Transcript

EXEC.SEC.CON. · CYBR.Signal

0:00
SPEAKER_00: And hello everybody.
0:01
SPEAKER_00: Happy Cyber Sunday.
0:02
SPEAKER_00: Hope you're doing well.
0:03
SPEAKER_00: So there was a post on LinkedIn the other day, and I'll include a link uh in here to it.
0:10
SPEAKER_00: Not somebody I'm connected with, but uh saw the kind of the conversation happening around where they stated that it was unfortunate that there were uh like conferences that were focused on CISOs.
0:30
SPEAKER_00: And that immediately caught my attention.
0:34
SPEAKER_00: But the reason I thought it was interesting even more was because what they seem to be saying is that, or not what they seem to be saying, what they specifically pointed out was that the that CISOs don't typically aren't typically the ones that are looking at the vendor to make a decision on that vendor.
1:00
SPEAKER_00: They they may ultimately be the one that makes that decision, but they're not looking at that on a day-to-day day-to-day basis.
1:08
SPEAKER_00: They've got security architects and directors and managers and others, engineers that are looking at that at a more technical level, all of those vendors, and giving their opinion and then building the case for whatever it is, and then bringing that to the CISO for them to make a decision.
1:25
SPEAKER_00: And I I do agree for the most part that that is that's the way it works.
1:32
SPEAKER_00: You don't see the CISO all the time.
1:36
SPEAKER_00: So a lot of them do, but not I don't think most of them.
1:38
SPEAKER_00: I mean, just you know, anecdotally, most of that I've known, they're making, they're having discussions and just doing decisions, decision making at that risk level, at the program level, that kind of thing, and letting someone else look at all the tech.
1:52
SPEAKER_00: So that made sense.
1:54
SPEAKER_00: But what the base assumption felt like to me, and it's why I commented on it, that I agree with the caveat, the base assumption to me was is that vendors, security vendors, are putting out some kind of event conference that they're focusing on the CISO and making the CISO um the person they they're inviting and not inviting anybody else.
2:23
SPEAKER_00: And if vendors are doing that, I do agree that that shouldn't be a CISO-only event.
2:33
SPEAKER_00: Having said that, you know, I've went the HueSetcon that I do, and you know, all everybody on the team, we've created ExecSecCon.
2:45
SPEAKER_00: And ExecSetCon is focused at having that level of discourse and discussion that a CISO typically would be having, which is the risk level, which is the program building level, compliance level, all of those things that aren't focused on vendors.
3:04
SPEAKER_00: And I think that's the kind of conference that absolutely should be focused at that level.
3:10
SPEAKER_00: That's not to say that you shouldn't have somebody else on the CISO's team come with them to the conference or go to the conference if they are looking at becoming a CISO at some point and want to have that or see what that level of discourse is like if they're not used to having that discussion, uh, those risk and compliance and program level discussions.
3:32
SPEAKER_00: If they're more focused and they have an idea or a goal to become a CISO at some point, then they absolutely should be able to come to those.
3:40
SPEAKER_00: I and we're we're allowing some of that with Execcon where we have CISOs can invite a deputy or somebody else that they can bring.
3:47
SPEAKER_00: If you haven't seen that, go to the link down below as well to apply for it.
3:52
SPEAKER_00: And you can see that you can bring somebody else with you.
3:55
SPEAKER_00: Um but that's really the whole idea behind having a CISO level, you know, executive level conference in security is to focus on the highest level of discourse and discussion from a program perspective, not be focused on vendors.
4:17
SPEAKER_00: And I do agree that if the vendor is creating something that is CISO focused, now that could be a relationship type of uh more of a conference or an event where they're doing dinners or something like that and bringing the CISO in to have that discussion or to just you know talk to them and get to know them.
4:38
SPEAKER_00: And that's that's perfectly fine.
4:40
SPEAKER_00: But if you're a vendor doing that and that's all you're bringing in, then you might think about doing it a little bit differently and have an event that where you're not speaking, you're bringing people in that are practitioners, that kind of thing, versus just having somebody from your your company talk about a talk about your product because that's generally just not going to be helpful.
5:05
SPEAKER_00: So anyway, just thought it was an interesting way to come at it.
5:09
SPEAKER_00: Again, I didn't say it's a waste of your time if you're a vendor and you're bringing CISOs only, but what you're doing is not getting the exposure generally that you could get if you also bring in architects and engineers and have them give their opinion to the CISO as well on that product, because the CISO is generally just going to be looking at program level things.
5:32
SPEAKER_00: So anyway, tell me what you think.
5:34
SPEAKER_00: Um I'll include a link to the the discussion on LinkedIn and I'll include the link to ExecSeccon if you want to be there.
5:41
SPEAKER_00: Hope to see you there.
5:43
SPEAKER_00: Talk to you next time.