Fireside Chat w/Jeffrey Wheatman, SVP & Cyber Risk Evangelist @ Black Kite

Hello and welcome to our fireside chat. This is the replay and you got here right on time. So thanks for joining and thanks for being a member of our community. We hope you enjoy the rest of the show. All right. Hey everybody, happy new year. Oh, first of all, are we still doing happy new year? I know it's, I know it's the 17th of January, but I haven't seen or heard you all this year. It's because you took down your Christmas tree, man. You should love it. It's a February 1st. All joking aside, I really did. I really did. I just unplugged the lights in front of my house this weekend. We celebrate in my household, we usually celebrate past up until three Kings day. And then since my birthday is usually close by, we extend a little bit because I like to come home and see the lights. There's nothing wrong with that, Katie. No, I love seeing the lights. I'm always just trying to chase the light. All right. Look, let's jump right in because it is the new year. We're happy to be back. We're happy to see people in the audience and we're happy to be joined this evening by Jeffrey Weidman, who's a cyber risk expert and evangelist and thought leader. I'll leave it at that very basic title because there's so much to unpack about Jeffrey, his journey, his origin story, where he's done, what he's doing with his career right now and where he's been and how he's helping people be successful in cybersecurity. So we'll get into that in a minute. But before we get into that, I just want to remind you all, this is our monthly fireside chat. And we do this once a month and we've done this since, wow, I think 2021, I believe. So we're going strong and we're happy to be back in the new year with a new fresh take on different guests sharing their origin story. So just a quick set of ground rules, our opinions and comments are our own and do not represent our current, prior, or even future employers for that matter, given that this will be replayed back. So it is Wednesday. It's the middle of the week. Let's have a good time. Actually, let's have a great time today because it's the start of a new year and a start of a new set of conversations that we'll have. We're happy to have everybody here joining us. We're going to go around the room quickly and then we'll get into the conversation. Jeffrey, we'll leave you for last. So I'm Tomas Maldonado. I'm the CISO for the NFL. Katie, over to you. I'm Katie Hanahan. I'm the deputy CISO for Ingredient. Russell, over to you. So amazing to be here. And Tomas, I'm just thinking that we're not a terrible two anymore. We're like three years old now. This is so amazing. Russell Eubanks here started and founded my own company, Security Ever After. Teach with SANS, do some work with INS. But the best part of my month, best part of my year actually, is being here and a part of the Fireside Chat. And it's with my great privilege I get to hand the mic over to Octavia. Hey, everyone. This is Octavia Howell. I am the CISO of Equifax Canada. And I'm happy to be here. Happy New Year, everyone. I know we're going to start off with a bang. And I'm excited to hear from Jeffrey. So before that, I'm going to hang it over to Stephen. Hey, everyone. And Happy New Year. My name is Stephen Garcia. I've been in the information security game for my entire career. Met Jeff a while ago. Also, I think for full disclosure, I should mention that I am a client of his wife, Debra. I have used her services before and super happy with them. I want to make sure I made that disclaimer before anything else. Who's up next? I think it's... Am I passing it to you, Tomas? Or are we giving it to Jeff? You pass it back to me. Got the baton. One last thing that I forgot to say. If you are a vendor in the audience, we appreciate you. We cherish your feedback. We encourage you to join us in the conversation. And by every single means possible, we encourage you to stay active and engaged. I know you might be tempted to sell us on your product or solution. If you do jump on stage, I will urge you to hold back that sort of desire to sell us on your solution and really use this as a day to have a conversation and learn more about Jeffrey and his journey and save those sales pitches for another day, another time, another place for that matter. And I do know that Jeffrey is a... Jeffrey, should I call you a vendor? I don't know what to call you. Why don't you take a moment and introduce yourself to us and our audience? And while you're doing that introduction, why don't you tell us a little bit more about you and your origin story? And feel free to go as long or as short as you like. Really? You're going to tell me to go as long as long? How long do we have? An hour and a half? I don't know. I got a lot to say. Here's what I'll tell you, Tomas. You know what? I would actually very much be honored if all of you would refer to me as friend and leave it at that. I think we're all in this together. I work for a vendor now. I worked for Gartner as a cybersecurity analyst for a bunch of years. I built consulting practices. I've run security programs. I've been on all three sides of the proverbial fence. First, I just want to thank everyone for you guys for inviting me. I also want to just let you know, Stephen, Deborah is actually on the call. So she's very happy that you gave her a shout out. I also just want to say, two of my kids are on and my sister. So I think my family is about half of our audience now. My mom was going to be on, but I don't think she knows how to use LinkedIn Live. But my story is interesting because I started off not even in IT. My first job out of college, I managed a hardware store in Manhattan on 8th Avenue and 38th Street. And we didn't sell computer hardware. We sold pipes and electrical and all that. And I did that for a few years. And I learned something very important about myself. I hated working in retail. So I said, what am I going to do with myself? I've always been pretty good with computers. So I decided I was going to go and get trained in computer. And I actually went to a training class and I got certified in updating myself Novell Network 3.11, which was one of the first business networking systems that was out there. And I really loved what I was doing. I love the challenge. I love the fun. I love, I'm a big fan of learning. I always want to learn new things, no matter what I'm doing. My dad taught me when I was a young man, any day where you don't learn something new is a waste of a day. And the great thing about moving into IT and now what I do now is I'm always learning new things. I learn things from all the folks on the call. I learn things talking to clients. I learn things talking to my colleagues. I work for a very young company and it's great because I'm learning stuff from people who are in their 20s and 30s, which I never really thought would be something that would be the case. So I went out and I got this Novell certification and I stumbled into a job working for a company called MCS Canon in New York City. This was right around the time when color printers first became popular and affordable. And I ran the team that deployed these things in customer sites. So print shops, print bureaus, advertising agencies, et cetera. And I didn't really, it wasn't super technical at the time. I had the certification, but I learned so much doing that job because our salespeople would go out and they would sell stuff that we didn't actually know how to deploy. We didn't know how to integrate. We didn't know how to get up and running. So I had to teach myself Solaris. I had to teach myself Linux. At the time there was only like one flavor Linux. I had to teach myself all of the network operating systems so I can make sure that my team did what they were doing. And that was a really fun job. And I worked there for about 18 months and I got some other opportunities and I moved around. So in my career, I ran security network operations for Martha Stewart Living in New York City, which was an amazing experience because at the time nobody was really doing security. And I had to build a program basically with Band-Aids and bubble gum. There was no money. There was no budget. I had a bunch of really smart people that worked for me. And I went, okay, we like, we got to figure this out. These assets are valuable. And when I started asking people around, what should we do? They were like, why is this important? And I said, you've told me each one of these digital images you have is worth $3,000. But what if somebody stole them all and put them in their own magazine? And they started paying attention. And that was like my first exposure to being able to communicate the business impact of the stuff that we do every day. I could have said, we got to protect our files and ones and zeros and hackers, but that wouldn't have resonated when I went to them and said, you've told me these things are valuable. What should we do? And we were able to build a program basically with no budget. And that was fun. And I worked there for about three years. And then I decided I wanted to go out on my own. And the question always comes up, so I'll answer it. I was running network and security when Martha was going through all of her legal troubles. So I was the interface with the feds. I was the interface with the law firm. I was the interface with a whole bunch of our customers. And again, I learned a ton about digital forensics doing that job. And I learned about how to effectively communicate with people that didn't have the tech background. Now, every big law firm has cyber and tech people. Back then, they didn't. Like the story I always tell people, they wanted all of Martha's files. So I burned all her files to a DVD. And then I ran a checksum, an MD5 checksum against all the files. And I sent them in two separate envelopes to the law firm. And the law firm said, what is this? I ran MD5 checksums. What's that? It makes sure that no one changes the file. So here's what the law firm said. Why would anybody want to do that? I don't know. Maybe they want to catch someone in a lie. Maybe they want to railroad somebody. Maybe they want to cause challenges and difficulty for people. And at the time, it never occurred to them that this was anything that people had to worry about. So I was there when they knew Martha was going to jail. I was getting phone calls on a daily basis, weekly basis. Who do you got working for you? Why are we paying them? So I knew that things were going to grind to a halt. So my former boss and I and another colleague decided we were going to start up our own security consulting company. The name of the company was Brute Force Security. Some of you may have heard of it, but actually you didn't. We just came up with a really cool name because everybody knows the term brute force from password cracking and from breaking encryption. So we did that for about a year. I learned a lot of lessons about how not to build a company. We got an office. Don't do that if you're starting your own company. We bought a rack. We bought servers. We spent a ton of money on technology, none of which we really needed. Did that for a little while. We quickly ran out of money, which again is how not to start a company. And I stumbled into an opportunity to go and build and run a security consulting practice for a company out of New York. And it was really fun and interesting. And I got to build this whole practice from the bottom off. And we created a menu of services and we built these whole delivery models. And we went out and the company was a company called ThruPoint. I'm not even sure if they're in existence anymore. But it was an interesting company because the folks that built it were the people that built all the market data silos for every company on Wall Street. So really deep technical expertise, not necessarily a lot of security knowledge, but I learned a lot from those folks on how networking worked and fintech before it was even really fintech. So, you know, building and I pulled all these things from all of these different jobs. I did that for a little while and then I wasn't really challenged anymore. I got an opportunity to go work for another consulting company in Northern New Jersey, where I actually really, they unleashed me a little bit there and it was really fun working there. We had a lot of really interesting customers and clients. The company was around during 9-11 and they rented a bunch of trucks and they drove them down to IBM's fulfillment warehouse in Southern New Jersey. And they loaded the thing up with a bunch of servers and they brought them to all of their customers and they basically showed how customer service should be done. So for a small company, they had a lot of really big customers. So I got to work with a lot of those folks, really senior people running programs, running IT, running security, because now security was starting to become more a more common thing. And we built that whole thing up and I had a great time there. The challenge I had there was I wanted to sell strategic functions. I wanted to sell strategic projects. I didn't want to go in and deploy a firewall. I wanted to go in and do risk assessments when everybody was just doing vulnerability scanning. And unfortunately the salespeople were, they didn't understand there was a longer sales cycle. They didn't really understand the concept of strategic relationships. They wanted to sell a product. I know Tomas, you mentioned vendors, and there was some interesting conversation on LinkedIn earlier about folks on our side of the table. But it was again, a really interesting opportunity just to learn how these things should be sold and how they should be discussed and how they should be pitched and how to engage and, and how to have these conversations. And it was at that job where I started picking up the, the skill that I try to teach everyone, which is telling stories, right? How do we become more effective communicators, especially with stakeholders that don't necessarily understand the language that we speak? So it was really fun. I was starting to go in front of boards of directors. I've been in front of like a hundred boards throughout my career. And I did that job for a little while. And I have a cousin named Victor Wheatman from California. And he worked at a company you may have heard of called Gartner. And he used to come in every year and we would do a big Chinese dinner. And I sat down and we were talking and he said, you might have a job working with us. So he did a mock interview sitting over Mugu Guy Pan and, and Chow Fun. And we thought there was a good fit. And that sort of was like a big bulk of my journey. So I worked at Gartner strategic advisory firm. For those of you that don't know, I shared the Gartner security conference in Washington, DC. And at that job, I had opportunities to be exposed to some really good people, some really senior people. Some of my closest friends still work over at Gartner. And it was just a great opportunity there to learn from people who knew things I didn't know and had perspectives that I didn't have and had views and thoughts and things. And I learned that it was okay to have ideas, even if you didn't think them out, because you could bounce those ideas off people and they would help you flesh them out a little bit. And that job was just a blast. I was there for 15 years. I had a great run. I've done hundreds of presentations. I've spoken with probably 10,000 or more clients. I ran workshops, I was able to create a bunch of really cool research from scratch. I don't know if any of you have been to the Gartner conference, but the keynote focused on a consumer packaged goods slash pharma company. And they were talking about how they have this skinny down version of doing risk assessments. And I'm sitting there in the audience and I'm going, I taught them that. Like, that was huge for me to see my ideas out there in practice. And I'm not going to take credit for all these things, but it really is special to be able to get with people and help them solve problems that they're that they were really struggling with. And that job was just so fun. I got to travel all over the world. I've been on every continent except for Antarctica, because there apparently there are no security people down there, just just penguins. But I've been to Sydney a bunch of times. I was in Singapore, I've been to India, I was in Tokyo a handful of times, obviously been all over North America, spent a ton of time up in Canada. And it was just it was such a fun job. And they're 15 years, that's a pretty good run. 15 years in any job is a long time. And one of the markets that I covered is the market where Black Kite sits, which is security rating services. And I was talking with my boss, now my boss, and I hung up the phone and I said, I think what you guys are doing is cool. I'd like to help. And three months later, I made the move. And it was really tough for me to leave an environment where I was so comfortable. I had been there for such a long time, everyone knew me, I could pick up the phone, anybody would get on the phone with me. And to make a move from a company with 30,000 people to a company with 100 people was such a paradigm shift. The joke I used to make all the time is when I was at Gartner, and I was chairing the conference, I put my hand up and say, I need and whatever it was, it would be in my hand before I even finished requesting. Now working for a startup with 100 people, I put my hand up on the guy I need, and they go, you better get on that. So again, another paradigm shift in my career, really different things, having to provide a lot of my own editing support and graphic support. These are all things that I didn't really have to worry about working for a big company. And the joke I make all the time, and Tomas may have heard me say this, the best thing about my job is no one tells me what to do. The worst thing about my job is no one tells me what to do. So I have this title. So my title is cyber risk evangelist, which is a title that essentially we made up for this role. Really, what I do is I think about things, and then I get to talk to people about the things that I think about. We focus in the third party risk management space, but I still talk to people about storytelling, and metrics and how to communicate with business stakeholders. Last year, I flew, I was on I think 87 airplanes last year. And that's a big change, because when I was in my previous role, I flew less, but I flew farther. So last year, I was on the road constantly. There was one stretch where I did 15 out of 18 weeks on the road, which is not all that fun. And when my wife was, you know, home with my kids, it wasn't so bad. But now my youngest is off in college. So now when I leave, my wife is really alone. So I'm going to try to be more efficient in my travel this year. But one of the coolest things about the job is, is now I'm closer to a particular subset of problems, right? When I was at Gartner, I would talk to people about 50 or 100 different things in any given month. But now I talked to people about a much narrower set of problems. And I maybe it sounds naive, although at 56, I probably shouldn't be naive anymore. But I really want to help people solve problems. I want to help people be better. I want to make the world a safer place from a cyber perspective, from a risk perspective. And I know it sounds, I don't know, it sounds silly, but it's really true. I really want the world to be safer and to be better. And one of the challenges I find is all the vendors are cutting, they're trying to cut everyone's throats. And I just feel like it's just not a good way to work. It's not a good way to do business. There was a guy that I follow on LinkedIn, who posted something earlier today about something very obnoxious that a salesperson did. And I just went, I wouldn't want to be sold that way. And I would never, ever let our salespeople do that. And yet, I just like all of you out there, I'm sure on a daily basis, you're getting LinkedIn connections or emails or texts or whatever mechanism people are reaching out, trying to sell you something that shows they clearly didn't do any research. They don't know what you do. They don't know what your company does. And that to me is a problem that we need to change. There's just so much out there. There's so many bad actors. There are so many more bad actors than good. They have no ethical or moral boundaries. And we as defenders need to be perfect. And the attackers only need to find one scale missing from the dragon's hide to get in. And they don't care about us. They don't care about people. They don't care about business. All they care about is money, which is not necessarily a bad thing to care about, as long as it's not at other people's expenses. But they care about fame. They care about getting their names known out there. And I'll just close with one thing. So I have three kids. My youngest has always been very interested in what I do. And one of the sort of side hustles I do, not that it makes me any money, but I am a goon at DEF CON. So I work with the speakers at DEF CON. I escort them from the ready room and get them on stage. I make sure that everything is working, AV. And then when they're done, I get them off stage. And it's really fun. I've been doing it for the last 16 years on and off. And I got to meet some of my idols. I got to hang out with people who I learned from when I was learning how to do pen testing. I became friends with Dan Kaminsky, who unfortunately is no longer with us. I had a scotch with Theodore, the guy that wrote NMAP, which is the core of pen testing. And I just got to meet all these unbelievable people and become part of that community. But every year when I go, I always bring my daughter a shirt. And I always make sure it says hacker on there. And the first time she went to school, somebody said, hackers, aren't they bad? And my daughter got, bless her soul, said, no, hackers are people that get systems to do things they're not supposed to do. Crackers are the bad people. And I was like, I was so proud because that's exactly what we teach people, right? Hacking is getting systems to do things unknown or unforeseen. And I'll share one last story and then I will pause. A bunch of years ago, when I was in consulting, we did a project for a bank and we interviewed the application developer for their market data application. And I asked him a question. I said, so you wrote this new application. Did you write the application to run on the network? It was a highly redundant network using all kinds of failover. And you know what he said? He said, I was told that the network was 100 megabits. So that's what I wrote for. And I had a little bit of an epiphany because he was so heads down and so focused. He knew what he needed to do and didn't really understand what other things were at his disposal. And I think that's a lot of what we run into these days is lack of communication or poor communication or miscommunication. There was a thing on LinkedIn the other day, a CISO put up a thing and he said, so what are some phrases that make you crazy? And one of them was people are the weakest link. And I said, I have to be honest with you. I think that's a true statement, but it requires context. Why are they the weakest link? Or maybe we're not educating that. Maybe we're not giving them the right tools. So what if they're the weakest link? Then they can get their data stored in and have downtime. And what are we going to do about it? And I think, you know, that's so much of what I do and have been doing for the last bunch of years is taking all the stuff that all the folks on this call do and actually turning that into business language. So our business stakeholders understand what it is we are trying to accomplish and why. And I think this is going to become more and more important with the new SEC ruling, with DORA out of the UK, a lot of the state regulations. We're seeing more and more focus from a legal and regulatory perspective on, are you defensible? Are you doing the right things? Are you spending in the right way? Are you protecting your businesses? Are you protecting your shareholders, your stakeholders, your customers, your employees? And I think unfortunately, a lot of people are not really doing that in a very effective way. So that's been my career pathway. Um, so that's what we got. Jeffrey, you took us on a journey. We went from your first job at the hardware store on 8th and 38th in Manhattan to being on the bleeding edge of, of risk and the way we're talking about risk now in this new world. Really appreciate you taking that time to take us on that journey. There are a lot of things that I noticed and really appealed to me. A million questions, but I think I only get one. So I'm going to just make a couple of statements just around, you said words like you, you, you're any day you can't learn something as a waste of a day that your father taught you very early on in your life. This is an origin story podcast, right? So we love to hear where someone like you comes from, right? The altruism with which you speak, I think is very much in line too, with the moderators on the stage. And, and the trick way that you came into this business, you stumbled into this business when you were running various companies. One of the things that I noticed though, that when you said you were at Gartner, you used the word fun. And I loved that because this is a really stressful industry. You pointed it out. Look at everybody that was on the stage. Look at the job that you do every day. It's not easy, right? Your time at Gartner, you found the fun in being a better storyteller and being able to be a part of something and to be able to change the world, just that, that little bit, right? That's hard work, but it's the fact that you use the word fun about that 15 years there. It was really interesting to me. So can you maybe expand a little bit more now in your day to day, whether it's now, or you could even go back to where that came from for you. I think that's so important because even early on when people ask me, people want me to mentor them or something. And I say, there's one thing that I can tell you. And it's, if you want to get in this industry, you have to love it. And that's what I heard when you said fun and you clearly love it. Could you tell us a little bit more about what your day to day is like, how you find the fun in the chaos and then what you would tell your mentees on a day to day? Yes. So that's a great question. And I'm a big fan of mentoring. There's a group out there, some of you may be familiar with called Cyversity, and they have a mentoring program. And I was actually a participant in it. And I really enjoyed that because I got to see the light go off on someone's head who wasn't really loving what they were doing and wanted to move into cybersecurity. But one of the great things about this job and really my last job too is every day is very different, right? Today, I recorded a podcast. I did a demo for a potential partner with one of our sales executives. I actually went for a two-mile walk this morning with my wife. It's a great thing about working from home. I updated some slides for a presentation I'm going to be doing at the ISAC Digital Trust World, I think is what it's called, out in Arizona in March, February, March, or May, some month later in the year. So I updated that. I'm continuing to play around with ChatGPT. That's been like a fun hobby for me, helping me work through my thoughts and being able to do it in real language. I also coached two of our salespeople today. We have a fairly young sales force, Black Kite. So I coached one of them on how to articulate the business value of cyber risk quantification. The other one is working an opportunity with an insurance company that we were just talking about. All right, so what's some of the messaging that's going to work with them? I spoke at a half hour catch up with my head of marketing because she and I are hip to hip talking about what we're doing through the year. Before we went live, Octavia and I had a very quick chat. She and I met last year at an event in Toronto called Cyber X run by a really good guy, Madi Raza. And we were up there last year. We're actually not going to be doing the event this year, but I'm always prepping for those kinds of things and seeing where I can help. And then the one thing that I've been trying to do over the last six months in particular is improve my networking. I'm one of those people, I always feel like I'm bothering you if I reach out, but it turns out people actually want to talk to me. And that's a big chunk of what I'm doing. So I had a virtual coffee with a friend of a friend who may end up being a partner or may just end up being a friend. And that's my day. Pretty much every day, it's just all filled with different things. And I also, I think back to the fun thing, Katie, I think it's a really important thing. Not everyone gets the opportunity to pick a job that they love. And I've been very fortunate in my life and in my career. But I think even if you don't love your job, you have to find some moments of joy, even if it's just taking a five minute break and proverbially sniffing the roses. I think it's so important that we find some joy either in work or out of work. I think if you can do it in work because we spend so much time here, I think that's great. But I also think that a big chunk of what I love about what I do is being able to help people solve problems. People refer to me as an expert and I hate that. I am an experienced practitioner. All that means is I've been around a long time and I've had the opportunity to make a ton of mistakes. And I share that because I think people learn better from mistakes than successes. What didn't work? I want to learn that. When I was at Gartner and I would talk to vendors, I would always say, don't tell me why you win. Tell me why you lose. Because I think you learn more from those kinds of things. So that's the thing. And I've also, I get to work from home, which is super nice. When COVID hit and everybody was stuck from home, I was like, oh, this is nothing new for me. I've been working from home for 20 years, which is, I recognize how lucky I am with that. Well, I really appreciate that and really appreciate you bringing it back to fun and to loving it. And speaking of, Russell Eubanks is another person in our industry who absolutely loves it. So Russell, I think you have your question next. I was wondering how you're going to navigate Russell, love, night. I thought, okay, where's this going to go? I love this so much. Hey, everybody, just do a quick room reset here. It's Wednesday night, once a month, as you should know, as you should tell your friends, we do fireside chat once a month where we get to know someone. And tonight, of course, our featured guest who you've been listening to the last several minutes is Jeffrey Wheatman. Always amazing for this. About 10 minutes or so, we'll be able to offer up a chance for you to raise your hand, come up and ask your question on stage. Jeffrey, get your questions ready. We'll come to you once we go through a round of questions with our moderator. So with that, Jeffrey, I have to tell you that I've got about 100 questions, but I'm going to restrain myself. And my most, I think my most interesting question is this one. You talked about, you said several times, you like to help people solve problems. I love that. If I'm being mentored by you and I'm not sure about this storytelling that you talked about, you've highlighted on your profile, how would you mentor me to make sure that I am successful at telling stories and also avoid defeat, some common defeats in ways that people try to do storytelling, but perhaps just doesn't resonate with their audience. Give us some tips, some things to do, some things not to do on storytelling, please. Yes. Thank you, Russell, because storytelling is my favorite topic of all the things I get to talk about. So I think the first thing, and interestingly enough, this was an epiphany that I had only a year ago. I was in front of an audience of about 400 relatively junior earlier in their career security people. And I was talking about storytelling and I'm looking at the audience and I'm going, you know what? I don't think any of you think you can do this. I'm going to let you in on a little secret. I'm an introvert. I would much prefer to sit at home on my couch with my wife watching Netflix, but I can't do that. So when I'm out and I'm on stage and I'm talking to folks like you guys, I play a character and that character is a very good storyteller. So I think that's the first tip is figure out what you want your storyteller to be. And then that's a character that you step into. And that character is a really good storyteller and they're fun and they're entertaining and they know what they're talking about. So stepping into that character, I think is really important. I think the second tip is figuring out how to get from your message backwards to the story. I think too many people start off with the story without understanding where they want to get to. And I think that is probably the biggest mistake people make is they just start talking without knowing where they're going to end. One of my favorite movies is Planes, Trains and Automobiles. And in that movie, Steve Martin is talking to John Candy's character and he basically says something like, when you tell stories, it should have a beginning, a middle and an end and a point. And I think we don't always know, and it's fine to have a conversation, but when you're telling a story, especially in a business setting, you want to figure out what your sort of end game is and work backwards from there. And then I think that the third tip, and this is particularly true, if it's something that you're not comfortable with, you want to practice, but you don't want to get to the point of memorization. And the example I always use there, for those of you that have seen the movie Catch Me If You Can, it is loosely, apparently very loosely based on the life of a gentleman named Frank Abagnale Jr. And I saw him speak twice, six months apart. The first time, he was amazing. One of the best speakers I've ever seen. I saw him again six months later and he was terrible. And you know why? The guy was bored of his own story because it was exactly the same. He was so over-rehearsed, he bored himself. So of course he bored the audience. And I think that's really important. And then the next tip is figuring out what your audience wants to hear from a resonating perspective. I think we have a tendency to talk about things we like, and that's normal, but we need to talk about things that they like. So again, we want to talk about things they're interested in, things they care about. They don't want to hear about your patch management problems. What they want to hear about is how you're going to keep the money flowing in, how you're going to keep expenses down, and how they're not going to be the ones that are going to get in trouble if something goes bad. So money coming in, money going out, and who's in trouble if something goes sideways. So thinking about that. And then finally, I'll close with one last tip, which is think in advance how you want your audience to feel. There's a quote, it's actually attributed to two different people. Maya Angelou is one, and the other is a guy named Carl Bruner. Bruner said it first, but Angelou said it better, which is people remember how you made them feel much more than the details of what you say to them. So how do you want your audience to feel? And this particularly is true for a CISO or a security executive. How do you want your audience to feel? And the common answer is we want them to be concerned, but we want them to be confident in our ability to deliver. So thinking about how you want them to feel and what the end result is. And I'll just put this out as a general offer. Anyone who wants storytelling coaching, reach out to me on LinkedIn. It is one of my favorite things to do, and I'm happy to jump on one calls and work with people on their storytelling skills. But thanks, Russell, for that question. Wow. Talk about deliver. You over deliver there. I said, give me a couple of tips. We got five plus an offer. I'm like, man, this is so amazing. And Jeffrey, I appreciate that. Octavia, over to you, my friend. Awesome. I'm agreeing. This is so rich. And Jeffrey, I appreciate you just being here. I actually want to go back, right? Because you talked about when you were actually, I think, working at Canon, you told them, hey, say each of these images cost $3,000 and we want to protect them. Did you know, first question, did you know that you were doing risk evaluation at that point? And then before you answer that, kind of coming back to it, how does it make you feel? And what do you think about just that evolution of the first time that you actually communicated risk out? And then seeing the industry, and now this is an entire practice, what is your advice? And how does it make you feel to actually see it come full circle? Wow, Octavia, you got right to it. Because until you said that, I didn't even think about it that way. And it was at Martha Stewart, by the way, not Canon. And as you can imagine, all those recipes and all those pictures, that's where the value was. But that's a great question. I didn't really think about it that way. I was always focused on what does the business care about? What are the outcomes? Even before I thought about it from a risk perspective, but you got right to it. So here's the thing. I think we are getting better very slowly. We are still having the same conversations we were having with people eight or 10 years ago. And I remember being on the keynote team for a conference one time. And one of the guys on the team said, we keep telling them they need to engage with the business and we need to have governance. And I'm like, and they keep not doing it. So we have to keep coming back. And I think that coming back to those things over and over again, I think is really critical. And here's a great example. I was at RSA last year. And there was a guy from I can't remember his name, but he was with the Federal Reserve in Cleveland. And he did a great presentation on risk appetite. The room was full. I was talking about risk appetite eight or 10 years ago, and there was nobody coming. So I think sometimes we're a little bit ahead of the curve. So I think the answer to your question, Alkavie, is we're getting better. I like some of the things I'm seeing. But unfortunately, what I also see is a bunch of people who are out there who still think it's security's job to protect the data, that it's security's job to protect the organization, that it's security's job to say no, stop, don't. And there's still too much of that out there. Instead of saying no, say that's a great idea. Have you thought about this potential bad outcome? Let's talk about how we can minimize that and still get you what you want, as opposed to saying, no, you're not allowed to do that. So those are some of the things that we are starting to see more of. And while I think the new SEC ruling, I think they took the teeth out of it when they took the board requirement out. But what I do think is going to happen is I think the business executives are going to start asking questions. And the CISOs better have a better answer than we need more money to patch, because that is not the answer. For the businesses, it's about balance. It's about, are we protecting appropriate with the level of our business model? You think about it this way, if I asked all of you, how long do you take to patch your critical systems? I'm going to get a bunch of different answers. And all those answers could very well be right. And that's the risk. Costs money. The more money you throw at a problem, the better you get at it, but you get to the point where you have diminishing returns. And I think those are some conversations I think that we need to continue to have. And that's why you and Tomas and Katie and Steven and Russell, we need you to be at the head of this because people are looking to all of you for guidance, not just me, especially now that I'm on the vendor side, but they're looking for you to set examples. They're looking for you. How do you do these things? How do you have these better conversations? And I know Octavia, you and I have a mutual friend, George, and he and I had a great conversation about that whole thing, which is how do you take the stuff you know you need to do and turn that into a business language so that they buy into it, so they give you money, right? And I don't think we do a great job of that across the board. I think we're getting better though. No, I agree. But I would love to figure out how we accelerate that, but that's for another conversation. You know what? Let's talk. I got some ideas. We'll talk. But for now, I'm going to pass it over to Steven so that he can ask his question. Thank you, Octavia. And Jeff, thank you for the time and all the insights you gave. You actually teed up my question with a comment you made earlier. Don't tell me why you win. Tell me why you lose. And I'm the opinion that mistakes are the way that we really learned some big lessons. And I'm thankful that you shared what happened with brute force security because I think it's important for people to understand that things don't always go the way you hoped or the way you planned. So aside from the obvious that you stated, it's obviously not a way to run a business. I wanted to ask you, what lessons did you learn from that experience that you may be applying today or think that people should take note of applying today? Again, not just the, hey, that's not how you run a business and burn money, but like the core of it. I would imagine that comes in pretty useful these days. Yeah, that's a great question. So I think there are a couple of things that I learned. I think there's a difference between what we want and what we need. And we have a tendency to do the things we want and not necessarily the things that we need. We wanted a cool office. We wanted a data center filled with gear. We wanted to hire 30 people. We didn't need to do any of those things. And in fact, they ended up undercutting us a little bit. Who knows if we would have been smarter up front, maybe we would have actually been able to build that and run. But I think there's a quality that people have that not everyone has to a certain degree, but we need to be somewhat self-reflective. We look back on decisions we made. And I think we need to sometimes say, why did we make that decision? Did it end with the outcome that we wanted? And if it didn't, we need to build that back in. So it's this overall, I think, iteration around we made decisions based on some assumptions. Now that the decisions are made and they've come to fruition, good or bad, we look back and we say, so did we make the right assumptions? I was in an event a number of years ago on data governance. It was held by a very big company and they had four people on stage talking about data governance. And they put a lot of time and energy into it. I got up and I asked them a simple question. I said, so what are you doing to make sure you made the right decisions? And two of the people said, what do you mean? Why would we want to do that? And the third person said no. Oh, and the fourth person just was like a deer in the headlights. So these are four CIOs for large companies that were investing what amounted to millions and millions of dollars. And it never occurred to them that they should figure out whether they were investing money for a good reason. And I think that's a really important thing, right? We're not terribly self-reflective. And I think that showing weakness as a leader is super critical. I think it is very underutilized. Harvard Business Review did a piece on how to be 10 years ago now, where they tried to compare and contrast successful leaders. And they use two criteria. One was they were viewed as knowledgeable and they were viewed as kind. And what they found was by a huge margin, leaders that were found to be kind and nice and approachable were far more successful than leaders that were found to be knowledgeable. So what does that tell you? It tells you that people want to be engaged. I am a huge fan of opening the raincoat and telling you about my mistakes. If I can admit my mistakes, then maybe you'll admit your mistakes. And if we don't admit our mistakes, nothing ever gets better. And I think that's a really important thing when we look back and try to get better. And it's a continuous improvement. Everyone on this call is senior in their career. So we've made a bunch of mistakes. And I think we need to continue to go back to them. And I think in particular with the advent of digital business and everything moving to the cloud and everything being so fast, we need to be very rapid about the way we iterate on those decisions. And we don't want to get analysis paralysis. We don't want to, I need all the information. I need all the data. I need to know everything, but you don't really because you get to the point where you have too much data and you end up with analysis paralysis. So getting the information that you need and then continually going back, having people around you that can call you out on your stuff, that will question you, that will ask you questions. Mark Cuban has a great quote. He says, if you're the smartest person in the room, you're in the wrong room because you need to learn. And the only way to learn is by being with people that are more knowledgeable, that have made mistakes, that have gone through the sort of ringer, so to speak. And let me tell you, I've made plenty of really big mistakes in my career. I'd like to think I won't make those mistakes again. And I think that's the key thing, right? Is it's okay to be fallible. It's okay to be open and honest with mistakes, but we need to make sure that we don't hold onto that and keep it. Because if we as leaders don't admit when we're wrong, then our people will never admit that they're wrong, which means we don't know what's going on. When I used to manage people, I had two rules. Don't lie to me and don't put me in a position where my boss asked me a question and the best answer I could come up with is duh, right? People need, we need to be open. We need to have that open environment so that everyone can learn, not just from our mistakes, but so that they can learn from their own mistakes and that we can learn from their mistakes as well. Jeffrey, I really appreciate that. Some sage advice and learnings there that I think a lot of us can apply. Just a reminder for everyone who wants to ask questions, now would be a good time to start raising your hand and getting yourself queued up as I pass this back to Tomas Maldonado. Tomas? Thanks, Stephen. Thanks, Maldonado. Great questions. Great conversation. I was trying to look up the definition of mistake because I don't know what that word means, Jeffrey. Oh, man. No, great conversation, man. Look, as Stephen mentioned, if you do have a question, feel free to raise your hand. We will bring you up on stage. If you want to join the conversation or say something to Jeffrey, please do that as well. And for those family members in the audience of Jeffrey, please raise your hand and jump up on stage. We got to hear some interesting stories of Mr. Jeffrey Rietman. So now is your time. That's it. Jeffrey, what are you, I was like, I'm an audio, audible sort of guy. I like doing audio books. I drive. It takes me about, unlike you, where you get to work from the coziness of your house. Sometimes I have to go into the office, actually more times than not. And it usually takes me about an hour and a half to get in. So three hour commute, not the best, but it does allow me and afford me a lot of time to listen to audio books. So that said, what are you reading or listening to today? Or have you listened to recently? That's interesting. I need to add to my audio collection. So yeah, I don't know that I'm going to help you all that much there. I do a lot of audio books too, but I don't really read work stuff via audio book. So I'm listening to, I'm a big fantasy. I'm a big sci-fi person. I actually just listened to the audio books of the Lord of the Rings trilogy. It was actually one of the first audio books ever read. It was by a guy named Chris Inglis. I really like that. I'm a big Stephen King fan. So I listened to a lot of that. I found that my attention wanders. So if I'm listening to something that I have to pay attention to, I either walk in front of a car, which down here in Florida is very easy because people can't drive here. So I tend to listen to stuff that I've already read. I'm actually right now, I'm halfway through Salem's lot, but I will tell you that I was on a flight about a month ago and I was sitting next to this very interesting guy. And we were talking, I'm one of those people, I always talk to people on airplanes. So if you don't want to talk to people on airplanes, I'm the annoying dude. But he recommended a book called Man's Search for Meaning by Viktor Frankl on about two thirds of the way through. Viktor Frankl is, he was in the concentration camps during World War II. And he talks about this whole philosophical journey that he went through. And it was, it's super, super depressing. So I haven't been able to kind of power through the whole thing. But I also, I like to read a lot of old management things. I'm a big Peter Drucker fan. I know some of his stuff is a little bit passe. There's a good book on leadership written by, I won't even mention the person's name because he's a very controversial character these days, but it was basically tips for leadership. And I thought it was really good. He gave examples from his career. I just started reading a fiction book called House of Leaves, I think is the name, that it's like almost like a puzzle book. So I have to concentrate pretty heavily on that. At any given time, I'm reading five or six different things, listening to a couple of different things. My kids think I'm crazy that I can do that all at the same time. I'd say not to read a lot of business books only because I find that most of the values in the first two chapters, and then the rest of the book is the writer talking about how smart they are. And I read the first chapter and then I move on. Good stuff. Thanks for that, Jeffrey. I'm listening to Hustle Harder, Hustle Smarter by Curtis 50 Cents Jackson. I actually find that book really fascinating. A lot of, maybe it's because of the New York connection with Curtis Jackson or 50 Cents, if you heard his rap music, but Curtis Jackson, he's actually a pretty smart guy, a really intriguing book. Anyways, a lot of points that he's mentioned in the book resonate with me and my upbringing. So it's- I just wrote it down. I'll put that on my list, Damas. Thank you. I was going to say just besides the fact that I was never, ever a drug dealer, but the other aspects of what he covers in the book are actually pretty interesting and pretty intriguing. So add that one to your list if you- Yeah, got it. All right. I'll pass it back over to Katie. Maybe Katie's having some microphone issues. All right. We'll go to Russell and then we'll come back to Katie. Yeah. Katie, I'll come right back. I'm sure of it. So I promised I had a whole bunch of questions. And the next one I have for you, Jeffrey, you mentioned your time as a goon at DEF CON, which you mentioned you got to meet some of your idols. You got to have experiences. And a lot of us are like drooling and I'm wiping the mouth. I'll drool off my face now just thinking about the exposures you had. Can you tell us maybe an unexpected or unique other experience that you've had by being affiliated with such a great organization for so long as a goon at DEF CON? Jeffrey's probably on mute because he's speechless. He's definitely not. Yes. I was on mute. Okay. Sorry. I think probably the most surprising thing was actually how welcoming the community was. When I first started, I was 38, 39. So I was much older than most of the other folks on the team. But the community is just so welcoming. And a lot of you may know of a guy named Jason Street. So he's like real OG hacker, pen tester. He's an amazing guy. And he was actually one of my first podcast guests. And we were talking about the fact that he was the first speaker that I gooned. I had no idea what he was doing. And he was just so welcoming. And if you guys know, Jason's the king of the awkward hug. So he would just randomly go up to people in the hall and just grab your leg and throw his arm around your head. And I was just, I just felt so welcome there. And the guy that ran my team was his handle was Agent X. And we were out one time after DEF CON and he looked at me and he said, when I hear your voice, I think of DEF CON. And this is a guy who's been going since DEF CON four. And that just made me feel so good. And the other thing that I'll share. So there are a couple of young guys that were on our team who they were 18, 19 when I first met them. They had no money. They flew themselves out to Vegas on their own dime. And we fed them. And we gave them a place to stay. We helped them come up. And this year, and I hadn't been in about five years. And I went back and these two guys were now in leadership positions. It actually turned out both of them at one point worked for my current CT. He ran Pony Express a bunch of years ago. And just to see those guys and see what they have turned into was just, it was such an amazing, amazing feeling. That to me, the community is the best thing about going. And I really like that. It is much more civilized than it was when I first started. And I am no longer a drinking person. So typically, we wrap up at the end of the day at seven, eight o'clock, and I go back to my hotel. And the next morning, I hear everybody's stories, because I don't need to participate in those stories anymore. Love that. And I love the long-term connection, the commitment. And then like you said, watching people grow up, grow out, do different things like that is just amazing. And just so everyone knows, if you see me there, I don't go by Jeffrey, I go by Monkey. So if you hear anyone calling out Monkey, that's me. All right. Oh, man. Yeah, we can do something with that, can't we? Oh, absolutely. Well, there's a story that I won't share out loud, but I will share in person. Don't worry about it. We'll find out. I was trying to avoid the roasting because the family was on. They roast me on a regular basis. I'm just excited to... So is that only... Should we only relegate that to DEFCON, or can we call you Monkey anytime, anyplace, anywhere? Call me Monkey anytime you want. The funny thing, Tomas, is when I was at Gartner, they were concerned about the crossover. So I would walk into meetings wearing a jacket and shirt, and people would go, oh, I know you, and I go, nah, that's a different guy. Because for Gartner, they didn't want that sort of association. Now no one cares. But yes, you can feel free, Tomas, to call me Monkey anytime you want. It's going to be fun. I feel like there's a story that needs to be told. Let's see how your mic is on. We'll have to see if Katie is able to get the story out of Monkey about where Monkey came from. But either way, Katie, can't wait to hear what you have for us. Yeah, I am not telling that story in public. I feel this is a DEFCON story over a couple of cocktails. Or not cocktails. Mocktails. No, I have no problem. I have coffee, club soda. You guys can have all the cocktails you want. I've drank enough to last me to the rest of my life. But Jeffrey, this is a safe place, though. Is it, though? I like that. This is a safe place. Look, it's only, it's just us. It's just us and a few friends. Don't fall for it. It's the fireside chat after all, right? Katie, go ahead, Katie. Yeah, no, I was going to say we're just sitting by the fire and negative two degrees. It's fine. Yeah, and actually, listen, I actually do want to dig a little bit deeper, Jeffrey. You said a lot of things very early on that were intriguing to me. There's something in you that keeps driving you back to altruism. There was somebody who wrote, there's the tribe of CISOs, right? So there's the justice-oriented people. I'm curious because I think a lot of people who listen to these podcasts after the fact are people who are coming up in the industry. They're people like me who are mid-career and are thinking about what our next steps are and what is really driving us forward to continue to bring this industry into the next place that it's going. But what I'm wondering is, what happened early on in your life that this, where did this come from? What were your early experiences that, as we're, even those of us who are raising children, we want to give our children those experiences that create this, you know, intellectual curiosity for the world and this fundamental altruism and desire for justice that serves us really well in this industry. So I wondered if you could dig back a little bit deeper and just tell us where that comes from for you as a person. I have to tell you, it came from my parents. It came from my parents. I grew up in an amazingly loving family. My parents were big readers, big learners. My father, if he got a college degree, he would have been able to teach history without any textbooks. That's my dad. And my mom started at a job. She typed up some guy's PhD thesis and she ended up 25 years later running the entire administrative function for a multimillion dollar company. My sister is on, so she knows where I'm coming from. And actually now two of my kids are on. My third one seems to have dropped off. I guess she had some studying to do, but I think it's all what you're surrounded by. My father, when I was a kid, my father said, I will always pay for books for you. And he did. And I grew up in a house filled with books, filled with learning. I grew up in Queens. Every other weekend, my dad would take me to the hall of science. My mom would take me to work with her. I have great memories of reading books, sitting next to my mom. My dad worked nights, so sitting next to my mom, just reading together. The one member I remember, she was reading Cujo by Stephen King and she was so scared, she made me sit next to her while she read. So she read some of those passages out loud. But I like to think that I have instilled that quest for knowledge in my kids. And I will tell you that my son who's on is finishing up his master's in public policy this semester. My older daughter who's on is actually in school to be a PA in Philly. And they decided to do all that stuff themselves. My youngest, who's not on anymore, she's majoring in French. She's a freshman at UCF in Orlando. And then my wife also, she, my wife is a big reader, a big learner. She's actually teaching herself, not teaching herself, but she's learning Spanish now. So we're just surrounded by people who love learning. And I have instilled that. I will tell you, none of my kids are going to go into technology. None of my kids are going to be in cybersecurity. And I'm perfectly fine with that as long as they, as long as they find their passion and seek that out. And I think Katie comes back to the mentoring thing that we talked about early on. I love to help people find that joy. I love to help people see in what we do, what I see in what we do. And you're right. I think a lot of the people that are unhappy in this career came into the career because they thought it was an opportunity to make money and not because it was something that they loved. And I just, I think when the love goes away, it makes everything else much more challenging. But I credit my parents with me being a lifelong learner. I really appreciate that. It's funny you say that too, because I always said to my kids, hey, I know a few people in the cybersecurity business, but now I have an environmental biologist person. And all these other things that, yeah. So I appreciate that, though, that you instill that in your children. And that's what we as leaders in our industry now are just wanting to instill in the next generation. Speaking of which, and we have a number of tremendous leaders in the audience today. I just want to remind everyone that in this fireside chat, this is an open room. You're more than welcome to raise your hand. If you have a question for Jeffrey, please raise your hand and we'll bring you up on stage. I just wanted to make sure that everybody was aware that this is the forum. We have some new faces as well. With that, though, yeah, thanks, Jeffrey. Octavia, Stephen, Russell, Tomas, which of you has another question for Jeffrey? Thank you. Thank you. I think, Jeffrey, I think one of the questions I have for you is, since we talked about a lot of the folks here on this call generally being senior, I think there's a conversation now starting to what happens next for the CISO type, right? Like, it is unlikely that we are all going to be CISOs forever. What, in your opinion, do you think is the next step for most CISOs? So, I think a lot of CISOs see the CIO as the next step, which I think currently and historically has been true. But the one thing that we're definitely seeing is CISOs being elevated in the organization to more be peers of the CIO. I think as far as future, one of the trends I'm seeing, and I don't know necessarily that it's a great trend, but I think it's because of the pressure that we are all under. But I'm seeing a lot of seasoned CISOs who are actually banging out of corporate jobs and going and doing like the virtual CISO or the fractional CISO because they get to do the fun stuff for the job without having the same level of accountability. And Tomas, when you and I were at that event in Miami a few weeks ago, there were a couple of folks in the group who, last time I saw them, they were CISOs, and now they're doing the virtual CISO bit. So, I think that's one thing. I think we're starting to see some people move more into the risk function. So, I think that the chief risk officer is a weird function because I think typically they are in finance and they're not managing the kind of risk we're talking about. So, I think that's it. And then I think the other thing is we're going to start seeing more and more cybersecurity experts or practitioners as board members. And I see a couple of folks actually have board in their LinkedIn descriptions. So, that's a great thing to see. I actually think we're also going to start seeing more cybersecurity advisors for companies. The reality is I don't know that a lot of companies are going to free up a seat just for a cybersecurity person. So, what we're seeing is an uptick in people going in front of boards for educational purposes. And the beauty for boards about the educational stuff is it doesn't actually go into the minutes. So, somebody can come in and talk about here's the current state. Here are the trends we're seeing. Here's what we're hearing from your security team, your IT team. And I think we're going to start seeing a lot more of that. And then the other thing, too, is I think there are a lot of people out there that do the CISO job without the CISO title. Right? Sometimes they're VP. Sometimes they're deputy. Sometimes they're directors. And I think over the next probably five or seven years, I think we're going to start to see a lot of those people become true CISOs. And then I think they're going to step out and do some other stuff. And I think really a lot of it depends on what your background is. If you're a really technical CISO, I think you're going to have a different career pathway than if you're more of a business CISO. We're seeing an uptick in BISOs, the business information security officer. And I think those folks tend to be a little bit more business aligned. Appreciate that, Jeffrey. Thank you. Anyone else on the panel wants to pick up the next question? I'm interested in your risk. Okay. So at what point in your career, was it your time at Gartner or where was it that you realized that this is your true passion within this pillar of the industry? So I was working for a consulting company doing networking. There were rumors that the company was going to be sold and it turned out they were. As a result of that, nobody was buying any services. So they stashed me in a gig up in Rybrook where at least I was getting paid. I was billing. So I actually started playing around on a website that some of you may remember called 2600. It was also a magazine. And I discovered the Carolyn Minum, who's known as the Happy Hacker. She wrote basically a how-to guide on how to be a penetration tester in 1990. And I knew the second I started reading, that was what I wanted to do. Like that. The love for security was immediate as soon as I started looking at that stuff. And then the transition to risk, Octavia and I chatted about it a little while ago. The transition to risk just seemed sensible to me. I never actually really thought about it in looking forward. I think retrospectively, retroactively, we look back. But looking forward, I never sat down and said, I'm going to be a risk person. I think I just grew into that. I learned it as I went through my career. Hey, Jeffrey. If someone wants to get into being a goon at DEF CON and getting a cool snazzy name as Monkey, how would they go about doing that? You got to know a guy or a gal. I am a guy. So if anyone is interested, please reach out. There are typically openings every year. There's a whole bunch of teams there. But it's the one thing I will tell you, in three days, I walked 77,000 steps. So how do you get that nickname? Eight for the fate of heart. How do you get that cool nickname? Oh, they just call me Monkey. That's it. I'm not sharing. Tomas is going to keep crying. It's hilarious. Tomas, next time I see you, maybe RSA, maybe my next trip up to New York, I will tell you in person. But I'm not doing it on this call in front of people I don't know. The fear of the podcast. I got you. I got you. Go ahead, Katie. It's not even a terrible story, but yeah, it's not happening. All right. Go ahead, Katie. I know you have another question. Oh, no. I was just, I had unmuted just to keep the conversation rolling again. Yeah. So many questions. I think, again, I like that you asked that question about DEF CON, but also, Jeffrey, in your community, I think one of the things we talked about earlier is how do people get more involved and figure out where they can stumble into? Because I, by the way, I'm a person who stumbled into the industry. I have a military history degree. How did I end up here? I kept stumbling and then leaning in. One of those ways is in finding volunteer opportunities. You're in New York. What are the ways that you recommend that people who are trying to get more involved can do so at multiple levels within their career? So I think volunteering is definitely a great thing. I mentioned cybersity, but there are tons of organizations out there and a lot of them have a cause or an agenda. I don't mean agenda in a bad way, but they have a particular focus, right? So cybersity is very much around diversity, gender, race. They also do a lot of stuff for former military. So I think volunteering for organizations like that, I think is a great job. But I think going to conferences and actually going up to speakers after they finish their talk and telling them, hey, that was great. I'd love to learn more. I used to love it when people would come up to me after I got off stage because it means that it landed, right? It resonated. I think if you live in a somewhat, even a medium-sized metropolitan area, joining a group like ISSA or joining ISACA, I think is a great way to network. Definitely be active on LinkedIn because there's a lot of opportunity. Now, there's a tremendous amount of gatekeeping, which infuriates me. So if anyone's gatekeeping any of you out there, you come to me and I will take care of that because I've been around a long time and I got a mouth on me when I need to. But I think that most people want to teach. Most people want to bring other people in. So I think just getting involved, going to DEF CON, just stopping people. Again, DEF CON can be a little overwhelming, but there are tons of conferences that. I know SHMU CON is actually done after this year, but there's B-Sides. There are a ton of conferences out there. And if you have any particular group that you are interested in, reach out to me and I can definitely point you to some resources. And again, back to Cyversity. So if there's anyone on who's looking to break in, Cyversity has a great mentorship program. They actually just opened up applications today, in fact. So you can definitely take a look there. And then talk to the security people in your organization, in your company. And you can learn from them. Again, I love to read. There are tons of websites out there. There are a ton of really good people on LinkedIn that you can follow. Tomas is a great example, posts his cybersecurity bite. I think that's really good. Octavia posts a bunch of stuff. I know Katie, you and I are still relatively new friends on LinkedIn. So I'll definitely see what you look at. But there's also a lot of really good podcasts out there. I do a podcast that I really like doing. But my friend, his name just jumped out. His name is Perry. I worked with him at Gartner. He now is at Know Before. Carpenter. Yes. Thank you. Wow. I'm glad he didn't hear that. He's got an amazing podcast. It's almost like a radio play on the history of security. He's a brilliant guy. I love him. But there's a lot of really good stuff out there. And it's hard to come up with things off the top of my head. But if anyone wants to ping me, and maybe as a follow-up to this, I'll post a bunch of links. But there are some great people you can learn from out on LinkedIn. Twitter is a bit of a cesspool these days. Mastodon was being touted as the replacement for Twitter. And I think a lot of people couldn't figure out how to get it to work because it's not centralized. If you love it, learn, and the stuff will come to you. And Katie, I'm just like you. I've stepped into every job I've ever had. I always tell people, the trick is figure out how to do the job before the people that hired you figured out that you didn't know how to do the job that they hired you to do. That's a very important life lesson, I think. Great advice. Absolutely. And I'm not going to lie, that definitely has happened. Over to you. Russell had another question. Yeah, I love so much of this. It's just resonating with me, Jeffrey. And you mentioned, and I loved how you invited like 14 different ways for people to get more involved than what they are with B-sides, being a goon, helping out, volunteering, participating, showing up. So many opportunities for us to put actions behind that. But my question, you mentioned earlier, you've been to 100 board meetings, briefed 100 boards. And I know it's tempting to go technical and APT this and NAC that, 802.1.x. All these technical things that are critical for security teams to do. I know people go into settings like that. They're scared. Maybe they've never been before. Afraid they'll never get asked back or asked to leave. Besides stories, how is it that you keep getting invited back to brief, as you said, 100 plus boards? To be fair, some of it's because people paid Gartner for me to show up. So that's part of it. But I think that you need to talk their language. Like I said it before, and I say it all the time. Your executives care about three things. Money coming in, money going out. And if something goes bad, who's in trouble? So you need to hook into those things. So here's an example. And this was actually the last piece of research I wrote at Gartner. It was a seven-slide deck on briefing your board on the hot topic. And the example I used was ransomware. And there was nothing technical in there. It basically said, here's the thing you probably have heard about. Here's really what it is. Here's why you should care. And here are the things that we are doing or would like to do that will at least minimize or, dare I say, eliminate those negative business impacts. And then the other thing I always suggest too is we have a tendency to say, risk is bad. If we don't do this, something bad is going to happen. But what if instead you went to them and said, hey, we'd like to implement this control. And if we do, it will make everyone on the sales team much more efficient. It'll make them much more effective. It'll enable us to recover from an incident much more rapidly. So instead of being down for three weeks when we get hit with ransomware, we'll get you back up in 72 hours. Pitching it from the more positive side I think is really important. And that is partially how you get invited back. If you go in and you're the boy who cried wolf or the girl who cried wolf and doom, the sky is falling, whatever it is, they don't want you to come back. So you have to give them some upside. And there are plenty of upsides out there. I don't believe ROI is a thing we can really justify in security. But we can absolutely talk about the upside of doing things in the right way and doing the right things. And don't get technical. That is the biggest mistake we can make. Because it's going to go over their head and I can tell you no board member is going to say I don't understand that because why? They don't want the other board members to think they don't know. And then nobody knows. And then what happens? They make decisions based on incomplete or misunderstood information. And then, of course, something bad happens and who gets blamed? The CISOs. Awesome. Love that example, some takeaways, more and more takeaways for us as we're thinking about how to apply some of the things that you've spoken about for almost the last hour and a half. Tomas, back over to you. Thanks. Thanks, guys. Look, it is getting close to the end of our segment. Again, if anyone has a question, feel free to raise your hand. We'll bring you up on stage. If you don't, that's fine as well. I thought you were going to use ChatGPT for this one, man. Got to tell you. Oh, you thought I was going to use ChatGPT? Yeah. Yeah. Why? I don't know why. That's interesting. I should. Let me pull up ChatGPT and ask a question. No, I do want to say a few quick points and then we'll get to call it one of the final questions that I usually like to ask. It's a reflective question, so I'll give Jeffrey some time to grab some water, take a breath, because I know we've had him chatting up a storm for a good hour and change, even though he doesn't want to tell us the origins of Monkey. But we'll get to that and we'll share that at some point in time. As I mentioned in the opening, we do this every single month, so we'll be back again next month. We'll announce the date. So please follow our Fireside Chat group or company page on LinkedIn, so you can follow our Fireside Chat page on LinkedIn. We also have a FiresideChat.live webpage where you can listen to all the playbacks from our guests today. We'll put that one up as soon as it gets through the editing field, and then you can listen to all of our prior playbacks from the prior years that we've been doing this for about two years now. But Jeffrey, I always like asking this question of our guests, and as I mentioned, it is a bit of a reflective question. And thinking about your – you've been in this field for quite some time, as a lot of us on stage, and you've had different opportunities to impact people's lives, if you will, both positive and negative, being the mistakes that you made. Hey, you said it, I did it. But positive being a lot of the good that you've done and sharing your knowledge, sharing your wisdom, obviously mentoring, speaking to the boards and the other aspects of your job when you were in gardening, and even the work that you're doing now as an evangelist or from your current company. If you have one piece of advice for the younger Jeffrey Wheatman, what would it be and why? That's a great question. So I won't say wear sunscreen because that's a cheat. I think the advice I would give the younger self is to breathe more and slow down and not always be racing to get to the end. I think younger people in general have a tendency to try to get to the end, right? What's the end? What's the end game? We've got to have all the money. You've got to have all the toys. I just think to slow down and breathe and appreciate what is around us. I think, Tomas, you and I maybe talked about this when we had lunch a couple months ago. I don't think enough people have gratitude. I don't think people are grateful for the things they have in their lives. And I think we need to be more grateful, be more appreciative of the people around us. Tell those you love that you love them. Tell the people, hey, you had an impact on me in a positive way. And I think we need to do more of that. I agree. And I agree with you on that for several reasons, but I definitely agree. And I think that's some really great advice. Slow down. Smell the roses, if you will, right? Enjoy where you are currently and where you're trying to get to and don't be in such a hurry to get there. That can apply to so many things. Life is precious. But look, I have enjoyed our conversation this evening. So I do want to take a moment and thank you and thank all of our guests, obviously. Sorry. Thank you as our guests and thank all the members in the audience who tuned in to listen to our conversation with you. We do know it is everyone's busy and it is 90 minutes out of your daily lives, but we do appreciate you spending that time with us. So with that, I'll pass it around to the moderators. Any final words for Jeffrey? I'll just say thanks for showing up and really, I will say, blessing us with your story. It had so many dimensions and so many nuggets that you shared. I had more questions, but again, we will be on here for 10 hours if I ask them all. So thank you for sharing. And I really appreciate you just being who you are. Thank you. Yeah, Jeffrey, thank you for your time and thanks for helping us kick off the year with this. Appreciate it. My pleasure. Thank you all for having me. It was this was fun. Yeah, I totally agree. I got my pen almost ran out of ink with the questions to ask like what Octavia said, but then also even better the answers and responses that you gave to several good unscripted unrehearsed questions. So again, thank you for spending the evening with us. Thank you. And again, anyone else who's interested in talking one on one has any questions? Hit me up. I am happy to respond. I love love talking to people. I really appreciate the time that you spent. And I'll say this going into the evening. What a great reminder on a Wednesday evening is take a deep breath. Tell the people that you love them. And what great advice going into the rest of the week. Thank you. So, Jeffrey, look, it's been a great segment. Again, thank you for your time. I'll leave you with the final words to take us home. So first, I want to thank everyone. I know 8 to 9.30 on a Wednesday night is a time when we could all be with our families. I was lucky enough to have my family join us, which is great. But this was super fun. And I love the open discussion. So thank you all for having me on. Thank you. Thank you.