Latest / You've Been Heard / 423- There Is A Cost To Know Things w/Steve Goudreau

Transcript

423- There Is A Cost To Know Things w/Steve Goudreau · You've Been Heard

• 0:09
  Speaker A: All right, well, welcome everyone back to. You've been heard. We are talking with Steve Goudreau today. So, Mr. Goodreau, I guess this is more advice of how do you go about finding a job in it, right? When you go to look for a job, do you look for a place where you can go in and you're like, oh man, this is going to be so easy to impress these guys and it's going to be really awesome. And they're open to technologies as a business force multiplier and we're really going to be able to make a big change. Or you're going to go somewhere that's like super technology heavy, where like everyone in the organization is kind of already an IT genius themselves. And the predecessor had built everything. How do you go about doing that?
• 0:52
  Speaker B: Well, I mean, obviously there's, there's pros and cons to each, right? And in my current position, I didn't come in knowing what I knew. You'll never know the complete state of the department until you're there for a couple months anyways. But I go into looking for a place to where I can have that personal relationship with leadership. I think that's the most important. I mean, as much as I'd like to come in and be that network hero who comes in and writes the ship, I want to be that person who can make that difference to where maybe the previous IT director couldn't move certain projects forward, couldn't articulate the need for an MBR or couldn't articulate the need to change how they're doing, reporting or things of that nature. It's going to be what the appetite of the organization is for change. And it is change. And as long as that organization isn't resistant to change, I think that's the biggest things that when I evaluate a prospective employer is the difference you can have is going to be proportional to the amount of resistance the organization has to change.
• 1:58
  Speaker A: So the old school IT leader or the old school mentality, which we've alluded to a bit, is maybe I've been in the IT role forever, since the invention of the dot matrix printer. And I came in right after punch cards and we were putting network cards in. That's how long I've been in the company, right? And I speak a level of nerd that makes people want not to get on the elevator with me alone. And I only say that because my father in law, like when he worked at Conagro, like they used the IT guys just come in, people would joke around like don't get on the elevator alone with him. And so you have that person that is essentially trusted and maybe sitting at the executive roundtable and then you have. And they've been there for so long and maybe it's nice that they've made their career out of it. And then you come along and I guess the difference is how much nicer is it to be heard and actually heard by executive management and have that relationship versus just be the guy that speaks and everything kind of goes over their head. And what do you do to be heard? If you're looking for a job that has that relationship, what do you do to create that so that they actually listen to you and would approve? I don't know. We need to put money in for managed detection and response or whatever. Endpoint detection response, whatever it is, Security.
• 3:22
  Speaker B: Yeah, that's a great question. Because what works? And what I found out, what works at one organization is not going to work at another organization.
• 3:32
  Speaker A: Are you saying communication wise or.
• 3:33
  Speaker B: Yeah, communication wise. Like where I'm currently at ice, I have a seat at the roundtable, if you will, at Midway. Even though I had five times as many people reporting to me, I did not have a seat at that roundtable. They had five directors and they would not have a director of IT there. They had an IT manager. I ran the largest department that wasn't headed by a director. And when we'd have our monthly management meetings and ops calls. When I first started there, the slides I was presenting from the previous head of IT was basically help desk metrics. And I said, well, I don't think this really encapsulates all that it is doing. And so they let me kind of freestyle. So I took it from two slides to eight slides and after about four months they're like, yeah, that's just too many slides. It wasn't the content. I was taking up too much time in the meeting. So trying to find the level of information that was germane to the people in that room was different than giving them a level information time wise that they wanted. So like I was trying to make a big push on the OT security side, having them understand that. But that's not something they necessarily want to report it out in the monthly management meetings. Whereas where I'm at now, there's a bit of, I think all in it, the fear of missing out. Right. Like with AI people like, well, we have to do something to say we don't want to be the last company to that dance. I'm like, well, making a bad Decision is worse than making no decision. Nobody can possibly know every AI company out there and what would be helpful to your organization. And you'd be crazy just to blindly be throwing darts at a board hoping you're finding the right solution without asking those questions of the organization first. What's our goal with AI? Is everything just about roi? Is it not just about improving efficiencies? What are we trying to get out of that? And I think some organizations are open to hearing those questions where I think other organizations just want to see product on the board and you keeping up with technology
• 5:40
  Speaker A: two things that are really, really important here. The AI thing we have to table for a second because that's deep actually. But what's also deep is what do you put on two PowerPoint deck slides in a management meeting? Is it like what we're paying now, what we will be paying tomorrow? Is that the two slides or is it how we got screwed by a ransomware attack, why we're not going to get screwed tomorrow and why you should write this check. I mean it's actually like a pretty profound point which is I used to think five slides was the maximum, right? It should be two slides now and should use AI to write those two slides. But it's like it presentations to the board should be two slides. That's how you get heard. What's on them. Most IoT leaders don't need more technology, they need less noise. Over the years infrastructure quietly gets complicated. Multiple locations, multiple Internet providers, different contracts, separate bills and reactive support. Nobody plans that that way, it just happens. What we do is vendor neutral advisory. That means we don't sell platforms or force change. We start with low friction areas. Internet telecom, Microsoft licensing. Places where complexity builds quietly and and can usually be cleaned up without disruption or capex. Sometimes we find savings, sometimes we find nothing. Either way the outcome is the same. More clarity, less distraction and it that's boring in the best way possible. If you want a second set of eyes from people who sit on the buying side of enterprise infrastructure every day, just go to you've beenherd.com and answer the questions to simplify, streamline and save.
• 7:28
  Speaker B: Yeah. So you want the information you're presenting to move the company forward. Right. If you're presenting your regular KPIs of this is how many tickets we open this how many tickets we closed. Here's our user awareness training statistics and here's how many threats are MDR caught? I mean that's operational information. How do you keep that conversation moving forward by just Presenting, like I say, static metrics, but metrics that are just point in time. I wanted them to understand projects that everybody was working on. So they knew the things we were doing with the ERP system. They knew what we were doing in OT security. They knew things we were looking at was HoloLens for engineer support and things of that nature. Because I think sometimes as you expose a broader group of leadership to these concepts, they start asking questions. And from those questions you can actually, that's how you move the conversation forward.
• 8:27
  Speaker A: Did they care about you reporting on all those projects?
• 8:31
  Speaker B: Some yes, some no.
• 8:33
  Speaker A: It's like showing someone a Kanban board. Look what we did. Yeah. And it seems like they need to know that information. But what I've found, and I've only found that because of what we've been doing with AI ourselves behind the scenes and rebuilding a CRM and realizing we don't need Salesforce anymore, we don't need a HubSpot, we can just build our own over the weekend. Which sounds crazy. And all my software dev friends laugh at me and they say, you're an idiot. But then the other half of the software dev guys say, those guys are in denial. And you're right. That's like a whole nother thing. What I've found is that I think the C suite really wants to see how is it making our vision come to fruition faster, better, richer? And what we want to say as IT leaders to them is we can do two projects at a time. We can't do 25. And which of these 25 projects can we delete that we'll never get to until 2040? And by then everything will have changed anyways, so we might as well just delete them now. Do you think that that's a true statement or am I out of line?
• 9:38
  Speaker B: No, no, I definitely think that's a big part of it. I mean, again, every organization is going to be a little bit different. When I worked for Arsenal Remittal, I mean, a Fortune 500 company, there was boilerplate templates and things that they wanted to see. Information, necessarily. But I'm still good friends with their director of it, who's now their vice president of IT there. So he got to sit back where the IT person should be sitting, having that conversation with the board of directors, if you will. But they saw the inherent value and information and business intelligence that they were doing with the ERP system and with the MES systems. I'm like, if you can become that hero in there saying, look, our OEs will go up by understanding the data that we have or that we don't have the data to make those decisions. Because that's one of the biggest driving forces to me behind AI is everybody's like, oh, AI can do all this great stuff. Do you have the data? Like, I have a couple different quality systems right now, disparate data around it. If we wanted to make better quality, grim decisions, I'm like, do I have the right information to make those decisions? I mean, you can say that's a management leadership trait all the way around. But AI without any relevant data behind it won't make any decisions that make any sense to you. And that's our biggest drive right now at my organization is as we develop our strategy. It's good to say that there's all these tools that do all these things, but if you don't have your HR data and your quality data and your production data and your shipping and materials data that can be ingested to help you make these decisions, I'm like, all the tools in the world aren't going to make a difference now.
• 11:24
  Speaker A: We have a good transition, the data cleaning side of the house and having like a really good, I guess, single source of truth for where all your data lies. The AI thing that's interesting to me, it's. What's interesting is everybody in a, like you said, like every CEO basically saying we're, I need an AI rollout plan on my desk by Monday. So we're not like behind the race. Right. But I'm wondering where, like I was talking about this the other day and yes, it was a data thing and like how do we use data and how can we analyze that data to do everything that you, basically everything you just said and make actual decisions that will make sense and move the company forward. But to me, and then like you said, there's a thousand AI products. If you're even thinking AI product, I think you're thinking wrong because I think that's the old mentality of someone, hey, we can build an app for that, we can build software for that. But it's really more. I think what would be more beneficial is AI training and training end users how to use AI to do their jobs better.
• 12:25
  Speaker B: I think, yeah, I've taken the initial strategy of having people a understand what basic concepts like prompt engineering, things of that. But coming as somebody who's deeply embedded in security is having people understand what happens when you put your data in a generative platform. It writes a great RFQ for me and I just throw it in chat GPT and it spits it out. I'm like are you paying for that chatgpt or is this personal one? Because it's ingesting that data and it's going to use that information you gave it to make other decisions and that makes your data public. And even if you're using a copilot or CLAUDE or something that it's. Even if it's not sharing that data with other organizations, it's using that data to train its large language models. So understanding how you're interacting with all the free versions and that little copilot on your, on your desktop, I think people have to understand the safeguards that need to be put in place around the data you share to have AI make decisions for you or create a presentation or clean up an RFQ or an rfp. I've been starting with security because I think that that's important before you start having the bigger conversations. So people just don't putting on cloud
• 13:45
  Speaker A: cowork and now it's sending emails and reading emails on your behalf and then you've got a whatever, it's not Claude bot. Now what have we got to change it to? Running multiple agents for you and reaching out to customers. Customers.
• 13:56
  Speaker B: Well the amount of requests I get in my admin 365 portal for people saying hey, I'm requesting Monday.com to have access to our organization to be able to read this, read that. I'm like well I'm going to pause that because now I have to take my own time out to look exactly the permissions it's asking for. And what are you trying to get out of this connector into Office365 into this third party application that A, we're not paying for. It's that shadow AI that scares me the most. I think there's been a problem throughout all of it is you have cost estimators who use a certain program to do other cost estimating. Right. I wasn't part, I mean it wasn't part of the setup. Whatever information there is, they created an account. It's totally separate from anything it has any purview over that person leaves the organization. I can't disable an account for a lot of third party applications that A, I don't know about or B have no access to. I'm like yeah, those are questions that for years weren't things you were asking. But now, especially with AI's ability to have his little spider webs into everything is well what other shadow AI is out there that our organization's been using and how do we make sure that the information, the data governance policies that we have are enforced and these things that everybody signs up for that you'll have no idea about?
• 15:19
  Speaker A: Well, good question. How do you do that?
• 15:22
  Speaker B: You create a policy. Yeah, I can create a policy saying all these things must be approved by it.
• 15:28
  Speaker A: I'm a big Alex Hormozi fan for some reason, and he was talking about it the other day and he's like, for all the people who are like, super paranoid, it's got to do this, it's got to do that. He's like, there's going to be a few bad outliers. He's like. But for the most part, it's like, any new technology, it's, you gotta use it and you gotta get past the like super paranoid point. And I'm thinking in my head right now, that's not gonna fly with a lot of IT guys and their end users out there. But there is a certain inevitability of, like you said, like, you can't really see anything. There's gonna be out of. I don't know, how many end users do you guys have? 200 plus or something or where?
• 16:03
  Speaker B: Yeah, like 250.
• 16:04
  Speaker A: I mean, out of 250 people, it's just a straight up 80 even. You get the 80, 20 rule, right? Maybe 20% of the people, like care about a policy and remember what they signed in hr, then it changed or like something like that. And then you've got the 80%, then you've got the real bottom, like 5% where you've got some disgruntled employee. You have, out of 200 employees, there's gotta be at least five. There's gotta be at least five super red flags. Don't give an absolute crap at all. Will click on anything, don't care, do whatever they want to get home at the end of the day. What we need is a program for sifting those guys out. How can we tell who's like, the most dangerous? We gotta use AI for that. So there's a certain level of like, inevitability. So I. Yeah, what do you do? I would love your answer on that. There's gonna be some security tool, I guess, and we have too many tools already.
• 16:54
  Speaker B: Arctic Wolf, the one thing I, I like about Arctic Wolf's user, we're in his training. Here we go.
• 16:59
  Speaker A: Okay.
• 16:59
  Speaker B: Yeah, it gives you, like your top. Like employee threats. Like, these are people failing quizzes, clicking on phishing tests, and it's doing Its behavior algorithm saying, these are the people you should focus on the most. And sometimes you'll get the pushback. Like, well, that person's a press operator. Only gets on that machine once a month. I'm like, but he's still interacting with the computer system. He needs to have these basic fundamentals down. I mean, the one phishing test that gets everybody, 70% of everybody, almost every organization I've been in, that you may have regular fishing festival.
• 17:34
  Speaker A: And I guess, yeah, guess is it approve your vacation time.
• 17:38
  Speaker B: It's anything HR related. So. Yes.
• 17:41
  Speaker A: Yeah. Do you know anything about statistics on how much ransomware people make? Like, do you know who it was?
• 17:47
  Speaker B: It was Russians. It was Russians. It was Ransomware Hub.
• 17:51
  Speaker A: Okay.
• 17:52
  Speaker B: Stryker is a medical device manufacturer and they had 10 petabytes of data storm. 10 petabytes. I'm like, how does that happen? What systems do they not have in place that flag 10 petabytes being exfilled from their servers or their cloud or whatever.
• 18:11
  Speaker A: How long would that take?
• 18:12
  Speaker B: First of all, the hacker came in through their China subsidiary. It looks like. Wow.
• 18:17
  Speaker A: They actually. It's all. It's so much healthcare. So much healthcare.
• 18:22
  Speaker B: Yeah. There's usually two, three times a year I'll get an email from one of my healthcare providers saying that we had a data breach back in this date. The law says we have to let you know, but we don't think you're personally affected. Yada yada.
• 18:34
  Speaker A: Yeah, I got one the other day. So it's. It's back to the AI thing. So if there was one thing that you needed C level executives to understand in here, one thing, what would that be? Loud and clear.
• 18:45
  Speaker B: It would be the same message that I think we all have is that treat it not as a cost center, but as a force multiplier, as a productivity enhancer. I mean, depending on the organization, some see it better than others. I'm lucky at some of the places I've worked where if we didn't start off that way, we ended that way. But I think that's the biggest message I would have. Technical debt will cost you a lot more later than it will by not doing upgrades, not looking at the latest technology. Things are gonna. It costs to have good security, it costs to have good productivity. It costs to stay ahead of a curve.
• 19:21
  Speaker A: That's a good point. How does tech debt cost us more later than now?
• 19:25
  Speaker B: Yeah, I guess making sure you're asking the right questions of your IT leaders and they can prove that you're not at risk simply because we've overlooked things or have deferred upgrades or haven't looked at certain technologies.
• 19:40
  Speaker A: That's actually a great question. We're going to use this from now on. What are some questions CEOs should be asking their technology leaders?
• 19:48
  Speaker B: Yeah, well, I mean, they should be asking at a bare minimum of where do we sit on our technology stack. And if you have the rights director, CIO VP who can put that in layman's terms of like, yeah, we have to be at Windows 11 because Windows 10 support ends at this date or we have to move to this newer version of the erp. We're going to move from Plex Classic to Plex, whatever their latest version is because there's no support on the old version. Yep. There's going to be training that has to happen, making sure that that CEO is getting the answers that they think they that will help them make those decisions. I mean, explain to me the tech stack. Explain to me where we are with our competitors, right? What is everybody else using? Why do we choose the technology we're using? Like, I love having those conversations. There's going to be times I'm like, well, it's what we could afford, but it met all the bare requirements. Right. And there's going to be times like, well, we need to spend more money to have this level of security. We need to have this, spend this more money to have these business intelligence tools. We need to spend money in training for our staff to make sure that we understand the tools we have or that they're going to the right conferences, attending the right webinars to make sure that we're being kept abreast of the latest technology. And then the CEO should be asking like, well beyond like, what is the benefit to the organization? And they often overlook, in my opinion. A lot of employees enjoy working with new technology. They want to be kept abreast of the latest things. And employee happiness, especially in it, I think goes a long way. If not, you end up with a stagnant workforce. Work just says, well, no new laptops this year, so we'll just make do. I've never had a problem being told no, but I'm going to ask all the time. I've had my hand slapped over camera projects and things like that in the past. But it's your job as an IT leader that the organization know what the organization needs. If there's not an appetite for it, that's fine. They will know where we stand on things. And I told my steering committee when I started, I formed an IT steering Committee with the cfo, director of finance, and the president. I said, we're going to meet weekly and you guys are going to know exactly where we stand on things. If there's not an appetite to do A, B or C, at least you're going to know that, A, it should be done or what the ramifications of not doing anything are.
• 22:19
  Speaker A: Yeah, it's good. What are some more things that we can do to get away from being labeled the department of IT as if it's this separate entity inside the company? Do we say the department of marketing or the department of Sales? I'm just like, this is one of the things that comes up a lot. People are like, we don't want to be referred to as the department of IT anymore when it is the thing that touches every aspect of the business. And there's not a single person that can do their job in any department at any level of the company with the exception without it touching it. Someone tried to argue one time that, oh, like, we repaved the parking lot. It wasn't involved on that. I was like, you better believe someone cut a PO for that. So it did touch it at some point.
• 22:58
  Speaker B: Yeah.
• 22:59
  Speaker A: And they forgot to trench the extra, like, conduit underneath the parking lot for the new fiber that needs to be put in the future someday. So it should have touched it.
• 23:08
  Speaker B: Why? The phrases I like to use is, especially when you're. When you're talking about researching new technologies, I'm like, there's a cost to know things. I mean, we always say there's. There's a cost to doing something, there's a cost to doing nothing. Right. If you take the stance that we're not going to do something this year, it's still going to cost in more labor into the IT department having to have more interactions with the endpoints because of the age of them. Right. And there's a cost to not investing in certain security tools. You could get ransomware. That's a big cost. But there's a cost to know. Like, we're going through our AI journey right now. I'm like, you have to engage other parties to find out what you don't know. And there's going to be training, webinars, seminars, engaging the right people. I'm like, if you're not willing to ever pay that cost to that cost of that knowledge or the cost to know, then you're going to end up in a spot where you have the right people. But they might not have. They might not have exposure to everything out There that leads them in new direction, leads the organization in new direction. I mean, AI is just the best example of that right now. I mean, I'm sure you've seen that Wolf of Wall street meme where Jordan Belfort Dan goes, sell me this pen. And the guy. And the new one is the guy says it has AI. Mike, I've given you the buzzwords. Now I can sell you this pen.
• 24:32
  Speaker A: I think that there's a cost to know things. Yeah, that's golden because you're going to pay a cost if you remain stagnant. You're going to pay a cost for not knowing things.
• 24:43
  Speaker B: Right. I mean, it's the otology. We don't know what we don't know or we know what we don't know. It's probably a better one.
• 24:50
  Speaker A: We know that we don't know. We know that we don't know. That was great. Was there anything that. We'll just end with this. Is there anything that you think in your career has led you to be successful in the leadership position that you're in? Is there anything that. Is there something that we'll leave this. Is there something that someone should go. No. Should go. Get the knowledge to know that has brought you to where you're at?
• 25:12
  Speaker B: Yeah, but it's not technology to me, it's those soft skills that make all the difference and the people you have around you as a mentoree. I wouldn't be where I'm at without the Rob Horwoods, without the Dickoffs, without the Jason Lamberts and the Steve Galloways of the world and the Larry Dragons, people that you looked up to or people you had working relationships. I mean, I've learned stuff, more stuff from bad leaders, to be honest with you, of like, oh, that's not the way to handle it. I'm not going to do. I don't want to be like that. And goodly, I would love your best example. I've got a good one. I had a manager once. I am notorious for coming into work early. That's my old military in me. And I would be into work usually about 45 minutes early. We had an employee, a coworker of mine, that struggled to show up to work on time and she didn't want me filling out my timesheet saying that I got there at 6:15 if I wasn't supposed to be there till 7 because this other person was struck. It just, it looked. I said, yeah, but I'm not charging for that time, but I'm here the next day after. She Got on me about that. I showed up at like 6:55. And she's like, is everything all right? I'm like, what's the matter? She goes, well, I noticed you were late today. I'm like, late. I said, I'm still five minutes early. She goes, well, yeah, you're only at 6:15. I said, you just told me not to be here that early because it looks bad. And she's like, well, no, just don't put it on your time card. I'm like, well, I'm not doing that. I'm like, it's either one or the other. I'm like, you're trying to fix the wrong problem here. And the people who know know exactly what I'm talking about. We've all worked with a manager more concerned about the things that make no difference in the world than the ones that do. And there's a great phrase of, nothing will frustrate a good worker than watch you tolerate a bad one. And that's a lesson I've learned in leadership from bad leadership.
• 27:14
  Speaker A: Yeah. I learned you definitely don't want to waste time on all your C players. You really want to spend time on your A players because they're the ones that are going to make the biggest difference. And spending money on one really good person rather than five average people makes a massive difference.
• 27:36
  Speaker B: It does.
• 27:36
  Speaker A: It really makes a huge difference. Yeah. Even paying, like, I also noticed that hiring the absolute best in the industry, even though that price might be. I can literally tell you I used to try to do something for, like, the one job I was trying to do for 2,500 multiple times in a row, and $5,000 here and there. Never got the job done for three years. Then I decided, oh, I'll pay $100,000 for that job. As very scary and very apprehensive as I was, I did. So what is that percentage difference?
• 28:15
  Speaker B: That's a lot.
• 28:17
  Speaker A: Yeah, it's like, wow, what is that? A hundred thousand divided by. I should be able to do this math. Isn't it like a decimal point or something like that?
• 28:24
  Speaker B: It's.
• 28:25
  Speaker A: Yeah, let's see, 1,000% or 400% more, whatever that is.
• 28:29
  Speaker B: Is that right?
• 28:30
  Speaker A: It's ridiculous. And what happened was I had been going for three years trying to do the same project. Fail, fail, fail, fail, fail. 2,500 here, 5,000 there, 6,000 there. Fiverr guy. This guy. Because you're trying to do something and then pay the hundred thousand guy. Took three months doing nothing, as far as I could tell. But what he was doing was listening to every podcast, digesting every episode, taking all of the text, listening to all the IT guys, looking at all the competition. Right. And then what he came back was. What he came back with was like, okay, I'm ready, Phil. You ready for what we're going to do today? Yeah. Your podcast is going to be called you've been hurt. Why? Because every guy that's been in IT has had a seat at the executive roundtable and worked for years to get there. And being there is great and everything, but how much better would it be if the IT guy could actually be heard and understood? And, like, I think so many IT guys have been almost brought to tears when I say that to them. They're like, that's it, man. They're like, that's it. They're like, that's it. We know the firefights, we know the late nights. We know the servers, we know the ransomware attacks. We know that when everything's on fire and everything's breaking, it is the most valuable department in the industry. But when everything's working like a well oiled Tesla and everything's smooth and nothing's going on and nothing's wrong, we're a cost center. Yep. We were just like, whoa, man. Like, that's what. Someone that really knows how to, like, break things down and is a really. A professional in there. I don't know, whatever, lane, whatever you want to call it. There's just a big difference between a really good employee and five stale ones.
• 30:23
  Speaker B: I agree.
• 30:24
  Speaker A: Mr. Goudreau, it has been a pleasure talking with you today, having you on the podcast, and you've been heard.
• 30:31
  Speaker B: Pleasure as always.
• 30:32
  Speaker A: Have a great day.
• 30:33
  Speaker B: All right, we'll talk at you.
• 30:34
  Speaker A: Yeah, man. Take care.
• 30:36
  Speaker B: Bye.