Sales is a tough job in cybersecurity. But does that make it okay to bombard a CISO for a meeting?

Check out this post by Marc Ashworth, CISO at First Bank for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Shawn Bowen, vp, deputy CISO – Gaming, Microsoft. Joining us is Ken Athanasiou, CISO, VF Corporation.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Noma Security

Full Transcript

Intro

0:00.000

[David Spark] Sales is a tough job in cyber security, but does that make it okay to bombard a CISO for a meeting?

[Voiceover] You’re listening to Defense in Depth.

[David Spark] Welcome to Defense in Depth. My name is David Spark. I am the producer of the CISO Series. And joining us, a long-time good friend of the show, been on every show of the CISO Series, none other than Shawn Bowen, who is now the Microsoft Deputy CISO for the Gaming Division. Shawn, thank you so much for joining us.

[Shawn Bowen] Thanks for having me. I’m here as a new person. I think I’ve spoken to you in all three of my corporate roles.

[David Spark] I believe you have. Our sponsor for today’s episode is Noma Security – secure your entire data and AI lifecycle with Noma Security. We’re going to explain how they do that a little bit later in the show. Today’s topic is something that I know every CISO is passionate about, and that’s the way sales vendors interact with CISOs.

It’s how this whole CISO Series began. But ask any CISO, and they’ll you what a horror show their inbox is from vendor emails. Mark Ashworth, who’s the CISO over at First Bank, shared on LinkedIn that he gets about 200 per day, and everyone wants 15 minutes of his time. He gave some pointers on how vendors can stand out in the cacophony, suggesting they keep messages to the point, focus on what problems a product solves, and how it differentiates, and provide links to documentation if the CISO wants to dig deeper.

Shawn, I’m sure your inbox is similar. Has a similar tale of woe that Mark Ashworth has, as do many CISOs. Let me ask you this – why are we constantly repeating what we all think is the obvious here of the vendor messages are too much?

[Shawn Bowen] Well, I think technology has become an evil in this particular case because there’s no thought, and there’s no genuine connection being made. And so when we get, let’s make up a rough number, 80% of the messages are just automatically generated, the 20% that are actual people trying to connect are being tossed in with that.

[David Spark] Right, and it’s been given a bad name.

[Shawn Bowen] Yeah. And it’s funny. As you mentioned, as soon as you announced, you go, “I’m going to start Microsoft expecting, oh, I should be able to maintain…” Within a week, I was already in a couple hundred emails from vendors. And I’m like, “I don’t even know my email address. How did you figure this out?

You’re just arbitrarily making them up.” And then some of them are hilarious. I just got one today I deleted that didn’t go into my spam, and it was they were trying to sell me a browser. I’m like, “Do you know that we make a big browser? We happen to do that.” And so it’s just low effort. And I get it, it’s the same tactic that threat actors use for phishing.

Send out a thousand phishing emails, and you’ll get 20 people to click it.

[David Spark] And that’s a great rate. You don’t even need 20. Five. You essentially annoy 995 in the process.

[Shawn Bowen] So, not to call sales vendors phishers, but they are. They’re doing the same exact tactic.

[David Spark] Well, this is just the setup. We actually have a lot to talk about, and we’re going to actually go into this far more nuanced and talk about very positive things. It’s not a vendor bashing session. We want some positive outcome for everybody. And the person to join us, we haven’t had on for a while.

I’m thrilled that he’s back again. It is the CISO for the VF Corporation, Ken Athanasiou. Ken, thank you so much for joining us.

[Ken Athanasiou] Hey, thanks very much, David. Great to be here. Looking forward to the conversation. I do have some opinions on this particular subject.

[David Spark] That’s why we asked you to join.

What would a successful engagement look like?

3:36.794

[David Spark] Tim McLaren of GuidePoint Security said, “There are so many security solutions today, and it isn’t always easy for salespeople to find the customers with the problem that you can solve, so it just ends up being a numbers game.” This is what you were saying, Shawn. “As you said, sales is hard, and hunting for new business is by far the hardest.

So, it is generally inside sales teams trying to get five minutes of your attention because they are paid to get meetings, or they don’t keep their jobs. One company in Saint Louis had a unique approach to helping with this problem/solution alignment. They hosted an annual vendor conference where they laid out their objectives projects for the next 12 months.

They told vendors and attendants that they would commit to a meeting with them if they had a solution for one of their upcoming projects but made it clear that they didn’t want to hear about solutions that didn’t align with those objectives.” All right, well, that’s pretty aggressive, and that actually puts cost and them in the driver’s seat.

It’s interesting. I know vendors would love that.

Mark Timothy Mandrino, who’s with Terry’s Grill JAX, said, “Sales and marketing to do a better job nailing down the ROI, use cases, what other customers in the prospect space that may be applicable, and so on. It’s a double sided issue.  Too many sloppy sales people, too many busy unqualified prospects and way to many use cases that salespeople can’t articulate until they do speak to a live audience to flush them out.

I prefer for someone to just tell me to take a hike,” he is a sales person, “so I don’t spin my wheels or waste my time with them. Salespeople are busy as well, and it’s our job to open doors and obviously sell something to someone willing to listen. We need to finetune our story and definitely shorten the pitch.” I agree.

All right, we’re getting nods here on this side. Shawn, it’s an interesting take. And I’ve said this before. I think the problems just stem from measurement. They’re measured the wrong way, and the wrong way of being measured. And I don’t know the right way. Not that I have the answer, but the wrong way just creates this environment where you’re getting hammered, and it’s numbers.

Does it boil it just down to that?

[Shawn Bowen] Yeah, it does. But I want to jump on something real quick that Mark said about… He goes, “I prefer somebody to just tell me to take a hike.” And I appreciate that he has that. The problem is I’ve tried that earlier on in my career, where I was just… I would reply to everyone and go, “No, thank you.

I’m not looking for that. That’s not on my roadmap. Hey, that is on my roadmap from two years.” And immediately I get replied back, “Well, can I get 30 minutes next week?” Or, “What quarter is that?” And so it’s almost pointless for us to reply and try to be courteous to let them down easy.

[David Spark] But, again, it’s not everybody.

[Shawn Bowen] No, I know. But Mark is caught up in this – the fact that there are back to the point of people being pushed and I think the conversation of too many unqualified prospects, sloppy salespeople. That whole piece of people not being experts in it. They’re just doing it. To your measurement piece though, I almost don’t want to put it on the salespeople entirely.

[David Spark] No, it’s their managers.

[Shawn Bowen] Well, no, no. But I mean not even on the sales divisions. Like the companies themselves. We have this attitude particularly I think in the US, probably more so than anywhere else, of if you’re not growing, you’re failing. And sometimes if you just have five solid businesses that are paying bills and whatever it happens to be… You know, five customers, ten customers, whatever you need.

And you’re doing really good at that, that might be good enough. But with investors, they want to see returns. So, they’re getting pushed to continually grow. And sometimes, especially as a CISO… I didn’t learn this until later one. I didn’t realize I had to know this. But when I’m going with a private company or a startup, whether they’re a series B, C, whatever they are, I need to look at their funding rounds to determine if their roadmap is going to be their roadmap.

Because if their funding was not aligned with where they’re at today then I know they’re going to worry about developing their existing product. They’re going to have to start creating new products to appease their VCs. And that means, for me as a customer, while your product is good today, you’re not going to be where I need you to be in 12 months because of the pressure as the business.

That’s where I mean the numbers pieces. Why not just be really good at the job you’re doing? Why does it always have to be growing?

[David Spark] And this is, by the way, what Andy Ellis says. He says you want to get recognized, be incredibly awesome at what you do, and I will hear about it. As does everyone. Ken, let me throw this to you. The numbers game, we hear that all the time. I’m concerned with the way they’re being measured.

But as Shawn points out, it really goes all the way to the very top, not just the direct managers, doesn’t it?

[Ken Athanasiou] 100%. I really feel for the sales guys that are out there. I think it’s a very, very tough job. There is an amazing amount of pressure that they’re put under, and that’s why you end up getting I, Shawn, etc., get bombarded with just an enormous amount of contacts. And to your point earlier, they’re not very good contacts.

Most of them are automated. Even the ones that are not automated are not very well thought out. They don’t have good pitches. They don’t present their product very quickly and very well. I like Andy’s comment there. That if you’re really, really good at what you do, I’ll hear about you. And to be honest, that’s where I get most of my knowledge about new products.

It’s not from sales guys. I don’t listen to sales guys, to be honest.

I get so many emails. I just literally ignore them. Unless I know who that person is and I’ve had conversations with them before, I don’t even bother responding. There’s just too much that comes through. And to Shawn’s point earlier, if you do actually respond, it’s almost like responding to those scam text messages that you get.

“Hi, how are you doing?” You don’t respond to those either because you know it’s a hook. They’re just trying to get you on the line. I feel really bad for the sales guys that are out there. I think it’s a really tough job. I’m not a sales guy. I don’t know exactly the best way to incent them and to how to get them to really focus in on things, but it’s not something I’d ever want to do.

What do most people think it is, and what’s the reality?

9:48.086

[David Spark] Daulton Capps of Hook Security said, “It has been beaten into sales heads that it takes an average of nine touchpoints to get ahold of someone. It’s become gospel in sales circle, thus the typical 15 touch point cadence.” This is a good thing to keep in mind, because this is how they’ve been taught to sale.

And Kevn Mallen of Contentsquare said, “The majority of meetings are booked on touch number three, four, five, etc. So, while I may piss off a few, the data says to keep cadences longer and not stop after your first or second email.” This is why everyone is getting annoyed, apparently. And John Haden of Trend Micro said, “The root of the issue is in my honest opinion growth.

Every company, whether old or new, is expected to grow, sometimes at unreasonable rates.”

This is just what you were saying, Shawn. “We’re expected to grow more month over month, quarter over quarter, and of course year over year. If you’re publicly traded, the pressure is even greater. So, while most of us would love to sit back and do nothing more than let you guys do your research and contact us when you’re ready, reality is we can’t.” Ken, I think all of these are so on the money in that, “This is what we’re taught.

We’re taught to harass you.” And then John’s comment, which we’ve heard but gets to it even more is, “We are under so much pressure that this is the way we’re required to behave.” And so we’re in this really tough cycle, aren’t we, Ken?

[Ken Athanasiou] Yeah. And that goes back to what I said earlier. This is not a job I’d want. 100% correct. It’s like Chinese water torture. Right? The constant drip, drip, drip of emails until either you succumb to the pressure and you actually responds, or you put in a rule to just block their emails automatically, so you never actually see them in your inbox, which I’ve done, by the way.

So, 100% totally agree with those comments. The idea that it takes half a dozen to a dozen touchpoints before they actually get a response back, it’s probably accurate because the first five or six times, you maybe didn’t need to talk to them. You don’t have time to talk to them. You didn’t even see the email.

Right? So, even if it’s a product that you’re interested in, the question is whether or not you’re going to respond to them because you didn’t have time to, or you didn’t see it. So, it makes perfect sense. They’re probably 100% accurate. But I still liken it to Chinese water torture.

[David Spark] Shawn, what do you think when a sales person says, “Well, look, we’ve been taught we got to go after you four, five, six. And by number nine, you’re going to finally say yes. If not you, somebody else that we hit eight times before.” And It’s just like, “I’m just doing my job,” is usually the response.

[Shawn Bowen] Yeah, they definitely have the, “I’m doing my job piece.” If they think nine times is enough, they need to talk to my wife to learn how hardheaded I am.

[Laughter]

[Shawn Bowen] And definitely not nine times. So, to your point of blocking them, one of my companies I went to a while back, the guy put the blocks at the exchange level, blocked the entire domain. So, when I came in, I’m trying to reach out to people I know. Like, “Hey, I want to work with this particular product.” And I’m not getting their emails, and I had to find out why.

[David Spark] This has come up on our show before, of how dangerous that is.

[Shawn Bowen] He blocked like hundreds of vendors at the exchange level, like the entire domain. I’m like, “No, we need to undo that.” But I appreciate what… He was protecting the whole company. I’m like, “Hey, man, good job.” I get the whole, “This is my last attempt,” and then I get four of those last attempts.

I’m like, “Okay, what is it?” Or, “Just give me this one reply, and then I’ll leave you alone.” And it’s begging. Just think of this as a regular person. If they came up to your front door and knocked on your door every day at dinner time and just begged you to wash your car, whatever it is, you would just be like, “Go away.” You would be so annoyed.

[David Spark] That brings up a good point. And I run into this a lot in that there’s this sense that other people react differently than they do. Look, you’re a sales person. If you got hundreds of requests for your time, would someone just out of the blue saying, “Hey, can I get 15 minutes of your time?” Would you actually give it?

Someone who’s not in your industry, has nothing to do with this. Would you give it? We, who’s asking others, don’t behave the way we want others to act.

[Ken Athanasiou] Right, turn it around on them.

[Shawn Bowen] I like it. Let’s get all the CISOs to send emails to a vendor each week that if they don’t get on our calendar by the next day they’re out.

[Ken Athanasiou] [Laughs] That’s great.

[David Spark] Well, vendors would love that. You’re really setting something up there.

[Laughter]

[Ken Athanasiou] That might not be a great idea, Shawn.

[David Spark] It’s not CISOs they want contacted.

[Shawn Bowen] We’re going to have to lose a couple of CISOs in this. A thousand of us send an email, five are going to have to take one for the team.

[Laughter]

[Shawn Bowen] I don’t want to call them keyboard bullies, but it’s close to it in the sense of would you do this in person? And unfortunately, there are some that do this in person. Like if you go to a conference, they will corner you. And they’re nowhere near their booth. They followed you somewhere.

They saw you.

[David Spark] Someone just being friendly and saying “hello.”

[Ken Athanasiou] Yeah, they’re being friendly. Sure, they are. Right.

[Laughter]

[David Spark] Hold on, I’m being on their side here.

[Ken Athanasiou] Of course they are. Yeah.

[Shawn Bowen] But I’m saying I appreciate the game. I appreciate what they’re doing. But to Ken’s point earlier, I remember very distinctly one of the very first time I met Ken was in Miami. I know exactly where we were. He had just come off of a keynote, and I cornered him. I was like, “Ken, I want to hear more about what you did.

I want to know who your partner was in the company that helped you get there.” And he gave me the contact information and whatever. And so I make phone calls to people all the time. Or I see their logo or their company on the thing, I’m not going to listen to the sales pitch. I’m going to call my buddy at that company, or I just put a feeler on… We have enough secret forums that CISOs collaborate on that I just put out a feeler.

Like, “Hey, has anybody ever worked with this company? What’s your thoughts on this?” Or, “I’m looking for a product in this space.” And that goes well. This goes back to the comments earlier of if you’re really good, we’re going to know about you, and we’re going to reach out. And when we reach out, just be an ally to the problem, not go right into sales mode.

Sponsor – Noma Security

16:02.251

[David Spark] Before I go on any further, I do want to tell you about our absolutely spectacular sponsor, and that would be Noma Security. The rush to embed AI into applications has created incredible innovation for enterprises. But with that innovation comes new risk. That’s where Noma comes in. The first application security platform built to secure the entire data and AI life cycle.

From securing your AI supply chain to protecting AI applications and run time, Noma detects and protects threats like misconfigured data pipelines, vulnerabilities in notebook environments, malicious models, and adversarial AI attacks like prompt injection. With a single platform that integrates seamlessly across your AI tools, code, and application SDKs, Noma empowers AppSec teams to secure AI applications without disrupting data engineering and AI teams’ day to day workflows.

Fortune 500 companies are already using Noma to bridge the gap between security and AI teams, delivering complete visibility, security, and compliance across the data and AI life cycle. You can learn more when you head over to noma.security. That’s noma.security.

What are they looking for?

17:18.199

[David Spark] Eric Rosenberg of BHM Healthcare Solutions said, “It has become hard to filter all the junk over the last year with so much spam, AKA sales emails, coming in with no relevance or poorly done. 100%. We are considering easy ways to block the domains of the many companies that overdo it.” And Jason Keirstead of Simbian said, “Sales teams need to link in a two-minute or less demo video.

Do not expect to ‘schedule a demo’ with nothing but an email description. If your product does not have a publicly available demo video, it is assumed vaporware. People do not have time for this stuff. If the demo video is interesting then the lead will follow.” Oh, I’m going to double down on Jason.

Drives me crazy when there’s no demo video, and it has the, “Book a demo video.” And I’ll say something that I’ve heard from many CISOs. I don’t click on that, “Book a demo video,” because I do not want to be put in the sales funnel. Ken, you’re nodding your head.

[Ken Athanasiou] Oh, absolutely. Oh, good Lord. You don’t ever click on any link in one of those sales emails. Because, “Oh, I downloaded such and such,” or, “Oh, I see you’re interested in this or that.” And it’s, again, just another hook, right? So, the idea of having a publicly available demo video is fantastic.

Putting a link in an email.

[David Spark] And may I ask you, have you ever done research, saw a video, and did actually follow up?

[Ken Athanasiou] Maybe once.

[David Spark] Okay. It has happened.

[Ken Athanasiou] Again, I’ll go back to what Shawn said earlier. When I’m looking for a new product, I don’t go out and talk to a bunch of vendors. I talk to my peers.

[David Spark] And we hear this a lot.

[Ken Athanasiou] I go find out, “Okay, who used this?” Or, “I have this problem. What have you guys used to solve this problem?” I’m looking for a use case that’s proven value. And I get that from my peers. I don’t get that from a sales guy.

[David Spark] I’m going to push back on that just a little bit. I want your take on this, Shawn. Is Allan Alford has brought this up. And he says this is the way most of the communications happen. The problem with that model is you get into an echo chamber. And for new entrance, it’s very difficult to get in because no one has used the company X, Y, Z who’s brand new in the market.

So, it requires at least one person to go out, understand them, and to bring that knowledge into the group. And his attitude is, “Well, I can’t wait for other people to find to find out for me, so I go do it.” And he had a kind of more systematic way that he was learning about vendors. What do you think about that?

Sort of the fear of the echo chamber, Shawn?

[Shawn Bowen] I think that’s down to the organization. You’re normally a start up very early on if no one has used you at all, and then you’re going to be welcomed in in that same concept. You’re not be given a big chunk of the organization. We’re not going to heavily rely on that particular product because it’s in a beta trial state of development, as well as in our environment.

We don’t want to commit to long-term on it. I’m not afraid to be a first in an organization. This comes down to now that company and where we talked about being a partner versus a vendor. If they’re just trying to sell, and get me on their list, and put my logo on their company website then that’s not a relationship I want to be in, no matter how good their product is because I’m going to be constantly treated as meat and not a part of the development of the program.

So, we like to refer to the products as partners, and that means you’re helping me get better, and I’m also helping you get better.

I’m going to give you feedback on the product and share where it is. And so the way I’ve kind of summed them up is if you’re looking for a sales close, you’re a vendor. If you’re looking to better the environment, you’re a partner. The interesting thing about CISOs, it’s kind of weird in the sense of relative to the other business executives.

We are probably the most collaborative position in all of the business. Like CFOs, COOs, CHROs, they don’t collaborate with their other company peers like we do because we recognize that in most cases we’re noncompetitive. Our competitor is the threat actor. And so we immediately want to share information with each other.

And we’re not out here going, “Oh, we’ll have a better antivirus. I’m not going to share it with my other company. We want them to get hacked.” We don’t think of it like that. So, when you have this mentality of highly collaborative, wanting to see each other get better at cyber security, and then you meet a company that’s selling a product who doesn’t care to help the industry like we do… Like we will help each other.

[David Spark] That’s a really good point. This is why… And I hear from CISOs. I’d love to get both of your feedback. CISOs love to see vendors sponsoring and supporting groups like ISACA, OWASP, BSides, like that, because those communities are based on that. ISSA, too, for that matter.

[Ken Athanasiou] This is something I was going to mention. What I get real value out of is when you have one of those types of organizations… And there’s a bunch of them out there. They do a little bit of vetting first. So, they look at, “Hey, these are some up and coming vendors. This is some interesting stuff.

We vetted the product. It looks like it’s real. It solves an existing problem.” And then they bring those vendors. They bring them to those gatherings. Then you get an opportunity for that vendor to actually present to 40, 50, 60, 100 CISOs, depending how large it is. And we all get the chance to see that at once.

But this isn’t a cold call, and we can walk out of the room any time we want. But this is a vendor that that organization has vetted and says, “Look, this looks like a viable product, and it looks like it solves a problem that you guys have actually articulated is a big problem.”

What’s the issue here?

22:47.607

[David Spark] Brian D. McCarthy, 327 Solutions said, “Lifelong sales person here. Gaining access to the right person is one of the most challenging endeavors, especially in our seas of gray noise across social and email. A dialogue is usually where most relationships are built. Not out of a cold email or LinkedIn engagement.

I think value and true must be present in any communication, or the effort are moot, and tire everyone out.” And Tom Happé of Trueleads said, “I also believe that leading with value is a key, rather than asking for a call without establishing any need. I think some vendors have an arrogance that their product or service will solve all your issues.” I’m going to go hit on that one.

I’ll start with you, Shawn. The thing that we hear from CISOs is, “Tell me what you do and tell me what you don’t do,” because that is a trust builder. If you think you can solve everything, that’s where the trust goes out the window. Shawn?

[Shawn Bowen] 100%. And I also think for me personally, bashing a competitor isn’t going to bode well for you. And I’m not saying that you might be better or not better than a competitor. A lot of times it’s a different use case. I think you probably at some point in this mentioned Andy’s comment of there’s typically four or five vendors that do this well and if you stick with them or whatever.

There’s some quote that Andy has got. I know you’ve said it before. But it’s basically like if I have this environment, your product might be the best for it. But if I have a different environment, your product might be the worst for it. And so going in and immediately trying to compare products, let me do that.

I’m an expert in that space. I know my environment better.

And so to your point, if you’re trying to tell me you can solve everything or if you can do something better than the existing product I have… You don’t know my environment well enough to say that, and so there’s a lot of assumptions that come on there. Brian’s comment about gaining access to the “right person” is a key.

Because for me in my past roles as a CISO, I didn’t choose the product. I might have introduced a product to my team, but the team that’s using it, I want them to pick the product. Because I would never force my team to use a product just because I liked using it. I want them to be invested in the decision of that product and how they work inside their team, whether it’s GRC, or SOC, or engineering, whatever it is.

I want them to be part of that decision making process. And I might share with my experience some insights that they hadn’t thought of. But for the most part, I’m not the right person. I’m one of the people that’s involved, but it’s the next level down that really needs to understand your product. And so if you’re immediately just disregarding them, which I’ve seen… Like, “Oh, we only want to talk to the CISO.” Like, “Why?

I’m not the person you should be talking to.” And so I immediately look at you. You don’t understand the organizational structure of a CISO’s responsibility.

[David Spark] Now, I always felt this to be true, but it’s interesting. I just recorded with Gary Hayslip, and I thought he would answer kind of like what you just did. But he said, “No, no, I do select the products, and I actually work with my team to select them.” So, it’s not always true that the CISO’s staff is selecting, sometimes the CISOs are.

But I mean, again, every organization is different. What about you, Ken? Are you selecting, or is your staff bringing stuff to you?

[Ken Athanasiou] There’s a couple points I want to touch on. I tend to have my staff actually go through and look at the products and give me an opinion. And I participate in those selection processes. At the end of the day, it is my decision. But you know what? If my guys come to me, and they say, “This one is great, and this one is poo,” I’m not going to go for the one that they say is poo.

That’s just not going to happen.

[David Spark] Because the bottom line is if there’s anyone you trust, it’s your own staff.

[Ken Athanasiou] Right, exactly. 100%. 100%. Going back to the partner commentary we had earlier. One of the things that I do rely upon, some of my VARs, is that V. I actually look for value added resellers. And that V is the partnership that I build with those guys and make sure they understand what I’m looking for, what I expect to see, what my strategic vision is, and what my initiatives are.

And I expect them to do some vetting. That’s another part of that V. Of products before they introduce any vendor to me. So, building that relationship with a really strong VAR that actually has a V. There’s a lot of them out there that are just, “Hey, I just want to push an invoice.” But there’s others out there that really do some good work.

And those are the ones that I want to partner with.

[David Spark] Well, let us bring to an end there. And let me ask you this question, Ken. Is there a quote here that you really liked that you want to sort of double down on and call out?

[Ken Athanasiou] I think I just did, right? I mean the whole idea of building a partner relationship with a VAR. And once you establish a good relationship with a particular vendor, making sure that that vendor is treating you as a partner, and you’re treating them as a partner. They’re not just an order taker.

They’re actually there to help you advance your program. And depending upon what breadth they have or what focus they have, maybe the advancement is a narrow one, or it may be a fairly broad one. But going back to the VAR comment, most VARs have some pretty good knowledge about a widespread of tools.

[David Spark] And another group that has a widespread knowledge, I wondered if you do value their advice and their recommendations, that is venture capitalists, VCs who specifically work with cyber companies. Do you like…?

[Ken Athanasiou] I do. I do. I’ve actually worked with a number of VCs in the past. I’ve actually participated on the board of a couple companies as an outside board member, independent board member. And those are very interesting engagements. You’ve got to be a little bit careful with some of the VCs, because, hey, they’re pushing their product, too.

It’s all about sales and growth.

[David Spark] It’s two-sided here. Yes, they’re pushing the product. But at the same time, it’s like, “Well, they wouldn’t have invested in this if they didn’t think it was good.”

[Ken Athanasiou] That is correct. And the other thing that they’re also very interested in is understanding your opinion of a particular product. So, they listen very, very hard. That helps. Because if you’re at a very early stage with one of these products, you can actually help influence the direction of that particular product.

[David Spark] All right, I throw this one to you, Shawn. Your favorite quote and why.

[Shawn Bowen] Well, I was going to jump on that VC thing. There’s also VCs that are well established, and they are trustworthy. They’ll give you an opinion on products even they won’t invest in. But then there’s a lot of startup VCs that have the same mentality as the startups that we’re complaining about.

So, something to be aware of. My quote, I’m going to go with Jason about including a demo or not making it publicly available. And I want to ask Ken a question, just because this is a conversation that you and I have had, Dave, have had this with other products. Just in general, gatekeeping information.

Whether it’s a demo, or a white paper that they wrote that you have to sign up on a forum. What’s your thought on that, Ken? Because I believe just put it out there. Because I’m going to either put fake information in there to get the access. And then if that doesn’t work, like they send it to your email, then I just don’t want it.

I don’t want to deal with it. So, I’m curious what your take is on that.

[Ken Athanasiou] 100%. Invariably, every time I’ve succumbed to the gatekeeper and actually given my two coins to cross the River Styx, what you get isn’t worth it. So, you basically just gave them a line into you, and it usually is something that is just not high quality and not useful.

[David Spark] And then you feel burned. And then that is not a good relationship making move.

[Shawn Bowen] Yeah, and then you have to hide in your email and go, “Ugh, I got to set up another subscriber ID.”

[Laughter]

[David Spark] Yeah. Well, you feel like a sucker. Like, “Ah, they got me.”

[Shawn Bowen] Yeah. Yeah, yeah, yeah.

[David Spark] But hold on. Let me ask you. When you said use a fake email… I wonder if you do this, because I do this. Do you put in an insulting name for an email address?

[Shawn Bowen] I don’t know as I put an insulting name. I’ll put something like, “Be better, share with the community.”

[David Spark] Oh, you are far kinder than I am. [Laughs]

[Shawn Bowen] Well, maybe I do want the product. I don’t know. But to your point, if you’re going to start off with something like that where I’m going to immediately… Like it’s not worth it. If it’s worth it then share it. I’m an open knowledge, open communication kind of person. Share this. I’m not on this podcast, getting paid.

I’m sharing my opinion to help better the community. And if you wrote a white paper that requires just a link for an email, just make that available and share that with the community.

[Ken Athanasiou] And you know what? If it’s a quality white paper, you’ll probably share it with somebody else, too, because you’ll be like, “Hey, you got to read this. This is pretty good.”

[Shawn Bowen] Yeah, exactly. It’s going to have your logo on it. [Inaudible 00:31:13] I’m going to reach out to you.

[David Spark] And also, I’ll point out, too, there is certain things… And I’ll call out the Verizon DBIR, stuff that comes from Duo, that I hear from CISOs again and again that they love the research, love the stuff that comes out from that. If you get that kind of response, you’ve hit a homerun there.

It’s unbelievable.

[Shawn Bowen] I’ll name Kenna. I mean I know they’re Cisco something or whatever they’re called. But Kenna’s like eight-part vulnerability research paper. I still have those downloaded, and I review them every… That was incredible. If you want to say it’s from marketing, cool, whatever. I’m sure someone thought of it from marketing.

But the research in it was truly valuable, and I have them saved because of it. And now they’re…as the original name that they are because of what they contributed to the community. And it wasn’t because of sales emails.

[Ken Athanasiou] That’s right. No, it was actually providing something of value. That’s the best hook that they can possibly give you is actually provide you something of value and get it in your head that, “Hey, this was great. This was something that these guys did that was good for me. Let me look at what else they can do for me.”

Closing

32:14.810

[David Spark] There you go. That’s the hook. We’ve closed with the ultimate hook. Thank you very much. I want to thank our sponsor, Noma Security. Remember, go to their website, noma.security, to secure your entire data and AI lifecycle. I want to thank our guest, who’s the CISO of VF Corporation, Ken Athanasiou.

Also, Shawn Bowen, who is now at Microsoft Gaming as the deputy CISO. Love that you’re there. Have you been playing any new games, quick, Shawn?

[Shawn Bowen] New Call of Duty dropped a couple days ago, and I saw a lot of people playing it during the workday. And I was like, “Oh, is this what we’re supposed to be doing?” I did not get that memo or approval yet.

[Ken Athanasiou] User tested.

[Shawn Bowen] Yeah, that’s it. User tested.

[David Spark] Thank you very much. Thank you very much to our audience. We greatly appreciate your contributions and for listening to Defense in Depth.

[Voiceover] You’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cyber security. This show thrives on your contributions. Please, write a review. Leave a comment on LinkedIn or on our site, ciso-dev.davidspark.dcgws.com, where you’ll also see plenty of ways to participate, including recording a question or a comment for the show.

If you’re interested in sponsoring the podcast, contact David Spark directly at david@ciso-dev.davidspark.dcgws.com. Thank you for listening to Defense in Depth.