← CMO Confidential
CMO Confidential
Joyce Kim | Report From the Front Lines of Cybersecurity & What It Means for Marketers | Zscaler
00:33:08
Loading summary
Transcript73 lines
- [00:00]
Unknown Announcer
The CMO Confidential Podcast is a proud member of the iHear Everything Podcast Network. Looking to launch or scale your podcast, iHear everything delivers podcast production, growth and monetization solutions that transform your words into profit. Ready to give your brand a voice then visit iheareverything.com welcome to CMO Confidential.
- [00:25]
Joyce Kim
The podcast that takes you inside the drama, decisions and choices that go with being the head of marketing. Hosted by five time CMO Mike Linton.
- [00:36]
Mike Linton
Welcome marketers, advertisers and those who love them to Chief Marketing Officer, Confidential. CMO Confidential is a program that takes you inside the drama, the decisions and the politics that go with being the head of marketing at any company in what is one of the most scrutinized jobs in the executive suite. I'm Mike Linton, the former Chief Marketing Officer of Best Buy, ebay, Farmers Insurance and Ancestry.com here today with my guest, Joyce Kim. Today's topic, a report from the front lines of cybersecurity and what it means for marketers. Now, Joyce is currently the CMO of Zscaler, a cloud security company which features a zero trust exchange. We'll talk about that later. She was previously the CMO of Twilio, Genesis, ARM and Wrike, and has also worked at Google, Microsoft and Deloitte. So steeped in technology. Welcome, Joyce.
- [01:34]
Joyce Kim
Thank you, Mike. Great to be here.
- [01:36]
Mike Linton
Nice to have you. First question, why don't you just give us a broad overview of the cybersecurity landscape? Here's how I think about it. Always in the news, but probably not understood, not even deeply, just past the surface by most people. How should our listeners think about the cybersecurity landscape?
- [01:58]
Joyce Kim
Yeah, I mean, cybersecurity is actually quite expansive. I mean, you know, when you think about the world now becoming much more digital and all of us sort of living online, I think this is one of the critical areas where, you know, protecting all your data and your assets and everything we do as consumers and companies, like, it just becomes more and more important. So it sort of encompasses, you know, securing your endpoints, which are like your laptops and mobile devices and things like that, to all the different applications that you interact with and sort of the network that connects those two things.
- [02:41]
Mike Linton
And Joyce, just one thing. Endpoint is any device I have that is at the end of the line. Right? Is that how is that how I think about the endpoint? It could be anything. Like, how do I. How do I think about that?
- [02:53]
Joyce Kim
Yeah, I mean, it could be, like I said, your, your laptop, mobile phone, anything like an Iot you know, your. Your ring doorbell, I mean, you name it. Like anything that is connected in some way or some electronic that using cars. Right. That could be an endpoint. Yeah.
- [03:10]
Mike Linton
I mean, and I guess your point would be that there are so many endpoints people may not be thinking about that are actually endpoints and breach possibilities for, you know, your personal stuff or your company stuff. So when we think about all the. All the data, all the endpoints, all the apps, and then we think about breaches, you know, there's been so many, they almost don't even. I mean, they make the news, but then they kind of don't stay around. There's been Ticketmaster, Neiman Marcus, Advanced Auto Parts, Ascension Healthcare. That's just the ones I pulled up for June. Do consumers care? I mean, companies obviously care. Maybe the government cares. How many people care about this? And how do you think about managing how they care about it?
- [04:02]
Joyce Kim
Yeah, no, that's a really, really interesting point in that we call it breach fatigue. I mean, I think in sort of the consumer landscape, it's absolutely real. You kind of get numb to it. Right. Like, I actually received a letter from some healthcare company that, you know, says my information exposed, and, you know, they're giving me a year's trial of credit monitoring, whatever. Right, right.
- [04:26]
Mike Linton
No, yeah, we're going to give this year your free sign up for this. And you're like, oh, my God, I can't even bear this. Or everyone has.
- [04:34]
Joyce Kim
I was thinking, like, I already have it from the other two that I got. I'm probably good, but I mean, it's real. And so I do think that that's one of the sort of bigger issues. But let me kind of take a step back and say I think consumers care deeply about privacy and how companies handle their personal information. Right. But they typically think about it in, like, how are you going to use it? So it's sort of the, hey, I want to give you my information, but I don't want you to send me a bunch of spam or junk. But when you think about it, that company is still collecting that information and they're responsible for that information. So having sort of cybersecurity becomes critical to maintaining and continuing to earn that trust with consumers. And so when you think about it, like, we know cyber attacks are increasing, I think we monitor that sort of on an annual basis. And our research found that it's like 18% increase so far, so.
- [05:33]
Mike Linton
Kidding.
- [05:34]
Joyce Kim
Absolutely. And the payouts, like, the ransom is getting bigger and bigger. So it's just. It's not going to stop. And I think it's one of those things where, you know, technology is fueling it so you have more things that are becoming digital. You now have AI and so there's just a plethora of, you know, sort of surface area, if you will, for these things to happen.
- [05:57]
Mike Linton
I want to go back to this, but you mentioned ransom and that's one of the things you don't read about is how many companies are actually paying the ransom. But I take in that comment that you made that maybe a lot of companies are paying it and just not publicizing it.
- [06:12]
Joyce Kim
Yeah, I mean, it's hard to say like, you know, how many. And now I think if you're a public company that their SEC is requiring you to actually, you know, report on that. But you know, there's, there's so much, it's smaller companies as well. We've definitely seen where, you know, they become more vulnerable because, you know, they don't have as much resources but they typically have cyber insurance. So it is quite a prevalent issue.
- [06:40]
Mike Linton
So how do companies or Zscaler or anybody measure the impact of a breach?
- [06:48]
Joyce Kim
You know, a breach has brand impacts. It has, as I said, if you're a consumer facing company, there's trust issues that become sort of vulnerability with your employees. So it's expansive. You know, this is one where it's board level. Right. So like you have to as a company be very, very conscious about, you know, how you're protecting yourself, what proactive measures you're putting in and then how your reactive plan goes. So it's, there's today, I think it is at sort of the top of mind, the C level and the board level.
- [07:24]
Mike Linton
Yeah, without a doubt. I mean, I know it was always, you know, my board's always up there. But how do you, how do you measure or even gauge it? You get a breach like the target breach a couple years ago or some of these recent breaches. How long does it take you to assess? Gosh, this is a brand impact, a financial impact, you know, a potentially customer acquisition impact, which I guess goes to brand. How do you put a number around it?
- [07:51]
Joyce Kim
Well, I mean, I think it depends on, you know, how you prepared for it and how you've reacted. As I just said, there's companies that have very well thought through the plan, what they're going to do, you know, whether they pay and a lot of it, you know, depending on your particular situation. I think it spans from paying something quickly, getting everything back and then, you know, it's sort of a blip in your overall operations to. There are companies that have been down for weeks and like, oh right, employees have no productivity. Your business is essentially shut down. So it spans across the board.
- [08:36]
Mike Linton
So I'm looking at this and you know, one of our earlier guests said this is a race between the people that want to break down your defenses and people that are building them up. We have AI now coming into play all over the place, helping marketers, helping customer service, you know, at speed. That's also a tool available to all the bad, the bad folks trying to get into your system. Tell us about this fight and just write AI into this from a cyber perspective. And then as marketers are playing around with AI at all the endpoints with their customers and everything else, how should they be? This is like a five part question. How should they be? How should they be thinking about AI and cyber and what are some best practices here?
- [09:26]
Joyce Kim
Yeah, I mean, so let's take a step back and just take AI as an example. Right. So first, before even technology comes into play, you have sort of bad actors that are, you know, constantly pushing the envelope and frankly, they're probably better at what you know. And I'm going to put an air quote, it's like innovating than the companies. Right? Because companies have processes and there's procedures and there's operations and there's legal. All these things that sort of create this barrier or friction point in order to do things quickly versus if you think about like, you know, black cats and bad actors, like there's nothing stopping them, they just kind of keep trialing stuff and they're able to move very.
- [10:13]
Mike Linton
Quickly now and they only have one job and that's to break down your system.
- [10:18]
Joyce Kim
Exactly.
- [10:18]
Mike Linton
Your, your other departments have a lot of jobs. And so yeah, the bad actor thing is I only have one job and all I need is one win.
- [10:28]
Joyce Kim
Exactly. And so now you add a technology like AI and it's funny, like our CEO will say we're probably going to get to a place where like generative AI has become so advanced that you can basically ask it to find you vulnerable attack surfaces and it'll come back with the best way of doing that. So can you imagine somebody with, you know, mal intent to be able to just leverage AI to find vulnerabilities and then to be able to execute something without really having to be like, you know, this super sleuth, you know, person. And so if the world becomes potentially that vulnerable, like this is where as a marketer I think about that in that we're probably the person in the company that collects the most amount of data.
- [11:24]
Mike Linton
Right.
- [11:25]
Joyce Kim
The most, you know, and AI think about it, is being injected to so many marketing tools and different systems and applications that we're using. So it's just going to proliferate. And when you have these sort of beyond just data, it becomes sort of insights and intent and all the stuff that you know about your customers and potential customers, you really have to make sure that that information is secure. And I think, you know, especially because we in marketing by design are going outbound. Right. We go outside to the world, so we could actually create a vulnerable point for our company. So these are all, like, things that I think before we kind of left it to it to think about it. And I think more and more, you know, sort of the product and the marketing areas are going to have to be much more conscious of, you know, what are they doing to secure, you know, their company and sort of their. Their assets that they have.
- [12:30]
Mike Linton
Yeah, this is a CISO's nightmare right here. AI attacks with marketers on the loose. So, I mean, I'm just. All these marketers, you're gonna, oh, my God, I could personalize everything. I can run this thing out. It's great. And your CISO is probably back there going, oh, my God, you're gonna kill me. So, so what is a best practice for marketers as they are unleashing all these things at the end points with their customers?
- [12:55]
Joyce Kim
Yeah, I mean, this is where I think, you know, we talked about sort of cybersecurity landscape. Right. So there's broadly two very sort of different approaches that the industry has taken. And historically, sort of the legacy way of doing it was you built sort of, you know, your wall around your domain, like, whatever we're going to protect, you put it in this place, you build a firewall around it and, you know, keep people out. So that was sort of the traditional approach. Now, for the last, you know, actually, zscalers sort of pioneered this notion of zero trust. And so zero trust is an approach where you kind of take the posture that nothing is trusted. So you don't let. It's not about building a wall and letting stuff in. It's about understanding, you know, you, Mike, as an individual, have access to this application, and I, Joyce, have access to other applications. So I'm just going to create a secure way for you two to connect. You know, do that. Without Mike, you cannot access what I access, and I can't do what you do. The other sort of.
- [14:09]
Mike Linton
So is this Like a personal passcode that Zero Trust is setting up, or how am I thinking about it? Mfa. MFA and all kinds of stuff. This is something different than that, right?
- [14:23]
Joyce Kim
Yeah, so. So the best analogy that like, pretty much anyone can understand is think about like, if you go to an office building, most of the time you check in with a receptionist, you give your id, they verify like you are who you are, and then you get this like visitors badge and you get let in the door. Right. And theoretically you can go anywhere in that building. So it's sort of. That is the firewall traditional way. Now what we're saying is you do the same thing. You still check in, I check your idea, validate who you are, but I give you an escorted path to that particular conference room that you are only allowed to go in, which is why you're visiting me, and you can go nowhere else. So that's sort of the distinction on how the two different approaches work. That's.
- [15:14]
Mike Linton
Well, that's super. I think that is a great example because, yeah, you know, when you get a lot of those buildings in, like New York City or anywhere else, you're going anywhere you want. Okay, that is really good. And then, you know, as we talk about Zero Trust, and I think that was a great example and you gave us some examples of a marketer should help defend the perimeter or defend the building. What can they do to help their, you know, chief information Security Officer or ciso? What can they do to make it easy for them when they're getting to a new tool? I mean, of course, other than hire Zscaler, but I mean, this is the.
- [15:54]
Joyce Kim
Ability to not think about it. Right. CMOs use a lot of systems and applications and tools, by the way, most of them are SaaS based, so they don't fit in my CIOs sort of domain, if you will. So, yes, when we have the ability to license some tool, it and security will do their checks and so forth. But you're still vulnerable in that, hey, I could be creating some entry point for a bad actor to come in if I don't use the right security measures. So this is where a company, you know, that does Zero trust will limit that exposure. The other thing that's really, really unique about how, you know, secure Zero Trust architecture works is that, for example, Zscaler sort of masked you so you were Best Buy. Right. If you, you know, come from your corporate system to access some, you know, marketing system, the outside world does not know it's Best Buy. So to them it just looks like A Zscaler path. And so they don't know how to target you, meaning you become completely invisible to the bad people. So from a marketer's perspective, you want to be as invisible as possible so that you do not become a target of anyone trying to infiltrate your system. That is the second really critical piece that. And you know, whether you're a marketer, a salesperson, or anyone out in the field, that's what's going to be the most important.
- [17:41]
Mike Linton
Got it. So a lot of this, probably where marketers can go off the rails, is the Martech stack. Maybe you can tell me if I'm wrong on this, but you get a lot of marketers that don't have time to wait for something to get done, and then they go buy a piece of software at the edge, or they go buy a program, or they hire an agency to do something and they don't fully integrate it with the stack. Is that a true thing marketers should be thinking about, or am I just making that up?
- [18:11]
Joyce Kim
No, I mean, I think that's 99% of how we function today. There's no question.
- [18:20]
Mike Linton
So. So I think there's a lesson here for marketers that we have when we've had a couple CIOs on, which is don't go rogue. Like, you will say, it's taking too long to get this done or it's taking too long to do this, blah, blah, blah, blah, blah. But if you go rogue, you might be going into the Pandora's box zone, where you're opening up a gateway to the whole company because you, you didn't actually bring in the right players. Is that. Is that a fair thing to say?
- [18:46]
Joyce Kim
Yeah. But the way that I would look at it is to say, if you do, if your company has implemented this zero trust architecture, it's okay, because again, the bad actors will never know it's you. So, like, our big thing is if they can't see you, they can't attack you. Right? So that's the whole point. You need to make sure that as a cmo, you're working very closely with your CIO to understand, hey, what is our security approach? How are we making sure that our company is protected? And all the things that I'm collecting from my customers and consumers are going to be safe. Like, that is a conversation that I think every CMO has to have, and that's not one that we're used to having. You know, we're used to saying, hey, can I get access to this system? Can I do this? But we really now have to understand what are we as a company doing to protect our data.
- [19:50]
Mike Linton
I think that's a super thing to say. It's your responsibility too. Marketers. So you've seen a lot of breaches. If I'm the marketer there and I have to manage once the breach happens, what's the best way to manage this once it comes out? I mean, and, and you obviously have to have a Pandora's Box or ready, set, go kind of thing. But what, what recommendations would you give people to be prepared for a breach, even if you're pretty certain one won't happen?
- [20:23]
Joyce Kim
You know, as we talked about, we know the attacks are happening and it's probably going to increase in frequency. Right. So I think there's no question that a company, and as we talked about marketing has to be prepared for that. So in my experience, the best way to sort of manage through it is sort of two things. Full transparency and what I call sort of long tail ongoing communications. So about six years ago I went through this huge security incident in the semiconductor industry. When I was with arm, the press actually called it like Spectre and Meltdown. I mean it was like huge Star Trek thing. Called to testify in front of the Senate committee kind of thing. Like it was huge.
- [21:12]
Mike Linton
We're having all the fun, Joyce. All the fun, exactly.
- [21:15]
Joyce Kim
The idea unfortunately, like the industry itself and this is like Intel AMD, ARM. So all x86 and ARM based CPUs were compromised because of a design flaw. It would, it had an unintended consequence of potentially giving access to some sensitive data. So we all sort of banded together to manage this vulnerability. But what I remember the most is it was an industry wide collaboration where we shared information. So full transparency. We knew it wasn't sort of a one time and you're done kind of thing. I think the updates and all the information that came out kept going for months and months and we did both proactive and sort of, hey, here's how you find more information. And we brought in more partners and ecosystem and customers just to make sure that everybody understood the impact to them and what was being done. So you know, you get through sort of this big initial storm and a lot of companies think, oh well, we're done, right? It goes on. And so like when people, when the, you know, as we talked about in the beginning, like it sort of gets out of the consciousness of consumers and all of that, like you still have to continue to manage through a lot of the things that will come through, but it's Being proactive about it and like being prepared for it, that will matter.
- [22:45]
Mike Linton
Oh, I hear you say yes, manage it in the short term, but don't assume it's gone because it's off the news. It's not off the news for the people that got burned by it. Is that a fair comment?
- [22:57]
Joyce Kim
Exactly.
- [22:58]
Mike Linton
So let's talk about this because you.
- [23:00]
Joyce Kim
Let's.
- [23:00]
Mike Linton
Let's flip over to how do you market product like this? Because this is a product that is the absence of. Of breaches and bad things happening. So you're selling the absence of a negative. How do you market something like this in a space where it's. There's so many great players and so much technology running around. How. What's some tips you would give marketers selling a product like this?
- [23:27]
Joyce Kim
You know, as you said, I think security one where, you know, for example, for us, we really try and talk about the value of staying ahead of the cyber criminals and sort of how they're moving quickly and sort of what are the new vectors of attacks versus you can't do what you would traditionally do by saying, like, we're the best at something. Right. Because then you kind of paint this target on yourself and you don't want to do that either. So from a marketer's perspective, it's understanding our customers and what their sort of issues and pain points are, but also educating them on sort of the newer things that are coming. And so the way that I say it is, look, cybersecurity, while it is one of the most important things in any company, is not your core business, but it is ours. So our ability to see what's trending, what's sort of being tried and sort of what are the things that we're seeing across the board is something that our customers can benefit from. So from a marketer's perspective, I try and sort of relay that message versus, you know, more that than like we stop bridges like that. I know that, that people say that, but it is, it's a very nuanced thing that we.
- [24:54]
Mike Linton
Right. And you sell more against the. I'm afraid of all these bad guys out there breaching me. Or we're on the cutting edge of this, so you should have us and then you can do what you want kind of thing.
- [25:07]
Joyce Kim
It's both, actually, because, I mean, they're hand in hand. Right. So I mean, if you believe that we have the best ability to spot things, like we stop, I think billions of attack, you know, across the world, like, it's just one of those things where you don't even know that you're in danger and we've stopped it. So you have to believe that we can stay ahead of that. And then that gives you the freedom to continue to do what you want to do in this new digital world kind of thing, Right.
- [25:42]
Mike Linton
Then you can choose to market it or not, right?
- [25:44]
Joyce Kim
That's right.
- [25:44]
Mike Linton
Okay, thank you for that. Now, you've been in tech your entire career, really, and sometimes, and I've spent some time in tech too, a lot of times tech does not always have the best reputation for understanding or valuing marketing. Give us your take on tech and marketing and then advice for marketers that want to be in tech.
- [26:08]
Joyce Kim
You know, I actually, I'm not sure I agree with that. That's okay. You can disagree.
- [26:14]
Mike Linton
That's part of the show.
- [26:16]
Joyce Kim
What I would say is it has not been my personal experience as a CMO in various companies and leadership and tech companies. So I think a lot of tech companies value growth. And in my experience, sort of you as a marketer have to be the engine for growth. And that'll typically come in traditionally it's sort of pipeline building for sales. Now I think you're seeing more and more where product led growth is really, really instrumental to a lot of companies. So whether you think about it as new product launches entering a new market, geographically, whatever, I think marketers have to have the attitude that we're building the groundwork for sales to be successful. We're creating sort of a soft landing spot for the company to expand. So from a tech perspective, if a marketer owns that, so it becomes sort of you're taking ownership for the pipeline or the revenue targets. That's what's going to get you to be seen differently from the business. And I'm not sure a lot of marketers actually do that.
- [27:31]
Mike Linton
You know, I agree with that. Like, they're giving you money to grow the business. If you're not really growing it and you don't understand how to grow it profitably, you're probably not going to be in a good space. When you are interviewing, any good interview questions that you would recommend our users, our listeners ask to see if they're going to fit into the company.
- [27:55]
Joyce Kim
So to me, as a marketing leader, you know, I'm typically interviewing functional leaders within my team or something. Right. So the question that I like to ask them is sort of what, how do you define marketing? And I will tell you, I've seen two. It's usually within two buckets. Some people will rattle off. Here's all the functions that they do, right. Like the marketing is responsible product marketing and PR and blah blah, blah. Others will go much more towards the business impact. So I know for me, when I'm interviewing somebody and they go down the path of, hey, my job is to make sure that we meet our revenue targets and we're, you know, sort of successful in these strategic areas, that's the person I'm going to hire.
- [28:47]
Mike Linton
I agree that marketing is a means to an end, not an end to itself.
- [28:51]
Joyce Kim
Yes.
- [28:52]
Mike Linton
All right, so I think that's a great way to get to our traditional last question. And it's a two part question. You have to take at least one. But you can take both. Funniest story you can tell on the air and or piece of practical advice we haven't discussed yet. Yours to pick. Have to pick at least one. But we're always happy if you want to take two.
- [29:17]
Joyce Kim
So I might try both story because this one like always sticks with me. And I do tell I have to explain it to people, which is why it's something that I do talk about. So, you know, there's not actually a lot of women in leadership positions in tech that might be shocking, but, you know, it's true. So a while ago I was doing like a keynote for one of the user conferences in my company and I think out of like eight speakers, there was literally like one other woman, right. She was like the customer success leader or something. And so we were both going to speak and there was one portion where we were both going to like speak together. It was like, you know, I speak, we speak together and then she speaks. We showed up to this thing wearing literally almost the exact same outfit. And I'm not talking like, you know, we're both wearing like a black suit or a blue suit. It was like a red jacket with a black blouse and like same colored shoes. We joke that we look like two airline stewardesses.
- [30:23]
Mike Linton
There you go.
- [30:24]
Joyce Kim
After that, I actually am pretty obsessive about asking people, like, even though I'm not speaking, like, what are you wearing? They'll ask me like, why are you asking me that? I don't know. And I always say like, oh well, you'd be surprised. And sometimes it's like, I don't want you to wear checkers or you know, things that won't look good.
- [30:42]
Mike Linton
Yeah, that's what bad on camera that camera can't pick up. Right? Yeah.
- [30:45]
Joyce Kim
But my ulterior motive is to make sure I don't have like eight men in blue suits and jeans. Or something.
- [30:51]
Mike Linton
I think that's right. Look, there's been times where I'm like, this is a sea of blue sport coats and khakis. My God.
- [30:58]
Joyce Kim
Exactly. You have to, like, say, do you have a tan jacket or a gray jacket?
- [31:06]
Mike Linton
Yes. I relate to this. Once I wear a pattern jacket, and I got the question of, how could you even do that? And I'm like, I'm standing against the tyranny of blue jackets and khaki pants.
- [31:18]
Joyce Kim
Exactly. Although now I've seen all men wear, like, the exact same checkered jacket. Exactly.
- [31:24]
Mike Linton
And then it's hard to stay trendy. So let's go to the practical advice piece.
- [31:30]
Joyce Kim
Okay. So when I was early in my career, someone once told me that if you pick a mentor, pick somebody that is not in your function and somebody you don't know well. And I thought, God, that is so antithetical to what I was going to do, because I would have picked somebody more senior in marketing and probably someone that I know I can talk to. And the reason why they told me to pick someone like that was you already have people that you get along with and you know that'll advocate for you. And the point of having mentors is to get a different perspective than what you and your sort of, you know, like, groups have. And you can turn. It's an opportunity to have advocate outside, which is typically, you know, in a business setting, a lot more powerful than, like, my boss's boss's boss. Right. So I found that incredibly helpful, and I've actually used it kind of throughout my career, which has given me sort of, hey, how does engineering see marketing? How does product see marketing? So it's really helpful.
- [32:41]
Mike Linton
I think that is a very wise piece of practical advice and a great way to end the show. So thank you, Joyce, and thanks to everyone for listening to CMO Confidential. If you're enjoying the show, please, like, share and subscribe. Look for all of our shows on Spotify, Apple, YouTube, and the I hear everything network, which include marketing, the battle between believers and non believers. Parts 1, 2, and 3. Secrets from a CFO. What your agency wants to tell you but won't. Part one, two, and three. And a marketer turned tech exec talks about big data, mainframes and AI. Hey, all you marketers, stay safe out there. This is Mike Linton signing off for CMO Confidential.