Caleb Barlow (13:18)

It's always a pleasure to be here with the voice of the cybersecurity industry. Dave, how are you today?

Dave Bittner (13:25)

I feel a little. A little teased. I feel a little. You should feel loved.

Caleb Barlow (13:29)

You should feel loved. It's all loved.

Dave Bittner (13:31)

All right, okay, I will take that. I will take that. So, you know, just a few days ago on our Cyberwire Daily, I was talking about the skills gap and questioning whether it is actually a thing, because you see lots of news stories about the skills gap, but then you see lots of people pushing back and saying, no, it's not really a thing. What's your take on this, Caleb?

Caleb Barlow (13:55)

Well, I mean, look, I think, and I'll actually credit Simone Petrella and I were having this dialogue and she said to me, you know, is it really a skills gap or is it an experience gap? And, you know, I thought about this a lot. I'm becoming more and more convinced it's an experience gap. And here's where you really see it. Like there's what, Roughly speaking, if you look at cybersec, any given day, it's about 450,000 open unfilled security jobs in the United States. Right?

Dave Bittner (14:23)

That's what they say.

Caleb Barlow (14:25)

You know, I don't, I don't think that number's Totally off. Now, maybe some of those aren't real jobs. We could probably agree. There's definitely a few hundred thousand open, unfilled jobs. Okay, okay, sure. Now, the other thing is like, we're also at a time in an industry where, and I don't know what this number is, but there are definitely tens of thousands of people that have been laid off in the security industry that are looking. And I get those resumes every day. And you know, in the US we graduate somewhere between 20 and 30,000 people a year that kind of are looking for a cybersecurity degree, a career that can't really find that first job that they really want. They're getting jobs, but they're not necessarily getting jobs that they want in the society. And you need to look no further than what's happening with recruiting to understand why.

Dave Bittner (15:09)

So what do you think the reality of the gap is? Where's the disconnect here?

Caleb Barlow (15:14)

Well, I think the disconnect, believe it or not, is the usage of commercial tools. And if we look at most cybersecurity education, right, it often starts with red teaming, penetration testing, and you're going to go through some sort of an exercise, maybe using a Kali Linux platform, a lot of common open source tools, and you know, you're learning the basics of how to do manual penetration testing, manual red teaming, and then you switch over to the defensive side. But the reality when a recruiter goes out and looks for a job and how that dialogue goes is, hey, you know, I'd really love to get somebody maybe on the younger side, maybe, you know, it's an entry level job, but it'd be great if they had like a couple years of experience using Splunk or qradar or Google Chronicle and you know, extra bonus points if they've maybe, you know, configured a firewall. Okay, So a recruiter hears that they don't write entry level job, they go program their search and AI agent to search on Splunk, Chronicle, you know, Palo Alto firewalls, because those are the easy things to find. So the reality is if you don't have these commercial tools on your resume and frankly have that experience, you, you're going to get filtered out and never even looked at by the recruiter.

Dave Bittner (16:29)

You know, I think back to my own experience in college. I was studying radio, television and film and was looking to a broadcast career when I got out, which I did for 20 years, but it was the time I spent working in the TV station on campus. And to your point, using the equipment in the TV station, you know, the videotape machines, the cameras, the, the cables, you know, all that kind of stuff. That's what got me work right out of college of being able to say to people, yes, I know how this machine works. What's the equivalent of that TV station on campus for folks who are looking to get their hands on the real security tools, I think you're spot on.

Caleb Barlow (17:12)

So, you know, my experience was very similar. I was studying to be an electrical engineer. I went to the Rochester Institute of Technology where they require you to go there for five years for an engineering degree and one of which is four co op rotations. So when I graduated, I had all of this commercial experience at times with companies that were hot at the time that nobody's probably ever heard of anymore. But the point is like, you're walking out the door with all this commercial experience. Someone takes a look at your resume and it's like, okay, well which job do you want? I think the same is true whether it's through an internship, whether it's through, you know, and I'm, you know, full disclosure, I'm pitching my own deck here, right? Cyber range training, like where you're going to get hands on with these commercial tools or some other experience where you're going to get. And the term I always use is eyes on glass, hands on keyboard, using the things you're going to use in industry. Now this takes on two forms, right? One, it's the responsibility of the student to go find these opportunities and to go find these internships. But also I think we have to look at higher education and say, look, if we're not training on the exact same tools and platforms that someone is going to be using in the real world job, then we're doing these students a disservice. And that's the other side of this we've really got to think about is as vendors in the vendor community, are you offering licenses to your product for educational use maybe at no or low charge? Because that's the other thing that's going to make the difference. And you know, these schools go out there and look at, you know, the price of buying a lot of these tools and go, look, these things are hundreds of thousands of dollars for a student. Well, it's not going to happen. Right, right. But truth of the matter is most of the vendors, if approached by a university and asking for classroom use, most of them have programs where it's free or very low cost to use these commercial tools.

Dave Bittner (19:01)

What about, I guess maybe we'll call it the Third leg of the stool, which is the companies that aren't training people in house. Right. They want people to come in fully baked, ready to go with the experience. And they don't have those in house programs or even just the funding to get people up to speed. Where's the guilt there?

Caleb Barlow (19:28)

Well, there should be a lot there. And look, I think for whatever reason, the cybersecurity industry has gotten a little drunk on just going out and hiring for the next level versus trying to build those people. Right. And I think here's the way you have to look at it, right? When you go out and hire someone that is an experienced professional on the tools you want, first of all, they're going to cost more. You're going to pay a third of their annual salary or more to a recruiter. So let's say you're recruiting for a job that's $100,000. Right. Just to use round numbers, you're going to pay $33,000 for the recruiter. You're going to get them on board. The reality in today's world, particularly in emerging geographies, is some reasonable percentage, maybe 20, 30% have lied on their resume about their experience. It's unfortunate reality. You're going to find out three months in that actually this person doesn't have 10 years of experience on splunk. They've never touched it before. Now you've got to get rid of them. And I'm only being a little bit sarcastic here. And you've got to start that whole process over again with a recruiter again versus if you had taken an existing top performer, skilled them up on that next tool set. You're only going to pay maybe 10% more in the bonus and the raise that you're going to give them. They're going to be a happy employee and you're going to have a known entity moving into that job where because you trained them, you know they're performant. Right?

Dave Bittner (20:54)

Right.

Caleb Barlow (20:55)

And that is, I'm finally starting to see a lot of the forward leaning CISOs start really changing. They say, okay, I need to take every year a certain percentage of my level one analysts and I need to turn them into level two. I need to take a certain percentage of my level two and I need to turn them into threat hunters. I think Those are the CISOs that are going to dramatically reduce their overall labor costs, dramatically reduce their retention and really be paying a whole lot less out to recruiters.

Dave Bittner (21:23)

Yeah, I was going to mention the retention aspect of it because I think in an industry where people are hopping around a lot. That kind of nurturing can really pay dividends in having people feel a little connection to the company.

Caleb Barlow (21:38)

Well, I mean, how many times have we seen security professionals that are bouncing around jobs? Every year or two. Every year or two getting a higher salary because we're recruiting from a finite group of people. There aren't enough people in the pool. So we all show up wanting the same skills and basically just drive the cost up artificially versus if we took the time to train people. I mean, yes, it might take you six months for somebody working at a level one to get them ready to go to level two. Now they haven't stopped working the whole time. They're just training a little bit in the off time, let's say over six months. But how is that really any worse than spending three months with a recruiter trying to find the right person? Two months of them onboarding and training and a month of them being performant, you're really only losing maybe a month and saving a fortune in the process.

Dave Bittner (22:30)

Right. And training them for exactly what you need.

Caleb Barlow (22:33)

Exactly. And the, what gets really interesting is I'm seeing CISOs now that have a curriculum that they want to mandate down for this to happen. So they're looking at what do I need to do? Because, like, a lot of people, for example, are moving off of qradar, as you know, that kind of winds down and moving to maybe Microsoft or Palo or Google Chronicle. Well, okay, I need to train up my team so they lay out a curriculum. Hey, over the next year, I want to train everybody up. We're going to deploy these new tools and we'll actually be able to measure when people are ready to switch. That's pretty cool in my mind.

Dave Bittner (23:12)

Let's switch over just a bit and talk about the students themselves, the folks training. You mentioned cyber ranges. You know, here at N2K, we have practice tests, those kinds of things. I mean, what's, what's the mindset of someone who is in this mode of getting up to speed? What, what kind of, is, is it a situation where they're putting a lot of pressure on themselves? Where do we stand there?

Caleb Barlow (23:37)

Well, there's a lot of, you know, there's a lot of challenge of getting, breaking into this industry. And I think we've done a little bit of a disservice to ourselves, assuming that, you know, certificate collection is the answer. And don't get me wrong, you know, industry certificates are valuable, particularly if you're going into consulting or a government job, because those are the two areas that really look at them. The reality is, I don't think most CISOs care if you have a certificate or not. What they care about is, do you know the technology and can you do the job? And this really comes down to kind of the brain science of this, of how do I train under pressure? Because it's not just about getting the book knowledge. It's not about passing the exam. I mean, don't get me wrong, passing the exam is important. Right. But I need to do that, and I need to have the time in the seat, because this is much more analogous to a sport. I'm up against a human adversary. I need. Just like I'm training for a sport, I need that pattern recognition of. Wait a minute. This is a little odd. I need to dig in here more. What is. What is this adversary's likely next move? What is their worst move? And that's only learned through time in the seat.

Dave Bittner (24:44)

It needs to be reflexive.

Caleb Barlow (24:45)

It needs to be reflexive, and that training needs to occur repetitive. So, again, let's use a sports analogy. Right? You don't get good at soccer or football. Well, I guess in some geographies, football and soccer are the same thing, but follow me through. Right?

Dave Bittner (24:59)

I'm with you, Ken.

Caleb Barlow (25:00)

You don't get good. You don't get good at this if you don't go out on the field every week and practice hard. Stop. Right, right. You also don't get any good at, you know, if you go out and train to be a lineman by reading a bunch of books, it's not going to end well in your first, you know, if I throw you on a D1 field, it's not going to end well. Right, right, right, right. Okay. The same is true in a sock, Right. Training has to be a regimented part of something you do every single week, which means it's got to be asynchronous, it's got to be easy to do, it's got to be measured, and it's got to be practicing. You got to push yourself. Right. If I only. If we were playing football and we only ever played against easy teams, we're not going to get any better. We've got to simulate playing against really hard adversaries so we know how to build up that muscle memory. And when the really hard adversary actually hits us, we're like, bring it on, baby. Because we're ready.

Dave Bittner (25:53)

Yeah, absolutely. I'm a true believer that the best way to get better at something is to do it with someone who's better at it than you are. Yeah, yeah, absolutely. All right, well, Caleb Barlow is CEO at Cyberbit. Caleb, thanks so much for taking the time for us.

Caleb Barlow (26:08)

Thanks, Dave.

Dave Bittner (26:24)

Let's be real. Navigating security compliance can feel like assembling Ikea furniture without the instructions. You know you need it, but it takes forever and you're never quite sure if you done it right. That's where Vanta comes in. Vanta is a trust management platform that automates up to 90% of the work for frameworks like SoC2, ISO 27001 and HIPAA, getting you audit ready in weeks, not months. Whether you're a founder, an engineer, or managing IT and security for the first time, Vanta helps you prove your security posture without taking over your Life. More than 10,000 companies, including names like Atlassian and Quora, trust Vanta to monitor compliance, streamline risk, and speed up security reviews by up to five times. And the roi, A recent IDC report found Vanta saves businesses over half a million dollars a year and pays for itself in just three months. For a limited time, you can get a thousand dollars off vanta@vanta.com cyber that's v a n t a v.com cyber and finally, we pause to remember Joseph Nye, who passed away on May 6 at the age of 88, leaving behind a profound legacy in international relations and cybersecurity. Renowned for coining the term soft power, Nye's insights into the dynamics of global influence reshaped diplomatic strategies worldwide. Beyond his theoretical contributions, Nye was instrumental in integrating cybersecurity into the realm of international policy. As a founding member of the Global Commission on the Stability of Cyberspace, he championed the development of norms to govern state behavior in cyberspace, emphasizing the importance of protecting civilian infrastructure from cyber threats. Nye's tenure as dean of Harvard's Kennedy School from 1995 to 2004 was marked by his commitment to preparing future leaders for the complexities of the digital age. He fostered interdisciplinary approaches, blending political science with emerging technological considerations, ensuring that the next generation of policymakers was equipped to navigate the challenges of cybersecurity and digital diplomacy. His dedication to public service, including roles as Assistant Secretary of Defense for International Security affairs and chair of the National Intelligence Council, underscored his belief in bridging academic theory with practical policy solutions. Joseph Nye's vision and leadership have indelibly shaped our understanding of power, diplomacy and the critical importance of cybersecurity in maintaining global stability. His contributions continue to inspire and guide scholars and practitioners in the ever evolving landscape of international relations. To all who knew and loved him, may his memory be a blessing. And that's the Cyber Wire. For links to all of today's stories, check out our daily briefing@thecyberwire.com we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2 we're privileged that N2k cyberwire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies. N2K's senior producer is Alice Carruth. Our Cyberwire producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman our executive producer producer is Jennifer Ibin, Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. What's the common denominator in security incidents? Escalations and lateral movement. When a privileged account is compromised, attackers can seize control of critical assets with bad directory hygiene and years of technical debt. Identity attack paths are easy targets for threat actors to exploit, but hard for defenders to detect. This poses risk in active directory, entra ID and hybrid configurations. Identity leaders are reducing such risks with attack path management. You can learn how attack path management is connecting identity and security teams while reducing risk with Bloodhound Enterprise powered by Spectrops. Head to Spectrops IO today to learn more. Spectrops see your attack paths the way adversaries do.