What Happened to Hacker Culture? [Threat Vector]

Summary

---

CyberWire Daily – "What Happened to Hacker Culture?" [Threat Vector]

Date: October 13, 2025
Host: David Moulton (B)
Guest: Kyle Wilhoyt, Director of Threat Research, Unit 42 (A)

---

Episode Overview

In this special episode of Threat Vector, host David Moulton sits down with Kyle Wilhoyt to explore the personal journey, mindset, and evolution of hacker culture—from its roots in curiosity and hardware tinkering to its current intersection with enterprise cybersecurity and automation. The episode investigates how hacker identity has changed, what’s been lost and gained as the field professionalizes, and offers advice for the next generation entering the security world.

---

Key Discussion Points & Insights

1. The Foundation of Hacker Mindset: Endless Curiosity

• Curiosity as Core: Kyle emphasizes that “being endlessly curious is something that can only benefit you within constraint... But being curious.” [00:26]
• Kyle traces his first exposure to hacker culture back to reading 2600 magazine and building devices as a young teen, highlighting the early spirit of hands-on experimentation. [02:46]

2. Defining Hacker Culture – Past & Present

• Old School:
  • Free-traded or open information.
  • Value of hands-on skills: "The ability to write scripts, execute code, perform actual hacks."
  • Mistrust of authority—a hallmark visible at early DEFCONs (“spot the Fed” contests).
  • Skill-based respect: “You would judge other hackers based on their skill and by their skill alone.” [05:17]
• Now:
  • Hacker culture is “deeply intertwined with the mainstream tech industry.”
  • The term “hacker” is more ambiguous, sometimes seen as negative, sometimes as a badge of creative problem-solving. “It’s a modern multifaceted phenomenon with a lot of baggage tied to that term.” [05:17]
• Host Reflection: David stresses separating “hacker” from “attacker,” arguing that hacking is about enabling technology to do unintended things—for good or ill:
  • “The intent and in the mind of the person...then defines whether it's a good or a bad thing.” [08:20]

3. Influences Shaping the Hacker Mindset

• Personal:
  • Kyle’s brother’s “engineering mindset...wants to understand how everything works,” instilled endless curiosity. [09:19]
• Professional:
  • Mentors Martin Rosler and Ben April at Trend Micro taught the power of asking “what if?” to open up innovative thinking and embrace hypotheses, even at the risk of failure. [09:19, 10:57]
• Iterative Learning:
  • Failure is not just acceptable, it’s a vital data source; “You still learn something.” [11:32]

4. The Impact of AI & Automation on Hacker Culture

• Lowering Barriers:
  • “Automation, generative AI...is facilitating and fueling cybercrime...at a rate we haven’t seen.” [12:29]
  • Both amateurs and nation-state adversaries benefit from tools like LLMs to scale attacks or create malware more efficiently.
• Advanced Threats:
  • Cites recent real examples (Russian APTs using LLMs for malware development). [12:29]
  • AI is not only a tool for spread but also for sophistication: “They can manipulate LLMs, jailbreak them in some capacity...” [12:29]

5. The Professionalization of Cybersecurity – Gains & Losses

• What’s Lost:
  • “The loss of just open and free information sharing.” [14:09]
  • Shift from pure curiosity to “marketable skills.” [14:09]
• What’s Gained:
  • Explosive “innovation and development,” large-scale R&D.
  • “Professionalization and quality control on software and hardware.” [15:10]
  • Not doom and gloom but a “maturation of the field.” [14:09]
• Host’s Take: The modern landscape requires this maturation, even as it leaves nostalgia for simpler, hobbyist-driven times. [15:58]

6. Encouraging Curiosity and Mentorship in the Field

• Conference Culture:
  • Black Hat and similar events have become crucial spaces for mentorship and real connection—“meet and greets” with veterans and accessible networking help newcomers. [18:01]
• Education Advice:
  • Kyle’s 3 Pillars for Students/Newcomers:
    1. Master the fundamentals (networking and coding). [19:35]
    2. Get hands dirty: “Create your own lab... that’s where I practically learned...” [19:35]
    3. Embrace soft skills: “Ability to effectively and concisely communicate... Being able to break down complex topics...” [19:35]

7. The Power of Soft Skills & Storytelling

• Importance:
  • “Facts don’t change people’s minds, stories do.” [21:24]
  • Kyle makes all students practice public speaking and recommends Toastmasters—valuable for any technical professional. [21:52]
  • Book recommendation: Duarte’s Resonate for learning persuasive storytelling. [22:56]
• Impact:
  • Technical leaders must communicate risk in relatable, compelling ways—otherwise, “you lose impact.” [24:13]

8. Sustaining Curiosity in High Pressure Roles

• Tactics:
  • Keep asking “what if?”—schedule curiosity and experimentation into your week. “Schedule time for that what if question... Even 15 years doing research, I still do that.” [24:38]
  • Embrace intellectual humility: “I don't know, but I'm committed to finding out... The smartest...are the first ones to say they do not know.” [26:02]
• Encouraging Team Creativity:
  • Block out time for research with a deliverable—apply the “pickle jar” approach to scheduling (schedule big/important tasks first). [27:15; 27:42]

9. The Future of Hacker Culture

• Aspirations:
  • Hopes the term “hacker” will be reclaimed as a force for “good and innovation...creative problem solving and the advancement of secure technology.” [29:37]
• Practical Step:
  • Listeners should help improve public perception by correcting inaccuracies in media and conversation:
    • “I correct them and have them try to use correct terminology.” [30:15]

10. Core Values, Old and New

• Constant:
  • “Relentless curiosity.”
  • “Unyielding integrity” in research, and belief that “knowledge gains value when shared.” [30:59]
• Still Evolving:
  • Moving from patience with problems to patience with people.
  • Shifting from technical purity to pragmatic impact.
  • Evolving “from a right to speak to a responsibility to listen.” [30:59]

---

Notable Quotes & Memorable Moments

• On Hacker Mindset:
  • “Someone that's endlessly curious...I think that that's fundamental to the quote, unquote, hacker mindset.” – Kyle Wilhoyt [09:19]
• On Old School Hacker Culture:
  • “All you cared about was what they were capable of doing with a computer or by bending technology and kind of stressing what was possible with technology.” – Kyle Wilhoyt [05:17]
• On Failures and Learning:
  • “If the data proves that your hypothesis is wrong, it's still the conclusion at the end of the day.” – Kyle Wilhoyt [10:57]
• On AI’s Impact:
  • “Automation, generative AI...is facilitating and fueling cybercrime at a rate that we haven't seen.” – Kyle Wilhoyt [12:29]
• On Professionalization:
  • “The loss of just open and free information sharing.” – Kyle Wilhoyt [14:09]
  • “Knowledge is a shared resource. And what I mean is I fundamentally believe that knowledge gains value when it's shared.” [30:59]
• On Curiosity:
  • “Schedule time for that what if question. Schedule time to hypothesize research and then execute on that research.” [24:38]
• On Humility:
  • “The smartest and most brilliant people I've ever worked with and met are the first ones to say they do not know.” [26:09]

---

Important Segment Timestamps

• Hacker Mindset & Early Influences: [00:26]–[04:06]
• Defining ‘Hacker’ & Culture Evolution: [05:03]–[07:37]
• Influences and ‘What if?’ Thinking: [09:19]–[11:21]
• AI’s Impact on Culture & Technique: [12:29]–[13:52]
• Professionalization--Losses & Gains: [14:09]–[15:58]
• Mentoring & Advice for Newcomers: [18:01]–[21:24]
• Soft Skills and Communication: [21:52]–[24:19]
• Sustaining Curiosity: [24:24]–[26:02]
• Scheduling Creative Time/‘Pickle Jar’ Story: [27:42]–[29:04]
• Future Hacker Culture & Listener Action: [29:37]–[30:26]
• Core Values & What’s Evolving: [30:59]–[33:32]

---

Final Thoughts

David and Kyle weave a powerful narrative about hacker culture’s roots in curiosity, experimentation, and community. Their conversation spotlights the importance of open knowledge sharing, the role of innovation fueled by both individuals and organizations, and the need for both technical depth and excellent communication. Whether reminiscing about magazine-scouting days or forecasting the future, the episode ultimately calls for a reclamation of the term “hacker” as a positive force and for every listener—novice or expert—to push themselves and their community towards curiosity, humility, and shared progress.

---

Transcript

[A]

You're listening to the Cyberwire Network, powered by N2K.

[B]

Welcome to Threat Vector, the Palo Alto Networks podcast, where we discuss pressing cybersecurity threats and resilience and uncover insights into the latest industry trends. I'm your host, David Moulton, senior director of thought leadership for unit 42.

[A]

Curious. Constantly curious, that is, to me, me. What is the foundation of a quote, unquote hacker, whatever you want to call it, that could be an attacker or a hacker, but at the end of the day, they're going to be curious to some degree. Right? And I think being endlessly curious is something that can only benefit you within constraint of, but being curious.

[B]

Today's episode is a little different. Instead of diving straight into the latest threat intelligence or attack techniques, we're pulling back the curtain to get to know the person behind the research. I'm speaking with Kyle Wilhoyt, director of Threat research here at unit 42, and.

[C]

This is his story.

[B]

Kyle's journey from a curious kid picking up hacker magazines at Barnes and Noble to leading some of the world's most sophisticated threat research is one that reflects the evolution of our entire industry. He's been a Black Hat board review member for over seven years, mentors the next generation of cybersecurity professionals, and has that rare combination of technical depth and genuine curiosity that makes him so effective at what he does. Today we're going to talk about Kyle's personal path into cybersecurity, how hacker culture has evolved, and what it really takes to stay curious and innovative in a field that never stops changing.

[C]

Kyle, when we last spoke on Threat Vector, you gave us a grounded no fud, in case you don't know what that means, Fear, uncertainty and doubt view of how AI is and isn't transforming the threat landscape. I was back on episode 13. Today's topic is a little bit more personal. Let's rewind. Do you remember the first time you felt like you belonged in the hacker community or the security community and take me back and tell me what you remember about that moment.

[A]

Yeah, there's actually two. There's a personal one and a professional one. The personal side is actually back in the day and I'm aging myself here, but there's an old magazine called 2600, which I used to pick up at Barnes and Noble at the time up in St. Louis, Missouri. I had to travel with my parents to go pick it up every month. And the first time that I felt like that was reading that and actually getting the plans for something called a beige box and creating A beige box by walking to my local Radio Shack and building it myself in my own house and testing it, et cetera. So that's kind of from a personal perspective and at that time, I think I was probably 14 at that age. So from a professional perspective, I would say it was honestly the first time I came out to Black Hat and defcon professionally. Brand new security engineer working for a couple different companies, and I finally got out to the point where they were going to invest the money to send me to Black Hat and defcon. And Black Hat was interesting. Obviously, the first time you're exposed to it, it's pretty impressive and pretty kind of overwhelming to a degree. And DEFCON was even more that way. So those were kind of the two real big kind of pioneering moments that I can remember back professionally and personally on when I kind of felt like I belong to the culture or whatever you want to call it.

[C]

Yeah, that's cool. When you were talking about going to Barnes and Noble to pick up the magazine to learn about a thing, going to, going to Radio Shack and getting parts, man, that takes me back. I used to love to go to Barnes and Noble, smell the print, look at magazines that I couldn't afford to buy, you know, try to figure out what in the design and computer magazines were kind of be the one that I would part with my cash. And you know, that part of our world has changed a little bit. I don't know what today's aspiring and I'm gonna say hacker. And I mean that in the good sense of the word. You know, how they get into. Maybe it's Reddit, maybe there's different communities that they're in. I don't think there's like a Barnes and Noble shelf full of the most cutting edge articles to go read. But who knows? I haven't actually looked.

[B]

Maybe they did.

[A]

Maybe.

[C]

Well, speaking of hacker, maybe we should define that word upfront to you. What does hacker culture mean and how has that evolved over the years?

[A]

Yeah, that's a really good question. One that, you know, I haven't really ever been asked to be honest, and one that I haven't reflected on personally probably and for as long as I've been in the industry. But I'd say that it's evolved over the years. Right. So early on, meaning like whenever I first started to get into quote unquote hacking, and I mean hardware hacking, from my perspective, that's how I entered kind of going into this video game cracking back in the day. And from my perspective, the kind of core Tenets of a hacker back in that time was freely available information traded or otherwise, meaning depending upon the level of information, you might trade for that or you might just freely get that hands on. Imperative, meaning the ability to actually go out and write scripts, write code, execute code, perform actual hacks, for lack of a better term, even though that's a really bad term to use for that. I think there was also, generally speaking, and I think a lot of folks that are of that age group from that kind of community, there was also a mistrust of authority, generally speaking. Right. I mean you could see that throughout defcon constantly to spot the Fed back in the day, all the different contests that were run in that way. And then also from kind of a component perspective like judging on skill, meaning you would judge other hackers based on their skill and by their skill alone, meaning didn't matter who they were, where they came from, et cetera. All you cared about was what they were capable of doing with a computer or by bending technology and kind of stressing what was possible with technology. That's evolved though, and from my perspective, that's evolved into where modern times, where hacker culture is kind of deeply intertwined with mainstream tech industry to some degree. And heck, I saw this just walking to this hotel to do this interview, meaning I was seeing T shirts with hacker written on the front of that. And is that a positive or a negative? Right, because in some communities it could be considered a negative. You could be talking about a true black hat hacker. Or in some communities the tech industry adopts that as a hacker mentality, something someone that stresses those boundaries, someone that pushes those boundaries. So from my perspective, I wish it was as easy as saying hey, hacker means X, Y and Z. But realistically it's a modern multifaceted phenomenon with a lot of baggage tied to that term, frankly. You know, there's, and, and that's kind of the way that I view it collectively kind of over the years that it's shifted, modified and kind of, you know, that has just changed to some degree.

[C]

Yeah, language sometimes does that. It depends on when it was said, what the context, who was saying it. And I've run into a lot of folks in the industry who consider themselves hackers badge of honor and are furious when people use that as a way of describing an attacker, somebody who just set out to do something malicious or harmful. And, and I've figured out over the years that I've been part of this industry, part of this community to start using attacker and hacker. And I think of a Hacker as somebody who's able to get technology to do things that it wasn't intended to do.

[A]

Exactly.

[C]

And that's interesting. That's fun. You're setting out to just push those boundaries, and sometimes you run into something where you're like, oh, I wasn't supposed to have access to this, or I can't believe this allowed me to do something. And then it's that question of, like, what do you do with that new information, that new capability? And if you're on the good guy side, if you will, you start to report that as a vulnerability or weakness or something that was unexpected. And obviously if you're malicious, you exploit it. Right. And I think that that's where the language struggles to say, like, how do you take the same exact behaviors and the intent and in the mind of the person doing it then defines whether it's a good or a bad thing.

[A]

Yeah.

[C]

I'm curious if there is a moment or a person that helps shape your views on what a hacker is or should be.

[A]

Yeah. Both personally and professionally. Again, personally, my brother, he is an engineering mindset and individual that literally wants to understand how everything works. And that literally means taking things apart. I can remember as a child seeing him take things apart, trying to understand how they function. And that rubbed off on me over the years to then make me endlessly curious on how things function. And I think that that's fundamental to the quote, unquote, hacker mindset. Right. Someone that's endlessly curious. And I think that ties into why my brother impacted me from that way. From a professional perspective. There's a few folks, Martin Rosler and Ben April from Trend Micro. Those are two of my leaders back at Trend Micro, and they really kind of taught me to constantly ask what if? Meaning what if I could do this? What if we go out and approach this problem? What if? Meaning almost daydreaming research, in a way. And it was really, really good to work alongside both of those individuals in terms of kind of teaching and thinking through that mindset, Both really skilled in that area. So I'd say personally and professionally, that's kind of, you know, some of the more impactful folks that. That really impacted me from that mindset.

[C]

Specifically, I really love that what if phrase because that puts you into a. Both an imaginative and then a future state where you're going like, oh, well, what if that was true? What if I could do that? And sometimes the thing that's blocking you from making the leap on an innovation is just your own mind saying, well, that's not possible.

[A]

Exactly.

[C]

But if you flip it around and you go, what if? And then it unlocks these possibilities. Exactly.

[A]

And that's. Ben and Martin really kind of didn't train us. They led us to that. Right. In a way. Meaning, hey, think up a hypothesis and execute on that. See if it comes to fruition. If not, if the data proves that your hypothesis is wrong, it's still the conclusion at the end of the day. And that's still data and it's still a story to tell. Right. So at the end of the day. Yeah, they kind of help shape my mindset in that sort of.

[C]

Kyle, I won't admit my age and. Or out yours here, but I think we came from a similar timeframe. We both went to Randy Street.

[A]

That's fair. That's fair.

[C]

We both went to Barnes and Nolan.

[A]

I'm losing my hair. Yeah, that's fair.

[C]

But I think there was a moment where education said, failure's not an option. You've gotta always succeed. And sometimes asking a dangerous question like what if? Might lead you to a hypothesis of things you couldn't do. So you didn't want to be a person who did a thing that didn't work. And yet I think that there's a moment where you reframe what you just talked about. Yeah. You have a hypothesis, you run it down, it doesn't work. You still learn something.

[A]

Absolutely.

[C]

That's key. Yeah. All right, we'll jump back in a little bit. This is a fascinating piece of the conversation. I want to go back to our last conversation. We talked about AI and how it's changing attacker tactics. And this time I want to ask you, how has the rise of new tech, AI, automation, changed hacker identity and culture?

[A]

I think the number one factor, or the number one thing that I see is lower barrier to entry for these types of criminals and these types of nation state adversaries. What I mean is automation, generative AI, whatever you want to call it, is facilitating and fueling cybercrime at a rate that we haven't seen, as well as fueling nation state espionage in a rate we haven't seen in the past. I think that that type of technology is only going to continue to increase speed in which these attackers are coming to scale and how fast they're coming to go out and actually perform initial attacks, et cetera. So I think that that's the number one thing that we're seeing is just the lower barrier to entry. I think the other thing is outside of having that lower barrier to entry, for These attackers. I think also what we're starting to see is the EVOL attackers starting to use things like LLMs and generative AI to do more advanced techniques. I mean, heck, we just saw a blog recently written that Russian state sponsored group was actually using an LLM Gemini, if I'm not mistaken, to go out and actually assist it in writing actual malware that functioned. So what that really leads to is again, that lower barrier to entry. Attackers are able to use and manipulate LLMs, jailbreak them in some capacity, manipulate the guardrails, whatever that is, and ultimately get the LLM to do things that it wants or that the attacker wants rather. I think those are the kind of two big shifts that I'm seeing.

[C]

You've seen the industry shift from hobbyist forums to billion dollar enterprises. What do you think has been lost in the professionalization of cybersecurity?

[A]

It's funny you ask this because I can actually kind of think of myself to some degree, right? Because I was kind of a quote unquote hacker in the old school sense of the word, and then migrated over into the corporate world. So I kind of can look at this from my own perspective. And I think one of those areas is the loss of just open and free information sharing, right? I think that's one of the reasons that I pursued intelligence, because a lot of intelligence work is ultimately sharing information and I truly believe that. I think the power of threat intelligence is sharing, but I think that the concepts and kind of migrating more to that professionalization of cybersecurity. I think that that's directly related to some of the decline of open information sharing. I think also the focus for many in the cybersecurity industry has shifted from inherent curiosity, what it used to be back early, early on, to marketable skills. And I'm not saying that's wrong, and I'm not saying that's right. I think that's just part of what we're starting to see kind of change in the industry, right? I think there are some benefits though, right? With every downside there is a benefit. Meaning with that professionalization you also see innovation and development that you likely wouldn't have seen in the past, meaning we're seeing rapid growth in innovation across all industries. I think also professionalization and quality control on software and hardware that's being produced is also something that's directly a benefit of that professionalization. So I don't want to make it sound like it's all doom and gloom, because it's not. It's just the maturation of the field and the professionalization of that field. And there's goods and bads with everything. Right. And that's the way I view it. That's just a couple positives, couple negatives, I guess. Yeah.

[C]

I think that maturation has been required because of the landscape, because of the changes and the opportunity for profit or espionage. And the hobbyist can't keep up with that.

[A]

No, it's hard for me to keep up with it. And I'm a professional.

[B]

Right.

[C]

But I think that there is a sense of maybe looking back at a simpler time and. And maybe longing for it.

[A]

Yeah.

[C]

You know, some of the pieces of it were there, but, you know, you can't unring the bell. That's where we're. That's where we're going.

[A]

It's true.

[C]

I want you to talk a little bit more about some of the benefits that you don't think get enough credit.

[A]

You mean with the professionalization of cybersecurity?

[C]

That's right.

[A]

I think innovation is probably one of the largest benefits. I don't think that the same amount of R and D dollars would be spent in innovative categories and innovation in general without that professionalization, frankly. So I think that that's one of the direct benefits. One of the direct impactors in a positive way is that innovation. We can talk and continue to go on about the professionalization and quality control of the software and hardware that's created as well, but I think that all of that stuff is just net benefits.

[C]

You've been on the Black Hat US Review Board for over seven years.

[A]

Yeah, yeah. A long time.

[C]

What do you think Black Hat and conferences like it should really be doing to foster mentorship and curiosity?

[A]

Yeah. So, you know, we've seen a lot of this. Just, you know, I don't want to speak for Black Hat specifically, but in this case, some of the events that I'm involved in, you know, the past few years have really been impactful in this area. We offer several opportunities to just do meet and greets with board members. As an example, where we just set up a table, we put our names on little placards and we stand there and we talk and just kind of just use as a networking opportunity for anybody that comes in to talk. That's the kind of thing that I think really makes an impact because it allows you to get one on one with individuals. I'm also a college instructor as well. And having that one to one time to be able to provide that mentorship I think is something that's really key, especially now in today's kind of cybersecurity industry, I think it's imperative to be able to try to find somebody that can kind of help mentor you because there's so many different avenues to take in the industry now. It's not as simple as it used to be back whenever I got into the industry, it was much more linear back then. So setting up those opportunities to be able to mentor and have those one on one connections is something that I continue to see black hat doing and stepping up into. And that's an area that I continue to volunteer for on the board because again, I think that that's really where you see a good benefit is that one on one connection.

[C]

So let's talk about that next generation. You mentioned a minute ago that you're an instructor. I'm wondering what advice you'd give to students or new professionals that are quote unquote trying to break into security, especially those that don't feel that they fit the mold.

[A]

Okay, I like it. I'd say there's three things that I constantly give in terms of recommendations for my students. The first is master the fundamentals. And by the fundamentals, I'm referring to networking. Networking, topology. Understand how RFC 1918 space works, understand how to configure network devices, et cetera. Do the same from a coding perspective, if possible. Right. So master fundamentals that you can apply directly to your role. Because at the end of the day that's going to be what you can do technically is going to be the foundation of what you can go from, I would say also get your hands dirty as much as possible. Create your own lab. Back whenever I was first getting started, I created my own lab in my basement and literally bought parts off ebay, racked in a stack, stuff, configured it, learned how, and that's where I practically learned how to network devices together and have them communicate all that stuff. And then the final piece is what I would consider kind of a bit different and that's embracing soft skills. Something that is oftentimes lost in our industry is the ability to effectively and concisely communicate. Like being able to break down complex topics down into simple bite sized formats that people can understand and individuals can really succeed in this field that have that capability to communicate in that way. And that's something that I really try to stress to my students is you can be the most technical individual in the world and that's amazing. But can you communicate what you know effectively? And if that answer is no, then obviously there's some places that you can work on from a soft skills perspective. So that's kind of one of those areas that I really try to stress on students. Just take technical proficiency as the end all be all because soft skills really round out that skill set. As an individual in this industry, I.

[C]

Think that facts don't change people's minds, stories do. And what I'm hearing is if you're able to concisely and effectively communicate, people will understand the risk. They'll understand that there's a problem worth solving. If you just tell them the facts, they don't have the context. So have you run across any effective ways of training on the soft skills, whether they're storytelling or something else?

[A]

Yeah, that's a really good question. And something that hits close to home because in intelligence work with threat intelligence and threat research, if you can't communicate what you're finding, you cannot communicate the risk that you're identifying. So from my perspective, there's two things that I try to recommend. First is public speaking. And I make all of my students and they can all attest to this. I'm sure some of them that listening or probably shouting at this very moment about me requiring them to do concise public speaking. So that's the first piece. Get used to and comfortable in a setting speaking where you are unidirectionally speaking, where it's not, you know, you are speaking to an audience. It's a different format than if you're an instructor. And it's, you know, bidirectional where you're receiving input and giving back. The second piece is Toastmasters. In fact, Here at unit 42, we have a Toastmasters Club also. And it works out really good to cut your teeth with how to effectively communicate because they'll have you communicating about topics that you may not be familiar with, which is always a fun kind of exercise to kind of come off as an expert on a topic that you may not know anything about.

[C]

And I think those soft skills that you're talking about being able to stand up and talk about a topic and or to move a room of people from one position to another. Right. That's a great presentation. That's a great Toastmasters outcome. Those are skills that aren't just great for an aspiring cybersecurity professional hacker. They're great for any type of career that you're going to be in. And I look at resources like Duarte's Resonate. It's a great book that shows you how to tell a story and to move from what is to what could be. And the jump between those two concepts is data, emotional hook, these kinds of things that our brains come on. And then you bring it back down like, what could be? And then you're like, but here's what is. And then you land at this idea of a new bliss. And you can see great speakers in all kinds of different contexts and industries able to do that. And sometimes I feel like we're a technical field full of technical facts, and we're going to give those facts to people. And if the receiver of said facts doesn't have the ability to translate them into their oh, no moment, they went, oh, I have no idea what that.

[A]

I have no idea. You lose impact.

[C]

Yeah. And then you're not effective as a security leader.

[A]

Yep. Bingo.

[C]

I want to talk about you for a second.

[A]

Okay.

[C]

How do you maintain your sense of curiosity, make time for experimentation in a high pressure role like you have here at unit 42?

[A]

The first is that question that I said early on, what if? I literally ask myself that multiple times daily, still in my current role, and that was as a people leader, as a technical leader, as everything in between. As a researcher, I still ask that question. So the what if question applies across the board. And a perfect example is what if? As an example, what if I automate this task? Right. That right there can speak volumes in terms of being able to get time back. Which leads me to the next thing, which is schedule curiosity. I know that sounds weird, but schedule time for that what if question. Schedule time to hypothesize research and then execute on that research. I still do that. Even 15 years doing research, I still do that because at the end of the day, you have to be constrained in your time, and you have to understand that you only have a certain amount of time to do those things. So the what if question will ultimately, hopefully lead you to that capability of scheduling that curiosity. And then the final piece is embrace intellectual humility. This is something that I think a lot of folks in our industry are not great at doing in some cases, and embracing being when you don't know something. They'd readily admit that, say, I don't know, but I'm committed to finding out what that answer is. And I'll have an answer back to you within 24 hours. That says a lot about someone versus just making up an answer.

[C]

That is a shocking level of confidence when you run across somebody who can admit, I don't know, but I do know how to figure this out.

[A]

Exactly. The smartest and most brilliant people I've ever worked with and met are the first ones to say they do not know. And that's an important thing that I constantly remember. Even today. I mean, I still have healthy imposter syndrome. Even to today. I have imposter syndrome constantly. And I think it's because making sure you have a healthy dose of that intellectual humility to some degree in tech.

[C]

I think we all do. It's a necessary feeling because we're making up a lot of things and making new things all the time. There isn't a moment where you're going, well, I've mastered this skill. Everything that needs to be known about fill in the skill. I don't want to go and pick on weaving or being a blacksmith or whatever. I'm sure that there is innovation in those spaces.

[A]

Yeah, of course.

[C]

But there is a moment where you're going, yeah, we've never done this before. How do we do this? I've never seen that before. Neither is anyone else. What do we do? I'm curious how you encourage that same level of commitment to being creative and curious with your team.

[A]

I mean, it comes down to literally scheduling that time, meaning scheduling research time. Put the time in your calendar block as research time and dedicate the time to that research, ensuring that there's a purpose for the research and there's a deliverable or outcome, ideally. Right. Meaning you're not just researching to research. You have an outcome or a purpose or a deliverable, ideally at the end.

[C]

Are you familiar with the pickle jar story?

[A]

No.

[C]

So this professor walks into class, and he has a big pickle jar, like the ones that you get at Costco or whatever, and he asks the class to tell him when the pickle jar is full, and he puts in a big chunk of stone, and then he puts in one more big rock, and it's up to the top. And the class is like, yeah, you're not gonna get any more big rocks in there. It's full. And he goes, well, hang on. And so then he gets out a handful of smaller rocks, and he starts to shove those in there, and they find little crevices, and they're like, okay, we kind of see where you're going here. He goes, is it full? Yeah. And they're like, well, yeah, you can't fit any of these smaller medium rocks in. And then he gets out pebble, does the same thing again, and he gets out sand, and they're finally like, okay, we get it. It's full. And he goes, hang on. And he gets out a big pitcher of water, and he Pours that in, and it fills in every little bit of the pickle jar. And he goes, what would have happened if I would have started with small things like the water, the sand, the small pebbles, the medium rocks? Would I've ever been able to get the big rocks in? And. Of course not. And he goes, start life with the big rocks. Because if you don't schedule those in as the things that you're gonna go for first, life has a way of filling in with a bunch of nonsense tasks. Little sand, little rocks. I love it.

[A]

Yeah, I like it.

[C]

Cause you could look at your week, your month, year, whatever you're looking at as your time horizon, and go, what's the thing I wanna accomplish? What's the most important thing? And then, as you put it, curiosity. Research with intent needs to be scheduled so that you don't look at your calendar and go, oh, I don't have any time this week.

[A]

Exactly.

[C]

Because too many of those weeks stack up.

[A]

Exactly.

[C]

And then you've done nothing.

[A]

Dingo.

[C]

Looking ahead, what kind of hacker culture do you want to see in the next? Call it five or ten years.

[A]

Oh, okay. Well, I would say I would like to see a culture that is overwhelmingly perceived as. As a force for good and innovation, basically linking creative problem solving and the advancement of secure technology all combined into that term. I would love to see the negative connotation attached with the term to be separated off and kind of originated back to its original term is what I'd really like to see. Do I see that happening? I don't think so, but we'll have to see.

[B]

Well, look, a boy can dream.

[A]

That's true.

[C]

What's one step that our listeners, every one of us, could take to start to move towards that idealized future culture that we should have do what I.

[A]

Do, correct family and friends. So when they say, hey, have you heard about that new hacker that's doing X, Y and Z, or using those types of terms? I correct them and have them try to use correct terminology. So my friends and family are tired of hearing that, but, well, I believe.

[C]

That it is possible. Kyle, you've had a career that bridges research, mentorship, teaching, and public speaking. What values have stayed constant for you throughout it all? And which ones are you still evolving?

[A]

So, relentless curiosity. You've heard me mention curiosity a lot throughout our conversation. And having that relentless curiosity is huge. I think having unyielding integrity also with the research that you produce, because the data will speak for itself, it's accurate or not. So having integrity with the research you're conducting with the data, that what you're doing behind the scenes, et cetera, is extremely important. Knowledge is a shared resource. And what I mean is I fundamentally believe that knowledge gains. It gains value when it's shared. And in this case, hoarding information for personal advantage is a dead end. I see that. And that's something that I try to kind of continually think through and kind of make sure that I'm cognizant of some of the things that are still evolving. That's a difficult question, and it's something that requires me to kind of think a little bit about, you know, myself. But what I would say is the first thing that I struggled with was patients with problems migrating to patience with people. So, meaning I had all the patients in the world for problems that existed in data, problems that existed in the technical realm. But whenever I became a people leader, I was not attuned to understanding the patience with the people aspect. So that was something that was constantly evolving, constantly shifting, and something that I had to acutely be aware of to some degree, I think. Also I used to always focus on technical purity versus pragmatic impact. So, meaning, do you. What is the technical purist route is one way, or you can go option B, get there faster. It's not going to be pure. Maybe might have some inefficiencies or maybe some things that might not be perfect, but it still gets the job done. So that's something that I'm still evolving and kind of shifting my mindset from being a technical purist in the purest sense of the word, and I think also migrating from a right to speak to a responsibility to listen also. So, meaning, you know, you have a responsibility to listen, not necessarily to speak in all settings. Right. So knowing when to speak, how to speak, et cetera, is something else that I'm constantly aware of and is constantly evolving to some degree. So I don't know if that answers your question, though.

[C]

It does. And I'm right there with you, brother Kyle, where can listeners reach out to you or find some of your writing?

[A]

Yeah, so I'm pretty active on LinkedIn and then also pretty active on the Unit 42 blog as well. So I'm blogging there pretty routinely and updating my LinkedIn pretty continually with everything from new job postings all the way down to research that the teams are conducting.

[C]

So, yeah, I'll go ahead and make sure that those are in our show notes. Kyle, thank you for coming in.

[A]

Yeah, thank you.

[C]

And during the hot seat, while we get to know Kyle Wilhoyt a little bit better. This has been an absolute pleasure of a conversation.

[A]

Likewise. Thanks David. Really good time.

[B]

That's it for today. If you like what you heard, please subscribe wherever you listen and leave us a review on Apple Podcasts or Spotify. Your reviews and feedback really do help us understand what you want to hear about. If you want to contact me directly about the show, email me at threatvectoraloaltonetworks.com I want to thank our executive producer, Michael Heller, our content and production teams, which include Kenny Miller, Joe Benecourt and Virginia Tranquil. Original music and mix by Elliot Peltzman. We'll be back next week. Until then, stay secure, stay vigilant. Goodbye for now.

[A]

Sam.