Subscribe
Share
Share
Embed
Technology isn't built by companies. It's built by people.
Random Access Memories (RAM) is where technology gets personal. Host Jake Bernardes sits down with founders, CISOs, engineers, operators, investors, and community builders to explore the stories behind the products, the pivots, the failures, and the moments that shaped their careers.
Whether we're talking cybersecurity, AI, startups, leadership, or life outside the office, every conversation asks the same question:
What shaped the person behind the technology?
New episodes every week.
Presented by Hubscale.
Hello and welcome again
to Random Access Memories.
I'm never quite sure what
this podcast actually is,
but we will see where it
goes and what we learn.
I have Jason Cenamor with me
today, founder of the CISO Society.
You've been on my old podcast before,
so you will know that I start with the
same thing, an introduction,
a hero, and a hobby.
And then from there,
we'll see where it goes.
All right. I wonder if I'll do
the same. Three as last time.
So first of all, thanks very
much, Jake. Really appreciate it.
So, as you said, Jason Cenamor founder
of the CISO Society and Confide Group.
Hero. Larry David. Larry David is my hero.
It's a bit of a silly one, but
it's basically because I just,
character covered in 2000 number one.
Just as a comedy person.
Love it, but that's like my goal in life
is to be able to get to that level of
approachiveness
And just. It wasn't your last,
one I can't remember it was.
But definitely wasn't it. Wasn't no
Okay, interesting.
And then, hobby, as, like, my team
knowing stuff, and few people now.
I'm obsessed with pizza. So,
like, making pizza dough.
Ooni. Or is there a better
pizza oven Out there
So I just moved house, and I'm
getting a new pizza oven, it's,
Gozney it's a British.
Is. That better than Ooni? I have
an Ooni Maybe I should Change
I had. Ooni to begin with. But I had
one of those, like, smaller ones.
It was during Covid when everyone
just started making dough,
And so I had like that smaller one, and
it was great, but wouldn't really work.
And so then when I move into
the house, like right now,
I'm getting a proper one.
So like, Gozney is the one.
You know one of the best things I think
there aren't pizzas that pizza runs for
amazing for cooking steaks, unreal
cooking steaks and the best cookie dough
thing in the world.
Get One of the skillet pans from the Ooni
chuck a load of like raw cookie dough
and stick it in there unbelievable.
I haven't even thought of it.
I'm excited to like try and
do some steaks and like,
roast some meats in there
and all that kind of stuff.
Yeah, but the problem is now it
started as I'll get that one.
But it's like, well, if I'm gonna
do it, I might as well get that one.
But then it's like, well, if I'm gonna
get that one, then I might as well get.
Yeah, I know that's how I ended up
with a bike that cost like 12 grand.
Yeah, because I'm like
upgrading bit by bit.
Until I ended up with a bike that's
more than most people's cars. Oh
Yeah. I was looking at stuff
last night and my wife was like,
when are you gonna order
your pizza up And I was like,
I'm gonna get you Which one are you
getting And I said, don't worry about. It.
The very camera filming this podcast
is like it's an insta 360 X5,
and it started with me going, I just
need the X3 and then going, well,
the X4 is kind of cool.
It does that and I just go to that one
and Before I knew I bought like the very
top of the line one that I could get. So
I've got to be careful, but I'm. Excited.
But that's life I'm glad
you're excited, right?
I have a load of things I want to ask.
I don't know where this conversation
is going, so we'll start from the top.
Is the CISO Society the biggest
security community on the planet?
No. No, of Of course not.
Isn't it? I don't know. Is it? No.
There's nearly 1,500 to
2,000 members on there?
Yeah. But okay. So break it down.
So I often say to people,
there's 2,000 members,
so there's probably about five, 600
who have forgotten they're even.
In community At this point, Right?
You know, then you've obviously, you
could say the, within cybersecurity,
there are different communities and stuff,
but there's huge ones like InfoSec live
and stuff like massive groups where
it's like a little bit
more all encompassing.
Yeah. You know, I'd like to think that
the society is one of the more engaged.
One of those active then. Yeah.
You know, members do tend to use
it quite a lot for various reasons.
And it's a comment we get a
lot when people join, Like,
I wasn't expecting it to be that active.
Yeah. Both like on the day to
day, just kind of like messaging.
And then, you know, if we host something
or something like one of the case
study sessions, they'll, they'll.
We'll get really, really good turnout
members and a lot of engagement in those
sessions as well.
So yeah, I'd like to think
it's one of the more engaged.
Okay. So I know the story of how it
came, but most people listening don't.
How did you get from nothing to here?
Because it's a journey that
has a few little steps in.
Yeah. Okay.
So started out original plan, because
I used to work in the event industry.
And so when I kind of, like, decided
not to do that, and it's just like,
I just kind of grew a
little bit tired of it all.
The plan was actually to start a
consulting company that helped vendors
with their event strategies and their
customer advocacy programs. Right.
And just all going back to, look, I see
vendors spend a lot of money on events
and I, a lot of the time they
wouldn't really get out of it.
Okay. How do I help
them get more out of it?
How do I help them find the right events?
The ones that actually, I
think, provide the most value.
And then when you're there, my biggest
frustration was always when I used to
host those types of events was
vendors, spends so much money,
and they don't bring a customer
with them to talk or something.
And so anyway, that's what I wanted to do.
Okay. So anyway, I'm with you.
The society I started, so that
was just like a zoom call idea,
but it was really designed,
first and foremost,
as a way for me to kind of give CISOs a
place to talk without being solicited.
So that was kind of the idea.
And the trade-off being, I get to expand
my network and learn so much and use
it as like a focus group for
my consulting stuff, Right?
If I want to advise people on where
they should be going from an event
standpoint, then what better than to hear
from the CISOs going to those events,
right? That was the plan.
And then the members just kind of
started like taking it onto themselves to
invite more people to get involved.
And Before we knew it, we had
like 50 members in the group and,
that's when it was like, oh, you know,
you should start a Slack group and We
looked at like teams and WhatsApp
and those kinds of things.
And I was just very used to using
Slack in the workplace anyway.
So I kept Slack, and most of the people
at that time, when I kind of like said,
well, what are you using?
Most of them were using Slack.
And then it was a case of just.
Like paying really close attention.
So event experience allowed me to create,
engagement in its earliest stages.
So a lot of people had said, you know,
Slack groups, there's so many of them.
No one uses them, it's
crickets, et cetera, et cetera.
Or it's just posts,
announcements and stuff.
So, how will you get people engaged?
Well, I know from running events, you
can't just put people in a room and
expect them to just talk.
So you've got to, initiate conversation
or give them a reason to have a
conversation. And so I did the
same thing in so it's like.
Having.
A table host in the Slack.
Exactly. Exactly.
And so, like, you can you can
ask like, some of those early,
early early members, I would message
them and tell them to go into slack.
I. Wasn't that early.
And I got those messages saying can
you go and comment on this? George
And then amplify. It And has
anyone else got a comment here.
And it just so it got people going And
all right, when they were joining, okay,
people are posting. More importantly,
people are responding. That was the key.
So I'm not just screaming into a vacuum.
Like people actually listen
to me and responding.
And then it was important
to have in the early stages,
like a series of kind of meetups.
So we did these live virtual round
table discussions just to like,
get together and talk about things.
And, having that as like a focal
point once a month in between the
conversations. Yeah. That allowed it.
But the biggest reason it's kind of
scaled to where it is is because,
never really forced any particular agenda.
Like, this is what we're
trying to achieve from this,
what we're trying to get out of it.
Never really kind of turn the
members into a product, right?
Like, we'll talk a bit about, how
kind of you monetize these things.
But once you start turning
people into a product,
that's when they start
kind of pushing back.
And that's where you've just got to
be very conscious when you're building
these communities, really conscious of,
what what is the purpose and what
what what am I doing this for?
And mine was always I just want to do it.
So the c says can get some value out of
it. And then, see where it kind of goes.
But never thought I'd
be doing it full time.
And never thought it would
have grown to this scale.
So when you launched
it, how were you living?
Because when I first joined the
CISO Society a long time ago,
There was definitely no
monetization in it at all.
So how were you living while growing? It?
So I had a small investment to
build my consulting business.
And so I was paying a wage off that,
paying myself a salary off that. So
You're Rolling a dice. That
This was going to work.
Massively, right? My investor is
absolutely incredible. Absolutely
incredible.
Like, he's are unofficial
CTOs or unofficial CFOs.
He's just, he's just done so much, but,
he invested in the early stage and this
idea of this consulting business I want
to build.
And, you know, I really kind of felt
like that was where I wanted to go.
So, and I hired someone, but the
consulting thing just wouldn't really pick
up.
And the reason it didn't pick
up is because I was enjoying,
where the society was going a lot more.
And, you know, I don't really like
selling myself and as an independent
consultant, so to speak, kind of selling
this idea and it was just a little bit
tricky. And so kind of was spending so
much time looking at the CISO society.
And then, you know,
inevitably the money dried up.
That's when I was kind of
like, oh, well, you know,
had a conversation with
my investor at the time.
I'll never forget. He was like, well,
you win some, you lose some, you know?
And I was like, well, you know,
I want to keep it just going.
I got to get a full-time
job. So this was 2022. Okay.
So I've been doing it for about
12 months, and, So I was like,
I need to get a job.
I need to pay myself like, because I
was paying myself. Always a good idea.
And get a job and very, very fortunate.
Had some opportunities And I went
to work with, Merlin Ventures.
And just when I joined them, I kind of
had the conversation with my investor at
the time.
Like, look, I think this could fizzle
out with me not really paying too much
attention to it.
Yeah. And Merlin were very, very
kind of like respectful of, look,
I know you run this CISO society on
the side, like that's Absolutely fine.
As long as it doesn't impact
your work. Here. And so.
Did Merlin. Want access to it?
No, I'll give them
credit for that as well.
That's pretty valuable Yeah
I mean, access in the sense of in that
early stage is funny because people
often say to me now, are your network,
your network, I'm like no like,
it's a community. So, yeah,
my network is is great.
You know, but my network is very
much those early members. Yeah.
So, Merlin, just like any Vc or
someone hiring someone is like, well,
we want to be able to get
access to the network.
Yeah.
Of course, but there was never this
kind of, we want in on the CISO society.
Yeah. Massive credit for that.
And I really thought that, like
I said, it was gonna fizzle out,
But the complete opposite happened.
So it was almost like the, the, the
spark it needed was me to actually step
aside a little bit and allow the
members to take even more control over,
conversations they were having and stuff.
So rather than me initiating conversation,
they just took it upon themselves,
start inviting and more people in
and it just started growing, growing,
growing, growing, growing until it
got to the point where we hit like 650
members. And that's when I started
thinking, okay, I think there's something,
something here.
Still don't know what. Even now,
Jake, people, what's the plan?
You know, and there's reason for
that because there's like, well,
what the members find valuable today,
they might not find valuable in six and
12 months.
So you can never plan too far ahead. I
don't know what our CISO's going to want.
I don't know if the cybersecurity
world is going to implode on itself.
I don't know.
It's always about like, okay, have a
plan of how you want to improve it,
but don't think too far ahead because
you've got to be able to be reactive to
the needs of the members.
Right. So anyway, they were often asked,
like, what's the plan of CISO Society?
I'm like, I don't know,
but there's something here.
And so I decided to
kind of do it full time.
You know, when it came to monetization,
I consulted some of those early members
who I still go to for advice today.
And they threw up some ideas, right?
So the first was, okay, we
can look at membership fees.
Yeah. Okay. And that
was the original plan.
Which is what a lot of communities
do, right? That exists. They do.
And there's value in that, right?
What I found though is we were
looking at the society as like,
this is something where
people can gain access to it,
whether they have a job or not, And
most membership fees for those groups,
CISOs will tend to put against
their budget for whatever reason.
It's like, well, what about those
people who lose their jobs? Or yeah.
And So decided not to do membership fees.
And then obviously the, the conversation
of kind of like sponsored events came
up. And at that point I was are
so tarnished from that world,
I push back quite aggressively.
But I'll give credit to the members
being able to really help me see that
there's value in that.
It's not like, you know, this, this
world of vendor bashing on LinkedIn and
that kind of stuff.
It's not that CISOs don't
like vendors, right?
It's just the environments
they are given to engage with.
Vendors are often either heavily one-sided
Or they don't actually provide a lot
of value. Yeah. Right. And so
when I was like, okay, cool.
So I can do this and I can consult you.
And so like the first
things we started doing was,
the startup showcase sessions, right?
So they were like these shark tank
things, but we wanted to go further.
And so the way we want to
go further is, okay, well,
what was my experience
of like a VC shark tank?
Vendor comes in, they get three
minutes. What does that do?
They're going to promise you everything.
CISO then goes and takes some time
to actually speak to them afterwards.
And goes, oh, it doesn't do half of
what I thought it might be able to.
So we wanted to go further.
So we gave them each like 15 minutes.
The rule was you had to be
nominated by a member of the group.
And then we charged a small fee.
So in the early stages, I
wasn't charging the startups.
When I consulted, Are you charging
startups to do the startup showcase?
No, well, you should be. There's like
a hundred CISOs on that call. Yeah.
And I'm like, well, that's
not the point though.
The point is to help you find these
cool tools that are nominated by members
and help the startups get a
platform without like, yes,
but there's value in that.
So that's when it started, to
kind of like snowball. In there.
I was like, okay, so, you know,
the cool thing about communities,
you never have to assume you know what
they want or guess what they want.
Just ask them, they'll tell you, and
then you play around with it a little bit
and you test out some ideas, and then
you ultimately land on what's valuable
for them that justifies
a vendor paying to, to,
to kind of participate
in something like that.
And that's where it started going.
And that's how it started monetizing.
And just kind of building from there.
As a vendor.
And a CISO at the same time, it's a
fascinating place to look because I can
watch, like the amount of times I'll
search anecdotes and there'll be like
conversations of like, I don't feel
appropriate commenting, but oh gosh,
this is uncomfortable.
Or I'm like, dude, that guy was a
customer. He was like talking about his
fact. I look like he's not a customer.
Yeah. Well, that's the other thing
people often talk about, you know,
the presence of vendor
CISOs in these groups.
The leper bell, as I always refer to it.
Look my, our stance in it has always been
if you've been a practitioner, Right.
And you become a CISO at a vendor. Yeah.
Of course you're allowed in the group.
You don't lose your
practitioner experience.
And as we know, a lot of the vendor CISOs
do have practitioner responsibilities
as well. So you don't lose
that experience overnight.
And I think there's a lot for
those individuals to share.
More importantly, those individuals
could find themselves back in a
practitioner a full-time
practitioner role at some point.
And to your point just now, we have very
strict rules around solicitation and
stuff in the group.
Funnily enough, the vendor sees those
are the ones that adhere to it the most.
The ones that-
I was going to say, I'm
pretty good with the rules.
It's ironic that most
people- You really are.
I'm like, I'm pretty sure you're an
advisor or an investor at that company.
So those are the ones where we
often have to reach out and go, hey,
we just got to maybe delete that because
we don't want this to turn into open
season of every advisor going.
Does everyone want to talk
about this. Vendor right Yeah.
So but more importantly, like the,
To your point about seeing things
potentially about anecdotes, I think that
is an awesome way for vendors to then
improve various elements of what they do.
So if a community, we know CISOs
are talking about vendors in these
communities.
If a community is talking about how a
vendor needs to improve their customer
experience, or they wish they kind of
had more of this service or product or,
you know, a bad experience they had,
vendors can be able to take that
internally and say, guys,
we need to do better.
It's fascinating because we we're actually
building a feature that we're going
to release in the beginning of H2, which
the slide that finally convinced the
rest of the exec team was was a
bunch of cisa society comments.
Where I reference there's how many people
are saying this particular feature is
really relevant to their requirements
for grc tool Like there's real market
research.
Like I can tell you, all these people
are and all their companies are we
scrapped the names and script mostly.
But I was like, this is I was like, this
is that I can't give you better market
research than like 50 people
saying the Same. Thing
We did a little like, one of
the huddles we were trying out.
We were trying out these, like, huddle
sessions with the society in like,
afternoon sessions, and you
did one like in Chicago,
and you pulled that as well.
And it's like, look these are real
conversations that everyone's happened
having, and again, it's a safe place
like everybody ideas to the same rules.
Like, you know what's said inside
this thing is private and, you know,
it's used for the benefit.
And, so that's where we're kind of like
trying to go with it as well is really
how do we start utilizing the
conversations inside to kind of give the
members back a lot more
of this information.
You know, a member saying that they
canceled their Gartner subscription
because they get all they need from
the society was number one, Like
Kind of crazy. I think I've said, that
in this last challenge several times.
I've never had a Gartner subscription,
but I wouldn't buy one because I don't
need. One.
Well, it's kind of crazy, right?
Because obviously, you know,
there's so much unbelievable,
like rich content and, information
resources through Gartner that justify the
membership.
But to hear that, it's like, yes, we just
are seeing the industry shift to more
of these, In order for me to
know what's really happening,
to get a pulse on things, yes,
I can read all the research,
but it's better to just
go directly to the source.
And the source is the practitioners.
There's people on the front lines,
like in the seat, doing the job.
And so a lot of our members are now
like, well, no, why would I do this?
I don't need to justify the investment
because Gartner says something. Now.
I justify it because I'm
in a community of 2000.
CISO saying this is happening and
we need to start doing something.
About it.
Which is insane. Live
continuous market research.
Research How many VCs or
PEs have tried to buy it?
None. None. You got to think about the
way that, those folks operate, right?
I mean. This is. Literally
what they pay people.
They have people on retainer
for these advice. Exactly.
You could literally have access
to this permanently? Continuously.
But that's the point, right?
The beauty of the CISO society
is its agnostic approach.
And so as soon as an entity
like that would get hold of it,
like how do you maintain the value to the
Yeah. There's potentially a
data side of the deal. And
So for a VC, each VC has their
value in their independent networks.
Yes, okay, you could go see society,
but then there's going to be a bunch of
members in there who are
part of other VCs as well.
Now, yeah, I do think that would
be a very closed-minded approach.
I personally look at, it's the
same with the society, right?
So people would say, that there
are competing CISO groups.
I completely disagree.
There are other CISO groups that exist,
many of which get spoken about
very positively within the society.
Events that they're
running get shared, right?
Information that they've put out
that you can go and you should join,
You should think about joining this
group because they get this stuff,
that gets shared.
Why wouldn't you provide value to your
members by making them aware of other
things that are valuable?
The way I've always looked at it is if
a CISO finds value in what you're doing,
they'll keep coming back.
So it's more about focus on how you
provide value about rather than prevent
them from getting value from elsewhere.
The one thing that strikes me,
this is off topic to some degree,
but that's kind of my thing.
In everything you said that
I've never mentioned before?
And Never identified before, you're
an incredibly patient businessman.
Like if you look at your history,
if you look at your history,
you have played the
waiting game every time.
Like you bill and then wait. This,
like you took funding and then gambled.
Like every time.
It's like, I'm not going to do this
until it's the right time to do this.
And even then, you're not
even sure it's the right time.
Like you took, forever to monetize this.
This could have been
monetized, like on day one.
It could have been.
And I've got an amazing investor, like
I said, like an amazing investor, Right?
But it's, it's more about, so I
remember as it was building and yes,
of course you look into stuff like that.
And I know that world so well.
And so you could have easily
started turning things around.
The catalyst for me was really just the
idea was always just allow the group to
mature to a point where you
can make better decisions.
So.
That takes patience when you're
living off investment wages.
That takes immense patience. Not go.
This is the time. Let's take the money.
Yes, Immense patience.
And especially when you
get exposed to, you know,
things that exist in the industry.
And like people often ask my opinion
on events that exist and stuff because
I've been in that world and now
kind of like free to, to speak very,
free freely about it, So
I'll often ask my opinion,
My first thing I'm always
going to say is, look,
there's always some value to be
had from, from any event, right?
And what one person doesn't
find valuable, Another one. Can.
Yeah. A hundred percent.
But being exposed to a lot of the events
out there that I feel don't put a lot
of thought into the experience.
And it's a little bit of what
I call lazy production, Yeah,
Could have done that pretty easily in
the early stages and just kind of like
monetized it and been able to
build a salary and build quicker.
But I think it would have been the
death of it before it had started.
So it's all just about,
you've got to make sure.
And this is the thing that
people often ask about community,
how do you build community?
It's like, don't have
that end goal in mind.
I said it like, if you're already going
in there with the idea that you're
going to build this community and
then start aggressively monetizing it,
people know when they become the product.
Yes, you can still provide
value in different ways, but,
you kill a community before it's
even had a chance to flourish.
If you're already thinking we're
going to build it for this reason,
I think that the superpower of the
society is still we don't know what its
purpose is, other than.
It's interesting because people who are
savvy enough to notice my shirt and the
background winner that.
Were filming this in Dallas, and it'll
be the same setup as when I spoke to
Cecil Pineda who does CISO XC Right? Yes.
And he was saying literally the same
thing when I, asked them about CISO XC,
I was like, what was the long-term goal,
when you thought about building it?
How did you build a community?
I don't really know.
It's like, we built it because there was
nothing in Dallas and we wanted to do.
Something in Dallas
with people to hang out,
that we want to try and build a
close-knit thing where people were like a
family and don't really know what
the long-term goal was at the time.
I'm not really sure what
the long-term goal is now.
I think that resonates with the
same thing that you're saying.
Well, I speak to other people who go,
I'm going to build this community or this
group or this
subscription-based CISO program.
This is the short-term goal.
This is the long-term goal.
Well, This is where it's going.
This is what's in it for me.
But they have a very, and
there's nothing wrong with that.
They have a very strict business plan.
That's what I'm saying.
When I talk about your patience,
unlike Cecil, Jamie and Randy,
who had full-time jobs at the same time,
you were waiting and waiting without
having money going into the bank,
which I think in itself
is, yeah, admirable.
Yeah. Well, I appreciate you saying
it, but yeah, it wasn't really, yeah,
at the time, it wasn't kind of
like, you know, I'm very lucky.
I have a wife that works as
well, and she's great at her job.
And so like having a secondary income
to be able to kind of support to a
certain extent, helps massively.
I remember speaking to Randy
on the last podcast as well.
And I remember speaking to Randy
when, Randy Potts for, those, who,
when CISO XC was kind of getting off the
ground and I met him in Chicago and we
had a coffee and stuff.
And the thing that I love most about
it and why they did it is there's all
these CISO events, like, we're CISOs.
We should be, we know what we. Want.
We should own the events. We know what
We want out of these things.
We know the content we like, we keep
getting asked to be part of these,
you know, advisory councils where
it is like, we know the content,
we know what we want.
But then again, one of the reasons
that succeeded is yes, okay,
like a strong CISO network
here in Dallas to start from,
But because from day
one, giving to charities,
having like the philanthropy side of it,
scholarship things and stuff like that.
That's what gave it more meaning
than just another event. Right.
But yeah, I remember talking to
Randy and he's like, we don't know,
what we're doing.
But you figure it out the same community
I didn't know what I was doing you
just kind of figure it out. So
Then you get to a point where
you start, Confide which is what,
the beginning of last year
or the back end. Of The year.
Before. Yeah. Beginning last
year. Officially, yes. So
Most. People have heard of
the CISO Society in our world,
but not as many people will know.
What Confide is immediately.
Is that by design or is that
still because it's growing.
That's it's bit of both
deliberately because again,
going back to my previous comment.
Right. Like, you don't want
to turn people into a product.
The, you know, Confide so the way
Confide was kind of born was, ultimately,
you know, you get into a stage where
the CISO Society is growing, growing.
Growing growing You know, we're doing
these kind of events and meetups and
getting some vendors involved every
now and then to sponsor these things,
to start building some revenue
base to kind of like, you know,
see where it can go.
But then.
Why do it through Confide instead to
turn the CSO society into a business?
Because, it's about like...
I don't think the CISO Society
itself is a business per se.
Because the. Brand for like an
Anti-Summit is the CISO Society, right?
Confide is there, but the people will
know it is a CISO Society event. Yes, they
Will. And that's because the CISO
Society make up the majority of these.
Things, But there's very much kind of
like a separation that's occurring,
which has been deliberate and by design.
Because Confide was created because it
was a case of this wasn't built to just
monetize it through event sponsorship.
That's not the purpose of this.
So I started thinking like in 2024 about
like, what is, what, what could be,
like the long-term strategy.
And ultimately, you know, when I was
able to like sit back and go, okay, well,
you've got all these organizations out
there trying to build communities, right?
These businesses that exist, that
are trying to build community,
but they're starting from
a place where people know,
like the business and stuff.
And so there's almost going
to be an element of, well,
why would they want to
build a community Now,
Customer communities and things like
that, User communities, that makes sense.
But let's say all of a sudden tomorrow,
big security vendors are like,
we're going to start a CISO community.
But why? Right? We came from a different
approach. Like the community was built.
And so it was very much a case of, well,
we're in a very privileged position right
now where we get exposed to all these
conversations that our members have,
both directly with us and with each other
about the things they like,
the things they don't like.
The the the key challenges that they
have in their day-to-day And it just
started going, well, it makes sense for
us to be able to think about how do we
create more of a service business
that could cater to those challenges?
You know that, yeah, members can
take advantage of if they want to,
but actually just focus on building a
service business with this idea that we
have the privilege of getting, you know,
direct access to the
source of the information.
And so, Confide We'd started out as
this idea of like a service business.
Number one conversation, our members
have in the group still to the stage,
as you know, is about vendors.
What vendors are you using for this?
What vendors are you using that?
You've got a bunch of people
out there who are doing,
introductions and referral
things and stuff and like, okay.
And then we get a lot of
members who are like, look,
I don't have the time or the resources
to be able to navigate this vendor
ecosystem.
It's getting noisier,
and noisier and noisier.
So we started looking at that, right?
Experienced with that in its rawest
form through running events in the past,
Like ultimately vendors trying to get
access to CISOs and you're trying to make
those connections.
So a little bit of experience there, but
started just looking into, okay, what,
what kind of service model
could you build around that?
Again, consulting the members, consulting
people that I trust in the group.
Hey, I've got this idea and I'm
thinking of doing this kind of stuff.
And it just started this conversation
on where do you go to find out about
vendors, how much time do you take, like
what resources do you have, et cetera,
et cetera.
That conversation naturally rolled
into a conversation about value-added
resellers.
And, you know, where a little bit of
trust has been lost in the VAR ecosystem
over the years, you know,
for a variety of reasons.
That's not every single, because there
are still some vast out there today,
like, that, that's, he's just talked very,
very positive about like defy that
actually got acquired by booze recently,
interestingly enough, but guide point
as well, like as a guiding light,
like very much a leader in the space.
But a lot of these, these kinds
of intermediaries, it was like,
I don't feel they're
really act on our behalf.
I feel like they're kind of
acting on behalf of the vendors.
And so when you think about
the core, like society,
the trust and everything that we
built in there, it's like, okay,
I think we've got our ability to maybe
build something here where we can
actually help CISOs navigate
that vendor ecosystem.
And then, you know, help them
find the tools that they need.
So that was how Confide started.
And then some conversations with members
were like, well, what about services?
Like, okay, services, we can
look into services as well.
The cool thing about it is it's
all powered from the society,
because the vendors that we ultimately
want to bring into our tech partner
ecosystem and Confide, Well, that's
partly due to the vendors that the CISOs
are saying, I validate this,
I use this. This is amazing.
You almost use them as a gate for what,
who you shouldn't do. Business, Right?
Like who we should and shouldn't.
And so now we help customers connect
with members of the group who use these
tools and stuff, or, you know, we go
through our own analysis, of course,
of these different folks and look
at different things, but, it's,
that's how it kind of powers it.
And then we kind of like
started building this kind of.
Like advisory network of folks who
kind of, work on projects with Confide,
but they consist of cso society members
who are in between roles who have gone
into like fractional work or stuff.
So the society is just powering it, and
it's all just community first. Right.
That's that. At The core.
I want to come back to the events.
I want to ask, what's the
long-term goal of Confide
Long-term goal of Confide is build
a business, I mean, you know,
that goes in two options, right?
It's either build a legacy business
that has the ability to go.
You know, I've always said I kind of
see Confide is almost like if GuidePoint
and Gartner had a baby, It kind of
goes down this route of really smart
decisions powered by real
information. So it can go there.
But at the same time, yeah, you know,
there's every opportunity at some point
someone will come around
looking to acquire it.
That's when the PEs will start. Asking.
But that then goes back to the core
of, well, What's our purpose here?
Is that really the right acquisition?
That's why that DeFi thing
is so interesting to me,
because seeing Boos kind
of go down that route,
is both interesting for
the industry as a whole.
But also, yeah, you know, I see where
that doesn't necessarily have to then
compromise the experience.
Customers get. You know as well. So.
Makes sense. Come back to the events
thing. There's two things that strike me.
You intentionally named everything the
anti-something which means you obviously
have, a a deep lack of appreciation
for historical event approaches for the
fact that that's very much a kind of
punk rock, FU type of approach to things.
Right? That's number one.
And number two is you'll know
that I have not as an advisor,
but as a friend to multiple companies,
tried to get them into events.
And your events are incredibly
oversubscribed to get vendors into.
Like, I've never known events before
where you couldn't get a vendor to write
you a check, right?
That's just weird. So they're
the two questions, I guess.
First is what was so wrong in your
opinion that you wanted to Anti-Summit And
what are you doing differently?
And I'll give my take on that.
And the second is, Maybe it's the answer
to the first one is why are they so
popular with vendors, particularly from
the Tel Aviv ecosystem where you have a
massive backlog.
They want to be in there and can't even
get in there currently for the. Year.
Yeah.
Yeah. Okay. So first,
question for, first answer.
I came from the event industry. I just
think the event industry is so boring.
I agree. It's so boring.
And You mean probably that people have
panels of people that because someone
paid for that C or because
they're there only on the panel?
Because they wanted them at the event?
Because they might be a potential
customer for that person.
So you've got these
really weird conversations
All of the above. Right.
There are events that
cso's will vouch for,
ones that I think are valuable based on
feedback I've got from from from cso's
I'm always happy to share those as well.
So we can come back to that, please.
But it's so boring and it's just it's
all the same cookie cutter tactic. Right.
And this is kind of goes back to
like the vendor advisory piece.
So a few things number one
panel discussions okay.
So let me focus on the attendee
experience. First and foremost.
Attendee experience.
Right, We see in the society every day
the the raw value of the society to this
day.
And if I was to ask any members what's
the most valuable component society?
It's the just the conversations agreed
100 agree. So,
And yet you go to these conferences and
that is the thing you see least of if
there are conversations, it's
between five people on stage.
But.
Is that the events problem or is it you
know, I'm a very aggressive presenter.
Like is that there Is
that the events problem?
Is that the fact that people on the stage
haven't been trained or taught to ask
questions, to engage, to
fight with the Audience?
Both. There's so much like I could do
a whole series on this stuff dude Like,
seriously, maybe you should like it's
there's so much so I think there's not
enough, like, there aren't enough
sessions at these that is events,
the agenda does not, a kind of,
compliment real discussion. Okay.
Yeah. I Agree.
Panel discussions. Yeah, I have a gripe.
And I posted about this on LinkedIn.
And, you know, ironically, I moderated
a panel at an event that I think is
really valuable, at the
back end of last year.
But the panels, it's just
a series of opinions.
And it's the same people are never again.
And it's always surface level content.
What are you actually learning?
Like when they're well
moderated, they can be valuable.
But what have you actually learned, right?
In 30 minutes where five people are given
five to seven minutes each to speak.
Okay. So that's an issue.
Is that not down to the... I
moderate a lot of panelists.
I think that's down to moderators.
A, come with pre-scripted questions that
the vendor response of the panel gave
them.
B, they give their panel guests all crazy
amounts of time to prepare and script
their own answers, which I
think is inherently wrong.
And C, they never actually engage with
the audience to validate whether they
agree with or have different thoughts
to what the audience just said.
There's three different angles
where I think that breaks down,
which I think are fixable in the right...
I think it's a lot of it's
down to the moderator chair.
I agree.
But it's still, how much are you really
going to get from somebody if you're
only going to give them
five minutes each to speak.
There's five minutes of intros, there's
five panelists, there's 25 minutes,
done, 30 minutes, done.
So then it's okay, there's not
enough time given to it, but why not?
Well, because they're trying
to cram too much content.
Because There's more vendor-sponsored
content, I make more money.
So these are the signs you can see.
If you look at an agenda and it's
very heavily vendor-dominated,
then you can see, okay, I get the idea
of what this event is trying to achieve.
The other thing is with things like
panels is okay, cool, run 10 panels,
four people, five people per panel.
Now there's 40 50 attendees.
So yeah, like I said, you're farming
the attendees by putting them on panels.
Right
So that's another thing to do Yeah.
So and then you look at things like
paid keynotes and stuff really,
you're going to have a paid keynote.
The keynote is going to be based on the
vendor with the biggest budget, really.
So that's the stuff.
I find is wrong with the space, and
it's been allowed to happen because the
reality is, a lot of the time with,
with, with events, it's all about timing.
Like some people want to go to the
events they really want to go to,
but they can't.
An event rolls through Dallas where
we're at right now, right? Like, cool.
Yeah, I'd love to go to this thing.
So there's and and like I said before,
there's always value to be gaining that
because okay, there might
be a ton of vendors,
but somebody might go to that and go.
I got to hear from 10 vendors today and
I didn't know about those vendors and
they might get some
value from it. Yeah. But.
The keynote thing is interesting because
I can say this publicly because it's
well known fact. I've never
charged for a talk anywhere,
and I've turned down money
when I was offered it.
Right. Because I think that community is
driven by the fact people don't speak.
And I know that in, new San Francisco,
didn't make it casey ellis was happy to
do our for free right.
Which again very established, a very
top tier guy who could know that's
whatever we wanted.
And I think that that for me is a problem
that needs fixing generally like that
people expect or want to be compensated
for talking at conference where they're
being brought there because they have
either a message or a style or something
which is worth sharing. Like that.
We always talk candidly about mentoring,
about like thought leadership,
about information sharing.
But then I'm going to ask for like five
to ten thousand dollars to share what I
think you.
Well,
The irony, right, is because you're
spot on and a lot of these events that
exist, would look at, he's not in the
role anymore, but like Phil Venables,
right?
He used to be a CISO at Google Cloud.
Some of these event companies are so...
Like, close-minded, they would say Phil
Venables couldn't keynote unless Google
Cloud sponsored.
Mate, I've been there with the leper bell.
I've been told by all the conferences
I can name where they said,
your talk and your style
is exactly what we want,
but anecdotes will have to sponsor.
They'll have to sponsor it.
And I've got to say, I know I'm better
than the guy you're paying to speak.
Absolutely. And that's the
trade-off, but that's the point.
And so now going into your second
question, in the answer to that, okay,
why are they hard to get into?
Because we limit vendor
participation massively.
So, you know, our Anti-Summits will
have six main sponsors at the event,
and that's it.
And, you know, they get the chance to
choose between either running a workshop,
or, moderating a round table discussion.
Even in the round table sessions, there's
CISOs moderating the tables as well,
you know, in the workshops.
And this is one of the things that
we did after we kind of launched the
Anti-Summit last year,
we changed the agenda up.
So there's an equal amount
of CISO-led workshops,
as there are vendor-led workshops, Right?
Our keynote is a tabletop exercise.
Where it's like split everyone up and
create like a mock company mock scenario
and get into.
It.
Which teaches them quite a lot. And
they're always radically entertaining.
They're
Awesome, right? They're great.
And, you know, so, but what it does is
it sets the tone of the day as well.
It's like, okay, so I'm here. I'm going
to be talking. I'm going to be working.
I'm going to walk away with
so much more information.
We have less slots on
the agenda for content.
We have more slots in the
agenda for networking.
So then there's less stuff
to be able to sponsor.
That's why they're hard to get
I'm going. To come back
and click on that a second.
But you said you wanted to tell us the
communities and events that you think
are good. Yeah,
Absolutely. Okay. So the ones
that I think are good. All right.
So other. Opinions are
welcome and about Yeah. So
First of I actually start with like
things like FS-ISAC and stuff like that.
Right. They will always get
an unbelievable crowd I think,
you know because the focus for
them is very much on content.
And Yeah, of course they have sponsors
and it's revenue, it generates revenue,
but content is very important to them.
Okay. So those are amazing.
The SINET events again, draw a
really, really, really strong crowd,
the ones that Robert Rodriguez does.
So from a networking standpoint,
they're really, really great.
Those tend to go a little bit panel
heavy, but that's one thing that I'll say,
because having moderated
the panel last year as well,
the irony being I don't like panels.
I moderated, the level of organization
that goes into those panels,
Is second to none. Like, seriously.
It was funny because when we got
there at the event, side like,
a little side story got there.
And As an event organizer, I rounded
up so I was like moderating like a,
panel I rounded up my members, got
them into the green room and then the,
staff member from signet was like I was
running around trying to find you lot I
didn't realize you'd
already be in here like I.
Yeah, the first thing I
did was round everyone up.
But anyway, like, really, really good.
Other notable mentions that, is
like the innovate Summit. Yeah.
I would love to go and see it because
it's kind of the same thing as all this
kind of speed date stuff.
They just reversed it, But, you know,
the CISOs come back saying it's really
nice to kind of have that
level of not control,
but it's a little bit more like, say, on
who they get to meet with because a of
these events force you to
meet with people, right?
Based on who the vendor selected. The
one at InfoSec World. Yeah. Right.
That gets a good. Good,
Good love InfoSec World.
That always gets a really good response.
Then you've got like a bunch
of, like little experience ones,
like we were just talking,
came back from SKISO.
So things like that. The
Team8 summit gets a good one.
There's like Merlin
Ventures, does their Safari.
They. Have a left
And then like the independent ones,
Like, I don't actually know what they do,
like, conference-wise, but I know, like,
CISOs Connect generally get a really
good feedback from the CISO world, right?
Pulse. You've spoken
positively about Pulse.
Yeah, I do like Pulse.
More UK-based stuff. They do stuff in
the US as well, but they do a good one.
They
Do a fantastic thing at RSA that I'm
actually doing. This isn't a pitch.
But it's interesting because it's very
different where they've got CMOs and
CISOs. So their lunch is based around
the fact of, like, CMOs asking,
saying how they think. They
basically pitch and present to CISOs,
and CISO saying usually
that that's a load of BS.
And you're probably doing
this in an entire own way.
I think it's actually an interesting,
kind of dichotomy. That will
Be a good one.
And then the final one I'd say, is one
that's always been around that still to
a certain extent, is this kind
of the standard is Evanta.
Like Evanta is amazing.
But again, quite exclusive, right?
You need to have a company with more
than a billion dollars in revenue,
which there's a lot of us, myself
included, who aren't in that bracket.
So that's the problem with some of those
are they're a little hard to get into.
The ones that I like as well. On top
of it, I think they're all great.
I like some of the localized
ones that are specific.
Maybe to grc the isaca
groups, the issa groups.
The chapters that localize and
I'm a massive BSides fan. Yeah.
BSides Vegas, is still more, I'm more of
a fan of BSides Vegas than DEF CON and
Black Hat and similarly in San Francisco,
I prefer BSides SF to RSA itself.
So yeah,
But it's funny.
That's why a lot of people kind of
gravitate towards Black Hat these days
versus RSA as well, because they're like,
I can kind of get the tail end of Black
Hat and then do BSides which, oh sorry.
DEF CON. Sorry. Yeah.
Which a lot of people, because
it kind of like taps into the,
the technical side. Yeah.
You know, get away from
all this kind of like,
where's the CISO going to be in five year.
Yeah, I agree. You know what I mean.
I want to go back to the events.
One thing that I like, and
this isn't a pitch for you,
but one thing that I like it's like,
you are allowing people to like me to
really push the boundaries of what
pitches and presentations are I still
There's a lot of vendors who
turn up at CISO Society events,
who come with their slide
deck and haven't learned yet.
And I think there's a lot to be said for
the fact that George is getting me to
tell people how to do this better.
But I, I see it as like almost like a
proving ground it's a chance to go and do
something completely mad, which I probably
wouldn't do in other places just to
see if it works or not. And I think
there's a lot to be said for that.
Right? If you get enough
vendors thought exchange,
they start to do things which are
completely unrelated to their product
pitch.
And I think that's like engagement that
people people want to come to an event,
and have fun.
In it they don't want to like,
sit to listen to 10 Pitches Yeah,
Well, you nailed it in your thing
because, so again, for those, listen,
Jake did like a how to
kind of guide, right?
Cause George, George Kamide, who's
our head of community and content.
He's really passionate
about this, like really,
really passionate about
like real quality content.
And so the challenge when you do have a
vendor sponsoring a session and they're
going to be kind of leading that session,
is you never really know the
strength of the speaker, Right.
And you can prep them as much as you want,
but even going back to my old event days,
a lot of times vendors just gonna you
know, send us your deck in advance,
That means nothing.
They could change it.
The more is the prep on, look what do
we what do we want the attendees to get
out of this?
Yeah, that's the prep, And so george has
kind of like done a really good job of
doing that with all the the you know,
the practitioner-led sessions and the
vendor-led sessions, But when you kind
of find these beacons like these, these,
these kind of, ones that set the standard,
that's when you want to double down.
So there are a couple.
So yourself in the
roundtable realm, you know,
how you can get people really
engaged in a roundtable discussion,
like when you've done those with
anecdotes? That's been amazing.
And, you know, you kind of said when
you did that, how-to video for us,
like be memorable. This is like a key.
It's, even if you if the content is
wacky on occasion it goes out there.
It's memorable, and they'll Remember
that was Jake it out to ourselves a fun
session.
No. One's. Gonna forget building
Lego F1 cars in San Francisco. Right?
The other one that, we use now is a
little bit of a, kind of, has set.
The standard was, a vendor called Maro,
and Gwen, who ran the session there.
It was funny because Maro kind of came
in at the last minute because one of the
sponsors had to pull out and
they said, oh, you know, talking.
And they came in and
this was in LA last year,
and they just absolutely nailed it.
They really like, because
we have workshops.
And so we say this to everyone, like
the clues in the title, It's a workshop.
You got to get people in the room
working. And they really nailed the brief.
And so they're kind of like now George's
this is the standard that's been set
from a round table standpoint.
It's a check session.
And then from a workshop that was
maro's session, and then, you know,
over time, people realize I get more
value by doing it like that versus we're
going to talk at you for 30
minutes about what we do,
You still get one or two unfortunately.
Again, you can't vet everything.
But for the most part, people,
people will enjoy that.
And especially because, you know, at the
anti-summer like everyone's allowed to
go to every session so the vendors can
go to one another sessions because we
don't have competitors there right
another reason why it's hard to get in.
So yeah, but they can
go to all the sessions.
So if they're looking at another
vendor like oh wow, that was good.
Oh god I want to do better than that.
It kind of ups their game a little bit.
Yeah.
Have you thought about conferencing
The CISO Society Conference.
Annual retreat.
An annual. Retreat. Yeah.
Hawaii, Bali, where are we going?
It sounds like a White Lotus thing here.
Yeah, but annual retreat
because it's, you know,
I've been looking at this and it's
something that I really do believe in and
I've been thinking about
it for a few years.
Is the future of the events is very
experience-based. Agree. Yeah, 100%.
And so, like, we mentioned
things like CISO.
We mentioned things like, you know,
the teammate when they did their CISO
village, their summit,
Merlin, who do their Safari.
There's lots of, there's a new one that's
called ciso ascent that's come out as
well, where they do like
hiking and things like that.
I've seen that. Yeah.
That is where because everyone talks
about relationship relationship,
the challenge you've got right now, and
I'm sure the organizers of those events
will kind of appreciate this a little bit.
The challenge you've got is when you
get into the vendor marketing dollars
world, there's still metrics,
and it's very hard to sometimes,
correlate spend on
An event ROI.
And so, okay, what results
did we get from that event.
Well there's nothing immediate, But
the marketers know it was about being
there, having the conversation to build
the relationships because that person
will come back in six or
nine months or. Something.
That's super hard right?
This is a conversation.
I mean, a high Linkedin's really open.
Like I talked about having like 20 of
anecdotes revenue last year came from me.
And if I like, say, if someone asked me
now I got asked by a year I see like,
how did you do that?
And I went, I don't really know.
Like I was in a lot of places.
Is I built a lot of relationships
and not one of these people did.
I directly pitch to Per Se.
They came back to me because we
already had friendships and we had time
together, like we had a relationship.
I think that's what you're talking about.
The problem is that there's
a short-sightedness around,
I need ROI from an event,
I need lead attribution.
But the reality is, a lot of the
time, the leads that came from it,
you might never realize came from it.
Because they came actually in-bathoment
Because you created the relationship
and the weirdness and like
that kind of bond already.
That's the problem. I think a lot of
vendors are very short-sighted. I,
I, I would tend to agree.
You know, and everyone's got to go for
a learning curve, especially startups.
And they spend money and they realize
what kind of like gets them the best
results.
And, the, you know, that's one of the
challenges with the society is no,
we say no, a lot, like, no, you can't
do this and no, you can't do that.
And it's not that we're
just trying to be difficult.
It's just.
You know, it's always got to be based
around what's the value for the CISO.
Yeah. This is why I go towards these,
these relationship-based things, You know,
when you can spend two or three days
with a CISO on site and get to know them,
beyond their budget and their
logo and really spend time,
getting to know them as a person,
they're going to remember you,
they're going to take a meeting and
they're going to be a lot more open with
you about, this isn't something I can
do right now, but I see the value in it.
And more importantly, that person's
going to go into a community and say,
when the next person comes in asking
for a vendor that does XYZ they're going
to say, oh, you should
talk to that vendor.
I met them at this event
and they're awesome. And.
Because at that.
Point you don't need to have a referral
agreement or advisory contract because
you just like the person, right?
I mean, I just came back, you know,
from SKISO where you've got a a large
portion predominantly Tel Aviv based
startups or seed round funds companies,
and you've got a group of CISOs who
vary everything from vendor CISOs like
myself up to like the
equivalent of a fortune 100.
T So what you've got is actually one
day's conference amongst five days.
The rest of the time you'll spend
in spas or skiing or on chairlifts.
And there's a benefit to everyone, right?
We're learning about the stuff
that people are trying to solve,
I didn't know existed.
They're learning about the products
that they're building to where they
actually match, or where they
should iterate and pivot.
And the end you're building relations
right I've said to more people I said,
look, I'm not your buyer, but I probably
know three or four people who might be
let me give them a ping, or maybe in a
year's time I might be your buyer or I
can probably help you guide your product
to what your buyer actually wants.
Like you build those relationships
which are then based on I mean,
it's old school consulting crap, right?
But related to trust where people
actually want to help each other,
regardless of this kind of transactional
nature that's often seen. Yeah,
We had, a vendor recently
will remain anonymous,
but they contacted us and like, so, we've
done two deals as a result of the cso
society.
They've never participated in any cso
society events or anything purely through
the community talking with each
other about like tools they're using.
They're recommending like so we didn't
even know this group basically existed.
And yet there's deals now in our
CRM attributed to the CISO Society.
Because how did you hear about
us through the CISO Society?
We've definitely done some,
which after any attribute,
you probably just don't know these things.
You go back and look at anecdotes,
somebody can't because it's 90 days ago.
But you look back through all the
chats and you'll see there's multiple,
times where someone got referred to
us by somebody else who was in there.
They reached out to me
because I was in the channel,
and the deal ended up happening.
That's completely organic
from this idea that Like,
do you need Gartner's Magic Quadrant?
If you've got a group of people who
just go, what vendor do you like for A?
Exactly.
And that's why my message to vendors,
and look, of course, it's because I,
manage this thing, but vendors need
to start thinking about investing in
communities, but not communities, okay?
Because this word is being
used very loosely as well.
So community, community, community, right?
If you're on a freaking mailing list
now, you're part of a community.
Real communities where you can
invest in building relationships,
building trust with people and
invest in the word of mouth.
We all know word of mouth is
your greatest sales asset.
Like your customers are your greatest
sales asset above anything else.
So you've got to invest in building a
presence within there without having a
presence in there.
And that takes time, but I've seen
it in the society many times, right?
Sponsor of a few networking dinners.
And then all of a sudden you
should talk to this company.
I met them in Boston and.
Yeah, you know, I'm sure.
Jason, but that's the long game.
That's the patience. Right?
I think maybe because we've now identified
that you're quite a patient person,
you probably expect to
patience of vendors,
which isn't inherent in
their nature. Normally.
Yeah. Yeah you couldn't be
it's like you've nailed it.
Absolutely.
Because you're not in their heads because
you don't think about things the way
they do. They think about immediate ROI,
because that's never been your game,
you struggle to kind of
get into their heads.
It's almost like a collision
here, Which is what
Causes the problem. Yes,
there are lots of times.
And I have been told that I can be
difficult to work with by vendors.
But know that it's because it's always
looking for the greater good. That's why.
It's very much like, okay, but I'm not
going to compromise something just for
the sake of some quick win.
Like there's got to be more meaning to
it if. Right Do you see what I mean?
Yeah. And so, yes, because I say, no,
you can't participate in the event.
Why, There's no spots
but make a spot. Yeah,
But we'll give you we'll give you 20, 30
grand, make us a spot. There's no spot
Why is it difficult? I've
not been difficult. Yeah.
Yeah, you've got. To protect
your branding then, right?
If you set out to do something then
there's a point at which if you
compromise, you risk putting everything.
I could talk for hours,
But we need to stop.
Two questions One is, what
is your tip for people?
You'd meet a lot of security
practitioners, young, old, employed,
unemployed.
If on the basis of knowing what you
know about community and about this
relationships and this world, what
would you give as a tip to somebody or a
useful piece of Intel?
Just
Somebody just in the industry
kind of making their way. Yeah.
You've got to be, you've just got to be,
you've got to put yourself out there.
You really do. I didn't value
my network for the longest time.
I started late, Jake, like really
started late And, it was naive of me,
and it was all because I had this kind
of, like notion in my mind as well.
I don't want to take work
home with me, You know,
you start a business you live
at work, so it's impossible,
but I don't everyone I
was one of my separation.
And, you know, and there's
some really kind of like,
let's say outgoing characters in our
industry that have really cultivated
amazing networks and stuff.
And I used to look at that
and go, no way, no way.
But, I was wrong. And so
I had to put myself out.
And the reason I just give, give my
own experience is Because I was one of
those people that wasn't really
comfortable, putting myself out, there,
which is strange for somebody kind of
starting and running the community.
Who's made a career out of it.
But, but that's where you've got to be.
You know, I talked to a lot of
people that joined the group now,
who are having this realization of, I
just need to start being where people are.
And know that in those groups,
you don't have to be vocal.
You know, the 80-20 rule exists, 20%
of the group account for 80% of the
engagement, right?
And you don't have to be vocal.
And you know, you can be a lurker
as community groups call you.
I tend to call them passive
consumers, but like you can be,
you can be somebody who gets
it, but it gets the information.
And then just get his permission, maybe,
but there was a gentleman who came
out to our networking dinner in LA,
Newport beach three weeks
ago, me and Larry, who's like,
I haven't been out to an
event for a long time.
But I wanted to come out because I'm
part of this CISO society And it kind of
meant it was like, and
I need to start again.
And this is my realization
that it's not as kind of, like,
scary as I thought it was.
It's not just got to get out. There.
So that's the biggest piece of advice.
Get out there, ask questions,
make friends with people,
especially those navigating
the job ecosystem,
because we see it even
with CISOs in our group.
Hey, I'm looking for work and
I'm looking for work. I think.
99 out of 100 that have like get it
through who they know instead of where
they're applying.
It's well, that definitely I can speak
to. I've never applied for a job.
And the second one I say is
mentoring you're calling people out.
Like I said, if you look at the CISO
Society as a chain of like almost like
grandfather, father, child,
like when I first went to,
anecdotes originally as a field
c So I spoke to carl Mattson,
who gave me some insane amount of time
and advice and documents and links and
intros.
They gave me all kinds of help.
Like, I couldn't thank him enough,
and I'm still incredibly grateful.
And then the next time that I saw
it flip is when Conor Sherman,
who then came to me and said,
Jake, how'd you do this?
And most of what I gave him, I realized
was just everything I'd learned from
Karl built into like,
my rhetoric and style.
Yeah. And I think that's the gift of this.
And when you talk about like,
if your tip is get out there,
you only get access to people, to
opportunities and to a chance to grow and
develop by being there like my again, if
I go back to like, you asked me, like,
how have you delivered
revenue to a vendor?
I would say I'm just there.
Like go to market, right?
GTN, there is a part which just says go.
Like same in community, You have to
physically be there to be able to build
these things. If you're not
there, it's very hard to like,
you can be a passive consumer on Slack,
but you can't really be a
passive consumer in a room.
Like at some point you have to introduce
yourself at some point you have to
engage. I think conquering that
first step is the hardest bit.
One more question.
I'm finishing every podcast with a
question from my eight-year-old daughter,
Izzy. They are random, and
disconnected, unrelated.
Yours, which she has said
to me this morning Was,
if you could go back and do any job
That wasn't this one, what would you do?
A job that I've. Done?
No. Any job. You could be anything
right now. What would you be?
A, professional football player.
Isn't that the same thing that every
person Would you play for I know,
but they don't. Know Yeah,
It'd be Spurs
Yeah, well, you might say
they're from game Relegate. But,
Yeah.
We're not using the r word So it'd be
football or it'd be like something but or
like, I think kind of I always
feel like the most glamorous,
the most glamorous job on planet Earth
is probably like, formula one driver.
Yeah.
That's the one. Isn't
it? That'd be. Pretty.
You want to be like George Russell, just
like on your boat in Monaco with swept
hair? Yeah, I can see
that, Jason. Thank you.
Honestly, it's been an absolute pleasure.
Personally, mate, you have been another
mentor and help and kind of support in
my career and journey.
So honestly, I don't say this very
often publicly, but thank you very much
And and yes, you've been asking me a lot
of questions and I appreciate it, but,
no, can't thank you enough for
all the time you've given to me.
And as you mentioned, like to others,
like when we talk about community,
absolute community. Figurehead.
Thanks, man. It's the
biggest compliment I can get.
If you aren't part of the season
society, you should join it.
If you want to know how reach
out to him or me on Linkedin,
and we can talk more, but
hopefully this has been useful,
interesting and mild entertaining.
Thank you for your time. We
will speak to you soon. Cheers