The Psychology of Security: A Conversation with Gary S. Chan, CISO of SSM Health

Speaker A: Cybersecurity changes quickly, but its hardest problem is timeless understanding the human being behind the technology. Back in January, I sat down with Gary Chan, a veteran security leader, trained interrogator, and the security mentalist. His insights into human vulnerability feel more relevant than ever. Here is our conversation.

Speaker B: Gary, thank you so much for joining me.

Speaker C: Thank you for flying all the way to come meet me here in Phoenix. I would do it again. Yeah. It's a pleasure getting to know you a bit, and I'm looking forward to this.

Speaker B: It really is. And, you know, we met at dinner a, ah, couple of weeks back. And, uh, as soon as we started dinner, um, you did something really special. Uh, you opened the jacket a little bit and you took out a pack of cards. And we're sitting there, you know, about 15, uh, CISOs, a few entrepreneurs, and you ran through a story that took my friend Shahkar and left all of us with our jaw on the floor. And that was a really special moment. Um, one, because it was just awesome and it was mesmerizing. Two, is that, um, as a ciso, you immediately connected it to, uh, the work that you do in security and how mentalism and magic connects. And so you, uh, know this series that we're doing is all about artificial intelligence meets cybersecurity and what that means. But as a passionate and avid magician and mentalist myself, ah, I was immediately drawn to your own journey and your own story. And so I was waiting for this moment, and I'm really excited to have you here.

Speaker C: Well, thank you for the opportunity. It's always just a fun time, uh, to share stories and learn a little bit about each other as well.

Speaker B: Absolutely. Gary M. Take me back a little bit about yourself. Um, where did you start? Where did you grow up?

Speaker C: Sure. Well, I'll give you the 10,000 foot view. Uh, I grew up in Louisiana, of all places. Everyone always asks me, where's my Louisiana accent? Uh, don't know where it went, but, um, you got what you got. So, uh, then I went to school at mit. Uh, do an undergrad in electrical engineering, computer science.

Speaker B: Small college in Boston, right? Yeah, I think I've heard

Speaker C: very small. Um, over the river in Cambridge, actually. But yes, Boston. I, uh, wanted to go there because I have an older brother and he went to Boston University for med school. And I always wanted to follow in my brother's footsteps. Uh, so, uh, Boston was where I wanted to go, and mit, uh, was the right fit because I have a passion for math and science. Um, my father was a math professor, so I was doing set theory in ninth grade.

Speaker B: Really?

Speaker C: Yeah. Uh, it was, um. I don't necessarily recommend it, but I've done a lot of math.

Speaker B: Wow.

Speaker C: Uh, anyway, so graduated from mit. Uh, and actually during that time a very noteworthy thing is, um, I, uh, went to Cambridge University and studied there for a year abroad, which was awesome. Uh, anyway, fast forward. Start, uh, doing work.

Speaker B: That's where you met your wife, right?

Speaker C: That is exactly. Yep. Um, do you remember it? So, um, then fast forward. I, uh, worked, uh, in consulting. In IT consulting. Uh, and then I worked, uh, doing, uh, identity fraud type of work. Uh, and then I moved to information security. Uh, today I work as the, uh, Chief Information Security Officer at SSM Health. Uh, and I also do mentalism, um, what uh, I call security mentalism shows, uh, which are basically security themed, uh, entertainment for, uh, folks.

Speaker B: Trademark pending.

Speaker C: Trademark pending for security mentalism. Yes.

Speaker B: Your father being a math professor and you doing set theory in ninth grade. Um, you often see two routes that kids take when their parents have a very distinguished profession. They could either dive into that and lean in and they love it, or they stay away from it and they're discouraged from it. Sounds like you chose the more passionate, excited path.

Speaker C: I'm not sure if I chose anything. My parents, uh, were helicopter parents. And I was a dutiful Chinese boy, uh, who followed the instructions. Um, today I no longer follow instructions. And they asked me what happened. I told them because you brought me up in America where that's, uh, not the culture, it's not my fault, it's yours. Uh, but yes, I found that the, uh, when doing the math initially, uh, I didn't really enjoy it too much, but, uh, I enjoyed the competitions really. Uh, so, um, it was an opportunity. And that's also a reason why I like Security is because, uh, you're competing, you're competing with the bad guy for security to basically defend, uh, against their attacks. Uh, and, um, with math, uh, I had the opportunity to basically learn a ton of different, uh, things and use, um, that, uh, in my daily life. Uh, including with Game Theory, which I find to be super fascinating because that's all about kind of predicting the other person's move and then figuring out how you can basically take advantage of it, you know, in a good way. Oh,

Speaker B: I, uh, love Game Theory.

Speaker C: Yeah. What do you, what do you like about it?

Speaker B: You know, I got introduced to game theory back in high school and I was, uh, doing a little bit of work in behavioral economics with Dana Riely and really seeing a lot of these Dilemmas, uh, from the very simple dilemmas, like the prisoner's dilemma, uh, to the more complex ones and then uncovering the psychological aspects, but then also the mathematical aspects and then how oftentimes the decisions that people make, uh, may be irrational mathematically, but they seem very rational psychologically. And the fact that you can have multiple people, very intelligent people, look at that same dilemma, even though it has a more promised answer, uh, the best response you could come up with, they, uh, will choose different things.

Speaker C: Yeah, yeah, I completely agree. But I would also argue that if you properly do the assessment, and this is where I guess all the math comes in, that you actually can get a correct answer. Uh, so I think one of the, the very simple example might be, um, you can prepay, uh, for a hotel room, uh, or you can buy one with a flexible cancellation policy. Right. And obviously the one with a flexible cancellation policy, uh, it's more expensive. Same for airlines. There are a lot of things that have this sort of thing where you can choose a prepay or you can pay later. Um, but whether or not you can cancel, well, you can calculate the exact probability of the break even point where if there's a certain probability that you will cancel, that you should buy the prepay versus buy the flexible one. And I think that most people don't do that calculation. They're just like, oh, okay, yeah, I think that I'll probably go, or not, it's more of a binary. And then they're like, okay, I'll prepay or I won't prepay. But you can actually just calculate the probability and then that is the correct answer. That is the answer.

Speaker B: Right. And it's challenging to. If you don't have necessarily the skills or the mindset or the patience to do that in the day to day, then people resort to trusting their intuition, their binary responses. Of course.

Speaker C: Yeah, exactly. And uh, as well as I think most people know, intuition oftentimes is wrong.

Speaker B: Yes. Do you remember a dilemma in game theory that you grew up with that stays with you that we can share here?

Speaker C: Uh, I don't know, but I do think the, uh, prisoner's dilemma is probably the simplest one and most straightforward. Um, uh, but I don't know. I use predictive models. Not necessarily the, uh, prisoner's dilemma, but predictive models a lot, uh, for work. So if I do X, then Y will happen, uh, and then laying out a decision tree. And my team really hates it when I do that because they're just like, Gary, it's simple. You should just do X or Y? I'm like, well, no, actually if you throw it out, um, you actually can get all of these different possible outcomes, each with different probabilities. And now you can look at and say, well, if I make this decision, then there's a 90% chance that it'll work out really well, but a 10% chance as like, terrible, or I can make this other decision. And yeah, there's a, uh, worse probability of it doing well, but at the same time the bad outcome is actually not too bad. So you can calculate that and be like, well, okay, in that case I should just go this route. Makes sense. Uh, and so, but if you don't have that conversation, then you're really making decisions based on like your gut feel, on one or two variables. Because that's really all that our head pets can use. You know, like a fundamental principle of interrogation. So like I'm a trained interrogator, uh, is that you can, you basically want to take up headspace and let me explain what that means. So all of us, every person has a, ah, number of units for them to basically think, right? So, um, one person may have five units to be able to think about something and maybe chewing gum takes up only one and walking takes up only one. Um, but you know, having, having a very theoretical, philosophical conversation, maybe that's four. Um, you know, and so basically in that model, you can basically walk and have the, and have the discussion, but you can't also chew gum. Right? Um, so the whole point, or not the whole point, but one of the points when you do an interrogation is you want to use up headspace because it's a lot harder to lie than it is to tell the truth, right? So if I can take up uh, three units of your headspace and now you only have two left, you're more likely to mess up and tell me your truth. Right? And so there's all these things that if you think about it and you're very calculated, you can be a lot better because the nuances matter. So for example, if I asked you to do two plus two, that's probably pretty easy for you might take only one headspace, right? But if I asked you to do like 3,400 times, you know, 5,000,082. Right. That might take up 2 or

Speaker B: 3,000,740.

Speaker C: Oh, perfect. Yeah. Calculator. Um, so, but we do need to check that.

Speaker B: Just trust me.

Speaker C: There we go. Um, but that might take up say three units rather than one unit. Well, if I, if I want to, you know, if I If I think about what outcome I'm going for, if I want you to get it right or I want you to get it wrong, then I need to fill your headspace with either two or four. Which means that, uh, if I only want to do two, then I need to do a very low level type of thing. Maybe I ask you some simple questions, like, hey, do you want a drink? Right. You know, something like, something super simple. Um, you know, but if I want to take up four headspaces, maybe I start yelling at you, right? And so you got to think about all these things. What outcome do you want, how much headspace is going to take, and what can I do to cause that to happen? And so there's a whole lot that can go into it.

Speaker B: Why did you go study how to be a good interrogator?

Speaker C: Oh, uh, because I just enjoy psychology. So I think you and I have a similar passion in that. Absolutely. I think it's super important to do that because, I mean, we deal with people every day.

Speaker B: That's all we do.

Speaker C: All we do, right. And so if we understand better how people operate, then we can basically do a better job and also protect ourselves. So I'll tell you this, uh, thing, which I know is probably kind of in line with the type of work that you do, right? Um, now we're all concerned about hiring people who are fraudulent, right? So, uh, it could be that the person, that that person is using a fake identity, or it could be that that person is using a real identity, but it's not that person. Or it could be that person is a real person, but they just made up a completely fabricated background. Right. Whatever it is. So, um, you know, I had a team member that was super excited about hiring this particular person. And, uh, you know, it was very clear. And now I didn't. I hadn't met this person or anything. It's like, oh, yeah, you know, Gary, this person's going to start on, uh, you know, in a month and super excited they're going to come work here. Um, and, uh, I said, well, let me take a look at the resume. You're so excited. I want to see what this is. I took a look at it and I said, um, I know you're excited. Maybe they can do the work. But I'm pretty sure that this is completely fraudulent. Uh, and then what ensued was total chaos. So maybe not chaos, but a denial, I should say. Denial was like, no, I met this person. No, they could answer all the questions. They did all that. And I said, no, it doesn't make any sense because I know security, I know what people know. And in 10 years, which is how long this person had been working, according to the resume, there is no way that they could have accumulated this level of knowledge in all of these different areas. I don't think that this is an individual. Maybe it's, uh, a amalgamation. Maybe they're using AI. Whatever it is, it's a lie. Um, and I gave a lot of other indicators, uh, in the, in the resume itself that didn't make any sense. Uh, and then I also looked at their LinkedIn and there was a ton of indicators there. And I said, you know, this person claims to have lived in, you know, city A, uh, and city B. Well, why are all of their connections in other cities? That doesn't make any sense. They only have three people in those two cities. That doesn't make any sense. Um, and there were tons of others. I'm not going to give away all the things because I don't want bad guys to be learning, but I had a list of like eight things that. All based purely on psychology, and I gave it to my manager. And the manager was, uh, incredulous and was like, had a reason for all, for each of the ones. Right. Like pure denial. Like, maybe they only accept, uh, invitations from people and it just happened to be. Okay, well, that's just one. Maybe they read for 40, you know, 40 hours a week and then work 40 hours a week and that's how they learn, you know, whatever it was. Right, sure. Um, and anyway, long story short, we did a background check, uh, and called the places, uh, and, um, and, and it was, it was completely fabricated. The person never worked at, you know, kind of those places. Um, but it's

Speaker B: amazing how attached we got to the, how attached we were to the idea that this is the right person for us. How excited we are looking at that same data and conjuring different stories with it. Right.

Speaker C: I would completely agree. And also, I would say also the background checks, I don't know how they're conducted, but, um, in this particular case, um, it was only on the second review that they found the issue because I asked them to do it again the first time it passed. And I said, these are the issues that I have with it. Make sure that you do these things when you do it. So, uh, and it was done. So, um, it's just kind of interesting also that, like, even something as base, that basic, you can have different ways of doing it. And it's all psychology. It's all People, that person was taking advantage of how people think.

Speaker B: Yes.

Speaker C: And you know, needing, and you needing to have that awareness. So, uh, I would say that even though I never, I didn't do it with the intention at that time, you learn how to be interrogator. Um, that has helped me immensely, uh, to be able to find things like that.

Speaker B: And it's quite amazing how we can as humans look at that same piece of data and interpret it in all different ways. Right. We talked about that before. Yeah. I think that's such a, such a special quality of being human that we bring in so many of our biases and our stories and our narratives and our wants and desires that start fogging up what this data means to the point where the now it's a story and it's all about stories at the end.

Speaker C: I completely agree. And uh, one of the things that I think is fascinating also is video games when we were growing up. Now first off, I understand back then just even getting graphics was a big deal. Right. Uh, but it was pretty linear and all these, uh, the dilemmas were not really. It was just solving puzzles or shooting things. It was pretty basic. Well, fast forward till today and there has been evolution over time. So it's not like it just happened overnight. Um, I find all these role playing games that are completely open ended in terms of what's right and what's not right. Like everything is a moral dilemma now. And that drives me nuts because I feel like there should be a correct answer. And what we're teaching people, even with these video games is that everything is gray. And I think we've gone a little too far because two plus two, guess what guys, it does equal four. You want to make an argument that equals to five. Some people do make that argument because if you've got two knots in a string, you've got two knots in the string. If you add them together, you tie another knot so you end up with five. I mean that's just stupid. But good

Speaker B: story.

Speaker C: But this is what we're doing now is we. Everything becomes so subjective that the truth is just really like what is the truth. Right. And I think that, I think we need to kind of swing this pendulum back a little bit. Um, so that not everything is that kind of open ended.

Speaker B: Right? Absolutely. Talk to me about your mentalism. How did that even start?

Speaker C: Oh, uh, so when I was a kid, uh, I, um, was 10th grade, we went to New Orleans and I saw uh, someone do um, a, um, we went to a magic shop. Uh, my mother, I Still remember, uh, we went to a magic shop and the person who was working, uh, there showed like a magic trick. And I was, oh my gosh, this is so interesting because I like solving puzzles. That's just been an inherent thing. And I like to know how things work. And so I begged my mother to buy that, uh, for me. So we bought the magic trick and uh, I went home, uh, and I played with it and I showed it, uh, at school to some friends. And people loved it. I started making more friends, which at the time I thought that they were more. I thought that they were wanting to be friends, but in retrospect they just wanted to see the magic tricks. But as a kid you don't know the difference. Right. Um, and so because I had that encouragement, I started doing more magic. I read books, went to library, Barnes and Nobles, all that stuff. And then, uh, fast forward, um, to word to I would say probably 2018ish. Um, I remember it was a couple years before COVID Um, the FBI asked me to perform some, uh, mentalism because I had switched over from magic to mentalism somewhere before that. But anyway, they asked me

Speaker B: and what is the difference between magic and mentalism?

Speaker C: Okay, so, uh, magic and mentalism. Uh, magic is more of dexterity of the hand and mentalism is more of, uh, mind games. So uh, uh, they're both magic in my opinion. Uh, because you're creating magical outcomes. And I like to think of it in this way, uh, because depending on who you ask, they may tell you that mentalism, uh, is not magic. And other people will tell you that mentalism is um, a subset of magic. Mhm. This is the way that I've come to understand it. Mhm. If you are outcome based and you say, was that a magical experience? Because something magical happened, something you didn't expect, both magic and mentalism do that, in which case they're both magic. But if you're very process oriented and you're like magic is you do something with your hands and you do all this stuff and mentalism is that you just do it all in your head, then yes, they are completely different, um, things, you know. So, um, anyway, I moved from magic to mentalism over time. There's no, you know, uh, some period of time I don't even remember, uh, and started doing more of that. And the FBI asked me if I could do some, uh, mentalism for one of their events. Uh, and I said okay.

Speaker B: The FBI asks casually people to come and do that. Yeah,

Speaker C: that's right. They just open call, right so,

Speaker B: um, you saw the Facebook post, signed up.

Speaker C: Um, yeah. And so they, and they said, but can you make it relevant for, um, FBI people? And I was like, what. What is mentalism for FBI people? And, uh, they said, well, we're hoping. We don't know. We're hoping you can, you can tell us. And I said, well, I don't want to look like a fool. So, no, I declined it. Um, so then Covid happened, and people were not hiring entertainers, because before that, I really just did mentalism. Uh, you know, I only did that, uh, or I only did security work. I didn't do both. Right. I'm sorry. I didn't do them like together. I did them in parallel.

Speaker B: Mentalism was a passion. Passion. It was a hobby. Passion. And then your work as a security professional, that was the day to day.

Speaker C: That's right. And so, uh, I thought, well, since I've got all this time now, how do I create something that no one else is going to be able to do? And I thought, well, what do I know or who am I and what can I do that other people would find it hard to replicate? And, uh, I came up with two things. One is security, and the other is mentalism. I'm good at both separately. Well, what happens if I combine them? Uh, so I spent probably a year and a half building, uh, just a prototype presentation. Uh, and I performed it, uh, for. Because they asked, the FBI asked me again after Covid if I would do, like, an event thing. And they wanted something just super. Or actually I said I wanted to do something super short, um, if they wanted me, uh, and I would just do it for free because it was new. I didn't know what was going to happen. Um, and I just wanted 20 minutes. Uh, and so I, uh, did a interrogation themed mentalism presentation. Which was

Speaker B: that on Zoom?

Speaker C: No, it was in person. It was in person. So I said, you know, it is all intended to be humorous. This is how an FBI agent would do an interrogation. Um, and then this is how a mentalist would do an interrogation. Uh, and, uh, people loved it, so they thought that was awesome and they wanted to see more. And so I thought, oh, okay, well, I guess I could, um, build, uh, a little bit of something. And I don't know how long you want the story to go on.

Speaker B: Please continue. This is for sure going to be my favorite part of the talk. Please.

Speaker C: Okay. Um, so then, so then, uh, put that aside. Right? So that's how I created something. But then how did it become something? Um, so I went with, um. So my wife is a doctor, a medical doctor, uh, super sharp lady. And, uh, we went to one of her, um, business, uh, events. You know, like, you know, they have these Christmas parties or whatever, and, um, and I just like trying different things. Right? So, um, when someone asked me, what work do you do? Uh, rather than say, I'm a security specialist, I said, I'm a mentalist or a magician, I actually said, magician. I said, magician. And all of these. Imagine all of these PhDs and medical doctors, uh, their eyes kind of go into the back of their head, and they're like, oh. And then they just completely lost interest in, uh, talking to me. Um, and then on the drive home, my wife said, would you please stop telling people that you're a magician or medalist? And I said, huh, huh. So I did what everybody would do, um, is I bought business cards that said mentalist.

Speaker B: Of course. Absolutely. We'll show them.

Speaker C: That's right. And so I had, at this point, two business cards. One as a security and one as a mentalist. I went to another one of her events, uh, and people, uh, asked me, what do you do? Well, I just tested my theory, and I. For half of them, I told them, I'm a. I gave them my business cards as a security guy. And then the conversations went as you expect. Right? Uh, and then, uh, for the other half, I said, I'm a mentalist. And, uh, kind of went a little, you know, just a lot less interested. Um, but then, um, two of those people at the same party talked to each other about me, uh, for whatever reason. And, uh, then they came over to me and they said, hey, you told him that you're a security guy. You told him that you're a mentalist. So which is it?

Speaker B: Yeah.

Speaker C: So at this point, I was like, huh. Um, wasn't expecting that to happen. Um, and so I immediately responded, oh, uh, I'm both. I'm a security mentalist. Boom. And you know how sometimes, like, at a party and there were probably, like, a couple hundred people here, the whole room gets quiet, and everybody turned and looked at me. So, security mentalist. What is that? Became super interesting. And then they asked me, well, what do you do as a security mentalist now? Because I actually had. I just made it up. Um, I decided to just say. I decided to just tell security stories. Like, oh, just talk about hacks. I didn't actually answer their question. I just started talking. I just started giving stories.

Speaker B: That works.

Speaker C: And people just loved it. And then, um. And then. So then we we went home and my wife wasn't sure what it. Because she wasn't really sure how to respond to that. Um, but she did say that, you know, that's ridiculous. A security mentalist. That is ridiculous. But she wasn't upset. She was just like, that's ridiculous. Um, well, anyway, um, the next day, um, I got a call, uh, from somebody, uh, that said, hey, can you come do security mentalism for us? And I said, what? Well, first off, what do you think security mentalism is? They're like, well, there are a lot of stories here and we like that. Um, it could be something that we use. But, uh, we're hoping that you can help us understand a little bit better, uh, about what it is that you do. Uh, and so of course on the spot I did what people would do, which is make shit up. Uh, so I remembered this presentation that I gave, uh, about the interrogation and I talked about, I said, this is an example of what I do. And they said, well, we love it. Can you do that? And at the time I said, not really. Um, I'm, um, too busy. Which is true. I had too much stuff going on. Uh, so that kind of went away. Well, I got two. One or I got another call the next day for something and then the following day I got another call. And this was where it got interesting. This person said, hey Gary, um, we'd like to hire you, uh, to do security mentalism for us. And I said, uh, when you say hire me, like, what do you mean? Like full time job or you mean like a gig thing? They're like, no, no, no, full time. And I'm like, uh, well, what would I do for you? And they said, security mentalism. And I was like, well, help me understand what it is you're trying to achieve. And he said, well, we like being at the forefront of information security. We've never heard of security mentalism before. We need that. So I said, I thanked, um, them and I said, no, I'm not looking for a full time job. But that was when I thought, this is something,

Speaker B: this is something,

Speaker C: this is something. So, uh, then I built out a whole show. Uh, and then, uh, I don't remember exactly what happened, but some people started asking me for shows and then I started just doing the whole show and then it just sort of grew from there. But it was initially because my wife told me that I couldn't tell people that I was a magician.

Speaker B: I love it. I love it full circle. And to date you perform, uh, sometimes in front of more than a Thousand people.

Speaker C: Yeah.

Speaker B: Right. And, uh, and you're a ciso? Yes, of an organization that has dozens, uh, of thousands of people.

Speaker C: It's got uh, 50,000. Yeah,

Speaker B: right. Uh, and uh, so anybody who knows, uh, the role of CISO changes per organization. But naturally a big part of a CISO role, uh, is people, people, uh, process technology. The more people you have, uh, there is additional challenges there. So it just speaks that you're doing both of these things at a world class level, which is super interesting. But tell me a little bit more about the shows themselves. So what is security mentalism? I'll go back to that same question.

Speaker C: All right, well, I've actually defined it now, which is security themed mentalism. So in a nutshell, it is entertaining education. That's what it is. So I do a, uh, one hour presentation or kind of whatever, but I'll just say one hour, uh, one hour presentation where I teach, uh, about cybersecurity and then I perform mentalism. So a, ah, very straightforward example would be, uh, I would talk about how vishing, uh, works. So vishing, as you know, um, is fraudulent phone calls. So if I were to call up the help desk of a company and try to reset someone else's password, or if I just tried to call somebody up and try to collect money, or I send, you know, I call and try to get them to pay me, you know, whatever, right? So using the phone or some other voice tactic. And I basically teach and say this is what a bad guy would do to steal from you. They would, um, speak in this way. They would have a particular cadence. Um, they would try to, uh, take up some of your head space by trying to embarrass you or maybe make you upset so that you're not thinking clearly. And I go into urgency. Exactly, urgency. Um, I basically talk about a lot of the psychology that goes into basically vishing somebody. And it's a lot more detailed than I think that most people have ever heard of before. So first off, that's super interesting. Uh, and then the mentalism part comes in when I basically say, okay, well let's do it. Um, we get people in the audience to randomly pick phone numbers. Uh, I just do it once, so pick a phone number. Uh, and then, um, we call it. And then I attempt to basically do whatever I can do with that person online, right. Depending upon whoever picks up. Um, and then the idea is using these tactics that I've just taught, um, I can actually perform it real live so that you can see how effective that it is. Uh, so that's what the show is about, is I have a number of different topics that we go through. They're all very topical. I change the stuff probably every couple months. Um, and then whatever is kind of the latest thing. I talk about kind of what happened or what the issue is. Um, and a little bit around the defense side, depending upon the client, do they want me to talk about defense or offense? Um, and then we do like, a mentalism thing where I kind of demonstrate that this stuff is not just theoretical. Um, but that actually works.

Speaker B: Wow. So what are some of the hottest topics today?

Speaker C: Some of the other topics, uh, obviously, AI is a huge one, which we can talk about. Um, but, uh, another one which is just really common for all the times is really passwords. Um, people guess people, passwords, things like that. One of the things I do is I talk about statistics of the most common passwords, uh, and, uh, how we pick passwords as well. Because, um, most of your audience, if I were to ask you, figured out what password you want to use, and then you just identified that the website forces you to have a special character

Speaker B: exclamation mark

Speaker C: at the end, you know, And I did. I do this for, like, an audience of, like 100 people, uh, who are not IT people at all. They're just completely, you know, all walks of life. And when I ask this question, you hear them say exclamation point. And everybody knows this, right? So, I mean, if everybody knows this, you know, there's a problem, right? Um, so that's a topic. And so then one of the routines that I do, I mean, there are a lot of different things that I can do with that, but, uh, would be I have a book. Uh, and then I have them open up the book to any random page. Uh, and then they sort of mentally think of a word that's on there, and then I guess what word that it is, right? And that's all just statistics. Um, because I've read the book, I know roughly the words that are on different parts of the pages. And when I see you open it, I can kind of figure out kind of where. Where you might land. And then I, you know, in one sentence, I can probably get about five of those words in, you know, so if I know that your word is probably one of these five, I just say all five words in the same sentence. And then your eyes will, like, tell me which of those words it was. Um, but anyway, kind of giving away some of the secret. But, um. But the point is, it's like it's all kind of tied together. Um, so that's just another example of one of the things that I do. But I've got a lot of different modules, different things. And of course you've got AI where today, you know, you can talk all sorts about how, um, computers, they can predict what it is that we want. Right. And when I do a mentalism routine, like, truly, you do have a free choice. Like, you really, really do have a free choice. You can choose any of the, any of the options. But the thing is, is like, you're going to, in general, you're going to kind of pick what I kind of predict that you're going to pick. And there are a lot of different techniques, a lot of different things because we all kind of think fairly similarly. Um, and so using AI so like with Netflix now,

Speaker B: when you say that, we think very similarly because, you know, humans are all different and we, you know, we like different things, we grew up in a different way. So what do you mean by the fact that we, you know, we think similarly.

Speaker C: Um, so you want to try something?

Speaker B: Yes, of course I do.

Speaker C: Okay, So I don't know how it's going to work with the, uh, with the, um, with the mic here, but really matter. Um, this one, let's make sure this is set up. Yep. Okay. And I'll show you, I'll show you these cards in a moment. Um, so you'll just have to vouch for it and tell, uh, folks what you see. Um, I've got here a number of different cars there. Uh, I have 52. You'll just have to take my word that they're 52.

Speaker B: I can see that it's about 52.

Speaker C: 52 red, uh, cards and one blue card.

Speaker B: Yes.

Speaker C: Okay, so a lot of different cards. This card is a blue card. This is my prediction.

Speaker B: Okay.

Speaker C: Of the card that you're going to pick. It's a duplicate of one of these 50, uh, two, um, cards. So as you can see, a lot of different cards. They're all different. All

Speaker B: different cards.

Speaker C: All different cards.

Speaker B: Absolutely. Um,

Speaker C: okay. I'm going to try to do this with the mic here. So, um, I want you to take a look here.

Speaker B: Yes.

Speaker C: I'd like you to just go ahead and, um, see if anyone kind of, if you were to pick a card, just go ahead and point at any card that you kind of like,

Speaker B: Write this one,

Speaker C: this particular one.

Speaker B: This particular one.

Speaker C: This specific one.

Speaker B: This specific one.

Speaker C: And you don't want to change it whatsoever. You've got your finger on it. You do not want to change this specific card.

Speaker B: Can I change it?

Speaker C: You can. Or you can keep it. What do you want? I don't want you to feel like I'm influencing you. Would you like this card or would you like a different card?

Speaker B: I'm gonna go for the one right below it.

Speaker C: You want to look at this card?

Speaker B: Uh, this card, right? Yes.

Speaker C: You like this card?

Speaker B: I do.

Speaker C: Do you want to change?

Speaker B: No, I, I, this is my card.

Speaker C: You can see that I'm not changing your card.

Speaker B: No,

Speaker C: this is your card.

Speaker B: This is my card. This

Speaker C: is your card. I'll show it to the camera. This is the card.

Speaker B: There's no way that's gonna be the card. But. Okay,

Speaker C: that's fine. That's fine. You've got 52 choices.

Speaker B: Yes.

Speaker C: The thing is, you could have picked any of those cards. And I'm not even going to touch that blue card. I'm going to have you lean over to that. But first off, tell me, what card was it?

Speaker B: Three of spades.

Speaker C: Oh, really? Yes. Three of spades.

Speaker B: Yes.

Speaker C: Go ahead, take a look at that card.

Speaker B: There's no way that it's going to be the three of spades.

Speaker C: Well, why don't we prove it?

Speaker B: Because I could have taken the other card right above

Speaker C: it. You could have, but you didn't.

Speaker B: And that was not the three of spades. I saw. We,

Speaker C: uh, we saw.

Speaker B: All right, I'm going to start with this. Wow, that's a three of spades. Wow.

Speaker C: One of the fun things is, and people always say, yeah, but I'm a different person. Yes, you are a different person. Um, but the thing is, uh, the whole point is, based on who you are, you're going to make decisions differently. Uh, and I'll explain this with some examples in a moment. Um, what I need to do is I need to profile the type of person that you are so that whenever I perform the routine, I'm also manipulating you in a good way, in a fun way, uh, to do what I want you to do. And I change the words that I say. But,

Speaker B: Gary, I could have chosen the other card.

Speaker C: You could have, but you didn't.

Speaker B: But I was very close to.

Speaker C: You were very close to. But you didn't. So I'll tell you this. Like, there's always the naysayer. Um, and you know who that is, because they're standing in the background, you know, in a group, and they've got their arms crossed. They're looking at you like this. And then they got their nose turned down, and they're Squinty eyed. And those people, I'm telling you, they're the easiest. If you do this routine for them and you're like, hey, uh, you want to help out? Like don't say you help out, just hey, do you want to help out? Like you ask it kind of like this, but kind of you're not sure they're going to say ah, ah, yes, my turn. When you spread out that deck and you're like, go ahead, point any card, any card. They're going to say any card. You're going to say yes. They're going to point at the top or the bottom card. Guaranteed that's what they're going to do. And if you want to do a purely psychological one where you're not, don't even have any cards, um, and you're like, I want you to, I want you to think of. Well, first off, for a normal person, if you said I want you to think of any cards, uh, acer, king, whatever. Right. And your uh, friend, uh, also did this, uh, Jahar, she picked up a card,

Speaker B: seven of diamonds. You picked?

Speaker C: Yes.

Speaker B: That's how strong it was. And that was what, a month ago. And I had a lot of things happening since then. And I still remember the card that you chose.

Speaker C: And that's what's so great about this, right? And what's so great about security mentalism is that you remember the, you remember what I taught. Because, because this is so memorable, so difficult to do. So if you do it, a normal person will pick card like that, somebody who's trying to mess you up and you do it exactly this way. Hey, uh, pick a card, any card, any card you like. And they go, any card. Choke. They'll say joker. I guarantee you they will say joker. It's actually easier. You just have to. Well, I say just the point is profile the person and then you can modify what you do so that they do what you want. And there. Right. So I was initially when you picked that first one, if you had gone with that, I would have been wrong. So I always have two chances though. Because I asked you whether you were wanting to make a change. Mhm. I knew where the car that I wanted you to pick was. Um, maybe when I spread it out, I didn't spread it out exactly perfectly. Um, but regardless, I had a second chance. You can ask a question in such a way to where you know they're not going to change their mind. Would you like to change your card? You want to change your card. Two totally different approaches. You can change Your card. If, if you want, your feeling about what you will do is going to be different and you will go on that instinct. And that's what I manipulate, that's what I take advantage of. So in this particular case, I was going to be wrong until you changed your mind. But then I asked it in a different way.

Speaker B: How does all of this play into cybersecurity in the day to day? So this phenomenal in shows and entertainment and education. How does this work in your own daily life as a ciso?

Speaker C: Uh, I'll give you a couple examples. Uh, one of the, uh, things is we changed our password policy from, um, eight characters to 12 characters. Um, your minimum password length now needs to be 12. As you can probably imagine, most people probably wouldn't like that.

Speaker B: Not at all.

Speaker C: I had no problems at all. Um, people accepted it, they were fine with it. Um, part of it was because, uh, and I did many, many things. But I'm just going to explain this one thing that I did. Um, I had these mugs made that had the company name on one side, and then on the other side it said, here we do eight. And I crossed it out and said 12, uh, uh, characters for our passwords. And then I had like a little puzzle, um, below that that to this day nobody solved. Um, well, I don't. It was sort of a hidden message. Uh, they don't know that they're supposed to solve.

Speaker B: They don't know that there's a game.

Speaker C: They didn't know that there's a game. Um, so anyway, I had these cups made. And, uh, one person had come into my office and said, hey, Gary, I'd like to talk about this password link thing. Um, and I knew that they were going to complain about it. Uh, I. Off the shelf, I took off the shelf, I gave them a mug. And they looked at it. They're like, what's this? They looked at it, they laughed, and then they forgot why they were there. And then they left. Never complained

Speaker B: what happened there.

Speaker C: Uh, it just short circuited their mind. I mean, like, who does that? Somebody comes into your office ready to fight, and then you, like, disarm them completely by, like, giving them a gift that's funny and relevant.

Speaker B: So that is to say that the way you approach these topics with mentalism and the entertaining aspect of it drives people closer not only to the meaning and the rationale behind them, but also just their own cultural experience with it.

Speaker C: That's right. And I'll give you one more example and then I'll kind of tie it together. So, um, you know, imagine this, right? And I did actually do this. Um, so, uh, when people have board meetings, they have, uh, they usually have catered lunch. Uh, and so, um, you know, you find out ahead of time, I found out ahead of time, kind of what they were having or whatever. And, um, I had fortune cookies made. And you can do that, you can have custom fortune cookies, uh, and you can put a message inside and you can write whatever you want. So I ordered these cookies and then I dropped them off at the different people's desks or whatever. Um, because, anyway, um, then just imagine this, right? The CFO opens their fortune cookie after eating lunch. And ah, they open it, they're not expecting anything. Um, they read it and it says, today is a great day to increase the security budget. I mean, that just gets a laugh. And everybody gets something that's relevant to them. And this is where you're understanding the psychology. You can write something custom for each person,

Speaker B: right? Um,

Speaker C: and then they're laughing, they're having a good time, and they're thinking, hey, this guy, somebody I can work with, right? So I get invited. They always say, security is not at the table. I get invited all the time to the table. Um, you know, and that's because they like having me there. You know, you could argue, hey, you know, you're not, you know, you're acting like an entertainer, but like, hey, whatever gets the job done, right? And it's not a bad thing, right? Like, people appreciate what it is that I'm bringing to the table, which is a bit of entertainment, but then also, like, you know, I'm actually bringing security stuff, so, like, I can actually improve and enable the business. So just getting at the table so you can do all of these things. And people, they like it because we're human.

Speaker B: I mean, one of the things that I hear from CISOs all the time is how difficult it is not to do their job, which is to secure the organization, secure their people, their process, their technology. But then to actually get buy in from the leadership, from the executive, from the board. Because a lot of the time the things that they're defending against, the solutions they have to bring in, the security that they have to do is not easily understandable or relatable to the other positions, right? A CFO doesn't necessarily understand why you need to spend another half a million dollars on, uh, this new XDR program or this insider threat program. The CEO doesn't necessarily understand why DLP is important and that the board is also. So it's really interesting how you translate for them through mentalism, through these different things to, uh, make it relatable.

Speaker C: Yeah, I think it's really more of the thinking process. So I get team members all the time that say, because I ask them, hey, can you help me draft up some stuff for the board? You know, help me draft up some stuff for this presentation? You know, whatever. You know, whatever it is. Right. And initially, the questions I always got were, um, well, Gary, I mean, I can't do this because, you know, I don't know John Smith, I don't know Jane Smith. Like, I, you know what? How do you expect me to do that? And I'm like, hey, I haven't met them either, you know, and, um, you know, the thing is, is like, but you actually know a lot. So if I were to ask you, what, what does a CFO care about? M. What would you say?

Speaker B: Making sure the company is hitting budget and is planning properly for the next year.

Speaker C: That's right. That's perfect. You know, and, you know, and if you were an intern and you just said money, that would already be correct.

Speaker B: Sure.

Speaker C: Right. Um, right. If you tell somebody, if you tell a compliance officer, what do you care about? You know, I mean, the answer is going to be obvious. Right. The chief legal counsel, what are they going to care about?

Speaker B: Sure.

Speaker C: Obvious. And most of these people, especially at large organizations, they've written books, they have articles published, they are on podcasts nowadays. Right. Um, just like what I'm doing here.

Speaker B: Yeah.

Speaker C: If you listen to any of them, you have an idea of what they care about. Sure. It's like talking to them. Right. So I tell my team, like, there's so much information out there, and you can go at different levels. One is just like, high level. What would any CFO care about? You can read all these general articles, books, whatever, textbooks. The next level is what does people in this industry, whether it is hospitality or transportation, whatever, um, what do they care about? And that'll get a little bit more specific. And then you can be like, okay, well, what does my organization's CEO or CFO or COO care about? But at each level, you can. You actually can do that without talking to anybody. And once you understand that, because guess what, if I'm going in for a presentation that takes 15 minutes to make, it's going to be high level. I'm not going to be teaching you super detail. I'm not going to tell you. I'm not even probably going to explain what XDR is. I'm just Going to say it's some security thing.

Speaker B: Yeah.

Speaker C: Right. Um, you have some. For responding or whatever. Right. So you actually have so much information and when you understand that, and then you read their bio on LinkedIn and you know where they came from, if they came from security and defense, you know that they actually are going to be your, one of your supporters just off the bat. But if they are in manufacturing where security is not as strong, I'm not saying they won't support you, but I'm saying that they will care about completely different things. They're probably going to want to see something, something tangible. We'll bring them something tangible to see. So everybody's going to see it from their own perspective. And if you profile that, then you actually can do incredibly well and do a presentation without ever having talked to the person.

Speaker B: Yeah. And you know, when I think about, you know, what security really is about within organizations and what attackers are trying to do. Right. They're looking at systems that were designed by humans for now. It'll change soon. And they're trying to circumvent them. So circumvent the way that the humans have designed their thinking models, whether it's passwords with the exclamation mark at the end, all the way to how applications are built or how databases are protected, uh, or how information is transmitted or how uh, payments are being done, or how hiring gets done in an organization. Right. It's all about figuring out how does a system work and then designing a clever mechanism around it, uh, which it's a lot of, you know, correlated to mentalism and the work that you do.

Speaker C: Yeah, yeah, exactly. It. You can do that, you can do that, um, for your next career.

Speaker B: Exactly, exactly. Thinking about it.

Speaker C: Yeah,

Speaker B: absolutely. And what drew you to, um, the more cybersecurity elements initially, uh, information security, identity fraud. How did you get looped there?

Speaker C: Oh, that was just, I would say pure random luck. Uh, so I was working.

Speaker B: It's nice that you still consider it luck and not, uh, and not something negative, but good. I'm hearing both sides.

Speaker C: Yeah. Uh, well, this has been, uh, my life now and I've really enjoyed it. Um, I was working in uh, London, uh, at the time, uh, and wanted, uh, you know, um, my wife and I, we got married and wanted to sort of settle. Um, uh, and um, I was looking for new opportunities, uh, in the U.S. uh at time. And this particular job description, which, uh, was the anti identity fraud thing that I kind of mentioned earlier, uh, was one of the job descriptions that I read and it was a lot of puzzle solving. Uh, that's the way I interpreted it. It didn't actually say that. Um, but I thought that was really cool. Uh, so I applied for the job and fortunately they hired me and that's how it got started. So, um, as part of that doing the identity, uh, fraud stuff, there were customers of ours, uh, at that company who wanted, uh, wanted cybersecurity. Like they said, is your solution secure? Right. And then we were also making these kiosks that had, you know, that had, that took payment and they said it has to be PCI compliant. I had no idea what that was like. What is this? PCI compliance? Right. Uh, this was, you know, very, very long time ago. Um, and anyway, I had to learn it because our clients were asking for it. So as part of that I got my cissp. Uh, and then, uh, you know, I actually really enjoyed doing kind of that combination. I had to do some of that, some of this. My job was still the anti fraud stuff. It wasn't cyber security. Um, but then when my wife got a new job and we had to move again, um, uh, I shouldn't say had to. We wanted to, uh, try something new anyway. So, uh, when we moved, um, I basically found another opportunity that was purely on the cybersecurity side. But fortunately, because I had so much experience already, um, from the other job, I could make that transition. But, uh, honestly, I think it could have gone either way. If I had done cybersecurity, which is what I did, or if I had done just more identity fraud stuff, I think it would have turned out,

Speaker B: yeah,

Speaker C: you know,

Speaker B: and so what is really your role today as a ciso? When, when you look at a company like the one that you're at today, so you have 50,000 employees and, um, you're, you're, you're, you're in health care. So it's, you know, critical information. And, um, how does the role of a CISO look like in an organization like this?

Speaker C: I would say it's all politics. Uh, so, and I don't say that in a derogatory way. I'm just trying to keep it like super, uh, high level and understandable. Uh, a lot of what I do is I do advocacy, for example, of information security and of my team. Uh, I do a lot of translation. You know, what is it? What is XDR like, why do we need it? Right. I think about the audience and if they're technical or not, and I think about whether they even need to know about that or whether they need to know the business impact of it. Um, you know, I kind of do a lot of that translation. So very customized news and marketing is kind of the way I think of it is I help people understand what it is that we do. And then of course I kind of, or uh, I do have uh, to look at a, uh, lot of the elements like okay, we're about to start this other business or do this other thing. How can I make sure that that's secure? Right, right. So then I have to make sure that other people understand why I need to be involved. Right. Because that increases the cost to that particular project, for example. Uh, so a lot of it is explaining things and then, and then basically selling. So internal selling, where I'm saying you need to hire us to go work on this project to do these things so that you can have a better product. Right. Of course we don't charge money for that. But like a lot of it is selling. Uh, so you think of it like kind of like the CEO that you are, uh, of a company, uh, and you're doing a lot of explaining to other people what it is that you do and you do a lot of selling. Uh, and then I have to do a lot of compliance work and all these other things too and make sure that the team operates properly. So it's very, very similar. Um, kind of at that kind of higher level. A lot of it's a lot of talking and really understanding what the other person needs to know, what they want to know, what they should know, which are all different, and then how to present that information in a way to where that they will actually do what you want them to do.

Speaker B: Right. And there are so many different things that you could focus on today, as you see. So there's so many different attack vectors and one of the common themes that are coming up in the series is that there's always going to be more attack vectors and more things to do than can be done. Yeah. From a budgetary perspective, from a time perspective and a resource perspective. So how do you manage that? Because that happens before you go and advocate for it and explain it. Right. You have your own decisions to make for how do you protect the organization in today's world, which is becoming more aggressive, more open ended, more uh, open sourced, more technology based, more m. Autonomous based. We have agents coming in now to do a lot of this work. So how do you even think about that as a professional?

Speaker C: Sure. I think that there are really two things that inform the roadmap because a lot of what you asked Was, well, what will the team work on and build? Right. So, um, so you got to look at both the bottom up and the top down. Yes. So the people, especially in America, there's a lot of emphasis on making sure that you're getting the input from the people doing the work. And I think that is very relevant and has a lot of value. Um, on the flip side, uh, you also look at it at a very high level and you say, what does the business need? Right. And those are two very distinct, very different things. Uh, and so what we need to do is essentially, um, bridge the two. So at the top down level, I'm looking at things like trends. I'm reading, uh, particular, I'm reading like news articles. I'm understanding what breaches there are in the industry that I'm having. You know, what are they stealing, what are they doing? Are they going after VMware? That's different than doing vish calls to the, you know, the help desk. Right. Like, what are things trending in the overall quote unquote market. Right. Um, these are things that I may care about. And uh, then also, um, we also have a lot of CISO groups and other things where you can get this information. So anyway, um, we've got that and then we've got the bottom up, which is the individual saying, hey, you know, I think we should do this. Those are usually a lot more operational, um, in nature. And also a lot of it's marketing that they've read, uh, from your big name companies. Right. And if the two happen to marry, Right. So usually maybe 10 or 20% of it overlaps, great, okay, maybe that's an easy, that's what we should work on. Um, and then the rest of it, um, now becomes an ROI discussion. And this is where usually teams really break apart because internally you're going to get basically, well, the individual contributor really wanting this problem solved because that's their daily basis. And then you've got senior leadership saying, no, we can always solve this other problem. And then both sides saying, you don't understand. Right. I think actually both sides do understand, but they may weigh things very differently. And I think the hardest part for security people, and I'm making an overgeneralization, but it's helpful just for the conversation, um, is that there's the, um, roi. How do you calculate that roi? Uh, and I think that there's a very different way of looking at that. So as an individual contributor, you care about doing really good security. So to you the ROI is, well, if you buy this thing, I can now like save X amount of dollars because I don't have to do this thing and my time is worth Y dollars or whatever. Right. And then on the business side, the ROI is calculated as well. If I do this thing, do I actually get more patients who are going to pay me more things? Uh, or do they not care? Uh, so in the end, um, those two, you're never going to marry them.

Speaker B: Sure.

Speaker C: And so unfortunately it then becomes, uh, how much time? Because in the end, the senior leadership is going to be the one that decides how much time they spend to convince the other side that that's what they need to do. Uh, but unfortunately, this side will always, in general, quote, unquote, win because that's what the company is going to pay for. They don't care that John Smith worked an extra shift over the weekend because guess what? So did Jane Smith on some other team.

Speaker B: Yes.

Speaker C: Right. And that didn't earn them any more money. That's just a cost center.

Speaker B: Right.

Speaker C: So until you can sort of couch it into sort of the, um, until you're actually making money for business, it makes it super, super hard.

Speaker B: But naturally, um, the security program in organizations, they don't make money for the business. Right. They help prevent risks or mitigate risks.

Speaker C: Yes, that's right. Um, fundamentally it is a cost center. So then it just depends on how well you can articulate, um, the cost of a breach or all these other things, which are kind of a negative way of looking at it. Sure. If you are a business that actually maybe does a little bit more of, um, uh, that maybe works with other businesses. So for example, the company that I work for, um, it has a program where it basically rents out the ehr. Uh, so Epic is the name of the healthcare, uh, system where you can put in patient information, all that. So like if you go to a doctor, um, there's a very high probability that they're entering that information about the diagnostics and all that stuff into Epic, uh, which is the electronic healthcare record. Um, so anyway, uh,

Speaker B: the more secure that is, the more likely it is you'll be. Right. And

Speaker C: that's right. So the more secure that it is then the more likely you will have clients.

Speaker B: Sure.

Speaker C: So if you can tie it to that, because they actually get. The company gets paid to do that and you're able to say, well, for every new company it comes on, they pay say $10,000 and you take $100. Right. Then that can be a way of articulating it.

Speaker B: So one way is to articulate how roi, um, is understandable through the lens of M. How does this make us a better product, uh, whether it's in optics or in reality. And how does this then impact the other businesses choice in working with us? Another way is to actually articulate what would be the cost of a breach. That's

Speaker C: right.

Speaker B: What would be the cost of us hiring somebody that we don't intend to. What would be the cost of us transmitting personal identifiable information of patients, uh, because of some leak? Right. And then playing that game. And how do you see changing over the last few years? Is today's game the same game that we've been playing before? Is it changing at all with the changing landscape?

Speaker C: Yes, it's definitely been changing. So, um, you know, stuff changes from year to year, um, and sometimes even within six months. Uh, and I would argue that over time, especially with the acceleration with AI, it's definitely getting shorter, uh, because the trends change faster. Uh, I would say that cost reduction, uh, especially since from COVID for a few and plus a few years from there, so say um, 2020 until say uh, maybe a year or two ago, um, cost reduction was really a huge focus. Um, but now companies are wanting to grow, they're wanting to increase so they're willing to invest a bit. So if you couch and you change the way that you articulate the same information, then they're more likely to want to buy your things if you're aligning it with say revenue generation. So I always tell my team like, hey, you know that template that, what you wrote last year, that was good for that time. But if you're actually going to want to buy that exact same thing today, you actually need to write it in this other way because that is what the organization cares about. And you know what that is because you know what, like the different, um, you know what the strategies are. So if you, because that's all published, like the CEO will say, hey, next year our strategy is going to be xyz. And like every year the CEO of every company has this big, big brouhaha. And I think that most people just kind of roll over their eyes and they're like, uh, yeah, okay, whatever. But actually if you pay attention to that and then you align it to those things, it's actually much more likely for you to get past because unfortunately budget doesn't always go to where it should go. It goes to whoever aligns it the best with the messaging.

Speaker B: Yes.

Speaker C: And that's where it goes.

Speaker B: How does that fit with startups? So you know, young startup over here. Um, and, um, cybersecurity is known for having a plethora of startups that are approaching companies to do design partnerships and being early customers. A lot of times they're coming in to solve either a novel problem or an existing problem in a different way. Sometimes it requires a company to invest new budgets, sometimes it's reallocating existing budgets. But one of the things that I've been really curious about is from an entrepreneur's perspective, where we are not in the enterprise seat. Right. Um, we are not getting that CEO memo. So it's hard coming into these interactions, knowing what those strategies are and where the ROI is. How do startups, the really successful ones, do you see working with CISOs like yourself to really find that fit?

Speaker C: I think they have to invest a lot of time, uh, into understanding the individual organization because unfortunately, selling into these organizations and you can see this with a lot of businesses, like, they have account executives and they'll have maybe eight accounts, and you're like, eight accounts, and that pays for their whole salary for the year. Um, and like, they're not necessarily even selling to all eight every year.

Speaker B: Sure.

Speaker C: Because it takes that much work in order to make that sale. Now the sales are usually a lot higher. Right, sure. Um, and, you know, in terms of dollar amounts, um, but. But they really need to understand every company, and the only way to do that is to be able to talk with the person. Now the next question is then, well, how do they even get to talk to the person? Right. Well, that also depends. Right. So in this particular case, you, uh, came highly recommended, and that's the way that it works. A lot of times is, like, you come highly recommended because someone I know knows you. Um, but if that doesn't happen, then you really have to understand at least the industry. Right. Because I really dislike it because I get a. I get about three or four vendor calls per hour during the workday. Like right now, if I looked at my phone, I, I easily have several. Since we've started talking. Right. Unbelievable. There's just so many, like, I can't respond to. All that would be what I did for my job, if that's what I did. Right. Um, and you know what? I, you know, I get all these emails and, like, the more specific that it is to my organization, the more likely I will actually respond. I will actually respond about once every two months because I, uh, just on average, like, it's not like I'm sitting there and like, now's the day, you know, it's like, I'M just saying, like, on average, somebody gets it right every two months. Somebody I did not know. Uh, and I'm very, I truly am very open, you know, but, like, if I got to educate you, because I see your email, I'm like, you know what? You probably could solve my problem. Seem like a smart guy kind of, right? But I'm going to have to sit and I'm going to have to spend 30 hours with you. Guess what? Not going to do it. Um, I got enough to do. And really listening whenever, you know, there's a difference between showing that your solution is good and really, you know, if we're already having the conversation, we already want something from you, right? Like, we want your product or whatever. We're at least exploring it, right? Um, you don't have to sell me your product. And I actually tell this to people all the time. Like, you, uh, already have my interests. We're here because I'm interested. Right? But what happens is you got to understand how our environment works. And that includes things like, okay, who on my team is going to be operating it, what level are they at? Or, you know, are these really young people professionals? Like, as in they haven't worked in this before and they're gonna have trouble, like, even just showing up to work on time, you know, I'm not meaning to imply that, you know, people do that, but I'm just saying, like, you have to understand what are those challenges that are gonna be there? Help me solve the problem, not help me solve the problem that your product solves. Let me be really, really specific. So if I buy your product and it sits on the shelf, that's useless to me. So if I have a vendor that comes and tells me I've got this product, and, um, it can identify all the fraud, 100% can do that. Okay. But if I've got vendor B that says I can identify 60% of it. But here's how it's going to work. Um, on Monday mornings, you're going to get a report. John Smith is going to look at it. We've met John Smith. John Smith needs a lot of training. We will dedicate two weeks of training to help him understand how this works. He will be trained up to this point. Uh, and then it passes off, and then Jack's going to do it. And then at the end of the month, you're going to get this report. We're going to look at it because we know, generally speaking, you should be getting 300 hits per month. If you're not at 300 hits. There's probably something wrong. We're going to drop in. Michael. Michael's going to take a look at it. He's going to be doing these things. This is how you're going to get your ROI out from this. You're solving my problem. The other one is you solved the problem you identified, but you didn't solve my problem. And then

Speaker B: the big difference. Huh? Huh? Huge difference. You're solving this problem that you've identified in a category level. You're not solving my own organizational problem.

Speaker C: That's right.

Speaker B: Which includes people, process, technology.

Speaker C: That's right,

Speaker B: Everything.

Speaker C: And so you probably run into that.

Speaker B: Of course.

Speaker C: So now I'll kind of finish this, but I'd love to hear your thoughts. Um, so then another element, and this is just an example, but it's a huge example, is procurement. Every organization has a procurement process. At the large enterprise level. They all have it. You have to understand the way that it works. And a lot of startups, uh, although on the one hand they're kind of open to learning, but on the other hand they oftentimes they just don't. They're just so far away from me understanding. It surprises me that people don't understand the difference between a PR and a po. Like, how can you sell to a large organization not to understand the difference? And if you understand that, uh, each company has gates that have to go through. And, uh, you know, for example, if I love, for example, your product and I want to buy it, guess what? I still got five other people that have to approve it. It's not up to me. Stop selling to me. I need you to help me get those five other people on board. I don't necessarily want you talking to them because that's my job, but I do need you to help me do that. Now, I'm not going to sit there and give you a download. And it kind of goes back to earlier conversation where if the cfo, dude, you should know what a CFO cares about, Give me the slide that I can just press forward and send it to the cfo. And the closer that it is to where I don't have to make any modifications, the better. So understanding that procurement process and who are all the approvers, and not everybody's going to be so open with you because they think it's a negotiation game. And it's true to an extent it is. But the more that you understand and show insight, the easier it is to want for me to want to do business with you. And if you understand for Example that I'm required to have three bidders on the project, then you understand that I'm going to have to ask for two other bidders to bid on the project. Now, you can try to manipulate that, and depending upon how friendly that, you know, we are, for example, you can say like, hey, Gary, and this is what some people do. Like, here are the requirements. Here's how you should structure your rfp. You know, you walk away and guess what? That person's so lazy, they're just going to copy and paste it. Sure, right. So understanding how the place operates versus following, sending, follow up. Hey, uh, we haven't heard from you in a month. Um, you know, what's up? What's the status? What's the status? You know, or sending me completely, you know, just. Just like these PDFs of case studies that, yes, again, you're selling me your product. I already want to buy it. How is that helping me? Right? Like, understand where I am in that process and understand kind of your synergy, how you can synergize. So let's say, for example, and these are all totally relevant, um, let's say that I am in a place where I need to reduce my budget. You're in a place of growth and you have investors, and you want to bring that to the table and explain to me that you'll invest in year one so that I buy it, and then the next year I got to pay. But then I'm going to have the budget in there because of the way that our, uh, processes work. Maybe that gets it through better, that's fine. Or maybe it's the opposite where I actually have some extra budget. This happens towards the end of the year. I'm willing to pay you m more today, but less next year. So let's structure in such a way. But I also don't want to get. I also need to get it past, you know, procurement. Right? And they're going to look at and go, m. You know, why is it that you can kind of do this and that? So then now we got to go maybe add a line item in there for, you know, training or something like that. So it looks different, right? Working together to kind of figure out how to get things through the process. Right. It's not tricking people or anything like that necessarily, but those are things that a lot of vendors, they really don't do. They put the onus on. On the ciso. Uh, they put the onus on the individual, and it always ends up with the ciso. So what happens A lot is that the individuals say, I'll get it through. And then they are like, gary didn't approve it. You know, and then you're upset, and then you come to me, you're like, why didn't you approve it? Well, okay, in order for me to prove it, I have a checklist. Checklist wasn't completed. I can't approve it. Doesn't mean I don't want it. But it does mean that the checklist wasn't done. And nobody is helping me with this checklist. Right. Um, and I can't necessarily, like, sit there and tell you, like, do this, do this, do this, do this, because I also don't know your product well enough to be able to say, this is the information I need from you to calculate the roi. So if I can tell you, for example, that our company strategy is to do XYZ and you can figure out how to tie it to that and show me that roi, then great.

Speaker B: What it sounds to me like you're saying is that a huge part of the partnership that forms between any vendor, startup or, uh, big enterprise and a CISO is not only is the foundational layer, is that the fact that the CISO identifies that the problem the startup or the company is solving is relevant for them. But that's mile one.

Speaker C: And

Speaker B: then you have 20 more miles for this marathon. And those 20 miles are now working in partnership the vendor, with the CISO for the vendor to do a lot of the heavy lifting. And the more heavy lifting the vendor can do, understanding the strategy of the company, understanding where the CISO is at along the journey, what is the ROI specifically or how is this going to get implemented into your environment. Right. And this earlier that happens, the better we can go through these gates. And it sounds like you also, as a ciso, have developed this acumen to quickly identify, hey, is this, is this entrepreneur, is this vendor, are they going to be a good partner for me on this journey, or are they going to waste 30 hours of my time just to get to the finish line? And then I'm going to have to waste 30 more hours to actually get this implemented. And guess what? Maybe it's not actually going to work at the end because I had to do all the heavy lifting, but I actually have so many other things I have to do, so I'm not going to be able to do that.

Speaker C: That's right. And I'm going to give you some some more tips because you seem like, uh, a person who really wants to understand.

Speaker B: Absolutely.

Speaker C: And that is actually One of the reasons why we're even sitting here, um, because you seem like someone who genuinely wanted to learn versus the gimmick, which is like, I just want to know these few things so I can get to the next step so I can sell something. Right. Like, whether or not you sell something, I feel like to you is kind of irrelevant. Uh, you just want to learn, love to sell something, but you just, at the very least, you're going to learn something.

Speaker B: Absolutely.

Speaker C: And that's one of the things I love about you.

Speaker B: Thank you. Um,

Speaker C: so

Speaker B: thank you for being so generous with your time here.

Speaker C: I

Speaker B: really do appreciate

Speaker C: it. It's been a pleasure. Um, so, uh, one of the things that I always ask, uh, especially for value added resellers, is I say it's, uh, a very innocuous sounding question. Uh, how many clients do you have? Like, as in you as an individual, not the company. And they'll oftentimes say 5 or 8 or 10 or 20 or whatever. And then I ask another question and I say, help me understand. Um, uh, how. When was the last time you changed your client set? Like, you know, some companies, every couple years, they like completely change, uh, the region that they're in or, you know, whatever. Like that. I ask in a slightly more nuanced way, but fundamentally, Those are my two questions. Incredibly important, because if you have 10 clients, that tells me how much time you're going to spend with me. Um, if you have 50 clients, that tells me how much time you're going to spend with me. I now understand how much time you're going to spend with me. I also know if you're a senior or if you're not. And I know how much seniors earn. I, um, can do the calculation. I know how much money you have to bring in for your job to exist, which means I know how much you need to sell to me in order for me to be worth your time. Second question. When was the last time you kind of changed out your folks? Right. Like, these are all things assuming they don't want.

Speaker B: What was the second question? I don't think I got it.

Speaker C: Oh, how, how, uh, when was the last time you changed your clients?

Speaker B: Okay. Change your clients. Got it.

Speaker C: Yeah. Whether it was because it's a different job. Right. Like some people, they just bounce around different jobs or they're at the same job, but then they change

Speaker B: agent or

Speaker C: change region, change whatever. Right? Yeah. And all of these, assuming they don't lie, Right. These are two questions that you really, they, they should have. They should, you know, you shouldn't. You should have an answer. Two

Speaker B: plus two equals four.

Speaker C: Yeah, that's right. Um, and if they say, uh, two years ago, okay, I now know that I've got a two way Runway, two year Runway with you. Is that what I want? If you told me never dropped any of my clients, that tells me something. Well, you guess which one I like, right? It makes a difference. These little things tell me how invested it is that you will be in, into the relationship. Now, I'm not saying there's not a good place for both. If you tell me that we change every two years, that's fine. You're going to be my transactional guy. You're going to be my guy that I'm going to call when I just want to buy something from Best Buy. That's okay. Because that's easy done.

Speaker B: And there are solutions where that's what you need and you know the solution, you know you need it.

Speaker C: That's right. And for those, I'm going to tell you very upfront, I want your bottom line price.

Speaker B: Yeah.

Speaker C: Because I'm not spending any time with you. You're going to get a quick sale.

Speaker B: Yeah.

Speaker C: But I understand that if you're going to be investing your time to understand my business, to be able to help me get it through all of those gates, that costs you money. I understand that's going to cost more. I get it. Right. But those two questions, they tell me immediately what it is that you can sell to me and whether or not you can charge a premium.

Speaker B: Fascinating. So much of it goes into your own decision making as a ciso. For who do you work with? You know, how is this partnership going to be formed? How successful is it going to be integrated into your team? Um, because ultimately you're, I mean, you're measured by your ability to secure the organization. And that's a factor of your ability to bring in the relevant solutions, your ability to integrate those solutions in a meaningful way and continue show and communicating ROI in a really simple yet powerful way, which requires you to have to spend your time doing that. Which is starting back from my question of what is your role started with. Well, my role is actually to explain to the organization how I'm doing my job in the day to day.

Speaker C: That's right. That's right.

Speaker B: That's a lot.

Speaker C: Yeah, but it's a lot of fun. And I think the psychology, like with the mentalism and all that, it's all part of that. And that's actually where I learned it was. Because if you're Selling to a conference or you're selling to, uh, an organization to do security awareness training or you're doing whatever, right? Everybody actually wants something different. If I'm selling just a very high level to a security awareness team, they want to make sure that I've got good credentials, uh, in security because of that I'm credible, uh, and that I can do a good performance to teach. If I'm selling to a conference, they want to know that I have good credentials, but they actually just want to make sure that the people there are kind of happy, you know, kind of, you know, like something like that. And they also just want to not be fired because they want to make sure that they come back the next year. Right. Unlike an internal information security awareness team. Uh, so they have completely different interests. And for the guy who is, um, doing the conference, they're probably doing. And you can read up on their organization, again, there's so much information you can do without asking. If I look at their company and I see that they do like 10 shows in a year, that's different than if they do 50. And if this one is the biggest one that they do because oftentimes they advertise the ones that they do, then I also know how much time they're going to spend on it and how important it is for them. If it is one of their small ones, they're not going to want to spend a lot of time, um, am I going to be easy to work with and I can give them a turnkey solution. That's what they want. If I've got an information security team that is doing one event in the year, this is spending their budget. Their biggest portion of their security budget is going to you to do your presentation. They're going to spend all of their time thinking about it and they're going to want to make sure that you're good. They want to be involved. They want to know what message that you have. In fact, they probably have their own message. And they want you to talk about a specific thing. Uh, you understand that then you can sell it, and then you can sell it at a premium because you understand that. And you can parrot it back to them and say, like, I'm gonna help you get through all of these gates. These are what all these people care about. And this is how I'm gonna help you do it.

Speaker B: A big part of the big part of the product is not just the solution, it's the process.

Speaker C: That's right.

Speaker B: It's actually getting to the finish line.

Speaker C: That's Right.

Speaker B: That takes real work.

Speaker C: That takes a lot of work. And that's why I think salespeople, good salespeople, have a really, really hard job because they're trying to figure out how to go maneuver and make all of these things and do that.

Speaker B: You know, it's fascinating because as, uh, an early stage startup CEO, that's not, um, that's not what we grew up learning necessarily.

Speaker C: Yeah,

Speaker B: we grew up learning how to build great technology. We grew up learning how to raise money, how to hire the best talent. And then we approach enterprises and it seems like the solution we're working makes sense. We know our technology is awesome. And we measure oftentimes our salespeople and ourselves by how well did we pitch this? And then we end there. And then nothing goes through. Or we ask ourselves, well, what happened there? And oftentimes we don't get the answer for what happened there. At least not a really authentic and open one. And what you're saying now, it resonates a lot with personal experiences, my friends, experiences. There's so much going on into understanding the process and the product is in many ways this partnership that you're forming.

Speaker C: I think so. And I think another thing is also, um, if I may, just unsolicited advice, um, if you're wanting that feedback, making sure that you've actually been a partner and not a vendor.

Speaker B: Right.

Speaker C: Because oftentimes, so I treat people the way that they treat me. And, uh, I'm not to say that, you know, that, you know, vendors have done anything bad or anything like that, but I mean, if they've really gone in to try to understand my business, just like you do today with asking me, you know, questions with a genuine interest in understanding and learning and not to m. Manipulate. Right.

Speaker B: Um,

Speaker C: then I'm going to treat you that way and be honest and open with you. But if you are manipulative in a way that it's like, I'm going to ask you these very specific questions so I can do these very specific things so I can get to this very specific outcome. And I get a lot of people ask, hey, Gary, how was your day? And we all ask this, this is a very. But you kind of know, who cares?

Speaker B: Yeah.

Speaker C: Right. Like, you kind of know that. And so, like, if you don't care, I'm also not going to be super upfront with you because you're going to take that information and then just try to get it through the gate and you're going to be using it to manipulate me.

Speaker B: Yeah, it's like going back to the mentalism, you developed additional intuition as to how people react and how they, you know, through body language, through, through tone of voice, etc. Humans have this intuitive sense when they're speaking to somebody who's authentic and who's curious and who wants, you know, in, In a, in something. In a partnership form rather than an outcome form. Right? That's

Speaker C: right.

Speaker B: Yeah. So I completely see that.

Speaker C: That's right. Just the way you carry yourself with the podcast, I think it's amazing and, and articulates kind of the person that you are.

Speaker B: I appreciate that. Gary, what you told me, the two questions that you asked, uh, that you ask vendors, what are, what are one or two questions that that startup CEOs should be asking you or other CISOs that they meet? What are, you know, those qualification questions to even know, hey, you know, what is this? Where is this heading? What, you know, what's the opportunity here?

Speaker C: I don't know. I think that's a, That's a really tough one. I've never really thought about it from your perspective. Um, I'm kind of just trying to think through the people that I've engaged with and the people that I, um, am open with, kind of what they've, what they've done. Um, I would say if they've done a lot of research before approaching me, uh, and then they kind of understand the organization or they understand me. And I'll say one of my biggest turnoff is when people, Everybody knows I like magic, like, that's all over my stuff. When they open with that as a manipulation technique. That to me is just like, I have zero interest in engaging. Um, so having a really good understanding as opposed to a gimmick, having an understanding of the industry, uh, whether it's healthcare, transportation, whatever, having an understanding of the field, which is security, uh, and then having a genuine curiosity, at least for me, uh, um, to be able to come in and say, hey, um, this is my understanding of all of these things. Uh, is that accurate? Right? Like, so you don't want to be like, I'm, um, telling you these are your problems. Right? Like, that's a little bit too wrong because. Too much, because you don't know. But, um, then also, like, feed me is kind of a little bit.

Speaker B: Absolutely

Speaker C: too much on the opposite. So I think demonstrating that you've done your research yet being very open and authentic, as you said, um, I think that combination. And it almost doesn't matter what you ask,

Speaker B: right?

Speaker C: Like, it almost doesn't really matter. Everyone who Operates at the CISO level. At large organizations, um, they care about. Well, I shouldn't say everyone, but I think a very large number, if not everyone, they, um, care a lot about the relationships. Um, and they want to know who you are. Because, guess what? If I'm having a really bad day because I just got breached, I need you to be on my side and be helping me. I don't need you being, uh, not my problem. Because according to these terms and conditions, um, I need to know that you've got my back. I need to know that you understand my organization so you can deploy people right away. That goes back to how long have you been working with your clients? Um, I need to know that you can be there on my bad day.

Speaker B: Right. In a real partnership.

Speaker C: A real partnership. And then I need to know that you are dedicated. Part of the reason why I think learning is so important is because you, as the founder and as the CEO, you need to pivot and you need to understand what's changing. So if today you can do deep fakes and you can identify deepfakes, you probably can't do that tomorrow because someone else invented an AI thing that kind of prevents you from being able to do that.

Speaker B: Absolutely.

Speaker C: If you're the curious type, you will solve the problem just to solve the problem. Like, you won't look at the ROI and say, if I solve this, I can get three more customers. You're just going to say, no, guys, uh, this is what we do. This is our mission. This is what we do. We're going to do this, and you're going to learn. You're going to make it better. That's how you're going to, uh, win over the CISOs.

Speaker B: And I think that's also what drew me close to social engineering in general. As a field in security, I operated in different fields in cybersecurity, more network security and operating systems. But what drew me really into social engineering was this dynamic nature, was that it really can't be about how we're doing it today. It's about the mission that we're going to have to continue performing to. We're going to have to continue innovating, continue to change it. And that. And if we're able to develop a culture and develop a way of being around that, that in itself will be a differentiator that will. That will stand the test of time. Uh, and that's something that gets me really excited. I want to. The time that we have left, I want to, um, go back to something that we spoke with earlier, you shared something really special and unique about the place that you work today. And it's not in the product, uh, and it's not in the way that the offices look or the way that, uh, salaries are paid. It's really about the culture of the place. Tell me a little bit about SSM Health in terms of the culture.

Speaker C: SSM Health is the most comfortable environment that I've ever worked in. Uh, and I've worked in a lot of places, both as an employee and as sort of a contractor, because I did consulting, um, work, um, to other organizations. So I've seen a lot of places. And I'm, you know, and without disparaging anybody, everybody, every culture has their own pros and their own cons. I would say that SSM Health is the most comfortable place out of all the places, because the people there are genuinely wanting, um, to do the best for the communities. Uh, it is a nonprofit health care, uh, organization, uh, so a lot of hospitals and physician clinics and things like that, and it actually makes decisions to do losses in order to help the community. And I just, I haven't worked at any other organization that is okay with a loss. So as an example, uh, we have, uh, for example, a hospital that earns, I'm just making up a number, $100 million in a year. We will actually deliberately purchase a hospital that loses $100 million in a year, because we believe that if we don't buy that hospital, that that hospital is going to go away. And then all of those other people, all of the people, not just the employees that work at that place, but like, the people, the general public, they have no place for healthcare. So we will look and see in this community, is there a hospital that's there. And if there's no other hospital they can go to, maybe we should buy that one. And to deliberately buy something to lose money in order to help people, that speaks to the type of organization and type of people that we have. And when I ask people, you know, hey, can you do this sort of thing for security? I don't get the rolling of the eyes. They're like, gary, what do you need me to do?

Speaker B: You get holiday cards thanking you for the security awareness training.

Speaker C: That's true. I do get holiday cards. I, I got this one guy who wrote to me, uh, that said, uh, he didn't know me, I didn't know him. And he wrote, I can't believe that I am writing voluntarily, writing a Christmas card to thank the CISO for forcing me to do security awareness. Training. Thank you.

Speaker B: That says a lot

Speaker C: and I think that's just amazing. So it's very. This organization is a very healthy organization from a culture perspective. We don't make all the money in the world. In fact, we try not to. Um, but it is from a culture perspective, just a phenomenal place.

Speaker B: And this is not a smaller. I mean we're talking about a 50,000 person organization.

Speaker C: Yes.

Speaker B: Servicing millions, I would assume

Speaker C: a lot of people. I actually

Speaker B: don't know

Speaker C: exactly how many patients, but

Speaker B: uh, in servicing patients that you mentioned, uh, quite a big percentage of them, more than half are coming in through Medicaid and Medicare.

Speaker C: Yeah, a very large percentage, uh, is, you uh, know, from Medicare and Medicaid, which don't pay as well as like private insurance. So uh, yeah, we, we really focus on the vulnerable and the poor. That is part of our mission.

Speaker B: Yeah. And, and you know, you shared some, some anecdotes earlier which we don't have to get into now, but about how, how the culture works, you know, within and part of the giving as a way, uh, rather than, than the receiving. And, and the uh, a lot of the way that, that most. That a lot. I guess most businesses run, uh, in terms of the priorities. Yeah, it sounds like here the priorities are a little bit different and, and that speaks volumes. Uh, it left me very inspired thinking. Wow, okay, it could work that way. You could have a very large organization that's sustainable, stable, healthy, um, operating in a way like this and having people like yourself that are, you know, top of the line in whatever they do. And it sounds like how you were talking about your own colleagues before. Top of the line, people choosing to be there because it's a place that you choose to go to.

Speaker C: It is. And I'll uh, give you an example, uh, which is we, you know, I was put into a program, uh, for two and a half years where every other month we spent three days. Um, we called it Executive Leadership Formation. And there are about 20 of us in the class and they spent the time teaching us the history of the organization and teaching us uh, like the ethics of the organizations that we understood that we don't need to prioritize making money. And for an organization to take three days of an executive's time every other month to come and talk about how we do the right thing just because it is the right thing to do. I, I mean, I don't know any other, uh, I just, I mean, I'm sure there are other organizations that do that, but that is a great place.

Speaker B: Yeah. Uh, every other month for three days.

Speaker C: Yep.

Speaker B: Putting aside the huge cost of that.

Speaker C: Yeah.

Speaker B: The fact that it, that that's a thing, that deliberately creating a program like this.

Speaker C: That's right.

Speaker B: And, and, and believing in the people within the organization.

Speaker C: That's right. And they have, during that time we have field trips, uh, we went to the different hospitals, we went to different clinics. Um, we went to, like, the Treffer center in Wisconsin where, um, they really take care of, um, particular types of illnesses. Uh, and we could see that. And we could see how the organization is really intended to help people. We will connect people with food. If you tell us that you have food insecurity, you go in, uh, something bad happens, and as part of it, they say, when you go home, do you have food to eat? Uh, and if you say no, they will give you a package of food. I, uh, mean, whether it's for good enough for a day or five days, it's kind of almost irrelevant. It's like, who does that?

Speaker B: It sounds, uh, quite familiar from about 30 minutes ago or so when we, uh, talked about what's the difference between solving your problem versus just trying to sell you a solution.

Speaker C: That's right. And I think that's what makes SSM Health a great place to work. So thank you for asking.

Speaker B: Yeah. And it sounds like you, you deeply care about solving problems and not just trying to fit some solutions.

Speaker C: That's right, because that's what we're here to do. We're here to serve our patients. We're here to, we're here to do good things. Uh, and my role in that is to keep us secure.

Speaker B: Yeah.

Speaker C: And that's, that's my role, but I'm part of a bigger machine.

Speaker B: But that's also how you also approach, I think, mentalism and how you approach storytelling, how you approach your own internal curiosity and learning and going into, you know, the identity fraud or interrogations. But how, you know, earning these skills and thinking about the world in a different way, not accepting reality as it is, not accepting the norms and saying, okay, these are the problems that I care about. How am I going to approach and solve them? Going as far as, you know, probably being one of the first to invent the term security mentalist, trademark pending. But that speaks to this notion. Okay, no, I'm here to actually solve problems. And if it means that I have to approach them in a unique way, if it means that I have to do harder work and I have to dive deeper and do things differently, then that's how I'll do it, and that's really awesome.

Speaker C: Yeah.

Speaker B: Gary, thank you so much for, uh, allowing me to come here, for allowing me to invite you here. Uh, I learned a ton.

Speaker C: It's been a, uh, true pleasure. Thank you so much for taking the time and also for all the preparation that you did and for welcoming me.

Speaker B: Absolutely. Thank you so much.