Human Skills That Define Tomorrow’s CISO with Matthew Rosenquist of Cybersecurity Insights

Speaker A: Welcome to Authenticate this, the cybersecurity leadership podcast for CISOs and identity leaders. Navigating the complex world of identity. From real life breaches to internal missteps and everything in between, we bring you authentic stories, hard earned lessons and actionable insights to help you lead with confidence when chaos strikes. Our goal is to humanize identity, uncover actionable solutions, and explore the business of identity beyond the spreadsheet. This is Authenticate this, where identity meets leadership.

Speaker B: Hello and welcome. This is Authenticate this. My name is Tim. I've got Aaron Lentz here and we have a special guest today, Matthew Rosenquist. Matthew, I've got a lot of accolades here for you. I don't want to dig into all of them, but a couple stood out. So. Actually, you just told me you drink 14

Speaker A: cups of coffee a day and you're also on 14 advisory boards, so that's the one to one ratio. That's pretty good. You're a CISO, you spent nearly a quarter century at intel, which is impressive. That's a huge number at Intel. You must have been one of the longest or oldest employees there as far as tenure goes. And you're doing a lot of really, really cool things in the marketplace. You're speaking all the time, you're all over the place. And we're very, very grateful to have you on the podcast today. This whole podcast is about humanizing identity and so we're going to dig in and talk about the human side of identity. But before we do that, I to want got a couple of questions and it was a kind of an interesting week. We've had some acquisitions, some mergers, some big announcements, and we're starting to see some trends. Curious if you have any thoughts on the palo, uh, acquisition of Cyberark?

Speaker B: Well, it's. We're in a consolidation phase, which is kind of the way the industry goes, where you've got a phase

Speaker C: of rapid innovation, small companies coming out there, and the very best of those rising to the top. And then you get into a consolidation phase where the big players are going in there and acquiring them. And every phase they're spending more and more money. And, uh, our industry is growing. The total market cap of cybersecurity just continues to skyrocket. So there's more money to be had during those consolidation phases. And from a customer perspective, right. They just need to take a breather and see what changes are going to happen. In most of these big acquisitions, there is a little bit of disruption, but they also are buying the company for that user base. So they don't want to mess things up. Hopefully good things come out of it and the customers receive even more consolidated benefits. But we'll see, we'll see. At the end of the day, every deal is a little bit different.

Speaker A: Yeah, it's interesting because we've seen the consolidation within the identity space. Right. There's a lot of the platform plays and hey, we do governance, we do Pam, we do access, we do all of the whole platform. But this is one of the first where a major hardware and network security organization is buying, getting into identity. And that was kind of an interesting side of the trend. But what comes up a lot with our customers is they're asking us, do we buy breasts of breed? Do we buy one platform or do we just pick and choose, uh, our manufacturers? Do you have a thought on that?

Speaker C: Every situation's different. And as a ciso, every time I go into an organization, even if it's in the same healthcare sector or finance sector or manufacturing, every situation is a little bit different. You have to look at their legacy systems, right? How are they using identity or security operations or whatever. You have to look at their expansion plans, you have to look at where their technology stack is going. I guarantee you every company out there is trying to integrate AI and um, probably double down on cloud and other things of that sort. So this unique mix that represents every organization. That answer varies and that answer can vary based on, okay, what do you need right now versus what are your plans? Oh, you're moving to a cloud first environment. Okay, that's a different discussion. There's maybe a right answer if you wanted to stay legacy. But as you're moving, okay, now, uh, you know, the answer is a little bit different. So it really all depends on, on what those objectives are. And that's the first thing, right, is working with the customer. Hey, what are your goals? What are your business goals? What are your security goals? Now let's figure out from an identity perspective, what's the right combination of solutions? You want simplicity, get a platform right. You want configuration because you've got specific threats or issues or regulatory controls. Now you may need to piece things together that are configurable and meet your specific needs. So start with the goals and then figure out what solutions fit those and fit the friction you're willing to put fit the investment and the sustaining operations. You're willing to feel for that kind of options.

Speaker B: Matthew, that, that falls kind of right in line with some of the predictions that you made. You talked about the strategic CISO and we're Seeing this on our side as well, where CISOs are shifting from technical leaders to strategic business enablers, I feel you kind of walked us down that path a little bit right there. Right. You're trying to enable, to be strategic on a business enabler side. So what, what are your thoughts there on the, on the changes of the ciso? I mean, obviously I can see your prediction here. And then I really do want to dig in, I really want to dig in, um, on the fractional CISO stuff. So, yeah, what are your thoughts on kind of the shift of the CISO role? And then let's talk about fraction from a fractional standpoint, the benefits of that.

Speaker C: Uh, this is a particular topic I'm very, very passionate about. Right. Because when I look at my industry, when we look backwards, we see the vast majority of CISOs have risen from a technical background, right? Developers, integrators, technologists. And this has tremendous benefits because that's the playing field, right. Our attackers and the defenders are dealing with digital technology. So having that background and especially an engineering or developer background where you're trying to solve problems, great benefits, but it also introduces great limitations, right. Cybersecurity isn't a fixable issue that engineers really love, right. I need to build a bridge, get from point A to point B, or I need to write a piece of software that runs when I execute it, right? Cybersecurity, you're dealing with intelligent adversaries trying to undermine everything you're trying to do. So we're moving to another phase in our industry where cyber security is becoming hugely important. From regulatory, from brand, from operations and everything else. And the CISO has be, has been elevated from way down underneath the cio, right. Uh, within it to come up to the big boys and girls tables, right. And even speaking with the board and being a C suite officer, so the expectations rise as well. But when you bring a technologist into those discussions, talking about kind of an ambiguous environment where you don't have real solid metrics and things of that sort, it becomes much more difficult. So there is a cliff for those, you know, that, that we're approaching for all those technology oriented cybersecurity leaders that if they don't transform into being a technical security leader to becoming a business risk leader, right. They're not going to survive. The next generation of CISOs have to be able to sit down with the C suite, with their peers, be able to communicate what is the value and step forward to target business value. Not just protecting against things that might, bad things that might or might not happen or meeting regulatory controls. When you're at the C suite table, you have to be able to talk about how you're helping the business. The bottom line, revenue and margins, average selling price, market share. You have to transform cybersecurity into a business value that contributes to the bottom line. And a lot of the technology oriented people, we talk alerts and risks and attacks and things of that. And that's ah, a different language. That is not business language, that's technology risk language. So we have to get there. And those CISOs and security directors and other security leaders that don't make that transformation. Well, you're not going to survive, right? It's the law of nature, it's a law of business. If you fail to adapt, you won't survive. And that's going to be a crisis that we're seeing coming right now.

Speaker D: It's interesting. So the, that it's a tough balance, right, because uh, the CISOs, their reporting structure largely is, is fairly technical, especially in smaller organizations and they have that they have to balance the two. But knowing the business, especially if you don't have a business background, that jump is giant and vice versa. We've got CISOs at our clients who are, who sometimes are, most of them are technical or have some technical backgrounds, but many of them are just the business, have more of the business acumen but their teams don't follow as much. And so I think as a trend I've seen in this space more often or the last, I don't know, I'd say five, six years is CISOs jumping between roles. And in that jumping, they're doing a good job with the business side but they're being somewhat, they're creating some amount of chaos on the technology side. So do you have advice for CISOs of how do you balance making sure you're building your team while also presenting to the board and back down?

Speaker C: Yeah, it's a tough challenge. And that gap, it's not just a little pitfall. I mean it's a chasm. You have to be able to understand the technology, right? The landscape. You have to be able to uh, actually understand your adversaries, which is again another problem. If you're just technically oriented,

Speaker D: right,

Speaker C: who's attacking you? What are their capabilities, what are they going after, what are their methods, why are they doing it? Can you dissuade or deter them? Can you, can you trap them? Can you. All those kinds of things. But you also need to understand a behavioral aspect. And that's true from the Attackers. It's true from your employees and workers. It's true from your third party business. It's true for your executives. And that's where that business speak comes in. Cybersecurity. If you're technical, you can only get so far. You need the buy in, right? And the validation and the support from the executives and from the board. If you fail to get that, eventually you end up in this downward spiral. It gets a little more complex. We can talk about that. But it becomes more and more difficult, right, uh, to be able to go in and ask for a 20% budget increase every single year. And if you don't show value, right, they're thinking, hey, this is just a technical problem, right? It does this. When they have a problem, we give them some money, they buy a solution and it's done, it's fixed. Why aren't you doing that? You can't keep coming back to us. You're an overhead cost. And overhead means I'm going to make it more efficient over time and I'm going to shrink your budget. You don't come back and ask for 20% every year. So this downward spiral just. And then you see CISOs bounce. Either they get pushed out or they realize, uh, I need to move on to the next company. And the cycle repeats. So this is a systemic problem. This is not an issue with an individual or collection of CSOs. This is a systemic industry problem that we have, that we have to overcome. So you have to understand the business. And a lot of my colleagues who have come up through the technology branch, if you will, top colleagues of mine, they're going back to get their MBAs, they want to understand the business. They want to be able to communicate and they want to be able to see how cyber security can actually extend its value. Not just protection against cyber risk and maybe some regulatory compliance. They want to understand, hey, how can I help with the business? Good, better, best marketing strategy? How do I help sales convert? Oh, wow. How do I help generate revenue? How do I help with brand and marketing? Right? These are questions that the traditional ciso, they don't think about. They're like, hey, I need to take care of all these alerts, or I've got vulnerabilities I have to close. And yet when I sit down with them and go, okay, how are you helping marketing? They're like, why would I help marketing? Oh, okay, I know exactly where you're at and I know exactly the challenges you're going to have in a year, in two years, in three years. And I know your budget's going to get capped at some point, and you won't be able to continually keep pace with the innovation of the attackers. You've got a problem coming up. Let's talk about that. So I mentor a lot of CISOs, and we kind of go over that. And one of the big challenges, especially at budget time, is they say, hey, I need. And, um, the average in the industry right now is about a 20% ask. They don't get that, but they'll ask about a 20% bump every year in budget. And there's a legitimate reasons for it, Right? The attackers evolve new technology, all this cool stuff, right? But the problem is when they go in to ask for budget, and the budget is finite, right? The CEO has to divvy that up. It's a zero sum game, you know? And they ask, Well, I need 20%. And they ask, well, well, why? Well, I need to protect against risk. Well, we didn't get attacked yesterday. Let's just keep it the same. It seems to be working fine. Whereas the profit centers can come in and say, no, give me 20% increase. I'll use that for marketing and sales. I'll increase our revenue. This is how much I'll commit to an increase in revenue. And that makes a lot of sense to a CEO and to a board and to the shareholders. And yet the, uh, Cybersecurity professionals, the CISOs, they're not able to join that discussion. They're left out. They're basically saying, give me money so that something bad won't happen. And it may not happen anyway if you don't give me the money. I don't know, Right. And I'm trying to compete with the profit center saying, no, give me money for sales and marketing, and I will up the revenue. I will increase our margins. And the poor CISO doesn't even understand what that means. Right? Average selling price margins. Oh, you know what? What? I deal with risk,

Speaker D: right?

Speaker C: Okay, so it's an unfair advantage. And yet, if you transform cybersecurity not only to do what it does now, but also contribute to the bottom line to be able to go in and have advocacy with those profit centers and go, yeah, security is helping me expand to Europe. Yes. Security is helping keep my margins up. Yes. Security is helping me close deals. Oh, by the way, security is helping me from a competitive advantage against these two competitors. Oh, okay. Now I'm tied to revenue. Now I'm tied to margin. Now I'm tied to conversion. Security features have moved people from our freemium model to our first paid tier model. Boom. Okay, that is a valid business conversation you want to be a part of instead of just propagating. Hey, bad things could happen. Give me a bucket of money. Yeah, that only works for so long.

Speaker B: It just clicked for me, Matthew, when you said move from freemium to the paid tier model, that, that's a perfect example. Right. And we always talk about how the best CISOs get the job done internally. And what I'm hearing from you is communication is key. Communication is number one. You can understand all the tech, you can understand the business value, but if you can't communicate that value internally and get people motivated and excited to get behind that project, you're not going to be successful. Are you seeing the same from a fractional standpoint? Obviously, a smaller medium business is more of a target, but I got to imagine the values probably even bigger. There

Speaker C: it is. And it's, it's a higher mountain decline, to be perfectly honest. So fractional CISOs, and I'm a fractional CISO as well, so targets small and medium businesses, which unfortunately had been abandoned by my industry. Right. They don't have the money, they don't feel that necessarily the need until something bad happens or they become very fearful. So a fractional CISO can come in at a much lower price point because you're only using them for a small amount of time. But a lot of these organizations, they have a very monolithic view of cybersecurity and it often, oh, well, we just need a firewall, really. That's okay. Wait, listen, let's discuss what you actually need, right? What are you worried about? What are you trying to accomplish? And so you have to start at a little bit lower level and in many cases kind of dispel a lot of preconceptions that are not helping them. And so there becomes a, uh, training phase to explore and figure out, well, what do they really need? Because they do have a much lower budget, but they do want to protect themselves, which I want to encourage. They need to because they're being targeted because they don't have protection. So the fractional CISO market is really kind of geared to help those organizations. There's a little bit more hand holding. And unfortunately, when I'm working with a small, uh, I don't have a million dollar budget or a hundred million dollar budget or a billion dollar budget as larger companies have to spend on cybersecurity projects. So it's about fine tuning it and whether it is a small business, a medium business, or even a Fortune 10 or Fortune 100 company, it's this same dilemma. It's a matter of optimizing the balance between what you're willing to spend. Right. Your budget, the friction you're willing to introduce. Because there's always friction with security. Right. We're going to introduce that and the acceptable residual risk that you're willing to accept. And this is kind of the squeeze the bubble exercise. If you don't want to spend a lot of money, well, you're probably going to have to accept a lot of risk. Right. If you're okay with a lot of friction, well, great. I can probably reduce the spending and, you know, reduce the risk. And so it's about squeezing that bubble, but at a smaller scale for a small or medium business. And that becomes challenging. Right. But also very helpful because they tend to have very little or ineffective security. So even adding a little bit can bring them up several tiers, especially as compared to the other potential targets, makes them less attractive.

Speaker D: I was just thinking about some of what you were saying about with these smaller SMBs. Like a lot of times it's like, I build homes or I do. Like this doesn't apply in the same way. But then there's also smaller banks and things too. And I like what you were saying earlier about M marketing and using them as an ally. And that, uh, the most damning thing for marketing is often is some kind of a breach. Right. And so where do you build when you're talking into these smaller organizations, where do you look to build the allies in that organization to help build it versus hey, I just need to install this or just this one sort of micro change makes a big difference, but it really is. How do I get people to adopt these adjustments?

Speaker C: Yeah, it's got to start with what's the organization's primary goals. That is the number one place you start if it's to generate revenue. Great. That's going to lead me down the next discussion. Okay, what are your primary revenue streams? What business groups. Right. Are leading that? Because that's going to be what's most important to you. Okay. Let's say it's, uh, well, I've got a primary product. Right. Or a service I offer. So it's this group that brings in 80% of my revenue. Okay. Revenue is your primary goal. This group is the, the, the primary driver behind it. Let me go figure out what they do. What market do they play in? What are their competitors? What are the risks? If it's a service, for example, availability might be really, really important to Them. Right. If they're dealing with sensitive data. Well, gee, well, confidentiality of that data and probably some level of regulation is one really important to them. So we can start looking at that to go. Okay, let's start at the baseline regulatory controls. Is there something there? Let's start with security controls for availability, confidentiality and integrity. Okay, let's look there. Then we can look into the marketplace. Right. Are, uh, your primary competitors? Do they market security? If you go onto their web pages, do they have security certifications that you don't do? They talk about security in their marketing and their white papers and their. All their other stuff. And you don't. Right. Okay. Maybe there's a competitive advantage play here and it could just be we've got a really strong and secure infrastructure. Right. I'm, um, Soc 2 certified. Not that that means that, but yes. So maybe what you're doing already, it's just a matter of communicating what you do. And now you can be more competitive. We can then look beyond that and go, okay, for this service that you offer, and does it make sense to start developing security features that the end user would appreciate that actually give you a competitive advantage versus competitive parity? Okay, let's at least discuss that now. I'm going to sit down with that business group and we're going to talk about all these things. How can I help you sell more? That's what I'm going to lead in with, especially with a profit center group. Hey, I'm going to protect you from bad things. Yep, yep. I could use your help on that, by the way. Right. But what I'm really interested in is how can I expand your market share, your share market. Right. How can I help with your margins? How can I help with your conversion? How do I make you more competitive against these three competitors? Yes. I know who your competitors are, by the way. Right. I'm the security guy. But I know who your three top competitors are. I thought you were just the security. Yes. Love

Speaker D: that.

Speaker C: I'm here to help your business. Right. Let me help you generate more revenue. Oh, now you have my attention. I thought you were just going to come in and say my people have to take security training. Well, yeah, they do. We're going to get to that. But I'm going to hook you first with helping you be successful because you generate 80% of the revenue. Revenue is the primary goal. Okay, let's start having that narrative. Right? We'll get to the other stuff. We'll get to the security policies, the dry stuff, and the security Training and oh, guess what, you're now going to have to do mfa. And these are the reasons why. But we're also going to have that conversation about value and how cybersecurity can be of value to your goal.

Speaker D: So just to sort of summarize a little bit for our audience, so kind of your, sort of your steps there. First, what I. The most important thing that I kind of am hearing about this is that any good team requires that every member understands what the other members are doing. So as a cso, you're not just sitting there. So it sounds like your kind of workflow is understand the primary goals of the business and then plus that with who is involved against those primary goals and then, uh, what hurdles and needs does that that group have? What's the primary competition? And that equates to a set of priorities that you can analyze against the values of bet against those primary goals and then you've got your solution. I mean, I'm oversimplifying it, but

Speaker C: that's the engagement piece of it. There's a whole bunch of other security risk things, risk analysis, understand who's attacking, understanding the infrastructure, technology, infrastructure. I mean, all those other things happen at the same time. Otherwise I can't come in and provide very, very clear communication on the risks, on the benefits, what we really need to prioritize. So there's a lot of other things as well that go on in parallel, but I think you've nailed it when it comes to the engagement with the other C suite partners. And they need to be partners. They can't be standoff, they can't be apathetic. They have to see the value that I bring to them. That's what teamwork is. Right? I'm bringing value, you're bringing value, Tim's bringing value. We have to understand and the aggregation of that value is better together than it is independently. That's what a team is.

Speaker B: We, we've gone down an interesting path. I really, really am enjoying this. What's really, I'm curious about, Matthew, is a lot of our sellers, our salespeople in the identity space, sell business value. And we're talking siam, the customer identity access management side. Right. And there's because it's a, uh, it's, it's a tool that's directed towards the end user, is usually acquired and, and run by a, a separate team. We sell that value. But I'm hearing the security business value not just in siam. I'm hearing it everywhere.

Speaker C: Oh, yes.

Speaker B: Um, yeah. And that leads me to the Next question on the prediction. So one of your predictions for the year was the bridging the cybersecurity talent gap. And specifically it talks more about entry level. We're talking C suite, but I got to imagine what skills, ah, at the entry level within the cyber world. Eventually those kids and people are going to grow up and become leaders. Right. So what can we talk about? So you mentioned, you said organizations will address staffing shortages by refining job expectations, integrating entry level talent, and fostering career progression through education, upskilling and mentorship. I love, I want to dig in on those three upskilling, mentorship and education. But curious on your thoughts there. How does it match up at the entry level and all the way to the C suite?

Speaker C: Yeah, the entry level is really difficult, right? Because again, we have another gap there where people are going in and getting their, even their degrees, right? In security or some element of security or technology and then trying to get into the industry. And the industry says, oh, that's great, but what experience do you have? Right? And well, I don't have any experience. Well, okay, no, we need somebody that's experienced, can hit the ground running. We don't have time to train you. And the reality is, and I've hired hundreds of people in cybersecurity. The reality is every time you hire someone new, you start training them, no matter how experienced they are, because you have to train them in your specific tools. And even if they know that tool now, you have to train them in your specific configurations and then your specific policies. Right? So there's always a level of training. But, uh, you know, the industry says, I can't find enough qualified people on one side. And we have a lot of wrecks out there, open wrecks. And on the other side we have a whole bunch of great entry level people that want to learn, that are hungry and motivated, saying, I can't get in the front door. So we're going to come closer and closer. Partially out of desperation, right. And partially out of maturity. We've seen job wrecks for the past 20 years be outrageous. I mean, absolutely outrageous. Okay, entry level position and you need to have six years of experience. Okay, how does that translate? Right. I had somebody saying, hey, it was for a, uh, risk assessment. Hey, we need a risk assessment person. And they needed to have eight years. And they listed all these things. And one of the things was Tara experience for, for eight years. Eight years Tara experience. And I reached out to them and said, hey, I'm kind of interested. You wanted threat agent risk assessment. Tara Experience for eight years. And they're like, yeah. And I said, are you getting many applicants that have that? Yeah, we're getting, we're getting a good amount. I said, that's very interesting because it hasn't been out for eight years, it's only been out for six years. And they said, uh, no, you don't understand. No, we're getting applicants, it's. And I said, why don't you go look at that? Because I actually, I'm the author of that. I created the methodology. I think I know what I'm talking about. And according to your rec, I wouldn't qualify for that analyst position. And they're like, maybe we need to go take a look. And I'm like, you're just grabbing stuff, you're just making up numbers. So we're seeing a change in that. And there's many good recruiting companies now that are becoming more security savvy. So they're vetting that and they're going, no, don't ask for that. No, you can ask for a CISSP and CISM and all these other things. For an entry level person. It doesn't make sense. What are you doing? And so there's tension in the system and that's driving an evolution of maturity to make the wrecks a little better. So we've got a better expectation and closing that gap so that we can get entry level people in who are good. Right. They're going to do an outstanding job, get them in the door for the first time and then we can get in the cycle of let's upskill them, let's train them, um, get them more education and move them up the ladder to be able to fill these middle management and even senior management positions.

Speaker B: I love that. So, so education is obvious, upskill. What's your definition of upskill and is that a personal thing or. Yeah,

Speaker C: well, upskilling is and you can do it through education. But a lot of times upskilling is about experience, Right. You may come in as an identity expert, right. And I understand identity tools. Okay, that's great. But you know what, to move to that next level to be able to oversee maybe a risk area or vulnerability management or so forth, you may need technical skills, you may need skills in operations, right? So okay, well let's spend some of your time with the security operations center and see what kinds of threats and risks and how they manifest in real time. So it's not just configuring the identity system. Let's look at the back end when somebody's Trying to abuse it. What does that look like? Okay, great. I uh, understand that operations skill now. All right, let's uplevel your skills and I'm going to go put you on the crisis response team. So when something bad does successfully happen, how do you recover from that? Who do you bring together? What's the processes there? Right. How do you reduce the loss when something bad happens? Right. Contain it. Okay, great. And so now you're, you're progressively upskilling them. Right. Okay. Hey, I've got all these technical skills. Great. I'm going to now have you sit with our product team. Right. Let's feel the pain of their customers having to use your identity tools. Right. How are you going to reduce the friction to the customers? Oh, and also our third party vendors that are part of that service. Oh. So I'm going to learn about third party vendors and what they offer and what are connections there and oh, I'm going to see it from the end customer perspective every time you're up leveling skills, communication skills, technical skills, awareness, operations, all of those. And in doing so, you're empowering this person to contribute more and to be able to go up that ladder and help in many different areas. Right now you're positioning them for a leadership role.

Speaker D: I like that a lot because it complements something I feel like I learned a, uh, while back, which was multiplying experience. So you don't have to have, have had every experience to know the information. You leverage other experiences and combine the two to be able to predict outcomes or what you need to know. Right. So people who've done multiple industry jobs usually do that well. It ties well, I think with something else. For our audience, which you were talking about earlier, is the business side. Understanding the business side. You do your own taxes, you know, when you get a landscaper or some contractor to work on your house or something, what you expect from them. How do you use that same experience to understand at a macro scale of your businesses? So I really like your idea of the, the up leveling because it's, it complements that multiplying experiences. Something I think for the more junior folks coming into our space or our early entry folks is this prediction I've been seeing around shortages, especially in identity, but of skills in cybersecurity and more so in identity, largely due to there was a prediction saying like some 40% of all new hires would be trained by AI in the next couple of years. Which is a wild prediction. Right. But also something that we could see as a reality and so the accuracy of that and what is it teaching us? And so if it's not teaching us all of the little things about the technology and all of the soft skills essentially that you need to be able to apply that technology, how do we uh, advance us uh, in the space? Do we end up being in a spot where we've got RAC F? We still have RAC F and we need RAC F engineers and architects who still, who don't exist anymore. Right. And so my question to you is, with the this idea of up leveling skills and maybe a potential skill shortage, do you think that our technology will outpace the need of deprecating old technology? And so the skills are only focused on what the futures looks like. It's going to be more like configuration based versus oh, we still need to have some of the basics, right? Are we looking at Star M Trek where everybody doesn't need to know basic algebra, they've got a computer for that. Right. So what are your thoughts on, on that aspect of skills as we grow in our industry?

Speaker C: It's a great topic, right? And we have to understand especially like the introduction of AI. Oh, this is new. When we take that 10,000 foot level, you know, uh, viewpoint, we see that technology, it's a tool and it enables us to do more and it enables us to do deeper things, to be repetitive, to do things faster. AI is exemplary at this. So for example, if you took a security operations center and you've got level one analysts, level two, level three, right. We're seeing AI being introduced to help level ones, for example, filter in alerts. When I turned on Intel's security operations center, its first soc, I was its manager. I built it. We had billions of alerts coming in every day and there's no way. I started out with 33 frontline people. You can't do a billion alerts. But it will help reduce some of that so the first levels can be more effective. It will then help their documentation process so they don't have to go off and type everything in. It's going to grab that and fill out those tickets and those incident reports instead of them having to go out and have command lines and a whole bunch of tools running and lookup tools. AI will be able to do that all for you and integrate that in. And then instead of sitting back and looking at all the data and making analysis. Is this really something I need to worry about? Is this not. Is this green, yellow, red? It's going to do that initial triage. So it will take A lot of that workload, which it should away from the first level analyst. Now there's still a human in the loop, but the workload, a lot of that that we rely on, first level analysts will be absorbed and automatically done by AI. And that doesn't get rid of the first level analyst. What it does is it elevates the them to now be a second tier analyst to where they're absorbing all that information and going, okay, I'm going to now make a decision or I'm going to validate the decision it's coming up with, or I'm going to check what they're looking at, what the AI may have missed. And so what we do is we then push the second level to third level, right. Because everyone's benefiting. So it raises all boats. And uh, essentially the definition of what a level one analyst, it changes, right? It changes to use all these tools and simply become much more capable and not get tied down into the weeds. And we're going to need that because guess what, it's not just the security folks using AI, it's actually the bad guys too. They're first at it. So the number of attacks are going to go up. We're going to need these AI tools. So the first level analyst can just simply keep pace. They won't be doing the grinding work that they've done in the past. They're going to be more of an intellectual worker, which is great. Right. So the tools make us more capable, more powerful, get rid of some of those things. Right. If you look back at the introduction of the calculator, does that mean we don't use math anymore? No. But you know what, I don't have to sit down and be proficient at long division. I don't. I pull out the calculator. Right, but does that mean we don't use math? No. Does that mean we don't necessarily. There are other tools that will take that burden away from us. Because I don't want to do long division and calculate out to the seventh decimal place. That will take a long time. So we're going to use calculators, we're going to use computers, we're going to use AI to do that. For us. It isn't a bad thing. Work still has to get done. It's now at an elevated level, at a faster pace, at a larger scope, and that's what these tools will help us do. Uh,

Speaker B: we've gone full circle here on this conversation, but I just want to point a few things out. So we started the Conversation of bridging the cybersecurity talent gap and how there's a lack of resources and we're all changing kind of how we work. AI is going to bridge a lot of that gap for us. But as we've always talked about on this podcast, the need for human intelligence is increasing. Everyone's worried about our jobs and jobs in the future. And sure, jobs are going to change, but like you said, Matthew, we are going to become far more proficient because AI is going to help us. But the skills that we need are the human skills. Those are the people who are going to stand out, the ones who have the best human skills, the best collaboration and communication and all of those things. And so I love that we've kind of gone full circle. I didn't want to go down AI, but we always have to.

Speaker C: Every time I talk, it comes up. It's pervasive.

Speaker B: Yeah. Uh, it is what it is at this point. But you did mention something back to your, your predictions, right? AI enhanced cybercrime is on the increase, and it's probably looking like a hockey stick, and it doesn't look like it's going to stop anytime soon. You threw out a number cyber attack. Cybercrime attacks to increase by 30% with fraud success rate rising by 15. Those are pretty big numbers.

Speaker C: And by the end of the year, when we look back, I may have, I may have called it a little short. It may be more than that. By the end of the year, when we look at the final numbers, the simple fact is the attackers, they maintain the initiative, right? And they dive into disruptive technology much faster, much earlier, and they're fine with using it and having it fail or break, and they just keep iterating. They're fine with failures. Whereas the defense side, we want to embrace it, but we don't have a tolerance for failure. If you're a security provider, you can't just adopt AI and go, okay, it's going to fail a whole bunch of times, right? Until we get it right, you can't do that. That's disruptive. You could cause more harm than good. Whereas the attackers can be much more haphazard. So we're seeing there's a window of, uh, opportunity, essentially for the attackers that they're using AI to be able to scale and make attacks much more efficient. For example, I received a phishing email, and I love them. I love them. I love knowing my attackers. I received one this morning and it used my name, it looked at my LinkedIn profile and pulled all this in. It looked at some of the podcasts I was recently on and pulled in some of the conversations and said, hey, I love the way you're talking about this topic and how you phrase that and, and where you're going with these other things and hey, we'd love to have you, you know, as part of our job and you know, at this company and please engage with us and whatnot. And it's from a, uh, Gmail account, it's not even from a legitimate and so forth, but it's an AI tool that's writing all of this at scale. So it's agentic in the way that it's going and doing research on me. It's figuring out primary topics, it's looking at my background and it's pulling together a narrative and iterating on it to see if it's going to get a response. And if not, it iterates again, right. And learns and then sends that to me and that becomes much more compelling. So their success rate, instead of a fraction of a percent, it might be 2%. And that's huge for phishing, right? So it will get better and better and better using the tools. And if it fails, so what, it iterates and tries again, it will learn from those failures, right. It's not a matter of how many times that I fail, it's how many times am I succeeding. It's a different mentality than security, right? So AI, that tool set, very powerful, is being leveraged faster by the attackers, so they get that advantage. And that's why we're going to see the bump. We're going to see the bump in attacks, we're going to see a bump specifically in success rate.

Speaker D: I kind of with you, man. I think the 15% is, is the safe number. And mostly for what you just said is I think there was a period of time where many breaches could. We were afraid of picking up a thumb drive in a parking lot if you took cyber security training, right, like that was

Speaker C: rightfully so I've done that attack, yes.

Speaker D: So, so like that was a good one. But like that was where the human fault was. Uh, is finding there now. It's the. It is not about just your internal controls. It is, it is what's happened in Vegas last year and this year, right. It's. There's the ability to compromise organizations lies in individual humans and AI has been able to support the attack of those humans versus just your network security or individual identities at mass. Right. It is way more pointed at specific humans and human emotion and so I'm with you. Based on that, I think the fraud goes way up. Unless we can make all of our, all of the humans smarter. And that is out. I just want to call back what you said earlier. That becomes outside of a CISO's specific jurisdiction because it's not infrastructure that they own, it is the rest of the organization which you're only going to get them to listen to you if you support them first as allies and running the business. And then maybe you can talk to them m about not picking up the thumb drive.

Speaker C: A CISO's role is influential, right? As a CISO of a company, I don't actually deliver the security. It's manifested through other groups and other teams. Right. I'm one person. The CISO is influencing not only the security team and it, the technology teams and the business teams and all of the employees and contractors, but I also have to influence the third party vendors who have some of our sensitive data or have permissions into our system and even business decisions that the company, hey, we're going to expand out to this nation that steals a lot of intellectual property. Well, wait a second. Right, you're. Do you really want to give up the crown jewels here? Let's have those conversations. So it's about influence. And the cognitive and behavioral aspects of risk are very important. You can put all the technology you want into place, but if you've got employees that are easily manipulated because of cognitive vulnerabilities and people can manipulate their behaviors, they're going to bypass it. I'd rather have a security savvy workforce than a stack of firewalls. Right. And I've been saying this for 20 years and it still holds true. We have to have technology controls for scalability, but we also have to have behavioral controls because at the beginning and at the end of all of these attacks are people. So if you don't secure those as well and understand those the way it's woven together, you'll fail.

Speaker D: I know we're running out of time here and I just as I wrote some notes because I learned a lot. It's been an incredible conversation, Matthew. So what I think the overall theme that I really saw out of this though is is there's so many things to be afraid of. There's things like the Palo Alto cyber arc change, there's AI, there's the ability for CISOs to have to be able to affect meaningful adjustments in their organizations and being more strategic. But what I really see in all of that is those are things to be fearful of. But the only known quantity based on what you're talking through in our industry and the future of our industry is change, inconsistent change. And rather than focusing on the fear, what I'm hearing from you is focusing on the influence to be able to adjust that change in a meaningful way from your. From your organizations. And so that's what I've learned from you today, Matthew, among all these other things. So I really appreciate your time, Matthew. It's been incredible.

Speaker C: Yeah, thank you. And, um, you're right, there's a lot of fear. But we. And I hate the word fear. It's about risk. Risk can be managed, but there's also opportunities for every single one of these areas. And that's why I'm always excited. And I've been doing this for 36 years. I see the risks, but I also see the opportunities. Yes, we deal in a world that's chaotic and we have intelligent adversaries and they may be smarter than us, they may have a bigger budget than us. Heck, they may know our environment better than we.

Speaker D: Right,

Speaker C: Right. But there are also so many opportunities to drive that collaboration, to make us more secure, to find that right balance, to contribute more, more to our shareholders, to our C suite, to our companies, to our employees, to our business partners. So, uh, the risk can be managed. Look at the opportunities. Don't just look at the fear. We have to deal with the ambiguity. We have to deal with the chaos. That's part of the fun, that's part of the challenge of cybersecurity. If you don't like that, don't be in the industry. Right. But yeah, see the risks and also see the opportunities. Address both.

Speaker D: Uh, awesome. Thank you, Matthew.

Speaker B: Love it. Thank you. That was a great take. We'll have to have you back on next year for next year's predictions.

Speaker C: Absolutely.

Speaker A: Thank you for joining us in this episode of Authenticate this, the cybersecurity leadership podcast. Check out the show notes for links and resources mentioned in today's shows. If you enjoyed the show, please leave us a five star review and be sure to subscribe so you don't miss on any future episodes.