← KBKAST
KBKAST
Episode 376 Deep Dive: Anna Wheeler | Synthetic Confidence - When the Board Believes the Machine
00:39:54
In this episode, Anna Wheeler, CEO of SSAW LLC, joins KB as she explains why so many cyber teams are stuck in event-driven strategy while calling it the real thing, why the doers can’t climb out of it because their KPIs won’t let them, and why visionary CEOs keep getting ousted when the board can’t see what they see. Along the way: the CEOs quietly burning more AI tokens than anyone else in their company, vendors winning unicorn exits on marketing rather than technology, adversaries stealing encrypted data as a long game, and what happens when boards start making decisions on synthetic confidence. Her closing advice for leaders: get very comfortable with being uncomfortable, and go looking for the sources you’d normally avoid. About Anna: Anna Wheeler is a cybersecurity strategist and former Army Blackhawk crew chief who has spent the last two decades helping government and industry modernize how they secure missions, data, and critical infrastructure. She has led federal moderniza...
Loading summary
Transcript56 lines
- [00:00]
A
So as they start asking the questions, some of it's a lack of understanding. Some of it's because that's what shareholders are looking for. Some of it is the fact that they're trying to get smarter on it, because that's the. Those are the questions they're being asked. And some of it is because they want to play with it. I've heard from many, many companies that the largest consumer of their Tokens is their CEO.
- [00:27]
B
From KBI Media, I'm Carissa Breen and this is KBCast. My guest today is Anna Wheeler, CEO of SSAW Consulting. Anna builds strategy for bonds and C suites and spent years Inside Symantec watching 250 point products compete against each other. We get into why? What are we doing with AI is a question and not a strategy. What synthetic confidence does to a boardroom, and why the CEOs who see the future too early keep getting ousted for it. If today's episode lands for you, do two things. Hit follow and send it to one person in your network who needs to hear it. That's how shows like this grow. Okay, so, Anna, I'm really curious to understand. When executives say, we need an AI strategy. And I say that for people who can't seem in inverted commas, are they usually asking for strategy or are they asking for permission to chase a trend they perhaps fully don't understand?
- [01:35]
A
I think there's a combination, right? So oftentimes, instead of an AI strategy, what they ask is, what are we doing with AI? They go to the CISO and say, tell me how we're implementing AI. And they don't have the continuity between the business case, Right? If you go to somebody who's a technologist and say, I really need AI implemented to mainstream our hiring process, right? That's a business case. The technologist, whether that's a pm, whether that's a ciso, whether that's a tech guy, whatever, can do something with that. But to turn around and say, what are we doing with AI? That's chasing the trend. And it's been a really interesting conversation because CISOs are getting a lot of those questions, what are we doing with AI? How are we securing AI? Is AI a threat? Is it not? How is it helping us? And without being able to boil that down and get more specific, it's a very difficult question to be able to answer. Kind of like, what are we doing for cybersecurity?
- [02:37]
B
And I mean, it's a broad question to ask because it's like, well, what are we doing? Okay, what Part are we doing? Like you said, is it recruitment? Is it about technology, is about marketing? Do you think it's just because they know they've got to do something, whatever that is. So it's okay, we'll just ask the siso, see what they say and go from there.
- [02:55]
A
So I think part of it is the idea that it's a magic pill, right? Turn around and AI is going to do this and AI is going to do that. AI is going to hurt us, AI is going to help us, AI is going to cost jobs, AI is going to make us better. AI is going to do all these things and they don't necessarily have the understanding or the accurate understanding of A, the different types of AI, B, the fact that AI implies an artificial intelligence, and there are some people who are convinced it's here, and then there are quite a few of us who are like, it still has guardrails, it still has parameters. You still have to work it through based on the data sets and ask it it's advanced code. And yes, it can write its own code, but only within the rules. So is it AI? So, so as they start asking the questions, some of it's a lack of understanding, some of it's because that's what shareholders are looking for. Some of it is the fact that they're trying to get smarter on it, because that's the. Those are the questions they're being asked. And some of it is because they want to play with it. I've heard from many, many companies that the largest consumer of their tokens is their CEO.
- [04:06]
B
You mentioned something before and you said that's sort of what the shareholders are looking for in terms of like, what are we doing with AI? Does that almost imply a little bit of virtue signaling? Because it's like, well, that's what they want to hear. So even like before, do you remember, like, even like 10 years ago, I was like, what are we doing with cybersecurity? It's the same sort of thing. So is it just it appears to the outside world or to whoever internally is a good question to ask. It wins them good brownie points. But in reality, it's kind of like we may do something with AI, but we're not sure. But if I ask the question, it makes me look really good.
- [04:38]
A
I think it's more they don't want to get caught unaware, right? So they don't want to be caught in a situation where everybody's talking about AI. Their competitors are saying, I just got this much better return because I used AI, you know, with these really kind of obscure language. And then they're like, but did I miss something? Like, so it's part fomo and it's part of. It is part. They don't want to get caught unaware. But it's definitely. They're also afraid they're going to miss something. And the roles of board members and executives is having to change so rapidly right now. It used to be a good CEO knew how to take care of people, knew how to state a mission and knew how to deliver. And if you could do those things and you could figure out how to scale that, then you were a good CEO. There are so many companies right now who are having to look at their overall strategy and decide, what do I even look like in five years?
- [05:38]
B
Yeah, that's a good point. And even from a media point of view, like, things are changing, like constantly, like week to week, day to day. It's really hard. I want to talk about the word unaware or aware being the operative word. I was interviewing someone last week and they said the only way for people to fully understand it is to literally, like, get your hands dirty, start leveraging it yourself. Like even, perhaps even listening to podcasts like, this is not going to be enough for people to fully understand it. Full fidelity. Would you agree with that or what are your sort of sentiments?
- [06:10]
A
There's a million out there right now. You see them all over LinkedIn. You see the different podcasts or small clips where people are like, stop using it. Like a Google search bar.
- [06:20]
B
Right.
- [06:20]
A
So if you're going to dive in and get your hands dirty, deciding having an idea on how to do that or which resources are available or even what it's capable of are the only way that will be beneficial. But I don't think I've ever met anybody who has an academics understanding that had a leg to stand on.
- [06:41]
B
That's a good point. And I think that even if we go back like a decade, even people were arguing in the industry around while people that have got runs on the board, that have actually worked amongst it, have probably got a lot more understanding of cyberverse and academic. I learn in theories and books, but I've never actually practiced it. So do you think the same sort of approach then applies here now to AI so as people can understand it and listen to these shows and read stuff, but at the end of the day, it's pretty much rubber needs to meet the road.
- [07:12]
A
It does. And the nice thing about podcasts like this or things you see online is really trying to give people the encouragement and the confidence to go out and play with it. We have just watched a huge kind of conversation coming out of the White House versus anthropic versus not. Now there's a competitor to blame. All these things like. And then everybody takes this kind of grain of what's happening and paints it with their own brush. They're not looking at that big picture. So if you look at the big picture on, are there going to be limitations? Are there going to be risks? Are there going to be letting these large language models loose? Are there going to be issues with that? Well, absolutely. The bad guys use them, but the good guys use them. So being able to be more precise in the questions, being able to get a focus on if you are an executive and you've got somebody coming in saying, hey, our marketing team is finding everything's getting kicked back because email filters are getting better. Okay, well, what do we need to do with that and why are email filters getting better? Oh, well, those areas are starting to have AI incorporated in them, so it's harder to get around. Okay, great. Well, that's the same thing that was happening with resume filters. Resume filters were knocking resumes out because you didn't have the right keywords. And then people got smart on how to match keywords. We're just at this stage where it's. I won't call it an infancy, but it's definitely a different difference between a walk and a run. And the companies that will be successful are the ones that are building this in at the core, as opposed to strapping it on with a. What are we doing about AI?
- [08:53]
B
Okay, that's interesting. So how would you approach building it in at the core? I'll give you an example. If you're like a legacy enterprise that's been around for 50, 100 years, how do you start to embed that at the core when it's like, well, we've got. Got really old legacy debt, really old technology that we're running critical systems with, haven't had a patch that's been able to patch any of this stuff for 20 years. How does that sort of conversation then work to really embed that in at the core, just. And then to obviously not strap it on and hope. Hope for the best?
- [09:25]
A
Well, I don't know that we're going to see companies revitalizing their infrastructure from the ground up. If legacy is where they're. They're sitting, they need to have a complete modernization effort and then build AI into the modernization effort. So I think those are two very different kind of sides to the same coin where if you're not patching, you're vulnerable, period. And I have certainly been at organizations, particularly I hate to say it, in the government space, where they hadn't patched a server in eight years because they were afraid they couldn't get it to come back when they restarted it. And eventually it fails, right? So why not instead turn around and start looking at these high risk servers, high risk parts of the environment. And as you come up with that modernization plan, build in where the AI can be more efficient. So you're, you're not just putting a new golden image out there and throwing up a new server, you're turning around and figuring out how that needs to integrate into a unified business plan for the enterprise as opposed to before where it's, I'm going to put this piece of hardware here and I've got to put this piece of software on it.
- [10:36]
B
You've described three levels of strategy, which is tactical, journey and destination. So I'm curious to understand why are so many cyber teams still stuck perhaps in tactical mode while still calling it strategy?
- [10:52]
A
So I realized that calling it tactical bothers a lot of people who are operating on a day to day. So I've refined that a little bit to be event driven strategy.
- [11:05]
B
Right.
- [11:05]
A
The event can be I've got to install a new program or I've got to install a new vendor, or I've got to get something out of the environment or it could be I've had a breach, let's kick off the playbooks and you'll see the people who manage those say, well, the fact that we have playbooks and we refresh them and we do these things and we're trained for them, we're prodding the user for the security side and for the user threat, we're doing these drills. They all call that a strategy and that's all event driven. It is a strategy, There is a plan. And if that's how they want to define strategy, then perfect. So if you have this kind of event driven strategy, again, whether it's something positive like refreshing or empowering the workforce, retraining and all of that, or if it's bringing in new tools or if it is embedding AI, what does that look like? There's your event driven piece. And most places that are not at the executive level, they can't come out of that because their day to day is exactly what's relying on getting those things done right. They are doers, they are driven by accomplishment, their KPIs are what have you done for me lately? And that's just how the system is built to work. So for them to turn around and not do a task that keeps something going that they have to report on is just not how the metrics are incentivizing them to perform. So event driven strategy, your PM is there to be a pm. Your tech support is there to be tech support. And yes, they can build some of that, hey, this would be great. But they have to go get buy in, they have to go get a champion, then they have to go find resources. And to put that on top of what is always a strained ecosystem of human resources, particularly at that execution level, it's just far too far. Right? It's just not a viable ask. Whereas your executives are supposed to be looking ahead, right? They're supposed to be looking at that journey. How do we get where we need to be is where we need. And then you've got the destination, which is where do we need to be? Right. So your executives kind of operate in those upper two levels. And your day to day executionists, like they have to be down here executing. And oftentimes if they try to step out of that, something has to give because they've got a limited capacity.
- [13:30]
B
Let's talk about the destination side of things again, a little bit more detail. Do you think people just don't know what their destination really looks like? Because it's like, okay, we need to be strategic like you said, but there are still people that need to be doing the operations on the ground. But would you say because things are moving so quickly now, maybe a, the goalpost moves so that destination looked ideal this way, then next week it changes. So that's a problem. Then equally, it's like, are people just driving in a, in some direction? But it's like, well, we maybe just fumble along until we get to the destination.
- [14:05]
A
So again, you have people who are just forward thinkers, right? And it's how their brains work. I'm not capable of thinking inside of a box. So that is why those are the types of strategy that most appeal to me and where I can really move the needle. And the biggest challenge I have is articulating that to the people who don't think that way. So Elon Musk can sit there and say, I'm going to go do this and people think he's mad. But they used to think the same thing at Apple, and they used to think the same thing at AT&T, and they used to think the same thing at all. Of these big blue chip stocks, the people who could see outside of that are rare and they're not celebrated until the success. Until you can't argue with success. So if somebody turns around and says, I want to go do this, and people look at them like they're mad, then they don't get funding, they don't have the support of the board. I can think of three companies off the top of my head right now who had CEOs who saw what the future needed to be. And they got ousted because they couldn't convey that in a way where the board understood it or the executives knew how to execute it. So that vision gets really close, cloudy, if everybody can't see it. So you also have to be judicious in how you present it. And you have to get people to buy into the milestones on the way which they think are the destination.
- [15:33]
B
Okay, this is interesting. I love what you're saying. So how would you go about it then? Because you said that you obviously think outside the box. You think more like a strategic thinker, equally, you know, no one can go at it alone. We still need to take people on the bus or the journey or however you want to phrase it. What are some of the things that have worked for you then over in terms of your career to articulate what that destination, Even if people think you're crazy, perhaps. But there's little junctures that in which that's like, okay, we've hit this stage, you're now at the next stage, but you're still driving it from 50 miles. And each mile that's a little, little win.
- [16:07]
A
So part of it is, whomever I'm working with, there are visionary leaders and they get it, and there are strategic leaders and they get it, and then there are the rest. Right. And it's not that there's anything wrong with that. It's just that it's a different way to communicate and sometimes you can't. I was brought in on a project one day. They needed a strategic. They needed somebody to write a strategy on how to go after something. Like they wanted to go to a customer who didn't know their name and was not really out, like was not really open to speaking to, to vendors. They wanted a contract. It would have been the largest to ever come out of that group. They wanted all of these things and they asked me to build the strategy and I built it. And I had great leaders in the beginning. And then they did a deck shuffle and we got new leaders. And some of them were still Very good. But that's not how they were wired. So you start explaining kind of that destinational journey or even the actual like you know how to get there and you just, you lose them. There used to be the saying, only give people three things their brain can't process. More than that. Well, if the three things, if here's the end goal and the three things don't lead to the end goal in a way that they can connect it, you haven't communicated. So sometimes it's just choosing your communication path. And it also depends on all. Communication is not about putting information out, it's about having information in a way it can be received. And that I think is the biggest challenge for strategic thinkers.
- [17:41]
B
We'll come back to that after a quick word from our sponsor. Selling SaaS to Enterprise. You'll be asked about your security credentials sooner or later, likely before the contract's even signed. Vanta helps SaaS teams prove their compliance and frameworks like ISO 27001 and SoC2 without losing months to manual prep. Visit vanta.com kbcast that's V A N T TA.com kbcast to learn more. And then on that note, Anna, would you say because of the world that we live in today, and what I mean by that statement is more so companies now need to be super competitive with how they're going to market because why people aren't super loyal to banks like they were 40, 50 years ago. So it's like faster, cheaper, better people are going to go there. So. So there's obviously now more pressure put on leaders to be able to have these. Strategic thinking, would you say, like as a skill, this is going to become even more paramount simply because you need people like the outliers to be able to think, even if it comes across a little bit mad and crazy. But these are the people that are going to potentially sail a company through the next wave. Because what's interesting to me in terms of observation is look at these big AI companies. One minute they're top dog, next minute they're not. And that was very volatile. That wasn't over a man of years where they sort of fell to the bottom. It was quite quick. So I'm taking a step back and interviewing people like yourself to really get into the minds of what can businesses do to make sure that they obviously need to stay on top. So I'm curious then to get your view on leaders now moving forward and what does that look like given the current climate we're in.
- [19:29]
A
So one of the problems is the companies that fall quickly, that's a shareholder reaction. That's market. So you have to walk a fine line as a leader. And I don't envy a lot of these CEOs, because it's. I had a CEO recently tell me, he goes, anna, why do you want to be a CEO? This job sucks. And I said, well, I like to build and I like to lead. And he goes, I wish it were just building and leading. And he said, but it's not. It's balancing investors. It's answering shareholders. It's. It's getting the executives on board. It's, you know, driving the bus as opposed to just sitting in the back with a chauffeur like everybody thinks it is. And he really dove into the fact that you have these. These pieces. And even if you can see it, you never know. You can lose the board in a heartbeat. You can lose shareholder with a news cycle. You can watch policy shape your world. It can come out of nowhere. And where the strategic thinkers come in is to help you see where those rocks are down the road. Like, don't get in the rapids and not know the rocks. Your executive team are going to be your oars, and the company's the boat. But you have to stay away from the rocks and the branches and the sharp edges or else you're going to pop the boat and you're going to sink. And that, I think, is what we're really seeing. We're seeing this market whiplash that's already got variables the market's never seen before. Models that have been tried and true for, from a professional standpoint, generations, aren't accurate right now. You know, we. We expected the pandemic to have certain effects, and they came out differently. We expected the different wars to have certain effects, and they've come out differently. We've expected different political outcomes and different economy outcomes and all of these things, and none of it's working the way that it should according to the old models. So executives have to be willing to step outside and look at the old models, and they have to be able to raise their hand and say, I need an extra set of hands or an extra viewpoint, because there's a lot going on and there's more than I can handle.
- [21:39]
B
And so when you say variables, do you mean that in terms of people wanting it, just the volatility in the market, like we mentioned? And then also like so many random things have sort of occurred suddenly as well that perhaps we hadn't seen over the last 10, 15 years? Things are relatively Stable. There's a lot of things coming out left field, whether it's geopolitical driven or whatever it is. Is that what you mean by variables?
- [22:03]
A
No, I mean, I mean some of them, those are certainly impacts when you watch a company go from on top to on bottom overnight. But you also look at AI. AI has been a huge variable and the previous one to that was cloud and the previous one to that was actually in between the two, we got a lot more ransomware. Right? Like there's all of these pieces that are flipping things on their heads. We've watched physical theft of hardware affect a company. We've got a population who is so the fatigued from hearing how everything's a threat and everything's bad that we accept some really stupid risks on our, in our personal devices, on our, in our personal lives. You used to be able to have this amazing argument between Android and Apple. When it came to your phone and security, people were like, oh, you go Apple because you can't get kernel access. And anybody who like developing and like to do their own thing, but they're like, but I love kernel access because of Android. And that was the extent of the conversation. And then you looked at it and maybe they weren't writing malware to Apple because you didn't get kernel access. Right? Like there were all these pieces. Well, AI is changing all of it. The fact that we've got geopolitical turmoil, we've got apps that are collecting bio data that are owned by countries that are, that are definitely proven to be up to no good. We've also got geopolitical issues where people have no problem stealing encrypted data because there's going to come a point where those encryption codes are going to be easy to crack. They're playing a long game. So we're looking at all of these variables and they all come into play and it's too much for any one person to look at. It's too much for any one person to have a crystal ball. Somebody really just needs to hope that Marty McFly rolls back and has like the betting ledger in his hand with. Here's what happened with cyber security over the last 50 years.
- [23:54]
B
Sports Almanac. Yes, I remember that exactly. Everything you're saying is really interesting because these are some of the observations that I have started to think through and have seen by interviewing people like yourself. Would you say that some of these leaders, by becoming top dog all of a sudden? No one cares. You've been relegated to the bottom very quickly. Is this starting to cause A lot of angst for these players, for these leaders. And then is it rattling people to be like, hang on, one minute I was king of the hill and now no one wants to know me anymore? Like, how, how does that go in terms of, yes, ego, but just more so the whole ecosystem.
- [24:31]
A
So what's really interesting is you're watching some of these people get, we'll say, dethroned. They're not losing influence, they're just shifting which throne they're going to sit on. I've watched some of these CEOs who, they get pulled and next thing you know, you've got 15 people banging on their doors going, I would love to have your help because you're an amazing leader. And there was just this moment, right, because keep in mind, a lot of these people and these companies, like, if they go from top to bottom or bottom to top, it's not necessarily because they've done anything right or wrong. It's because the market had a reaction. Things that should have buried a company haven't. Things that have buried a company shouldn't have. And that goes for the people as well.
- [25:15]
B
So, okay, here's a question for you. Do you think it's anyone's game out there? Look, let's look at tech or cyber market. What I mean by that question is you could literally be the underdog. No one knows about you. All of a sudden something happens, you just become the top player. It's something that even over the last 15 years, we've, we would have seen the same old players. You know, they didn't really move. They've been top dogs, king of the hill for the year. But now we're seeing these companies literally spawn from nowhere. And then all of a sudden it's like, they're like the main player now. So do you think that it's creating more opportunities perhaps for these out the box thinkers that are like, oh, I've got this idea, I got ousted for my last company. Now I'm going to credit myself and I've got a very good idea. And I know this is what the market needs and I know I can drive it to get on my own throne.
- [26:03]
A
What we're seeing a lot of is what these leaders have learned is who to trust and who to go on a journey with. Right. I have watched now multiple companies where a CEO has been removed because you had somebody who didn't even understand cyber on the board drive that removal. Whether it was a VC or a PE or majority shareholder, co, founder, whatever. I've seen companies where somebody gets elevated very quickly. We've seen technologies who aren't best in breed, but they're best in marketing have unicorn exits.
- [26:39]
B
Right.
- [26:40]
A
We have seen great companies die because they didn't put the money into marketing. Right. So those, the go to market strategy. I was speaking to a CEO who I think the world of and I really enjoy anytime I get to work with them. And he said, Anna, you know what I realized? He said, having a chief marketing officer does not mean I'm not responsible for the go to market strategy.
- [27:03]
B
Right.
- [27:04]
A
He said, I thought that's what they were for and I had to approve it. And he goes, and I have spent six months getting really smart and they just, I think they're just launching their go to market now. But he turned around and I mean it was. He used AI, he leveraged industry best, he tailored it to everything he needed and he poured his heart and soul into it. And I looked at it, it's impressive. You're not going to see that from a cmo because it didn't just take into account his executive viewpoint, it took the customer viewpoint, it took the board viewpoint and it gave everybody what they needed throughout the cycles. And so I think we're watching executives, particularly the C suite and very much CEOs and board members as well, have to come up with new skill sets. You know, you used to be able to go on a board because of what you had, who you knew or what you knew, and usually a combination of all three. Usually one thing wouldn't get you there. And now we're seeing that that isn't always enough. It's how can you adapt? How far can you look ahead? What do you see that nobody else sees? And the executives, whether it's the CEOs or the board members or whoever, are going to be more successful as they keep that in mind instead of the previous I'm the only captain on this ship.
- [28:22]
B
So what you're sort of saying is, what was that Mark Twain statement? It's not the size of the dog that wins the fight, it's the fight within the dog that wins.
- [28:30]
A
Pretty much it is. And it's going to be that way. From an adaptability standpoint, can you look ahead if your baby's ugly or not? Right. If you're a technology company and you are a homegrown technology, you have to be reassessing your technology. I've got a couple of companies who, they've looked at it and they said, you know what? We're not building AI into the technology. We are rebuilding it with AI at its core. And that's what they're also working on in concurrent with, with keeping everything moving. And it's been absolutely phenomenal that what you can design in six to eight months, you can design in six to eight weeks.
- [29:10]
B
So, okay, question then would be with, do you think any of these vendors wake up and get my baby's ugly, meaning my technology is ugly? Do you think that because for someone who works very close to vendors and all this sort of stuff like, do you think these conversations are happening that you and I are privy to? For example, are they really assessing it? Because everyone's trying to say, well, we're market leading and we're in this quadrant and whatever else goes around it. But would you say that really they are trying to assess, to say, well, we should probably improve here because our stuff kind of isn't best of breed anymore. It's a little bit old hat.
- [29:46]
A
It depends on their business model. We watched some huge companies that turned into acquisition companies, right? Like I was at Symantec, we had 250 point products that competed against ourselves. Oftentimes when we acquired something because it was part of a marketplace, we didn't necessarily integrate it. And so then we had these shelved products that were actually really good and then we had other products that we were just so in on the marketing and we were so afraid to disrupt our own supply chain for our customer base that, that we fell flat. And they had a couple of acquisitions that didn't pay off and then they had the Blue Coat acquisition where the Blue Coat leadership was able to kind of wrangle control. And so you look at those things. So they all vary, right? And it's not even calling the baby ugly.
- [30:36]
B
It's.
- [30:36]
A
This is going to be a really awful comparison because this is one of the books we had to read in high school. But if genetic enhancements are coming to children, do you decide, do you want the genetically enhanced kid or do you want the one that's naturally born? And that's almost the same conversation these founders are having to look at from their technologies and their platforms.
- [30:58]
B
So, okay, I'm curious now to understand you dislike fluffy commentary and vendor driven conversations, which is true. What is sort of the cyber industry too afraid to say out loud. Then what are your thoughts?
- [31:13]
A
Oh, they're afraid to say what they don't know and they're afraid to be wrong. Right. I recently got to speak to somebody who's an amazing red hat or white hat, probably one of the top in his Region, easily, if not globally. And he sat there and he had a conversation with a bunch of CISOs and he says, I'm not going to pretend what I'm going to tell you is going to be right. He said, this is what I'm seeing right now, but it could change in a day, could change in a minute. And so. So he said, here's what I'm seeing, here's how I feel about it, here's what I believe is going to happen. But if you'd asked me six months ago, I would have believed something different. So being able to say here's what the market's doing and here's where we're headed used to be a 10 year conversation and now it's not. Now it's how do we keep the processes in place so we have continual feedback loops so we actually keep our pulse on the market or our finger on the pulse of the market. How do we understand our customers needs and make sure we're listening instead of writing them off as one offs until we hear it so many times we can't. So there's a lot of these pieces where we just need to be able to say these are the things that matter to me right now. Knowing that they might not be the things that matter tomorrow.
- [32:25]
B
What do you think at the end of the day really grinds people's gears
- [32:30]
A
in the market about vendors, vendors who can do anything. I have some very, very dear friends who are CISOs and they're like, don't come in and tell me you can solve the world. Don't come in and tell me you can do something that is a roadmap. Don't come in and tell me something that you can't show me right now. And then don't tell me I have to make a five year decision today, knowing that five years from now is going to look different. So I think a lot of vendors are hearing that and a lot of vendors are kind of being shaken to their core. But you also have where a lot of things are getting really interesting, where things that that had always mattered and they do still matter, aren't getting the traction, never did. Like, like sbom.
- [33:12]
B
Right.
- [33:12]
A
Software bill and materials. Knowing what's under the hood matters. The federal government figured it out when they outlawed Kaspersky or when they banned Kaspersky. And I don't think they did that well by saying every vendor who has Kaspersky under the hood raise your hand so we can rip you out. Not much of an incentive as opposed to saying everybody who Has Kaspersky give me your plan to get it out and then assigning risk based on that plan and then holding vendors to it. But again, vendors are, operate. Are tactically operating, right? Like, you have a sales team, you have an engineering team, you have a customer success team. They're all being pushed on. What have you done for me lately? What are you doing for me in the next week? What are you doing for me this quarter? So having those big deeper conversations, and a CISO, also. A CISO's time is so valuable because they have so many things going on. They're answering up, they're answering down, they're managing laterally, and they're liable for things that aren't even in their purview. They'll be the sacrificial lamp for. To ask them for your time to help you improve your product is a big ask. And if they're willing to do that for you, it's because they believe in you. And I don't know that vendors always appreciate that or exhibit that appreciation as well as they can. But that level of response and appreciation, if they show that to their customers and they show that to their development teams, they're halfway there.
- [34:44]
B
So, Anna, final question. If AI produces what people want to hear rather than what is true, what happens when boards, governments, security teams start making decisions potentially based on synthetic confidence?
- [35:01]
A
Then I'll raise you an ante on that one. What happens when somebody compromises what's true? Right. What happens when somebody compromises a data source? What happens when somebody convinces that AI or that algorithm that what it wants is more important than what you want? And so this concept of synthetic confidence is absolutely accurate. I love that term, by the way. I'm totally going to steal that, because it's kind of like when you watch. I don't want to. I don't want to say a child who's convinced that something's true because they just don't have a more experienced knowledge base. But it is kind of similar where you watch somebody who comes in, they just cannot be moved by any logic, by any other data, by any other anything. You cannot move them off their opinion. And part of that is ego, because they don't. A pivot would mean that they've had to reassess where they came from. A lot of CEOs have stifled companies because they don't listen to any voice but their own. And being able to come in and say, hey, look, you have this set of data and this all makes sense, but this little piece over here is the outlier. That outlier might be your key to bringing sanity back to that synthetic confidence.
- [36:20]
B
Because I think the thing that's interesting to me and I've spoken about this example, is these people that think the earth's flat. And so these flat earthers or whatever you want to call it. Imagine if there are so many sources out there that were trying to tell people the earth is flat and then that's what shows up on Claude or ChatGPT or whatever be using. People will start to think actually it's true now. And that to me is what is engendering that synthetic confidence. In fact, that is not true. But now the machine says it's true. And I don't have to your point, the child that level of discernment to really do my own research and inverted commas to be able to understand this in more fidelity to uncover, well, is the earth really flat or not? And let, let me go to those data sources to understand that. But if we expand that out, this is where I think things are going to get really interesting in terms of there are ways to manipulate those answers that show up in these LLMs.
- [37:18]
A
Unfortunately, the easiest example of this is the media globally. I don't know if the chart still exists. There used to be a chart and it put political leanings and accuracy in all this. Left to right, fact driven in the center. And you saw this big spread like you knew the tabloids were way over here with like, let's just make stuff up. But you knew that. But that doesn't mean people didn't read them. And we're to a point now where we've watched the media do it all over the world. Left, right, in between, doesn't matter. All of it's happening and people. It's human nature to surround yourself with people who make you comfortable with your ideas. And I would say the people who are going to keep kind of a true north are going to be the ones who get really good at being uncomfortable with their ideas and surround themselves with people on any side of the viewpoints. And again, this isn't meant to be political at all.
- [38:20]
B
It's.
- [38:21]
A
It's exactly what we're seeing in the algorithms.
- [38:23]
B
If you go.
- [38:24]
A
And you know what, here's a great example. When I was a kid, I went on a foreign exchange student program to Denmark and I stayed with a host family who, the parents didn't speak English, but the kids did well. Then I met their friends who didn't go to the same school and they didn't have an official language program. So they learned English off mtv, particularly a lot of Beavis and Butthead. It was a very different outlook and a different way they communicated. And that is absolutely what we're gonna see with bias and algorithms. It's what we see in the media. It's these things where if that's all, you know. So leaders are going to have to get very comfortable with being uncomfortable and really searching for the things they don't know, particularly from maybe from the sources that they wouldn't normally look at.
- [39:11]
B
That was Anna Wheeler, everybody. The line I can't shake is at the question every board keeps asking, what are we doing? Doing with AI isn't strategy at all. If you sit on a board, flip it. Next time, don't just ask, what are you doing with AI? What is your problem you need to solve? Then hand your technologist something they can actually build. I read every reply. If you got some thoughts on this one, send me a message on LinkedIn. Kbcast cyber for the c suite.