Latest / Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance / Next-level Consulting: Marketing & AI Governance Opportunities | Interview with Tudor Galos

Transcript

Next-level Consulting: Marketing & AI Governance Opportunities | Interview with Tudor Galos · Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance

• 0:00
  Dejan Kosutic: Welcome to Secure and Simple podcast. In this podcast, we demystify cybersecurity governance compliance with various standards and regulations and other topics that are of interest for consultants, CSOs and other cybersecurity professionals. Hello, I'm Dejan Kosutic, the CEO at Advisera and the host of Secure and Simple podcast. Today my guest is Tudor Galos, he's the founder of Tudor Galos Consulting. This is a consultancy focused on privacy, AI and governance and he's also the main GDPR expert at Advisera.
• 0:36
  Now he has grown his consultancy from zero to more than 200 clients in more than 10 countries and prior to his consulting career he has worked for fourteen years in Microsoft in marketing roles. So he has perfected various marketing techniques for promoting his consulting. So in today's podcast you'll learn on how to use marketing to grow your consulting business. So welcome to the show Tudor.
• 1:06
  Tudor Galos: Thank you very much. Thank you for inviting me, Dejan. Great honor to be here.
• 1:10
  Dejan Kosutic: Happy to have you here. So what inspired you to leave, I mean, company like Microsoft and and start out on your own as as an independent consultant. Can you take us back to these early days?
• 1:24
  Tudor Galos: So seven years and a half, actually almost eight years now, what happened is that I was on a roll. Received a lot of internal prizes, external prizes. At some point our campaigns were extremely successful. Suddenly there was a York. After the York, my role got axed.
• 1:49
  So basically I had to make a choice whether I go to entrepreneurship or I continue the corporate way. And I thought, well, I think it's time for a change. Maybe the universe is showing me a new path. So I said, okay. Also, I was a hero when I left.
• 2:07
  Everything was green, everything was wonderful, so I left on really good terms. I started my consultancy saying, Okay, this is a one time opportunity, if I fail in this, I'll return to the corporate world. Luckily, this didn't happen, so I was in this entrepreneurship direction as well.
• 2:28
  Dejan Kosutic: Okay, great. Did you ever regret that you went into a consulting business?
• 2:34
  Tudor Galos: No, not really. I mean, of course, I was thinking about the good old days when we had big teams and team meetings and corporate retreats and corporate big meetings. Other than those, I think it's much more interesting in the entrepreneurial direction because it's less bureaucracy, less decision time, more efficiency, more freedom. I get to do what I love, which is interacting with customers and seeing how they transform. In the corporate world, rarely have the chance to do this, especially in marketing roles where you saw only the effects of the campaigns, maybe one or two or three testimonials.
• 3:19
  But other than that, your effect as a person on other people's lives or companies was limited. And here in the entrepreneurship world, sky is the limit.
• 3:30
  Dejan Kosutic: Yeah, this is true. When you're free, you're usually much more happy than in a large system. This is true. I heard that in the beginning of your consultancy you actually offered something like a one hundred hour or free consultation hours to your clients. So how did this work out?
• 3:49
  Was this a successful move or?
• 3:52
  Tudor Galos: So, what I realized when I left Microsoft is that I had a brand, but the brand was connected to Microsoft. So, I was to Dor Galas from Microsoft. And I knew, okay, I had some runway left to use this brand, but I had to rebuild the brand. So, I had, let's say, a max of three or four months until everybody forgot about So, in these three or four months, I had to make an impact. And the first thing I thought was value first.
• 4:17
  Value first is a very interesting sales concept coming from The US type of selling, which is kind of aggressive and fast paced. What they are teaching you in that area is that, first of all, before selling something, try to offer something, something valuable for that person, for that company. Free help, free training, free whatever. So I said, Okay, let's pack something interesting, like one hundred free hours of GDPR consultancy into a marketing or pre sales effort, such as, Okay, one hundred free hours of GDPR consultancy in the form of two hour sessions. This means 50 good thing was that I had 50 open doors.
• 5:08
  In the end, that was the beauty of it. I had 50 open doors. Out of those 50 open doors, I had secured only three contracts, which in marketing terms looks good. It's above 1% closure rate, which is kind of great. Out of those companies who didn't sign contracts with me, I got referred to other companies, and other companies, and other companies.
• 5:38
  So basically, the snowballs started rolling down the way and actually started to get bigger. People started hearing of me and of our enterprise, and of course when GDPR came and everything was a huge buzz, we were able to ride that way.
• 5:54
  Dejan Kosutic: Would you recommend this kind of a strategy also for other consultants that are starting out? Do you think it's a good return on investment?
• 6:04
  Tudor Galos: I think so. First of all, even if you don't secure immediately a deal, people remember what you did for them. People remember your name and remember the fact that they have a positive memory about you. It's very important how you set up these first moves. Because, first of all, clearly you don't have a second chance for a first impression.
• 6:30
  And second of all, you get the first impression in the first seven seconds. And those seven seconds are really important. If people remember you with the fact that you offered something and that you wanted to help to transform the market or something, yes. Well, it depends also what you offer in these, let's say, first You need to actually offer something valuable for them. If it's a new technology, offer trainings.
• 6:57
  If it's a new legislation, offer a webinar, explain to them what is changing in the markets. In a way, what we are doing at AdvisorEye is similar. Whenever a new regulation appears like DORA, we already have tons of content for people. Really see this as extremely valuable. I love this and this is why I keep working with you, because I really get inspired on how I feel part of a team which offers value, instead of just capitalizing on a wave and just cashing in, cashing in, cashing in.
• 7:32
  No, actually transforming the market.
• 7:34
  Dejan Kosutic: I feel that this kind of offering free content that is valuable is really a crucial part of our strategy for companies like AdvisorAh, but also for consultants like you. Okay. You also mentioned that, you know, many consultants are chasing these big enterprise clients and that they leave these smaller or mid sized companies kind of behind. And what do you think? How how important is it to focus on these smaller clients and also how important is it to choose a niche?
• 8:10
  What is your take on this?
• 8:15
  Tudor Galos: There is clearly a big difference between enterprise customers and small businesses. What I learned is that small businesses or small medium companies are easier to transform. They really want to see what you did and feel the impact. Meaning, actually, when you come up with the advice, when you come up with technical organizational measures, when you hear them, when you offer consultancy, they listen. In enterprise, both the sales process and the implementation are usually delayed, because there are lots of priorities, lots of team, reorganizations, movement of funds, movement of people from certain roles, suddenly every change you need to manage it really maturely.
• 9:01
  You need to apply change management processes and methodologies in order to be able to see that they transform. So it's much slower. In smallmedium, clearly it's much faster, the base is faster. Innovation starts to move from the big companies to the small companies because they are much more lean, they are much more eager to try new things, bureaucracy is less, or e bureaucracy. Now we move from bureaucracy to e bureaucracy, and you actually see the change.
• 9:36
  Are kind of working in a mix. We're also working with big customers, where we assist more enterprise processes and documenting and working in larger teams. We also work with small innovative companies who are really changing the market: Artificial intelligence solutions or hospitality solutions or health solutions. It's really interesting to see how fast the market is actually moving.
• 10:03
  Dejan Kosutic: Is it actually easier to get a larger client to buy consulting services or let's say mid sized clients? Because I mean these larger clients are already used to actually using consulting services whereas these mid sized and smaller ones are quicker maybe to make a decision, but they are not really used to using these kind of services.
• 10:22
  Tudor Galos: It's a very interesting mix here and I love this question, it's a really good question. Despite the fact that, let's say, a larger company is used to working with consultancy, they are not used to working with boutique consulting companies like the one I run. Basically they want the big names, or the big fours, the big seven, how they are called, because they used to working those processes, although they don't necessarily offer the best quality or the best value versus quality equation. So It's much more easier to sell these days to small and medium who really start to understand the fact that I don't need to employ somebody on a working contract or a working labor contract while I can outsource some of the efforts or some of the activities inside the organization. And it's not only about GDPR compliance, it's about legal compliance, marketing services start to be outsourced, development of course.
• 11:29
  Suddenly small businesses start to focus on what they are good at, instead of wasting time things that they are not used to and that they don't like to do, they start to outsource because they want peace of mind. Big companies, yes, they are used to, but they carefully select their partners and as I said, they prefer big companies and they are very focused on costs and low margins and that's an issue. We are not cheap, we are not super expensive, but I never get into a price battle. If there is a price battle, I prefer to withdraw from the tender.
• 12:13
  Dejan Kosutic: Okay, and then how to actually get those smaller and mid sized clients? I mean, in your opinion, what is the best method actually to get these contracts, to really convert them from someone who is only interested into really becoming a customer?
• 12:32
  Tudor Galos: Well, actually you to do First of all you need to determine also if you as a company want that customer. Based on my experience, I've seen customers that I really didn't want to work with, which means customers that don't want to transform. I don't want to be that person that I, let's say I was in the beginning when everybody was saying, Hey, Tudor, give me some papers to make sure I'm compliant with this thing that I want to do. No. It's about transformation.
• 12:58
  GDPR compliance or AI compliance, AI governance, it's about transformation. I want to see the fact that they understand that the transformation journey is not an easy one, but it's a highly rewarding one. So, I keep working with those customers. And if I really like a customer, I'll actually fight to get that customer. First of all, I have patience, and we have patience inside this organization.
• 13:23
  So, if I don't secure the deal now, I'm pretty sure that in a few months, or even one or two years, we will secure some sort of a deal. I keep them warm. I keep them informed with posts on LinkedIn, on Facebook, on Twitter, on the blog. I am always going to conferences. I see that they are also going to these conferences.
• 13:45
  So we keep a constant touch base with some of these leads. And at some point we get to work together, if not later or, I don't know, never. But that's life. I'm not obsessed, you know. I'm not obsessed capturing every customer and every client because sometimes, just like in a relationship, some customers are toxic or they are not good for your business.
• 14:11
  They can really prove to have a really negative impact on the business and on your feeling as a person. In the end of the day we must not forget that we are humans and we have feelings as well. If your gut feeling is saying that hey, you shouldn't work with this customer, okay, I'm taking a break.
• 14:30
  Dejan Kosutic: Okay, this is really good. Mean, if you can choose not to work with someone, mean this is certainly, I would say, a privilege that you earned through being already established in the market. Now, basically, besides keeping in touch and touching bases, as you mentioned, with these clients that did not convert yet, what also is important from your point of view actually
• 14:56
  Tudor Galos: to make them your clients? It's very important to be perceived as a subject matter expert. You can do this when you attend conferences, when you are a speaker at conferences, when you write articles, when you keep posting valuable things. Not like, hey, I have discounts for my projects, get them now. No.
• 15:19
  It's about, hey, look what's happening, look what's new in the area of your subject matter expertise, like GDPR in my case, or AI governance, look what is being changed, and look what you should do. By the way, if you need help, we are here, but these are some recommended steps. Just keep providing valuable content. At some point you will get the first customers who will then reference you. What's really important is to have positive first customer experiences.
• 15:49
  This is how you start the ball running. Traditional marketing in the area of consultancy is not working that great. If you just keep sending newsletters which are not valuable, or spamming people, or creating ads, they don't usually transform. People want to hear about what you did at their peers. This is when they trust you.
• 16:14
  They provide you with some initial level of trust that you need to capitalize. The recommendation is the most powerful tool you have as a consultant. So make sure your customers open mindedly recommend you and proactively recommend you.
• 16:30
  Dejan Kosutic: How do you actually get a customer to recommend you? Is this something that happens on its own or is this something that you as a consultant have to facilitate?
• 16:40
  Tudor Galos: It's both ways. First of all, if you know that there is a customer you would like to reach to and there is a connection between your actual customer and this lead, feel free to ask if you have a good relationship. If you build a trustworthy relationship with your customer, this is what will help you actually make this request. But a lot of times these customers proactively recommend you. Because they're saying, Hey Tudor, I really like how you work with me.
• 17:09
  I just recommended you add my partner here because they need some assistance in this specific case. Some of them don't materialize. I just had a situation where somebody at a really big financial institution just wanted to double check and get a second opinion on what their DPO said. Their DPO said, Hey, you cannot do this. So they came to me via one of my customers and honestly I gave this advice for free.
• 17:40
  It wasn't a problem. I said, Yes, your DPO is right. I mean, it's not my role to say, Hey, you have a creepy DPO, replace them with me. No. On the contrary, if that DPO is right, yes, I can say he did a good job, and it's my role to tell you that he did a good job and don't replace him because he's right.
• 17:59
  And, okay, for me it was a valuable thing, that person also understood my opinion and maybe in the future it will work or not. It's not a problem.
• 18:09
  Dejan Kosutic: Okay, and so you said that basically to actually get your existing clients to refer to you this trust building process is crucial, right? Now, how do you actually build this trust with your clients?
• 18:24
  Tudor Galos: It's a very good question. First, you start by listening. Nowadays, not too many people know how to listen. Listen, listen, and don't speak. You're tempted to speak notes.
• 18:38
  Just take notes. Just take notes, learn about the customer, ask questions. Listen and ask questions. Don't come immediately with solutions. Ask questions, ask questions, learn exactly what's happening there, and then you can start offering valuable advice.
• 18:56
  But even from the negotiation phase, you can actually start by sharing things from your expertise which are similar to them. Usually the pain points are the same industry by industry. If you know the pain points from a customer, let's say, in the financial sector or in the insurance space, the brokerage space, it's the same pain points the others have in that area as well. So you can start sharing by Hey, I saw this pain point. Do you have the same issue?
• 19:29
  Usually, yes, they do. This is when you actually start capitalizing. But listen, take notes, and only then start providing valuable and insightful advice. Not things like I believe that. No, I know that because here is my experience.
• 19:48
  And this is how you provide value. So this is how build the relationship. They should know the fact that they can contact you, when they can contact you, and very important discipline. When you promise something, do it. Do it by the deadline that you promised to do it by.
• 20:07
  If you miss the deadline, because sometimes it happens, tell them practically: Hey, I'm missing the deadline, because ABC. And then you find a solution. But work is just like any relationship, you need to work on both ways.
• 20:22
  Dejan Kosutic: Yeah, especially if you actually show as a reliable consultant so that you are doing things on time, that you actually provide them with good advice and on top of this if you actually their expectations then they really start trusting you, right?
• 20:41
  Tudor Galos: Exactly, exactly, very important this.
• 20:44
  Dejan Kosutic: Okay, so how important is really for consultants to find a niche, really to be specialized, let's say in one type of a service or let's say one type of industry.
• 20:58
  Tudor Galos: Yes, it's very important because you need to be perceived as a subject matter expert on something. Then you can develop new competencies, but you need to start with something where you need to dominate that niche. I've been in March or February, I think, to a training led by a really professional sales consultant from The United States. He said that everybody should have as a mindset total global niche domination. Even if you're small, you need to think that you need to dominate that market and your niche and you need to act as the one dominating the markets.
• 21:48
  Because this is also about your attitude. If you're perceived as a subject matter expert, you cannot be an expert on everything. Having expertise on something else, yes, it's important, but you need to be perceived as the guy, the GDPR guy or lady, I don't know, Dora guy or lady. There is a lady in The UK, a really great consultant, an amazing lady, and she brands herself, and not only herself but her customers as well, as the data classification guru. It's so niched because if you think about data classification, it's such a niche in the area of data governance.
• 22:33
  She's an expert on that. But you know that if you need a data classification expert, you know where to go. This is important. Sometimes we want to do everything and we don't do nothing. No, be really good in your niche, in your specific thing, in your area.
• 22:51
  Excel on that. Be perceived as the expert, and then you can try new things which are highly connected to that one. It's like we did with the GDPR. We started with data protection. From data protection we can easily move to data governance, because without data governance you don't have actual protection, and to AI governance, because now everybody is adopting AI and more or less they are breaching GDPR.
• 23:14
  They are highly connected.
• 23:16
  Dejan Kosutic: Okay, and if you actually specialize in a niche, doesn't it actually limit your opportunities in the market? Aren't you then throwing away some other potential work?
• 23:28
  Tudor Galos: Of course, but sometimes, and this is really important, you need to learn to let go. Not every opportunity is your opportunity. Some opportunities are meant for others. I know it's hard to think like this: you want to make money from everything, but you can't. You need to focus on something, be an expert in that area and maximize your gains in that area.
• 23:52
  Yes, something will be left for others. You also need other experts because if you're in a bigger project you won't be able to do everything by yourself. The customer will be the one asking, I need you to help me with some experts. And then you need to actually bring the others in the game, the ones that you trust as an expert, bring them in the game, create a powerful team and deliver customer. Because how you deliver is the most important thing that you do.
• 24:20
  So not only you don't need to sell in every niche, but you need to know the experts from every niche so you can work with them in bigger projects.
• 24:29
  Dejan Kosutic: And collaborate and actually invite them to work together, right?
• 24:33
  Tudor Galos: Exactly. Okay, great. Be partners.
• 24:35
  Dejan Kosutic: Yep, yep. Okay, you mentioned that you're actually focusing not only on GDPR but also on AI governance, so how did you actually decide to add this to your offering and why specifically AI governance itself?
• 24:54
  Tudor Galos: It happened actually way before I started my entrepreneurship role. As a student I worked in some artificial intelligence projects, paper based, intelligence research, mathematical research, statistical research. Then I went into Microsoft and, of course, less AI, and then I started entrepreneurship and really started again rediscovering artificial intelligence and what it can do. AI came as a first impact, having a huge impact on data protection with the Cambridge Analytica case, because this is how they use AI. They use AI as a weapon.
• 25:36
  This is when I started doing more and more research. Then more AI based projects started to come. Pattern identification, facial recognition, fraud detection, and many other projects which had a GDPR perspective, or a data protection perspective. So I said, Okay, this is interesting, but more needs to be done. Then CzechGPT appeared, and the game changed.
• 26:03
  Everybody started using this. I mean, the democratization of the large language models became an issue because nobody realizes, hey, it's not on my computer. It's in the cloud, it's at some company which doesn't have the best agreements for me as a user, so they might use my data as well. And of course, ChatGPT started to be adopted in companies, and secret information started to leak, and people started uploading very secret information and personal data, breaching GDPR. So, okay, I said it's time to do something.
• 26:40
  This is how I learned that AI governance was already a thing, and people were starting actually, consultants started working on the principles of AI governance and working on the artificial intelligence Act. So I started learning. Then I got a certification from Masters University in December on AI Trust and Privacy Officer, and this is how officially the AI governance consultant see begun. But in the background there are lots of years in terms of research and papers read and situations, and of course consultancy already provided to customers related to data protection in
• 27:19
  Dejan Kosutic: And do you see this area, I would say, of AI governance and this transformation is very interesting. And do you see that the biggest opportunity there for consultants are with the European AI Act or ISO 42,001, the AI standard, or something else? What do you see there as an opportunity?
• 27:42
  Tudor Galos: I think that a good AI consultant needs to understand that there are hundreds of laws and standards related to AI. Starting from the data management, data quality, data governance, data linearity, starting to actually prepare the data sets for the learning process, eliminating biases and things like this. EUAX is just a small piece, because usually if you are developing a new product or AI based service, you need to think it won't have the classical borders between countries, or EU and The US. It will be a global product. So you need to make sure that you'll be abiding by all the legislations in the world, which are a few hundreds.
• 28:37
  Luckily, they are all based on OECD principles related to AI, including the definition. So if you're becoming, let's say, compliant to EUA Act, you'll be compliant to seventy-eighty percent of the current legislation related to AI in the world. The standards are also really important. You need to actually understand where you're starting from. You have risk management standards,
• 29:01
  you have GDPR, you have information security, you have personal identifiable information, then you have standards related to data privacy by default, for example, which is also a new standard on ISO. So you need to work through a lot of standards. You can only do this by doing your own research and working with other consultants, attending webinars or advisor at once, of course. Actually, you know, keep in the game. But there is no, let's say, in GDPR or in data protection, GDPR is a lighthouse.
• 29:38
  It's called the Brussels Effect. It affected everybody. But EUA Act came quite late in the game. You have legislation in Singapore, in The UK, in The US, and the OECD principles. Moreover, these days, the European Commission is taking into consideration to postpone the EUA Act fines, rendering EUA Act unusable.
• 30:00
  But people need to understand that EUA Act is just a product legislation while GDPR still remains. I mean, the GDPR principles, which have an impact in EUA Act, will still remain. I mean, still you need to do AI governance, not necessarily with EUA Act.
• 30:16
  Dejan Kosutic: And when you think about, let's say, in some larger terms, would you say that this, let's say, opportunity for AI consulting is bigger when compared to, let's say, privacy or cybersecurity consulting, or smaller? What do you think in the next couple of years will happen with this AI consulting?
• 30:34
  Tudor Galos: It should be bigger because it's not developed yet. Not only it's not developed, I mean we don't even see the boundaries yet. We don't know what AI consultancy roles would appear. Just think about the new role of CEO, Chief Empathy Officer. You need to understand actually how to be empathic, because this is the main difference between humans and machines.
• 31:02
  Empathy cannot be mathematically modeled. So, AI algorithms don't understand empathy, they don't understand what's right, what's wrong. They understand mathematics. Behind every AI algorithm, it's pure mathematical statistics, in one way or another. So, you cannot model things like ethics, like biases, like discrimination.
• 31:23
  This is where humans are. So we will have consultants related to AI training, and training, removing biases from trainings, data sets, monitoring behavior. By the way, speaking of EUAX, if you have a major AI incident, you need to be able to know what to do within a very short time frame, like seventy two or forty eight hours in some cases, one week in other cases, but just imagine that your beautiful chatbot, in which you invested a lot, starts to spit out really ugly things. Suddenly, you need to respond within minutes. It's not days, it's minutes.
• 32:00
  And you need to have specific service level agreements and processes and procedures which are rehearsed. Because just look at what happened during COVID, when everybody started rediscovering you know, what backups are, what disaster recovery is, what continuous operations are, but they never rehearsed them. So suddenly they were, you know, rediscovering the will because they never rehearsed those issues. So in this case you have minutes to respond to an incident, minutes or let's say maximum hours. If you don't have the right processes and procedures into place, have zero chance of doing
• 32:42
  Dejan Kosutic: Yes, in any case a huge opportunity for consultants in this area. Now, it seems to me that you actually made an innovation in this consulting business by kind of merging this consultancy for GDPR for privacy and with AI. And what would you say, what would you recommend actually to other consultants? Should they also explore and create a kind of new offerings that do not exist in markets? And if yes, how actually to approach this, I would say, innovation in consultancy?
• 33:15
  Tudor Galos: Well, it's finding actually what are the connections, because it doesn't need to be AI, it can be data governance. In the data governance space you have a lot of opportunities, starting, as I said, from data cleaning, which is a huge issue, especially now that the data that is being generated is really poor quality, especially the AI generated one. You need to have actually metadata management, because it's a huge issue now with metadata and labeling and automatic labeling. You have, of course, data privacy. But then you have the AI thing, which is huge at this point.
• 33:56
  As I said, there are many niche things that you'll be able to do in the future related to AI, such as retraining the algorithm, Explainability AI is also a new niche in AI, where basically you have the means, procedures, and also algorithms to be able to explain what happened in the dark space of the neural network. Usually it's a black box and nobody knows why the algorithm is taking bad decisions at some point. Well, the EUA Act and all the other legislations are asking you to discover what happened and to be able to explain it and make sure it doesn't happen again. Have so many opportunities. You just need to decide the ones that be employed by, that somebody will pay for, and that you love as well.
• 34:46
  You can't go into something that you don't like or love and just be forced to work with it, because it won't fly.
• 34:53
  Dejan Kosutic: Especially if you connect this to your niche, right, if you have a specific niche and then you connect actually a couple of these things together and then you have a very unique offering in the market, so it's probably the best way. Now, when you actually go with, let's say, a new service offering or let's say a new product as a consultant, how do you determine the price?
• 35:16
  Tudor Galos: It's a very good question and it's a question to which you answer very difficult. You know, the definition is that the price is the highest cost that the customer would be able to pay you for a specific product or price. That's the right price. Otherwise, it's very difficult because, especially now with the globalization, you compete with consultants from all over the world. Of course, you need to dominate your niche or your country or your geographical area, but it's quite tough.
• 35:51
  There will be always somebody who will be cheaper than you and more expensive than you. I don't think that you need to position yourself as a cheap consultant because you'll never be able to get out from that position. You need to price yourself according to your expertise, to your trainings, and to your certifications as well. Because these days, the consultancy market is also shifting to the boutique consulting market, which is a movement that I estimated it would happen at some point. Now it's actually happening.
• 36:32
  Because many big four companies simply don't understand what's happening in the world anymore. They have their top consultants who are really experts, really good paid, but who are filled with projects. So many of their projects are being outsourced or cascaded down to entry level consultants. That's a quality issue. This is why many companies start to rediscover the beauty of working with boutique consulting companies, many of them by former ex big force, established by ex big force, who are now working as independent consultants and who know how to give specific advice related to one matter or another.
• 37:16
  But many companies start to rediscover this. This is also changing the purchasing habits of enterprises. We discussed earlier about enterprises and the fact that, yes, they do prefer big force at this point, but things are starting. You see a change in the market. I've been discussing with other consultants as well and it's time to actually accelerate this change as well.
• 37:45
  Dejan Kosutic: Okay, how do you see actually consulting business in let's say five to ten years? I mean, lots of people are now using Chegg GPT to consult them, right? To actually ask any questions. So from that perspective, what do you see will be the role of consultants in five to ten years from now?
• 38:02
  Tudor Galos: It's a very good question. It's about the perception and it's very difficult because this is up to us, to the consultants, to provide value. Sadly, of course, there are many imposters in our areas as well. Everybody now, for example, is AI without any certification or expertise. Several years ago, everybody was GDPR.
• 38:23
  I had bodyguard companies actually offering GDPR services, saying that it's about protection, so I can beat you then give you GDPR. It was a madness. We see these days as well. I think it's rightful for many customers to turn to something that they know and that responds to them. It's CHED GPT.
• 38:45
  Moreover, the bigger the scenario in which CHED GPT is used in consumer, mainly in the first six months of this year, in fact, and this is unbelievable, in fact therapy. So they are using CHRGPT for therapy. It's very dangerous because therapy is in fact something in which you need a different opinion, not an echo box. Box. Charge GPT acts as an echo box.
• 39:17
  They are giving you exactly when you're asking for advice related to something, they are giving you an answer. The answer suits you. But the therapist doesn't give you the advice that you want to hear, it gives you the advice that you need. And it's exactly the same with consultants. Consultants don't need to agree with you.
• 39:35
  They need to give you the advice that you need, not the advice that you want to hear. Okay? And this is the problem with CHGPT. It gives you the advice based on your it's a again, it's a mathematical output. It's a statistical output.
• 39:49
  Sounds good. It's not necessarily right. It's not even necessarily correct. And it lies a lot. We know this already.
• 39:58
  So be very careful when you ask for CHET GPT advice, because sometimes it can nail it if you use the right parameters and you need to make sure and you limit the output and things like this, you can play with it and give you some good advice related to a specific issue, a small issue, but it can't give you a specific strategy advice or strategical advice, something which is valuable in the long term, because they don't have the experience. They just read a lot of content, they are giving a mathematical response which suits the algorithm, which you want to hear, but it's not the advice that you need.
• 40:33
  Dejan Kosutic: And especially using this special insight that the machines do not have, right? This is also something that consultants actually what distinguishes consultants from machines, right?
• 40:49
  Tudor Galos: Exactly!
• 40:51
  Dejan Kosutic: And regarding your consultancy, are you actually afraid if you will be able to stay in the business? I mean the competition is tougher and tougher, okay, AI is also taking its part, so what do you see for your consultancy and how do you actually plan to stay in business?
• 41:12
  Tudor Galos: I think I still can I have a lot of jet fuel under my wings? So, it's still going, it's going quite well. I love competition. I wish I had more competition, to be honest with you, in the data protection space. I don't see that we are enough.
• 41:32
  We should be at least three or four times bigger in terms of data protection consultants. We are not enough. It's a huge opportunity here, so I welcome any specialist in this area. In AI it's even worse, we don't have specialists. We just have a few who are employed and who are working on big projects.
• 41:54
  I think the opportunity is still to be there. The market is clearly growing, and the number of consultants is still low for how big the opportunity is. I think the tough thing at this point is not actually the competition, but it's actually growing the market, making people understand that they need to invest in consultancy in this area.
• 42:17
  Dejan Kosutic: Okay, great. Good. So let's try to wrap up the call. So what would be, let's say, your top kind of suggestions for beginner consultants or established consultants? What would you suggest to them?
• 42:35
  Tudor Galos: Well, first of all, learn to promote yourself. Do good websites, which is already have a great photoshooting. You need to position yourself as a top consultant so you need to have a really good professional photoshooting taking place. You would always have photos for your website, for social media, also for the press will be asking you. If you are a really good expert, the press will contact you to offer opinions related to different topics and you need to have your photo and bio ready.
• 43:07
  Then actually start offering something valuable for your customers, something that others don't offer. And don't be afraid to offer it for free. The reward will come later. Offer it, see how many meetings and doors are opened, and then just do the follow-up. Once the door is open, the deal is half done.
• 43:29
  Open the door, make sure you have a minimum full conversation, make sure you are perceived as a top expert, and then actually start doing the follow-up. And of course consistency in offering quality. Consistency is super important. Yes, you might have at some point customers who are not happy with your work maybe you did a mistake maybe they did a mistake but don't how should I say make sure you you control the narrative what they're saying about you in the market and how you can address those issues And of course have fun, love what you do, don't just do it for the money. The money is just a means that money come and go.
• 44:12
  The most important asset that the consultant has is time. Time only goes one way. Money come and go, time only goes one way.
• 44:22
  Dejan Kosutic: Great! I really like this advice. And thanks for this insight, Tudor, it's been a pleasure talking to you.
• 44:30
  Tudor Galos: Thank you very much for having me me here.
• 44:32
  Dejan Kosutic: Thanks again. Thanks everyone for listening on or watching this podcast and see you again in two weeks time in our new episode of Secure and Simple podcast. Thanks for making it this far in today's episode of Secure and Simple podcast. Here's some, useful info for consultants and other professionals who do cybersecurity governance and compliance for a living. On Advisor website, can check out various tools that can help your business.
• 45:00
  For example Conformio software enables you to streamline and scale ISO 27,001 implementation and maintenance for your clients. The white label documentation toolkits for NIS2, DORA, ISO 27,001 and other ISO standards enable you to create all the required documents for your clients. Accredited Lead auditor and Lead implementer courses for various standards and frameworks enable you to show your expertise to potential clients. And a learning management system called Company Training Academy with numerous videos for NIS2, DORA, ISO 27,001 and other frameworks enable you to organize training and awareness programs for your clients workforce. Check out the links in the description below for more information.
• 45:48
  If you like this podcast, give it a thumbs up. It helps us with better ranking and I would also appreciate if you share it your colleagues. That's it for today. Stay safe.