Subscribe
Share
Share
Embed
Technology isn't built by companies. It's built by people.
Random Access Memories (RAM) is where technology gets personal. Host Jake Bernardes sits down with founders, CISOs, engineers, operators, investors, and community builders to explore the stories behind the products, the pivots, the failures, and the moments that shaped their careers.
Whether we're talking cybersecurity, AI, startups, leadership, or life outside the office, every conversation asks the same question:
What shaped the person behind the technology?
New episodes every week.
Presented by Hubscale.
Jake Bernardes (00:00.632)
Hello and welcome to another episode of Random Access Memory Stories That Bite with me, Jake Bernardis. And today I have a fantastic guest. Tim Brown is about one of the most high-profile breach I think in in history. And I want to talk a little bit, not about that actually, but about the consequences of and pressures of the modern CISO role and everything that kind of surrounds it and dive into some of the kind of the aspects that we don't talk about enough in our industry. But before I do that, Tim, if you'd love to introduce yourself, tell us a bit about yourself, tell us what your hobbies are, and tell us who your hero is.
Tim Brown (00:30.884)
absolutely. So Tim Brown, former CISO Solowans, now CISO in residence for team eight. let's see. So I've been around for a long time, done a lot of things, built a lot of products, always focused on security for about thirty years. heroes, heroes. I I look at inventors, I think. Those those guys, yeah, really changed the world. so
You know, i and sometimes you love them, sometimes you hate But when you can really move things, then you kinda get a get excited. So, you know, you get the Einstein's early, you get, you know, Elon, you know, he before he went crazy, he was still doing an incredible thing. So those types of folks are really the ones that I look up to. You know, folks that really push and change the world.
Jake Bernardes (01:09.324)
Ha ha.
Jake Bernardes (01:17.582)
That's interesting. What did you do for hobbies? What's what's fun for you?
Tim Brown (01:20.14)
Yeah, so I live on a on a ranch in Texas. So I have about sixty acres, have probably thirty many donkeys, ten horses. My wife rides every day, rides four horses. I help, I don't ride. but yeah, that keeps us real busy.
Jake Bernardes (01:37.368)
How do you live on a ranch with a wife who's obsessed with horses and have not and don't ride horses?
Tim Brown (01:42.546)
so I probably haven't she says I have no balance. so I was never any good. so she said I'm scary. and that was probably twenty years ago. So I've been married for thirty five years. so yeah, been a long time.
Jake Bernardes (01:58.126)
kudos on being married 35 years. That's cool. I might actually ask some questions related to kind of the the relationship side of things too as well. Actually, let's go on that one. But I wanted to start with this one, right? So you were the center of one of probably the most reputable or biggest breaches in recent time. it was a pretty major event. there's enormous public scrutiny was applied to it. you suffered obviously a health event, a heart attack, and then you reinvented your career entirely. What do you
know about life now that you didn't know then? Like what what's how's your outlook changed now?
Tim Brown (02:30.486)
Yeah. Yeah. So so a lot about, you know, not to worry about the things you can't change. That's one of the biggest ones. You know, through all the court cases and be in charge, those type of things, you know, heart attack puts things into per perspective for you. And, you know, eventually you get to the point of okay, I can live with the result, right? Whatever that result had to be. I was okay with it. And so, yeah, you have to give things patience. You have to let things run out. Yeah.
The incident happened it in December twenty twenty. The incident didn't close until December of twenty twenty five. That's five years of stuff going on. you know, and eventually the case was dropped, which is great. so I think it's really just, you know, sometimes you have to let go and just realize, hey, if the worst thing happens, I've got it covered. and be true to yourself throughout this whole thing. And, you know, make sure you're not kind of selling your soul.
i in any of the circumstances.
Jake Bernardes (03:34.005)
Mm. I think you I mean I think a lot of the community agrees you handled it with some pretty good grace and elegance in the way that you you dealt with the situation and it were real credit to the community. I I I guess I would I would I would drive it further. You talked about just being married for thirty five years. What was it like at home? Like I assume it's really hard for a spouse when like your husband or or wife is in the news and there's so many things being said. that must be really challenging on a relationship.
Tim Brown (03:58.774)
Yeah, and and I do something that I I don't know if I recommend to people actually. So I really do separate life and work and home and work. And I remember my wife telling me, Hey, yeah, I know this is your safe place, but if you have to talk to me, you can. But literally we didn't spend any time on the on the incident or what I was going through, except for the heart attack, those type of physical things.
Right. But from you know day to day what's going on with the case, very, very, very, very, very little. so I compartmentalize those things. And
Jake Bernardes (04:35.541)
It's so interesting that you say that. I I I did a pod not long ago with Joe Sullivan and his wife Patiba and they talked about the exact same thing that they comp mentalised entirely. They'd literally leave the courtroom and be like, So, who's picking the kids up? Like, what are we doing for dinner? Like they they said the exact same thing as you, it's really interesting.
Tim Brown (04:52.716)
Okay, that's interesting. Yeah, 'cause I I know Joe well. I never really talked to him about it though. But compartmentalizing for me worked. And because I did need the, you know, you're under stress all day long. You're talking to people all day long about these things. You need a break. You need to be able to just, you know, go home and breathe and you know, hug a donkey. And that that always does good for you. And and just but you need the separation, or I did. So and I used other people for my sounding.
Jake Bernardes (05:12.085)
Okay.
Tim Brown (05:21.654)
you know, boards. I use the CISO community. I used others for for, you know, going back and forth on things. And so in many ways all the talks that I give are therapy, right? They really are, you know, just, you know, they help me cope. And and then the support that that I ended up getting from the community was, you know, just incredibly incredibly heartfelt and incredibly, you know, meaningful.
Right. So to have that level of support and to be able to give a story or give tell somebody a presentation and they'd Wow, thank you. Or to hear somebody say, Yeah, I adjusted what I was doing and something bad happened and I was safe because of you. Or those types of things are make it all worthwhile.
Jake Bernardes (06:10.141)
Yeah, I think I mean you I'm sure you've been told this before you just meant referenced it, but there are more people myself included in the community who learned so much from some of the things that you said afterwards about insurance, about how to deal with lawyers, about how to be protected, about how to deal with your internal communications, like certain things that so many of us didn't know that we've then now got preparation for. So the same thing happened to us, how to deal with it in better way. and thank you. I think that's a great credit to how you and the community interacted after the fact. I guess going back, like you said you complementalized.
Was there a point at which either you or your wife sat there over the dinner table or somewhere and thought, you know, I might actually go prison for this? Like the the SEC was filing pretty hard, right? They're like, is there a point at which you genuinely had that thought and went, I don't know what this means to my life, I was just doing my job and now I might end up in a cell?
Tim Brown (06:54.52)
Right. Yeah. So I mean i it one of the biggest decisions with the SEC came the first days, right? So I'm sitting there in the hospital after my heart attack. So I had the heart attack that the same day that the SEC charged me. So I'm sitting there looking at a settlement and I'm saying and thinking to myself, Well, I can just get it done, right? I sign this piece of paper and then it will be all over, right? It'll just be done. I'll pay a fine. the the
The the fine would have been anywhere from fifty to two hundred and fifty thousand, something like that. but then I'd be done. And at that point they weren't asking for a bar of officer and director, so I wouldn't have to be fired. But the words that they tried to have me sign were just so terrible. just soul sucking, right? You know, Tim, you suck as a person, you suck on your program, you
were completely negligent in everything that you did, just the words. And then you have to put your name to that. And then thinking about what it would do to the, you know, the community, right? The CISO community in general. I'd be setting precedent that says that somebody just doing their job is responsible for something. an incident, yeah. And yeah, that's not the right precedent that I wanted to set either. So doing that, you know,
deciding to say, yeah, no, we're just gonna fight. they made it pretty easy, really, right? The SEC was just being so nasty. So they said, Tim, you built a program that wasn't sophisticated enough to combat the Russian SVR. Okay, you're right. I didn't I would have signed that. I didn't. Right? I didn't. And because I failed in that mission. And I would have signed that, right? But the stuff they wanted me to sign was just so
Jake Bernardes (08:37.869)
Hands up, yes I didn't. So did everyone else in the world.
Tim Brown (08:50.722)
full of mistruths and lies. And I just couldn't put my name to it, even though I knew it was going to cost me a couple of years.
Jake Bernardes (09:00.949)
Interesting. I mean you said that obviously you had your heart attack and then the same day they actually filed the the case. Like when did it start to become physical? When did you realize in kind of this incident point that you act this was actually this is affecting my physical health right now? Like did you know before the heart attack or was that like that was the wake-up moment?
Tim Brown (09:18.124)
That was really a wake up moment That the I started feeling so I was in Zurich, at a conference, speaking at a conference, and I got the call. And so my attorney just said, Yeah, just you and the company are being charged. And then and I just noticed that I couldn't breathe, right? I noticed that like walking up from the hills up to from Zurich up to my yeah, hotel, you know, I'm with some folks and just walking along and it it's like
your arms start feeling heavy and your chest starts getting tight and you're just not getting enough oxygen. and then you know so I knew something was going on. I was thinking virus or something like that or and really put it to a heart attack. but then I did something silly. I flew home, got to the got home, couldn't walk from the terminal to my car, had to stop and rest. And that's a walk that I'd done thousands and thousands of times.
Jake Bernardes (10:09.475)
my gosh.
Tim Brown (10:15.532)
So I got home, told my wife, and she said, We're going to the hospital now. So ended up the hospital Saturday night. they put st ninety for ninety five percent blockage, one artery, seven five the other. So put stents and balloons, you know, all better now. So no damage to the muscle and that type of stuff. So I was I was really, really lucky.
Jake Bernardes (10:37.089)
But you didn't realise the kind of physical stress you were carrying until it manifested itself in the form of like an actual heart attack.
Tim Brown (10:43.468)
Yeah, I didn't. I thought I was okay, right? and I really did. I thought I was okay. And you know, one of the things that you know, a number of us strive on thresh on stress. So I I like stress. I really do. And so when people tell me to manage stress, I had a problem with that. Met with a psychologist, Israeli person at one of our conferences that we had. He had a great presentation. He's been studying happiness for like forty years.
Jake Bernardes (10:55.916)
Yeah.
Tim Brown (11:13.764)
And what he said is stress isn't the problem, recovery is your problem. That you stretch your muscles, you give them rest, you get better. You stretch your muscles, you get them better. So you that's the way you build build up muscles. But I kept having problems with somebody saying reduce stress, reduce stress, reduce stress. No problem whatsoever with people saying increase your recovery. So I've actually been focused on increasing my recovery. I'll take a
Jake Bernardes (11:41.847)
So even now, having had a heart attack because of the stress you're under, you're still an advocate that stress is a no is a good thing.
Tim Brown (11:48.065)
I'm advocate for me, right? That I like I like to be I like to feel pressure. I like to feel that I've got a lot to do. I like to to do a lot of things. I like to feel that I am under some stress. so I do think it's still stress is okay. But can I do better on recovery? One hundred percent. Can I
Jake Bernardes (11:50.017)
For you. So it it depends on the circumstance individual.
Jake Bernardes (12:13.855)
I think I think it's inherent in security leadership. I think that all of us like stress in one way or another, whether that's from having multiple different parts of our jobs happening at one time, whether that's incidents, whatever it is, somehow we we kind of thrive on the buzz, I guess. I can it's it's a weird it's a weird thing. We talk about burnout a lot, but I think often often it's just the personality traits that we carried before we got there. It's not the actual pressure of the job. so
You you obviously mentioned that now you can look back and you talk about appreciating the things that you've got and like being more appreciative for life and stuff, but that's after you obviously were found completely innocent and the whole thing was dropped. You had a period there where you had this heart attack and for quite a long period of time you still didn't know what the outcome was. So did it did your priorities and way of thinking change immediately after that point, or did it take the case being dropped for you to change how you kind of saw the world and thought about like what was happening in your head in that period?
Tim Brown (12:59.384)
Yeah, so it helped me yeah, as soon as we decided to fight, then then you soon get you go through a couple of different stages. First first one of the stages is you question everything you're doing at work and say, Can I write this down? Can I do this? Can I can I expose this thing that's happening? Can I put programs together that'll make things better still? And you question yourself and say, Well, that's what I'm getting, you know.
prosecuted for. And you you quickly get to the point of saying that, well, I can't do my job and if I'm worried about all of these things that they inappropriately thought. And yeah, we c always look to improve. We always have programs to improve. So just because they didn't understand what we do doesn't mean I could stop doing what we do. but for, you know, a month and there or so I was like trying to i I was struggling.
then you get to a point in the case where you've got great lawyers, the lawyers are moving the case forward, they're doing what they need to do, they're essentially driving the boat and you're a passenger. And once you figure out that there's not much you can do except help when they listen to them, prepare, take it really seriously, and help through the process, there's not, you know, a tremendous amount you can you you can do.
So you get to an acceptance point and you just say, Yeah, whatever needs to happen will happen and we'll get to a point and you know, things will things will be one way or another and it's okay. So as soon as you reach about it, it hopes out. Yeah.
Jake Bernardes (14:36.737)
You take a kind of acceptance actually. Interesting. Yeah, that's a really refreshing way to look at it, I guess, from the perspective. if you could go back in time, like pre heart attack, so when the incident was happening but you hadn't yet been charged, would you do anything different? Would you tell yourself, if you went back as a ghost of your own shoulder, what what advice would you give yourself?
Tim Brown (14:55.416)
Lot lots of advice from different angles, right? So things were misinterpreted from the case perspective. So I always recommend people, you know, have good job descriptions and very clear things that they do and don't do. I really believe somebody was looking for the truth and during the beginning of the incident or during the beginning of the court case. And the truth didn't matter, right? That that was not
Jake Bernardes (15:10.829)
Mm-hmm.
Tim Brown (15:24.652)
what somebody was after. so yeah, I went into teaching mode, trying to help people understand what we do as security professionals. And I probably should have just been quiet and answered single questions and not tried to give as much context. So be more cautious, right? When somebody's yeah
Jake Bernardes (15:43.645)
Mm, because every word becomes evidence effectively at that point.
Tim Brown (15:47.039)
Exactly. And you know, I c came up as competent. I came up as somebody that's worthwhile being charged. Yeah, and if I back again, if I give the SEC some grace, right, you know, and their mission was to improve cybersecurity for public companies of the world, if they had just charged the CEO or the CFO, it would not have been a non-event. Charging me made it an event for the security community, made it an event for boards, made it an event for the executive teams to say
Hey, we had better talk to our security people. and then security teams looked for liability insurance. They looked for understanding whether they would be covered. yeah, because we're talking, you know, millions of dollars of legal fees. So that yeah, we shouldn't be on the hook for. But it spurred conversations at the executive team and boards with their security people. So overall they achieved their mission of
helping public companies realize that they need to take security seriously. And then, you know, in the end I won with being dropped. So we both ended up winning. It was just a painful five years.
Jake Bernardes (16:57.623)
What what made you decide to fight? Was it just because that what they asked you to sign was so unsignable? Or was it the fact I mean, you were backed by your CEO and SolarWinds in a way that a lot of CISOs haven't been historically? Was that what what was the reason or what was the moment where you went, actually know sod it? I'm fighting this.
Tim Brown (17:02.144)
Mm-hmm.
Tim Brown (17:12.8)
Right. So the the company is being sued by itself and then I'm being sued on my own. Right. So you have to remember those are two different distinct things. And with two different distinct lawyer pat lawyers here at be before this. so with that you're making kind of independent decisions. So nobody at the company, the company had my back, had my
So had full gave me full support, paid everything that that needed to be paid. but the we couldn't or didn't probably couldn't really collude on what our decisions were going to be. So our decisions were independent. So for me, it was a couple two parts, right? What is this gonna do to the CISO community? Is it gonna be good for the world?
And the answer was no, it's not going to be the good good for the world if I set a precedent that says they can, you know, strong arm to a settlement and then have something that in enforcement action that can then be precedents. So that absolutely entered into my mind. And the second was they really made that simple and easy because of the language they were asking me to sign. so between those two, it just was, yeah, let's fight. And the and the language they used against the company.
Jake Bernardes (18:28.705)
Yeah.
Tim Brown (18:36.63)
happened to be as bad as the language that they were using against me. And they looked at it and said, well, we can't sign this either, because it would be bad to the company. So if they hadn't been that aggressive, we probably would have ended up settling
Jake Bernardes (18:54.189)
That's interesting actually, is a as a I I thought you'd probably say the same and I I've seen the documents themselves, so it's quite interested by that. you've talked about Sullivan's a million times, so let's pivot, right? So you survive one of the biggest breeds in history. You're cleared entirely. You've had a heart attack, you've not died, you've recovered, you're back to full health, you've got a a fantastic reputation, you now have a incredibly strong personal brand. why not be a s why not go straight back to the CISO role?
Like why you've pivoted in time to become a CISO in residence, which is i you can explain in a second what it is, but why not just go straight back into the fire? What what what changed your mind?
Tim Brown (19:29.302)
Yeah, I think I just needed a little bit of a break, right? And the operational side I do miss. the surprisingly, right, that the you know, going through all of this, I had opportunities at the end, right? Of different places. the I never sought out ever to be, you know, to be known by many, right? That just was not my, you know, my plan whatsoever.
but you know, through that, you know, a lot of a lot of people know me, a lot of people you know, have worked with me or heard me or have talked to or all of those things. So when it came to looking, right, yeah the the case settled in December, or or was dropped in December, which was great. The company and I had already decided to part ways before, right? Because you know, the company needs to move on beyond this.
And they did a good job, right? Great quarters, highest renewal rates they've ever had, all of those things. but it was still time for me to, you know, kind of move away from the company and and let them keep going on their path and let me go on a on a new path. And then I talked to folks about you know CISO roles, I talked to folks about you know different roles, and I still wanted to help the community. So I looked for jobs that I could help the community with.
this was yeah, Team8 operates a CISO village. about five, six hundred CISOs are in the village. And what the CISO Village does is we, you know, it gives us insights to what the world's looking at, what the world's missing, what products we should build. And then Team8 incubates products. So we start a company up, build the product, get them to you know incubation stage, a seed round, an A round.
and hopefully keep them building to you know great success. So it's a great model for me to kind of bring a couple of passions together. I'm a product guy at heart. I've built product for the last 40 years. So when I look at incubators, I've been helping the the s early stage guys. I have been helping the smaller companies kind of on their vision, on what they should do. So I really enjoy that half of the job as well. So
Tim Brown (21:57.133)
Both those put together. So I still have community. Then I have help building products that will hopefully change the world and are right at the bleeding edge. And yeah, and then I put those together and I, you know, get a lot of good get a lot of value.
Jake Bernardes (22:14.049)
Hm, interesting. what are you hearing most from the community? You obviously now run or or have a strong least run on the community. What are you hearing most from the CISOs in it?
Tim Brown (22:24.374)
I'm sorry, you broke up there for a sec.
Jake Bernardes (22:26.349)
Sorry, I said you obviously are now deep in a CISO community in Team A. What are you hearing most from the CISOs in the community? What are they moaning about, happy about? What are the trends?
Tim Brown (22:31.948)
Yeah. So yeah, of course AI is gonna change the world, right? We're we're in a w next couple of years are gonna be interesting. And interesting from what we need to have. interesting in that, you know, all of the agents we're writing are, you know, different than humans, right? They're gonna have different personalities and
But those personalities are not always like the computer programs we wrote before. They're not deterministic. So what they're gonna do can be based on a lot of different factors. So you know, when we look at that world, it's a you know, it's we're at a good inflection point. We're at another one. So I've gone through a number of them. You know, I'm old enough to have, you know, been at the you know beginning of the PC to the internet, to the cloud, to
you know, now AI. And I think each one of those has been an evolution and we're gonna be in the middle of a interesting evolution right now. So the question is how do we keep up with the adversaries? I'm not a I'm not a you know everything is negative, everything's gonna blow up. I think at the end of the day we're gonna get better software because of AI. I think we're gonna have a couple years of you know difficulty from a
We need to patch everything, right? The good hygiene has just changed, right? Good hygiene is bumped up. So I worry about companies that are you know don't have the facilities to be able to, you know, aggressively implement updates, to aggressively test on their own, to aggressively and proactively understand what risks they're facing. Because the risks of yesterday are not gonna be the risks of tomorrow. So
That's one of the big things that you know we're looking at with the community is saying, Okay, how do we how do we do this? How do we do this in for not just those that are big enough that can take really proactive approach? How can we help the ones that are not? How do we help open source? How do we, you know, kind of move forward at the right way so that we can use this kind of inflection point to make it much harder for our adversaries as opposed to, you know, them getting it upper hand. So that's what
Jake Bernardes (24:49.175)
Do you think that sorry, do you think that CISOs are getting better? I won't care for that word. My I what worries about the next generation? I say it because I I think that as you start, you talk a lot of AI replacing early tooling, right? And effective like that, entry-level sock analyst no longer exists. Entry-level pen tester no longer exists, right? Entry-level GRC no longer exists. So this path that most of us yourself, you being having been through several decades of innovation, I'm still also at this point haven't been through two of them. Like
We've seen and grown through career paths. Whereas now, like this next gen's coming into a very sophisticated tack landscape, but probably having never done any entry level work. Like how I don't know if I worry that like our next generation of CISO leadership doesn't have the skill set because they don't have the context. I don't know if you think differently, but someone in the community I thought would be interesting to ask your opinion.
Tim Brown (25:38.497)
Yeah, I I was thinking some of that as well. It's like the the the background matters, but you know, the in some ways if you look back, right? I was a kernel guy, so I, you know, developed under the kernel. Who needs to anymore, right? Then I developed under, you know, early Windows stuff and who needs to do that anymore, right? Low code, no code. So it we've we've we've been able to survive not understanding the basics and thrive.
Because do we really need to know Assembler anymore? Right? Do people really how many of the people really need to know what's going on that deep? As long as it's working, right? So I think we're gonna feel some pain, where that knowledge of what's going on behind the covers really does matter. But, you know, I think it's just when we're gonna see an inflection point. Do we really need to? What skills do I need for tomorrow?
I think CISO of tomorrow is the really the yeah i if if a company does not have a somebody thinking about cyber impact on their business a hundred percent of their time, then they're being negligent. And I think we'll see some of that proving out. So that's what I think the CISO's job ends up being. And then they need implementation and then they need the idea to be able to
you know, appropriate architect protection, but those protections are gonna be different than what they were, yeah, just a few years ago. So I think the basics somewhat change and you know what we look at, what we're gonna see five years from now, we'll be a different environment and we'll be different types of people and will be different basics and different hygiene. And yeah, that's gonna move us to a different lens. But I don't think the position
Jake Bernardes (27:15.309)
Mm.
Tim Brown (27:37.356)
morphs into thinking about the business, thinking about the risks, thinking about it from a cyber risk, and then making sure that we have that risk level at an appropriate level.
Jake Bernardes (27:49.346)
Hm. It's interesting. You you mentioned a couple of things I I'm hearing a lot in the communities and in the kind of chats in various places that I am these days, which is whether the future you talk about the impact on the business and modern CISOs haven't understand that. And do you think that it's going more towards a path where defensibility is almost impossible? Like you talked about the fact that I couldn't I didn't build a program that could defend against the Russian state, like shoot me, right? Like the reality is in you you see in AI world that even script kiddies now can get past some pretty sophisticated defenses.
And then I guess the question becomes, is it now more about resilience, your ability to restore, your ability to understand BCP, your ability to know how to run proper DR? Is that now a more important skill set than it was five years ago, even when we really cared about how do you protect the cloud or the SaaS environment?
Tim Brown (28:34.24)
Right. So I think it's resilience, right? I think when we look at resilience, we look at giving up land, we look at better design. I think a number of the things that, you know, we've been doing for the last thirty years of simplifying environments, I think we actually can embrace a little more complexity to get to resilience. So when we look at, you know, why don't we write micro segment everything? Well, it was too expensive.
cost too much. We didn't understand what it was going to be. So let's make it so a human can understand it. Maybe we don't need to do that anymore. You know, why do we have one identity provider? Because that was easy. Why not have a hundred? Why not completely eliminate lateral movement across these these environments? you know, why don't we all in gre you know embrace military grade, you know, networks and and architecture and design.
and true separation. Well, it was gonna be too expensive and it was gonna take too many people. So anytime we say it's gonna take too many people, I think we have an opportunity to, you know, with AI to potentially do it better. So I think when we look at you know ideal environment from an AI enabled defense capability, I think we have to rethink some of it. So today we're very tactical. tomorrow I think we get strategic and really
Change the shape of what we're doing.
Jake Bernardes (30:04.535)
Which needs a different CISO, right? Many CISOs who are attached and operationally very good aren't strategic thinkers. Like a strategic thinker is a real leader. They to be truly outcome focused, understand like that workflow, that process, more than they actually need to understand, more than they need to understand how Assmbly works. They need to understand like how an attacker might think and what I might have to do if this goes down or if that part breaks or the ephemeral part of this application goes down. It's it's a different skill set for the leader of tomorrow.
Tim Brown (30:30.284)
Yep, it's one I think we have to develop develop well. I mean, the other part is you know, through this I had the privilege of you know, my company was acquired into Symantec early on. And Symantec at that point was all old IBM folks or ex IBM folks. And they had a great executive leadership program. And I got part of that executive leadership program early on in my career.
Jake Bernardes (30:33.121)
Yeah.
Tim Brown (30:58.754)
And that served me really well, especially through a major incident. So I think we do need to scale up ourselves and the CISO community on executive skills. I think, yeah, that's going to be an important one. And then also on architecture, design, and strategic thinking and strategic models versus just all of the operation. Hopefully, AI will take out some of the operational burden so that we can focus more.
the strategic imperatives, I guess, is a good way to put it for the company.
Jake Bernardes (31:35.148)
Interesting. let's click opposite direction. You said that you're on teammates, it's half community, half founder incubator type world. Obviously, like Team8's had some great successes. Every VC's had some great successes in life, but lots of companies don't make it. I guess now that you're in with lots of them advising them, what is the most common mistake that founders are making or what they consistently ignoring? Like, what is the reason that makes some so prolifically successful and some just fall by the wayside?
Tim Brown (32:01.037)
Yeah, so I think a a number of different things. So when you look at first off, do they you know do they know what their their their purpose is? Do they know how crisp and clear their vision is of what they're trying to do? One of the lessons that I always ask is I always have them start at the end. So, people say, I'm gonna build this, I'm gonna build this, it's gonna run here, this is how it's gonna work. I said I don't care. I don't care about any of that. You know, how are you gonna change my world? How are you gonna change what what is your
Jake Bernardes (32:28.631)
Yeah.
Tim Brown (32:30.402)
thing that you're building going to change how I'm I'm working, make me money, save me money, make my day go better, make me happier, give me something that it's going to change my life for, then we can say, and I love it if it's hard. I want it to be a hard problem. If it wasn't hard, everybody would be doing it. So then those types of conversations lead us to things that are truly meaningful.
And then we start having people build. But answer the early question. Start at the end. Give me your marketing pitch. Tell me what what you've done. And I want it to be super cool. And I don't care if it's hard, right? Harder the better. so that's one of the lessons. Sometimes people start too much on the I can, right? I can do this. Well, who cares? Right? So testing the ideas. looking for great feedback, looking for honest feedback.
You know, if you ask somebody, would you rather have this orange or blue? People will give you an answer. They'll say, Well, I'd like it blue. Well, would you buy any more if it was blue? Well, no, of course not, but I'd like it blue. Right? So appropriate questions to people, test with the audience, get a broader group of of people to ask those questions to. So do the homework up front is one of the big ones. And then really
you know, dig into that homework and look for true feedback so that you can figure out that you are truly going to solve something that matters and solve something that's important and yeah, really being able to truly make a difference. If you can do that, then you then it's still really hard. But you know, you you have a shot at, you know, going through, yeah, you're you're going through and becoming a success.
Jake Bernardes (34:22.409)
It it's great that Tim I have a lot of founders that listen because I do a lot with the founder community myself and I I've what you've said is exactly what I've said every time. One is I always say to be an eight year old like my little daughter, like stop thinking about what's possible and start thinking about what you want. Like in an ideal world, like you want a pink unicorn in the garden, right? Fine, we can't there's no unicorns in the world. But like that's what you want, find a way to get there. Like it's the outcome focus and like everyone says I want to understand what CISOs want, but then they go and build stuff without really thinking what we actually want.
Like I want something that you can tell me is gonna solve me this problem. I don't care how you do it, I don't care how hard it is, I this problem solved. And then the second I think you think is the best thing that you've said in the entire thing is that like don't be afraid of the value of feedback. Right. So when people tell you, I don't give a damn if that's that or that, don't focus effort on it. Even if you think that that's the most important thing ever, if your audience says it's not, don't worry about it. But if they say that something really matters to them, listen.
Tim Brown (35:10.764)
You have to Yeah. And you have to remember sometimes they don't know what they need as well. So you have to keep that in mind as well, right? Because you know the the old you know, if you asked somebody what they needed, you know, when the light bulb was invented, they would have said smokeless whale oil, right? so yeah. You have to also realize that that people may be not thinking at the same level of as you are.
Jake Bernardes (35:17.045)
Mm.
Tim Brown (35:39.347)
Do you have have the right people that are going to be thinking strategic enough that what am I looking for? Well, I'm not looking for I'm looking for light, right? okay, light. How can I get light? well, I can, you know, get light by this, you know, new thing called electricity and a light bulb, or I can get light by, you know, smokeless whale oil. And people aren't necessarily all thinking at that same
innovation side. So you sometimes need to bring up people to a a different level in order to get to that answer. So don't always, always, always listen to people, test them and listen to the ones that can truly be strategic for you. And you know, think about the light bulbs, right? And just say, Yeah, I can you know, I can change everything. And
How is a light bulb going to change anything? Well, think all of these things that could happen if we can get powered everywhere in the world. Right? I know it's a big if, but yeah, what look what it did. So yeah, you do so you have to make sure you don't get stuck, because if you get stuck just giving me what I need, you're probably not giving me enough.
Jake Bernardes (36:44.425)
Think beyond the possible. Yeah.
Jake Bernardes (36:54.061)
Tim, let me ask you one final question. You've obviously got to a point in your career where you really seem to you've been passionate about what you do and you love what you do, right? You have said that your experiences changed your outlook on life, they've strengthened your relationships, that you've been able to just see things in different way. but obviously it was an incredibly hard period of life. If you could go back and not make it happen now with the hindsight you've got, would you? Or would you still go through it because of where you are?
Tim Brown (37:22.104)
so I think every experience helps you build, helps you grow. yeah, this one for many reasons, you know, wasn't you know, it didn't suck. It really didn't. So the the lessons that you learn through something are worthwhile. You know, we got more done in the first six months after this incident than you'd ever think it was humanly possible.
yeah, I was I was able to you know accomplish a great things internally. Externally we were able to prove that a company can survive and thrive after an incident. Hugely important. I was able to help the community. So d do I think I would go back and stop it from happening? I don't think so. I think that the the the yeah the the amount of kind of benefit we had going through this, you know, was truly worthwhile.
Yeah, CISO role is young. We're only thirty-five years old, so we're babies. I'm glad this inflection point for the CISO ended up where it was. And I think, yeah, I was put there to to help have that happen and turn out okay. So it was a simple bump for most. And, you know, we're gonna need these bumps to, you know, keep going and protect the world. So yeah, looking back, yeah, it was difficult. no question. But
You know, I don't think I would have tried to, you know, completely stop it from happening. I think it it was an experience that, you know, will last me forever.
Jake Bernardes (38:57.261)
Tim, I've heard you speak at multiple places and I've had the privilege of listening to the things you say. And you speak so elegantly about community and the fact that you went through something which has changed your life and potentially your health forever. and mention the fact of the importance on how it will impact the lives of other CETOs in the future as a credit to who you are as a human being. I think that stands testament to the kind of attitude that you have to life. Thank you so much for the time that you've shared. it's been absolutely my pleasure to get to speak to you about some of the emotional aspects of that Soda Win's time, but also more excitedly,
what you're doing these days and what a CSW in residence actually looks like. anyone who wants to reach out to him, I'm sure he's very easy to find via LinkedIn or various other places, want to learn about the teammate at CISO Village, I'm a member of it. There's a great, huge breadth of knowledge and access to the community there that's really helpful and beneficial to all those people involved. But again, thank you very much for your time. I truly appreciate you being with us.
Tim Brown (39:45.656)
Thanks, Drake. Appreciate it.
Jake Bernardes (39:47.406)
Thanks, man. Speak to soon and speak to you all next time we're here.