이 에피소드에 관해
Matthew Sharp came up as a computer and electrical engineer, moved through independent testing and audit work, and then took a sales role he was convinced would be the devil's work. Four years selling specialized security services taught him the opposite. He often walked into meetings knowing more about a client's business than the CISO across the table did, down to how they segmented revenue on their financial statements. Now CISO at Xactly and co-author of The CISO Evolution, his argument in this episode is that technical leaders stall on the climb to the C-suite because they cannot connect security to the business, and the fix is more concrete than the conference-stage line about speaking the language of business.
That fix starts with learning to read the three financial statements, and he points to John Tracy's How to Read a Financial Statement for the single graphic that ties them together. He gets into moral authority versus formal authority from Covey, why he steers clear of the RFP as both buyer and seller, and the body, mind, heart, and spirit sabbatical (Everest base camp, the Camino de Santiago, Mandarin study, a month teaching English in Vietnam) that gave him cross-cultural empathy for why someone in a hard economy might turn to ransomware. At Xactly he walks through the India-based Center of Excellence, a Snowflake security data lake, a 24x7 AI SOC, and machine learning that forecasts the sales pipeline so his team clears cyber diligence on the deals most likely to close. He closes on where this goes next, with third-party diligence negotiated between MCP servers and a human in the loop, instead of an army of people slinging spreadsheets.
Topics discussed:
- Reading the three financial statements to speak to executives
- Moral authority versus formal authority in security leadership
- Steering clear of the RFP as buyer and seller
- Body, mind, heart, spirit sabbatical and cross-cultural empathy
- India Center of Excellence built on a Snowflake data lake
- Machine learning forecasting the sales pipeline to prioritize cyber diligence
- Jobs-to-be-done hiring that scales with AI agents
- Third-party diligence negotiated between MCP servers
