Latest / The Bridge To Tomorrow's Talent Podcast / Ep. 17 Beyond the Firewall: Cybersecurity, AI, and the Future of the Workforce

Transcript

Ep. 17 Beyond the Firewall: Cybersecurity, AI, and the Future of the Workforce · The Bridge To Tomorrow's Talent Podcast

• 0:12
  SPEAKER_00: Good morning or good afternoon, and thanks for joining us whenever and wherever you are.
• 0:16
  SPEAKER_00: My name is Zachary Hill, and I'm your host on The Bridge to Tomorrow's Talent, a podcast where we talk about the work-based learning efforts going on in the workforce right now, the future of the workforce, how to start great careers, and what really makes the real world of work tick.
• 0:31
  SPEAKER_00: Today we're joined by Kane McGladry, a virtual independent CISO and the author of Cyber Risk is a Myth: a Business Approach to Integrated Risk Management.
• 0:42
  SPEAKER_00: Kane, thanks so much for joining us today.
• 0:44
  SPEAKER_00: I really appreciate having you here.
• 0:46
  SPEAKER_00: But for the uninitiated, maybe like myself, can you tell folks what a CISO is and what exactly it is that they do for businesses?
• 0:53
  SPEAKER_01: Yeah, thanks for having me on the show today, Zach.
• 0:55
  SPEAKER_01: So a CISO is a chief information security officer, and their main responsibility is at the strategy layer of figuring out how a business or an organization, an entity, let's say, is going to address uh cybersecurity uh at a technology layer, but they're not the person who installs the firewall.
• 1:18
  SPEAKER_01: They're not the person who operates the firewall, they're not the person who says, well, we need a better antivirus.
• 1:25
  SPEAKER_01: They're working at a higher strategic level where they're trying to say, over the next three to five years, what do we need to do as a business and who needs to do what?
• 1:36
  SPEAKER_01: Um, in order to both reduce technical risks to the business, but also to be able to demonstrate to attorneys, to insurance investigators, to uh if you ever get called up on Capitol Hill, that is a bad time.
• 1:52
  SPEAKER_01: Uh, but to be able to demonstrate that you were doing the best you could do based on the information you had, and you can defensively prove you didn't make something up as you were going along.
• 2:02
  SPEAKER_01: Where CISOs tend to get into trouble is where the uh business does not think that's what CISOs do, or alternatively, where they're making stuff on the stuff up on the fly.
• 2:12
  SPEAKER_00: Gotcha.
• 2:12
  SPEAKER_00: Okay, so managing kind of that long-term planning around cyber risk and cybersecurity, which we'll get into that term in a little bit, and also that kind of uh, you know, contingency planning, I guess, for if something happens to make sure that you've done your due diligence in the background.
• 2:28
  SPEAKER_01: Yes, yes.
• 2:29
  SPEAKER_01: And you will hear other variants of the uh definition of what a CISO does or a CISO, what we do.
• 2:34
  SPEAKER_01: Um, mine is not canonical.
• 2:36
  SPEAKER_01: Mine's the one that I subscribe to.
• 2:38
  SPEAKER_01: There are other definitions out there that say, hey, if you can write Python code, configure the firewall, multi-manage a multi-million dollar business, talk to the board, and want to make$20 an hour, you could be a CISO.
• 2:49
  SPEAKER_01: I have seen that on LinkedIn as a job posting.
• 2:53
  SPEAKER_01: There are a variety of spectrums of idea about what CISOs do.
• 2:57
  SPEAKER_01: Not all of them are real.
• 2:59
  SPEAKER_00: That makes sense.
• 3:00
  SPEAKER_00: Yeah, those those jobs looking for somebody to do it all, right?
• 3:03
  SPEAKER_00: Yeah.
• 3:03
  SPEAKER_00: Yeah.
• 3:04
  SPEAKER_00: Yeah.
• 3:04
  SPEAKER_00: Now, when we were planning for this, and and uh you've described yourself to me as a theater kid or a former theater kid, uh, which is probably not the origin story I think most folks expect from a cybersecurity leader.
• 3:17
  SPEAKER_00: Uh so how did that path begin?
• 3:19
  SPEAKER_00: And how did you get from there to where you are today?
• 3:22
  SPEAKER_01: So that's a great question, uh, Zach.
• 3:24
  SPEAKER_01: And I'd say the the short of it is I was what, 18, I guess?
• 3:29
  SPEAKER_01: Let's say I was 18.
• 3:30
  SPEAKER_01: I remember being 18 at some point.
• 3:32
  SPEAKER_01: And I was in the first uh semester of college taking theater classes.
• 3:39
  SPEAKER_01: And you know, you've heard the analogy of do what you love and you'll never work a day in your life.
• 3:43
  SPEAKER_01: And it turns out you'll also never be able to pay your bills.
• 3:45
  SPEAKER_01: And that was what hit me is that rent wasn't just the name of a musical.
• 3:49
  SPEAKER_01: It was actually something you had to pay.
• 3:51
  SPEAKER_01: And I realized that I could have a very rewarding career failing to get on Broadway and washing dishes or waiting at a restaurant or tending bar, or I could do something else and maybe just set aside the idea of, hey, this is the thing that I love doing.
• 4:06
  SPEAKER_01: Maybe I'll find my uh way to make money in a different way.
• 4:10
  SPEAKER_01: Theater gives us a lot of improvisational skills.
• 4:12
  SPEAKER_01: It also gives you a uh a startling degree of um public confidence and self-doubt at all times.
• 4:20
  SPEAKER_01: And both of those are key attributes in cybersecurity, that imposter syndrome that we you may have heard of.
• 4:25
  SPEAKER_01: Um, I just had the right blend.
• 4:27
  SPEAKER_01: And so when I went to a consulting company doing federal consulting, I can't say which government agency we were working with, um, they offered to pay me half the market rate with my lack of education and my willingness to learn and my willingness to make stuff up on the fly.
• 4:41
  SPEAKER_01: And it turns out that um consulting, and especially in security consulting, this is 30 years ago, uh, it's about being two steps ahead of where your customer is, not necessarily knowing everything.
• 4:52
  SPEAKER_01: It's about being able to look stuff up very quickly and then to be able to say that with confidence.
• 4:58
  SPEAKER_01: And again, these are all things that we learn in theater.
• 5:00
  SPEAKER_01: You learn your lines and then you can repeat your lines, and if you need, you can ad lib if the other person isn't quite tracking.
• 5:06
  SPEAKER_01: Um, it's not your typical cybersecurity origin story, but that's what I got.
• 5:12
  SPEAKER_01: That's what I've done in the intervening years.
• 5:14
  SPEAKER_01: Uh, I've done executive advisory on three continents in more languages than I've forgotten.
• 5:20
  SPEAKER_01: Um, I remember trying to learn Icelandic, and uh that was a hard one.
• 5:25
  SPEAKER_01: Um, but I remember doing, you know, consulting down in Mexico or in Sao Paulo, Brazil, uh, working through basically the same problems I've seen everywhere in cybersecurity.
• 5:35
  SPEAKER_01: The businesses are still struggling with today.
• 5:38
  SPEAKER_01: I don't think the problems have really, you know, you'll hear vendors say that the problems have changed or that AI is exacerbating things, or that you need this new certification or education or thingamajig or this widget.
• 5:51
  SPEAKER_01: And often that's not true.
• 5:52
  SPEAKER_01: Often things come down to some very core basic uh fundamentals that we can talk about.
• 5:58
  SPEAKER_00: And you said at the beginning of that, you said that theater gave you the like public confidence, but also the self-doubt that you thought might be needed to be successful in cyber.
• 6:08
  SPEAKER_00: How do you how do those two go together?
• 6:11
  SPEAKER_01: Uh so they just seem to be a unique phenomenon among cybersecurity people and actors, because I've met a lot of actors and all of them privately think they're just bombing their lines and it's going to be a terrible day.
• 6:21
  SPEAKER_01: And most people who are in cybersecurity can publicly put on a smile.
• 6:25
  SPEAKER_01: Um, but whether you're manning the firewall or whether you're presenting to the board, you usually think, yeah, I'm probably missing something, and this next data breach is going to be my fault.
• 6:35
  SPEAKER_01: Uh, it is endemic if you go to uh major cybersecurity conferences like Black Hat, I'll be there this year, uh, down in Las Vegas, or you go to any B-sides, there are there are dedicated sessions to dealing with the imposter syndrome.
• 6:48
  SPEAKER_01: Um this is just a normal mental behavior among my people.
• 6:52
  SPEAKER_01: Uh, I won't say that it's it's great to live with, but you know, it it it it keeps me intellectually honest, I think.
• 7:00
  SPEAKER_00: Okay, so it keeps you always to never think you've got it down because no one does.
• 7:04
  SPEAKER_00: It's a constantly evolving space.
• 7:06
  SPEAKER_01: Yes, I think that's fair.
• 7:08
  SPEAKER_00: Okay, yeah.
• 7:09
  SPEAKER_00: Now, what would you say was like the biggest surprise for you as you went through that arc and you know, getting into consulting in the cybersecurity world?
• 7:17
  SPEAKER_00: Maybe what what came the most unexpectedly?
• 7:22
  SPEAKER_01: Um the lack of care, the lack of alignment, the the the consistent communications failure that I've seen that has really led to a lot of uh the problems that we see in our modern world.
• 7:40
  SPEAKER_01: Um I think of the well, that first consulting contract I had with a you know a brand new government facility, and it was on the waterfront, and it was beautiful, and they had an ADA compliant ramp up to their uh front door, and their front door was glass, and it was just this beautiful facility, and they had their brand new server sitting in the lobby on casters because they wanted to show how you know technology forward they were.
• 8:03
  SPEAKER_01: And um they had a system you could log into, but there was no username or password, you could just get in and edit public records all you wanted.
• 8:11
  SPEAKER_01: Nobody had thought that having a computer server on a set of wheels that you could back your pickup truck up to the door and steal the whole darn thing, or better yet, you could just walk in and do whatever you wanted while the uh person at the desk did not care, nobody thought that could result in bad outcomes.
• 8:29
  SPEAKER_01: Right?
• 8:29
  SPEAKER_01: That was not promulgated as part of what we thought about.
• 8:33
  SPEAKER_01: And I'd love to say things have changed, right?
• 8:36
  SPEAKER_01: How many modern breaches have we seen where the threat actors were able to not log in and just do stuff, right?
• 8:43
  SPEAKER_01: IBM's got statistics about that.
• 8:45
  SPEAKER_01: Verizon's data breach investigation report have got statistics that could go on, right?
• 8:49
  SPEAKER_01: Or where they've been able to just steal all of the data.
• 8:51
  SPEAKER_01: I mean, how many data breaches have we had this week associated with Oracle PeopleSoft and, you know, just widespread data exfiltration where it wasn't locked down, much like you could drive a pickup truck up to the server.
• 9:03
  SPEAKER_01: The technology's changed a smidge, but the actual problem, like nobody prioritized and said, Oh, that'd be a thing?
• 9:11
  SPEAKER_01: We should worry about that.
• 9:12
  SPEAKER_01: Nobody's really gone and done that exercise.
• 9:14
  SPEAKER_01: And it often isn't that they shouldn't.
• 9:17
  SPEAKER_01: It's that the person who sits in my seat, the CISO, has failed to communicate adequately with people who have a different educational background than them.
• 9:27
  SPEAKER_00: Gotcha.
• 9:28
  SPEAKER_00: Okay, so that kind of cross-department, not acting in silos, making sure that everybody's hearing the same message, no matter what level or what department they're in.
• 9:36
  SPEAKER_01: Yes, yeah.
• 9:36
  SPEAKER_01: I think code switching is super important for people in cybersecurity careers.
• 9:40
  SPEAKER_01: The ability to, when you're talking to another analyst or you're talking to another engineer, totally, absolutely talk tech.
• 9:47
  SPEAKER_01: Use acronyms, use buzzwords, use coded references.
• 9:51
  SPEAKER_01: Cool.
• 9:51
  SPEAKER_01: You're talking to somebody who's a manager, you're talking to somebody who's an executive, you're talking to somebody who went to business school, they have no idea what you're talking about.
• 9:59
  SPEAKER_01: And as soon as you start throwing out buzzwords or metrics or putting the cyber prefix in front of anything, they can mentally check out.
• 10:07
  SPEAKER_01: That's your problem, not their problem, right?
• 10:09
  SPEAKER_01: Until you want to get funding, until you want to actually have money to do a thing to fix a problem that could wreck the business or could it uh affect the shareholders of the business or could affect the general public.
• 10:19
  SPEAKER_01: If you keep talking tech at them, you aren't going to understand why.
• 10:23
  SPEAKER_01: And again, we end up with pickup trucks that you can back up to servers and just steal, or just go ahead and log in and don't log in and steal all the data.
• 10:31
  SPEAKER_00: Yeah.
• 10:32
  SPEAKER_00: Okay, no, that makes sense.
• 10:33
  SPEAKER_00: The messaging is really important.
• 10:35
  SPEAKER_00: And I think that gets to, you know, in your book, Cyber Risk is a Myth, uh, you talk about that cybersecurity risk, and I said we'd get back to it, right?
• 10:43
  SPEAKER_00: But you say it's just business risk.
• 10:45
  SPEAKER_00: So what are people misunderstanding when they separate cyber risk and business risk from each other?
• 10:51
  SPEAKER_01: So this is an interesting thing because um I have a receipt on my wall from a famous organization.
• 10:57
  SPEAKER_01: Uh, we in cybersecurity have built this professional identity of cybersecurity professionals.
• 11:03
  SPEAKER_01: And if you go back years ago, we before we had cybersecurity as a term, we had information security, and before we had information security, we had IT.
• 11:09
  SPEAKER_01: And before then, we probably just had computers.
• 11:12
  SPEAKER_01: And what are these neat things?
• 11:13
  SPEAKER_01: Right?
• 11:14
  SPEAKER_01: So, pretty early on, we started this evolution where there's the business and then there's cybersecurity, and never the twain shall meet.
• 11:22
  SPEAKER_01: They have different languages, they have different professional identities, they have different certifications, they have different courseware, they also have built a different language.
• 11:30
  SPEAKER_01: And the problem when they try to talk, they talk past each other.
• 11:35
  SPEAKER_01: There's not a lot of common ground.
• 11:38
  SPEAKER_01: And uh in the book, I explore that psychology of it as well as some of the history, but also what we should be doing.
• 11:46
  SPEAKER_01: Because when we're framing something as, I don't know, you in cybersecurity, you hear these things, CVEs, C VE 9.8.
• 11:53
  SPEAKER_01: There's one of them rolling around this week, actually, and it's it's it's running hard numbers, right?
• 11:58
  SPEAKER_01: An executive doesn't care what a CVE is.
• 12:00
  SPEAKER_01: If you say, hey, look, this is going to take down a manufacturing process that generates a million dollars an hour, suddenly they're interested, right?
• 12:07
  SPEAKER_01: There has to be a monetary impact effect.
• 12:11
  SPEAKER_01: And often what's lost when we talk about cyber risks other than our professional identity, which dictates that we should probably do that, we're missing the business impact, right?
• 12:21
  SPEAKER_01: For a while there, um business impact analysis, BIA, is the study of um what happens if this thing breaks, right?
• 12:31
  SPEAKER_01: And it's a it's a basic process study, it's not specific to cybersecurity.
• 12:35
  SPEAKER_01: For a while it was part of cybersecurity doctrine and then it sort of fell out of fashion, and everybody these days kind of goes, what's this what's a BIA?
• 12:43
  SPEAKER_01: What's that?
• 12:43
  SPEAKER_01: Why would we want to do that?
• 12:45
  SPEAKER_01: But if you can't show that if a server goes offline or if you lose an amount of data, or if you, I don't know, if your availability of your web hosts goes down, right?
• 12:54
  SPEAKER_01: If you can't show that in material effects, monetary impact, you're not going to get funding to fix it.
• 13:01
  SPEAKER_01: You're not going to get priority to fix it.
• 13:03
  SPEAKER_01: And that's how we end up having our current state of play where we have large-scale data breaches that occur despite um people knowing that thing's broke.
• 13:12
  SPEAKER_01: Like we should go fix that.
• 13:14
  SPEAKER_01: But because they can't adequately communicate, why they should go fix it?
• 13:18
  SPEAKER_01: Because of that missing translation layer, which is often business impact analysis.
• 13:22
  SPEAKER_01: The other thing that ends up happening is the misalignment of incentives.
• 13:25
  SPEAKER_01: I think that's the other thing we're seeing happen right now, where companies are FOMOing it so hard to make profits by on a quarterly basis by investing in new technology.
• 13:36
  SPEAKER_01: They're often saying, Yeah, yeah, yeah, that's a cybersecurity risk.
• 13:39
  SPEAKER_01: That's not a business risk.
• 13:40
  SPEAKER_01: We don't need to fix that.
• 13:41
  SPEAKER_01: We're still making money.
• 13:43
  SPEAKER_01: And that's fine until something bad happens, at which point the insurance investigators, the attorneys, the nice folks up on Capitol here are going to go, so who knew about this?
• 13:53
  SPEAKER_01: And all the cybersecurity community is going to go, uh, don't look at our Slack messages because it's full of us complaining about how everything's broken, right?
• 14:03
  SPEAKER_01: Which is what we saw in the SEC's case against uh SolarWinds, against Tim Brown, where their Slack was full of messages saying, like, yeah, this is a horror show here, guys, right?
• 14:11
  SPEAKER_01: That's gonna all come up, but businesses are FOMO in it right now.
• 14:15
  SPEAKER_01: They're saying, no, it's cool, we're gonna just make money.
• 14:17
  SPEAKER_01: Cybersecurity is not a real problem, despite all the societal impacts that it can have that'll be negative for a large amount of people.
• 14:24
  SPEAKER_00: Yeah, okay.
• 14:24
  SPEAKER_00: Okay, no, that that makes a lot of sense.
• 14:26
  SPEAKER_00: And so when you reframe it as the direct impact that it'll have on the business, you can get people who don't think about cyber to think about the issue that you're discussing.
• 14:35
  SPEAKER_01: Well, we're also removing emotion from it.
• 14:37
  SPEAKER_01: It's a math problem, right?
• 14:39
  SPEAKER_01: A lot of business decisions are non-emotional.
• 14:42
  SPEAKER_01: They are math.
• 14:42
  SPEAKER_01: It's like, so what is the cost if the risk is realized?
• 14:45
  SPEAKER_01: What is the cost if there's a lawsuit?
• 14:48
  SPEAKER_01: What is the cost if there's an investigation?
• 14:50
  SPEAKER_01: How much is our insurance going to take away?
• 14:52
  SPEAKER_01: Cool.
• 14:53
  SPEAKER_01: That's your total cost.
• 14:54
  SPEAKER_01: What does it cost to fix it?
• 14:56
  SPEAKER_01: If the cost to fix it is less, cool.
• 14:59
  SPEAKER_01: Let's do the thing that cost to fix it is less, and we'll reduce our risk.
• 15:03
  SPEAKER_01: But if the cost to fix it is more and you're making more money, you know, than the money you make off of it, this is where a lot of businesses, unfortunately, they don't do the math because the cybersecurity professionals don't give them the numbers and they don't.
• 15:15
  SPEAKER_01: This is not to say that all um people with CISSP should have also have an MBA and a doctoral in finance, but they should at least be able to go, hey, you're in charge of the sales process.
• 15:28
  SPEAKER_01: Could you tell me roughly how much money we make on a, I don't know, an annual or maybe on a weekly basis off of this system that you're basically in charge of, the sales process system, right?
• 15:39
  SPEAKER_01: Because otherwise, whenever we do that, you know, the wet finger in the wind and go, ah, it'll cost some money, right?
• 15:44
  SPEAKER_01: They're gonna get laughed out of their office because we don't know what we're talking about.
• 15:47
  SPEAKER_01: In cybersecurity, we have to be willing to go talk to the other business owners, the other stakeholders, find out what they do, what do they care about?
• 15:56
  SPEAKER_01: What are the things that motivate them?
• 15:58
  SPEAKER_01: Learn their language.
• 16:00
  SPEAKER_01: And then when we want to present a potential risk to their business, to their part of the business, to their vertical or their horizontal, depending on organizational structure, we can frame it in language they already know and in terms they already know.
• 16:11
  SPEAKER_01: Instead of going, well, it's a CVE 9.8, and we expect there'll be a four-hour outage.
• 16:15
  SPEAKER_01: Hell does that mean?
• 16:16
  SPEAKER_01: Nobody knows what that means.
• 16:17
  SPEAKER_01: A cybersecurity person knows what that means.
• 16:19
  SPEAKER_01: The rest of the executives?
• 16:20
  SPEAKER_01: No, they don't.
• 16:21
  SPEAKER_00: Right.
• 16:21
  SPEAKER_00: Nothing to connect to.
• 16:22
  SPEAKER_00: Yeah.
• 16:23
  SPEAKER_01: Exactly.
• 16:24
  SPEAKER_00: And, you know, AI, I know, is on everyone's mind.
• 16:27
  SPEAKER_00: And you've mentioned that uh the idea that leaders may prefer working with AI because AI can speak their language, and AI almost always says yes, right?
• 16:37
  SPEAKER_00: How do you think cybersecurity professionals can adapt to that, you know, changing paradigm around their CEO can talk to Chat GPT or to Claude for five minutes and feel like they have a firm understanding, even though they may just be hearing what the AI wants to tell them?
• 16:53
  SPEAKER_01: Yeah, and this is a multifaceted problem.
• 16:55
  SPEAKER_01: So um, if you're watching this podcast and you're a future law student or you're going into law, you might want to uh sit up and take note here because there's this thing called attorney client privilege.
• 17:05
  SPEAKER_01: And if you're not familiar with it, the long story short is anything you throw into an LLM, a large language model, an AI, is not protected by ACP and it is discoverable.
• 17:15
  SPEAKER_01: And the fun times with that is let's say the CEO is asking, hey, explain to me what the CISO just said in English, please.
• 17:21
  SPEAKER_01: If it misinterprets that from a discoverability perspective, everybody's cooked on account of the decisions that were based on the CEO having that interaction with an AI.
• 17:31
  SPEAKER_01: If it results in something bad happening, it's going to come up in litigation and no one's going to be very happy about that.
• 17:38
  SPEAKER_01: Now, if you're a cybersecurity professional or a technical professional thinking, huh, so they'd rather talk to an AI rather than me, ask why that is.
• 17:46
  SPEAKER_01: Right?
• 17:47
  SPEAKER_01: And it's a pretty simple like look in the mirror and think about how you talk to them.
• 17:51
  SPEAKER_01: Like, think about the interactions you've had.
• 17:53
  SPEAKER_01: When's the last time?
• 17:54
  SPEAKER_01: This is one that trips up new CISAs and is a pet peeve of mine.
• 17:59
  SPEAKER_01: When's the last time you had coffee with your general counsel?
• 18:02
  SPEAKER_01: Because if you're in the middle of a breach, you've got it's 3 a.m., no one's happy, something's gone horrendously wrong, everyone's on the phone, and somebody dials in and says, hi, I'm the general counsel, if you've never met that person before, the first thing you're going to assume is that they're here to fire you and everyone you work with.
• 18:21
  SPEAKER_00: But if on the other hand, first conversation.
• 18:24
  SPEAKER_01: Exactly.
• 18:24
  SPEAKER_01: But if you've had a coffee with them, if you know, hey, this is what you know I prioritize, this is what we work on, and this is how we can work together.
• 18:32
  SPEAKER_01: If you haven't done that, once you get to a leadership level in cybersecurity, you are going to fail and it is going to be a hot mess, right?
• 18:40
  SPEAKER_01: We need to figure out how do we partner with the other business leaders?
• 18:43
  SPEAKER_01: How do they like to be talked to?
• 18:45
  SPEAKER_01: And then instead of sending them vanity metrics that they don't care about, which ChatGPT or Claude or whichever will just burp back in something that looks plausible, figure out what do they actually care about?
• 18:56
  SPEAKER_01: What are their key performance indicators?
• 18:58
  SPEAKER_01: Those are the things that allow them to, I don't know, get bonuses.
• 19:01
  SPEAKER_01: And what are the key risks that would imperil those?
• 19:04
  SPEAKER_01: And then speak in that language.
• 19:06
  SPEAKER_01: And that cuts the whole LLM out of the middle, which means from again for our attorney friends or future attorney friends who are watching this, that means you don't risk losing privilege over those artifacts.
• 19:16
  SPEAKER_00: Right.
• 19:17
  SPEAKER_00: Okay.
• 19:17
  SPEAKER_00: Okay.
• 19:18
  SPEAKER_00: So kind of the same idea as like word problems for students learning math, right?
• 19:23
  SPEAKER_00: You put it into terms that they can relate to, and it can make it a lot more real and applic applicable than just kind of the abstract cybersecurity terminology.
• 19:32
  SPEAKER_01: Yes.
• 19:32
  SPEAKER_01: Yeah.
• 19:33
  SPEAKER_01: I think I think that the the less terminology that we use as a profession when talking to people from literally any other profession, I think that's a good thing.
• 19:42
  SPEAKER_00: So then you've been clear before that cybersecurity right now may be hard mode for new graduates or you know, high school college students looking at that as a career path.
• 19:53
  SPEAKER_00: What are you seeing in that area?
• 19:55
  SPEAKER_00: I mean, what skills maybe can people grab that can make them a little bit more resilient to that hard mode, or what can they start practicing today to position themselves better for the future, you know, four years from now, three years from now, when they're ready to step into these careers?
• 20:11
  SPEAKER_01: So the question is how much you're willing to put up with to get into the field.
• 20:18
  SPEAKER_01: I think that's for somebody first entering darn near all the fields right now.
• 20:25
  SPEAKER_01: At least in Western nations, you really have to ask yourself, are you committed to the bid?
• 20:30
  SPEAKER_01: And if you're not, it might be a time to have a a rethink about what you want to do with yourself when you grow up.
• 20:36
  SPEAKER_01: And I say that because for years, the premise of multiple industry reports has been there's this super wide gap of jobs that aren't filled in cybersecurity.
• 20:49
  SPEAKER_01: And these reports are by institutions and organizations that sell training and they'd love you to take their training to help get a job that'll fill that gap.
• 20:59
  SPEAKER_01: And these same institutions and organizations have been saying, hey, when you get hired, you're gonna get a six fig, six-figure salary, if I can get the right number of fingers up, uh, when you get out of college.
• 21:10
  SPEAKER_01: It'll be great.
• 21:10
  SPEAKER_01: It'll be fun times.
• 21:11
  SPEAKER_01: And that's generally been true.
• 21:13
  SPEAKER_01: And then the people with the MBAs, your chief financial officer, your, I don't know, your general controller, anybody who's in a management level is going, huh.
• 21:20
  SPEAKER_01: So what we've seen over the past 20 years is the number of data breaches has gone up.
• 21:24
  SPEAKER_01: And cybersecurity salaries have gone up.
• 21:28
  SPEAKER_01: Huh.
• 21:29
  SPEAKER_01: So we're kind of getting paid, we're paying twice because they have to pay for the remediation and the lawsuits and all the nightmare that comes along with having a data breach.
• 21:37
  SPEAKER_01: But also they're paying people salaries, and they're starting to ask, why?
• 21:41
  SPEAKER_01: Like, what's the business value we're getting out of this at this point?
• 21:46
  SPEAKER_01: There was a there's a market report that came out earlier um in 2026 from Heydrichson's struggles out in the UK that said this is the first year cybersecurity cybersecurity salaries have stayed flat or went down.
• 21:58
  SPEAKER_01: Now that's limited to UK.
• 22:00
  SPEAKER_01: That are, but in North America right now, that's kind of the vibe that's happening where companies are asking, okay, so we have these highly paid, highly talented individuals who speak basically a foreign language, and we see we give them money and we haven't seen the data breaches go down.
• 22:18
  SPEAKER_01: That becomes a very tenuous position to hold, right?
• 22:22
  SPEAKER_01: And that's why I think in cybersecurity we've seen a large number of layoffs in the industry, as well as the general tech industry.
• 22:29
  SPEAKER_01: And at the same time, we have another force, artificial intelligence, where vendors are saying, hey, instead of having a human have to deal with 200 alerts an hour, which a human cannot deal with 200 alerts an hour, not in any reasonable triage, we'll have an AI do that.
• 22:45
  SPEAKER_01: Never mind the cost in two years.
• 22:47
  SPEAKER_01: Forget that.
• 22:48
  SPEAKER_01: Right now, it's cheap.
• 22:50
  SPEAKER_01: And I think that message, again, when you go to the current profit mindset of like, hey, can we make number go up for next quarter?
• 22:55
  SPEAKER_01: Everybody'd be happy if we do that.
• 22:57
  SPEAKER_01: All of our investors will be happy.
• 22:58
  SPEAKER_01: I'll get a new swimming pool, whatever.
• 23:00
  SPEAKER_01: Right.
• 23:00
  SPEAKER_01: I think that's the force that we're working against right now is if we keep doing what we're doing, which is basically charging a lot of money and not showing business value, I think that it really does imperil the profession.
• 23:13
  SPEAKER_01: So the things that we can learn then are how do we speak about business?
• 23:17
  SPEAKER_01: I'm not saying go get a degree in finance, but maybe take a few courses to go figure out like what are the things that motivate them?
• 23:24
  SPEAKER_01: What are the things that motivate sales folks?
• 23:26
  SPEAKER_01: What are the things that, and that's not a simple answer either, if you're thinking, oh, I know what motivates them.
• 23:30
  SPEAKER_01: No, I've I've a great number of friends who are sales professionals.
• 23:34
  SPEAKER_01: They have unique motivations.
• 23:35
  SPEAKER_01: Figure out what does what does HR actually do, right?
• 23:38
  SPEAKER_01: Like what are the things that motivate each one of these?
• 23:40
  SPEAKER_01: Get that broader domain knowledge and then connect that.
• 23:45
  SPEAKER_01: Because that's how you can say, this actually you can help create business value or defend business loss rather than, yeah, you'll you'll fix some CBEs and you'll do the firewall thing, and that'll be great because nobody cares, right?
• 23:57
  SPEAKER_01: That's that's table stakes at these days.
• 23:59
  SPEAKER_01: You're assumed to be able to do that, and that's not a differentiator.
• 24:01
  SPEAKER_01: If you can speak their language, if you can mirror their language and you understand their um problems that they face on a day-to-day basis, not just the technology problems, I think that's a much better outcome.
• 24:12
  SPEAKER_00: Right.
• 24:12
  SPEAKER_00: You got to climb up out of that silo and kind of see what other folks are doing outside of the cybersecurity world.
• 24:18
  SPEAKER_00: Yes.
• 24:18
  SPEAKER_01: Yeah, there is a lot of other interesting things going on out in the in the broader world.
• 24:23
  SPEAKER_00: And so, you know, here at Tomorrow's Talent, we're always building internship programs and apprenticeship programs or work-based learning experiences for students to go and get a taste of what that is and maybe start building some skills before they say go to college and start working, you know, on their actual degree, given the the changing nature of the cybersecurity workforce and the influx, like you said, of companies just thinking they can have an AI do it.
• 24:47
  SPEAKER_00: What are the skills that a new cybersecurity professional can learn and can hold on to?
• 24:53
  SPEAKER_00: I mean, I'm hearing communication is a big one of them, right?
• 24:55
  SPEAKER_00: Their ability to communicate with people outside of the cyber field.
• 24:59
  SPEAKER_00: But what what skills can they really have that are going to be valuable in the long run?
• 25:04
  SPEAKER_01: Um, I'd say that so I'm gonna give you two answers to this.
• 25:07
  SPEAKER_01: One is gonna be the skills, and the other is gonna be who you should go intern with.
• 25:11
  SPEAKER_01: Um that answer will surprise you.
• 25:13
  SPEAKER_01: So the skills are gonna be around um data analysis, the ability to uh take a large, possibly unstructured, probably unfamiliar corpus of data and make sense of it.
• 25:26
  SPEAKER_01: And you can use whichever tools you have at hand, I hear Excel remains popular, to figure out like what does this actually mean?
• 25:33
  SPEAKER_01: And don't go spend tokens on having Claude go figure it out for you.
• 25:37
  SPEAKER_01: Like you should be able to figure this stuff out on your own because a lot of cybersecurity, at least the technology layer, is figure out what is this I'm looking at?
• 25:44
  SPEAKER_01: And it could be source code, it could be binaries, it could be traffic patterns.
• 25:49
  SPEAKER_01: Being able to understand the broader pattern is something that is helpful because while an AI can also do large-scale pattern analysis, it won't put it in context.
• 26:04
  SPEAKER_01: An AI could say, well, I'm seeing a whole bunch of new firewall attacks, but it won't go, oh, and there's geopolitical instability with another nation state that doesn't like you so much, right?
• 26:13
  SPEAKER_01: Right.
• 26:13
  SPEAKER_01: It lacks that larger operational context that we just kind of collect by living in the world.
• 26:19
  SPEAKER_01: I think that ability to tie together, here's what I'm seeing, and here's what it means, I think that's an important data skill for people to be able to draw that together.
• 26:29
  SPEAKER_01: Um, soft skills, as I've said repeatedly, uh former theater kid here, right?
• 26:34
  SPEAKER_01: Um, that's important because if you can't talk to folks, there is a decreasing number of jobs where you don't interact with other people outside of the business and outside of your department, I should say.
• 26:45
  SPEAKER_01: And I know that a lot of people in cybersecurity professionals, especially, are introverts.
• 26:49
  SPEAKER_01: This is hard.
• 26:50
  SPEAKER_01: It's socially draining, it's challenging to go talk to other folks on a regular basis.
• 26:55
  SPEAKER_01: That's also part of the job, right?
• 26:57
  SPEAKER_01: I think that's something you just have to learn to uh, it's a feature.
• 27:01
  SPEAKER_01: Uh, you're gonna have to learn to live with it.
• 27:03
  SPEAKER_01: Um, and then in terms of who you should go intern with, because this is the thing I'd say, don't go look at big companies.
• 27:09
  SPEAKER_01: Please don't.
• 27:10
  SPEAKER_01: Go look at your local government, go look at your state government, go look at agencies at the federal level.
• 27:16
  SPEAKER_01: And I say that for two reasons, especially at the local and state, and also in the educational level.
• 27:21
  SPEAKER_01: The pay is gonna suck.
• 27:23
  SPEAKER_01: I'm not gonna lie, the pay outside of like commercial entities is gonna suck.
• 27:28
  SPEAKER_01: But boy, do you get job security.
• 27:30
  SPEAKER_01: Because a state government does not have a profit motive that says number go up, everyone happy.
• 27:36
  SPEAKER_01: They've got, how do we best serve our citizens?
• 27:39
  SPEAKER_01: Right?
• 27:40
  SPEAKER_01: How do we actually make this a better place to live, whether it's your town or whether it's your city or whether it's your state, if you're working at that layer, you've got a lot more job stability than you're gonna have working for, I don't know, your traditional like financial institutions where they certainly have got a profit motive and it's to reduce all those cost centers, that's cybersecurity people know, unfortunately, and make the number go up, right?
• 28:03
  SPEAKER_01: I think so.
• 28:03
  SPEAKER_01: If we look at those internships uh as opportunities, um, research institutions also, I'd say you could consider those as well.
• 28:10
  SPEAKER_01: Again, the pay is not going to be great, but having not great pay for 30 years versus great pay for five, and then going, oh, now what do I do?
• 28:20
  SPEAKER_01: Right?
• 28:20
  SPEAKER_01: That's not fun.
• 28:21
  SPEAKER_01: Or becoming a CISO where it's endemic, where we change jobs allegedly every two years, right?
• 28:27
  SPEAKER_01: Nobody enjoys that.
• 28:29
  SPEAKER_00: Yeah, constantly relearning, having to re-establish yourself, possibly physically moving, right, having to relocate.
• 28:35
  SPEAKER_00: Yeah, nobody wants to be doing that all the time.
• 28:38
  unknown: Yeah.
• 28:38
  SPEAKER_01: Well, outside of people who choose to work with the military.
• 28:40
  SPEAKER_01: That's the other option, of course.
• 28:41
  SPEAKER_01: Right.
• 28:42
  SPEAKER_01: I have a great number of friends who are uh veterans and um they've done amazing things for the country.
• 28:48
  SPEAKER_00: So, you know, looking into the the potential future, right?
• 28:52
  SPEAKER_00: If people hear the message that you're giving them, if people hear what you're saying and make these kinds of shifts, what do you think a healthier kind of cybersecurity industry would look like?
• 29:02
  SPEAKER_00: What would you like to see as changes broadly to kind of fix that communication problem and really bring the value back behind what cyber does?
• 29:13
  SPEAKER_01: That that is a dance.
• 29:14
  SPEAKER_01: So there's what the CISOs want, what the businesses want, and what the vendors want.
• 29:19
  SPEAKER_01: And those are not, this is a case of misaligned incentives.
• 29:23
  SPEAKER_01: So what chief information security officers want is to be able to show their board and their investors and their business partners that they've been able to materially reduce risk at a lower cost and a lower headcount.
• 29:36
  SPEAKER_01: That's what they want to be able to show.
• 29:37
  SPEAKER_01: Because if they've said, hey, the risk number went down, the profit number went up, everybody's happy.
• 29:42
  SPEAKER_01: What cybersecurity vendors have the incentives to do is sell as much stuff as they can as fast as they can.
• 29:48
  SPEAKER_01: And unfortunately, a lot of their messaging is not aligned to here's how as a CISO you're going to reduce the business risk.
• 29:55
  SPEAKER_01: It's like, hey, we've made this really cool technology and it fixes this one edge case because all of the basic stuff is out there.
• 30:02
  SPEAKER_01: We're not in a technology problem anymore.
• 30:05
  SPEAKER_01: We're just not.
• 30:06
  SPEAKER_01: We have it's been a while since in cybersecurity we came up with something super neat.
• 30:10
  SPEAKER_01: Um, I I keep being told that quantum computing and post-quantum cryptography is going to be the next big thing, and um, it was the next big thing five years ago and five years before that.
• 30:21
  SPEAKER_01: And it's been going for about 20 years, that it's just about another five years from now that it'll be really kind of like fusion energy, right?
• 30:26
  SPEAKER_00: It's always the tech of the future.
• 30:28
  SPEAKER_00: It's always coming up.
• 30:29
  SPEAKER_01: Yeah, yeah, yeah.
• 30:30
  SPEAKER_01: And CISOs, we have no patience for this stuff.
• 30:32
  SPEAKER_01: We want real defensible controls that actually reduce risks to the business that we can easily communicate to the business without having to parse through a vendor's nonsense buzzword bingo.
• 30:43
  SPEAKER_01: But unfortunately, and um my friend Gianna will hate me for saying this, most cybersecurity marketing sucks.
• 30:50
  SPEAKER_01: It's just absolutely terrible.
• 30:52
  SPEAKER_01: And it's a complete mismatch because the engineers and the people who build the products are all very talented, but all very smart.
• 30:57
  SPEAKER_01: They don't know how actually they're they're selling it to or what their product really does and why anyone care.
• 31:03
  SPEAKER_01: And until we fix that, the messaging of this is what how your business would care about this.
• 31:10
  SPEAKER_01: We're gonna keep seeing this weird misalignment where CISOs buy products that they think might help because their analysts said, well, this seems like it would be probable, but they really don't know.
• 31:18
  SPEAKER_01: And there's no real proof of value that it actually is gonna produce a business outcome that everyone's gonna be happy with.
• 31:24
  SPEAKER_01: And then again, we get into this weird dynamic where we've been spending a lot on head cat, we've been spending a lot on tools, and the number of breaches hasn't gone down, and the risk level's been about the same, and you start going, cool, so you you all know what you're doing there, or do we need to bring in some new people?
• 31:41
  SPEAKER_01: And I think that's what we're currently facing.
• 31:44
  SPEAKER_00: So for a student who's watching and is still excited, still interested in pursuing the cybersecurity.
• 31:52
  SPEAKER_01: Wow, good on you.
• 31:54
  SPEAKER_00: What would you what advice would you give them before they, you know, are in college or you know, their junior, senior year of high school about picking classes and that kind of thing?
• 32:02
  SPEAKER_00: What advice would you give them before they even jump in to maybe decide if it's the right field for them?
• 32:08
  SPEAKER_01: This really is a question of if you're committed to the bit.
• 32:11
  SPEAKER_01: I think that's the the biggest thing is that cybersecurity done well is about protecting our community.
• 32:17
  SPEAKER_01: It's about protecting the people around you, it's about protecting the people who are beside you at work, it's about protecting your customers.
• 32:23
  SPEAKER_01: If you are not willing to sign up for that to help other people, this is probably not the right field for you because that's the mentality you have to go into this.
• 32:32
  SPEAKER_01: It is hard, it is difficult most days.
• 32:34
  SPEAKER_01: Most days are not good days.
• 32:36
  SPEAKER_01: And if you're not willing to bring your best ability continuously under duress with honestly a fairly challenging environment, and that's both the threats that we face as well as the businesses that we support, probably don't.
• 32:55
  SPEAKER_01: Right?
• 32:56
  SPEAKER_01: You have to sign up for this because it's in spite of what all of the educational institutions will tell you about, you know, futures and how the careers are great, the work is hard.
• 33:05
  SPEAKER_01: The other thing I'd say is um before you really get into it, because cybersecurity, like it's not just a thing.
• 33:12
  SPEAKER_01: It's like it's not like plumbing where you can go, like, it's just plumbing, because it turns out, I didn't know this, plumbing has different disciplines.
• 33:18
  SPEAKER_01: There's industrial plumbing, there's manufacturing plumbing, there's residential plumbing, there's not just one type of cybersecurity either.
• 33:24
  SPEAKER_01: Go talk to some people.
• 33:26
  SPEAKER_01: We are all on LinkedIn and we generally don't like LinkedIn anymore.
• 33:29
  SPEAKER_01: But that's um, you can find us there or find us on uh Reddit or find us on various Discord servers and ask us, what do you why?
• 33:37
  SPEAKER_01: Why do you still do this?
• 33:39
  SPEAKER_01: Why do you push that boulder up that hill every day?
• 33:41
  SPEAKER_01: What makes you what are the things that you like and what are the things you don't like?
• 33:45
  SPEAKER_01: And what are the skills that keep you going?
• 33:47
  SPEAKER_01: Because I'd say, like one of the best malware researchers I ever hired was a former concert violinist, no background in malware reverse engineering, really good at solving puzzles.
• 33:58
  SPEAKER_01: And that's what that discipline is, is solving problems and solving puzzles and just picking something apart with a lot of determination.
• 34:05
  SPEAKER_01: And concert violinists, I guess, is not an easy profession to get into.
• 34:10
  SPEAKER_01: So you have to figure out like what are the skills you have?
• 34:12
  SPEAKER_01: Do you like um do you like helping people understand value, right?
• 34:17
  SPEAKER_01: That could probably be a sales job right there in cybersecurity.
• 34:20
  SPEAKER_01: It's still a cybersecurity job, it's a sales job or a marketing job.
• 34:23
  SPEAKER_01: Do you like picking apart like how to estimate costs and financial institutions?
• 34:30
  SPEAKER_01: You could be a risk analyst.
• 34:31
  SPEAKER_01: We have those in cybersecurity.
• 34:33
  SPEAKER_01: So figure out like what are the things that you love doing.
• 34:36
  SPEAKER_01: And if you're not sure, go ask us, like the things that we enjoy doing.
• 34:39
  SPEAKER_01: We're all, like I say, we're all generally available.
• 34:43
  SPEAKER_01: And if you don't like what you hear, don't like either choose not to, like, don't get despite what the vendors will tell you that are selling certifications.
• 34:52
  SPEAKER_01: The reason they're making it sound so good, they want to make money, they want to sell certifications and educations.
• 34:59
  SPEAKER_01: That doesn't necessarily mean you get a good outcome, right?
• 35:01
  SPEAKER_01: Have to think of like, is this what I really want to do for the next, I don't know, 10, 20 years?
• 35:06
  SPEAKER_01: I think people are gonna change careers multiple times inside of their uh lifetime at this point.
• 35:11
  SPEAKER_00: Right, but gotta be willing to put your nose down a little and kind of you have the grit to keep going.
• 35:16
  SPEAKER_00: Because, like you said, most days in that profession aren't gonna be good easy days, right?
• 35:20
  SPEAKER_00: You got you're dealing with stuff, you're solving problems.
• 35:22
  SPEAKER_01: Yeah, and that's regardless of what level of the pyramid you're at, whether you're somebody who's just an engineer or whether you're at the top, you're a C SO, you're still reporting to somebody and you're still dealing with the challenges change, but there's still challenges.
• 35:33
  SPEAKER_01: There's not like these there's not going to be a lot of easy days.
• 35:37
  SPEAKER_00: And I love the connection you made to plumbing too.
• 35:40
  SPEAKER_00: Like if you're if you're maybe getting into cybersecurity and what you're doing in your class isn't necessarily the thing that you really get fired up about, well, then maybe you need to shift to sales or risk analysis or just a different facet of cybersecurity, but still be involved with that kind of work.
• 35:54
  SPEAKER_00: There's a lot more than just help desk, right?
• 35:57
  SPEAKER_01: Yeah, it's not all just fingers on keyboards and a green matrix screen in the background.
• 36:02
  SPEAKER_00: Yeah, yeah, okay.
• 36:03
  SPEAKER_00: And then from kind of that perspective, if we're looking at new talent coming into the career, what would you suggest employers or maybe you know, CISOs who are hiring a bunch of new people into their department, how would you suggest they work with the new folks to really prepare them for what's next in cybersecurity, you know, to keep their workforce relevant and modern?
• 36:25
  SPEAKER_01: So I love the jump you just made there.
• 36:27
  SPEAKER_01: And there's an unfortunate step in the middle.
• 36:30
  SPEAKER_01: So um the the current problem we have in cybersecurity right now, one of the many problems we have in cybersecurity, we all we don't have all problems, we certainly have a few, is it's very gatekeepy.
• 36:41
  SPEAKER_01: And that's unfortunate.
• 36:42
  SPEAKER_01: And the problem is that a CISO says, uh, I need a new intelligence analyst or I need a new engineer, new cybersecurity engineer.
• 36:50
  SPEAKER_01: And HR goes off to an AI and it burps out an answer of what a perfect candidate would be.
• 36:57
  SPEAKER_01: And then puts out his job description and then finds out that nobody actually meets that unless they've been in the field for 15 or 20 years to go get an internship.
• 37:06
  SPEAKER_01: And until like until that problem gets torn down of we can't have perfect candidates for every single job, because at that point you just don't hire people anymore because they don't exist, that you have a diminishing capacity.
• 37:18
  SPEAKER_01: But for the C for the folks who make it through that gauntlet of like, yes, you need a um you need 30 years of Cali Linux, you need a CISSP, and you need a Purple Heart, even though you just graduated college to get an internship at a cybersecurity job, right?
• 37:33
  SPEAKER_01: Which is unfortunately what I've seen in some of these.
• 37:36
  SPEAKER_01: The CISO that is successful, the manager that's successful, is going to ask you to talk in business terms.
• 37:42
  SPEAKER_01: And if they're not, they're doing you a disservice.
• 37:44
  SPEAKER_01: They are failing you professionally.
• 37:46
  SPEAKER_01: Because you can talk vanity metrics all day.
• 37:48
  SPEAKER_01: You can talk about how many patches you have applied and how many firewall rules you've built and how you've built different snort detections.
• 37:56
  SPEAKER_01: Nobody cares, right?
• 37:57
  SPEAKER_01: If you can't translate that to another business person, your career is going to hit the ceiling real quick.
• 38:04
  SPEAKER_01: And it's not that you have to get into management.
• 38:07
  SPEAKER_01: We need really good penetration testers.
• 38:10
  SPEAKER_01: We need senior incident wranglers.
• 38:12
  SPEAKER_01: It's an actual term, incident wrangler.
• 38:14
  SPEAKER_01: We need these people.
• 38:15
  SPEAKER_01: They aren't managers, but boy, do they have to talk to them.
• 38:17
  SPEAKER_01: And if you can't do that, your career is going to get stunted real quick out the gate until you figure out how do I go talk to people.
• 38:24
  SPEAKER_01: So that's the thing I think that we have to do is like the leaders who are in my roles, we have to be giving people those deliberate challenges of explain this to me in business terms.
• 38:33
  SPEAKER_01: Do not explain this to me in technical terms.
• 38:35
  SPEAKER_01: I already understand the technical stuff.
• 38:37
  SPEAKER_01: Right?
• 38:37
  SPEAKER_01: Do you understand what this means in the larger context?
• 38:41
  SPEAKER_00: Yeah.
• 38:41
  SPEAKER_00: And then, you know, you mentioned earlier, and I'm thinking I'm hearing it here in a little bit when you said it's very gatekeepy.
• 38:47
  SPEAKER_00: Uh, you need to know, you need to have a network of people that you communicate with.
• 38:52
  SPEAKER_00: But earlier you said uh LinkedIn might not be the best place to go, right?
• 38:56
  SPEAKER_00: Uh, and I know you've talked to me already about LinkedIn is is full of stuff that isn't necessarily business networking nowadays, right?
• 39:03
  SPEAKER_01: Do you love AI slop?
• 39:05
  SPEAKER_01: Because they will give you some slop.
• 39:07
  SPEAKER_00: Where would you suggest people go then to start building their network if LinkedIn isn't the answer anymore for this field at least?
• 39:14
  SPEAKER_01: There are a lot of good Discord servers out there for cybersecurity.
• 39:17
  SPEAKER_01: Almost all of them are public.
• 39:19
  SPEAKER_01: Um, that's one thing.
• 39:21
  SPEAKER_01: Eventually you'll get invited to some signal chats.
• 39:23
  SPEAKER_01: That's actually where the real action is, which is way off of anybody's roadmaps.
• 39:27
  SPEAKER_01: Um, but I'll honestly like start with uh I'd say start with Reddit, because that's usually where these things get kicked off.
• 39:33
  SPEAKER_01: Find out which um cybersecurity specific Discord servers are out there.
• 39:38
  SPEAKER_01: There's uh one for job hunting, there's one for threat exchange, there's one for there's there's a variety of them that I'm already in.
• 39:45
  SPEAKER_01: Um and then show up and chat to people and find out what's going on.
• 39:49
  SPEAKER_01: That's that's ultimately where a lot of the good conversations are happening.
• 39:52
  SPEAKER_01: And the the reason is not that like it needs to happen on a specific platform.
• 39:57
  SPEAKER_01: It's what is the point of the platform.
• 39:59
  SPEAKER_01: These Discord servers, they're not for profit.
• 40:01
  SPEAKER_01: They're not trying to say, like, hey, here's some more AI slop that'll make you angry and get engagement, like a social network, because it's not, right?
• 40:08
  SPEAKER_01: I also would say um InfoSec apparently still exists on Twitter.
• 40:13
  SPEAKER_01: Um, that's one of the few things in the world I will dead name.
• 40:16
  SPEAKER_01: Uh, but I'd say it's largely there's a lot, there's more misinformation there than there is real information.
• 40:24
  SPEAKER_01: And uh stay away from Telegram channels about cybersecurity.
• 40:29
  SPEAKER_01: They're generally not a good place to be.
• 40:32
  SPEAKER_01: That's the uh would you like to have the dark web in your pocket?
• 40:34
  SPEAKER_01: Because that's that's Telegram right now.
• 40:37
  SPEAKER_00: Yeah, okay.
• 40:38
  SPEAKER_00: So stay away from the big kind of marketed social media sites and look for places that are just cybersecurity professionals having real conversations instead.
• 40:46
  unknown: Yeah.
• 40:47
  SPEAKER_00: Not something looking to be sold.
• 40:48
  SPEAKER_01: Yeah, I think one of my favorite ones, um, and this is by no means an endorsement, but I do like uh Black Hills Information Security.
• 40:56
  SPEAKER_01: Um, they run a BHIS's um Discord server.
• 40:59
  SPEAKER_01: It is really good.
• 41:00
  SPEAKER_01: They publish both research, but they've also got pretty good people on there.
• 41:05
  SPEAKER_00: And then an important one I heard for you know young adults and students listening is once you're there, talk to people.
• 41:11
  SPEAKER_00: Once you're there and you're in that community, make yourself known, chat, be a part of the community.
• 41:15
  SPEAKER_00: Don't just be a to use some Reddit terminology, don't be a lurker, right?
• 41:19
  SPEAKER_00: Be an active member of the community.
• 41:21
  SPEAKER_00: Okay.
• 41:22
  SPEAKER_00: Yeah.
• 41:23
  SPEAKER_00: Well, Kane, is there anything that you'd like folks, if there was you know one takeaway somebody took from watching this episode, is there something that you could could sum up for them?
• 41:32
  SPEAKER_00: Maybe it's you know, get out of your cyber shell and and learn the other pieces.
• 41:36
  SPEAKER_00: Maybe it's something else.
• 41:37
  SPEAKER_00: What would you want folks to walk away with?
• 41:43
  SPEAKER_01: I think right now we're at a real hard point in human history.
• 41:49
  SPEAKER_01: And I think it's really important to keep that in mind.
• 41:53
  SPEAKER_01: If you're looking at graduating this year or in the next year, um, there are a lot of things outside of cybersecurity that are going to influence the field dramatically.
• 42:05
  SPEAKER_01: And I think it's very important to not fall into the narrative of this is my fault.
• 42:11
  SPEAKER_01: If we see widespread layoffs, that's not your fault.
• 42:15
  SPEAKER_01: If you can't get a job because 100,000 other people just got laid off and you're just a new guy, right?
• 42:21
  SPEAKER_01: That is not your fault.
• 42:23
  SPEAKER_01: And I think it's essential to, because there's again with that imposter syndrome that tends to be endemic in cybersecurity, there's also a lot of self-blame, like, you know, you could have done better.
• 42:31
  SPEAKER_01: There are some things that are just way outside of our level of control.
• 42:34
  SPEAKER_01: And I think that's the thing to keep in mind is there are things that are going to be in your sphere of control, and that is a diminishingly few number of things.
• 42:41
  SPEAKER_01: And then there's going to be a lot of stuff that's outside of your sphere of control, and that's the real world.
• 42:46
  SPEAKER_01: And I think if you can hold that in your head and be okay with it, you're probably going to do a lot better in cybersecurity because that's how this thing, whole thing, works.
• 42:55
  SPEAKER_01: There is so much we don't control.
• 42:57
  SPEAKER_01: We cannot even pretend to.
• 42:59
  SPEAKER_01: If you're willing to be comfortable with that, cool, you probably still got an opportunity with the cybersecurity roles.
• 43:04
  SPEAKER_01: If not, yeah, go look elsewhere because this is this is the current state of the field, and I don't see it changing.
• 43:09
  SPEAKER_01: I don't see the days getting any easier in the next decade.
• 43:12
  SPEAKER_00: Yeah.
• 43:13
  SPEAKER_00: Okay.
• 43:13
  SPEAKER_00: Yeah.
• 43:14
  SPEAKER_00: I like that.
• 43:14
  SPEAKER_00: Don't don't think it's all your fault and don't expect yourself to be able to change everything out in the world with the the little bit of influence that you have.
• 43:22
  SPEAKER_00: Okay.
• 43:24
  SPEAKER_00: Well, Kane, thank you so much for joining us today and for being here.
• 43:28
  SPEAKER_00: Uh, we're definitely going to include your uh information down in the description of this episode so that people going can find you, can find your book, and can maybe get onto one of those Discord servers or maybe even just LinkedIn, right?
• 43:39
  SPEAKER_00: And get a get a message out.
• 43:41
  SPEAKER_00: But thank you so much for being here.
• 43:43
  SPEAKER_00: Uh a reminder to everybody watching or listening along with us, uh, in the description of the episode, you should also find our churn calculator.
• 43:49
  SPEAKER_00: So if you're at a business and you're worried about the amount of turnover that you're having or what it takes to bring on a new employee and get them up to speed, you can play with that, fill in all your variables, and maybe have a discussion with somebody from Tomorrow's Talent about what it would look like to put an intern in that position instead, an apprentice, maybe.
• 44:05
  SPEAKER_00: Uh, but thank you all for being here with us today for listening or you know, watching along.
• 44:09
  SPEAKER_00: If you caught us on YouTube, please leave us a like or a comment, and we'll see you next time on The Bridge to Tomorrow's Talent.
• 44:15
  SPEAKER_00: Thanks so much.