Bearded Faces, Bald Heads, and Bold Cyber Insights

By
Josh Peets
-

What happens when you gather a panel of security leaders who all happen to be bald men with beards? You get some beard grooming jokes, but also some hard-won insights from decades of navigating cyber leadership.

In June, the CISO Series hosted its monthly Reddit AMA (Ask Me Anything) on r/cybersecurity. The theme?

“I’m a CISO/Security leader. I’m also a bald man with facial hair. Ask Me Anything.”

While the setup was tongue-in-cheek, the answers were anything but. From leadership alignment and burnout to vendor lock-in and security telemetry, the discussion covered the very real challenges CISOs face, and the strategies they use to lead effectively.

A big thanks to our participants, listed here:

Here are some of their best takeaways from the AMA.

1. Haircuts are cheap. Good security isn’t.

Q: Does being bald bring any advantages in cybersecurity? Asking as a guy with a receding hairline.

“I spend no money for barbers and I can get ready in less than 5 minutes because I don’t have to brush my hair. Efficiency and cost savings are good lessons for cybersecurity professionals.”

— Michael Farnum, founder and president, HouSecCon

“You’re not distracted by the superficial… All attention on cyber. All attention on protection… You’re going to be so good, you’re going to get tired of being so good.”

— Jason Fruge, cybersecurity advisor, Risksilience LLC

The jokes landed, and the message was real: confidence, clarity, and presence matter in leadership roles. And a little humor doesn’t hurt in this industry.

2. Know the job you’re actually signing up for

Q: Why do CISOs get fired when a company gets hacked?

“Sadly, the CISO becomes the scapegoat. This is why it’s critical to thoroughly document your GRC program… get Board/Senior Leadership signoff on risk tolerance… and maintain your own CYA documentation.”

— Todd Hughes, senior compliance analyst, Harbor IT

“Culture is a combination of what you celebrate and what you tolerate. Reward the behavior you want repeated and hold people accountable who exhibit behaviors you don’t want.”

— Jerich Beason, CISO, WM

“You are not protected. Have D&O insurance. Severance package pre-negotiated. Personal Legal Liability insurance. And make sure everything is well documented.”

— Andrew Wilder, CISO, Vetcor

Getting blamed may come with the title. Knowing how to protect your reputation—and your livelihood—is part of the job.

3. What ICs don’t see from the CISO seat

Q: What do security engineers at the IC level not see that CISOs see?

“Usually business alignment issues and budget constraints. CISOs have to directly take the needs of the business into consideration when making decisions… People deeper in the trenches don’t usually have those conversations.”

— Michael Farnum, founder and president, HouSecCon

“As a CISO… I am talking to the business, educating the executive team and board… and getting feedback about where the company is going… I look at my security program as a service organization. We are there to serve the business.”

— Gary Hayslip, CISO, Softbank Investment Advisers

“As a CISO my role is to set the team on a path and remove any obstacles while they focus on executing… I’m looking around the corner strategizing and gaining support for the next path I set the team on.”

— Jerich Beason, CISO, WM

Security leadership requires strategic vision and patience—and that perspective only comes with time and access.

4. SIEMs are evolving—but so are expectations

Q: Favorite SIEM? Is SIEM still useful?

“I’m going to go old school and say Nitro Security. It used Flash… Searches were crazy easy. And it looked really slick. But, yeah, Flash… That was a bad idea ultimately.”

— Michael Farnum, founder and president, HouSecCon

“I honestly believe… SIEM will not exist in 5 years. It will evolve into something very different than what is currently on the market due to AI.”

— Gary Hayslip, CISO, Softbank Investment Advisers

“We need some of the capabilities that SIEMs provide but we don’t need SIEMs anymore.”

— Fredrick Lee, CISO, Reddit

“Do we still need a SIEM? Why not put all of your security telemetry in a data lake and build an LLM to query it?”

— Andrew Wilder, CISO, Vetcor

The next generation of security tooling will be shaped by data engineering and AI—not dashboards.

5. Avoiding vendor lock-in

Q: What do you think of big platform vendors like CrowdStrike or Palo Alto trying to own everything?

“I am not a fan of platformization. Think MS and E5. Once they get their tentacles into you, trying to rip and replace becomes next to impossible… That’s why I like to keep my stack as fluid as possible.”

— Andrew Wilder, CISO, Vetcor

Follow-up Q: Are you going SIEM-less?

“I am considering the idea… But at this point it means that my SIEM is not the same vendor as my EDR or my mail provider… If my SIEM vendor were to be bought… it would be pretty easy for me to get out.”

— Andrew Wilder, CISO, Vetcor

Vendor consolidation may look convenient—but flexibility and exit strategies matter more in the long run.

6. The CISO is not your frontline engineer

Q: Should a CISO engineer security tools or certify existing solutions?

“A CISO should be ensuring the overall cyber program aligns with business needs. So in a sense that is both of what you described above… At the end of the day, security (and a CISO) exists to serve a business purpose.”

— Edwin Covert, vp of advisory services, Fenix24

“A CISO should not be the primary line of defense… Engineering of requirements versus engineering of solutions, essentially.”

— Michael Farnum, founder and president, HouSecCon

“The CISO serves as a second-line resource… implementing a security strategy that avoids overall business disruption from cybersecurity incidents.”

— Jason Fruge, cybersecurity advisor, Risksilience LLC

“This depends on the type of CISO the organization needs. Early stage companies need more hands-on CISOs but CISOs in the Fortune 500 spend more time interfacing with execs.”

— Jerich Beason, CISO, WM

The definition of “CISO” is shifting—but alignment with the business is the throughline.

7. Five things every security leader should know

Q: Can you make a top 5 list of DOs and DON’Ts?

“1. Know WHO’S in your enterprise
2. Test your recovery plans often with realistic assumptions (annually is insufficient IMO)”
3. Know WHAT’s on your enterprise
4. Know HOW fast your team can respond to an incident
5. Know your backups are actually immutable”

— Edwin Covert, vp of advisory services, Fenix24

Final Thoughts

This month’s AMA combined humor and honesty in the best way. The “bald beard brigade” may have been a lighthearted theme, but the insights were serious. Leadership, communication, and resilience came through as the true differentiators of today’s security leaders.

Read the unfiltered discussion directly on the Reddit AMA page.

Join us next time!

Our July AMA is coming soon:

“I’m a security professional who has worked in and out of Government roles. I can tell you the pros and cons. Ask me anything.”

July 27 – August 2, 2025

Tune in on r/cybersecurity and stay connected with CISO Series to participate.