Performance Through People as Executives Struggle and Mentorship Matters - Greg Hoffman - BSW #454

Speaker A: This week we welcome Greg Kaufman, president at Ascension Performance Group, to discuss his new book, Performance through People. In the leadership and communication segment, what the new Quantum executive orders mean for business leaders, what I learned about burnout the hard way and how to actually fix it, mentorship matters and more. Business Security Weekly starts now. It's the show where we explore the business of security to improve the security of business. Your trusted source for emerging risks, leadership and communication. Get ready for Business Security Weekly. Welcome to Business Security Weekly. This is episode number 454, recorded June 29, 2026. I am your host, Matt Alderman. Joining me for this interview segment today are two of my co hosts. First, Mr. Jason Albuquerque. Welcome, Jason.

Speaker B: Hello there, Matt. How it goes? Um, been World cup world in my world. So all, um, World cup.

Speaker A: Did you go to another game?

Speaker B: Nope. So only. I only did two. I only did two. I, I put in for a lottery for another one, but I didn't, I didn't end up getting it. So unfortunately. But that would have been pretty, pretty awesome to go to three World cup games.

Speaker A: Yeah, exactly. Yeah.

Speaker B: Other than that, we spent our Sunday on the beach, uh, East Matunic, just soaking in the sun. So it was beautiful here in New England.

Speaker A: Great. Also joining from Slovakia, Summer Fowler.

Speaker B: Welcome.

Speaker A: Summer.

Speaker C: Yes, thanks. So apologies if my connection is bad, but I am here finally for my son's ah, ball hockey tournament with Team usa. The other two big things from the weekend. I became a Formula one fan and have decided that Verstappen is my guy because my son was sending me, uh, like the clips about him as we were watching Formula one this weekend and super excited that the Penguins picked up the Ruck twins. So in the draft that was, it's fun to have some, some twins on the team and really looking forward to watching them play at Notre Dame next year and getting them to Pittsburgh. Awesome.

Speaker A: Ah, yeah, I watched golf. It was a playoff and then Scotty lost in the first hole of the playoff this morning at 9:00am I'm like, uh, that was anti climatic.

Speaker B: Yeah, that's the traveler right up the road for me.

Speaker A: Yeah. All right, one quick announcement and then we'll get into it. Your vulnerability program is costing more but reducing less risk. Teams are chasing CVSS scores. Patch SLAs are slipping and leadership still lacks clear visibility in what's truly critical. Throwing more tools at the problem is not the answer. At the Vulnerability management Virtual CyberSecurity Summit on July 29, learn how to align vulnerability management to real business risk risk, improve efficiency and make smarter Investment decisions Security Weekly listeners can register for free by visiting securityweekly.com vulnmanagement using the promo code CSS2.6SW. That's the same promo code for the last one, which was the agentic AI SoC one, I think anyways. Greg Hoffman is the creator of Performance Through People, a leadership development system he built more than 25 years as a senior executive in global manufacturing, financial services and autonomous technology, with roles at companies that include General Electric and Whirlpool. He has served as both Chief Legal Officer and Chief Transformation officer. And he has turned what he learned in those roles into a framework any leader can use. Greg, welcome to Business Security Weekly.

Speaker D: Thanks for having me, Matt. I'm really excited to be here.

Speaker A: I have to thank Summer because Summer suggested that we should bring you on to talk about your new book. So thank you Summer.

Speaker B: Thank, um, you Summer.

Speaker C: Yeah, it's kind of cheating. I've worked both for and with Greg for years and I really think that the listeners are going to find value in both his system and his new book.

Speaker A: Yeah, so let's start with the book. I always like to ask authors like why the book? Like what prompted you to want to write a book?

Speaker D: That's a great question. And I never thought I would be an author. Um, but at some point, really probably about two and a half years ago, I started reflecting on how I'd seen both just a really incredible environment and culture in one company I'd worked in, uh, where the employees just loved working there. They were highly engaged and it was an amazing culture, almost a unicorn culture in a lot of ways. And then I've seen other cultures that weren't so um, so positive in fact in many ways often negative. And over time I realized I uh, actually have been able to influence from a negative culture to a positive culture and build those high performance environments. And I had a passion inside me to really share that with folks. And um, honestly for me it's just about helping as many people as possible have a great place to work. And so that's why I wrote Performance Through People.

Speaker A: Zero trust is clearly the future as threats get faster, quieter and harder to detect. But implementing it shouldn't disrupt the business. Threat Locker enforces default denied execution in a way that remains enterprise ready, scalable and operationally clean. Unknown software is stopped cold. Trusted apps stay contained and drift is locked down across the environment. It's zero trust that works in real enterprises and prepares you for the threats ahead. See why CISOs are adopting it at securityweekly.com forward/threatlocker.

Speaker C: Greg, I think what's super, um, great about the book is that it's not your typical chapter one. This is what the background of a great leader is. Chapter two, these are four characteristics. It's a story, it's a novel. And so you can read it on a cross country flight or you could pick it up in an afternoon, um, and drink it with your beverage of choice. But it's a novel that walks you through the story. Um, and so what made you think that that was the way to write it? Because I think it's super effective. Um, but what made you make that selection and not the traditional style of book?

Speaker D: Yeah, and I think I would start with Summer. You've worked with me, uh, for years and you know that I like to have fun at work. And so when I started writing a book that was kind of, that kind of book, the book that wasn't a story, frankly, it was boring and really hard to write for me. And I sat back and I said, I want people to enjoy reading this book and I want them to experience leadership through the characters and through the environment that comes out through the pages of the book. And so I struggled. And honestly, what I did, I sat down and wrote some of the books two years ago and I just stopped. I couldn't get past the, you know, the writing of the book. And um, I started collecting stories and thinking about things and going back over my history. And um, then when I decided to turn it into a parable or a story maybe about eight months ago, it all just flowed out of me so fast and so easy and I was able to just pull it together. So I'm really glad I did that. It's not a big book. I have a copy here. It's, it's fairly small and to your point, you can read it in about four hours, five hours, something like that. And it's actually a fun read. You get into the characters and you start um, getting pulled into their story. And that was the whole idea, is to make it engaging and interesting for people to read.

Speaker B: So Greg, it's written as a story, but it's built as a framework. So talk to us a little bit about the core pillars of that framework.

Speaker D: Yeah, I sure will. There's really five. Um, so the first one is that I truly believe, believe that leaders have to have a leadership first mindset. And what does that mean? That means when you hit the, hit the door every day, you should be thinking first, what does my team need to be successful? What does my organization need to be successful. And, you know, leaders oftentimes get pulled into the technical work if they're. If they're engineers, they code, if they're lawyers, they produce legal work, you know, whatever it is that they do. But if you're a leader, you first got to hit the door and say, what do I need to do to build the conditions where the environment is as healthy as it can be for my team? So that's the first part is having that leadership first mindset and saying, you know what? I'm going to purposely build the environment where trust can emerge and where my people can be engaged and succeed. So that's element number one.

Speaker A: But that can be challenging for leaders in certain environments. Right. And you talked about culture a little bit in that. Right. If you're a leader in a negative culture, sometimes you can't maybe do that. Right. And so talk a little bit about, as a leader, what you have to do in those situations where maybe the culture is not right. You don't have the ability to really think about your team because you're. Maybe you're just firefighting constantly. Right. Like, how do you approach that, Greg?

Speaker D: Well, first of all, I disagree that you can't. Right. I think every leader has a choice to lead purposely for their team. And you may have to firefight, too, but you also have to lead for your team. And so I do challenge that assumption a little bit. And the other thing I would say is, I think in those environments where it's hardest to do that are the environments where you don't have the support from your leader if you're not the CEO. Right. But you don't have the support from your leader. They don't understand that that leading is something that the job requires when you're a leader, and they just value only the substantive work that's produced. I think in that environment, that's the toughest place to do it. But I still think leaders have a choice. They control their own team and within their team, what I always say is, lead where you are. Be the example. If the culture around you is not. Is not supporting that, it's okay, do your part, lead where you are, and be the example for the rest.

Speaker A: Be the example. Yeah, yeah, yeah.

Speaker C: And I think, Greg, that was a really important message. Um, as I was working with you and we were, you know, working across, you know, a group of leaders together, because you were really leading leaders, we spent significant time saying, where are we now? What can we impact? And let's stop worrying about what we can't. Let's do what we can for our teams. And it actually really changed the trajectory of everything that we were doing and allowed us to advance.

Speaker D: I love that summer, and I'm glad you brought that up because I remember one off site where we literally, literally drew a circle on the ground, um, with tape and we put all the things we could influence in the circle and we put all the things we couldn't influence outside the circle. And we, we said, you know, that's, we can't, we can't influence those. Let's write them on a list and let's stop talking about them. And um, you just have to leave where you are.

Speaker B: Yeah.

Speaker D: So.

Speaker B: So, Greg, a lot, a lot of challenges that I've seen over the course of my career is that organizations incentivize behavior. And sometimes for other leaders, they're incentivizing behavior that's counterproductive to what we want to achieve. Right. So how do you convince an executive who may have, I don't know, salary or comp based on things that are counterintuitive to what we want to do as leaders and get them to adopt this approach of leadership first, because it can hit them in the pocket sometimes.

Speaker D: Yeah. So what I would say is you might take a little bit of slow pain, um, you know, as, as you're leading first, but ultimately the payoffs are, are huge. And so if you really want to incentivize those things, I'm actually going to jump to condition number two. And because it rolls right into this and that is operational clarity. So condition number two is operational clarity. And I say operational clarity because clarity means, we understand, you know, why we're there. Right. Our purpose, why are we there. Our vision is kind of where we're going or our long term, uh, plan. Then we, then we have a success formula, which are really some short term metrics. These are kind of how we measure ourselves and what we plan to year over year to make sure that we're on track to achieve our vision. And then finally, in that purpose architecture, you have values or behaviors, how people treat each other in, in that team. And so what, uh, what I would say to you is when you create that clarity, it's not enough just to create it. It has to be operationalized throughout the business. And this is something you'll see happen in the book. You know, they, they, they operationalize it different ways. Even one team, you know, has a bingo game they play where they, you know, uh, do values bingo. To recognize people who are living the values. But to your point, Jason You've got to define what good means. And so you define it within your team. And again, let's say the organization is not on board. Define inside your team what good looks like through that clear operational clarity, and then drive the team to that. And that's what you should build your performance metrics and your bonuses and everything else on. And frankly, it should roll up to whatever the company's goals are and plug into that. And that's really important to getting everybody out.

Speaker B: I look at that. Greg, we say this a lot on the show. Say easy, do hard. That's a very hard thing to do extremely well, because I know, and I've seen a lot of teams and executives build these dashboards and these metrics, but a lot of times they're measuring the wrong things.

Speaker D: Yeah, right.

Speaker B: They're measuring the wrong thing. So I think the key here is put in the time and the effort. It's going to be hard. It's not going to be easy to do, but you have to have extreme clarity around what true success looks like, because otherwise you're going to be drowning your team in vanity metrics, which I love.

Speaker D: I love that so much, Jason, because again, it's back to number one, right? Be purposeful, go to an off site, bring the team together, create that vision, create those success metrics, hash it all out in the room, get it on the board, and then align around it and make sure you operationalize it. But when you do that, it's literally like magic how much the team, uh, rallies around it and how. How positive that environment becomes. All right, jump to number three. Number three? Yeah. Number three is capability. And so a lot of these words are like things that you go, duh, like, people have to be capable. Right. But I think about capability in kind of a four prong analysis. And, um, first of all, the most obvious one is, is the individual capable of doing their technical job or their subject matter expertise? Right. If they're a coder or they're a lawyer, um, can they do that thing? That's the one all companies measure, and everybody measures that well on performance reviews and everything else. Right. Um, the second one is, can that individual lead themselves? Right. So that gets back to you justifying values and behaviors in the way that person's supposed to behave inside the environment. How we treat each other on this journey, that individual capability to lead yourself is really important, that we measure that, we define it through the operational clarity, and we hold people accountable to it. The third prong here is now we look at each of those Things as a team. So we say, is the team capable of doing this substantive work that needs to be done? Right. You put all the substantive work that needs to be done in a bucket. You make sure you got somebody that fills every gap. But then the fourth one is, is your leader capable of leading the team? And is the team together capable of leading itself? Because you might have a collection of six individuals who, who are brilliant technicians, who are generally capable leading themselves in their own environment. But when they get together in a team, you got one or two cancers, and it's undermining the team. And that team will collapse under its own weight if that team itself isn't capable. So we measured across all four, uh, prongs, individual technical capability, individual leadership capability, team technical capability, and team leadership capability. And I argue that team leadership capability is absolutely the most important one. I've seen time and time again where teams can't perform because they're, you know, they're literally brought down by their weakest member.

Speaker A: Yeah.

Speaker D: Even if they have the, uh.

Speaker A: Sorry, Jason. But even if they have the technical capacity, but yet somebody can't lead. Right. So I think about getting a bunch of individual contributors together that are really, really good at their tasks. And the team has the technical capability, but yet none of those ICs really know how to lead the team, team forward. That's where things start to break down, Right?

Speaker D: Absolutely. And if you have really strong operational clarity and you have really strong capability across all four of those prongs, what you end up with is a very high trust environment. And when you have that high trust environment, you can move to really empowering your people. Which is. Which is the fourth element.

Speaker B: Yeah. Uh, you know, I love this topic, and this is a topic I feel like we could dig so deep into, because, folks, organizations and employees are moving 1,000 miles an hour. Leaders are moving a thousand miles an hour. And so often we have a bad habit of trying to buy our way out of problems, buy it with human capital, buy tools, buy shiny blinky lights to fix a problem, which for me is not the answer. And again, this is something that's hard to do. Right. So how does your framework help leaders evaluate? Are we suffering from a lack of human capability? Are we suffering from a lack of resources? Is it the tools that are maybe overloading us? Or we don't have the right tools to help get us through this systemic complexity that we're suffering from? Because there's a lot of things. There's talent, there's tooling. Right. There's a Lot involved here. Yeah.

Speaker D: And I want to come back to this topic and I want to. But I also want to answer your question directly. The question was, how does the framework help? And that's actually the fifth element of the framework is kind of a continuous improvement cycle loop that goes back and says, do people have a leadership first mindset? Do you have operational clarity? Do you have the capability? And then did you empower people at the right level? Because empowerment, which I was about to talk about, fourth prong, uh, it's a dial, not a leverage. And so you don't just flip it irresponsibly. Right. You ask yourself, have I established that operational clarity? Do I have a highly capable individuals and a highly capable team? If so, you can crank that empowerment dial all the way to the right. You should have a high trust environment. If you don't, you have to keep it dialed back. And you're going to have to continue to build that operational clarity and build that capability. Maybe you got to put people on performance improvement plans or maybe replace somebody, but until that team is really operating at the right level, it's irresponsible to fully empower the team or you're going to have mistakes, you're going to have chaos and other things. And that, that I won't spend a lot of time on the, on the feedback loop. But the fifth element is that impact feedback loop. And um, you know, Jason, you want to get back to your other point, which is the speed at which people are moving. And actually one of my premises is here is when you build this kind of environment, you get extreme ownership down at the working level, middle management, individual contributors in a way that they can move so much faster. And I actually even just wrote an article on this, it's on my website. Um, it's called, um, when the J Curve Turns. And it takes off of another article that was talking about the J curve of AI adoption, where essentially people adopt all these tools and then you go down in this huge valley and it actually bogs everything down because you don't have the leadership, you don't have the environment, you don't have the place where you can truly operationalize these tools. And I think when you purposely build the environment, I think it actually can speed up the environment in a way that you can leverage AI even better, and you can kind of jump the bottom of that J curve if you do it purposefully. But again, it takes a lot of thought.

Speaker B: Yeah, and the sound of it too. It's just another thing that kind of came top to Mind, when you started talking about capability, no organization should buckle by the loss of one person, right. A key player, a high performing individual. And it sounds like when you're focused on capability, you alleviate that risk because you're cross training, you have multiple folks skilled in certain areas, then you're not limited if somebody leaves and you're behind the eight ball.

Speaker D: Right, no doubt. And, um, I'm going to go back to the book for a second and I will tell you. Lauren's a CEO in the hypothetical company called LaserTech and she struggled with this because she had a brilliant technician that was definitely undermining the team. And I don't want to be a spoiler of the book, but she worked and worked and worked on this individual to try to bring him along because, um, you know, he was, he really was a brilliant technical contributor. Um, but he was actually challenging the team as well. And if you read, if you read the book, you're gonna, you're gonna feel that as you, and feel her struggle as she goes through this and deals with that. It's a really common thing that companies deal with.

Speaker A: And I think what's important here is these all are related to each other. Right. You've got to have them in this order or you can't actually drive to your end. Um, goal, which is a high performing team that's producing impact. Right. And so is each step kind of a loop in itself, Greg, where, okay, let's say, okay, leadership. Leadership, um, first mindset. Okay, got it. Okay. Yes. All right. Operational clarity. Okay, got it. Capability. Well, we got some gaps, so now you got to go fill gaps, get that readjusted before I can move on to empowerment. Right. Because of what you said. It's a dial, it's not a lever. So I don't know how much empowerment I can give a team until the team has operational clarity and all the capability to do it.

Speaker C: Right.

Speaker D: Yeah.

Speaker A: Which leads me into my question is how do you, what are the metrics in the impact side or is there metrics in each of those, those phases that we really should be focused on as a leadership team to figure out when we're ready to go the next step or when do we have to repeat a step?

Speaker D: Wow, there's so much there. I, I, I, I could talk forever on that, but what a great question. So let me see if I can, let me see if I can peel back the onion a little bit. Um, yes, it's a leadership system and that's one of the things that I think makes performance through people Different. A lot of leadership programs, and to be clear, I've got a book, but I'm launching this summer a leadership development program as well. It's a two day on site intensive, um, and it's a system. And I think a lot of leadership programs teach tactics or they teach different things that you can change about yourself or ways to have conversations, different things you can do in the environment, all of which are positive. But this is an absolute system that has five critical elements and it does not work without the five elements. So to your point that having that leadership first mindset, assessing and building continuously is the magic of this whole system. It's critical. But what we do during that two days is we teach leaders how to do that. We teach them how to do it and they actually start doing it in class. They work with their own teams, um, they create a growth plan. We have a virtual, uh, AI enabled coach that helps them build the growth plan, helps them do self reflection, helps them evaluate across every one of those ah, categories with some proprietary survey that we run. Um, and then we have a trust score that basically says here's your trust score on your team. And it diagnoses where the trust problem is. Is it capability? Is it operational clarity? Um, but long story short, um, it's a system. The system teaches leaders what the system is and then teaches them how to assess and build within that system on a continuous basis. Yeah, go ahead, go ahead.

Speaker C: I was just going to answer your question about the metrics, Matt, because as I worked through a leadership system with Greg and my teams, uh, that Greg and I worked with, it was really a matter of using that dial. And as I had the operational clarity as the team, my other leaders and I developed that and we said, okay, here's an area where we don't have as much clarity as we need. What would we measure to determine where we are? So we developed those measures together and to Jason's point, sometimes we said we actually need a person who can do this. And sometimes we said we need a tool that can do this. And sometimes we said there's a process missing here, we need to do that. But it really fell together because we were able to identify it as we were getting our clarity, you know, becoming more clear on what we needed. And as we went along we said, here's how we, we measure knowing if we're getting there. Right. And I can talk through an example later. It was great.

Speaker A: Yeah. So your metrics are that you're measuring success around is developed as you're going through these Right, Okay.

Speaker C: Yeah.

Speaker D: Yeah.

Speaker C: You build your architecture together.

Speaker D: Yeah, you do. And to Summer's point, one of the things that, you know, she did some amazing work around was enterprise risk. And really looking at that. And I'm just going to take cyber, because that was one of her risk areas. But taking that cyber area and building a whole new way of looking at risk across that cyber portfolio, that really ended up spreading to other areas of the business. We started using it in compliance, we started using it in other areas because the process itself kind of came out of this approach to leadership where they were continuously improving and continuously changing how they approach it. And, um, it was super powerful. I've actually taught it a couple times.

Speaker A: Yeah. Trust me, Greg, there's plenty of business out there for you because almost every organization struggles with this.

Speaker D: Yeah, yeah. And I. One of the, One of the things that's challenging to answer, Matt, is, um, yes, you want to have metrics around it, but everybody's metrics should be custom designed inside. And what we do is help them understand how to do it in a way that it's defined well and operationalized well and holding people accountable against it and measuring it. But it's, uh, a systematic process to doing it. And who am I to come in and tell you what your vision should be or what your success metrics should be? That's something that has to be developed internally and it has to be developed even outside the program. It's a, It's a whole process unto itself.

Speaker A: Great summer. Jason, any more questions for Greg while we have him?

Speaker B: Oh, God, I have a ton, but this could be another show, honestly.

Speaker C: I mean, there's.

Speaker B: There's still two more pillars to cover here of, you know, empowerment and impact and, you know, going down the path of continuous improvement. So, you know, let's do a part two to this, please.

Speaker C: And my question would be, Greg, where do. Where do you. Where should people go to find out more?

Speaker D: Yeah, my website is ascensionpg.com uh, my direct email address, gregcensionpg.com. um, I'd love to have a conversation with you. I'd love to chat with you about it and Amazon for the book. Right? The book's on Amazon. It's still at a discounted price. Um, it's still in its first month of release. And, um, you know, I guess my ask with the book is, uh, if you love it, buy another copy and give to somebody else. Um, because it really, I'm out there to try to help people have a great place to work. And I think the more People that read the book and learn about the system. Um, the more that I can help folks. That's my personal mission.

Speaker A: Greg, thank you so much for joining us on Business Security Weekly.

Speaker D: Thanks for having me.

Speaker A: This episode is sponsored by Microsoft Edge for Business, the browser with built in protections for Microsoft 365 customers with employees using AI and web apps. More than ever, Edge for Business helps you stay in control, securing sensitive data, protecting against shadow AI and stopping threats right in the browser. You don't need to worry about added extensions, new tools or extra costs. It's the secure enterprise browser you already have built for the era of AI. Visit securityweekly.com edgeforbusiness to learn more. The rules just changed. AI, like Mythos, now finds and weaponizes zero days on its own. And your patch window just dropped from weeks to hours. One prompt, Titanium Atlas. It scans thousands of endpoints M. In seconds. It confirms which machines are actually breached, then hunts the attacker's command and control. Atlas then acts to isolate, quarantine, rotate credentials and patch every endpoint in real time. Tanium Atlas AI that doesn't just answer, it executes. Find out more@securityweekly.com Tanium so what a great leadership conversation to lead into our leadership article segment. Yeah, very good, Very good.

Speaker D: All right.

Speaker A: So article number one. IBM study finds executives struggle with AI sovereignty. I think they struggle with more than just AI sovereignty.

Speaker B: Sure. I think they're struggling with the entire concept of AI. I mean, uh, we've talked about this on the show that so many organizations are just rushing right into it. Right. And it's one of those scenarios where they're kind of reckless about it because they look at it as a competitive advantage and they'll do anything to get ahead of their competitors when it comes to AI. Many instances to their detriment. I mean, we talked about the stat. What is it? 72 of or 72% of organizations have failed AI initiatives to the point where they're calling it out as one of the most expensive experiments in technology history for some organizations, I mean. Yeah, it's just reckless at this point.

Speaker D: Yeah.

Speaker A: And only 7% had reached the most advanced level of AI control.

Speaker B: Yeah, that's not a great stat. Not a great stat.

Speaker A: Not.

Speaker B: And I wonder who that. I mean, it'd be interesting to hear who that 7% is. Right. Who's the 7%? Is it the big dogs that have all the money in the world and can hire the best talent and have been working on the strategy forever? I don't know who's that 7%?

Speaker A: Yeah, yeah. It's just, there's really interesting stats in here that are just eye opening. Like response 72% said they would accept a 20% cost increase.

Speaker B: Yeah, I know, right?

Speaker A: So think about that, right? One of the, one of the things that's been touted about AI is how I can save, save, save, save, save. Well, not if you're taking a 20% cost increase.

Speaker B: No, like, and hey, guess what? Now that all of these changes are happening with all of the larger manufacturers of utilization token based billing, guess what? The chargers are about to start going up because the caps are off now.

Speaker A: Yeah, well, I see it, right? So I'm using the Google AI Assistant, right? Gemini. I hit my thing every day and I'm like, I got to decide am I going to wait till tomorrow or am I going to keep chugging through, right? And then it's paper token and it.

Speaker B: All of, all of the, all of the big dogs are catching up, right? I mean, Microsoft with their, um, copilot cowork, that's going to be tokenized, I think in uh, what, two days? Uh, July 1st, I think is when they're kicking in. And guess what? You're going to start getting the utilization bill if you use cowork.

Speaker A: Yep. Yeah. Crazy. Second, uh, article, what the new quantum executive orders mean for business leaders. So this was interesting to dig into. I pulled up both of the executive orders. They're linked in this article. Um, what's really interesting are the timelines.

Speaker B: Right?

Speaker A: They're fast. They're pretty fast. Right. So I think one deadline. Deploying quantum enabled sensors and networks, uh, by September 30th of 2028.

Speaker B: Yep.

Speaker A: So we're not even talking 2030 anymore. Now there are some 2030 dates still in here, but this is pushing quantum safe quantum enabled capabilities in 28.

Speaker B: Yeah, I mean, the time is ticking. You know, when we first started talking about Q Day on this show, we said it's going to come faster than you think it's going to. And I mean, we're in 2020, we're halfway through 2026. Yeah, we're already talking about two years from now, two and a half years from now. You better start having some infrastructure in place. Not to mention, you know, you have to have post quantum key establishment by 2030. You have to be ready for the digital signatures by 2031. Time's ticking. We'll say it again. Time is ticking.

Speaker A: Yeah, even NIST has to have a pilot for post quantum compliant migration on appropriate subset of information systems. By the end of 2027. So there's a year and a half away.

Speaker B: Exactly, exactly. Yeah. Yep. So if you're not having the conversations now, you better start asap.

Speaker A: Yeah. Because this is going to impact anybody doing work in the federal government side. This is going to get embedded into the federal acquisition regulatory requirements. Um, they will be required by cover contractors to be compliant by December 31, 2030. So that date's still 2030. So there's the government's doing things earlier, but all contractors by the end of 2030, you've got to be compliant with these requirements or you're not going to be doing business.

Speaker B: Just like we saw with cmmc, it's not just third party risk, it's going to trickle down. Oh yeah, it's going to be fourth party risk, fifth party risk. If you are doing business with an organization who does business with the federal government, guess what, it's going to trickle down to you because they can't have third parties that could adversely affect their contracts with the government. So it's going to have a trickle down effect.

Speaker A: Security teams are overwhelmed. In 2025, more than 48,000 vulnerabilities were disclosed. Yet only a small fraction pose real risk. Most organizations remain stuck in a reactive cycle, responding to everything without the clarity to know what actually matters. Origina, a global provider of independent software support, is built on one principle, giving organizations control over their own it Roadmap risk and critical systems. Optus, by Originaw is a predictive intelligence service that brings that same approach to security, helping teams predict risk, validate what matters, and act with confidence. Visit securityweekly.com origina for a conversation with a security expert today. Next article is Cyber risk evolves. The insurance industry tightens guardrails or just doesn't provide coverage.

Speaker B: Does he? Exactly. No. No is always an option. And believe me, I have seen that. I've seen organizations who get a straight up Heisman. Nope. No, thank you. Right. But it just shows that, uh, from the time we started this show, just the evolution of the insurance industry when it comes to cybersecurity. It's an amazing story because seven years ago you and I were on the show complaining about how it's just a checkbox, uh, written text. You don't even have to prove anything that you have, don't have to show any artifacts. And what a complete waste of time it was all the way to now where it's like, it's diligence to the point where I'm sitting back saying to myself, is It. The insurance organizations making our organizations more mature these days instead of the regulation. Maybe it is, Maybe it is. They have quite an influence on moving the needle because we know people treat regulation or compliance like a checkbox exercise. But to get insurance, you actually have to prove it now.

Speaker A: And why is that? Because there's a financial component to it.

Speaker D: Exactly. Right.

Speaker B: Well, the money, Matt. Follow the money.

Speaker A: When the money's on the line.

Speaker B: Yep.

Speaker A: You're going to do it, because if you don't do it, then your claim is going to get denied, which means would you pay all that money for. And you don't have the cost to cover it. Right. So this is why we harp so much on making cyber a business risk issue and trying to tie it to dollars, because, uh, the money is what people will pay attention to.

Speaker B: That's 100% it. Right. So, yeah, I'm telling you, mate, I'm at a point now where I'm, um. Like, insurance organizations are helping move the needle more than compliance because it's not a check in the box. You have to prove with artifacts that you're doing what you say you're doing. That's kind of crazy. It's crazy to think that's. That's where we're at right now.

Speaker A: Yeah. Because most of the regulations don't just have enough teeth in them anymore. I mean, look, there are some that do, Jason, but there's a lot of them that don't. And so it's cheaper to not comply in some cases than the penalties. So why deal with it?

Speaker D: Right.

Speaker A: And so. But insurance is different because now if you get attacked and your policy can't kick in because you don't have the controls in place or you. It's, It's. It could be your business and.

Speaker B: Absolutely. And you're paying completely out of pocket at that point. It could bury your business. Yeah, exactly.

Speaker A: Right. All right. What I learned about burnout, uh, burnout the hard way and how to actually fix it.

Speaker B: Yeah. I mean, I like this article. Right. I mean, it talks a lot about how burnout is a, uh, systemic issue within organizations. Right. And how. How we can overload our folks if we're not paying heavy attention to what's going on in the environment. Right. And, you know, for me being on the show, I am very in tune with burnout on my teams. Like, it's something that I think is very important because we're in an industry where we're running a thousand miles an hour all of the time. And as leaders, we're doing the Same where running a thousand miles an hour, all of the time in multiple directions. And if we don't take a step back and look at this overload of work as a problem that we need to get ahead of with our staff, our entire team is going to start burning out right in front of us.

Speaker A: Yeah. And so I want to go back to the previous interview.

Speaker D: Mhm.

Speaker A: Right. To have that leadership first mindset.

Speaker B: That's right.

Speaker A: And part of this is understanding your team, where they are, what they need. Right. We talked about that a little bit on the previous one. And this is what this article talks about. Like, look for the signs.

Speaker B: That's right.

Speaker A: Force, uh, breaks. Right. Like, make sure your people are going on vacation and taking time off and doing things. Right. And so it goes back to that leadership first mindset of you are looking out for your team, your employees, and making sure that they have what they need and that they are not falling into this trap. Because what I think is hard to, to recognize is like you, Are they truly burned out or is that the way they always operate? Like you, if you don't understand your employees, you may not know the difference. Right. And it's. I said this a few months back, like, I have a really good friend of mine that went like completely burned out. Like just super brilliant coder, unstoppable. Right. He hit the wall and nobody saw coming because this is just always the way he was. So there were, there were no leading signs per se, but somewhere you want to find that early so that your employees don't hit that wall. He's struggling.

Speaker B: At the end of the day, Matt, it may have taken some work, but there had to have been leading indicators, right? I don't, I don't believe it. Because, uh, you know, I'm, I'm at a point where our teams look at utilization of employees. Right. And, and when, when utilization is pegged for a certain duration of time, it's a warning sign.

Speaker A: Yeah.

Speaker B: If someone is working, let's say 110% of what their utilization should be on the regular, that's an indicator. That's an indicator of, hey, you need some pto, you need to take Friday off. You should take a couple days off, have that conversation. I, uh, get it. People are workaholics, but you can only sustain, you know, we were talking about formula one for there for a little while. Right? You can only sustain that level of RPM for so long before the engine burns out. Right. You can't, you can't.

Speaker C: Can you guys, can you guys hear me again?

Speaker B: Yes.

Speaker A: Yeah, you're back.

Speaker C: So I was actually going to do. I'm on my phone now, so apologies that the connection here is so bad. It's Bankska Bistrika, Slovakia. So I'm out in the mountains. Um, but anyway, I was going to bring up the exact same thing that both of you just did. It's the. You know, when you think about Greg Hoffman's book, it's about getting your performance through the people on your team. So, like Formula one. Think about Formula one. You pay attention to that machine that you're driving in the driver. Right. With. With such precision. Like, you know, I was learning this weekend about the difference between the hard, the medium and the soft tires, and when you change them out and the track is different and the race is different and the conditions are different. So we really tune into that. That's what we need to do with our people. We have to tune into when there's a, uh, different track in front of them. And maybe it's time that you get them off of this thing and give them a little bit of a break or a stretch assignment here, or maybe it's a relaxation. But that performing performance through people means that the people are our most important tools and we have to tune them as well.

Speaker B: Yes.

Speaker A: And I think the challenge right now is with a remote workforce, it's hard to know exactly how long they're working. And seeing some of those signs now, I know some of my team is right, but it's harder to track when you're in a remote environment. So you got to find ways to break that barrier down and figure it out. I think, because, you know, you could just be off on your own. Like, it's 5 o' clock here and they're working till 10 o'.

Speaker B: Clock.

Speaker A: You don't necessarily know because you're not online anymore. So you don't realize they're still sitting online working.

Speaker D: Right.

Speaker B: I mean, that's gets harder. There's telemetry you can pull. I mean, believe me, there's telemetry you can pull. And at the end of it, I think it's some of the best telemetry that's out there, because, like I said, we are workaholics. We don't want anything to beat us. We. We are out there and we're working hard and saving the day and, you know, being these incredible professionals that we are. But it comes, uh, it's the law of unintended consequences. It comes with things like burnout and stress and anxiety. So there's metrics that we can keep a look on, we can keep our eye on the ball as far as lead measures. And we know when things are stressful. Right? We know when things are stressful. So we have to make sure we're making those accommodations for our employees. And hey, by the way, don't forget about yourself, because if you're not taking care of yourself, you can't take care of your people. And you will have blind spots because you are burning out.

Speaker D: Yep.

Speaker A: Yeah, you're right. That leads into this other, uh, really interesting article around great leaders question philosophical assumptions. And I was again reminded of this article when we were talking to Greg in the previous segment. And it's around some of that operational clarity. Right. We were talking about toxic environments and cultures, et cetera. This article talks about some of that. Right. Like looking at, uh, kind of the ethics side of leadership. And they give a lot of great examples in here on how companies have handled aspects of this. Right. And I'm thinking, thinking back now going, wait a minute, that has to be part of my operational clarity in some respects.

Speaker D: Right?

Speaker A: Like we, we have a set of ethics, we have a set of things that we, we know we're going to do and not do. Right. And kind of feeds back into that, that performance loop we just talked about.

Speaker B: Yeah. You know, I, I really like this article because it made me, you know, it made me really think about how to use metrics effectively. Right. Because data is great, metrics are great. But it's all about perspective of these are historical assumptions that you need to look at. Because what that data doesn't have is the ethics and the human value and all of those things that we can do as humans to humanize that data, to make sure we're doing the right things. Right. That's the missing piece. Data's great, but it's just gotta be like a historical report that you're looking at where you can see trends and things of that nature. Because sometimes you have to look at the data and make a different decision.

Speaker C: I think this has a lot to do with aligning your core values with the truth and vice versa. And that, you know, we see some organizations that will say things like, people first. We care about our people. And then everything they do runs counter to that. And so, you know, then you then you have like the falsification of what it's supposed to be like to work there. And I'm a proponent of just be honest with yourselves about what kind of company you're going to be and make that your core values and Some companies are not about people first. They are about the grind. They are about, you know, the innovation at all cost, even at the cost of people. I'm not faulting them for that. But don't pretend and don't pretend the other way around. Right? So I think there's an alignment as a leader that you need to come with in the truth, and that's building that trust with that leadership team to say, let's really reflect on ourselves. What kind of company are we? What kind of company do we want to be? And are we willing to make the steps to be the company we want to be?

Speaker B: Yeah, yeah. And see, I think that's where, again, that's where metrics matter. Right? I mean, uh, uh, I'm in the consulting world, right? So I sit back and I say, all right, we could have dashboards showing how effective our managed services and professional services staff are. They're hitting all the marks from an NPS score to closing out projects on time or even early in on budget. They could be closing every ticket that comes in and getting great NPS scores there. But our entire team is anxious and stressed and burning out. Seriously though, right?

Speaker D: Yeah.

Speaker B: The metrics do not tell you that part. We could be looking amazing on paper and in a dashboard, but the humans are suffering for it. That's where I say we have to take it deeper. It's a trend. It's an analysis that we see. It's data. We have to.

Speaker C: And the question is, Jason, are you the kind of company that is okay with stressing people out and perhaps having high turnover, and there are some companies that are okay with that, or are you the kind of company that wants to maintain those, you know, retain that talent that you have built? Uh, and if that's the case, then you definitely do need to figure out how you're going to keep that long term. So that. And that's where, you know, like I say, leaders have to have to look in the mirror. And it's a really hard question. What kind of company are we and how are we going to measure to make sure that that's what we're doing?

Speaker B: 100%.

Speaker A: Yeah. When he described operational clarity and capability, he said, when those are aligned, that's how you build trust. It's from my notes when I was doing the prep call with him. Right. And it's getting that alignment around that is so important for organizations to build that trust layer, which then drives hopefully to the right metrics. Right, Jason?

Speaker B: M. Absolutely.

Speaker A: All right, last article.

Speaker B: Mentorship matters non negotiable have to have in your. In your culture. Right. I mean, that's at least, that's my view of the world. You know, I've always had that mentality of we need to have the level of professionals within our organization can. Who can help others level up. And that's where mentorship comes in. I've said it a million times. My job is to teach the folks on my team how to put me out of a job and then I'm successful.

Speaker C: Right.

Speaker B: Because then I'm off to my next best thing. So we need it, uh, for. For folks to be able to level up. We need it to be able to. We talked about it earlier, preserving institutional knowledge. You have to have that.

Speaker D: Right.

Speaker B: You have to have that mentorship. And then, you know, folks have a group of, you know, I've always called it my personal board of directors. I have folks that I trust. If you're building that mentorship within your organization now, you have team members building their own little, you know, personal board of directors that they can lean on when things are going on. So, you know, I look at it as. Mentorship programs shouldn't just be, you know, learning the tactical or uh, technical skills in the organization. It should be bringing people's leadership skills up, communication skills up. Right. Give them those diverse mentors to teach them different things, get them out of the monotony and teach them different things.

Speaker C: It's also about extending in their. There's, you know, decades of talk about this as well beyond the mentorship. You have to be, uh, sponsor as well. And that means not only helping them build the skills, but then opening the opportunities for them to flex them. Right. So if you're working with someone and they are really fantastic at communications or really good at a certain area, you need to give up something that you're doing potentially and say, hey, go do this. You're going to be the expert on this now. And that's where it can be scary for leaders because it's like giving up more. But that's how you build true succession and you really build your replacement so that you can move on to other things that uh, are next in your life as well. So yes, mentorship. I also think that sponsorship is important.

Speaker A: You just empowered them to go do that, which is going to increase their capability, which, uh, ties back into the. Yeah. All the first interview you. I love it. Yes.

Speaker B: Yeah.

Speaker A: And drive an impact. Anyways. Yeah, I, ah, I, uh, keep going back to those five because they were just so insightful earlier and how all these articles kind of fit into what Greg was talking about in the first segment.

Speaker C: Yeah.

Speaker A: Thank you both for joining me. Thank you, Summer, for joining us from Slovakia. I know it was a little difficult, but thank you very much. Thank you, everyone, for watching and listening. We'll see you next week on Business Security Weekly.