Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / How to Sell to the CISO: David Gee, who is a ... CISO

Transcript

How to Sell to the CISO: David Gee, who is a ... CISO · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:32
  SPEAKER_00: You know when you're told go sell this to the CISO, but not told how to do that?
• 0:36
  SPEAKER_00: And you walk into a high stakes, high impact meeting and left to just kind of figure it out.
• 0:42
  SPEAKER_00: Don't you wish there was maybe a book about how to sell to the CISO?
• 0:46
  SPEAKER_00: And if it's gonna be a book, maybe it should be written by a CISO.
• 0:50
  SPEAKER_00: Yeah, well, I found it.
• 0:51
  SPEAKER_00: And the author is joining us today.
• 0:54
  SPEAKER_00: David G has been leading IT and security teams since the 90s.
• 0:58
  SPEAKER_00: He's been CISO or CIO companies such as Eli Lilly, HSBC, and many others you recognize.
• 1:05
  SPEAKER_00: And he's just retired and started writing books.
• 1:08
  SPEAKER_00: One is called A Day in the Life of a CISO.
• 1:11
  SPEAKER_00: And his latest is called How to Sell to the CIO and CISO.
• 1:16
  SPEAKER_00: Yeah, really, these books exist.
• 1:18
  SPEAKER_00: Oh, and these are not cute little ebooks with 20 pages of generalities or just very basic advice.
• 1:24
  SPEAKER_00: These are each hundreds of pages of detail, of specifics, of examples, of stories, the whole lot.
• 1:31
  SPEAKER_00: And David joins us today.
• 1:33
  SPEAKER_00: Frankly, we only scratch the surface in this interview, but we do talk about things such as why sometimes a CIO in the room might not be quietly working for you and might be working against you.
• 1:46
  SPEAKER_00: We talk about what has to be true sometimes before a CISO might break a one-in, one-out rule that it might have, why it matters the career stage of the CISO, and what to say when you finally get to meeting with that person.
• 2:01
  SPEAKER_00: We talk about a whole bunch more.
• 2:03
  SPEAKER_00: Here's David.
• 2:13
  SPEAKER_00: Well, David, welcome to the podcast.
• 2:16
  SPEAKER_00: Thank you, Andrew.
• 2:17
  SPEAKER_00: Excited to be here.
• 2:18
  SPEAKER_00: You know, I'm I'm I'm genuinely looking forward to the conversation.
• 2:21
  SPEAKER_00: Um, we haven't really planned out or scripted out anything we're gonna talk about.
• 2:25
  SPEAKER_00: It's gonna be a little bit free-flowing.
• 2:28
  SPEAKER_00: So, but you've written the book, and you know, this is gonna be fascinating, I think, for the audience to hear all about your advice and the world that you've been in.
• 2:36
  SPEAKER_01: Can I can I wave it around?
• 2:37
  SPEAKER_00: Yeah, yeah, go do it.
• 2:39
  SPEAKER_00: We're gonna talk about this in depth.
• 2:41
  SPEAKER_00: But first, David, you're not the first, but one of the first people to play the Cyber Go to Market talk spin the wheel game.
• 2:50
  SPEAKER_00: We've got five topics today: overrated or underrated, cyber donut hot seat, it's personal, visionary or smoking crack, and differentiation teardown.
• 3:00
  SPEAKER_00: Are you ready to for me to spin the wheel?
• 3:02
  SPEAKER_01: Let's go.
• 3:03
  SPEAKER_00: All right.
• 3:09
  SPEAKER_00: All right.
• 3:10
  SPEAKER_00: So we will come back at the end, and it's overrated or underrated.
• 3:15
  SPEAKER_00: We're gonna give you some things, and you're gonna tell me whether you think they're overrated or underrated.
• 3:21
  SPEAKER_00: But let's get into the episode.
• 3:22
  SPEAKER_00: So let's let's think about this, right?
• 3:24
  SPEAKER_00: So, David, you spent your almost your whole career since the 80s in IT organizations.
• 3:29
  SPEAKER_00: You've been leading IT organizations for a long, long time.
• 3:33
  SPEAKER_00: For example, 15 years at Eli Lilly, including the CIO of the Americas, various financial organizations, including being CISO of HSBC.
• 3:43
  SPEAKER_00: You retire and then you write a book called How to Sell to the CIO and CISO.
• 3:47
  SPEAKER_00: Why are you writing books for vendors and salespeople?
• 3:50
  SPEAKER_01: Yeah, Andrew, but I've also been selling all the time, right?
• 3:52
  SPEAKER_01: So, you know, selling, I've been a you know partner at KPMG and E and EY.
• 3:57
  SPEAKER_01: And so I was selling services, but I was also selling myself up to organizations.
• 4:03
  SPEAKER_01: And so I was selling ideas and and so I've always, from a brand standpoint, thought myself as to be a transformational leader.
• 4:09
  SPEAKER_01: Okay.
• 4:10
  SPEAKER_01: How do I make organizations transform and the teams that work with me transform?
• 4:14
  SPEAKER_01: So how do I coach people to be their best versions of themselves?
• 4:17
  SPEAKER_01: You know, think about this from a scale of things.
• 4:19
  SPEAKER_01: We all actually operate within a range, you know?
• 4:21
  SPEAKER_01: You're you're today you're seven, yesterday you were you're eight, next day you're not getting like great, you operate a six out of ten.
• 4:27
  SPEAKER_01: So how do you coach people?
• 4:29
  SPEAKER_01: So I that's always intrigued me.
• 4:30
  SPEAKER_01: So organizations can operate a higher band and lower band.
• 4:33
  SPEAKER_01: So so writing a book about that was sort of my journey of thinking about this.
• 4:38
  SPEAKER_01: And I if I go way back to, you know, I I write for Foundry, CIO magazine and CISO magazine.
• 4:45
  SPEAKER_01: I, you know, wrote a couple hundred articles, I think, you know, nine, ten, fifteen years ago when I was had some time on my hands.
• 4:52
  SPEAKER_01: And then I always wanted to write books.
• 4:53
  SPEAKER_01: That was the background.
• 4:54
  SPEAKER_01: When I retire, I'm gonna write some books.
• 4:56
  SPEAKER_01: So prior to retirement, I I said, okay, I'm gonna retire at 65.
• 5:00
  SPEAKER_01: Okay.
• 5:00
  SPEAKER_01: So it was two years ago I retired, and I told the office 15 months before I retired, hey, I'm gonna retire about this day, July, about July, August.
• 5:09
  SPEAKER_01: And I picked the 4th of July, by the way, is my retirement date, independence day.
• 5:13
  SPEAKER_01: And so I had an opportunity to write my first book in that first 12 months or so as I, you know, started thinking about transitioning.
• 5:19
  SPEAKER_01: That I want to transition to retirement, but actually not stop doing things because my wife said, like horrified, you mean you're gonna stop?
• 5:25
  SPEAKER_01: I said, No, no, no, I'm gonna be do boards and advisory and stuff and you know, write speeches and be keynotes, and and then I started.
• 5:33
  SPEAKER_01: So I wrote, sorry, I actually wrote a book.
• 5:36
  SPEAKER_01: Autobiographical.
• 5:37
  SPEAKER_01: And it was actually the aspiring CR and CISO.
• 5:40
  SPEAKER_01: And so this was a career guide to how do you become a C and CISO?
• 5:43
  SPEAKER_01: And as I was writing this book, it became evident that actually, well, firstly, a lot of the people that write these, you know, in these roles actually quite shy that I like to be open about things.
• 5:55
  SPEAKER_01: But then I noticed actually, as I launched this book and I did, you know, 20 or 30 events around the world doing this launch that salespeople were buying my book.
• 6:03
  SPEAKER_01: 20% of the sales was salespeople.
• 6:05
  SPEAKER_01: And I thought, that's interesting.
• 6:06
  SPEAKER_01: And then they would say, David, we don't understand the mindset how they how these people think.
• 6:11
  SPEAKER_01: Oh, okay.
• 6:11
  SPEAKER_01: So, but I I had thought about my book three being how to sell to the C and CISO.
• 6:17
  SPEAKER_01: I just wasn't sure the market is ready for it.
• 6:19
  SPEAKER_01: So fast forward, I I started writing this book, and then I said, Well, actually, I'm actually worried that my colleagues don't want to share information.
• 6:26
  SPEAKER_01: So, how about I ask a few of them?
• 6:28
  SPEAKER_01: Maybe, maybe I'll ask five or ten or fifteen.
• 6:31
  SPEAKER_01: I kept I kept asking more and more people.
• 6:33
  SPEAKER_01: Okay, so and the Day in Life of the CISO was my second book, but that took me 15, 16 months to write because it was, you know, sometimes six months approval process for now.
• 6:43
  SPEAKER_01: This is the White House CISO some years ago under Trump's administration.
• 6:47
  SPEAKER_01: Getting those approval processes takes five, six months, right?
• 6:50
  SPEAKER_01: So yeah, and then and frustrating because it's 20 pages, yeah.
• 6:54
  SPEAKER_01: And so again, this book, you know, 500 pages I'd sold a lot of people have sold out to salespeople because that's trying to send the mindset.
• 7:01
  SPEAKER_01: So I kind of knew there's a market there for me to do that.
• 7:04
  SPEAKER_01: But I think the fundamentally, Andrew, I think the whole idea around this book was yes, there's an angle around as a CO and C so you're frustrated how bad it is now.
• 7:13
  SPEAKER_01: The process is kind of flawed, very spammy, you know, you feel like like you feel like you're underwater because you're getting 100 emails from salespeople a week, you know, 20 to 30 linking requests coming through, um, invited for events every day of the week for lunch or dinner or breakfast or drinks.
• 7:31
  SPEAKER_01: And so you're getting all this stuff happening to you.
• 7:34
  SPEAKER_01: Phone calls coming to your private phone numbers, and someone wants to talk to you about stuff.
• 7:38
  SPEAKER_01: And that and and I I thought to myself, is actually how do we change this?
• 7:42
  SPEAKER_01: You know, back to my transformation thinking, how do we get best practices and put them into a book, right?
• 7:47
  SPEAKER_01: And again, this is say thick, and get others to give me quotes and insights.
• 7:50
  SPEAKER_01: So I had 55 others uh provide, I didn't put them on the covers, Tim and provide quotations for me and then do that more holistically.
• 7:58
  SPEAKER_01: So, you know, it's it's vendors and CIOs and CISOs and resource analysts and advisors.
• 8:05
  SPEAKER_01: There's a CFO in there, there's a chief procurement officer there.
• 8:07
  SPEAKER_01: So have about 360 review things.
• 8:09
  SPEAKER_01: So it's not just David speaking, but actually it's the industry talking about this is good, this is bad.
• 8:14
  SPEAKER_01: And my hope was actually we create a a way where that's that's the standard.
• 8:19
  SPEAKER_01: We want this standard, a higher standard of of level.
• 8:22
  SPEAKER_01: And so that makes it all about change.
• 8:25
  SPEAKER_01: So I'll just I'll push from it, Andrew, but change is really important for the C-suite, right?
• 8:30
  SPEAKER_01: So if you can't get the right change happening, your job's kind of over, right?
• 8:33
  SPEAKER_01: And so so because they're frustrated with the process, they'll they'll shut those people out and block you out.
• 8:38
  SPEAKER_00: Yeah, for sure.
• 8:39
  SPEAKER_00: And you know, I'm glad you brought that up, but uh the book, I mean, both these books are 500 pages, but because you interject all the anecdotes and situations with all these other people, it doesn't feel like a 500-page reach, I gotta tell you, right?
• 8:53
  SPEAKER_00: If you're going through it, it's like, oh, that's interesting.
• 8:55
  SPEAKER_00: There's the you know, the CIO from this company talking about something and the system from that company, it's it's really well put together.
• 9:01
  SPEAKER_00: I I find it really interesting going through it.
• 9:04
  SPEAKER_00: Thank you.
• 9:04
  SPEAKER_01: It's it felt it felt like a jigsaw puzzle, by the way.
• 9:06
  SPEAKER_01: It felt like a headache because you actually had all these voices talking to you and you're trying to then figure out how do I knit it together.
• 9:12
  SPEAKER_01: Clustered in the right place.
• 9:14
  SPEAKER_01: Yeah, yeah.
• 9:15
  SPEAKER_00: Yeah.
• 9:15
  SPEAKER_00: But I think you hit on something there at the start.
• 9:17
  SPEAKER_00: You you know, if I if I think about my selling career, David, I've I've been in cybersecurity sales world since 98, been at a bunch of different companies.
• 9:26
  SPEAKER_00: And I would say my experience is that if we as a sales team, wherever I was, got, let's say, we wouldn't get as much as 100 hours, but let's say we got 100 hours of training in the year about to do our jobs and all the rest of it.
• 9:39
  SPEAKER_00: I would imagine maybe two hours of that hundred is about the people we sell to.
• 9:44
  SPEAKER_00: And it's often a throwaway line, right?
• 9:46
  SPEAKER_00: It's like, oh, this title cares about these three things, and that's it.
• 9:51
  SPEAKER_00: And and and that's about it.
• 9:53
  SPEAKER_00: And then, you know, the way that you get good is you put the hours in and you work and you content, you talk to people and you build trust and you go from there.
• 10:01
  SPEAKER_00: But the actual look, here's the how this all works behind the scenes and how these teams work, just never had anything like that before.
• 10:07
  SPEAKER_00: Yeah.
• 10:08
  SPEAKER_01: It's it's fascinating.
• 10:09
  SPEAKER_01: I I as I mentioned, I work as an advisor for a few select firms, right?
• 10:13
  SPEAKER_01: From Silicon Valley Tel Aviv out there.
• 10:15
  SPEAKER_01: And and so they just want to get to my network.
• 10:17
  SPEAKER_01: And I always tell them, you know what, I have a network, I value the network, it's growing.
• 10:21
  SPEAKER_01: They people trust me because I'm an ex-peer.
• 10:23
  SPEAKER_01: So I can't just spam them because you asked me to.
• 10:26
  SPEAKER_01: That would be going against my book.
• 10:28
  SPEAKER_01: Okay.
• 10:29
  SPEAKER_01: But we you need to have preparation, you need to be thinking about what's in their mind, what's on their agenda.
• 10:34
  SPEAKER_01: And actually, something that, you know, often, Andrew, it's actually not actually written down.
• 10:38
  SPEAKER_01: It's not the strategy that's been written down and been executed often is too late because you've already that's been sold to.
• 10:44
  SPEAKER_01: It's the stuff that's happening, yeah, 12, 15 months out, where it's probably not budgeted, probably not approved.
• 10:50
  SPEAKER_01: But they're thinking, actually, I really need that because I'm thinking the business issue is gonna be this.
• 10:55
  SPEAKER_01: How do I address that?
• 10:57
  SPEAKER_01: And trying to understand that in preparation, then, you know, then perhaps having that discussion, and it's a two-way discussion, it's not a pitch, right?
• 11:05
  SPEAKER_01: Is really important.
• 11:06
  SPEAKER_01: And I've seen it work really well where, you know, I'll give you the small example where working with a vendor and they're trying to get to this very large Australian company.
• 11:13
  SPEAKER_01: And I said, Well, I'm not gonna just send this message to them and let's give me something interesting where where they there's a business problem they they have that you know about, right?
• 11:21
  SPEAKER_01: And so he came back with an idea and said, Look, this is a business problem, gives you more security as you cut your costs.
• 11:26
  SPEAKER_01: And so I flicked it to him, like literally two two sentences and said, Look, this this looks interesting.
• 11:31
  SPEAKER_01: Are you interested in having a having a consideration of this, right?
• 11:35
  SPEAKER_01: Within a few hours?
• 11:37
  SPEAKER_01: Yeah, wow, let's have a look.
• 11:38
  SPEAKER_01: But it was because the the target message hit the spot in terms of the objectives was about increased risk, uh, reduced risk, sorry, and lower cost.
• 11:47
  SPEAKER_01: And it was a unique proposition in terms of category.
• 11:51
  SPEAKER_01: So that meeting happened, and that was literally the way it should be, which is it's it's a it's uh a need that hasn't been thought through that he wants to talk to.
• 11:59
  SPEAKER_01: So for me, it was actually wasn't work, it was easy, right?
• 12:02
  SPEAKER_01: But for the versus actually all the all the hard red, you know, sorry, red color, blue opposite a blue ocean, it's all red, it's all sea of red, which is just blood and and people don't uh enjoy it.
• 12:12
  SPEAKER_00: Yeah, I noticed uh there's two CISOs contributed things to the book, and it was an interesting contradiction from them and interesting on this topic, right?
• 12:21
  SPEAKER_00: So one of the CISOs said, you know, it's astonishing how many vendors turn up and explain things to me and all the rest of it about this is happening and all the rest of it, as if I don't know what I'm doing.
• 12:33
  SPEAKER_00: And there's another one saying, you know, I I want people to come in and and tell me things I don't know, right?
• 12:40
  SPEAKER_00: So how did you think about that?
• 12:41
  SPEAKER_00: Like, do I want to be told about the future or do I want something to listen to me about what I care about?
• 12:47
  SPEAKER_01: And by the way, it was more than two.
• 12:48
  SPEAKER_01: Okay, there may be a bit eight, I think.
• 12:50
  SPEAKER_01: I think it's it depends.
• 12:52
  SPEAKER_01: It it goes down to the person's persona, Andrew, too, as well, right?
• 12:55
  SPEAKER_01: And and perhaps there's also in their mind, uh, every C-suite person I know, right, they're overloaded.
• 13:02
  SPEAKER_01: Their brain is overloaded.
• 13:03
  SPEAKER_01: And so if they had a bad day and you're coming in trying to talk to them about stuff that's not in on that, you know, list of 10 things in their head and it's number 11, you're gonna get rejected because it just doesn't doesn't meet what's what's in their current m mindset.
• 13:17
  SPEAKER_01: And so it's uh it's it's tricky, it's tricky.
• 13:21
  SPEAKER_01: And I I understand it's it's a tough job, but that's where the magic happens, right?
• 13:24
  SPEAKER_01: How do you how do you read the signals?
• 13:26
  SPEAKER_01: And I even talk about the fact that if you're if you turn up for a meeting with me and and I've just had an incident and I've but I've said, look, I'll take it.
• 13:32
  SPEAKER_01: You probably should say, no, look, David, go go and deal with that, because you're not gonna be you're not gonna be focused on what I want to talk about.
• 13:39
  SPEAKER_01: Let me give you back the time.
• 13:40
  SPEAKER_01: I'll come back to you in a few weeks' time.
• 13:42
  SPEAKER_01: Now, I know that's hard because sometimes as a salesperson, you may have taken a month or more to get that meeting, sometimes three months.
• 13:48
  SPEAKER_01: But if you said that, I I I would actually respect that versus trying to give this message, you know, and you're not listening to me.
• 13:54
  SPEAKER_01: And you just look at your phone and you're going, oh geez, I'm gonna lose my job.
• 13:58
  SPEAKER_01: And that's a hard trade-off, isn't it, to make that decision.
• 14:01
  SPEAKER_00: Yeah, uh the example you gave was where trying to get to the system for the first time.
• 14:06
  SPEAKER_00: Would you the other approach that sales will do is they'll work with the team, right?
• 14:10
  SPEAKER_00: They'll work with the middle management team and build up, I don't know, knowledge and trust and all the rest of it, and then say, okay, now is the right way to go.
• 14:18
  SPEAKER_00: Is that the best way to do it?
• 14:20
  SPEAKER_01: Or yeah, no.
• 14:21
  SPEAKER_01: I look, I think that that warm introduction we talk about, coming through champions, is important.
• 14:26
  SPEAKER_01: And so champions, and and there there are some C-suite people who said actually, you know, if you come this way, top down, I'm gonna be a bit annoyed because you haven't worked through my team.
• 14:35
  SPEAKER_01: But I've also seen when I was working as a divisor is that you know, often the the vendors start at the bottom, the technical folks, because they don't have the top level relationships.
• 14:44
  SPEAKER_01: And the truth is that both you need both ways.
• 14:47
  SPEAKER_01: You need both ways to work, and you need that that to come in where, you know, ideally, you know, your champion says, Hey, Andrew, I've got an idea, which is I saw that we've got a gap in in this.
• 14:58
  SPEAKER_01: Are we thinking about doing something about that next year's plan?
• 15:01
  SPEAKER_01: Right.
• 15:01
  SPEAKER_01: And so Andrew will go, that's interesting.
• 15:04
  SPEAKER_01: Let me think about that, right?
• 15:05
  SPEAKER_01: And depends on the relationship between David and Andrew, whether you actually give much credibility to that.
• 15:10
  SPEAKER_01: But then you go in in conversation with your having coffee with your mates or your girlfriends or friends, or you'll say, Hey, what are you doing about this?
• 15:16
  SPEAKER_01: And you'll, oh yeah, I'm doing that.
• 15:18
  SPEAKER_01: So that that sort of warm network peer thing, there's not number of networks happening this way and that way, right?
• 15:24
  SPEAKER_01: And so you you're working both ways, and then you're saying, okay, hey, Dave, let's talk about that again.
• 15:29
  SPEAKER_01: What's your idea?
• 15:30
  SPEAKER_01: You know, what what should we do?
• 15:31
  SPEAKER_01: Who who do we who do we consider for to solve that business outcome problem we have?
• 15:36
  SPEAKER_01: And I think that's that's the dynamic that happens, right?
• 15:38
  SPEAKER_01: It's not always just one conversation, it's many conversations.
• 15:41
  SPEAKER_00: Yeah, it's not an easy formula, right?
• 15:42
  SPEAKER_00: You have to really that's where your EQ as a seller has to be really on point to understand all these different dynamics.
• 15:48
  SPEAKER_00: One of the things I noticed about the book is there's multiple times throughout you write about the concept obviously of trust, right?
• 15:56
  SPEAKER_00: And building trust.
• 15:57
  SPEAKER_00: You talk about it being a bank account with deposits and withdrawals and things like that.
• 16:01
  SPEAKER_00: Give it a sense of, you know, if I'm trying to work with a company, how how do I, how do I really set out on the right foot and start building that trust along the way?
• 16:10
  SPEAKER_01: Yeah.
• 16:10
  SPEAKER_01: I I I think I've I I've got a chart there somewhere, Andrew, that's called the three C's, right?
• 16:15
  SPEAKER_01: And it's um competence and competence, confidence, and what's the other one?
• 16:20
  SPEAKER_01: Um, I'll get to get back to it, but I'll lose the example because I think at the end of the day, first, your first thing you notice is the competence, which is this person I'm speaking to knows what they're talking about from a competence standpoint.
• 16:31
  SPEAKER_01: They've got some domain knowledge on a topic that I'm curious about, right?
• 16:35
  SPEAKER_01: And then the the the confidence part is that is that person's actually speaking to me, and I I get a good sense of presence.
• 16:42
  SPEAKER_01: That person's actually you know, that person that I could work with.
• 16:45
  SPEAKER_01: And that that there are elements of trust.
• 16:47
  SPEAKER_01: Now, the third C I trying to remember the what it was, um, but eventually it was all about that I'm seeing you provide this service over time, and it's actually incredibly trustworthy, and you're actually giving me that's not continuity, you're giving me the what I expect you to do over time.
• 17:07
  SPEAKER_01: So it's not actually something that you'll see initially, which is the you know, the pure technical competence.
• 17:13
  SPEAKER_01: Um, you'll you'll see okay, delivery and and and I'll it'll come back to me at the end, I think.
• 17:18
  SPEAKER_00: But you know, competence, character, and consistency.
• 17:21
  SPEAKER_01: Thank you, thank you.
• 17:21
  SPEAKER_01: And consistency is the piece that you get over time, which is okay, contract signed, I now have the A team with me the whole time, not the B team put in.
• 17:29
  SPEAKER_01: Sorry.
• 17:30
  SPEAKER_01: And so I think that matters because people judge you and keep judging you, and if you keep providing those three C's, then that that trust gets built more and more from from being distrusted, okay, to to being more preferred and and no, perhaps and you know, every now and then you'll be an MP M VP, right?
• 17:49
  SPEAKER_01: But that's that's pretty rare.
• 17:51
  SPEAKER_00: Yeah, my feeling is that on the first contact on your side, people are very skeptical of the salespeople they're working with, right?
• 17:58
  SPEAKER_00: They're like, you know, what's gonna happen here?
• 18:00
  SPEAKER_01: Oh, that's massively.
• 18:01
  SPEAKER_01: No, it's actually it's actually distrust.
• 18:03
  SPEAKER_00: Yeah, distrust.
• 18:04
  SPEAKER_00: There you go.
• 18:05
  SPEAKER_01: Distrust, yeah, it'd be the it'd be the right place to start because of all the bad practices going on, right?
• 18:09
  SPEAKER_01: You'd actually think, oh, okay, you got through to my phone number?
• 18:12
  SPEAKER_01: Okay.
• 18:13
  SPEAKER_01: What do you what do you want, Andrew?
• 18:14
  SPEAKER_01: Okay.
• 18:15
  SPEAKER_00: So we're starting from uh we're starting from a low point, right?
• 18:18
  SPEAKER_00: So all we have to do is build, not to lose at this point, right?
• 18:21
  SPEAKER_00: So we're just trying to gain, gain, gain.
• 18:23
  SPEAKER_00: So if I look at competence, character, and consistency.
• 18:26
  SPEAKER_00: Any examples where the sales team or the vendor itself has just completely got it wrong in in those areas that you can remember?
• 18:34
  SPEAKER_01: I think I talk about I mentioned before about bent strengths important because I think you see that the consistency pieces, you know, being they're willing or the all the stars, architects and the likes for the for the sales, and then when the implementation comes, they disappear because they've been assigned elsewhere.
• 18:50
  SPEAKER_01: Because look in the day, right?
• 18:51
  SPEAKER_01: If you if you're if you're putting yourself on the line to actually put a change forward, all that sales process is great, but you actually want the outcome at the end.
• 18:59
  SPEAKER_01: You know what I mean?
• 19:00
  SPEAKER_01: So that's where you care about that getting the outcome, driving that change, being told, hey David, that's pretty good.
• 19:06
  SPEAKER_01: That's I like that, you know.
• 19:08
  SPEAKER_01: A little paddle to back, not much of a paddle to back, a little paddle in the back.
• 19:10
  SPEAKER_01: Keep your job, right?
• 19:11
  SPEAKER_01: Because I think that this whole psyche of you know for these C-suite people, particularly CISOs, right?
• 19:17
  SPEAKER_01: What's the average tenure is what?
• 19:19
  SPEAKER_01: Two years, three years, right?
• 19:21
  SPEAKER_01: So their career is not that long.
• 19:23
  SPEAKER_01: So making a mistake is is life-threatening for them and their own and their position.
• 19:27
  SPEAKER_01: So that they they want to see consistency, they want to see performance, they want I want to see people giving them the best.
• 19:33
  SPEAKER_01: And so that's important, I think.
• 19:35
  SPEAKER_00: Yeah.
• 19:35
  SPEAKER_00: You mentioned you mentioned change a couple of times now, right?
• 19:38
  SPEAKER_00: The idea you're a leader is there not to just keep the lights on, they're usually there to make transformations and changes and things like that, right?
• 19:45
  SPEAKER_00: I heard a great line from a CFO who was talking to salespeople.
• 19:49
  SPEAKER_00: He said, you know, whatever you might think, really the purpose of the sales cycle is to build the business case for change, right?
• 19:57
  SPEAKER_00: To help the company realize they have to do it and then how do they actually go do it?
• 20:00
  SPEAKER_00: Does that ring true for you as you think back?
• 20:03
  SPEAKER_01: I I do.
• 20:03
  SPEAKER_01: I do.
• 20:04
  SPEAKER_01: And like and look, uh, there's a lot of uh criticism of CFOs getting in the way.
• 20:08
  SPEAKER_01: And so I think there's like a chapter 18 or 19, it's about procurement and legal and all these parties.
• 20:14
  SPEAKER_01: And so that have a role to play, right?
• 20:16
  SPEAKER_01: So, you know, frustratingly for the vendor and also for the C-suite, they slow me down, right?
• 20:21
  SPEAKER_01: They that they'll uh put in barriers that don't seem to help me because I want to get my outcomes.
• 20:27
  SPEAKER_01: And so they they're worrying about compliance, they're worrying about contract wording and IP wording and and so forth.
• 20:33
  SPEAKER_01: All those things I think are important, but actually you care about the change, you care about the outcome.
• 20:39
  SPEAKER_01: And this this is this is why you're there, I think.
• 20:43
  SPEAKER_01: You know, when you think about it, this is why you're in in chair, and clearly every C-suite person can be one of the personas, whether you're transformational or more business focused or a risk-based person, but you care about change.
• 20:55
  SPEAKER_01: Even the ones who are BAU care about change, just a different different degree.
• 20:59
  SPEAKER_00: And how do you align that to the stage?
• 21:02
  SPEAKER_00: You talk about the stage of for the CISO's career, right?
• 21:06
  SPEAKER_00: Some might be early on, some be more mature, you know, be in the role a long time.
• 21:10
  SPEAKER_00: How do you align their appetite for change to kind of of how long they've been there?
• 21:15
  SPEAKER_01: Yeah, and and listen, I think go back to my second book.
• 21:17
  SPEAKER_01: You know, you see you see that there are some CISOs that have in that book that have been there 18, 20 years, right?
• 21:21
  SPEAKER_01: But that's the edge cases.
• 21:23
  SPEAKER_01: Most have this two to three year.
• 21:25
  SPEAKER_01: So I think looking in the chart, I've in the chart, I sort of charted that if you're a typical CISO, you come in, you go, oh my God, this place is really going to be attacked.
• 21:33
  SPEAKER_01: I'm going to be the wine holding the can because it's going to fall over.
• 21:37
  SPEAKER_01: It is such a bad state with such high risk.
• 21:39
  SPEAKER_01: Why did that last person do this, right?
• 21:42
  SPEAKER_01: And so they come in going, all guns blazing, which is we need to make these changes now.
• 21:46
  SPEAKER_01: So they start high with we need to be do some action.
• 21:49
  SPEAKER_01: And then they say, Oh God, let's just, I'm overloaded, let's back off a little bit.
• 21:53
  SPEAKER_01: You know, so they kind of be you curve, I think, right?
• 21:54
  SPEAKER_01: Which I need to do more.
• 21:56
  SPEAKER_01: My experience is the CIO is slightly different.
• 21:58
  SPEAKER_01: CIO's a little bit different.
• 21:59
  SPEAKER_01: They're more considered, they're more around how do I build stakeholder engagement with my business partners and so start a lower curve, then say I need to prove myself, and then back off a bit, as they say, I've done enough like this need to sustain this.
• 22:12
  SPEAKER_01: So I think that's the typical curve for the CIO and CISO.
• 22:16
  SPEAKER_01: And you kind of watch those clues, you know.
• 22:19
  SPEAKER_01: And I've seen CISOs come into roles and you know, provide with hundred page presentations.
• 22:24
  SPEAKER_01: He I wanted all these things.
• 22:25
  SPEAKER_01: And I went, oh, here we go.
• 22:27
  SPEAKER_01: Okay.
• 22:28
  SPEAKER_01: And the answer is in between, right?
• 22:29
  SPEAKER_01: Which is you need to be listening, seeing what's there, and honoring the past and then say, how do I make it better?
• 22:34
  SPEAKER_01: Which is always the good case.
• 22:35
  SPEAKER_01: But the degree of change is the difference between different C-suite people.
• 22:39
  SPEAKER_01: How's it going to drive things?
• 22:41
  SPEAKER_00: And when you say if someone's been there a while, their appetite for risk or change is lower, or they've got more confidence, more credibility and tech.
• 22:50
  SPEAKER_01: Well like they can't I can't blame the last guy anymore or last girl anymore.
• 22:53
  SPEAKER_01: It's more on me.
• 22:54
  SPEAKER_01: Look, I I I think they're they're in a different stage because of they know what's worked, they understand change takes time and you know getting getting things done that make an impact, you know, takes a few budget cycles, yeah.
• 23:07
  SPEAKER_01: And if you've been there for five years then you kind of know that you know you've done all these things, you probably get slightly more defensive because when things go don't go well, they look at you to say you've been here five years, Dave.
• 23:18
  SPEAKER_01: Now, right now in today's age it's the AI error, okay?
• 23:22
  SPEAKER_01: And I'd argue that for most most organizations they aren't well protected for that that new control plane.
• 23:28
  SPEAKER_01: They're just fighting the last four still and they're asked to do that with the same team and the same budget.
• 23:32
  SPEAKER_01: And so they're feeling a bit exposed.
• 23:35
  SPEAKER_01: Most most COs and CSOs feel a bit exposed right now because they're being told top down from the board go and make this AI thing happen.
• 23:42
  SPEAKER_01: But you say oh but but oh no no just go make it happen right we want to don't be the puppet of no don't be the one saying no.
• 23:49
  SPEAKER_01: So they're in a tricky situation that they're trying to protect the organization from from a cyber standpoint but understand this new AI induced threats is huge and you know probably I would argue after Ransware probably number two ish.
• 24:02
  SPEAKER_01: Right?
• 24:03
  SPEAKER_01: It's coming up with the charts with the with a rocket.
• 24:05
  SPEAKER_01: Yeah so they're feeling very grondable I think.
• 24:07
  SPEAKER_00: I think you're right one of my clients right now is in that space and they say when they taught the people the phrase is we feel like the trains left the station and we're trying to catch up and figure out how do we protect ourselves.
• 24:19
  SPEAKER_01: And it's gonna go and it's going faster it's going faster with no brakes, right?
• 24:22
  SPEAKER_01: So yeah.
• 24:23
  SPEAKER_00: Yeah really is the other thing you mentioned you mentioned CIO and sister there before you said that there's sometimes tension between the two there's not always harmonious what's going on there?
• 24:31
  SPEAKER_01: What's the dynamic that we don't see from the outside I I may I think written an article for CI magazine about the the CIO CISO tensions like three years ago.
• 24:40
  SPEAKER_01: Okay.
• 24:40
  SPEAKER_01: And what surprised me having been a CIO for 20 years, Andrew was then, you know, purposely going into the role of a CISO because I wanted to do that because I wanted to do something different, different industries, different countries.
• 24:51
  SPEAKER_01: And going to HSBC I had offers to be a CIO as well.
• 24:55
  SPEAKER_01: But then I thought going in there that actually he would get it.
• 24:58
  SPEAKER_01: And I realized actually what wait wait a minute hang on a minute most CIOs I work with actually we just cared about digital change, driving change because that that's they got the pass from the head and bonuses, right?
• 25:08
  SPEAKER_01: But cybersecurity that's just actually there's no upside this is just downside.
• 25:13
  SPEAKER_01: Okay so I I found I found that many CIOs I work with when I was a CISO were that so negative to cybersecurity and not really supportive on you know superficially they were supportive but actually a great example I I love to give is that many many years ago HSBC mobile banking in the US which is not huge was was was was being hacked you know by a bot okay and and it brought it brought down the mobile banking service in the US and I then said okay so is that the same version we have in Asia oh well no it's it's you have three countries in Asia if you A19 actually have the same version.
• 25:52
  SPEAKER_01: So I remember talking to the CIOs and said look I I need your support here.
• 25:57
  SPEAKER_01: We have this big issue in the US we'll put a bot agent in place to help alleviate this for the time being but actually the currently you're at risk because they could target you next and these CIOs were saying no that's I don't want to do this and I said well sorry this is this is not this is not a choice you've got to tell me when is it next month or the month after but it's going to happen to you right you're gonna get it targeted because it's a very easy switch for these guys to to figure out the same version.
• 26:24
  SPEAKER_01: And kind of shocked me that a CIO would be pushing back on that because they're worrying about experience I said well when you're when you're out that's a really bad experience okay so please don't say this is not something we're gonna get to do.
• 26:37
  SPEAKER_01: And I saw that happen a few times which surprised me but then I realized that yeah they don't get it.
• 26:43
  SPEAKER_01: Yeah I think uh everyone who's been in this industry for a in the sales side for a while has got that story about the company that didn't invest or they say so couldn't justify to someone to get something and something something bad happens and the budget suddenly becomes available like three times over is in the reaction that you get sometimes but this this story goes on forever because I've had examples where there's one one chief risk officer in my book who actually used to be a CISO and when he came in from came into a to a job after being BCG cyber consultant for me for 10 years he he became a chief risk officer and he said I want the CISA under me and I saw that happen across a few organizations where they separated the CISA from the CIO because the CIO was telling them don't disrupt the the business don't annoy them you know go and keep them happy and so having that separation of reporting I've seen that across at least three different companies where they've said okay we need independence we need you to be able to secure the organization and not worry about availability of systems as much.
• 27:40
  SPEAKER_01: And what's the relationship with the CFO like usually you know the uh I I did I was laughing I did I did a l I did a lunch with Palo Alto a couple of years ago and it was actually in this in in Sydney here and I wanted to have a CFO it was a global CFO from Palo Alto in town they wanted a CFO C CSO lunch and so I remember I remember having the starting conversation saying well when I was in this role and I saw this guy I would run away because it would be and I said no don't joking however that there's truth in that because you you know the CFO sees you as being a biggest and spender not sure I I under really understand why you're spending money why it keeps going up you know why why is it you're different you know why are we spending more money on you than we're spending on on on other areas of the business but then how do you switch that around to be to be more along the lines of having the C CFO as your biggest ally by actually spending the time to and you know make him and make her hear more under her understand why and you know how how do you use their language and how do you use risk quantification language so you can start to put financial terms around here's the risk in financial terms it's you know was X billion dollars of risk we reduce that to 800 million still a big number but but we reduce that by these investments.
• 28:58
  SPEAKER_01: And so trying to speak to to him or her in their language helps but you know also understand that they they have the power to block you right so there's a there's a whole bunch there about business case in the book around how do you work through that?
• 29:10
  SPEAKER_01: How do you start to help help yourself because rather than being the victim you know and and having that vetoed by CFO and procurement team because they've often report to the CFO really important to get the change happening.
• 29:24
  SPEAKER_00: How could a vendor help a CISO with that?
• 29:27
  SPEAKER_01: Oh easily and I and talk about the book and look at firstly you know the vendor knows best practice cases.
• 29:34
  SPEAKER_01: The vendor knows you know what business case returns and has worked elsewhere and providing sharing those examples that you know obviously they have to be changed and adapted for each client client but actually say look and we've worked with a company that's similar to yours, similar scale to yours over here and and they've had the success getting it approved and getting it in and here's their business case the identified template that's really helpful because when you write building a business case you you want to get it to work but you need that sort of data right and so and sometimes I talk about the book sometimes actually you know you want to maybe introduce the CFO to turn on the CFO to say hey we can introduce your guy to this lady who's actually has approved this and endorsed this.
• 30:18
  SPEAKER_01: So those those sort of connections are important I think to provide that context.
• 30:22
  SPEAKER_00: Yeah I think you said in the book that you know the CFO is interested in soft savings but really cares about hard savings.
• 30:30
  SPEAKER_00: But security never or rarely produces on its own it's not like you invest this much to get hard savings.
• 30:36
  SPEAKER_00: It seems like almost every big purchase must be a a real wrestle to try and figure out how to get it justified.
• 30:42
  SPEAKER_01: Oh mess mass mass massively and and you know we're all being all being crowded out now with AI investments right so it's it's it's it's one pot of money still right so we forget that actually most of the C-suite people don't have much discretionary funds.
• 30:55
  SPEAKER_01: It's all fixed in with different contracts with different staff and and so that that there's got a little bit of skinny room to play with and yeah so it doesn't matter how big your budgets are the same deal applies.
• 31:06
  SPEAKER_00: Yeah you have constraints.
• 31:07
  SPEAKER_00: Did you ever do much work with true startups, earlier stage startups when you were in the world?
• 31:13
  SPEAKER_01: Yeah I did I did I I did a lot of work uh as a VC and and probably back back in the days Andrew I was probably meeting 25 to 25 to 30 startups a month from around the world because I was I was curating them doing innovation workshops and going to big companies and then saying look I've once a quarter I've got this what interested in I've got startups and blockchain, cloud, you know whatever whatever the the themes were at the time and having them pitch three or four of them pitch to uh to the executive group because people are trying to be innovative and get ideas in.
• 31:47
  SPEAKER_01: But I was thought that actually there's a purity in the small guys because they they can't afford to be everything.
• 31:53
  SPEAKER_01: They need to be very good at what they do and and so therefore even cybersecurity the same thing was how do you how do you do more with less and so that that that thinking I guess applies to big organizations as well as small ones.
• 32:05
  SPEAKER_00: I'm always fascinated that you know who actually are the the lead the the the CSOs or the CIOs who want to work with startups because it it you take it a risk, right?
• 32:15
  SPEAKER_00: It's like you know it could be career limiting or it could be a big win you know a certain type of person that wants to do that.
• 32:22
  SPEAKER_01: I I think there's there's a there's a type but it also depends on the topic because you you know like I I I talk to a lot of you know again I get approached by a lot of early stage companies and so they're you know these these are new best to breed potential best of breed products and so the and I there's a chapter can't what is it chapter 15 about best to breed versus packages right and I started writing this one and I it was sort of interesting because you fundamentally know that if I've got uh the average CSA's got 85 products or 80 89 products think of it something like that and 29 vendors okay so you know the CFO is telling you hey stop buying new crap from new vendors can you just use the vendors we have because we can get a better pricing deal and negotiate better.
• 33:06
  SPEAKER_01: So that's what you're hearing in your voice all the time.
• 33:08
  SPEAKER_01: So you then say okay I'm gonna incur the wrath of the CFO because I want to have one in, one out.
• 33:13
  SPEAKER_01: So keep the number about the same right I'm gonna invest in this because this is a new category that my current guys don't have this but it's really important to me.
• 33:21
  SPEAKER_01: Right.
• 33:21
  SPEAKER_01: So it's something about AI, observability or something that's actually new.
• 33:26
  SPEAKER_01: And so I I can't go back to this existing stack.
• 33:29
  SPEAKER_01: I need to find something new.
• 33:30
  SPEAKER_01: Okay.
• 33:30
  SPEAKER_01: It's worth there for me considering going through the extra problems with procurement extra you know intensive POCs to make sure there's no constraints and issues with the technology stack versus working with someone I know the devil I know.
• 33:46
  SPEAKER_01: And so it's it's a really interesting problem and I think I as I started writing the book at that chapter I I realized people are thinking package versus best abrid versus AI right I said I just use AI for everything.
• 33:57
  SPEAKER_01: And I was like not yet but that that's that's that's how people start to think about you know I can I don't need a package I don't need best of breed I just AI can do everything.
• 34:07
  SPEAKER_01: I said well maybe not but I've been here here now in board meetings people start saying you know we'd use AI for instead of that package.
• 34:15
  SPEAKER_01: There's probably some truth in there that we can use AI for some other functionality but definitely not all of it.
• 34:20
  SPEAKER_00: I I heard someone say the other day, you know, why don't we just why don't we throw out Salesforce and you build our own AI driven CRM as I well you know you got 500 salespeople and you got you know a few thousand customers do you really want to do it like that?
• 34:34
  SPEAKER_00: Because you're gonna take a lot of risk by trying to build it yourself.
• 34:37
  SPEAKER_01: Yeah yeah what's the what's the upside for you?
• 34:39
  SPEAKER_01: Yeah when when you think about back in the days Andrew with the you know the work for Lily and we had I don't know you know 45 to 50 CRM systems around the world right and so one of the things we did with a few other colleagues for mine other CIOs we standardized to have let's have one platform for and one platform, one server, one process global process around the world and we're gonna just part of that in one year.
• 35:00
  SPEAKER_01: We had this ambition.
• 35:02
  SPEAKER_01: We kind of did kind of did that we took us more than more than a year but we ended up finding that we need to have two levels you know one for mature companies and one for the less advan advanced countries and then we had to but having those ambitions were important.
• 35:14
  SPEAKER_01: Then you say how do you work towards that and there's a but it's better than being fractured and splintered and having 50 versions of stuff.
• 35:21
  SPEAKER_00: Yeah.
• 35:21
  SPEAKER_00: Right.
• 35:21
  SPEAKER_00: Well I guess with that change there's a lot a lot of risk that you have to manage as well right it's this you know if this doesn't quite go right.
• 35:27
  SPEAKER_01: Oh yeah no no it's it's uh look change change change management's often the biggest risk because people don't like to make brush their teeth with the left hand like they like to use the right hand but your change management's difficult for the C-suite to manage because they get they get the flack.
• 35:43
  SPEAKER_00: My impression these days is that typically the vendor doesn't get too much involved in the in the change process afterwards.
• 35:52
  SPEAKER_00: We'll obviously help and the customer service customer success uh success folks but it's not like we're all embedded in your change is is what I'm sensing.
• 36:00
  SPEAKER_00: Is that yeah I think that's pretty fair.
• 36:02
  SPEAKER_01: I I think the difference I'd say Andrew is when you when you're working towards a major transformation and you've done a partnership with some big of these big integrator firms and I've seen that happen a few times in my career where you actually want that firm to be embedded you want the firm to have skin in the game.
• 36:17
  SPEAKER_01: So in which case they you know will support you during and post and then people don't realize who actually who's the who's the staff who's the contractor who's the the vendor because you're actually so embedded but that's probably the exception rather than the rule.
• 36:30
  SPEAKER_01: But in those transformations if you don't have that level of team work then you will fail because it'll be a transactional basis which you know you do this and I do this and you want a contract and I do this and versus hey we want an outcome how do we work towards that and so every now and then that is a occurs and and they're often what the CEOs will refer to as the MVPs.
• 36:51
  SPEAKER_01: They'll have one or two MVPs they work with cross their whole career and they they drag them in and engage those people as thought leaders and you know I've got this idea Andrew what do you think about this?
• 37:02
  SPEAKER_01: Even that nothing to do with you okay because they they'll trust you over a number of years and that's that's the ultimate level of trust where you build that relationship over you know battle scars so to speak and you're willing to ask your opinion about other stuff.
• 37:15
  SPEAKER_00: Yeah.
• 37:15
  SPEAKER_00: I want to finish off with talking quite tactical things David if you don't mind let's say that you know startups in in cybersecurity they they've been working with the team and now they've got the meeting with the CISO or the CIO let's let's say the CISO how do they approach that meeting to make sure you know this has got to be a good half hour right let's make sure we get high high value, high impact.
• 37:38
  SPEAKER_00: What should they be thinking about?
• 37:39
  SPEAKER_01: Well firstly they've tuned in to the fact that it that they understand there's a business problem to solve right prior to the meeting having all that you know coffee with their staff members, architects, other people that could be champions to help them get info around the problem and as much as possible because it's something very confidential there's something happening here where we're we're looking at these this topic trying to work through that and say well look you know um there there's something here we could perhaps share with you that could be of interest to you.
• 38:08
  SPEAKER_01: So I I had a conversation with a startup actually a few days ago on this topic and uh I remember there's a little soundbite he gave me which I I took away which is we're doing work around data and I said okay great.
• 38:20
  SPEAKER_01: Then he says oh you know you realize that actually AI alerts are nine times more chatty than other alerts I said oh wait wait wait stop there nine times more chatty in that's interesting so if I'm I'm a SOC and I'm taking all these those data inputs then actually it's there's so much more chaff towards it right oh that that's really interesting.
• 38:39
  SPEAKER_01: I love that angle that's that's an interesting angle which is so your your product actually helps cut through that and reduces that that chatter by 50% which is reduces the cost space I I get it.
• 38:51
  SPEAKER_01: Okay got it I love it right I might put and work with you because you've got something that's interesting and and so to me having that little sound bite that relates to that environment at the context is important.
• 39:01
  SPEAKER_01: So a little preparation is important I think.
• 39:04
  SPEAKER_00: But you started off there by saying the business problem.
• 39:07
  SPEAKER_01: You didn't start off by saying you should be thinking about your product or you know some new stuff you do or that right no no that's it and that you get that from all the quotations of others which just said don't come in with the the solution talking about features talk about the look can I just clarify what I understand your problem your problem you're worried about now is this.
• 39:26
  SPEAKER_01: Is that right?
• 39:26
  SPEAKER_01: Is that this is a problem because we think this is going to be create more risk or there'll be some third party risk or you know try to get that clarification and then and that helps build that business case for because that business case is in his him him or her's head right now right it's not actually articulated on paper.
• 39:43
  SPEAKER_01: But they're thinking about actually I can actually promote this to be number five maybe from being number 10 because I can see that this is something that could be done and it seems like it's to be done elsewhere in other country and it's worked and it's got these returns and yeah maybe you know maybe I can I I'll just switch it around and that that's how strategy is made right it's it's done in the head and then put on paper and how do you get into their heads that there's something that's there that they haven't thought about.
• 40:07
  SPEAKER_00: And then in that scenario obviously made up but would you trust your team to have evaluated the vendor to say yeah this this is the right product and you don't really want to get too involved in that no I'd the the answer is yes the end that that's my answer.
• 40:22
  SPEAKER_01: I think every CEO and CS is slightly different.
• 40:24
  SPEAKER_01: They maybe have less trust to their team and it depends if you operate as a manager and whether you you do but it also depends upon how strategic this this widget is right if the the widget's really strategic to you in your career then you won't just won't trust it as much because you actually want to make sure you're all over it.
• 40:40
  SPEAKER_01: Because at the end of the day it doesn't matter if it fails because you'll still be blamed anyway as the top guy.
• 40:44
  SPEAKER_01: So you want to make sure that you put your finger all over it and get involved in it to a degree not run the POC right or POV but actually say okay put your best people onto it and say I want you to look at this I want you give it a you know good sense will it actually create what we think it will create and not create issues for us elsewhere.
• 41:00
  SPEAKER_00: Yeah I would imagine if it's going to be on for example every single desktop and therefore people are going to complain if something happens you probably want to be more involved yeah yeah no that that there's there's a there's definitely a radar there Andrew which is you're you you're sensitive to that noise.
• 41:14
  SPEAKER_01: And look bear and and bear in mind too is that as you in the CIO CISO roles there's a lot of envy because you're getting all the cash they think right your peers think oh my God Dave is getting all that money all that time what the hell you know he doesn't use it properly he doesn't really you know I I need my project to get off the line and it can't get it funded.
• 41:32
  SPEAKER_01: So they're not gonna give you any favors right there's a bit of competition going on there and and politics going on there.
• 41:37
  SPEAKER_01: And so you're aware of that and you're aware that that's behind it but you got to be above that so to speak right and and then okay how do I help you?
• 41:44
  SPEAKER_01: I'm sorry you know let's get on with it and that that's smooth it over so it doesn't have an issue.
• 41:48
  SPEAKER_00: Yeah it's funny you say what money I remember I went to a a prospect years ago and the sister was mad like spitting mad because he was struggling to find some budget and the network team went out and spent like$15,000 on a massive printer to print out some network diagrams.
• 42:03
  SPEAKER_00: He's like how come we can do that and I can't get any budget for anything.
• 42:06
  SPEAKER_01: It's it's it's unfortunately normal it's normal.
• 42:09
  SPEAKER_01: Things aren't distributed that well and so no no I think the that's why the the CFO's role is really important to actually try to help redistribute the the wealth.
• 42:17
  SPEAKER_00: Right let's wrap up here David with the the end result of the spin the wheel game right here are you ready to to see what the questions are you go all right so we've landed on overrated or underrated the first one you have to tell me whether you think this is overrated or underrated meeting the founders of a startup.
• 42:37
  SPEAKER_01: Oh found founders are as as a as a person that work with VCs definitely it's a it's it's it's important.
• 42:45
  SPEAKER_01: I I think it's I'm not sure underrated is the right thing but actually it tells you a lot about the company culture and and it's one of the you know if you're in a VC you invest upon a number of things the product and the you know how how unique it is but you also invest upon the founders being amazing.
• 42:59
  SPEAKER_01: So no it definitely is important.
• 43:01
  SPEAKER_01: Okay.
• 43:02
  SPEAKER_00: Funny you mentioned VCs so overrated or underrated cyber VCs gosh I don't want to say anything too bad about anybody here.
• 43:11
  SPEAKER_01: No names no no no look I I think I think they they they serve a good really good purpose in in society to to to put money into investments.
• 43:20
  SPEAKER_01: Obviously these days every cyber VC is a cyber AI VC and so I that's the thing I would I'd say is that look at some stage the AI bubble will pop.
• 43:29
  SPEAKER_01: Okay and it'll be AI is going to be important for sure.
• 43:32
  SPEAKER_01: It's just probably probably the AI piece is overrated right now and it'll come down a little bit and that'll but it's it's significant I think.
• 43:39
  SPEAKER_01: Sure.
• 43:39
  SPEAKER_00: Yeah I'll flatten out a little bit all right last one overrated or underrated social events with vendors games dinners things like that.
• 43:47
  SPEAKER_01: Yeah you know it it it's interesting I was asked this question yesterday for for a major vendor and I said look up in my book I've got a chart there about about dinners right and and I and I said well there's criteria which is number one go have a board meeting tomorrow or not and I don't okay so I'll probably go for dinner what's is my friend Andrew attending oh that's that's good okay I'll is the venue is the venue going to be cool you know so I know the food's gonna be cool and then oh is the content going to be interesting too so there's all this criteria so I think to me to answer your question is that people do value those but often not for the reasons why you think it's other reasons and then oh the content's interesting as well I'll go there but it's not necessarily top three.
• 44:28
  SPEAKER_01: Right right yeah it's it's other things combined with the speaker or the giving way David's book and that'd be cool you know and so all that is part of the package I say good good answer.
• 44:39
  SPEAKER_00: All right then well listen David uh absolute pleasure chatting to you the books are available uh the two I've got anyway a day in the life of a CISO uh personal mentorship from 24 battle tested CISOs and the second one is literally how to sell to the CIO and the CISO I'll put these links in the show notes for everyone to be able to click through and more of them fantastic and actually one of my friends told me that um it was so it was so cool that you you did the American flag um that all was a that wasn't the intention it's just uh deep to the UK audience to the UK yeah uh David thanks a lot for joining us really good fun thank you