Followership, CyberSecurity Leadership, and Judgement as a Defining Skill - Kenyada Meadows - BSW #465

Speaker A: This week we welcome Kenyatta Meadows, CEO and founder at the executive parent company, to discuss his new book on followership in the leadership and communications segment. Stop playing with the CISO role. Fix cybersecurity leadership, what cio, CISO alignment looks like when it's working, why judgment is emerging as cybersecurity's defining skill, and more. Business Security Weekly starts now. It's the show where we explore the business of security to improve the security of business. Your trusted source for emerging risks, leadership and communication. Get ready for Business Security Weekly. Welcome to Business Security Weekly. This is episode number 465, recorded September 14, 2026. I am your host, Matt Alderman. Joining me for this interview segment today is my lonely, my one lone co host, Mr. Jason Albuquerque. Not a good football weekend for us.

Speaker B: Lonely I'm not, but co host with you.

Speaker A: Yeah. Lone co host.

Speaker B: Yeah. Uh, listen, Week one of the NFL, although disappointing for the two of us, for our teams, it was. It was a really good, uh, good week in the NFL. I think, um, I think summer's team pulled it out, though. The Steelers pulled out a W, didn't they?

Speaker A: They did, yes.

Speaker B: Well, I'm. I'm going to chalk this up to. Listen, Patriots need to get their feet stable. We played the super bowl champions. We, we didn't lose by a ton. So I'm not super disappointed. We just got to work on those interceptions on the Patriots side, that's for sure.

Speaker A: Yeah, if. If Drake doesn't throw those interceptions, you guys win that game.

Speaker B: We would have won that game. No, no doubt about it. But, um, AJ Brown, high ankle sprain, no bueno. So hopefully it's not too many weeks out.

Speaker A: Yeah. Yeah. All right, before we get into the interview, one quick announcement. Identity risk is growing fast. Too much access, too many accounts, and not enough control. MFA fatigue attacks and credential abuse are slipping past defenses and impacting the business and fixing it without adding friction is the challenge. At the Identity Virtual CyberSecurity Summit on September 30, learn how to balance security usability and risk reduction. Security Weekly listeners can register for free by visiting securityweekly.com identity and use that same promo code you've used before. CSS26-SW. Kenyatta Meadows is a Senior Vice President of Audit at bank of America, an independent board director, and a master Certified Executive Coach. With over 25 years of experience overseeing enterprise risk forensics investigations and regulatory compliance for global financial institutions, Kenyatta helps leaders bridge the gap between departmental initiatives and core business objectives. Kenyatta, welcome to Business Security Weekly.

Speaker C: Thank you. So, just a little bit of an update, um, or reminder that, um, actually that was my last corporate role at bank of America. I'm the founder and CEO of a couple. A couple of companies. So we spoke about the executive parent company, which we'll focus on. And then there's also fractional chief executive, which, uh, is where I'm focusing now.

Speaker A: Yeah, perfect. Um, so we're going to talk about your book on followership. It's called the Passenger Seat. Um, whenever I get into a book discussion. Right. And this one's an interesting one, I always want to understand, like, why the book, like, what was the inspiration to actually write the book.

Speaker C: Sure. So anything that I've written, uh, spoken about, I've got a podcast that I'm pretty inconsistent, uh, with called, uh, Executive Dad. But anytime I speak on anything, uh, either verbally or in writing, it's based on my own experience, not just observation. Uh, but usually my experience is kind of accentuated and embellished by the things I'm seeing in the conversations I'm having, like this. So what motivated that book? So I think there's an overwhelming amount of literature, research, focus on leadership. Right. It's very aspirational, I think, for most people, which is why, uh, maybe it captures the imagination as much and certainly captures the space on our bookshelves and in our digital libraries, et cetera. But the vast majority of people are not and never will have ultimate leadership authority, certainly not at work. Uh, and so there is a mismatch between what's out there and what's for people and what people are actually experiencing. And so, as I thought about that imbalance, but also really focused on what it means to have and to embody and to display moral courage, uh, I found that there also seemed to be an opportunity to kind of share what my experience was. My observations were to help the majority of people who are not ultimate leaders. And by the way, even as an executive or someone who was pretty senior, uh, on Wall street in my prior couple of roles, um, I still operated with some flexibility, certainly, and quite a bit of autonomy, but I still have to operate within a framework. And so the question kind of became for me, to what extent am I following this framework? Am I following particular leaders? Am I doing what I'm asked to do or what, uh, uh, seems like, you know, what's being suggested for me, even if it's not being said, and how well does that align with my values or what I think, uh, are really important. And so they kind of became a little bit of a rub. And I think this is true for a lot of people. This rub between what allows you or cause you to be successful, to thrive, or even just to survive in, uh, a corporate environment. We can focus on corporate and what actually, um, is true to me and how I want to be and how I want to live my life. And so that's really was, uh, the basis for the book and the framework that ensued.

Speaker B: So, Kenyatta, when I, when I saw this topic, it, you, uh, know, I got super interested. Um, you know, it's. This is such an interesting topic to me. Just a little background on me. You know, I served eight years in the Marine Corps. I was in the military. Um, a lot of leadership style I've pulled from military leadership philosophies. Um, you know, for example, we talk about it a lot on this podcast, Extreme Ownership. Right. Talk to me a little bit about the difference between, uh, collective followership or collective leadership. Right. You know, uh, I've always said on this podcast that leadership isn't a title. It's something that you can deploy every single day in how you operate at work. Right? You can be a leader without the title of a leadership. It's about influence, right? It's about being able to influence folks. Influence decisions, bring a set of leadership skills to the table, which eventually can help you go up the chain of command within leadership roles, within your organization. So just talk to me a little bit about the difference between the two.

Speaker C: So what you just described as the ideal and the way that it ought to be, but I think we know for a fact, we've seen, we've experienced, we continue to see that that is not how it always plays out. And unfortunately, there are a lot of people who don't abide by what you've just described, but who do have the authority and who do have the influence. I'm sure in the military there were times when you were told to do something and you knew you kind of had to do it and you didn't agree and you thought, this person is not technical and they're not decent. But now I've got a rub between what I think is the right thing, what I think is the decent thing, and, uh, maybe what is even permissible and what I've actually been asked to do. Right? So I think that is one of the big differences there. Um, that there is a difference between what we think is the ideal and what actually happens. And our job is to bridge the two, to define clearly what leadership is and also the path to get there in an effective, but also in a decent way. The beginning of your question, actually, you spoke about collective leadership. I'm not really sure necessarily how you're thinking about that. Um, but you know, I'll get into collective followership and the influence. That's really what the essence of the book is about. It's not about necessarily what's happening top down, what a few or one person says should happen and having that leadership, so called leadership trickle down. It's about saying in the collective. Right. The collective is a very important, uh, phrase. I'm glad you used it. In the collective, we do have influence and we do have impact. I used to tell my teams, uh, over time, you guys are actually my boss, right? You're my manager. Uh, because if I do, and we've seen this plenty of times, if somebody in a leadership position does something that a lot of people don't like, eventually the reputation is going to proceed them, people are going to hear about it. And unfortunately what happens in those situations is the bad leaders tend to persist longer than many of the followers can tolerate. Um, but ultimately that is going to be their undoing. And so if that illustrates anything, it's the power of kind of those multiple drops in the bucket, those multiple chips at the, at the stone, whatever it is, that actually affects change. But is that how we want change to be affected? Do we want to wait until then? Do we want the masses to suffer? Do we want, you know, things to be ineffective or even a calamity to kind of strike? No, we want to make sure that we've got people working in tandem, working collectively. Yes, to do the right things, also to communicate challenge effectively, to make sure that there's effective communication above. It shouldn't be one directional, which is how it oftentimes is. And that's problematic that it's top down. But there should be a genuine interest by those in the leadership position to understand what's happening on the ground and to understand how people are feeling about what's happening, what they're seeing, but also to make sure that they are taking those challenges, uh, seriously and that there is, uh, a credible way of executing and making sure that it's sort of cyclical, uh, and circular, not just bilateral and one directional. So, so when you talk about collective leadership, I'm not really sure what you mean and maybe you can elaborate a little bit on that, but that's kind

Speaker B: of how I would love to. And this is, this is why I wanted to have this conversation because I feel like it may be A conversation of just semantics.

Speaker A: Right.

Speaker B: At the end of the day, when I look at collective leadership, much like we did in the military, it, it consists of things like contextual authority. Um, you need a specific expertise that has the real time ground truth, which comes from, let's call it your ground forces. Right. At the end of the day, this. There's, uh, a decentralized execution in the military. Right. You have commanders at the top, but then you have this decentralized execution and command throughout, which allows you to get real time information upstream from the ground. Right. There's multidirectional influence when it comes to, uh, the military and decentralized leadership. Um, it allows for that up and down hierarchy, that vertical of information sharing up and down. So that way things like, you know, I came from the, um, the air side of the field, so, you know, Tactical Air Command center would always get from the ground troops information and intelligence to help feed upstream the strategies that we would deploy out in the field. Right. So it was that command. And at the end of the day, I almost feel like we're speaking the same language here. Right. And we may just be using different terminology because when it comes to that collective leadership, when I was in the Marine Corps, even if I was a corporal, I was still a leader within our organization who had some level of influence. Now granted, could it have been a situation where you'd have a commander who decided not to go with the decision that we wanted to make? Absolutely. It happens all the time. That happens not just in the military, but in the corporate world. And to be honest with you, it'll happen with collective followership.

Speaker A: Right.

Speaker B: Those type of things will happen where you'll have a leader say, no, that's not the direction we want to go.

Speaker C: Of course, yeah. Because I mean, look, we're not off. So I largely agree with that. I think we're saying a lot of the same things. The only difference that I see in the example there is, um, and it's not that it's necessarily a difference, but where it is often a difference. So in the example that you gave, Tactical Air Command understands that they need to get feedback and so they execute accordingly. Not all leaders have that clarity. That is not infra, that's not structural in a lot of places. And so there are leaders. And I think we, we've seen it in the political realm. We've seen it, uh, historically, we've seen it in business. We've seen it, you know, in so many different places, social organizations, where there are those people or there is that person who just doesn't think that they need to listen to anybody else. Conversely, there are followers who sit on precious information, critical information that would have allowed for even the saving of lives or the saving of an organization. And they don't speak up, they don't feel that they have a voice or that they're going to be heard or listened to. And so I think ideally, again, what you're describing is exactly how it should work. And it's great that it's working in these critical spaces where you see it working. Uh, but the problem is a lot of people don't feel empowered. I'm sure even in the military, even though people knew what the criticality of the information would be and their execution, that doesn't always happen. So it's just good reminders for people, um, of one, how to build a structure, two, how to communicate effectively, and three, kind of taking responsibility for wherever you sit in the hierarchy.

Speaker A: Right now with Tanium IT and security teams, complete patching programs in minutes, not weeks. Reduce software vulnerabilities by up to 97%. Cut incident response times by up to 99%. This is not just IT, this is autonomous IT, making business, your business, unstoppable. Tanium autonomous IT unstoppable business. See more@securityweekly.com Tanium yeah, and ultimately, at

Speaker B: the end of the day, as executive leaders, it's up to us to build the culture to support the collective followership and, or the collective leadership. Because for me, I look at what you're saying. What I'm saying is a combo deal. They both need to work together, they both have similar endgames and missions that you need to accomplish. There may be some nuance to the followership side and there's nuance to the leadership side, but at the end of the day, they need to be working hand in hand. And that's all about culture.

Speaker C: So I agree with, uh, that what do we do when the culture of an organization is toxic as a result of a toxic leader? Right.

Speaker A: Well, that's where I was going. Right. Uh, Jason brought it up. But the importance of that cultural alignment. And if there is no cultural alignment, then what? Kenyatta.

Speaker C: Right, right. Well, that's exactly what we're talking about. So. So the idea, the idea there is, you know, ideally, yes, your leader will provide you with great culture and facilitate, you know, kind of, uh, an environment where people are free to speak up and people talk about psychological safety all the time. But again, I kind of focus on the fact that it really has to be circular. There has to be, uh, or bilateral too. There has to be that push. Because who is the culture carrier in my book, Um, I put quotes at the top of all of my chapters. John C. Maxwell, uh, said. I think it's the top of chapter seven. John C. Maxwell says a leader without followers is just out taking a walk, right? So at the end of the day, you can have all of, you know, you can have a coach who's got the best plan and tells everyone to do if they don't execute. That's a problem. You can take, you know, some of the most renowned CEOs on the planet, like Jamie Dimon, he's got 300,000 people reporting to him, global, all across the globe. At the end of the day, if some of those people don't operate or don't execute according to whatever the culture is, um, then that's going to be a problem. And this is also why, for example, strikes occur, right? We're going to show you what happens. You've got your excellent culture and your excellent playbook. But if we don't show up to do TSA duties or we don't show up to fly the planes, guess what? Not happening. So I think I agree again, culture is so important, but it still can't be unilateral. There has to be that humility from the leadership perspective. They take ultimate responsibility. They may strategize and be responsible for that, but what is it that allows them to. What processes do they have to take that feedback and ah, to demonstrate to people that they are listening and that it's sort of a collective effort.

Speaker B: Ah. So with, um, the followership side of the aisle, uh, the collective followership, let's call it, how do you balance things like operational drag? Because if you're building a culture where people are defining themselves as a follower, they may have a hard time making a decision and they may have that paralysis of, I need a leader to make a decision. Right? So how do we overcome that so that way we don't have this organizational paralysis of a culture of followers and read the book.

Speaker C: That's the point. How they can do that is by reading the book and taking responsibility. It's not, uh, what I'm talking about here isn't really. It's not like I'm, you know, saying, oh, we discovered a new planet here, right? I'm saying that you are not, uh, a person or an entity without autonomy, without responsibility for yourself or for the organization. And to follow means taking, playing an active role in that. Playing an active role in influencing what you're being told to do. It's just like when you've got a kid, uh, who just does everything they're told, and you try to talk to them, and they don't want to talk to you. Uh, I mean, that's a terrible relationship. It doesn't feel good. You don't really know what's on their heart. You don't know what's in their mind. And they're probably not going to be doing a pretty, uh, doing as good a job as you would like them to do. That's probably not someone who's going to be operating independently. And it comes back and says, you know what, dad? You asked me to do this. But, you know, when I was raking up the leaves, I noticed that the hedges needed to be trimmed, and so I did that too. Wow, that's great. That is actually very consistent with what we're aiming to do. Et cetera, et cetera. Right. So you want people to take initiative. You want them to feel empowered. But you don't necessarily need 200,000 people all trying to take leadership, uh, roles. But they do need to have that autonomy. And so what is being described here is not passivity. Um, we're not celebrating passivity. To be a follower does not mean, uh, to be without autonomy. It's exactly the opposite, or without responsibility. Collectively, we all have it.

Speaker A: Yeah. So you lay out a framework for this in your book. It's the Passenger acronym, right?

Speaker C: Yeah.

Speaker A: So, Kenya, kind of walk us through the framework a little bit in the pieces, because the way you've constructed it, I think is something people need to understand on how do you enable this responsibility as a follower within an organization?

Speaker C: So there are nine, um, the acronym is Passenger, and there are nine, uh, points. And I dedicate a chapter to each of those points. But each of those, uh, uh, nine points sits in three categories. Right. So the first is really around, um, your internal. Your internal discipline. What are your own principles? How are you taking accountability for your actions, your decisions, your engagement? And that's sort of, I think, been a big part of what we've been, uh, have been talking about here. Um, you know, I talk about self mastery, which I think is extremely important m. In all aspects of our lives. Right. So when you think about what am I good at? How am I going to use my skills and abilities to the benefit of myself, obviously, to the benefit of my family, to the benefit of my organization? I think taking that inventory and having a good, clear understanding of that, um, helps you to appreciate One, how well to engage, how you engage, where you should engage and frankly, where you should stop engaging. So I think sometimes we think about, I'm a part of this organization. I'm, um, here in the here and now, and this is what I've got to do. I'm kind of miserable because I don't feel like I'm um, meeting my potential or I'm not doing as well as I can or I feel like I'm just messing up all the time. Okay, fine. If that's how you really feel after doing some evaluation, what are you going to do about it? Are you going to continue to suffer and drag down the organization, drag down your team, maybe come home and drag down your family? Are you going to take some responsibility for that? So the first three, ah, are really focused on, um, focused, uh, on the internal, uh, the internal category. Uh, then we uh, then we talk about um, navigating the system. Right, that's our second category. And there um, we talk about systems thinking. And again we've alluded to some of that. So it's not just what do I do within my small portfolio or what do I do with the invoices when I receive them, I get them from John, I give them the sue. And I have no idea how this whole thing works. In order for you to be effective as uh, someone who can challenge credibly, someone who can even follow effectively, you have to kind of understand why things are the way they are and how things work. And so that's really one of the key things that I talk about when it comes to system navigation. Understanding the threats, not just the opportunities, because that's huge. But you also have to understand what are the things that are going to, uh, caused you create, uh, mitigation. Then I talk about negotiation. And again, this is uh, you know, what Jason was talking about, I think alluding to a little bit when you talk about the influence. And that's one of the things that over the course of my career, even over the course of my life, um, I've had to work on, I think many people do, but it's something that I have continued to have to really, um, focus uh, on how best to communicate. Uh, in Robert Greene's book the 48 Laws of Power, I don't address that in my book. Um, I like to keep those things kind of separate because that's a little bit of a controversial book, but I did enjoy it. But in one of the stories that he gives, he talks about how, um, the courtiers of some king would Actually, uh, spend all this time figuring out the content of the message. Then they would debate the time of day to deliver the message. What's the best time of day? Then they'd figure out where in the palace should the king be met, um, to kind of get the message. I don't know that it should necessarily be that difficult all the time, but those are some of the things that we should be thinking about, even as followers. Because when and how you deliver the message, even sometimes delivering it, broken up over a series of meetings, which was not something that I was particularly good at because I thought, here's something that needs to be communicated. Let's communicate it, let's be done and move forward. That is not always effective in, particularly in highly political environments, big bureaucratic organizations, that's not going to be as effective. And I definitely learned that. And then the third thing, uh, the third category, um, is really around value, uh, preservation, um, you know, making sure that your results driven and influence that, uh, your influence is measurable. So I know you asked me to talk about the, you know, the framework. Those are kind of your nine pieces in three buckets.

Speaker A: Yeah. So, uh, I want to get into a couple of those. Right. Just at a high level, obviously yourself is very important. Right. Which is where you start your framework. Like, you have to understand your values, your morals. That is a very important part of this. And when we were doing our prep call, I recall, like, I've left organizations because there wasn't a value alignment, right?

Speaker C: Absolutely.

Speaker A: It was an important thing for me. Right. And I think starting there is really important for people to understand. Like, if my morals and values don't align to the organization, like, am I going to be happy here? And the answer is probably no, right?

Speaker C: No, no.

Speaker A: It's a huge part of this.

Speaker C: I think. Just one thing I'll add to that is oftentimes it's not the organization as a whole. Right. Because the organization is made up of a bunch of people. The organization has a mission. The mission may be neutral, you may be agnostic, or it might actually be a wonderful mission. And so that really appeals to you. But it's actually the leadership, or it might even be middle management. It may be your manager who makes it absolutely miserable. So you love the organization, Maybe you really like the people, maybe you really want to work there. But your challenge is, here's this group, or here's this individual who wields influence, who has power over me and my peers or whatever the case is, has maybe power over my career trajectory. Do I really want to stay here for that. And that's the difficult part, right. If you just say, well, I'll give you an example. Uh, I've got board experience, um, and I'm looking to join some other boards. One of the very clear things for me is that I'm not going to join the board of a, uh, tobacco company. I'm not going to join the board of fast food, even though I love hamburgers and I'll eat fast food sometimes. I don't want to put my, my best efforts into convincing people to do things that could potentially be damaging to them. Right. So for me in that regard, it's not even organizational, it's the industry. Um, I'm not going to participate. That's the easy part. What's challenging is, you know, being a part of an organization where, like, I've just described, everything seems to be fine or even good. But you do have those challenges. And I think that's where people have to kind of get down to themselves, have the conversations with the people who are important to them and say, look, is it worth it? Maybe I can either find another organization that's similar, I can find another part of the organization if I need to. I can circle back to this organization if I need to, but status quo. I'm not going to stay here for those reasons. So I think it's sometimes much more nuanced, which makes the decision so much more difficult.

Speaker A: Yeah, yeah, agreed. I've had to make those calls sometimes. Now, the middle part you talked about, the navigation part was interesting to me in that when and how to deliver some of that messaging. Right. Like, and so I started thinking, I'm like, well, yeah, before I have a cup of coffee in the morning is not the best time to talk to me. Right. It's just not because I'm not, I'm, um, My brain's not there yet. How many of us actually think about that? Like, when is the best time to deliver a message, right. And understanding who you're communicating to and, and, and what the best time. Like, I never thought of that. Right. It's just you. Sometimes you just do it when it comes up and you're like. But you're talking about being more systematic about it, right? In that that'll maximize probably your delivery and your point when it comes to, to when you bring that topic up.

Speaker C: Yeah, absolutely. Uh, one of the dangers, though, right? It's a great, you know, so many things are good for you until they're bad for you. Right. So, so I think this is A great, uh, it was a great learning and something that I really thought was important to share. But it does become a slippery slope. You gotta be a little bit careful because if you have to, you know, put yourself in a pretzel in order to deliver, uh, the truth in order to deliver valuable information, that may also be time bound. You may just not have time for all that. So if you're in a place where you always have to do that, where you always have to pander to the leader or pander to your peers, or you're afraid that it's not going to be a good time, and it never seems like it's a good time, then that may also be your feedback about the environment that you're in. Being in a hyper political environment actually also causes you to develop that kind of sensitivity. But is that the environment you want to be in? So I would say it's a double sided coin in that you do want to be thoughtful. I mean, just with our family members too. I've got family members who, you know, they want to have a conversation at, uh, what feels like to me sometimes the most inopportune time about something that is not urgent at all, but they really want to have that conversation. Sometimes you acquiesce and sometimes you just say, listen, I'm sure you guys are big football fans, you know, unless everyone in the family wants to join you, that's probably not the good, not the best time to be talking about family matters. Right? This is not a good time for a family meeting. We want to do this thing. Uh, so I think it's really important to find the right time and the right place to know how to approach. But also you have to be mindful that if you have to do that too much, you might be having a problem, some other kind of problem.

Speaker B: Yeah, yeah. See, this is why I brought up the whole paralysis side, right? And the more we talk, the more we discuss. I feel like the collective followership and the collective leadership is a symbiotic ideal. We have to be in a situation where we can be both. Because if you start finding yourself paralyzed and unable to communicate, now it's time to bring that leadership mindset into play. And see, you want to know what time for me to be a driver? I'm going to drive this message now because I can't be paralyzed by this. And this is where that symbiotic relationship begins, I think. You know, and again, the more we dig into this, there's times to be a follower and times to be a leader.

Speaker C: Yes, I think I would say yes, that's true, certainly. And I do talk in the book about kind of the dual role. So there are times when you have to lead within a context or within a certain capacity. I would refine that maybe just a little bit to say that there's always the time for influence. So again, you know, you may not be the driver, and that's the metaphor that I carry through the book to kind of help to keep things a little bit clear. There's one person at the wheel, but there are multiple people who can put inputs in around navigation, around calling out danger. Um, and those people are not the drivers. So they are not in that regard a leader. But they certainly have many of the attributes and they exhibit them in a leadership capacity. Right. Even though they don't have ultimate responsibility over the way that the car moves or who is driving. And so I completely agree. And the essence is precisely that, that we need to work together, that the relationship is symbiotic. And it goes back to that quote that I told that I shared with you. Right. Uh, there is no leader without followers. By definition it has to be that way. But you can have a bunch of people running around like sheep or like cats. It's not going to be very effective. Your organization's not going to get very far at all. But you do have those people who are there. So I think corralling, yes, corralling your followers, getting them on that framework or within a system is ideally how an uh, organization functions well and can achieve. But it's really about that influence. And so I think, yeah, uh, I don't want to split hairs, but I do want to make it clear that this is sort of how the book, um, does address this question, does sort of wrestle with this question because it can be quite easy, um, to kind of slip into, immediately slip into leadership. That anything that a follower does, if it's assertive, that if they demonstrate autonomy, that if they demonstrate courage or if they go against the grain, that they are somehow now a leader. Yes, they are demonstrating leadership capacity, they're demonstrating those attributes and maybe in a smaller sense they are leading, but they are not driving the car. Uh, as a whole.

Speaker B: Yeah, yeah. I'd love to make this a three hour debate.

Speaker C: the end of the day, I don't think it even has to be debate. Right. It's a matter of. It's a perspective that I hope awakens the masses who are following without thinking and um, without taking responsibility.

Speaker B: Yeah, no, I mean, I understand what you're Saying, But I take a look back in history and I see that some of the most profound leaders on this earth didn't have followers. You have pioneering scientists and whistleblowers and visionary thinkers who were thought to be crazy. They had no fault. Einstein, people thought Einstein was crazy, Right.

Speaker C: Contemporarily. And maybe not at the time. I mean, nobody bought a Van Gogh right. Until after the guy was dead. But I would, I would suggest to you that certainly there are people who follow. I mean there, there are accounts all over. There's a museum in Amsterdam I've been to. So I hear you. But again, I think it's, you know, I don't know that anyone is a leader without a follower. You can take, you know, I mean, Jesus, mhm, Mahatma M. Gandhi, Martin Luther King, at various points in times, nobody cared about those people. They're all dead and gone long time. But I think it would be easy to say that there are still people who are followers, right. Who are their followers and also followers of the principles.

Speaker B: The beauty of those leaders though is they grew other leaders to bring up followers to grow other leaders to bring up followers to grow other leaders.

Speaker C: And we can do that.

Speaker B: Continuously grew leaders.

Speaker A: Yeah.

Speaker C: And followers can do the same. You know, the thing about it, and just to make, maybe clarify, maybe this is clarifying. So if we say that everyone has the ability to lead, uh, I wouldn't necessarily argue that it depends on the scale, the scope and what. But the one thing I can tell you is JP Morgan does not have 300,000 leaders. Right. The United States government, the United States military doesn't have a million leaders. But every single person who is there is expected to have leadership attributes and to execute them in their followership. Right? So it's a matter of thinking about where we are in the levels, where we are in the spectrum of time, where we are in the maturity of an idea. I don't disagree with what I think you're getting at, which is the essence of the book. We all have a responsibility to participate and to do so actively and thoughtfully. But that does not necessitate our being a leader. And another example, just to kind of drive that point home, we have all met in our professional journeys, people who were excellent at what they did. But if you told them that you wanted to promote them to some other role or more responsibility or to be people, managers or manage more people, they would tell you, no, they don't want that. And so in order for us to get the best out of them, we leave them as individual Contributors, subject matter experts are generally people who don't have big teams or maybe no teams. But we know that we can rely on those people. I don't know that we would consider those people leaders. It would be unfair. It would be unfair.

Speaker B: Yeah. No, at the end, the statement that you just made is validating, necessitate leadership. What I don't want to do is preclude folks from becoming leaders. Right, Absolutely. Um, so that was a key phrase that you just said right there. It's not a necessity to be a leader within this organization, but my leadership style says I'm going to give everyone the opportunity to be a leader. I'll never preclude anyone to be a leader in this organization.

Speaker C: And, uh, just to be clear, that is not at all what the book advocates or what I'm advocating. Right. The idea is not you can only be a follower. It is that we are making space for you to find your level. So, for example, in the corporate world, if you're in Big four accounting, if you're in banking, whatever it is, almost nobody wants to be an associate forever. That's not the point at all. That's not the basis of your recruitment from, you know, accounting school. The whole idea is one day you're going to be a partner, and that's why you got to work like crazy for $45,000 or whatever it is, and you're going to look back at this and think that you were mad. The idea is that there's this aspiration, this aspirational ladder. I'm kind of, uh, pushing against that a little bit, but certainly it doesn't, uh, preclude you. But again, there's no necessity. But in the meantime, until you get that level or until you achieve that title or that degree of responsibility, you do still have responsibility as a follower.

Speaker A: Kenyatta, thank you so much for joining us on Business Security Weekly. Great topic.

Speaker C: We're done. Wow. This is a quick conversation, but I really enjoyed, I really enjoyed the, uh, the discussion and the challenge. The challenge is very effective, very thoughtful, and I know a lot of people would also be thinking about these things and have that question. So I really appreciate the, uh, questions there.

Speaker A: Yeah, thank you.

Speaker C: Thank you.

Speaker A: Zero Trust is clearly the future as threats get faster, quieter and harder to detect. But implementing it shouldn't disrupt the business. Threat Locker enforces default, denied execution in a way that remains enterprise ready, scalable and operationally clean. Unknown software is stopped cold. Trusted apps stay contained, and drift is locked down across the environment. It's Zero Trust that works. In real enterprises and prepares you for the threats ahead. See why CISOs are adopting it at securityweekly.com threatlocker as Jason said, we probably could have gone another two and a half hours on that.

Speaker B: Absolutely.

Speaker C: Yeah.

Speaker A: Before we get into this week's articles, though, one quick announcement. Infosec World brings cybersecurity professionals together across industries from healthcare and financial services to government and the Fortune 500. Join the community in Orlando October 12th to 14th for practical education, new perspectives and cyber security research unveiled. Live listeners save 30% on their pass with code ISW26SW Savings by visiting securityweekly.com infosecworld 2026. All right, so, Jason, we have a followership article in here. We're going to get to it a little later. Um, before we get there, though, let's start with, um, our lovely first article, Stop Playing with the CISO Role. Fix Cybersecurity leadership.

Speaker B: Yeah, I mean, at the end of the day, this article has some really good points.

Speaker A: Right?

Speaker B: I mean, the CISO role is becoming very overloaded. There's a ton of pressures coming from every single angle you look at it from. You need to be a business strategist, you need to be a board advisor, you need to speak to legal risk, you need to speak to, you know, uh, technology. Uh, you know, it's, it's. There's a lot of pressure. We've talked about it. That's why there's so much burnout in the CISO role these days. Right now, part of the solution that gets presented is to stick another executive into the realm of the ciso. That's, that's the challenge that I'm seeing here, is now you want a chief security officer who has a CISO reporting to that chief security officer, creating a little bit more of that hierarchy bloat, I guess you could say. I don't know. It's tough, right? I mean, uh, I don't know many organizations who are going to invest in having a chief security officer and then a ciso. I mean, we're going to look at an article that talks about how many CISOs, that percentage of CISOs that are out there right now. And I don't, I don't think we've hit 50% yet.

Speaker A: No.

Speaker B: So, no, no.

Speaker A: And then the article right after that is about a, uh, deputy C cell.

Speaker B: That's right, exactly.

Speaker A: So these three articles all tied together a little bit, right? So you've got this concept of, okay, the CISO is overloaded, so let's give them more responsibility and Call it the Chief Security Officer. Okay, so now I got a Chief Security Officer, I got a CISO who's handling the information sign. That's right. They might need a deputy CISO to

Speaker B: handle the technical side.

Speaker A: So now I have two more people in the mix, like. And, uh, only 49% of companies actually have a CISO.

Speaker B: That's right, because at the end of it, we still haven't proven to the executive leadership and the board that they should be investing in cybersecurity.

Speaker A: Exactly.

Speaker B: Never mind three tiers of leaders. So why don't we tackle the, uh. If we get to the point where we have 90% of organizations with a CISO, then let's talk about, maybe we need to have additional roles there. But we're not there. We're not even close to, to being able to influence organizations to hire one security leader.

Speaker A: Yeah. Let alone potentially three leaders. Or even more. I mean, or even more.

Speaker B: Right.

Speaker A: The, the proposal here is to put some additional functions under the CSO role, which, yeah. It creates another interesting. Like, okay, where, where's regulatory and legal, and how does that all come into play?

Speaker B: Right, listen, I mean, maybe if you're a Fortune 100 company, but listen, 90% of the businesses in this country are small, medium businesses, maybe emerging mid market.

Speaker C: It.

Speaker B: They can't do this. There's no way. There's no way. Right. Yeah, there's no way.

Speaker A: So that. Yeah. So Deloitte comes out with some research. This article. The title of this article is kind of misleading almost, right? It's like Deloitte, 49% of organizations have a CISO. Okay. That's interesting news. Right? So, all right, it's 49% up from 31% since 20 years ago. Three years ago.

Speaker B: Yeah.

Speaker A: Okay. Uh, so let's just have that thought. Right? So the previous article, we want to create this new role, but yet three years ago we only had 31% of those roles. Now we have 49% of those roles. So we're not even a 50% to your point. Now we're creating a new role, uh, for those 49 percenters. The real interesting part in this article, though, to me was the actual Deloitte report. Right. So I pulled up the report and this is, to me the most interesting part of the article that was not in the title, which is the shift from stability to strategy and, and how the mandate has changed. Right. So what is. What's going on? Right. And, and so I'm gonna, um, I'm just gonna walk through this because I think it's interesting. So if you go into the article, you gotta click the report article, which is a blog, and then you gotta actually go get the report. So it's 2. 2 clicks. But here's what's interesting. 79% of tech leaders say driving measurable business outcomes is a top priority in 2026. It aligns to what we've been talking about on this show for a long time. Drive business outcomes through technology. Right. But then number two, 77%. Ensure compliance with evolving digital regulations. Okay. Interesting.

Speaker B: Right.

Speaker A: And embed cybersecurity and digital resilience across the organization. Expand and retain top technology talent. Demonstrate strong financial and operational discipline. Transform data to enable AI and agents. This is what CSOs need to be focused on.

Speaker B: A thousand percent. Aside from the AI side, which we've been talking about for the last year.

Speaker A: Right.

Speaker B: Everything else we've been talking about for the eight years I've been on this show.

Speaker C: Right.

Speaker B: Seven years and change. Whatever it is. Right. I, uh, mean, at the end of the day, these are the things we've been talking about every single week.

Speaker C: Week.

Speaker A: Yes. On the show, six of the seven we talked about.

Speaker B: That's right.

Speaker A: Articles around, all this stuff in there.

Speaker C: Right.

Speaker A: Obviously, number seven. And AI is. Look, all this crazy, um, catastrophic AI doomsday news dropped over the weekend. So wait until next week's article.

Speaker B: It's been all over the news. But I mean, still, if you talk to CISOs, the majority of them are concerned about autonomous AI, concerned about the sprawl across their organization. They're concerned about their lack of visibility into all of the AI applications and agents and things happening throughout their ecosystem. The majority are very concerned because there's a huge visibility gap on what's going on in their networks right now.

Speaker A: Exactly. Uh, one of the big topics that that's happening internally in my day job is all about this concept of responsible AI and how do you actually govern AI.

Speaker C: Right.

Speaker A: So a lot of early solutions, Jason came out around this concept of AI governance, but it was a paper exercise.

Speaker C: Right?

Speaker A: Paper exercises aren't going to work here.

Speaker B: No.

Speaker A: Because look at all the stuff that's happened with the breakouts and all this other stuff. You think me reviewing and having a policy on AI and then manually validating some controls once a year are going to prevent an agent from breaking out?

Speaker B: No, I mean, we talked about it on the show. The traditional cybersecurity controls do not work anymore.

Speaker A: Yep.

Speaker B: Until you can start managing things like agency within your organization, you're going to have hugging face all over the place. I mean, honestly. Right. I mean, at the end of it, these agents are trying to win the game, and they'll use whatever method possible to win the game. And we're, We've. We're seeing it all over the place now. Right. So, I mean, we have to really take a step back and say, all right, traditional controls may not be enough. We have to be doing more with guardrails and making sure we're focusing on the agency that these AI agents have within your ecosystem, within your organization, and really start to focus on that. Yeah, it's about the harnesses and making sure that we have the right guardrails there. And, I mean, there's a lot to this.

Speaker A: Yeah, there is a lot. I think we're going to see a lot more articles on this topic now that everybody kind of, from the AI leadership, it says, yeah, uh, we probably need to slow down. Which now prompts, well, is Congress actually going to do something about it? We'll see. Yeah.

Speaker B: I mean, it's the tug of war that's happening right now because, you know, the tug of, the tug of war. One side is saying we need to slow down. It's, you know, it's risking humanity. And then the other side says, well, we're at risk for humanity if China gets it before us because they're going to come destroy us with AIs. So, you know, it's doomsday on both sides. Uh, right now, this is the conversation. If we don't do it first, China's going to do it first, then we're in trouble. But if we let AI go crazy, we're in trouble.

Speaker C: Yeah.

Speaker A: Yeah, Exactly. Article number three, the growing case for Deputy CISOs in the environment. Cybersecurity teams need a leader, or do they need two? We just talked about authority, which is a cso. I was really hoping Ben was on this week. He's traveling this week because I know he's got some strong positions on this

Speaker B: topic, which, I mean, you know, it makes sense. You can put whatever title you want on these roles. It makes sense to have a strategic leader who has a leader who can take away some of the tactical, everyday, maybe technical side of the aisle, uh, personnel management pieces. I'm not opposed to having a deputy, but, you know, cut the cloth any way you want. Do you want a, A CSO with the cso? Do you want a CISO with the deputy cso? Do you want or, or wait, directors or VP level folks doing it? It's about, it's about what they're doing versus the title to me.

Speaker A: Exactly. So maybe you want a CSO, but now you have maybe multiple deputies or VPs in those leadership roles underneath to account for these different.

Speaker B: That's right.

Speaker A: Areas. Right?

Speaker B: Yeah.

Speaker A: That would be logical.

Speaker B: Sure.

Speaker A: Have a cso.

Speaker B: Yeah. Yeah. The titles for me don't matter as much as the responsibilities that are taken care of right at the end of it. We know you need a strategic leader in that top spot. Name it whatever you want. Cso, ciso, whatever it may be. Depending on the size of your organization. You need that deputy level or deputy level roles depending on the size of your organization.

Speaker A: Right.

Speaker B: Someone who can allow the top leader to be strategic, not be overwhelmed with the tactical day to day and be able to make progress for the organization. Name it whatever you want, but we know you need those level roles.

Speaker A: Right. But we don't need C suite bloke in the process.

Speaker B: Absolutely not. It's about taking on the responsibilities and the accountability that's needed within your organization. And every organization is going to be different, but at the end of the day, you need to fill the spots of where so work can be done and folks aren't burning out and being overloaded. Right. You have to. You have to have the right size workforce for your organization to be able to take care of the. The action items that need to be taken care of for your. For your business.

Speaker C: Yep.

Speaker A: Agreed. Uh, what CIO CISO alignment looks like when it's working. Unless you own both roles like Jason. You have.

Speaker B: I have.

Speaker A: Would you think of this? Yes, I. What'd you think of this article?

Speaker B: I mean, I, uh, think it goes beyond just the cio. Right. We've talked about this before that as a ciso, you have to be out there building strong relationships with your peers. CIO is one of them. But I also think it's important to have a good relationship with whomever your legal officer is. Have a wonderful relief. I talk about this all the time. The cfo. Listen, if you want to have influence within an organization, start building a great relationship with the cfo so you can talk about quantifying risk the way the CFO wants to and the board wants to hear it, not the way the CISO thinks it should be. Right. Have a great relationship with HR so you can influence hiring practices and change the dynamic of the old school hiring practices that we've been in. It's important to have a relationship around the horn cio. Of course.

Speaker C: Of course.

Speaker B: You want to have a great relationship with the top technical lead within the Organization, who's making decisions on what software vendors you're going with, what hardware vendors you're going with. Right. The overall technology ecosystem. You have to have all those good relationships.

Speaker A: Yes. The article from the previous segment, collective leadership or collective followership?

Speaker B: I mean, obviously from the last session, you know that I'm a fan of collective leadership, right?

Speaker A: Yeah.

Speaker B: Um, you know, I do truly believe that it is this symbiotic relationship between following and leading. Um, but I don't. I personally would never want to build a culture that by nature perceives that you would not be included in a leadership role on the day to day. Right. So, yeah, I don't like defining people as followers. I want everybody in my organization to have an opportunity to be a leader. If they choose to be a follower. That's wonderful. They will have every opportunity to lead that I could ever possibly give them. And by coining it, and maybe it's just a marketing thing in my mind, but perception becomes reality. If it's collective leadership, everybody feels unable to be a leader.

Speaker A: Yeah. So he says it in this article. Collective followership and collective leadership. The difference is not hierarchy. The difference is responsibility. And we talked about this in the previous segment.

Speaker C: Right.

Speaker A: The goal here is to make people responsible. Right. And then participate. And then if they want to be leaders, that's fine. That's why I think where we landed in that previous segment is, is kind of the symbiotic relationship between leadership and followership.

Speaker B: Right.

Speaker A: And those that want the ability to potentially lead can. Those who don't don't have to either.

Speaker B: That's right. That's right.

Speaker A: And it was just interesting that this article comes out September 1st in this tranche from. Because we would have covered it, you know, if we did a show last week, we, we would have potentially covered this article last week. It just happened to align because last week was the holiday that it landed on this interview segment. So security, uh, teams are overwhelmed. In 2025, more than 48,000 vulnerabilities were disclosed, yet only a small fraction pose real risk. Most organizations remain stuck in a reactive cycle, responding to everything without the clarity to know what actually matters. Origina, a global provider of independent software support, is built on one principle giving organizations control over their own it Roadmap risk and critical systems. Optus by Origina, is a predictive intelligence service that brings that same approach to security, helping teams predict risk, validate what matters, and act with confidence. Visit securityweekly.com origina for a conversation with a security expert today.

Speaker B: That's right. That's right. But, yeah, it is. I mean, there's always a choice that you sit back and you make and say, all right, is this my time to lead or my time to follow? You know, and it's. It's a constant decision that's being made. Um, but again, for me, maybe it's just terminology and putting the. The leadership term in front of people. So it's front of mind all the time. Everybody has an opportunity to be a leader.

Speaker A: Yes. Why judgment is emerging as cyber security's defining skill. I would actually expand this beyond cyber security, Stu. Defining skill. I think this is humans defining skill.

Speaker B: Yeah. I mean, it 100 is. It's across the board. It's not just for cyber security. I mean, you know, good. Good judgment is something that. I mean, I think it's becoming a lost art right in. In the world today. I really, really do. You know, it's. It's. I think it's something that can be coached. I think it's something that, as. As leaders, you can help folks on your team with. But, um, at the end of the day, good judgment, I think, is one of those skills that you should be interviewing for. You should be seeing folks as far as aptitude with having good judgment, put them in scenarios and interviews to see what their judgment would be like. But on the same token, we have a responsibility as leaders to give our folks the right context. We have to give them. Otherwise, they'll be blind to the business context and the business strategy and the values of the organization or the mission of the organization. So we have a responsibility as well to not bottleneck folks and make sure they understand the context.

Speaker A: Yeah, because context can change the decision.

Speaker B: Absolutely. Absolutely. It matters. It matters. I mean, you know, uh, to boil it down simple, employees need to know what winning the game means. If they don't know the rules to how to win the game, maybe they won't play the game the right way. Right. So you have to give them the context on, um, what winning means.

Speaker A: Right. Well, AI won't. AI won't.

Speaker B: So do whatever. Right? That's right.

Speaker A: Exactly. And that leads into our final article, Layoff Remorse. Gardner says at least one in three positions eliminated by AI will be restored by 2029 at a higher cost.

Speaker B: Who would have thunk? Of course. Of course. I mean, you know, the second we started seeing all of these layoffs, we saw the writing on the wall. Is AI really going to be able to replace all of these humans that have. That are being let go as part of Rifts? Highly unlikely. And now we're starting to see this reversal. I mean, listen, what was the last stat that we saw? 70 plus percent of AI projects have been failing. Yeah, so there you go right there. If 70% of the projects that are failing are, uh, ones that you basically said as a leader, you know, I don't know what, I don't need this entire team of people anymore because I have AI and now your projects have failed. Bad decision.

Speaker A: Bad decision.

Speaker B: And it's going to cost you more money for that bad decision.

Speaker A: Exactly. Because now you got to hire them back. You're going to hire them back at a higher price. Um, yeah.

Speaker B: And again, what was the hit on the productivity of the business? What was the hit on your ability to innovate at a certain pace? What was your, you know, there's, there's ancillary, you know, hits that the company's going to take because of this.

Speaker A: So that's the other number that's in this article. It also predicted that by 2027 next year, 75% of organizations that prioritize capturing AI productivity games as cost savings will be eclipsed by competitors that aggressively reinvest those gains into innovation, modernization and upskilling.

Speaker B: Yep.

Speaker A: So you're right, Jason. Right? Yeah. It's not only the, the fact you have to hire them back. You're also falling behind your competition.

Speaker B: That's right.

Speaker A: Now innovating faster than you are.

Speaker B: That's right. You just, you just set your organization back by doing it. Yeah. You slowed it down. You slowed the organization down.

Speaker A: Yeah, yeah.

Speaker B: Live and learn, people. Live and learn. You can't, I mean, you can't be knee jerk. And a lot of these organizations were just knee jerk. It was a knee jerk reaction.

Speaker A: It was a knee jerk reaction. But they also, some of these public companies got huge, huge stock gains out of this. Right. They're like, look, they're cutting costs. They're using AI to cut costs. So their margins m are going to go up. Their profitability's go up. So a bunch of these public companies got huge stock gains from this. What happens in 2029 when you now have to hire them back at more costs?

Speaker B: That's what I want to see. I want to see what happen to these companies now because they got their little bubble. They got the little bubble. Was it worth it? I want to see if it's worth it. Yeah, let's see what happens. I can't wait.

Speaker A: Find out. Yeah. Oh, Jason, always a pleasure. Thank you for joining me today. Thank you everyone for watching and listening. We'll see you next week on Business Security Weekly. Uh, thank you for watching. If you enjoyed this content and would like to find more, see what the rest of the Security Weekly network has to offer. Visit securityweekly.com subscribe to find all of our shows and the latest episodes. Hope to see you on a future episode.