20MinuteLeaders

There are genuine operational gems buried here - the headspace theory of interrogation applied to security, the two-vendor-qualification questions, aligning budget requests to the CEO's annual strategic messaging - but they are stretched across 99 minutes padded with personal backstory, a live card trick, game theory tangents, and mutual affirmation. The yield per minute is low.

“if I can take up uh, three units of your headspace and now you only have two left, you're more likely to mess up and tell me your truth”

“I always ask, uh, especially for value added resellers... how many clients do you have? Like, as in you as an individual, not the company... if you have 10 clients, that tells me how much time you're going to spend with me”

The security mentalism concept is genuinely novel framing, and the tactical creativity - fortune cookies for board members, mugs to disarm password-policy complainers, profiling a vendor rep by asking how many clients they carry - represents real first-principles thinking rather than recycled frameworks. The larger vendor/CISO relationship advice echoes familiar enterprise-sales wisdom but the specific heuristics add texture.

“I had fortune cookies made... the CFO opens their fortune cookie after eating lunch... it says, today is a great day to increase the security budget”

“off the shelf, I took off the shelf, I gave them a mug. And they looked at it, they laughed, and then they forgot why they were there. And then they left. Never complained”

Gary Chan is a genuine practitioner - CISO of a 50,000-person healthcare system, trained interrogator, and professional mentalist - with a rare multi-disciplinary background he has actually operationalized, not just theorized. He is not a career podcast guest, and his resume-fraud detection story and vendor-qualification approach reflect real scar tissue. He is not a household name and the conversation under-exploits his depth.

“I work as the, uh, Chief Information Security Officer at SSM Health... it's got uh, 50,000”

“I had a team member that was super excited about hiring this particular person... I said, I'm pretty sure that this is completely fraudulent... I gave a lot of other indicators... all based purely on psychology... we did a background check... it was completely fabricated”

The episode features concrete specifics - 8-to-12 character password policy, the two-and-a-half-year executive leadership program meeting every other month for three days, three-to-four vendor calls per hour, one cold-outreach response every two months - but several examples are explicitly flagged as made-up numbers, and there are no breach cost figures, threat data, or named vendor comparisons to anchor broader claims.

“we changed our password policy from, um, eight characters to 12 characters... I had these mugs made that had the company name on one side, and then on the other side it said, here we do eight. And I crossed it out and said 12”

“I was put into a program, uh, for two and a half years where every other month we spent three days... Executive Leadership Formation... about 20 of us in the class”

The host occasionally lands a sharp question - asking what startup CEOs should ask CISOs, or probing why Chan studied interrogation - but spends too much airtime inserting his own opinions and biographical tangents, validates almost every claim with enthusiastic agreement rather than productive pushback, and the cumulative effect is a PR-friendly conversation rather than a probing one.

“Please continue. This is for sure going to be my favorite part of the talk. Please.”

“And that's also what drew me close to social engineering in general... what drew me really into social engineering was this dynamic nature”