Podcast Transcript

Welcome to the RSAC cyber at the top podcast where security leaders across industries share the strategies, hard lessons, and real experiences shaping modern cybersecurity and AI. Insights are grounded in community and built for every level of profession.

Hello, listeners. Welcome to this edition of the RSAC Cyber at the Top podcast series. Thank you for tuning in. I'm Tatyana Sanchez.

And I'm Kacy Zurkus.

And we are your RSAC podcast hosts.

Kacy, what are we going to discuss today?

Well, I am super excited to be here today, not only because it is that time of year again where we are preparing for the call for submissions, but today, we're joined by our friends.

I'm super excited to be talking with a couple of our program committee chairs, Patty Titus and John Johnson, in advance of the official opening on September 15 of our call for submissions for RSA Conference 2027. And this is going to be a great lineup of tracks for people to submit. And to help kick things off, we are here with Patty and John today who are going to share some behind the scenes tips and guidance for anyone who's thinking about submitting.

Spoiler alert. We are going to try and encourage you to submit if you're thinking about it. We'll talk about what reviewers are really looking for, common mistakes to avoid, and how to make your submission stand out in a crowded field.

But before we get started, we do wanna remind our listeners that here at RSAC, we host podcast twice a month, and we encourage you to subscribe, rate, and review us on your preferred podcast app so that you can be notified when new tracks are posted. And now we would like to ask our guests to take a quick minute to formally introduce themselves. Patty, let's start with you.

Hey, everyone. I'm Patty Titus. I am the field CISO at Abnormal dot ai.

I have spent over twenty five years in the cybersecurity leadership seat, including as a CISO, most recently a Booking Holdings prior to my abnormal switchover. And these days, I split my time between my day job and happily sitting on this side of the table reviewing submissions for the leadership and workforce development track. Happy to be here.

Thank you, Patty. And John?

Hi. I'm John Johnson.

I've also been in leadership roles in cybersecurity since before the term was used in the mid nineties, so you know, about thirty years, and I was at John Deere for eighteen years, Campbell Soup, and Deloitte, and Los Alamos, and a couple other places. So it's fun now to focus on my nonprofit, which is an educational charity and we're focused on online safety and cyber security, and the ethical use of technology. And we work with kids as young as kindergarten, all the way up through college age and professions. So that's kind of fun to be on that side of the table from the the corporate role these days.

Thank you both for being here today and for your time and dedication to go through the hundreds of call for submissions. And for listeners who aren't familiar, what exactly does the leadership and workforce development track cover? Patty, let's start with you.

Yeah. So the technical side of security is only half the job. The other half of the job is building and leading the people who are actually solving the problems that keep surfacing.

So this track, in my estimation, covers developing the next generation of security leaders and building resilient teams and navigating burnout and retention, and how leadership itself has to evolve as fast as the threat landscape does. So that's my take on this track.

Thank you. And, John, anything to add?

Yeah. We're at a time where technology is rapidly accelerating. I think we see that all around us, in particular with AI. And we have employees who are using AI, some because it's built into the operating system and and the enterprise has embraced it, and others who are using shadow AI, and we may not even be able to detect it. You know, this is something that is just changing every day, and so training becomes sort of a... It's not something where you just can go out and have some canned program that hasn't changed, the script hasn't changed in ten years. It has to be changing very, very frequently. And in security, because risk management is sort of our focus, we're risk advisers to the board and to the executives.

We need to be able to prepare for the risks of tomorrow. That means we need to have people that keep up with the technology as it evolves. And so I think that because of that pace of technology, it's becoming harder and harder to to keep up with it. And a lot of the traditional methods may not serve us well in the future.

Yeah. And I think that all ties back to what Patty said about, you know, leading through change, and the leadership aspect of this track is hugely important and obvious in the title as is the workforce development. And it's also tied in there are these elements of human risk management, you know, obviously, development, but also, like, developing a security first culture. Right? So what kinds of themes or even topics within those of leadership, human risk management, career development, personnel management, culture creation. What sort of topics are you expecting to see in this track? And are there any you rarely see in your experience as a program career reviewer, but you're like, I really wanna see something on this this year?

I think that we assume that leaders are leaders already, and they don't need more training sometimes. And and I don't think that's the case. I think that their job is even harder. To Patty's point earlier, you know, we can train people on technical things, but it's the soft skills, as they say, the ability to communicate, and the ability to lead.

And so as a leader, it's becoming a harder job. And I think that we need to provide some good guidance to say, hey, these days things are changing fast. The risk, it's hard to codify the risk and present it effectively to the board. Maybe people are having problems getting the budget that they need to do the job right.

And I think that as the technology is changing, we need to target our audience and tailor what we say specifically to the audience.

That's something that we're seeing AI doing a good job when they send me spam.

But we need, as leaders, to maybe reframe things. I don't know. What do you think, Patty?

So I think we'll probably see a lot of submissions, to be honest with you, in mentoring and career pathing. And we have continued to talk about that as leaders in cybersecurity, which is great. And and certainly we we do want to see some of those. But I rarely have seen or heard talked about leaders measuring burnout as an operational risk instead of an HR issue and something that's backed by real data and real programs. Like, how are we really doing this, not just having good intentions?

And I would also love to hear more about how AI is changing what we actually ask of our teams day to day and how are we going to uplevel skills and promote that internal growth.

And something that I've always been on a soapbox about is inclusive and diverse cultures.

And what I mean by inclusive and diverse is not just the color of our skin or the gender we identify with.

It also has to pull in neurodiversity. And neurodiversity is something that the EQ and IQ, we need to also talk about how we're leading with those things in mind.

I'm over here on mute. Like, yes, Patty. Yes.

And I think that, you know, I I love that question that you asked about how AI is asking more or different things of our workforce.

But I also wanna double down on the definition of inclusion. Right? Because it's not... Like, there are there are so many layers to the iceberg of, like, socioeconomic status, education, background. Like, there are so many things that people bring to their experience that really make them such rich candidates that a lot of times we kind of are dismissive of at first because it doesn't fit some sort of bill. So I challenge people to think differently about what makes a great candidate.

And, you know, when people now are thinking about what kind of topic to submit, they will put cool data, cool facts, like, really good important things. But sometimes it's hard to tell what they're trying to get to without that storytelling. So how important is it for speakers to bring a personal story or even a case study rather than a purely conceptual talk? And what's the ideal balance between here's the problem, and then here's what I did about it in an abstract?

Yeah. So I have to openly admit I do like good stories, but I like those personal stories.

You know, those personal stories, I think, are what really makes it stick. I think the statistics and the and the the purely conceptual talks are great at the bar, at the W, at some place where you're having a cocktail. So what I would say, nobody really is going to remember a slide of frameworks a week later.

What separates a good abstract from a forgettable one is the second half.

Like, here's what happened when I tried this. Here's what broke. Here's what I'd do differently.

I want to see some of the scar tissue. I like it when people are a bit... Little bit vulnerable, not just the theory of it. Although, honestly, we all read theoretical books so that we try to figure it out before it happens to us.

But if I had to put a number on it, I'd aim for a quarter of the problem framing and then three quarters of what you actually did to solve the problem. And don't forget to add the battle scars to it because that's what makes it real and tangible. And really bring your genuine self to the conversation. If you wanna talk theory, that's probably done in a different forum.

Yeah. I think that's a communication skill that leaders need to learn as well.

It's necessary to have your story that resonates with people, because then they retain it.

You make it personal, you be a little bit vulnerable, you know, people are going to get more engaged with your story, and of course, as you said, Patty, you have to actually tell us, you know, what you did and how this turned out. It's important when you're submitting for RSA conference to have not only your theory and your story, but you need to have takeaways. Know, people are here to learn and apply what they've learned when they get back to the office. And so that's a very important thing in getting selected is the ability to have a have a clear story, be able to present actual results, and to be able to put it in terms that the audience can consume and apply.

Those are great tips and good advice.

Let's turn that coin over and maybe talk about what's the most common mistake you see in submissions. What should submitters avoid doing instead so that they turn that not accepted into an accept?

If you work for a vendor, it's even harder to sell us that you're not selling something. Right?

And so when you have it submitted by, you know, the head of marketing or or, you know, somebody from marketing and sales, you know, we're we're highly skeptical. And so the same thing with panels, you know, the last thing that we want... And and there may be good stories. That's, know, war stories, but maybe not applicable stories.

They come out of something like that. If everybody is is agreeing and nodding their heads, then I don't feel the audience walks away. Hey, that was really good, but I don't have any memorable nuggets to to take with me.

We are happy to have someone with a good thesis, a good abstract, change their title, do wordsmithing, that's fine, and we'll we'll help provide some guidance if we think that, you know, something is wrong. So don't focus on it being clever and catchy that way.

Just focus, I think, on having content that can be meaningful to our audience.

I couldn't agree with you more, John. And I think one of the biggest mistakes that I've seen in submissions in previous years is the topic instead of a talk, meaning burnout in cyber is a topic.

A talk has a point of view, a specific story, a takeaway someone can use Monday morning when they go back into the office after rush week called RSAC. So avoid the survey of industry approach and pick one narrow honest experience and go deep.

If you feel like you need to submit a panel, have some contrarian on it that's going to disagree with what is being said. Have different points of view and and you'll get that if you have good leaders across vertical industries. That's the other thing that we see a lot is people like to submit a group of people from their company talking. You know, points of view are having someone that either is or was in the government in public sector, somebody that is or was in financial services, and get yourself across sector for if you really feel compelled to submit a panel.

But I do also jump on John's bandwagon there. The first pass, I usually go through and look for a sales pitch. And if it looks like a sales pitch, it's going to get pitched.

So keep it genuine, keep it honest.

But I'm done. Yeah. You can you can sell on the exhibit hall floor.

If it if it walks like a duck. Right?

Yeah.

But there's nothing to say that, you know, there are... And I don't wanna lump them into a category of it's a vendor or a consulting firm or whatever, but there are good perspectives and stories to be told throughout our ecosystem. So I don't want to pick on vendors, but I want to say that this isn't an easy way to avoid being a sponsor at RSA by just putting in a talk and then selling on stage, because we won't invite you back.

We're very careful about that, but you know, bring a practitioner, bring a customer. If you're a vendor and you want to tell a case story, you know, we have a we have a lot of those where we'll have a co presenter. And then you're right, Patty. We need people with different different perspectives, different backgrounds that can discuss things and not always see eye to eye on the panel if we're talking about panels.

Yeah. And as we know, the industry in the cybersecurity field right now, it's facing incredible changes at a rapid speed.

And when we think about leadership, we think about, you know, it's not just steering through calm waters, but it's also about how you navigate through the storm. One could argue that there has never been a more important time for a strong leadership. So for those who are listening and, you know, are on the fence about submitting something for this track, what would you say to convince them to just go for it?

Aside from just do it.

Yeah. So I would say if you've ever fixed something about how your team works, even something small, that's a talk.

The industry is moving fast enough right now that people are hungry for real leadership examples, not just technical ones.

Submit it. Worst case, you have feedback that makes the next version stronger. But there are some really important talks that need to be had in our industry, and we're not talking about them. And sometimes it makes it easier to talk about it when you're no longer in that job in that company, but there are little pieces of information people will glean from your discussion that they can take back those nuggets of really important things that can help them exponentially move through their career path. So I would say don't be afraid to submit.

Sometimes it's the small things that end up being so important, and when you look back at it, it seemed like a small thing. But at the time, it was really big. Capitalize on those things.

John?

If you have a a good story to tell, if you have something that you're passionate about, be open and and share it. We would like to see it, even if it's not selected.

You know, a lot of what we do on the program committee for a track selection is we'd like to see a talk covering this or this or this, and we don't have enough room to just add as many as we want. We're... We have a very limited number per track that we can select, and so we try to select the best one for each of these topics. And so if there's something that you feel, hey, this is topical, timely, I've got the expertise, I've got a good story, I think the... That the audience will relate to this, don't make it too narrow, make make sure that it's relatable, because you're gonna have people from different industries in the room. You know, you don't wanna water things down, but you know, take into account the audience and put something together that gives us a good idea in your in your abstract of what you're gonna cover, and we'll take it seriously, and I would encourage you to submit.

I love that enthusiasm and the encouragement. I think a lot of people need to hear it, and hopefully, this will inspire them. I think one thing that both of you are super fortunate about is that this is a track that kinda lends itself to storytelling. Right? And there is, you know, a lot of experience and personal interaction and engagement among a workforce that just naturally is, you know, so rich with story. And so it's a real opportunity for you folks to read some incredible submissions and might make the job a little challenging because hopefully everyone is sharing a lot of really good stories that are difficult to select which ones get to the top. But I'm excited to see what comes through, and I'm excited to see what you all select in the final submissions.

John and Patty, thank you so much for being here today. Listeners, thank you for tuning in. Please keep the conversation going in our RSAC membership platform by visiting 1rsac.com/membership. And be sure to check 1rsac.com for new content posted year round. Until next time.