Look at the inbox of any CISO and you’ll either find an endless stream of vendor outreach emails or some very robust filtering rules. Every CISO is quick to point out that the current vendor playbook is vexing and inefficient. So how can the industry creating meaningful contact between vendors and CISOs, rather than just defaulting to volume?

This week’s episode is hosted by me, David Spark, producer of CISO Series and Mike Johnson, CISO, Rivian. Joining us is David Cross, CISO, Atlassian.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, ThreatLocker

Full Transcript

Intro

0:00.000

[Voiceover] Who should be listening to the CISO Series Podcast? Go!

[David Cross] Everyone should be listening to this podcast and this series because that is how you grow in your network.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark, I am the producer of the CISO Series. And joining me, since day one, it’s Mike Johnson, CISO over at Rivian. Mike has say hello to the audience.

[Mike Johnson] Hello, audience. Great to be with you again.

[David Spark] That’s what his voice sounds like. You don’t plan on changing it, adopting a new voice, creating a new accent, developing a lisp, anything like that, Mike, throughout the show?

[Mike Johnson] I actually had a lisp when I was a kid.

[David Spark] I did too! I had a very… And did it just go away by itself?

[Mike Johnson] No, I actually did speech therapy and all that fun stuff. So, I worked on it.

[David Spark] Mine was not that severe, but it did just kind of go away. I had it through my first couple of years of college too.

[Mike Johnson] Mine, I got through an elementary school and maybe some middle school.

[David Spark] Oh, but yeah, it would come out every now and then. No, it wasn’t like a chronic lisp, but it would come out every now and then. We’re available at CISOseries.com. If you have not gone there, we recommend people spend at least two hours a day at CISOseries.com.

[Mike Johnson] Minimum. Minimum.

[David Spark] Minimum. It’s a doctor’s recommended time.

[Mike Johnson] Yes.

[David Spark] Just go to the site, read, listen to a bunch of episodes. Two hours, you should feel a lot healthier, I believe.

[Mike Johnson] Yeah. Yes. You will feel healthier. You will feel better informed, which makes you feel healthier.

[David Spark] Our sponsor for today’s episode, a spectacular sponsor of the CISO Series. They actually have a suite of solutions that will help you on your zero-trust journey, none other than ThreatLocker. We’ll be talking about that a little bit later in the show. But first, Mike, I want to talk to you about the importance of in-person cyber communities. Now I’m just going to sort of pat myself on the back right now. For those listeners who are in the San Diego, SoCal area, I started the San Diego Cyber Group Meetup actually with someone else, but now I’m just running it by myself now. And it’s become quite successful and really honestly, people just love to get together with other cybersecurity professionals and it’s great just to network, but what would be your tip to like make the most of your local group, Mike?

[Mike Johnson] What I would say is you have to go more than once.

[David Spark] Yes.

[Mike Johnson] The first time that you go, I’m an introvert, so my first time to any of these events, it’s going to be very quiet. I’m not going to get a whole lot out of it, but by going to the same event over and over again, you see the same faces, you open up, you have better conversations. So, that’s my one tip is, is commit. Ultimately, that’s what comes out of it, commit.

[David Spark] And I will say, do not hesitate to walk up to complete strangers and just say hello. By the way, this is my favorite opening line. If you walk into a group of like three, four people chatting, and you think you’re going to be interrupting them. First, let me point out, yes, that is what you’re doing. You’re interrupting them.

[Mike Johnson] By definition.

[David Spark] But this is how you can make it ease in, and this is what I do. I literally walk in, and I point out the obvious. I say, “What am I interrupting?”

[Mike Johnson] [Laughter]

[David Spark] Because you are, but what you’re doing is you’re asking, “What is the conversation about?” Because one of the problems I see a lot of people do is walk in and they start their own conversation. Like, well, something was already going on here. So, it ingratiates you to the group by saying, “All right, I want to know what you’re talking about, and I want to be a part of that conversation, whatever it is.”

[Mike Johnson] I think that’s a great tip because you want to be a part of the conversation. You’re not showing up to start a new one.

[David Spark] Correct. Now you could have a topic, a concern of yourself that you could eventually bring up but just be where they’re at when it starts.

[Mike Johnson] One of the pieces of advice that we always give on the show is meet people where they are.

[David Spark] Yes.

[Mike Johnson] And that’s a great example.

[David Spark] Your users as well.

[Mike Johnson] Yes.

[David Spark] Don’t force their hand where they don’t want to be. Our guest has been nodding all the way through this, and our guest has been on the show multiple times in previous incarnations. He now has a new gig. He’s now the CISO over at Atlassian, and as we understand, it’s the smallest, it’s like a startup, tiny little company. It is the smallest company he said he’s ever worked for. Please, the CISO of Atlassian, David Cross. David, thank you so much for joining us again.

[David Cross] David, thanks for allowing me to come back and I can’t wait to get the five-time jacket, I’m just dying for it. So.

[David Spark] You do have a jacket. By the way, we’re working on other schwag too, I must say. We’re working on others.

Unexpected outcomes or failures?

4:55.459

[David Spark] CISOs are drowning in hundreds of vendor messages monthly, mostly lacking any personalization or credible context. As Val Tsanev of Execweb put it on LinkedIn, “The cybersecurity sales model is broken. Startups waste months chasing ghosted threads, LinkedIn likes, and email cadences when what they need is simple, warm, qualified meetings with real decision makers.” So, instead of trying to optimize cold outreach, what if sales teams spent their time securing warm introductions to just 10 qualified prospects? By the way, I always say this, like, just make connections. Do we need to challenge the entire hustle mentality? Maybe the path forward isn’t more volume, but better access. I am a huge fan of quality over quantity, Mike.

[Mike Johnson] We started this podcast seven years ago.

[David Spark] Mm-hmm.

[Mike Johnson] And it was the CISO’s… What was it?

[David Spark] Hold it. Can you remember the original title of it?

[Mike Johnson] It’s always a mouthful, which is why we changed the name.

[David Spark] Yeah, that’s why we changed it. [Laughter] Yes.

[Mike Johnson] The CISO Security Vendor Relationship Podcast.

[David Spark] Not even I called it by its right name and I’m the one who named it.

[Laughter]

[Mike Johnson] But what we were highlighting at that point was that the relationship was broken.

[David Spark] Yeah.

[Mike Johnson] And at that time, it was an adversarial relationship.

[David Spark] Mm- hmm. In fact, you, by the way, legitimized my doing this.

[Mike Johnson] Yes.

[David Spark] Because I saw your post about how frustrated you were. I mean, every time you posted about this on LinkedIn, you expressed your frustration. And by the way, the crowd came running in.

[Mike Johnson] Yes. And I think seven years later, I think we’re at least past that.

[David Spark] Yes.

[Mike Johnson] I think we’ve at least fixed… We won’t take credit for it, but we’ve had a small…

[David Spark] Mike, this is where you and I differ. I’m totally taking credit for this.

[Laughter]

[Mike Johnson] So, David fixed this relationship.

[David Spark] No, with your help, Mike.

[Mike Johnson] So, it’s at least not adversarial anymore. But it totally is true that the sales model of always going to the top, that’s still happening, and that is still fundamentally not working. I don’t think this is unique to cybersecurity, by the way. CIOs have the same thing. They’re being constantly approached. And for my team, I’m looking for feedback from my leaders, from my really high-level individual contributors. And that’s what some of the feedback to this thread was, was don’t talk to the CISOs, talk to the leaders within the security org, talk to the principal engineers. Those are the folks who are making the recommendations.

And that’s one of the methods, but the piece of advice that I keep giving on this show, and I will continue to give until I’m blue in the face, is the best source of sales leads is your own customers. Make your own customers happy. When the peers of those customers are looking to solve a similar problem, they’re going to go ask their networks. They’re going to go say, “Hey, how have you solved this?” That conversation in that in-person security meetup might be about, “Hey, how have you solved this?”

[David Spark] And you don’t even need to say, “Hey, could you recommend us to your friends?” Just be overly nice and they will go out of their way to speak for you.

[Mike Johnson] Absolutely. Be overly nice and deliver a good product. David Cross, you feel the same way?

[David Cross] I think some great tips there. A lot of things. Certainly, we don’t want to go down and like you’ve got to be in the Gartner Magic Quadrant and those type of things. But I think the key word is right at the beginning there is about personalization, right? And I say you need to understand the customer because sometimes the CISO could be the right person or it could be the architect that owns that area, right? You need to go deep and understand the customer and who’s the decision maker who works in that particular area and understanding their environment. It’s like coming to me and saying, “Hey, I want to protect your Office 365.” Like, we don’t even use Office 365, so why would you waste your time? I think the other element is you want it to be a safe place, right? People that are interested, this is where I think like Sagetap and others are doing is so that you can say, “I might be interested, but I want to be safe. I don’t want to get bombarded with phone calls and things after the thing just because I wanted a little bit of information.” Right? And that’s another part of it. If you don’t feel safe, you’re always be hesitant to engage.

[David Spark] By the way, I’m going to toot our horn again. This is why we started our show, Security You Should Know, where two CISOs interview a vendor about their product. What we hear from the listeners, they say it is a safe way to learn about new solutions. And we’ve heard it again and again and again. Vendors don’t click on that “Book a demo” button because they do not want to get trapped.

[David Cross] Exactly.

When is the best time to do this?

9:55.280

[David Spark] “Levity in the heat of the moment isn’t just about making people laugh. It’s leadership under control.” And that was from Jerich Beason, CISO of WM, who recently made the case on LinkedIn that levity is an underdeveloped soft skill for the CISO arsenal. During a high stakes incident, laughter doesn’t solve your technical problem, but it can reboot your team. When a CISO can inject strategic humor during a crisis, they’re demonstrating emotional command that builds trust, lowers defenses, and transforms intensity into momentum. So, how do you – I’m going to start with you, David Cross – how do you develop that kind of composure? Like when the S is hitting the fan. Is this teachable or does this only come from surviving enough high-pressure situations that you learn to breathe through them? And maybe you can think about your first one and the one you deal with now. Are you a different person, David Cross?

[David Cross] Well, here’s where I’m going to make my pitch for an element for many companies. This is where veterans can really be a great value-add to your organization.

[David Spark] Yes, yes.

[David Cross] Because part of it is because it’s the training. And first I’ll start off with that a big part of it is you learn to train how you’re going to fight, right? And this is where playbooks and tabletops and other things. And ultimately, the veterans can know. They say they know how to operate the playbook. They know how to say to operate under fire. They know how to have the discipline, right? And you can train this. This is what we do. And you can bring it for others, but you can do it in the civilian world in the same way but use the veterans and their experience, and those principles can really help everyone get through the challenging times. Also, I think there’s another element that I want to call out is, as a leader, is you’re part of the team, you’re part of the org, and you lead by example, right? It’s that you understand everything that you’re doing and you’ve been part of it, and so that when you’re under fire, you’re part of that. You’re not misunderstanding it. You’re not trying to dismiss things. And I think it’s very, very important to do as well.

[David Spark] Mike, I throw this to you. You were not ex-military, but David was. So, can you think about your first high-pressure experience and your latest? Like I’ll ask, were you a very different person from one to the most recent?

[Mike Johnson] Well, I think I was. I can’t remember when my first. It was a very long time ago.

[David Spark] Mm-hmm.

[Mike Johnson] But it was something that, as you go through these over and over again, you do learn both the ability to and the importance of being calm. If you are out there with your hair on fire, everybody else is going to be running around with their hair on fire, too. You need to actually, as David was saying, lead by example and be calm, remain calm. You might be the duck, like you might be smooth above water, and your feet are paddling like crazy underneath.

[David Spark] By the way, I love that metaphor. Go on.

[Mike Johnson] I mean, that’s kind of the CISO metaphor, really. But you do need to intentionally be calm. And in my early days, I had to stop and pause and recognize that. And I’ve had the good fortune of working with many very excellent incident responders, and that’s where you really see it. People who their profession is responding when the “s” hits the fan. You can see how they remain calm for whatever might be coming their way. David mentioned hiring veterans. One of the most impressive incident responders I ever worked with. They were a first responder. They were an EMT who would ride along in ambulances and was responding to terrible events, and you can see how they remain calm. So, yes, I’m very different than I was when I first got started. Some of that comes through practice. A lot of that comes through training and learning and observing others who are really good at it.

[David Spark] So, the advice for someone – I’ll start with you, David Cross – if you don’t have military experience and you haven’t done the training exercises, I guess, start doing the training exercises, yes?

[David Cross] Absolutely. This is where I think the real tabletop exercises, right? Again, train like you’re going to fight – and not the very simple ones, you check the box. Make it a real high-pressure training, a tabletop, and you will be ready when the time comes.

[David Spark] Yeah. And have you done that with past teams before yourself, David?

[David Cross] Absolutely. It’s one of the best things you can do. It’s a great investment.

[David Spark] And I hear this and just quick answer, what is the number one thing you learn from doing these tabletop exercises?

[David Cross] The number one thing is you always learn that where the gap is on who owns something and who’s the decision maker, and that is the worst place to be when you’re under fire and you don’t know who can make the approval or make the decision. That’s the worst place to ever be.

Sponsor – Threatlocker

15:01.220

[David Spark] Before we go on any further, I do want to tell you about our spectacular sponsor, and that would be ThreatLocker. Now, as we all know, in cybersecurity, seconds matter. Precision matters. That’s why ThreatLocker is up in the game again. The company just launched a new set of solutions built for teams who need to move fast without compromising security. So, it’s zero trust, but without complexity. Ah. Sounds good. All right. I’m going to walk through some of these solutions.

First, with ThreatLocker Insights, you get real time intelligence from millions of endpoints worldwide to empower you to make the best swift cybersecurity decisions on what applications to allow and what controls to put in place in your environment. Patch management? Well, instead of chasing updates and manually approving patches at 2:00 a.m., ThreatLocker takes care of it for you with the rigorous research and testing you need to stay compliant and secure. Cloud Control adds an essential layer of defense, further closing the gaps that phishing and token theft campaigns love to exploit.

They’re also making life easier for IT and security teams with the new User Store, a smart way to give users instant access to pre-approved software while maintaining the strong security of your environment. And for web threats, well, one of their newest is Web Control. It lets you block sites you don’t trust, or users should not access from the workplace, and it blocks unapproved content by category, not necessarily URL by URL. Now, of course, you still get ThreatLocker’s 24/7 US-based Cyber Hero Support. No scripts, no waiting hours for answers. They deliver world-class swift support, responding in about 60 seconds. Now, it’s no accident that over, listen to this, 50,000 companies now trust ThreatLocker to help them harden their environments against modern threats. If you’re serious about tightening your defenses and getting a platform that doesn’t slow you down, check out ThreatLocker.com to learn more.

It’s time to play “What’s Worse?”

17:02.339

[David Spark] David Cross has played this many times, Mike Johnson has played this as well, many times, and the person who is submitting has submitted many times. All veterans all the way around!

[Mike Johnson] Yes, we’re all experienced.

[David Cross] Could this be any worse?

[Mike Johnson] [Laughter]

[David Spark] All right. This is a new twist, and I love this. Very, very creative. And actually, you know what? This very much is telling to our last segment.

[Mike Johnson] All right.

[David Cross] Mm-hmm.

[David Spark] So, it’s from Dustin Sachs of Cyberrisk Collective. And Mike, which one’s worse? A security strategy driven by fear or a security strategy driven by overconfidence?

[Mike Johnson] Oh, wow. That’s an interesting comment. So, it’s essentially, are you using FUD or are you clueless, basically?

[David Spark] Well, I mean, overconfident, maybe not clueless, just like you think you’ve got it all right and you probably do not.

[Mike Johnson] That feels clueless to me. You’re at least lack of self-awareness.

[David Spark] Lack of self-awareness, that’s a good way of putting it.

[Mike Johnson] Yes. Boy.

[David Spark] These are these are two levels of stupidity.

[Mike Johnson] Stupid’s a strong word, but these are both incorrect ways to lead a strategy, for sure. So.

[David Spark] Right. And by the way, you’ve probably seen them done before.

[Mike Johnson] I think all of these have been unfortunate ways that people have led security programs before. I really think the lack of self-awareness is the worst. Like, theoretically, if you’re leading a program through fear…

[David Spark] At least your heart’s in the right place.

[Mike Johnson] Well, you’re at least aware that you’re doing that. Right? You’re doing that with intention.

[David Spark] Mm-hmm.

[Mike Johnson] It’s not a great intention, but at least you’re aware that that is your intention.

[David Spark] Right. And you could be, by the way, if you’re leading by fear, you can be very easily swayed. I mean, “You’re not worried about this yet?”

[Mike Johnson] Oh, yeah. Like, I mean, it can absolutely be the squirrel mentality.

[David Spark] Yeah. You could be chasing squirrels all day.

[Mike Johnson] Yes, absolutely. Again, Dustin, both really bad options.

[David Spark] This is good. This is good.

[Mike Johnson] Good scenario.

[David Spark] So you’re going the overconfidence.

[Mike Johnson] I do think the overconfidence because it’s that lack of self-awareness that really bugs me on that one.

[David Spark] All right. David Cross, do you agree or disagree? Because this is a tough one, I think.

[David Cross] No, actually, it’s not a tough one. And I’m going to, since we get the veterans theme going on here, is so the military experience, the biggest failure is when you are overconfident. You know what to do, you know what you’re doing, and that is when people… Bad things happen. You go on the flight deck of an aircraft carrier, and you think, “I know this. I got it down.” That is when someone gets blown off the flight deck, right? So, that’s what it’s all about. You’re always training. You’re always aware. And that’s what success is all about.

[David Spark] So, as we have said, a good level of paranoia is healthy.

[David Cross] Well, Andy Grove said only the paranoid survive.

[David Spark] [Laughter] All right. So, both of you are saying that overconfidence. But you’re just saying that when you get to the point of overconfidence, you’re going to miss something that’s critical. But I would argue you’re going to miss something critical if you’re driven by fear at the same time.

[David Cross] Absolutely. Yeah, there is. Because I think then, you’re not taking a step back. Or the fear is that you’re into fight or flight. Correct, right? And really, those are not the only two options. There’s sometimes more than that, and I think that’s very important to call out as well.

Is this really the right strategy?

20:42.354

[David Spark] “What will our cybersecurity incidents cost us next year?” Who knows? Maybe like earnings guidance from public companies think in ranges X million to Y million, suggested Rob Labbé, CISO-in-residence over at Mining and Metals ISAC. It’s like a weather forecast. Precision in prediction is often precisely wrong, while accurate ranges build credibility and help with decision making. Instead of obsessing over exact numbers, focus on intelligent uncertainty. I like that. The suggested framework breaks cybersecurity costs into four components. Security spend, incident costs, security friction, and opportunity costs. Now, David Cross, isn’t trying to predict the unpredictable losing battle?

[David Cross] Well, I think it’s a really interesting conversation. One of the things is that you got to think about risk management here, and you need to develop a set of ranges, right, based on the various outcomes because let’s think about it as just like vulnerability severity, right? You have low, medium, high, critical, right? And you can kind of do some predictions on saying, what would it be for a critical or for a high? And I think that can help you do some planning, right? An estimation, right? And also how you’re going to approach it, right? And so, I know this’d maybe scare people, but sometimes this is where cyber insurance and actuarial kind of plans and how they structure it really can come into play in helping you in actually doing that. Because they have a lot of experience based on your company, your vertical and other things, in saying that what could you possibly predict, and what would be the range of those? And then what protections to your insurance you may want to have? So, I know it sounds different, that you’d rarely hear about, but I think there’s a lot of structure that many companies can help in building out that plan.

[David Spark] I like the low, medium, high thing. How have you addressed this, Mike, when people want an exact number, but you have to give ranges and that makes them even more uncomfortable? Or is there a way you make them more comfortable with the uncertainty?

[Mike Johnson] Right now, for better or for worse, our industry is recognized as relatively immature in that area. So, that ability to actually give predictions for the number of incidents or the costs of the incidents, I haven’t been asked to provide that, so that’s something that I still think we have some time to resolve. David mentions insurance and actuarial tables. Those industries have built up that muscle over time to where it is something that they can rely on, and they can use that, and they can predict for these sets of facts, here is the likely outcomes that we will see. And based on history, these are the expected costs of these outcomes. Which also, we don’t have a good history of the costs of incidents. The cost of an incident five years ago is very different than the cost of an incident today. That is one of the areas that ransomware has helped in that there are costs associated with ransomware incidents, and we’ve seen what those are, but even those have been changing.

[David Spark] Yeah, pretty drastically.

[Mike Johnson] The cost of a ransomware incident five years ago is very different than the cost of one today.

[David Spark] That’s why I got to assume like cyber insurance, actuarial tables got to be like an EKG chart going all over the map.

[Mike Johnson] They certainly feel that way. I’ve spoken with some folks in the industry in the past and they are saying, “Hey, we’re getting better data. We’re learning more over time.” But if you look at renewal rates, which is really the time that I interface with them, they’re very different year over year. And what the insurance companies are seeing as good practices that help manage those costs, that seems to be changing as well year over year. So, I hope this is an area that we can get better at over time, but we’re not there yet.

[David Cross] Maybe if I could interject something as well, is you think about with the cyber insurance and others, is it’s just like sports teams, right? Say the NFL. Say that, hey, what do they have for the players on the team and their experience at different things? That’s just like saying what is their vulnerability management looking like? What’s their patching cycles look like? A set of these statistics can really kind of help on what would be potential impact, or the likelihood and other things, in helping you building those ranges with some kind of reliability.

[David Spark] So, give me a good example of a range you often have to deal with, and is it dollars to if we don’t do task X, or we don’t spend the money on this? Give me an idea of a common case of this, David Cross.

[David Cross] Yeah, I think for many companies, it’s that you have an incident, right? So, let’s not… There’s a variable brand of things. But if you have an incident and often the biggest unknown cost or a range of costs that you can estimate is, oh, outside counsel, a good example, right? Is that what do you need to have to deal with that? Because you don’t need that counsel and lawyers full time, but if there’s an incident, you may need them for a lot of work, and how do you prepare for it and how you’d measure that, and I think it’s a good example.

[Mike Johnson] I think if you look at risk management, at the highest level, it is likelihood versus impact. And that’s not satisfactory to all of the quantification fans out there, but from a qualitative perspective, that’s where many of our programs are today. This is the likelihood of this thing happening, and this is how painful it would be if it did happen. And it’s really just usually five points on each of two axes, and you do some math, and you say this is a high, medium, or low or critical or a very low or whatever your range is coming out of it. That is what we do every day is risk management, and it’s how bad can it be and what’s the likelihood of that happening?

[David Spark] Right. And I would assume, because I look at this as well as you kind of started like what is the thing that could literally cripple us? What could put an end to the business? Start there and like work your way down, yes?

[Mike Johnson] For sure. It’s like you do want to start with the things that are most likely to be extremely detrimental to the business. Now, you want to make sure you’re not chasing the black swans because it’s very difficult to identify what those might be. But for many companies, ransomware is not quite existential but is most likely the thing that will cause the most impact. Certainly, frequency is also a thing there. So, I think most organizations, it’s like understand your exposure to ransomware and go after that, and that’s a good place for any program to start. David, you want to close?

[David Cross] Yeah, I agree. I think that’s a great example, is that if it occurred, right, and then what would it take and likely take from a cost and all the elements of it? And I think that’s a great example to start from.

As a CISO, what do you think of this?

28:04.215

[David Spark] Are security startups the worst at doing security for themselves? And this is a question that was asked by a security professional who manages security reviews for 5 to 10 mergers and acquisitions a year for his enterprise company. While they may be selling a great product, their ability to secure their own infrastructure is laughable. This is what this person on Reddit thought and posted this conundrum. It’s a conundrum for the M&A. The acquired company thinks their security is enterprise ready because they’ve been working for an enterprise business. Now, once they’re merging with a company that has actual standards, the attraction and the sales price starts to drop. Is this something that a last-minute fix can solve, Mike Johnson, or has the startup put themselves in a situation where they’ve shot themselves in their own foot?

[Mike Johnson] So, I first want to start with the shocking revelation that security is hard, and startups are not in a great position to solve security. They’re really just trying to survive.

[David Spark] Right.

[Mike Johnson] They’re trying to get something off the ground, trying to build a product, build a go-to-market strategy, all of that. It’s not surprising that security is not the first thing that they’re investing their time and resources into it. That said, security startups are slightly different. You are expecting as a customer of one of these that your security vendor has invested in security. And so, it’s a bit of a quandary if those aren’t investing in security. But last minute, you can’t fix this last minute.

[David Spark] No.

[Mike Johnson] If you’re trying to fix it, when you sign the letter of intent or even entered into an earlier stages of due diligence, it’s going to be found out. The company who’s acquiring you is going to get to the bottom of that. But it’s fine. The best thing that you can do is just be open and honest about it like, “This is where we are.”

[David Spark] And they’ll probably say, “Okay, to get you up to our level, it’s going to cost X, and that’s going to impact whatever the purchase price is.” David Cross.

[David Cross] I can’t resist by saying, like we did earlier, is that you have to lead by example, especially the security startups. Now, let’s kind of break it apart a little bit here. It certainly is, when you’re very young and early, you need to be agile and fast, right? But it’s kind of like a staged crawl, walk, run, right? At the very early stages, you’re building something. Yes. Do you need to have everything? No. But you want to start winning the enterprise customers? You better be enterprise grade security yourself, right? So, overall, it kind of made me think about when I saw this question coming in, it’s really about building that stage plan, right? And there was a really good book out there by Matt Blumberg, right, called the Startup CXO here. Okay?

[David Spark] Okay.

[David Cross] And really in this is that thinking about building a startup is the person is the chief revenue officer of day one of 5 people is maybe quite different than who you need to be the chief revenue officer when there’s 300 people. And the reality is that may be the same thing for the CISO. You’re a CISO of a 5-person team or a CISO of a 100-person team. Your skills, your experience, and your needs may be very different, and a company needs to have a plan – crawl, walk, run – for security, revenue, sales, everything, and I think that’s an important element that many companies need to think about.

[David Spark] What I’m hearing is you can get there. It’s not going to go as fast as you think it’s going to go or hope it will go.

[David Cross] It’s about the stages. What stage do you want to be in? If you want to start selling to enterprise customers, you’ve got to be in a different stage, and what it takes to get to that stage.

[David Spark] Awesome.

Closing

31:58.097

[David Spark] Thank you very much, David Cross. Thank you very much, Mike Johnson. And thank you to ThreatLocker, our sponsor for today’s show. If you don’t know their website, it’s ThreatLocker.com and it is spelled exactly the way it sounds. And if you go check them out and if you do want to learn more from them, why not tell them that the CISO Series sent you there? They want to know that the money they have spent sponsoring us is actually having an impact. Let them know. David Cross, thank you so much. Now the CISO for this tiny company, Atlassian. Are you hiring over there?

[David Cross] Yes, we are. We are a global company. And what we say is we are team anywhere, which means we are remote.

[David Spark] So, you will hire people wherever. Now, do you work remotely, or do you go to the office yourself?

[David Cross] I go into the office one to two days a week by choice because when you have a great vibe of a company, a lot of people like to go into the office, but completely by choice.

[David Spark] Well, thank you very much, David Cross. Thank you very much, Mike Johnson. Thank you to our audience as well. We greatly, as I’ve said it many times before, and I truly mean it, we greatly appreciate your contributions. If you haven’t contributed – like a “What’s Worse?” scenario, I’m always looking for good ones – if you haven’t contributed, why not do that? Why not send us a question you would like to ask, or you see a great discussion online or a “What’s Worse?” scenario, send it in. This show thrives on your submissions. So, I mean it when I say I greatly appreciate your contributions and for listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review. This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.