Latest / find your cause / He Turned Cybersecurity Into Plain English with Cyber Matters | EP. 191

Transcript

He Turned Cybersecurity Into Plain English with Cyber Matters | EP. 191 · find your cause

• speaker-0: things will happen. My job is to help you to get ahead of them. Think of us as a personal trainer. We will tell you all the good habits. We will help build a diet plan. We will be there motivating you to get things done. But we can't lift the weights for you. We can't eat the diet for you. And if you have a bad day or if you decide to go on an all-night bender for whatever reason, you are going to suffer the consequences. But what we can do is try to get you ahead of it. you speaker-1: Alrighty. So thanks everyone for tuning into this episode of find your cause. Today we have a really special guest in organization. We don't typically interview for-profit companies because we have a focus on nonprofit, but there've been a lot of times when we have and a lot of the reasons why we end up doing that is because they have mission or activities or a culture that we really want to highlight and take some learnings from. So tonight, Saim Khan joined us. He's the founder manager director of Cyber Matters. Saim, thank you so much for your time tonight. speaker-0: Hey, thanks so much for having me. Great to be here. speaker-1: All right, so per usual, what is the mission and what is your organization Cyber Matters? speaker-0: Sure. So I started Cyber Matters with a mission of demystifying and kind of breaking the conventional truths around cybersecurity consulting. People usually associate it with expensive, hard, complicated, vis-a-vis snake oil. So I just wanted to do something to break that status quo. And about six years ago, I started Cyber Matters. You know, we work with companies, both large and small, mostly small companies. and we help them make sense of cybersecurity in simple English really. That's what we do. Nothing exciting, but we are really passionate about it. speaker-1: Yeah. so six years ago, what was the spark for you? Why you, why did you make a pivot and what was your career up into that point? speaker-0: Um, sure. Prior to that, I'd spent almost 20 years working as an IT and then subsequently cybersecurity consultant. And I'd worked with mid- and large size firms. And the way that most of the consulting worked then, and it still continues to work now, is you have these astronomically large, you know, daily rates. mean, talking about two, $3,000 a day for someone's time to kind of take through, you know, someone through consulting. and their cybersecurity, and at the same time, really just giving them, what would I use? I guess just continuously showing them, hey, you should do this rather than here's how to do it, or more importantly, let me do this for you. And I'd run a number of practices for different employers up until that point. And I think this was around the same time as COVID hit. And I thought I'd just use this as an opportunity to kind of break away from that and kind of build the firm that I'd want to work in. So taking all of the learnings from before and then just really building ⁓ a firm that, you know, issues all the values that I believe in. So that was really it. It wasn't, you know, a big epiphany or anything. It was just like, okay, let me just do work the way that I want to do work. speaker-1: Yeah. What were some of the coming from kind of being for larger security organizations, what were some of the things that you brought to your company and what were some of the things that you chose intentionally to leave behind as you started to build your company? speaker-0: So one of the things that I often saw done really well in larger organizations is having the infrastructure and having the actual scaffolding, for lack of a better term, to be able to provide a world-class service. So it means being almost obsessive about the smaller details because it's all those smaller details that kind of connect. For example, and this may sound really strange, but like deciding what systems you're going to use early on. deciding and building out processes from day one, even if it's just a one person firm at that point. But really it doesn't have to be war and peace, but even a page which kind of says, this is how I do X, this is how I do Y and really building out those processes from day one. So that was one thing which I leaned into quite heavily when I was starting my own firm. And the things that I broke away from was the convention that you have to be working nine to five, you have to be working X number of days in the office. mean, bear in mind, this was COVID around the time I started. Everybody was working remote, but return to work was a discussion point even at the beginning of COVID. So, you know, making sure that people work flexibly and work as long as the objective is met. So that was a big departure from the typical cultures that I was working in or I was a part of. So that was the one major shift. the second thing that I believe that you could call the departure from typical things is keeping things super simple. For example, and to this day, a lot of my peers also grapple with me on this, and I'm still a staunch believer of this. I do not like to give long, lengthy proposals to clients. Our proposals are a couple of pages. This is what we're doing. These are the assumptions, these are the limitations, these are the pros and cons, and this is how much it costs. If you can't articulate that in a couple of pages, you're not really being forthcoming. And that's a core belief that I have, that keep things super simple, keep things very to the point. So that's also a big departure. So there's no big branding, there are no six pages on why us and about us and all of those things. It's a cover page, an exec summary. a detailed page and then a financial page. So I guess those are the core things that I would think at a high level. And then from a team perspective, the way that I've built the team and I've tried to build the culture is also a little bit of a departure from what I've seen typically. speaker-1: Yeah. And I want to get into that, but before we do what shifting away from that classic nine to five, what were the, what have you seen are the pros and maybe the cons of that approach, or if there's just pros, feel free to highlight them. speaker-0: Sure. Look, some of the cons, I'll start with the negatives. The cons are that sometimes not everybody's available at the same time. And sometimes you just want to talk things through. And we practice a lot of asymmetric or asynchronous rather asynchronous communication. So we use a platform called Slack and we leave messages for each other on it. And not everyone's online at the same time always. There's usually some overlap, but Sometimes you miss out on real-time collaboration. And one of the ways that we've now started to get around it is we do try to meet up in person, because we're all in different cities. But for the folks that are in the same city, I encourage everybody to meet up. And then once a quarter, we'll all come down to whichever is the most convenient point for everybody and spend a couple of days together, have their meals together, and then just come together for that. But by and large, you know, asymmetric, sorry, I don't know, I keep calling it asymmetric, asynchronous communication tends to make you feel isolated a little bit. the pros are there is an intense trust that everybody's, you know, taking ownership of the outcomes that they've been entrusted with and whether they choose to tap into the time after their kids go to bed in the evening, that's when they do their best work or they are early risers and they like to do work early in the morning. That empowerment really allows you to find that best efficiency lot for yourself. And we've benefited greatly from that. I do want to highlight that this is kind of linked to our culture as well, which is, you know, we recognize everybody's got their own unique, you know, familial and social circumstances. And, you know, for us, it's immaterial what those are. We support the work that you're doing. And if you need to work at certain times of the day in certain styles, doesn't make a difference to us. And I now want to make sure that this does not come across as us being callous, but it's more so to do with, just, we respect the fact that everyone comes from different circumstances, but they're not here because we want to have soldiers in this army, so to speak. We were looking for great people who are great contributors. You know, we give them the flexibility to be themselves, how and where they find best. speaker-1: Yeah. Yeah. And I feel like there's counter arguments to both. you can always find, you can always find somebody to argue the opposite there. could, I could definitely see, and I've experienced, I have a flexible job too at Amazon. I don't, I'm not forced to work nine to five. Like it's, it's more like get the job done and we trust you and, and, being in that environment makes me feel like my, my leadership trusts me to get the job done. So there's definitely pros in that. I think there's some, the opposite could be it's an opportunity for somebody to maybe take advantage of that. There's, think that the new trend where people are working multiple full-time jobs, I think was a recent trend that we've seen with that flexibility. So unfortunately people are abusing something that was intentionally set up for people to be more flexible. it's, feel like employers have put in hard positions where they want to show trust in their employees, but they don't want to get abused. So it's a tough position to be in. speaker-0: I agree. I completely agree with that sentiment, but then therein lies, I think almost the counter argument that I pose it to that, which is why should trust have to be something which is at risk? Why is trust at risk? For example, and this may again sound strange, but I generally, when I'm hiring, I tend to look at if I actually know the person either through a common network. or through a mutual colleague or whether we've actually worked together in the past. Because there's this, as you may have seen in terms of recruitment and hiring practices, there are these insane hoops that applicants have to go through. And on the flip side, while you say employees may abuse remote working flexibilities, at the same time, prospective employers are abusing applicants by literally getting them to do paid work in the name of an assessment. speaker-1: 100 % 100 % speaker-0: in our case, we kind of bypass all of that saying, hey, listen, I need someone to come in and help me do security assessments for financial services companies. And I know that you've done this amazingly well in the past. And I know you are looking for some flexibility in your life. And look, this is what I need. Is this something that you think you can do? And it's usually just a yes or a no. And lot of people who've actually said, hey, I'd love to join you, but I actually cannot because of reasons A, B and C and that's completely fine. Or some people have said, I'd love to join you, but these are things that I need to be mindful, that you need to be mindful of. And these are things that I need. And if there's a mutual agreement on that, it works. And I'm also quite well aware that as we scale, because we're currently about close to 20 people, but as we scale, this is gonna need to be formalized in different ways. But there are ideas that I have on how to make sure that that doesn't kill the essence of what Cyber Matters is as a company. those are my thoughts on the subject. speaker-1: Yeah. And then the other example you provided of things you moved away from and starting your company is simplifying proposals. What the heck is the point of having multiple tens of pages of proposals? Is it more of like a flex thing that you've seen in industry that makes people like, ⁓ this is a large document, so they must be serious or know what they're talking about? Or like, what do you think was the impetus for having a large... speaker-0: So 20, 21 years ago, when I started working at a very, very large consulting firm, I was part of, was a junior consultant at the time. And, basically the gopher that most of the grant work and we were putting together a proposal and this was the first proposal that we were doing. was for a central bank of a, of a, of an Asian country. And it was a extensively large project. was in the millions of dollars, but. when the proposal was being made and the team leader was kind of building it together, they pointed to me and said, all right, you need to go handle quals. What are quals like quals? We have this library of hundreds of one pager PDFs. You need to go through all of those PDFs and each is a one pager on a project profile that we've done. And you need to find similar ones. And I'm like, okay, how many am I looking for? And they said, get at least 10, but bonus points to you if you can get 25. speaker-1: So. speaker-0: Those, ended up, I think maybe finding 18 or something from the whole list, which were directly aligned to the project that we were bidding for. 18 pages of just one page tables of the work that that's been done. The idea is to inundate your reader with to show that you are so good and you've done this so many times. And it's been, you know, proven beyond the shadow of a doubt that you are the best at what you do. So it is. putting that, you know, qualification statement on steroids. speaker-1: Yeah, guess like ⁓ devil's advocate here, cybersecurity is a very serious topic. people get fired probably very frequently for if cyber attacks happen or if data breaches happen. Right. So it's like, yeah, like getting somebody that could say they've done this a million times, you know, guess, perceptually reduces the risk profile of making that decision. So on one hand, I get it. On the other hand, it's just like What are you going to do for me? Are you going to solve this problem? Yes or no? Thank you. Fix it. speaker-0: Okay. On that note, right? About, about, you know, we've done this hundreds and millions of times before. Not too long ago, last year, some of the biggest cybersecurity vendors had outages which impacted the entire world. So I'm going to name anyone, but you know, if you know, you know, and those, those impacts were felt in everyday life from flights being grounded to major retail store operations being halted. So, and this is a company that you know, is a publicly listed company. They actually do really good stuff, but yeah, they have this nafu. They made a mistake. But, this is the thing that we advocate for quite a bit, right? We know something is going to go wrong. And the only thing that you can do is to kind of think about, okay, what will I do if something goes wrong? We don't want you to start quantifying what that thing will be, but more so do I have a response process in place? And And you just do the best you can. And we set this expectation with our customers when we're meeting them for the first time. It's like, I'm not, you know, what I represent or what I'm presenting to you is not a silver bullet. Bad things will happen. My job is to help you get ahead of them. It's almost like, and I give this example quite often is think of us as a personal trainer. We will tell you all the good habits. We will help build a diet plan. We will be there motivating you to get things done. but we can't lift the weights for you, we can't eat the diet for you, and if you have a bad day or if you decide to go on an all-night bender for whatever reason, you are going to suffer the consequences. But what we can do is try to get you ahead of it. you know, there's anyone who says that they can make sure this doesn't happen ever is... speaker-1: Yeah, run in the other direction. Yes, yes. Exactly. Awesome. Well, that's great for some of those best practices organizationally that you've brought to your organization from the culture building perspective. I'd love to hear some of your experiences and what you brought and maybe chose to leave behind. speaker-0: Yeah, sure. Look, culturally, there is, it's a flat structure. Everyone works with everyone. There's no reporting line. So I'm nobody's boss and nobody else is anybody else's boss. Everybody's there for very specific purpose. We utilize this thing to the right person in the right seat. It's actually a methodology I've borrowed heavily from Agenia Wickman's entrepreneurial operating system. ⁓ A lot of small startups use that framework as ⁓ a strategy and a structure building. So we have the right people in the right seat and everyone's doing what they're doing. So there's no hierarchy to speak of. So that way everyone can speak with everybody. There's no, need to book some time. You need to do this. You need to do that. If you need something, just leave, you know, if it's, if it concerns more than one person, create a group chat. If it concerns one person, message them directly. If it concerns a particular project, just go into the right channel and just, you know, raise the question there. So. There's no hesitation in speaking your mind. The second is we focus a lot on sustainability and not in the sense of ESG, but more so don't make promises you can't keep. And that also starts off with like, do not set yourself up for an impossible standard of responding to everything within 15 minutes. Respond when you can, but don't leave someone hanging. Right? So. And this almost sounds like common sense, but again, with the old adage, common sense is very common. But these are things that I've emphasized on rather than, you know, these are values, do your personal best and, you know, perseverance and all of that. mean, sure, but these are things which I think make more sense. So the value system that we drive is transparency over ambiguity. Sometimes it's going to sound terrible what you're going to say. Or sometimes it's the uncomfortable truth, but you have to say it. I've been called out on a lot of things. For example, my head of projects actually tells me all the time that, and her words are, you need to stop over committing to clients. I know you want to help them, but what the hell are you doing? speaker-1: It is possible to have a negative three minute SLA. What are you? speaker-0: And just because you want to help them doesn't mean that you give them the farm. Tell them, she's like, you need to lean on me to kind of have that conversation if you don't want to have it yourself. in your experience, Joseph, how many times has a project leader been able to walk up to the CEO or the MD and actually give them that direct kind of feedback? Probably very little. speaker-1: Yeah, very tough. Yep. Yep. speaker-0: but in our company I get told off all the time. So, that's okay because I like to empower our staff because there is no reason to hold back. what are we holding? It's, 20 people, right? Almost. So it's, it's, it's like a small group of people, group of friends working together. The second thing, and I say friends, a lot of small businesses and to say, ⁓ you're part of the cyber matter. Like, and you're part of the insert company name here, family. No, this is not family. You have a family. This is where you work, but we like to make it a friendly environment. So you actually enjoy coming to work or you enjoy working with these people. our focus is not on family. Our focus is on a good place that you actually don't dread logging into on Monday morning. me. The third is around that sustainability piece. So sustainability is not just for yourself, but you practice it in everything that you do. Don't overcommit. I mean, I myself am the biggest violator of that value. And I get told off every quarter whenever we have a review, I get told off, hey, you were supposed to do this, but you did more than that. Why did you? Right? Going the extra mile, that's fine. But going the extra mile at the cost of some personal thing or at the cost of, know, setting yourself up for an impossible standard later, that's not sustainable. And that's kind of what the value is about. And I'm very comfortable talking about all of this because I am still aspiring to all those values. And I'm not on that 100%. So, and I'm again, that goes back to number one, which is transparency. So, and I'm quite open about it. When we speak with our clients, we're pretty open about it. Like we don't hide anything. We don't, you know, kind of try to present a certain view of the company. It is what it is. And I think that is, that is something that's, that's helped. And lastly, it is. whatever you're doing, make sure it actually does some good in the world. So for example, if I'm sitting here talking to you, hopefully some of the stuff I say may resonate with you and the stuff that you'll share with me resonates with me. And you know, we both walk away learning a bit more than we did getting into this conversation. And that's the same approach I take into every interaction that we have. And that's, you know, including the team and including our customers. And that's what I help push the team as well. that, you know, do that. And lastly, and this is the weirdest one, I guess, or I've been told it's the weirdest one, the best way to, you know, build a good culture is to get out of the way. And I try to do that as much as I can. All right, this is something you want to do. You do it. If I can help you, great, but you know, you're largely the responsible person for this. And it's the hardest thing that a business owner can do, is to get out of the way. and because they want to be involved in everything. Again, I'm not saying that I'm really good at it as yet, but again, something I aspire to. speaker-1: Yeah. Wow. How has that culture that you've established trickled down to your employees experience? Like have they given feedback? Like this is so different from what I'm used to. This is better. This is weird. Like what have been some of the feedback if you've had any over the past six years as to that friend team culture? speaker-0: It's not for everyone. And I can't say that everyone who started off with us is still here. Some people moved on because the, it's a, of this, think of our culture as a, as a seesaw. There is a lot of flexibility and implicit trust given to you, but then it's kind of balanced out by your own personal ethos and responsibility and your own initiative, if you will. So what I mean by that is the folks that have left, and moved on. They have moved on because they felt that, you know, they weren't given too much structure. They wanted more structure. They wanted more rigidity and we're not that. So at the same time, and again, very, very open about it. not the, we don't pay the highest salaries in the market. We're a small business, but we also don't, don't try to underpay our people. So speaker-1: Yeah, yeah. speaker-0: You we try to strike a good balance and the balance and this, and you know, like salary negotiations and compensation negotiations, they're all pretty much based on an honest conversation. Hey man, this is my budget for the year. I want to hire two consultants. If I give you X then I have Y left and I'm not going to be able to get someone for Y. So this is what it is. The second thing is the kind of benefits that we offer. So for example, everybody in the business that comes in, because they're in a consulting capacity, we add them onto our own professional professional indemnity and public liability or is it public indemnity? Yeah public indemnity and professional liability insurance so that we give any advice You know, they're they're covered so they have that protection. Secondly, we have an unlimited leave policy and to be honest, nobody actually takes more than five weeks if at all over a period and It's it's because people are committed to doing the things that they want to do They, you know, someone was moving houses, they were moving to a different city. So they want to take a couple of weeks off. Sure. Somebody wants to take a couple of days off because of a religious observance or because of a family event, whatever you want to take a day off just because you don't feel like working. That's also okay. But there's a lot of responsibility that comes in. ⁓ yeah. The other thing that I've realized, and again, this may sound strange and, maybe I just don't have enough data to, to actually speaker-1: ⁓ yeah. speaker-0: substantially claim what I'm about to say, but I please take it with a grain of salt. think culturally from our perspective, we're not a company for youngins, if that makes sense. And what I mean is that the average age at our company is about 38 years old. So not young, no spring chickens here. Right. I guess it's also because of the nature of the work we do, there is a certain amount of EQ, a certain amount of maturity that we expect. speaker-1: Yeah, yeah. Mm-hmm. speaker-0: And we have hired youngins in the past. And when I say youngins, mean, someone below the age of 25. They've not really, and again, those were the same people who've given us that feedback that, you know, speaker-1: They needed more structure, especially young in their career. speaker-0: So the mentorship that we offer, I guess the, I say mentorship, it's more like the experiences that we pass on from our experience working in this field. People want that to be a bit more structured, but generally it's more like, hey, don't do this. Because when I was doing a project for ExcePt, so and so, this thing blew up in my face. So I can tell you from experience. But a lot of people may not be appreciative of that until it happens to them. And they'll be like, ⁓ yeah, you were right. I told you so. of situation, right? And then from there, the other thing, which the feedback that we've received is from our perspective, right? There's a standard that I try to uphold is even if you work with us for a month, a week, a month, a year, it doesn't matter. I will give you a professional reference. whether you ask for it not, I mean, can throw it in the bin if you want, right? And I'm more than happy to be a reference for you in your next endeavor, because we do not want to be the employee, the employer that you hide from to go, you know, interview for your next role. So some of the folks that have worked with us, they've actually like, you know, they've told me that, listen, this isn't working for me. They're like, okay, that's absolutely fine. Look, you're on these projects. I do need your help to get these projects done. Do you need to speak to recruiters? Here are the five recruiters that I can trust. you know, tell them I sent you. Do you need any references? What kind of jobs are you applying for? What do you want to do? Because ultimately the way I look at it, it's a very small industry that we work in, even globally, right? Small industry. pardon the language, but if you're a douchebag to your employees today and tomorrow they become a size ⁓ or a decision maker at a firm that you're prospecting at and they see you, they're going to be a douchebag to you and you can't really blame them because you know. Oh, is there one? Come to the right. speaker-1: Yeah, you burn that bridge. That was your choice. speaker-0: So just, know, like, I think, I think, so you know how if you go to HubSpot's value page, they say like, know, use good judgment. I think that's their, that's their single liner. Ours is don't be a douchebag. speaker-1: A lot more direct. speaker-0: And we are very direct. are very direct. There's no reason to beat around the bush. It is what it is. And I think our clients also love us for it. We will quite openly tell our clients, if you think this is going to pass, you're dreaming. This is not going to fly. And part of our marketing or part of our messaging is sometimes we're the only adult in the room. speaker-1: Yeah. Yep. Wow. Well, this is, this is, this is great to hear that this is a culture that you've established, especially in this, this up and coming market and this huge need that we're seeing in industry. What, do you hope in the next six years Cyber Matters turns into? speaker-0: In the next six years, I'd like Cyber Matters to not just be compliance in the cyberspace, but compliance in every space. Because unfortunately, and at the time of this recording, there's some riveting gossip slash news that's going through the cyber compliance industry about fraud and dodgy certificates and audits and stuff. I know that other industries are rampant with this kind of compliance theater as well. My vision for the company is to be that, ⁓ if you need a straightforward, you know, five word answer to a question, this is the company that you call. And if, and this is funny as well, this ⁓ was a good moment for me. We started off the year helping three other compliance companies prepare for their audits. The compliance company that compliance companies come to for. speaker-1: Yeah. That's a good ⁓ sign. ⁓ speaker-0: And I'd like to build that further. you know, we play with everybody. We help our competitors. We work with all the vendors that are associated in the industry. We work with people who are around. So I want to continue that. And I believe very much so. And again, this may be aspirational or delusional, depending on how you want to look at it. I genuinely believe that you can work in business without being a douchebag and you don't need to have you know, ironclad joint venture or agreements or non-disclosures in place, you need a trusted ecosystem. So in the next six years, I want to expand the ecosystem. It works today. We've got amazing folks that we work with and partner with across different parts of the cybersecurity space. And I just want to see that grow more into non-cyber security fields like finance, health, ⁓ as well as environmental and physical safety. So I want to look at all things compliance. speaker-1: Yeah. Well, Sam, well, thank you so much for bringing this culture and this type of the company to the world. Is there anything you want to leave us with before we wrap up? Maybe something that we missed or anything that you want to end with? speaker-0: Look, I'll just say that I'm always open to having conversations like this, and I don't need to sell you something for me to be useful to you. And if I'm useful to you today, chances are opportunities will present themselves where you may be useful to me in the future. And that's what you should go through life trying to be right useful to people, because then it all adds up. So if anyone who's listening or watching your podcast needs help on cybersecurity. has questions, I'm always happy to have a conversation. And again, it's not a sales pitch, it's just something that we all at CyberMatters genuinely enjoy doing. speaker-1: Well, Sam, thank you so much for your time. I really appreciate it. And I know it's late or early. I guess I'm trying to think of the time zone difference here. But yes, super early. But yeah, we're honored to share your story and interview you and people that are listening to reach out for exactly what Simon's mentioned. And and yeah, we'll be cheering from you on the sidelines and especially for supporting small businesses and medium business and some large businesses in the work that you guys are doing in industry. So thank you so much and really appreciate what you're building. speaker-0: Thank you so much for having me on. was an honor to be on your podcast. Thank you so much. speaker-1: Thank you. speaker-0: you