WEBVTT
00:00:01.199 --> 00:00:06.240
Welcome to Cyberminded, where cybersecurity, behavior, and leadership meet.
00:00:06.400 --> 00:00:07.040
I'm Dr.
00:00:07.120 --> 00:00:14.960
Dustin Sachs, and this podcast, co-sponsored by CyberCog Labs and Cybersec Media, asks a simple question.
00:00:15.119 --> 00:00:21.199
What if the biggest risks in cybersecurity start with how we think, decide, and respond?
00:00:21.440 --> 00:00:27.199
Each episode is a chance to pause, reflect, and see security through a more human lens.
00:00:27.440 --> 00:00:33.280
Let's take some time and look beyond the controls to the human side of cybersecurity.
00:00:34.000 --> 00:00:40.399
Organizations often respond by adding more controls, more dashboards, and more language around accountability.
00:00:40.560 --> 00:00:41.920
Yet the gap persists.
00:00:42.079 --> 00:00:45.439
The issue is not always that security leaders lack the right tools.
00:00:45.600 --> 00:00:54.560
Often it's that cyber risk is being translated through competing incentives, partial trust, and different assumptions about how work actually gets done.
00:00:54.719 --> 00:01:08.159
So today's overarching question: what changes when we stop treating trust and judgment as soft issues around cybersecurity and start treating them as core operating conditions for whether security works?
00:01:08.319 --> 00:01:13.760
From a behavioral science standpoint, the people don't make security decisions in a vacuum.
00:01:13.840 --> 00:01:20.799
They make them under pressure through relationships and side systems of trust, dealing with ambiguity, fatigue, and business trade-offs.
00:01:20.879 --> 00:01:24.480
And if leaders misread those conditions, they misread the risk.
00:01:24.640 --> 00:01:30.239
That's why the same control can look strong in policy, but still break down in practice.
00:01:30.480 --> 00:01:34.719
And as everybody knows, that's the space this podcast is built to explore.
00:01:34.879 --> 00:01:45.599
Cybersecurity, as we always say, depends on trust tools, policies, and governance, but it also depends on attention, judgment, incentives, trust, communication, and ultimately behavior.
00:01:45.760 --> 00:01:48.079
Welcome to today's episode of Cyberminded.
00:01:48.400 --> 00:02:04.319
So, again, one of the kind of overarching questions we'll be talking about today is how can cybersecurity leaders build programs that do more than enforce controls and instead create the trust, translation, and judgment conditions that make security decisions more likely.
00:02:04.480 --> 00:02:12.000
My guest today is a powerhouse in the industry, Tammy Muskitis, founder and CEO of Psy Alliance.
00:02:12.240 --> 00:02:20.319
Tammy's a cybersecurity executive whose work sits at the intersection of enterprise security leadership, business alignment, and industry trust.
00:02:20.479 --> 00:02:26.479
Her career includes senior leadership roles, spanning Accenture Security, Home Depot, and Time Warner Cable.
00:02:26.560 --> 00:02:44.719
And her public thought leadership has touched machine identity management, leadership development, and the relationship between practitioners, vendors, and the wider business, which makes her an ideal guest for today's conversation on what cyber leadership looks like when we take the human side of security seriously.
00:02:44.960 --> 00:02:46.560
Tammy, welcome to Cyberminded.
00:02:46.800 --> 00:02:47.599
Thanks for having me.
00:02:47.840 --> 00:02:54.080
So before we get into the deeper part of the conversation, I want to start with your perspective on a question that we ask all our guests.
00:02:54.240 --> 00:02:58.479
When you hear the phrase the human side of cybersecurity, what does that mean to you?
00:02:58.560 --> 00:03:01.840
And where do you think the industry still kind of misunderstands it?
00:03:02.000 --> 00:03:09.280
It's funny because when you say the human side of cybersecurity, a lot of people sit there and say, oh, it's immediately identity and access management.
00:03:09.439 --> 00:03:14.159
They instantly think of user IDs and passwords, but it's so much more than that, right?
00:03:14.319 --> 00:03:18.319
It's the ability to make trustworthy decision making.
00:03:18.479 --> 00:03:30.159
It's the ability to be able to understand how we interact, not just professionally, but how we interact with other portions of our organization when we're assessing risk, which is a whole nother problem, right?
00:03:30.319 --> 00:03:34.639
And then there's the human side, which is also there's a piece of identity, right?
00:03:34.800 --> 00:03:39.120
But it encompasses so much more than what the average person would think of.
00:03:39.360 --> 00:03:40.080
Yeah, that's great.
00:03:40.159 --> 00:03:43.680
And it's interesting because in our last episode, we talked with Dr.
00:03:43.759 --> 00:03:50.080
Calvin Nobles and he mentioned the fact that this question of what does the human side of cybersecurity mean to you.
00:03:50.240 --> 00:03:56.080
He did some research and found that he interviewed a hundred people and got 17 different answers.
00:03:56.319 --> 00:04:14.400
And so far we've done this, will be our third episode, and we've gotten three different answers to this question, which is awesome and really exciting because it really shows the kind of what the fact that when you add humans to the mix, it changes perspectives and that perspectives are important.
00:04:14.560 --> 00:04:20.079
So, Tammy, the topic for today is cyber leadership through the lens of trust and translation.
00:04:20.160 --> 00:04:28.879
And I want to start with the distinction of that because many organizations still treat this as a tooling problem or a compliance problem first.
00:04:29.040 --> 00:04:38.879
So, when does it become clear that a cyber issue is not really about technology, but about whether the security team and the business are interpreting risk through the same lens?
00:04:39.120 --> 00:04:58.399
When you're looking at it from a holistic perspective and they look at organizations have controls and frameworks and dashboards and all those things that they still make poor decisions, but because leaders operate from inconsistent interpretations, so weak translations between teams, low confidence levels, information being presented.
00:04:58.560 --> 00:05:05.040
So the distinction the leaders really need to understand is do we have protections, policies, processes, technologies in place?
00:05:05.199 --> 00:05:14.240
And then from a trustworthy decision making, the answer is going to be can leadership reliably understand reality well enough to make sound risk decisions?
00:05:14.399 --> 00:05:27.759
So I know that was a lot of words, but but when you look at it from that perspective, it gives you, it gives that that appreciation that mature security organizations should evaluate things on multiple different levels to be successful.
00:05:28.000 --> 00:05:28.240
Yeah.
00:05:28.319 --> 00:05:33.600
So where do leaders often misdiagnose a trust problem as a process problem?
00:05:33.920 --> 00:05:34.399
Always.
00:05:35.040 --> 00:05:36.800
It just made me laugh thinking about it.
00:05:37.040 --> 00:05:42.720
As you can probably tell, these aren't scripted, so I have to think about answers sometimes to D all of the above.
00:05:42.879 --> 00:05:54.160
I think that when you think about a trust problem versus a translation and whether controls operate effectively, whether truth travels accurately, right?
00:05:54.480 --> 00:05:58.079
Can the uncertainty be voiced in a safe manner, right?
00:05:58.240 --> 00:06:03.439
And then it turns into whether the leadership can actually interpret and remain coherent, right?
00:06:03.680 --> 00:06:11.279
And whether across multiple layers to make sure that it's is it processed can't permanently compensate for weak trust, right?
00:06:11.439 --> 00:06:12.319
It just can't, right?
00:06:12.560 --> 00:06:18.639
So leaders really need to predict organizational behavior around how they respond to the process.
00:06:18.800 --> 00:06:25.199
So whether the people trust the institution, right, to surface here's reality and here's the damage that could occur.
00:06:25.360 --> 00:06:27.920
Those are the distinctions I think they need to understand.
00:06:28.160 --> 00:06:35.759
Yeah, and one of the things that I hear in what you're saying is that security breaks down long before a control picnically fails.
00:06:35.839 --> 00:06:41.600
It breaks down when people no longer share the assumptions about the urgency or ownership or trade-offs.
00:06:41.680 --> 00:06:51.439
Everybody points fingers at each other, no one wants to be left holding the potato when the incident happens, and they'll turn to their dashboards, but their dashboards aren't going to reveal any of that.
00:06:51.600 --> 00:06:53.600
So lack of complete visibility.
00:06:53.680 --> 00:06:54.720
There's nothing there, right?
00:06:54.800 --> 00:06:57.199
Leaders don't trust the underlying data anyway, right?
00:06:57.519 --> 00:06:59.360
The dashboard is a dashboard, right?
00:06:59.600 --> 00:06:59.920
Exactly.
00:07:00.079 --> 00:07:04.079
So you've worked across enterprise leadership in the broader cyber ecosystem.
00:07:04.240 --> 00:07:13.120
What if those vantage points taught you about the gap between what practitioners need, what executives hear, and what outside partners think they're solving?
00:07:13.360 --> 00:07:14.000
Yeah, it's funny.
00:07:14.079 --> 00:07:17.759
So when you think about the translation gap, which is one of my favorite things, right?
00:07:17.839 --> 00:07:20.480
I always put it into operational blind spot, right?
00:07:20.639 --> 00:07:25.759
So security says, oh my gosh, we have a critical vulnerability, danger, whatever.
00:07:26.000 --> 00:07:29.680
Then operations here is a maintenance, inconvenience, problems.
00:07:30.079 --> 00:07:32.319
We have a problem, we gotta make a maintenance window.
00:07:32.399 --> 00:07:37.199
And then the same translation gap around that same communication is executive says it's handled.
00:07:37.279 --> 00:07:38.720
I don't have to worry about it, right?
00:07:38.879 --> 00:07:41.040
And then the board hears, oh, it's low risk.
00:07:41.279 --> 00:07:43.360
Hey, we got these dashboards, everything else.
00:07:43.519 --> 00:07:48.480
And then all of a sudden you have the same issue, four different realities about what's going on.
00:07:48.639 --> 00:07:51.839
When in fact the escalation clarity is unknown, right?
00:07:52.000 --> 00:07:54.000
So everybody is just like, it's okay.
00:07:54.240 --> 00:07:56.480
Oh, we spilled grape juice on the carpet, it's okay.
00:07:56.639 --> 00:07:58.079
That kind of commercial kind of a thing.
00:07:58.240 --> 00:08:02.959
But in the governance perspective, it could be a failure, but it's not necessarily a tooling favor.
00:08:03.199 --> 00:08:11.040
So the way that I feel that organizations kind of need to meet through this, controls can exist, but everybody uh risk in a very different way.
00:08:11.120 --> 00:08:13.759
It's just depending on the different audience.
00:08:14.079 --> 00:08:19.120
Before we go further, this episode is supported by Cybercog Labs.
00:08:19.279 --> 00:08:29.439
At CyberCog Labs, we help cybersecurity and risk leaders look beyond control design to understand where human behavior is shaping cyber risk.
00:08:29.680 --> 00:08:43.519
Because the issue is not that a control does not exist, it's that the control breaks down when real people encounter pressure, ambiguity, competing priorities, unclear incentives, or decision fatigue.
00:08:52.720 --> 00:08:55.279
Visit us at cybercog.com.
00:08:55.600 --> 00:09:00.879
That's P-S Y B-E-R-C-O-G.com.
00:09:01.200 --> 00:09:05.600
Now, with that in mind, let's get into the problem beneath the problem.
00:09:05.840 --> 00:09:09.440
Yeah, it depends on the perspective that you're coming from and what your outcome is.
00:09:09.679 --> 00:09:12.960
The board of directors, they're all worried about share their value.
00:09:13.200 --> 00:09:16.879
The CEO and CFO are worried about bottom line numbers.
00:09:17.120 --> 00:09:22.799
So you've got all of these competing interests and getting them to align is important.
00:09:22.879 --> 00:09:28.159
And that's where this idea of having a system of trust amongst everybody is so important.
00:09:28.399 --> 00:09:30.960
Of trust as part of the operating environment.
00:09:31.200 --> 00:09:36.879
What conditions make secure behavior and good judgment harder than leaders might assume?
00:09:37.120 --> 00:09:40.320
I think a little bit is around how they take a look at it, right?
00:09:40.480 --> 00:09:53.200
So when you're measuring alignment versus compliance, the different leadership layers are going to assess things as a cyber risk, but they're not going to understand the severity, the readiness, all the other things, and most importantly, the business impact.
00:09:53.679 --> 00:09:53.919
Right.
00:09:54.080 --> 00:10:01.200
So I think that what happens is they focus on escalation integrity and measure confidence versus evidence.
00:10:01.360 --> 00:10:04.159
I think that the governance acknowledges that uncertainty.
00:10:04.320 --> 00:10:08.559
So the judgment, the security capability is a more of a win, right?
00:10:08.720 --> 00:10:13.840
They don't trust based off of mature, fine controls, right?
00:10:14.000 --> 00:10:19.360
But in addition to the organization's ability to understand accurately, especially when it's under pressure.
00:10:19.600 --> 00:10:40.000
The one kind of theme I think I hear in this first part of the conversation is that cyber performance is shaped not only by controls, but by whether people trust the signals, whether they understand the context, and ultimately whether they believe that security choices make sense inside their day-to-day and their perspective on things.
00:10:40.240 --> 00:10:44.799
So I want to move from the conceptual distinctions to what leaders can actually do.
00:10:44.960 --> 00:10:56.639
So most organizations, as we talk about on the show all the time, is most organizations can measure training completion, they can measure the ticket volume, they can measure control coverage, they can even measure audit.
00:10:56.799 --> 00:11:04.480
But those metrics don't tell whether or not there's decision quality trust or whether operating resilience is really improving.
00:11:04.559 --> 00:11:17.519
So, what should a CISO or a risk leader or board-facing security executive measure differently if they want to know whether the organization is getting better at cyber judgment, not just busier with more cyber activity?
00:11:17.840 --> 00:11:18.399
Telling me.
00:11:22.720 --> 00:11:29.279
What I mean about that, like I said, is not just the severity, but how they move that information upward and across channels.
00:11:29.440 --> 00:11:34.399
I think if we measure those pieces, they should evaluate whether controls operate effectively.
00:11:34.639 --> 00:11:37.039
Trying to think of some good ways of going through that.
00:11:37.200 --> 00:11:40.399
I guess process problems is a good way of for reporting, right?
00:11:40.559 --> 00:11:46.240
Is delayed escalations, anything around the governance, around those excessive uplayers.
00:11:46.399 --> 00:11:47.440
I'm just trying to think of good ways.
00:11:47.759 --> 00:11:49.600
Yeah, no, those are all really great.
00:11:49.679 --> 00:11:52.240
And so I'll come at this a little bit differently.
00:11:52.320 --> 00:11:53.679
I'm going to hand you a magic wand.
00:11:53.759 --> 00:12:06.320
And what is one leadership behavior or governance routine or reporting question that you would wave your wand and magic and materially improve how the business and the security function make decisions together?
00:12:06.559 --> 00:12:08.320
I wish that they just were coherent.
00:12:08.399 --> 00:12:12.480
That actually We all are you talking English and I'm talking French?
00:12:12.639 --> 00:12:13.039
Like, yeah.
00:12:13.279 --> 00:12:17.360
Yeah, some people are talking just still ones and zeros, and people just don't get that, right?
00:12:17.519 --> 00:12:24.000
So I think of whether people trust the institution enough to surface whether reality is really there before damage occurs.
00:12:24.159 --> 00:12:31.919
I think that judgment is a security capability that in the cyberspace that it's not defined by technical controls, right?
00:12:32.000 --> 00:12:34.879
It's really about the organization being able to understand reality.
00:12:35.120 --> 00:12:57.440
Yeah, and I think the practical synthesis of all of this is that leaders need to stop using the fact that we've done something or we've taken some action or whatever as a proxy for I'm confident that we're secure, because better governance, better outcomes really come from how decisions are made, where the translation, as you've said, is breaking down.
00:12:57.519 --> 00:13:04.480
And as you've said, whether the organization can surface friction safely before that friction causes risk.
00:13:04.720 --> 00:13:06.720
And you look at excessive governance, right?
00:13:06.960 --> 00:13:16.639
You just mentioned that when decisions slow down, leaders said, Oh, let's add steering committees, let's add additional levels of approval, let's do risk sign-offs, let's do this.
00:13:16.799 --> 00:13:20.559
And it just compensates for low trust and a judgment of quality.
00:13:20.720 --> 00:13:24.960
So you're looking at it like a healthy organization should be able to distribute that authority.
00:13:25.120 --> 00:13:26.799
You don't want low trust, right?
00:13:26.879 --> 00:13:31.600
You want good, sound judgment and adding excessive layers of governance.
00:13:31.759 --> 00:13:47.840
It's just Yeah, the last thing you want when it when an alert comes in or when there's an incident is the analyst saying, I'm sorry, I gotta go talk to my manager who's gonna have to talk to his manager, who's gonna have to talk to his manager, who's gonna have to talk to his manager to then have a meeting to figure out what we're gonna do.
00:13:48.000 --> 00:13:56.480
You've gotta be able to move and you've got to have that trust and that belief that your team is going to operate at the peak of efficiency.
00:13:56.559 --> 00:13:59.279
And that's why we do things like tabletop exercises.
00:13:59.440 --> 00:14:18.080
It's why we train our people, but it's also why we build the systems so that when an incident occurs, there's already a support system, a safety net, a way to approach things that everybody knows so that it makes it easier to make that decision in that time of increased pressure and stress.
00:14:18.320 --> 00:14:18.799
Yeah, and right.
00:14:19.200 --> 00:14:19.759
I'm sorry, go ahead.
00:14:20.320 --> 00:14:22.559
Go ahead, please talk about the governance a little bit more.
00:14:22.720 --> 00:14:28.399
I think what they're saying is around the alignment across the leadership layers has always become the problem, right?
00:14:28.480 --> 00:14:29.440
Oh, I can't do that.
00:14:29.519 --> 00:14:35.039
And I think that from a good leadership, a good executive will empower their staff to do their job, right?
00:14:35.200 --> 00:14:36.639
And make quality decisions.
00:14:36.720 --> 00:14:40.000
And just like you said, we all do tabletop exercises, right?
00:14:40.240 --> 00:14:42.080
But we have to trust the authority.
00:14:42.240 --> 00:14:49.360
And although there are some boundaries, right, you gotta make sure that these people don't have any fear and political consequence, right?
00:14:49.440 --> 00:14:50.399
I'm doing my job.
00:14:50.559 --> 00:14:55.919
They have to ensure that their leadership are saying, hey, I'm giving you the confidence to go ahead and get this done, right?
00:14:56.000 --> 00:14:59.919
Because what you see all the time is that decision latency is gonna kill you, right?
00:15:00.080 --> 00:15:04.159
Especially if there's something that's basically you've kicked up a war room or whatever you want to say.
00:15:04.240 --> 00:15:07.039
But confidence versus evidence tracking is crazy.
00:15:07.200 --> 00:15:07.759
Go, right?
00:15:07.840 --> 00:15:09.600
We'll have mistakes after the incident.
00:15:09.759 --> 00:15:10.320
We gotta move.
00:15:10.559 --> 00:15:15.519
There's a viable reason why there's a whole lessons learned section at the end of an incident, you know.
00:15:16.320 --> 00:15:17.279
We call it post-mortem.
00:15:17.360 --> 00:15:19.039
Some people call them most incidents, post-incident.
00:15:19.200 --> 00:15:22.720
Now we used to call them post-mortems, but people didn't like the word mortem at the end.
00:15:23.200 --> 00:15:23.919
Yeah, yeah.
00:15:24.080 --> 00:15:33.279
We have some, we that's a whole separate conversation about the language we use in cybersecurity that I've talked about before, but that could be a whole episode in and of itself.
00:15:33.519 --> 00:15:41.519
Given everything we've discussed about trust leadership and cyber judgment, I want to close with the question that we ask every guest on Cyberminded.
00:15:41.679 --> 00:15:47.120
What's one place where the cybersecurity field needs to slow down and think more carefully?
00:15:47.360 --> 00:15:51.120
I was thinking about this because I do listen to what you're talking about.
00:15:51.279 --> 00:16:01.919
I think what people need to focus on from a security perspective is focus less on probably the measure of confidence levels around versus evidence.
00:16:02.000 --> 00:16:06.080
So making sure that you have strong governance that acknowledges uncertainty, right?
00:16:06.159 --> 00:16:12.720
And adds that uncertainty into projects and makes sure the organizational agility is you're able to move fluently.
00:16:12.879 --> 00:16:16.080
But I also want to add that it's really important to have trust.
00:16:16.240 --> 00:16:18.559
And trust is up, down, and backwards, right?
00:16:18.720 --> 00:16:23.440
Trust in your leadership, trust in your staff, trust in your policies and procedures internally.
00:16:23.519 --> 00:16:34.080
And because without that, you're not gonna succeed in any Yeah, and it's really about figuring out when we always talk about this concept of thinking fast and slow, the Daniel Kahneman phrase.
00:16:34.159 --> 00:16:38.159
And there are times where it's perfectly appropriate to think fast.
00:16:38.320 --> 00:16:42.639
If there's a fire in your house, thinking fast is probably an important thing.
00:16:42.799 --> 00:16:59.200
But when you're trying to make a decision that's going to impact the viability of your organization or an incident, or should we pay a ransom, maybe slowing down and thinking about it, but also having that level of trust and having those systems in place is super important.
00:17:00.080 --> 00:17:00.480
You're right.
00:17:00.559 --> 00:17:03.360
Many process problems are actually trust problems and things.
00:17:03.440 --> 00:17:06.079
So delayed isolation, softened reporting, all that.
00:17:06.319 --> 00:17:14.240
I think all of that excessive governance we talked about, dashboard overload, all of that just indicates low trust in an organization on information flow.
00:17:14.319 --> 00:17:15.680
It's not really a lack process.
00:17:15.759 --> 00:17:21.599
So I think leaders kind of need to think differently across the layers, but because you're all assessing the same risks, right?
00:17:21.680 --> 00:17:24.480
We just kind of do the severity and the readiness a little bit differently.
00:17:24.720 --> 00:17:27.119
Yeah, couldn't have summed it up better myself.
00:17:27.359 --> 00:17:35.680
Today's conversation really challenged the assumption that cybersecurity effectiveness can be read directly from controls or maturity language.
00:17:35.839 --> 00:17:44.720
Tammy, you've helped us examine the role trust, translation, and leadership judgment play in whether security decisions actually hold up in the real world.
00:17:44.960 --> 00:17:50.480
As we always talk about, the human side of cybersecurity is not just about awareness or user behavior.
00:17:50.559 --> 00:17:57.519
It's about or how organizations shape judgment, incentives, communication, and confidence around risk.
00:17:57.680 --> 00:18:06.559
So my thanks to you, Tammy, for joining the conversation and to CyberCog Labs and Cybersec Media for supporting the show as we end every episode.
00:18:06.640 --> 00:18:11.599
Until next time, look beyond the controls and pay attention to the human side of cybersecurity.
00:18:11.680 --> 00:18:12.880
Thanks, everyone.
00:00:01.199 --> 00:00:06.240
Welcome to Cyberminded, where cybersecurity, behavior, and leadership meet.
00:00:06.400 --> 00:00:07.040
I'm Dr.
00:00:07.120 --> 00:00:14.960
Dustin Sachs, and this podcast, co-sponsored by CyberCog Labs and Cybersec Media, asks a simple question.
00:00:15.119 --> 00:00:21.199
What if the biggest risks in cybersecurity start with how we think, decide, and respond?
00:00:21.440 --> 00:00:27.199
Each episode is a chance to pause, reflect, and see security through a more human lens.
00:00:27.440 --> 00:00:33.280
Let's take some time and look beyond the controls to the human side of cybersecurity.
00:00:34.000 --> 00:00:40.399
Organizations often respond by adding more controls, more dashboards, and more language around accountability.
00:00:40.560 --> 00:00:41.920
Yet the gap persists.
00:00:42.079 --> 00:00:45.439
The issue is not always that security leaders lack the right tools.
00:00:45.600 --> 00:00:54.560
Often it's that cyber risk is being translated through competing incentives, partial trust, and different assumptions about how work actually gets done.
00:00:54.719 --> 00:01:08.159
So today's overarching question: what changes when we stop treating trust and judgment as soft issues around cybersecurity and start treating them as core operating conditions for whether security works?
00:01:08.319 --> 00:01:13.760
From a behavioral science standpoint, the people don't make security decisions in a vacuum.
00:01:13.840 --> 00:01:20.799
They make them under pressure through relationships and side systems of trust, dealing with ambiguity, fatigue, and business trade-offs.
00:01:20.879 --> 00:01:24.480
And if leaders misread those conditions, they misread the risk.
00:01:24.640 --> 00:01:30.239
That's why the same control can look strong in policy, but still break down in practice.
00:01:30.480 --> 00:01:34.719
And as everybody knows, that's the space this podcast is built to explore.
00:01:34.879 --> 00:01:45.599
Cybersecurity, as we always say, depends on trust tools, policies, and governance, but it also depends on attention, judgment, incentives, trust, communication, and ultimately behavior.
00:01:45.760 --> 00:01:48.079
Welcome to today's episode of Cyberminded.
00:01:48.400 --> 00:02:04.319
So, again, one of the kind of overarching questions we'll be talking about today is how can cybersecurity leaders build programs that do more than enforce controls and instead create the trust, translation, and judgment conditions that make security decisions more likely.
00:02:04.480 --> 00:02:12.000
My guest today is a powerhouse in the industry, Tammy Muskitis, founder and CEO of Psy Alliance.
00:02:12.240 --> 00:02:20.319
Tammy's a cybersecurity executive whose work sits at the intersection of enterprise security leadership, business alignment, and industry trust.
00:02:20.479 --> 00:02:26.479
Her career includes senior leadership roles, spanning Accenture Security, Home Depot, and Time Warner Cable.
00:02:26.560 --> 00:02:44.719
And her public thought leadership has touched machine identity management, leadership development, and the relationship between practitioners, vendors, and the wider business, which makes her an ideal guest for today's conversation on what cyber leadership looks like when we take the human side of security seriously.
00:02:44.960 --> 00:02:46.560
Tammy, welcome to Cyberminded.
00:02:46.800 --> 00:02:47.599
Thanks for having me.
00:02:47.840 --> 00:02:54.080
So before we get into the deeper part of the conversation, I want to start with your perspective on a question that we ask all our guests.
00:02:54.240 --> 00:02:58.479
When you hear the phrase the human side of cybersecurity, what does that mean to you?
00:02:58.560 --> 00:03:01.840
And where do you think the industry still kind of misunderstands it?
00:03:02.000 --> 00:03:09.280
It's funny because when you say the human side of cybersecurity, a lot of people sit there and say, oh, it's immediately identity and access management.
00:03:09.439 --> 00:03:14.159
They instantly think of user IDs and passwords, but it's so much more than that, right?
00:03:14.319 --> 00:03:18.319
It's the ability to make trustworthy decision making.
00:03:18.479 --> 00:03:30.159
It's the ability to be able to understand how we interact, not just professionally, but how we interact with other portions of our organization when we're assessing risk, which is a whole nother problem, right?
00:03:30.319 --> 00:03:34.639
And then there's the human side, which is also there's a piece of identity, right?
00:03:34.800 --> 00:03:39.120
But it encompasses so much more than what the average person would think of.
00:03:39.360 --> 00:03:40.080
Yeah, that's great.
00:03:40.159 --> 00:03:43.680
And it's interesting because in our last episode, we talked with Dr.
00:03:43.759 --> 00:03:50.080
Calvin Nobles and he mentioned the fact that this question of what does the human side of cybersecurity mean to you.
00:03:50.240 --> 00:03:56.080
He did some research and found that he interviewed a hundred people and got 17 different answers.
00:03:56.319 --> 00:04:14.400
And so far we've done this, will be our third episode, and we've gotten three different answers to this question, which is awesome and really exciting because it really shows the kind of what the fact that when you add humans to the mix, it changes perspectives and that perspectives are important.
00:04:14.560 --> 00:04:20.079
So, Tammy, the topic for today is cyber leadership through the lens of trust and translation.
00:04:20.160 --> 00:04:28.879
And I want to start with the distinction of that because many organizations still treat this as a tooling problem or a compliance problem first.
00:04:29.040 --> 00:04:38.879
So, when does it become clear that a cyber issue is not really about technology, but about whether the security team and the business are interpreting risk through the same lens?
00:04:39.120 --> 00:04:58.399
When you're looking at it from a holistic perspective and they look at organizations have controls and frameworks and dashboards and all those things that they still make poor decisions, but because leaders operate from inconsistent interpretations, so weak translations between teams, low confidence levels, information being presented.
00:04:58.560 --> 00:05:05.040
So the distinction the leaders really need to understand is do we have protections, policies, processes, technologies in place?
00:05:05.199 --> 00:05:14.240
And then from a trustworthy decision making, the answer is going to be can leadership reliably understand reality well enough to make sound risk decisions?
00:05:14.399 --> 00:05:27.759
So I know that was a lot of words, but but when you look at it from that perspective, it gives you, it gives that that appreciation that mature security organizations should evaluate things on multiple different levels to be successful.
00:05:28.000 --> 00:05:28.240
Yeah.
00:05:28.319 --> 00:05:33.600
So where do leaders often misdiagnose a trust problem as a process problem?
00:05:33.920 --> 00:05:34.399
Always.
00:05:35.040 --> 00:05:36.800
It just made me laugh thinking about it.
00:05:37.040 --> 00:05:42.720
As you can probably tell, these aren't scripted, so I have to think about answers sometimes to D all of the above.
00:05:42.879 --> 00:05:54.160
I think that when you think about a trust problem versus a translation and whether controls operate effectively, whether truth travels accurately, right?
00:05:54.480 --> 00:05:58.079
Can the uncertainty be voiced in a safe manner, right?
00:05:58.240 --> 00:06:03.439
And then it turns into whether the leadership can actually interpret and remain coherent, right?
00:06:03.680 --> 00:06:11.279
And whether across multiple layers to make sure that it's is it processed can't permanently compensate for weak trust, right?
00:06:11.439 --> 00:06:12.319
It just can't, right?
00:06:12.560 --> 00:06:18.639
So leaders really need to predict organizational behavior around how they respond to the process.
00:06:18.800 --> 00:06:25.199
So whether the people trust the institution, right, to surface here's reality and here's the damage that could occur.
00:06:25.360 --> 00:06:27.920
Those are the distinctions I think they need to understand.
00:06:28.160 --> 00:06:35.759
Yeah, and one of the things that I hear in what you're saying is that security breaks down long before a control picnically fails.
00:06:35.839 --> 00:06:41.600
It breaks down when people no longer share the assumptions about the urgency or ownership or trade-offs.
00:06:41.680 --> 00:06:51.439
Everybody points fingers at each other, no one wants to be left holding the potato when the incident happens, and they'll turn to their dashboards, but their dashboards aren't going to reveal any of that.
00:06:51.600 --> 00:06:53.600
So lack of complete visibility.
00:06:53.680 --> 00:06:54.720
There's nothing there, right?
00:06:54.800 --> 00:06:57.199
Leaders don't trust the underlying data anyway, right?
00:06:57.519 --> 00:06:59.360
The dashboard is a dashboard, right?
00:06:59.600 --> 00:06:59.920
Exactly.
00:07:00.079 --> 00:07:04.079
So you've worked across enterprise leadership in the broader cyber ecosystem.
00:07:04.240 --> 00:07:13.120
What if those vantage points taught you about the gap between what practitioners need, what executives hear, and what outside partners think they're solving?
00:07:13.360 --> 00:07:14.000
Yeah, it's funny.
00:07:14.079 --> 00:07:17.759
So when you think about the translation gap, which is one of my favorite things, right?
00:07:17.839 --> 00:07:20.480
I always put it into operational blind spot, right?
00:07:20.639 --> 00:07:25.759
So security says, oh my gosh, we have a critical vulnerability, danger, whatever.
00:07:26.000 --> 00:07:29.680
Then operations here is a maintenance, inconvenience, problems.
00:07:30.079 --> 00:07:32.319
We have a problem, we gotta make a maintenance window.
00:07:32.399 --> 00:07:37.199
And then the same translation gap around that same communication is executive says it's handled.
00:07:37.279 --> 00:07:38.720
I don't have to worry about it, right?
00:07:38.879 --> 00:07:41.040
And then the board hears, oh, it's low risk.
00:07:41.279 --> 00:07:43.360
Hey, we got these dashboards, everything else.
00:07:43.519 --> 00:07:48.480
And then all of a sudden you have the same issue, four different realities about what's going on.
00:07:48.639 --> 00:07:51.839
When in fact the escalation clarity is unknown, right?
00:07:52.000 --> 00:07:54.000
So everybody is just like, it's okay.
00:07:54.240 --> 00:07:56.480
Oh, we spilled grape juice on the carpet, it's okay.
00:07:56.639 --> 00:07:58.079
That kind of commercial kind of a thing.
00:07:58.240 --> 00:08:02.959
But in the governance perspective, it could be a failure, but it's not necessarily a tooling favor.
00:08:03.199 --> 00:08:11.040
So the way that I feel that organizations kind of need to meet through this, controls can exist, but everybody uh risk in a very different way.
00:08:11.120 --> 00:08:13.759
It's just depending on the different audience.
00:08:14.079 --> 00:08:19.120
Before we go further, this episode is supported by Cybercog Labs.
00:08:19.279 --> 00:08:29.439
At CyberCog Labs, we help cybersecurity and risk leaders look beyond control design to understand where human behavior is shaping cyber risk.
00:08:29.680 --> 00:08:43.519
Because the issue is not that a control does not exist, it's that the control breaks down when real people encounter pressure, ambiguity, competing priorities, unclear incentives, or decision fatigue.
00:08:52.720 --> 00:08:55.279
Visit us at cybercog.com.
00:08:55.600 --> 00:09:00.879
That's P-S Y B-E-R-C-O-G.com.
00:09:01.200 --> 00:09:05.600
Now, with that in mind, let's get into the problem beneath the problem.
00:09:05.840 --> 00:09:09.440
Yeah, it depends on the perspective that you're coming from and what your outcome is.
00:09:09.679 --> 00:09:12.960
The board of directors, they're all worried about share their value.
00:09:13.200 --> 00:09:16.879
The CEO and CFO are worried about bottom line numbers.
00:09:17.120 --> 00:09:22.799
So you've got all of these competing interests and getting them to align is important.
00:09:22.879 --> 00:09:28.159
And that's where this idea of having a system of trust amongst everybody is so important.
00:09:28.399 --> 00:09:30.960
Of trust as part of the operating environment.
00:09:31.200 --> 00:09:36.879
What conditions make secure behavior and good judgment harder than leaders might assume?
00:09:37.120 --> 00:09:40.320
I think a little bit is around how they take a look at it, right?
00:09:40.480 --> 00:09:53.200
So when you're measuring alignment versus compliance, the different leadership layers are going to assess things as a cyber risk, but they're not going to understand the severity, the readiness, all the other things, and most importantly, the business impact.
00:09:53.679 --> 00:09:53.919
Right.
00:09:54.080 --> 00:10:01.200
So I think that what happens is they focus on escalation integrity and measure confidence versus evidence.
00:10:01.360 --> 00:10:04.159
I think that the governance acknowledges that uncertainty.
00:10:04.320 --> 00:10:08.559
So the judgment, the security capability is a more of a win, right?
00:10:08.720 --> 00:10:13.840
They don't trust based off of mature, fine controls, right?
00:10:14.000 --> 00:10:19.360
But in addition to the organization's ability to understand accurately, especially when it's under pressure.
00:10:19.600 --> 00:10:40.000
The one kind of theme I think I hear in this first part of the conversation is that cyber performance is shaped not only by controls, but by whether people trust the signals, whether they understand the context, and ultimately whether they believe that security choices make sense inside their day-to-day and their perspective on things.
00:10:40.240 --> 00:10:44.799
So I want to move from the conceptual distinctions to what leaders can actually do.
00:10:44.960 --> 00:10:56.639
So most organizations, as we talk about on the show all the time, is most organizations can measure training completion, they can measure the ticket volume, they can measure control coverage, they can even measure audit.
00:10:56.799 --> 00:11:04.480
But those metrics don't tell whether or not there's decision quality trust or whether operating resilience is really improving.
00:11:04.559 --> 00:11:17.519
So, what should a CISO or a risk leader or board-facing security executive measure differently if they want to know whether the organization is getting better at cyber judgment, not just busier with more cyber activity?
00:11:17.840 --> 00:11:18.399
Telling me.
00:11:22.720 --> 00:11:29.279
What I mean about that, like I said, is not just the severity, but how they move that information upward and across channels.
00:11:29.440 --> 00:11:34.399
I think if we measure those pieces, they should evaluate whether controls operate effectively.
00:11:34.639 --> 00:11:37.039
Trying to think of some good ways of going through that.
00:11:37.200 --> 00:11:40.399
I guess process problems is a good way of for reporting, right?
00:11:40.559 --> 00:11:46.240
Is delayed escalations, anything around the governance, around those excessive uplayers.
00:11:46.399 --> 00:11:47.440
I'm just trying to think of good ways.
00:11:47.759 --> 00:11:49.600
Yeah, no, those are all really great.
00:11:49.679 --> 00:11:52.240
And so I'll come at this a little bit differently.
00:11:52.320 --> 00:11:53.679
I'm going to hand you a magic wand.
00:11:53.759 --> 00:12:06.320
And what is one leadership behavior or governance routine or reporting question that you would wave your wand and magic and materially improve how the business and the security function make decisions together?
00:12:06.559 --> 00:12:08.320
I wish that they just were coherent.
00:12:08.399 --> 00:12:12.480
That actually We all are you talking English and I'm talking French?
00:12:12.639 --> 00:12:13.039
Like, yeah.
00:12:13.279 --> 00:12:17.360
Yeah, some people are talking just still ones and zeros, and people just don't get that, right?
00:12:17.519 --> 00:12:24.000
So I think of whether people trust the institution enough to surface whether reality is really there before damage occurs.
00:12:24.159 --> 00:12:31.919
I think that judgment is a security capability that in the cyberspace that it's not defined by technical controls, right?
00:12:32.000 --> 00:12:34.879
It's really about the organization being able to understand reality.
00:12:35.120 --> 00:12:57.440
Yeah, and I think the practical synthesis of all of this is that leaders need to stop using the fact that we've done something or we've taken some action or whatever as a proxy for I'm confident that we're secure, because better governance, better outcomes really come from how decisions are made, where the translation, as you've said, is breaking down.
00:12:57.519 --> 00:13:04.480
And as you've said, whether the organization can surface friction safely before that friction causes risk.
00:13:04.720 --> 00:13:06.720
And you look at excessive governance, right?
00:13:06.960 --> 00:13:16.639
You just mentioned that when decisions slow down, leaders said, Oh, let's add steering committees, let's add additional levels of approval, let's do risk sign-offs, let's do this.
00:13:16.799 --> 00:13:20.559
And it just compensates for low trust and a judgment of quality.
00:13:20.720 --> 00:13:24.960
So you're looking at it like a healthy organization should be able to distribute that authority.
00:13:25.120 --> 00:13:26.799
You don't want low trust, right?
00:13:26.879 --> 00:13:31.600
You want good, sound judgment and adding excessive layers of governance.
00:13:31.759 --> 00:13:47.840
It's just Yeah, the last thing you want when it when an alert comes in or when there's an incident is the analyst saying, I'm sorry, I gotta go talk to my manager who's gonna have to talk to his manager, who's gonna have to talk to his manager, who's gonna have to talk to his manager to then have a meeting to figure out what we're gonna do.
00:13:48.000 --> 00:13:56.480
You've gotta be able to move and you've got to have that trust and that belief that your team is going to operate at the peak of efficiency.
00:13:56.559 --> 00:13:59.279
And that's why we do things like tabletop exercises.
00:13:59.440 --> 00:14:18.080
It's why we train our people, but it's also why we build the systems so that when an incident occurs, there's already a support system, a safety net, a way to approach things that everybody knows so that it makes it easier to make that decision in that time of increased pressure and stress.
00:14:18.320 --> 00:14:18.799
Yeah, and right.
00:14:19.200 --> 00:14:19.759
I'm sorry, go ahead.
00:14:20.320 --> 00:14:22.559
Go ahead, please talk about the governance a little bit more.
00:14:22.720 --> 00:14:28.399
I think what they're saying is around the alignment across the leadership layers has always become the problem, right?
00:14:28.480 --> 00:14:29.440
Oh, I can't do that.
00:14:29.519 --> 00:14:35.039
And I think that from a good leadership, a good executive will empower their staff to do their job, right?
00:14:35.200 --> 00:14:36.639
And make quality decisions.
00:14:36.720 --> 00:14:40.000
And just like you said, we all do tabletop exercises, right?
00:14:40.240 --> 00:14:42.080
But we have to trust the authority.
00:14:42.240 --> 00:14:49.360
And although there are some boundaries, right, you gotta make sure that these people don't have any fear and political consequence, right?
00:14:49.440 --> 00:14:50.399
I'm doing my job.
00:14:50.559 --> 00:14:55.919
They have to ensure that their leadership are saying, hey, I'm giving you the confidence to go ahead and get this done, right?
00:14:56.000 --> 00:14:59.919
Because what you see all the time is that decision latency is gonna kill you, right?
00:15:00.080 --> 00:15:04.159
Especially if there's something that's basically you've kicked up a war room or whatever you want to say.
00:15:04.240 --> 00:15:07.039
But confidence versus evidence tracking is crazy.
00:15:07.200 --> 00:15:07.759
Go, right?
00:15:07.840 --> 00:15:09.600
We'll have mistakes after the incident.
00:15:09.759 --> 00:15:10.320
We gotta move.
00:15:10.559 --> 00:15:15.519
There's a viable reason why there's a whole lessons learned section at the end of an incident, you know.
00:15:16.320 --> 00:15:17.279
We call it post-mortem.
00:15:17.360 --> 00:15:19.039
Some people call them most incidents, post-incident.
00:15:19.200 --> 00:15:22.720
Now we used to call them post-mortems, but people didn't like the word mortem at the end.
00:15:23.200 --> 00:15:23.919
Yeah, yeah.
00:15:24.080 --> 00:15:33.279
We have some, we that's a whole separate conversation about the language we use in cybersecurity that I've talked about before, but that could be a whole episode in and of itself.
00:15:33.519 --> 00:15:41.519
Given everything we've discussed about trust leadership and cyber judgment, I want to close with the question that we ask every guest on Cyberminded.
00:15:41.679 --> 00:15:47.120
What's one place where the cybersecurity field needs to slow down and think more carefully?
00:15:47.360 --> 00:15:51.120
I was thinking about this because I do listen to what you're talking about.
00:15:51.279 --> 00:16:01.919
I think what people need to focus on from a security perspective is focus less on probably the measure of confidence levels around versus evidence.
00:16:02.000 --> 00:16:06.080
So making sure that you have strong governance that acknowledges uncertainty, right?
00:16:06.159 --> 00:16:12.720
And adds that uncertainty into projects and makes sure the organizational agility is you're able to move fluently.
00:16:12.879 --> 00:16:16.080
But I also want to add that it's really important to have trust.
00:16:16.240 --> 00:16:18.559
And trust is up, down, and backwards, right?
00:16:18.720 --> 00:16:23.440
Trust in your leadership, trust in your staff, trust in your policies and procedures internally.
00:16:23.519 --> 00:16:34.080
And because without that, you're not gonna succeed in any Yeah, and it's really about figuring out when we always talk about this concept of thinking fast and slow, the Daniel Kahneman phrase.
00:16:34.159 --> 00:16:38.159
And there are times where it's perfectly appropriate to think fast.
00:16:38.320 --> 00:16:42.639
If there's a fire in your house, thinking fast is probably an important thing.
00:16:42.799 --> 00:16:59.200
But when you're trying to make a decision that's going to impact the viability of your organization or an incident, or should we pay a ransom, maybe slowing down and thinking about it, but also having that level of trust and having those systems in place is super important.
00:17:00.080 --> 00:17:00.480
You're right.
00:17:00.559 --> 00:17:03.360
Many process problems are actually trust problems and things.
00:17:03.440 --> 00:17:06.079
So delayed isolation, softened reporting, all that.
00:17:06.319 --> 00:17:14.240
I think all of that excessive governance we talked about, dashboard overload, all of that just indicates low trust in an organization on information flow.
00:17:14.319 --> 00:17:15.680
It's not really a lack process.
00:17:15.759 --> 00:17:21.599
So I think leaders kind of need to think differently across the layers, but because you're all assessing the same risks, right?
00:17:21.680 --> 00:17:24.480
We just kind of do the severity and the readiness a little bit differently.
00:17:24.720 --> 00:17:27.119
Yeah, couldn't have summed it up better myself.
00:17:27.359 --> 00:17:35.680
Today's conversation really challenged the assumption that cybersecurity effectiveness can be read directly from controls or maturity language.
00:17:35.839 --> 00:17:44.720
Tammy, you've helped us examine the role trust, translation, and leadership judgment play in whether security decisions actually hold up in the real world.
00:17:44.960 --> 00:17:50.480
As we always talk about, the human side of cybersecurity is not just about awareness or user behavior.
00:17:50.559 --> 00:17:57.519
It's about or how organizations shape judgment, incentives, communication, and confidence around risk.
00:17:57.680 --> 00:18:06.559
So my thanks to you, Tammy, for joining the conversation and to CyberCog Labs and Cybersec Media for supporting the show as we end every episode.
00:18:06.640 --> 00:18:11.599
Until next time, look beyond the controls and pay attention to the human side of cybersecurity.
00:18:11.680 --> 00:18:12.880
Thanks, everyone.
