WEBVTT
00:00:00.160 --> 00:00:01.040
And hello everybody.
00:00:01.120 --> 00:00:02.160
Happy Cyber Sunday.
00:00:02.240 --> 00:00:03.279
Hope you're doing well.
00:00:03.520 --> 00:00:10.720
So there was a post on LinkedIn the other day, and I'll include a link uh in here to it.
00:00:10.880 --> 00:00:29.280
Not somebody I'm connected with, but uh saw the kind of the conversation happening around where they stated that it was unfortunate that there were uh like conferences that were focused on CISOs.
00:00:30.960 --> 00:00:34.640
And that immediately caught my attention.
00:00:34.799 --> 00:01:00.399
But the reason I thought it was interesting even more was because what they seem to be saying is that, or not what they seem to be saying, what they specifically pointed out was that the that CISOs don't typically aren't typically the ones that are looking at the vendor to make a decision on that vendor.
00:01:00.560 --> 00:01:08.159
They they may ultimately be the one that makes that decision, but they're not looking at that on a day-to-day day-to-day basis.
00:01:08.239 --> 00:01:24.319
They've got security architects and directors and managers and others, engineers that are looking at that at a more technical level, all of those vendors, and giving their opinion and then building the case for whatever it is, and then bringing that to the CISO for them to make a decision.
00:01:25.200 --> 00:01:31.920
And I I do agree for the most part that that is that's the way it works.
00:01:32.079 --> 00:01:35.840
You don't see the CISO all the time.
00:01:36.000 --> 00:01:38.480
So a lot of them do, but not I don't think most of them.
00:01:38.560 --> 00:01:52.000
I mean, just you know, anecdotally, most of that I've known, they're making, they're having discussions and just doing decisions, decision making at that risk level, at the program level, that kind of thing, and letting someone else look at all the tech.
00:01:52.239 --> 00:01:53.840
So that made sense.
00:01:54.319 --> 00:02:22.719
But what the base assumption felt like to me, and it's why I commented on it, that I agree with the caveat, the base assumption to me was is that vendors, security vendors, are putting out some kind of event conference that they're focusing on the CISO and making the CISO um the person they they're inviting and not inviting anybody else.
00:02:23.039 --> 00:02:32.240
And if vendors are doing that, I do agree that that shouldn't be a CISO-only event.
00:02:33.439 --> 00:02:44.000
Having said that, you know, I've went the HueSetcon that I do, and you know, all everybody on the team, we've created ExecSecCon.
00:02:45.599 --> 00:03:03.520
And ExecSetCon is focused at having that level of discourse and discussion that a CISO typically would be having, which is the risk level, which is the program building level, compliance level, all of those things that aren't focused on vendors.
00:03:04.479 --> 00:03:10.319
And I think that's the kind of conference that absolutely should be focused at that level.
00:03:10.479 --> 00:03:32.319
That's not to say that you shouldn't have somebody else on the CISO's team come with them to the conference or go to the conference if they are looking at becoming a CISO at some point and want to have that or see what that level of discourse is like if they're not used to having that discussion, uh, those risk and compliance and program level discussions.
00:03:32.400 --> 00:03:40.319
If they're more focused and they have an idea or a goal to become a CISO at some point, then they absolutely should be able to come to those.
00:03:40.479 --> 00:03:47.199
I and we're we're allowing some of that with Execcon where we have CISOs can invite a deputy or somebody else that they can bring.
00:03:47.360 --> 00:03:52.639
If you haven't seen that, go to the link down below as well to apply for it.
00:03:52.719 --> 00:03:55.199
And you can see that you can bring somebody else with you.
00:03:55.280 --> 00:04:17.839
Um but that's really the whole idea behind having a CISO level, you know, executive level conference in security is to focus on the highest level of discourse and discussion from a program perspective, not be focused on vendors.
00:04:17.920 --> 00:04:38.399
And I do agree that if the vendor is creating something that is CISO focused, now that could be a relationship type of uh more of a conference or an event where they're doing dinners or something like that and bringing the CISO in to have that discussion or to just you know talk to them and get to know them.
00:04:38.480 --> 00:04:40.000
And that's that's perfectly fine.
00:04:40.079 --> 00:05:05.199
But if you're a vendor doing that and that's all you're bringing in, then you might think about doing it a little bit differently and have an event that where you're not speaking, you're bringing people in that are practitioners, that kind of thing, versus just having somebody from your your company talk about a talk about your product because that's generally just not going to be helpful.
00:05:05.360 --> 00:05:09.279
So anyway, just thought it was an interesting way to come at it.
00:05:09.680 --> 00:05:32.480
Again, I didn't say it's a waste of your time if you're a vendor and you're bringing CISOs only, but what you're doing is not getting the exposure generally that you could get if you also bring in architects and engineers and have them give their opinion to the CISO as well on that product, because the CISO is generally just going to be looking at program level things.
00:05:32.560 --> 00:05:33.920
So anyway, tell me what you think.
00:05:34.000 --> 00:05:41.680
Um I'll include a link to the the discussion on LinkedIn and I'll include the link to ExecSeccon if you want to be there.
00:05:41.920 --> 00:05:43.040
Hope to see you there.
00:05:43.199 --> 00:05:44.160
Talk to you next time.
00:00:00.160 --> 00:00:01.040
And hello everybody.
00:00:01.120 --> 00:00:02.160
Happy Cyber Sunday.
00:00:02.240 --> 00:00:03.279
Hope you're doing well.
00:00:03.520 --> 00:00:10.720
So there was a post on LinkedIn the other day, and I'll include a link uh in here to it.
00:00:10.880 --> 00:00:29.280
Not somebody I'm connected with, but uh saw the kind of the conversation happening around where they stated that it was unfortunate that there were uh like conferences that were focused on CISOs.
00:00:30.960 --> 00:00:34.640
And that immediately caught my attention.
00:00:34.799 --> 00:01:00.399
But the reason I thought it was interesting even more was because what they seem to be saying is that, or not what they seem to be saying, what they specifically pointed out was that the that CISOs don't typically aren't typically the ones that are looking at the vendor to make a decision on that vendor.
00:01:00.560 --> 00:01:08.159
They they may ultimately be the one that makes that decision, but they're not looking at that on a day-to-day day-to-day basis.
00:01:08.239 --> 00:01:24.319
They've got security architects and directors and managers and others, engineers that are looking at that at a more technical level, all of those vendors, and giving their opinion and then building the case for whatever it is, and then bringing that to the CISO for them to make a decision.
00:01:25.200 --> 00:01:31.920
And I I do agree for the most part that that is that's the way it works.
00:01:32.079 --> 00:01:35.840
You don't see the CISO all the time.
00:01:36.000 --> 00:01:38.480
So a lot of them do, but not I don't think most of them.
00:01:38.560 --> 00:01:52.000
I mean, just you know, anecdotally, most of that I've known, they're making, they're having discussions and just doing decisions, decision making at that risk level, at the program level, that kind of thing, and letting someone else look at all the tech.
00:01:52.239 --> 00:01:53.840
So that made sense.
00:01:54.319 --> 00:02:22.719
But what the base assumption felt like to me, and it's why I commented on it, that I agree with the caveat, the base assumption to me was is that vendors, security vendors, are putting out some kind of event conference that they're focusing on the CISO and making the CISO um the person they they're inviting and not inviting anybody else.
00:02:23.039 --> 00:02:32.240
And if vendors are doing that, I do agree that that shouldn't be a CISO-only event.
00:02:33.439 --> 00:02:44.000
Having said that, you know, I've went the HueSetcon that I do, and you know, all everybody on the team, we've created ExecSecCon.
00:02:45.599 --> 00:03:03.520
And ExecSetCon is focused at having that level of discourse and discussion that a CISO typically would be having, which is the risk level, which is the program building level, compliance level, all of those things that aren't focused on vendors.
00:03:04.479 --> 00:03:10.319
And I think that's the kind of conference that absolutely should be focused at that level.
00:03:10.479 --> 00:03:32.319
That's not to say that you shouldn't have somebody else on the CISO's team come with them to the conference or go to the conference if they are looking at becoming a CISO at some point and want to have that or see what that level of discourse is like if they're not used to having that discussion, uh, those risk and compliance and program level discussions.
00:03:32.400 --> 00:03:40.319
If they're more focused and they have an idea or a goal to become a CISO at some point, then they absolutely should be able to come to those.
00:03:40.479 --> 00:03:47.199
I and we're we're allowing some of that with Execcon where we have CISOs can invite a deputy or somebody else that they can bring.
00:03:47.360 --> 00:03:52.639
If you haven't seen that, go to the link down below as well to apply for it.
00:03:52.719 --> 00:03:55.199
And you can see that you can bring somebody else with you.
00:03:55.280 --> 00:04:17.839
Um but that's really the whole idea behind having a CISO level, you know, executive level conference in security is to focus on the highest level of discourse and discussion from a program perspective, not be focused on vendors.
00:04:17.920 --> 00:04:38.399
And I do agree that if the vendor is creating something that is CISO focused, now that could be a relationship type of uh more of a conference or an event where they're doing dinners or something like that and bringing the CISO in to have that discussion or to just you know talk to them and get to know them.
00:04:38.480 --> 00:04:40.000
And that's that's perfectly fine.
00:04:40.079 --> 00:05:05.199
But if you're a vendor doing that and that's all you're bringing in, then you might think about doing it a little bit differently and have an event that where you're not speaking, you're bringing people in that are practitioners, that kind of thing, versus just having somebody from your your company talk about a talk about your product because that's generally just not going to be helpful.
00:05:05.360 --> 00:05:09.279
So anyway, just thought it was an interesting way to come at it.
00:05:09.680 --> 00:05:32.480
Again, I didn't say it's a waste of your time if you're a vendor and you're bringing CISOs only, but what you're doing is not getting the exposure generally that you could get if you also bring in architects and engineers and have them give their opinion to the CISO as well on that product, because the CISO is generally just going to be looking at program level things.
00:05:32.560 --> 00:05:33.920
So anyway, tell me what you think.
00:05:34.000 --> 00:05:41.680
Um I'll include a link to the the discussion on LinkedIn and I'll include the link to ExecSeccon if you want to be there.
00:05:41.920 --> 00:05:43.040
Hope to see you there.
00:05:43.199 --> 00:05:44.160
Talk to you next time.
