys, and and and the people that are not gonna survive in this industry are the people who are afraid because you got and at some point, yes, things are gonna be very different to what they are now where the consultant does things inherently completely differently, but there's still a need for people. There's still a need for the quality review. There's still a need people with experience. There's still a need for people who can evolve with where it's gonna go to.
• 17:03
  So it's it's a risk, I think, when you look at your strategy of your company, you need to look at and say, well, the way we're currently doing things is not gonna be done that way in the next two to ten years. So it's not a I'm not afraid of it. I see it as a risk. I see it as a strategy movement. Actually and you see it as an opportunity if you're really getting this right because you need to go that that's where it's going.
• 17:29
  I've gotta work like that because if I'm not, then in two years time, no client's gonna come to me. They're all gonna go, okay. You're doing it like that. I'm not afraid. Of course, I'm I'm I'm thinking, you know, where is this going?
• 17:41
  And we need to understand it for the risk of the company. But if you're afraid, then you shouldn't be doing this is the way I see it.
• 17:47
  Dejan Kosutic: Yep. Yep. Definitely. And when it comes to, I mean, scaling the business and and how do you find clients and and how would you compare actually how you found clients when you started with with your business and and how how you're finding clients now? So what what is, you know, in your experience, what works best?
• 18:08
  Bevan Lane: Also changing so much, isn't it? And and I think, you know, the when I used to find clients in the past, it was a very limited pool. So I was working in South Africa and I knew people, and and then you become known as, you know, the ISO guy or the security guy in that specific field, and then people then give you references you you get from there. But you you're working in in quite a small environment, and and especially being in Cape Town where, you know, Johannesburg is the big city in the country, so you're not even really doing much work there. So we had to then go, alright.
• 18:43
  Well, guys, it doesn't really matter where I am. How do I get clients in 23 countries? And and, really, the two the two things are partners, the right partners anywhere in the world. Get partners who want to work with you, and you can help them grow, and they can help you grow. And the second one is, then going, using LinkedIn and and marketing on social media and and getting your name out there, getting your website sorted out using those sort of things, which is all the things we've been working on considerably.
• 19:15
  And, you know, now you're on a call to Ukraine, then you're on a call to Australia, and then you're on a call to, you you know, Slovakia. Those are all interesting things that you can do now. So, of course, you need to market like that, and and it's been working incredibly well. Yeah. Last week, I've got seven calls in one week for consultancy work.
• 19:37
  And and that was probably a this is a record. How do I know go beyond that? But I'm not sure we get all those jobs, but that shows you that the funnel's working incredibly well and that, you know, you're getting work through the partners, through the network, through through building your name as a company and yourself. This
• 19:55
  Dejan Kosutic: sounds great. And what kind of partners do you find the most, let's say, productive in these terms?
• 20:02
  Bevan Lane: So it's gonna be a combination of the guys doing compliance services, those products, people, like I said, that's why, you know, a lot of where I'm moving to The UK has been through those people. And sort of IT companies that don't necessarily have a cybersecurity wing themselves. And then others, they'll just be people who, you know, are people that reach out to people and look for look for customers through different ways. So there's quite a few different types of partners we've got now and I think all of them have a sort of a need or they see gaps in terms of compliance and you can work with them. And
• 20:39
  Dejan Kosutic: how do you really position yourselves and how do you, let's say, suggest this partnership to, let's say, an IT company? So what do you bring to the table and and why would they accept this kind of a deal?
• 20:52
  Bevan Lane: Because a lot of them don't have and they've tried some of them would have tried a cybersecurity and and back to your point earlier, they would have gone, we need to get into cyber. And then they they hire a pen tester, and then the pen tester gets poached, and then they lose. Or they're bringing someone who's a senior cybersecurity person, and that person the same thing. Either it doesn't work out, doesn't grow the company the way they wanted to, or gets poached somewhere else. So because of this constant movement and things, you can find gaps with people.
• 21:21
  Even the guys that do bring in a senior cybersecurity person, he can't do everything. Like, he becomes like us. He can't do the work anymore, and he's been so focused on so he needs he needs people to help him. Yeah. You know, the one that I really enjoyed was talking to a consultancy who have a lot of very senior people, and they've taken that typical model that many of us in which I tried at the beginning as well.
• 21:46
  You only have people that are trusted consultants, people with lots of experience, and they're so busy that they're now 20%, hundred fifty % busy. And then they go, well, the model works really well, but we're turning work away. So if we were rather to bring in junior people with us or to partner with somebody who has younger consultants, we can give them certain work and then not turn work down. And I think those are the really clever partners. They've done really well with an established business model that are going, oh, this is a way of sort of, like, pivoting now.
• 22:19
  So if Devon's hiring youngsters, enthusiastic people that we can then go, here's a job, senior person does this, junior person does this, we can actually grow both companies. And and I'm looking for more partners like that because it's it's a clever way of actually growing our company both.
• 22:35
  Dejan Kosutic: Yes. Certainly is. It's very interesting actually. Didn't hear many, many consultancies doing this. Yeah, in most cases consultancies are using social media, these kind of things to promote.
• 22:45
  From your experience, what is the best way to use First of all, which kind of channels are you using and and what what is really the best way to to build your brand name?
• 22:56
  Bevan Lane: So at the moment, we're really using LinkedIn dominantly. Mhmm. But we and and that now comes from not just me, but getting all the company getting the company to do it and all the staff to then create their own so you can all build together. So the ten, twenty people can all start to grow together. And the the the the website has been a bit of a we just can't ever get it right.
• 23:20
  So we're redoing the whole website from scratch right now and then using that as a separate mechanism. And then the rest is really then where we do the physical stuff. So I've I've looked at other ones whether we should use other mechanism or may in the future. Facebook is something which we haven't used at all, and I prefer to use that as a person rather than as a company. But in the future, we may look at it again.
• 23:43
  But we find the LinkedIn is is giving us really 8090% of what we need. I think it is a very trusted successful mechanism that it works well.
• 23:53
  Dejan Kosutic: Great. And are you using some kind of paid campaigns on LinkedIn or or simply posting on your personal profile and getting getting leads from there?
• 24:00
  Bevan Lane: Little bit of campaigns, but most of it is personal profiles and company profiles. So so, you know, I've I've been working with companies who a guy who, you know, couldn't find a way to market and he pivoted his marketing company into LinkedIn, And he went from nothing to, you know, 200 staff doing LinkedIn marketing. And and it's really and he also has clients all over the world because of how this has worked out. And and I find it really successful to to work with people like that who understand how to manage a LinkedIn marketing campaign and LinkedIn marketing in that way. And we then hired somebody else working with another partner who can do the the Google SEO and and the website stuff.
• 24:41
  Mhmm. And and both these companies are really good at what they do. And and the way you do LinkedIn marketing is you you you do enough that focuses on your core skills and your understanding of cybersecurity and AI and all those things, and then you're putting enough personal stuff. And there's a lot of people that don't like putting personal stuff into LinkedIn, but a lot of other people that realize that if you don't, you can't really get beyond a certain point. And so it's a mixture of that where you talk about you as an interesting enough.
• 25:14
  And because I've been doing it like that for a year, I have noticed just how many more people are reaching out to me. Yeah. How many more people are interested in meeting me and people are inviting me to conferences, webinars, those sort of things. So, clearly, it does work. You need to because anybody can buy from a consultancy, but, actually, they buy from people.
• 25:33
  People bought from people, and and that's what we found in auditing and implementations. People love us because of people, because of what we give them in terms of the relationships, not just where we can get the job done very quickly.
• 25:46
  Dejan Kosutic: Mhmm.
• 25:46
  Bevan Lane: So for me, it's it's critical. Yeah.
• 25:48
  Dejan Kosutic: So presenting you as as a person plus as an expert is the way to go on LinkedIn. Right?
• 25:53
  Bevan Lane: Yeah. Yeah. Exactly. And I mean, Dejon, your name has been known to me for fifteen years because Yeah. Not because of what you did in LinkedIn, because of what you built in other mechanisms.
• 26:03
  But now I've seen what you're doing in LinkedIn as well, and and, you know, your company has gone beyond you, but your name is still such a large part of of what you are. So that and I think you were one of the inspirations for me that everyone knows days on. You know? Yeah. This could work.
• 26:19
  Dejan Kosutic: Yeah. It's always I mean, especially these kind of smaller companies, it's it's the the name of the founder is always always an important part of the brand name. Right? So it's it's always a a very strong connection, I would say, between the two.
• 26:32
  Bevan Lane: Yeah. I mean, my first one was was was Kevin Mitnick. I mean, I think I met Kevin Mitnick a couple of times, and and it was incredible for me to meet him. But I always thought of and I watched how his name really was everything about his company. And you were working because you wanted to work with Kevin Mitnick, inviting the keynotes and and listening and speaking to him.
• 26:52
  So I would say he's the name that got me thinking, well, if Kevin Mitnick does it like that, that John does it like that. There's something a lot more to this.
• 27:00
  Dejan Kosutic: Mhmm. Yeah. Certainly. Now looking back looking back at at your business, what were some, you know, biggest growing pains or or setbacks that that you encountered? And and since, you know, can you share just just your experience and and how you handle this?
• 27:17
  Bevan Lane: So yeah. I mean, I think, know, you've mentioned a couple of things. Consultancy is exactly that, isn't it? Because now you you hire consultants, and then you you gotta keep them happy. You gotta give them opportunities.
• 27:29
  And then what they'll want is they'll then either go work at a client or go work at an opposition consultancy, and in some cases, take some of your clients with them potentially. So those are things that are very real thing for consultants. And, yes, contracts are in place, but the contracts, you know, sometimes can really only do so much. So and, yeah, I think my biggest challenge really is about finding because you bring in young people and and you're building them up, you sometimes are doing so much yourself and and and doing so much across different levels because they can't they don't have yet the capability to to manage teams. They don't have the capability yet to go out and help you with marketing.
• 28:16
  They don't have the capability to know to do admin or whatever those sort of things that you wanna teach them. So that's that's a big challenge of it, which is why I did rely on one or two people who had more experience to help me. But then realize that those people didn't have the capability and didn't give us what we needed. Mhmm. So then I had to step back and do a lot more of those things that I wish I, in some ways, wasn't doing.
• 28:41
  So, yeah, it's and and and I now have but now that it's four years into the business, those young people are now built up enough to be able to take more of that on, to be able to do that. So and and I brought in people that I wanted to help us with with sales and growth and help the company, and it just wasn't the right fit. So we haven't found the right people to do that sort of stuff, and it's always been a a challenge. So I I start again every year to try and who's the right people, how do I grow with the right can I bring in a senior person to help me? Can I give part one of my businesses to somebody else?
• 29:16
  All those are challenges that are constantly in your head as you're trying to grow this thing and not have a really fun answer to most of those, but I know we work it's working, we're growing, and some of the people, the the junior people are starting to really step up now.
• 29:30
  Dejan Kosutic: Yeah. So what you're saying is that finding the way to to grow your team is basically the the way to to succeed in in scaling the comp the consultancy. Right? Yeah. Yeah.
• 29:41
  Bevan Lane: Exactly. Giving them you know, growing them at the right speed. Think, you know, you you you know, you can't hire a 21 year old and then give them a senior management position because you don't have anyone else. But you can hire a 21 year old and let them learn from you and other people for two, three, four years and then start giving them those management. And and I've seen with my team being post, you know, one of the one of the people was was offered something where, sure, this person's very young.
• 30:09
  How would they be offered a job like that? And they could because they were shown they that they had done so much already in their role that a company that was a big corporate went, well, that's amazing. We can get someone young with three years experience. Come come work for us. And, you know, this is a difficult thing to do.
• 30:27
  Yeah. Exactly.
• 30:29
  Dejan Kosutic: So you mentioned earlier that you travel a lot. Right? That you've been to all the countries, all the starting letters except O, right? Yes. So it's a lot.
• 30:39
  And how do you manage this balance between private life and work life? How does it work?
• 30:45
  Bevan Lane: Yeah. Excuse me. I get asked that question a lot and I, you know, a lot of I did spend by breaking up my life, I suppose, into into sections. So when my children were very small, when they were very small, I was doing a lot of travel working for a for a big auto trim. And and I and I then got a a contract in in Central Asia of all places and worked in the countries there and smaller those stands and made a good amount of money to come back and then spend a lot of time at home.
• 31:19
  So then between when my children were between the age of four and sort of 18, you know, that sort of time period, I could I was mostly home, mostly working home, and then traveling only intermittently, doing small amounts of traveling. But I've done a lot of traveling before then so that I could calm it down a bit. So then now that my my children finishing school, finished school, I I can actually then go and do it again. So that's really what I've done. So I've always been I spend a lot of time with my wife and kids, in that period.
• 31:52
  And and when you then have to leave afterwards, you can imagine it's a bit harder. But, generally, my children are have grown to an age now that they're independent largely. Mhmm. And my wife and I, we we work it out, basically. So, yeah, it's difficult.
• 32:06
  But, generally because I've done so much of it, know we can get a system that works.
• 32:12
  Dejan Kosutic: Yeah, it's very important to be with your children and with your family, especially when they are younger. Yeah, great that you did manage to do it in such a way. I think these are kind of big decisions in your life when you have to really not lose sight of your family and yeah, it's something. And do you actually enjoy the most at your work now?
• 32:37
  Bevan Lane: So the one thing just to tag onto that that is really interesting is when I was with my my family for that period, I was heavily involved in other things with them. So that stuff that they were doing, and the one was I coached my son at football for ten years. And and that coaching of football was constant with them, kids every weekend. So you're spending a lot of time with your family, and then my older daughter also did football too with us as well. So, you know, I and part of why I mentioned that is because that coaching actually showed me that I could actually manage people, and I could actually work environments with other come and I and I had a very competitive streak as you can imagine.
• 33:19
  And and I learned so much from that that I could then bring it back to work. And I do lean on it quite a lot, that coaching that I did for a long period of time, you know, privately like that as well.
• 33:31
  Dejan Kosutic: This must have been a very great experience, right, coaching. These were young kids, right, if I understood well. Yeah. And and spending time with your own child and with these kids and actually learning on how to handle people. It's it's yeah.
• 33:45
  It's it's
• 33:46
  Bevan Lane: It's critical because you're handling fam you're handling parents, you're handling the kids, you're handling the opposition coaches. And I think one of the things I learned there, which I've been trying a lot to improve is is this not getting angry, not losing your temper. And and I think in all the years that I coached, I only had one incident where I got very angry with anybody, and it was a ridiculous situation. And I sat back and sat on a chair in the background and had a inner jade or something and just quietly calm myself down thinking, no. You must never do that again.
• 34:20
  And and in my team working with him as well, it's something really learned. I think, again, I lost my temper with him once and realized it just it's not doesn't give you any real you know, it doesn't go anywhere. It's it's not in any way constructive. Constructive. So that's probably a lot of stuff learned from that as well.
• 34:37
  Dejan Kosutic: Well, it's very interesting. I mean, having this kind of an activity, which is not business related actually helps you in your business, right? It grows you as a person makes you a better business person afterwards.
• 34:48
  Bevan Lane: I think so too. I've met a lot of people when I go to functions who we've had discussions about, they've also coached in different things. And then I could see they have coached because they're they've got more of an interest in the other person they're talking to. They're they're actually, you know, really excited to meet Dejean. You know, I'd like to interview you next time and learn more about you because that's the sort of stuff that I've from that.
• 35:11
  And I think as I've grown older older and and been through a lot more of life's experiences, you actually are more of that person. So do you think it all helps in that in that process?
• 35:21
  Dejan Kosutic: Yeah. Definitely. Definitely. Okay. How do you see this business of, let's say, consulting or auditing evolve in the next, I don't know, five, ten, maybe fifteen years?
• 35:32
  Bevan Lane: Yeah. I do think, you know, we we haven't gone into developing a product because most of our partners have got these products. And and so I'm I'm I'm if we ever did develop a product, it would be something that wouldn't compete with them or would do something slightly differently. And and we've thought about that a few times, so it may still go there, a SaaS service or something that we do ourselves because then it takes it beyond that. And and I know you've you've been through that journey as well.
• 36:02
  So Yep. You know, that would be something that we we have looked at a few times we might still do. If not, I think we will, but if not, we will then work with our partners and to keep on adjusting what we're doing as as we're saying. The the AI angles work we're working with a couple of AI companies already Mhmm. Trying to work out how they're doing things.
• 36:25
  Working with more partners that do things like that in the AI space could could help us. But, yes, we will definitely be adjusting our methodology constantly. You and going in and getting evidence through, you know, the way that these APIs and these AI tools are getting the evidence, understanding the evidence, and then adjusting the way we interview people so that they work together with the way that the the structures are working. And the same for implementations, taking implementation, using a solution and saying, you've got something now that you can manage, you know, constantly, and we can actually then, you know, just help you with that, but adjusting how we do or everything we do really because of that.
• 37:07
  Dejan Kosutic: Yeah. It's interesting. So this combination of of, let's say, partners and technology is is might be a way to go in in the future. Right?
• 37:16
  Bevan Lane: Yeah. I do think everyone everyone will go to that, every country in the world, you know. Like I said, we're doing work with companies in Vietnam and Singapore, and you can imagine, you know, that developers and that people doing things in a very strong technology angle, and you've gotta understand their business and work out that these guys are agile, they're quick, they're doing things in such a different way to, you know, massive corporate backing, you know, Europe might be doing it. And you've gotta adjust your methodology and work with them to try and make it as automated as quick as possible.
• 37:49
  Dejan Kosutic: Yeah. Yeah. Now when you look at your competition, are you afraid of actually staying in the business or them pushing you out?
• 37:59
  Bevan Lane: That word again. Been a bad day at work, Dejon. I'm I'm not afraid of anything. I've I think largely the stuff I've been through the last couple of years has taught me not to be afraid of anything. I'm not.
• 38:14
  But but I know that this is a ridiculously competitive environment, and and you gotta be on your toes all the time. So so the way it is is now I'm gonna push as much as possible probably for the next five years and push, drive, build this thing as much as I can and have no no fear about it because, you know, I wake up at nights and I'm sweating because of cash flow, because of other things, and because we could lose a client. But it's not fear. It's it's more sort of the drive to then not lose that client. Mhmm.
• 38:47
  Not, you know, not lose that deal, get get cash flow sorted out. It's and fear has been something that has been there in the past, but it's definitely not. So but, yeah, you just don't know. And I think you you almost need to make peace with that because you could, in a year or two or five, just be blown out the water by something that changed so much. Mhmm.
• 39:09
  You just gotta go and you gotta adjust and you gotta you gotta go with it and try and do it as positively as possible because, yeah, it's crazy, we just don't know, the world is really is changing this quickly.
• 39:20
  Dejan Kosutic: Yeah, yeah. And do you feel that you're better than competitors because of, let's say, these relationships with your partners or because of your team or because of, I don't know, using of these tools? So what do you feel is really distinguishing you between,
• 39:35
  Bevan Lane: you know Yeah. Why? Why would you come to us and why would you not come to other people? You know? And it's a tough question to answer in consultancy.
• 39:43
  Again, we're not better. We we're just different, and but we can try and give you something, which is done in a different way and maybe the combination of cost and quality and and the skills that you get and the way we do things. So it's all bringing that together. So, you know, we don't wanna say I'm the cheapest because at one point, we were the cheapest because it was the only way to get you going get in the market. But we're no longer the cheapest, but we're the right combination of all those sort of skills that will give you something that, hopefully will really enhance your ISMS, your company, help a lot with what you're doing.
• 40:19
  Yeah. No one is the best, I think, and that's what I've learned as well, but the combination is hopefully what works for you.
• 40:25
  Dejan Kosutic: Mhmm. Great. Okay, so to wrap it up, what would you suggest to other consultants? What are the top things to keep in mind?
• 40:36
  Bevan Lane: You know, I've got a very good friend who is so much more successful than me, and she came and asked me for but, again, what is success? But she came and asked you for advice right at the beginning, and she sold her company and and then sold it again and really has made a lot of money and a lot of success and is going out there. And and I do think, you know, she asked me right at the beginning, how do you start a consultancy? And my first advice to her was don't spend all this time developing something without money coming in. Always at the beginning have money coming in right at the beginning.
• 41:13
  And the way I did it was working at a client part time while I started my business. So I knew I had income. And I probably became too reliant, and that's actually the client that pushed me out and said, grow a team. Because they saw that I was too reliant on them, and I needed to actually take that step and be pushed out of the bath. So but that having money coming in the beginning, and funny enough that the the girl was telling about, she did exactly the same thing.
• 41:39
  She then started working for a customer and did consultancy just to have money coming in as she grew her business. And and it worked incredibly well for her, but I know other people that have just jumped in both feet and just tried to find money and bootstrapped and lent money. And so there's no right answer to this thing, but that worked well for me. Knowing that I had something keeping me there, something that I had annuity income, and then I could then start building from there. And and, largely, we still got that client twenty years later, which is amazing.
• 42:13
  I can't actually really think of how we have done that, but it's largely because, again, relationships. So big one for me. But then, yeah, getting the right people, trusting the right people, getting them to help build it with you, all those are critical things I would I would recommend.
• 42:31
  Dejan Kosutic: Great. Okay. Great. Thank you for these insights, Bevan. It's been a pleasure talking to you.
• 42:37
  Bevan Lane: Thank you, Dejan. It's been great talking to you as well. Yeah. And like I said, I'd like to hear your insights too sometime. It'll be great.
• 42:43
  Dejan Kosutic: Absolutely. I'm all for it. Thanks again. And thank you everyone for listening or watching this podcast and see you again in two weeks time in our new episode of Secure and Simple podcast. Thanks, for making it, this far in today's episode of Secure and Simple podcast.
• 43:00
  Here's some useful info for consultants and other professionals who do cybersecurity governance and compliance for a living. On Advisera website you can check out various tools that can help your business. For example, Conformio software enables you to streamline and scale ISO 27,001 implementation and maintenance for your clients. The white label documentation toolkits for NIS 2, DORA, ISO 27,001 and other ISO standards enable you to create all the required documents for your clients. Accredited Lead auditor and Lead implementer courses for various standards and frameworks enable you to show your expertise to potential clients.
• 43:42
  And a learning management system called Company Training Academy with numerous videos for NIS2, DORA, ISO 27,001 and other frameworks enable you to organize training and awareness programs for your clients workforce. Check out the links in the description below for more information. If you like this podcast, please give it a thumbs up, it helps us with better ranking and I would also appreciate if you share it with your colleagues. That's it for today, stay safe!