Podcast Transcript

Welcome to the RSAC Cyber at the Top podcast, where security leaders across industries share the strategies, hard lessons, and real experiences shaping modern cybersecurity and AI. Insights are grounded in community and built for every level of profession.

For a CISO, reporting directly to the CEO changes how you communicate risk, how you build trust, and how you balance security priorities against business goals. It can be an opportunity, but it also comes with real pressure.

In today's episode, I am so excited to be joined by Frank Fischer, Group CISO at DHL, one of the world's largest logistics and supply chain companies.

Frank reports to the CEO and has experience navigating that relationship.

We'll talk about what makes the CISO/CEO relationship work, what potential mistakes CISOs should watch out for, and whether CEO reporting is the right model for every organization. Frank, thank you so much for being here.

Thanks for having me.

So I'm looking forward to this topic. It is a very hot topic in the CISO community, has been for a while. But maybe to... Just to start off, can you give us a quick overview of your role and your current reporting structure at DHL?

Yeah. Sure. I can. Yeah. I report to the CEO of the group. Right? Basically, we have also CEOs of divisions, but the COP report is made up of all the CEOs, and thereby, I report to the boss if you want.

I'm heading up cybersecurity for the group, but that means everything from government's risk and compliance to any operational steering that basically falls in my responsibility. So if we have to move any cybersecurity programs dealing with incidents that eventually ends up on my table as far as it hits the group, right, obviously, I have divisional colleagues that help with, let's say, the divisional nature of the business.

Helpful because I I know that there are many organizations that have these BSOs and different relationships of rolling up. So that's super clarifying. And and let me let me ask this. You know, when you first began reporting to the CEO, and, you know, that that may have been the case coming in even to DHL, What surprised you the most? Whenever in your career was that first time reporting to the CEO, what what was the thing that you didn't really expect?

I guess he was reasonably interested in cybersecurity, cybersecurity, which is not the norm. I guess you have different types of CEOs, right, some of which are much more in the business side. And I guess it's because he's engineered by origin, right? So he's obviously interested in technology and what have you.

So that was probably my first surprise that he really had a hang for the topic to a certain degree.

And, certainly, he has quite a technology focus. Right? So he's pretty swift in adopting and consuming new topics. Right? So that's... Also, he's very snappy on that one. So we can have conversations almost in machine codes, right, if you want.

And it... Well, it sounds like there's real empathy there too. Right? Because he's both interested and technical.

Yeah. We we had our honeymoon. Right? Let's put it that one.

We took us about maybe four months, really, to lean on one another. Right? Because you said one thing very properly. Right?

To learn the mechanics of the group is quite critical to be successful in that job. Right? And so at some stage, I just went back to him and said, you really have to coach me on the mechanics and the dynamics here because you obviously know it all inside out. You've been with the company twenty plus years, right, in all sorts of divisions, in all sorts of positions.

Right? So you have to help me out how I steer this boat, right? Because it's not trivial, right? You obviously have to form alliances, and therefore, we had to come together, right?

It took a while, right? We both have our edges, right? And we're not always compromising on certain things, right? So we had a fair amount of debate in the first four months, but useful debates, right?

It could help. It helped us to really understand each other's position and probably come back to that later. And by listening in to what's really important to him and, obviously, to the Board, helps immensely to understand how do you position cybersecurity in the business context.

What do you think makes for an effective CISO CEO relationship? What what... What's the the secret sauce or what's some of the key things that you found?

I guess to be dead honest. Right? So honesty is always valued. Other parts certainly is...

Have a certain degree of openness for, let's say, business realities. Right? So kind of walk in each other's shoes is probably the best way to describe it. The other part is clearly straight talk.

Right? So I guess what he dislikes, and he often smirks at that when people try to beat about the bush and don't get to the heart of it. Right? And it takes a while because he's pretty quick thinker.

So if it it takes you long to convey a story, he gets pretty impatient. Right? So it's really necessary to adjust to that mode of communication, right, and to figure out, okay, how do we interact, how do we make it effective, how do we focus on certain items. And after a while, there's also an emotional twist to it.

And I remember a conversation I had in a year into the job where we discussed, okay. How how was our journey? Right? And then he basically reflect, okay.

After four months, I wasn't so sure if that's gonna work out. Right? Because, obviously, different positions on certain items.

And...

But he actually acknowledged even if my ways of may of things is sometimes especially got to appreciate it. Right? So that was probably the biggest appreciation I could get at that point. So, yeah, it takes a while.

Right? We had our...

With our differences. Right? But we...

Because we found him a a mode of operation, and I frequently ask him to coach me. Right? So that's sometimes an interesting twist. Right?

So rather than suggesting or guessing around, right, get the top man's view. Right? It's quite useful. And if you listen to it carefully, it helps you out.

Oh, that's that's a great piece of advice. It's it's one of those things that you hear. And in retrospect, it sounds obvious, but I think if you're in that spot, you don't think about it that way. You're new in this relationship.

This is this is the big, big, big boss. They don't have time to coach me. You know, they they may not even have interest in doing it. So that's that's actually really helpful to think about it that way.

And and and I'm wondering, what mistakes do you think that CSOs may make in general when communicating with the CEOs? I know you're you're involved in a CISO community in a fundamental way globally. So this may be from your own experience or others. What are some of the mistakes either that you've run into or that you've seen about CISO communication with the CEO?

I guess it's probably starting with a lack of appreciation for the business. Right? If you don't really like the business and like to know what makes the company tick and successful, right, because you will have a hard time. Right?

That's absolutely critical. So I love business processes, so I probably toured all sorts of divisions in my first twelve months. Right? So travel was quite a part of my job, right, to really to get to know how we work, how we actually lift the approach we have, how do we implement strategy, what do the people on the ground need from us, right, in order to be successful, what are the needs and and pains, right, and really get a kind of holistic picture of how we operate and on which level, right?

So understanding also division of flavors, what's different between global and local, right? So country level, operate we in more than two twenty countries, right? That gives you a lot of flavors, and there's certainly a certain need of appreciating that variety.

The other part is really getting to the point, right? So we talked about that a little bit earlier.

And and figuring out how you translate it also to other board members. Right? He might be tech biased. Right?

That doesn't mean others are. Right? So we have board members. They look at you more as a person.

Right? Do you fit the team? Right? Do you play in the team? Right? Do...

Are you a member of the group? And so that's that's much more emotional. It's much more do I fit in, and how do I make a living with those people, and how do I convey my topic, let's say, fashion. Right?

People can understand. So really tailor the message to the audience. Right? And not everybody is equal, and and he's probably, in this case, a little special because he always, yeah, has the...

Kind of the ambition to win. I guess you have to have that as a CEO, right, which probably unites us. Right? And then if both wanna win, there's always a trade to happen.

Right? So that's interesting, and we actually appreciate it. Sometimes it becomes an interesting gameplay. Also, you need to really deliver things.

Right? So you're actually measured by outcome more than ever everywhere else. Right? So it's important to stay on the path, not get distracted.

Right? And if things happen, right, to rationalize them first and then come back with a sound proposal. Right? So I would never show up with risks without the mitigation plan, for instance.

Right? That's just a trait you have to have.

So think about how you fix it. Think about what you need from him, and then we have a constructive conversation that also delivers outcomes. Right? And for instance, we had a extensive conversation about how do we fix some basics. Right? Because cyber is obviously relying on a lot of IT and and data topics.

Now I could have take the position. Right? Somebody else has to do it. Right? But I rather propose let's do that together.

Let's fix it together with the IT teams, right, and make sure it actually works. And even if I had to take the lead, right, I need that in order to operate properly, so I go fix it myself even though people have tried repeatedly and may have failed in the past. That's not a reason not to try.

And I guess that's the other thing what probably surprised me, coming back to your original question. There's a certain tolerance for difficult situations. Right?

It's not automatically a bad thing to expose a difficult situation as long as we have a conversation how to deal with it. Right? So I guess there's a frequent fear to expose bad news to that level. Right?

But they're all too familiar with bad news. They see bad news every day. Right? I mean, he sometimes mocks me a little bit.

Right? When I call, it's usually trouble. Right? So, unfortunately, that's true because I try not to call him, right, at least not casually, right, without a reason.

And we see each other quite a bit. But if I call him, it really has a reason. So usually, it's a bad message I bring to the table, and that's something he actually rather appreciates. So dealing with difficult items is not a problem as long as you conceive a plan how to deal in a constructive fashion with it.

Right? That's that's probably one thing. So not doing that is certainly a failure. Overselling your abilities is certainly also something I would clearly discourage to do.

And so understand what is your ability to act is absolutely crucial because that defines your option space. So whatever you come forward with, there might be difficult consequences, and there might be difficult compromises to reach.

Too often, we are caught in between what operation needs, what strategy needs, and where the risk was. Right? So...

And then we need to keep that balance. And so what you learn is to get really pragmatic. Right? Not being pragmatic would be probably the nail in the coffin.

Right? If I would try to be the super security guy, right, that locks everything down, right, that would not work with him.

And shut the business down as a result and no no Yeah.

Exactly. So super secure, but not operable anymore. Right? So don't do it. Right? And and and I guess last but not least, it's certainly also the ability to look left and right.

So we often have conversations. I mean, we currently have an IT board. We don't have a group CIO, but we obviously start picking up group CIO type topics. Right?

Because I have a co CIO, if you want, right, that deals with cross divisional topics. Right? But, eventually, it's not gonna end up in our both labs. Right?

So when we are in the board, we often pick it equally. Right? So it's not to be too focused on the...

On your job frame, right, and then look a little bit more holistically and be entrepreneurial is probably something that is absolutely needed. Right? So think about this more like, is it...

If it's your own company, what are gonna do? Right? How would you steer that forward? Right?

What is the trade off you would have to do in order to keep the business running but still protect the downside. So where...

How does that work? Right? Sometimes it feels like sparing the circle, but there's very often appreciation for risks. Right?

And it's just requires exploring.

Well, let let me ask you this, which might be might be a controversial topic. But if I think about the the situation you've described, you have a CEO. They're tech savvy. They value directness and being to the point. They're interested in cyber.

You've got lots of different types of CEOs in the world. Do you think that every CISO should report to the CEO, or are there cases where that's just not the right model? Yeah.

It's really a question how the company wants that type of risk to be managed. Right? I I know a lot of companies where that's a clear strategy to introduce a buffer between the CEO and the CISO, right, just for the sake of having liabilities covered, right? Because to a certain degree certain organizations I was part of also had that model, which had its flavors. Right?

But it obviously also limits your ability to maneuver. Right? Sometimes it also limits the ability of changing things around the way they need to be changed. But clearly, it's it's it's a way to contain certain types of risks more effectively, right?

So it's probably a maturity topic, right? So to your point, it requires a fair amount of sensitivity, right, how risks are being perceived. So in our corporate governance model, right, so if you look to look at the Board, right, in Anglo American terms, that is clearly risk focused. So the management team obviously does the business operations, but the Board would clearly be focused on risk.

So that's a level higher, right? So you end up talking to these people as well, right, with even less of involve less involvement into day to operations. So we purely talk about risks. And so that interaction, how do we create a risk ecosystem that's favorable for the company while protecting the downside, dealing with the obvious disruption we are facing, right?

That's, I guess, immensely important.

And that also defines a little bit the relationship. So eventually, you can be successful if you feel that you're part of the table, right? If you act like being one of the table, right, then it basically gets the right outcomes because you start balancing things in a collective fashion. So it's not you alone.

It's basically the entire board that steers it, and then also helps you get direction, right? What's actually favorable? Where do we need to take trade offs? Where do we take a conscious risk, Right?

Because we don't know it better. Right? We're facing a situation nobody has faced before. Right?

Take The Middle East. Right? So that's something which isn't kind of the normal type of incident. Right?

And you need to trade off things very quickly and respond to situations very quickly. So situational awareness, having holistic situational rumors, those type of things is quite helpful for the management team and the board members. So back to your question, is it for everybody? Certainly not.

If you feel like you don't wanna have that business acumen, you wanna be more on the tech side. Right? So you like the technology. You rather spend 90% in AI models and not talking to the management team.

Right? And if you...

And it's an...

Inevitably...

It's political. Right? So there certainly could be...

It's a political job whether we like it or not. Right? So I have a lot of colleagues, specifically in the divisions. They don't envy to get my job.

Right? They they are actually quite happy that I take the heat. And you said it said it quite clearly in the beginning. Right?

You're closer to the sun. Right?

That is race's edge. Right? Clearly saying that. And if you don't like to...

If you're fearful of heights, so to speak, right, then you shouldn't do it.

Okay. That's that's a very good litmus test. Very practical too. And I wanted to ask you this because I know several folks who are in this situation.

They report to the CEO. It's a relatively new reporting structure for them, but their CEO is not very technical, which is probably more common than not.

How... What advice would you give those folks? Like, how do you build trust with a CEO who may not come from a technical background?

I guess you need to have a role discussion. Right? What...

What's he looking to you for? Right? So what is he looking for when you deliver? Right?

So what is this actually the outcome he wants you to deliver to the table? Because...

And I have that in the corporate Right? So I...

When I talk to different people, I get that flavoring. Right? Because I have folks that are...

They're more on the financial side. So they're more keen on numbers. Right? So there are number of people of kind of few populate...

Certain population of CEOs, performers, CFOs. Right? I guess it's a fair assumption. So you have people that are very number minded, so you need to know your numbers.

I mean, that's also a running gag between my CEO and I because we also talk about numbers quite frequently. So you have to have your ducks in a row. So that's that's that other flavor. You certainly always have, but it's not always taking the lead here.

There are people like some of the divisional CEOs who really want you to cover the risks. So they want you to protect them. Right? They wanna make sure they have a safe operation.

So resilient operation is the name of the game for us, for instance. Right? So we do everything to make operation resilient. We have it in all flavors, in all countries, in all functions, and it's always something we do repeatedly.

Right? So a fair amount of the job is how do you think resilience. So business resilience is usually something everybody relates to no matter how technical or untechnical he is, right, because he wants the business to be successful. Therefore, he needs to build business resilience into his operational body.

And that's usually a topic everybody can relate to. So talking about business resilience, business risk, outcomes, how do I fulfill strategic targets? Like, we usually have growth targets. I have functional targets.

I have market targets. I have maybe people targets. So those items...

So also when you talk to the head of staff, right, then that has different flavors. Right? And then depending on where thing...

People came from, what their origin was, you need to listen very carefully and then figure out, okay, what is my connection? How do I establish that, and how do I make a successful team? Because it's a team play. Right?

It's almost like a football team. So you win together or you lose together. Right? But the the one thing is clear.

Do it together in honesty and in transparency.

Oh, that that... That's great advice. And and I guess my next question is really a follow-up to that. How do you end up translating cyber risk into something that resonates either with the CEO or these board members. You mentioned resilience. You mentioned true business risk. Sounds like tailoring it a little bit to their specific function or piece of your coming to them.

Any any any advice or insight you'd give on this?

Yeah. Well, I I remember just anecdotally. I remember my first corporate board meeting. So kind of three months into the job, showing up at the corporate board, and it wasn't just the intro of the the guy.

It was actually how do you think about your strategy. Right? What's important? And and I spend a fair amount of time in every one of the divisions to really figure out, number one, what's your top issues.

Right? What keeps you awake at night?

Business sides. Right?

What is your technical debt? Right? So what does everybody have as an issue, right, and try to solve it and didn't get the job done in the past?

So I I had a little back book in the absence of a better world where where I collected all the issues and everything I learned, right, where I had an opinion. Right?

And so...

And then I ended up talking to them one by one. So I really made sure I had one to one, at least half an hour or an hour with them to really understand their view of the business. So how do they want to steer? What's their thing...

Thoughts about strategy? What do they think they need for me to succeed? So how could I help them achieve their targets? Right?

What what is the critical piece? Right?

And so collecting that together, I built basically my strategy and then actually had a little bit of a carrot for every one of them. So I could actually...

In the board meeting, I could go around, drop in, and address everyone individually. Say, I understood this is your key issue. Right? We had conversations with your team.

They think this is the best way. I have a different twist, which actually benefits us all. Right? And then I went around Robin.

And after the meeting, which actually went pretty well, my CEO came back and said, you can't possibly do this every meeting, can you? Right? So...

And I said, well, it's actually my second nature. I love doing this, right, because I love to relate to people. I'd love to understand how how I can help them. How can I be a valuable member of that team?

Right? And that made it actually flick over. Right? So that eventually got me the job, right, being three or four months in.

Right?

That's fantastic. And it sounds like really being a student, not just of the business, but of the individual that's run... They're either running a function, they're running a division, knowing what really matters to them, and then taking that risk and putting it into their context. And I I would imagine that creates a great empathy too in between both parties.

It does. Right. So...

And and we do that on a regular basis. So we always have a top executive meeting once a year. It's about 70 people. They come together where you have a fair chance to talk to them.

Right? And...

But I always try to have at least one or twice a year, a solid one to one with them to understand their view of things. And sometimes we have that ad hoc, right, because we have something going on in their division. It bubbles up. Right?

We need to talk about it, and then all of a sudden, you have...

Sometimes get a lecture about the business, which is good. Right? So they sometimes give you an insights, right, which is helpful. And we get more and more into problem solving together.

Right? So it's it's not kind of one dimensional. It's not just cyber. Right? It's how do I interact with you?

How do I help you with the divestiture or whatever? Right? So it it could be many things. And in some cases, it's also following the business transformation we see in certain areas, and that needs to be sided with cyber.

Right? So we wanna make sure we have a proper cyber envelope around it.

I wanted to key in on something that you mentioned earlier that when you when you call and reach out, maybe an unscheduled meeting with the CEO or suddenly pop up on his calendar, he immediately thinks you're about to deliver bad news. So when you do need to deliver bad news, which, you know, being in this role, occasionally, you will, What what is the best approach to that conversation with the CEO? You mentioned honesty, being direct, being concise, coming with a solution, not just here's a problem. I'm laying it at your lap. What what additional... Like, this is such a such a huge everyday issue for everybody in that role.

I guess, have a decent understanding of the situation. Right? So whatever it is. Right? I mean, usually, we end up talking about incidents.

Right? So no...

Of us in our discipline is free of incidents. I guess the the biggest challenge in my view is really ambiguity. Right? So if you don't know what's going on, right, so where you still need to do the digging, you have the containment team protecting your operations, but at the same time, you're still chasing the adversary or you're chasing kind of the forensics team.

Right? So you're trying to figure out what actually happened.

And it's important you kind of keep a lifeline. Right? So you take the first possible location to get them informed even if you have full uncertainty. Right? And, usually, we have that conversation.

Hey. I know there's something going on. I just give you a heads up. I send them a quick text, and then it's okay. I will call the board because we feel that this is a cross divisional topic. Right? So we need to bring everybody in.

And we had a fair amount of alerting topics. Right? So how do you alert people properly? And I recall one incident where I was able to get everybody around the table but him because he was in a business meeting, and he had his phone on silent.

And we called and tried every possible avenue to reach him. But for some reason, he somehow misplaced it, and it didn't ring. Right? So it didn't vibrate even.

Right? So for some reason, it...

I was muted. Right? Or it didn't have me in the contact list, whatever. The biggest issue wasn't that I eventually got him on, and then we had the whole team together and got the problem solving going.

What bugged him the most was that he wasn't part of that solution effort from day one or from the first minute. Right? So that delay was more the concern. So we made a few adjustments, anecdotally, about how we alert people.

And, I guess, you learn how the individual reacts to certain messages, and then we frequently have that tweaking of the phone, how you make it ring and those type of things. So that's became a pattern if you want, but it's really crucial to get the people online as fast as you can no matter what. Right? And I guess, meanwhile, we have a drill.

So they frequently watch certain channels. Right? And they're restricted to a very small population. So it's very selective.

So if something hits that channel, it's important. So it doesn't get drowned in other messages. Right? And so we have always that kind of discussion, how do we react selectively on operational issues while we probably go broad for strategic direction, right?

So being inclusive on strategy, but being specific in operation is certainly one of the traits we have there.

Well, I I also wanted to unpack one more thing you said earlier, which is being a business enabler.

Right? Because you talked about for these divisional heads or even for the folks on the board, you wanna talk to them in terms of business solutions. You wanna help them as opposed to being the person that says, no. We're gonna put additional kind of restrictions and guardrails around you. What advice in general would you give to folks on how to better become that business enabler?

Yeah. Sometimes it's a hard job, to be honest. Right? Because you have two hearts in your chest.

Right? One is you wanna make sure that the risks are protected, and, you know, if you go too far, it actually becomes prohibitive for the business. Right? So there's a limit of what you can ask them to do.

On the other hand, you sometimes have to educate them that it's the right thing to probably go the extra mile even if it hurts.

So I guess it's a compromise that requires both sides to recognize each other's needs and then where the downsides are. Eventually, it's their liability, right? So as much as I do my job, right, they take the liability. So it's essentially me protecting them, right? And I guess it took us a while to realize that, right, and then have that done on the individual level.

And as I mentioned earlier, some of them act more through their ops team, so they would probably not look for the topic themselves, but they would expect that I had done that with their ops team.

So let's say, the head of aviation. Right? So if we have an issue with our with our fleet, right, then I would talk to the head of aviation rather than to the CEO. Right?

Because I know he's the guy who's at the steering wheel. Right? And I need to get it done with him. Right?

So we can come back to him and say, look.

This is what happened. Right? Here, we have an issue. Right? This is where we need your support.

Please unlock this problem. Right? And rather than, okay, I'll give you a long talk about what are the technical specifics of a certain problem, right, that would not relate to him. So...

But in another place, so when I have, let's say, I have a finance conversation, right, and we talk about internal control system, right, then that's something where we could get a lot of passionate finance people involved in there because they have an opinion of how we interrelate with our annual auditor. Right? So...

And those type of relationships require certain treatments. So you could almost say we have programs running with each and every one of them. Right? So my programs touch all divisions in one or the other way.

And we often surface that to them, and sometimes we do a fair amount of education. And, clearly, we did AI education to a certain degree. We educated them about cyber threats. So we gave them a lecture and walked them through how do we do threat intel. Right?

That was an interesting situation because we got a lot of questions saying, how do you do this? How do you do that? Right? How...

And then we looked into the machine room in our cyber defense center. Right? So...

And we kind of combined that and then gave them a firsthand education. So what is what the market says? How do we make that specific to us? And how do we make it actionable for you guys?

Right? So how do we translate that into actionable changes that help the business? Right? And that's, I guess, the story to say.

So you end up storytelling. Right? That's probably the best advice I can give. So figure out how you story tell with each of the board members or your management team, and then figure out what they're...

What they listen to. Right? Because everybody has a hook. Right? And you need to figure out what's that hook, and then usually get people much more interested if you play towards that.

I'm wondering if you had to give the CEO advice, not not your CEO, but CEOs in general, where should they lean in on cyber, and where should they be more hands off? And just in your experience and talking to many of your peers, what do you think? What... What's some areas that the CEO should lean more into in cyber, and what areas do you think they're actually not that important for the CEO to be focused on?

Yes. The most critical thing is to have a proper mandate. Right? So he has your back if things get tough.

Right? So...

And that's both in change management, which all of...

Often has cultural implications. So we end up working against habits. Right? So that's usually difficult.

Right? Rewriting the human firmware is pretty difficult. So it's one of the most difficult items, I guess, we can face. Right?

So that's certainly a topic he absolutely has to be on board with. Right? So he has to have your back. Sometimes it's helpful if he doesn't get into solutioning.

Right? So, specifically, if you have tech focused people, right, they love solutioning. Right? He once mentioned to me, yeah, it's it's great we have that opportunity to solve it together.

And I thought to myself, okay. Yeah. Let's deal with that. That's not exactly something you're looking for.

Right? Because you actually have laid out your plan. Right? And then you end up having an add on education.

Now what we did, because I felt that this is important to him, we now have interim education sessions, right, where we have an off the board kind of conversation and have the ability to sound ideas to get his perspective into a proposal. Right? And then also sometimes levels that perception because he obviously gets a lot of influences from all sorts of parties, right, external and internal. And sometimes you really have to be adamant about a certain concept.

Right? So, yeah, you heard this, but it's still wrong.

We have to do it differently. Right? Yeah. So don't listen to this because it's the wrong source.

Right? So please trust me, and and this is important. So I guess also the trust lover. Right?

So really trusting the source and then not always being questioned. Because if he starts questioning what you do, right, then that erodes your trust also in front of the board. So we had that kind of discussion in the beginning, and so we found trade offs. Right?

Because sometimes you feel, yeah, he has competing positions in his ads. Right? And then he's probably leaning to one or the other. So to your point, what should CEOs lean to?

I guess they should recognize cyber as being a business factor.

That actually helps them to protect the downside and also protect maybe challenging operational states.

On the other hand, I guess it's fair to say you'd need to have some sort of a pragmatic sense for how things get implemented. Right? Because there's only so much you can have people do for you and what you can afford in the field. Right?

Specifically in field teams, I mean, you have a huge field force. Right? They're so far away from the corporate headquarters. Right?

You you truly...

And I...

That's what I do. Right? I work with them. I get on the ground. I do last mile duty, right, if necessary, and that's a trait we have as executives.

We all do last mile duty once in a year or in a couple of times.

And and that really gets your hang for what is important. And with that knowledge, right, you can see things differently because you can reflect about, okay, if I'm on the ground where the rubber meets the road, how do people feel about what I'm deciding about? Right? Is it burdening them? And how do I reduce burden so they can still make a living because their job's hard enough. I don't make it even harder.

And so how could I help them actually on the other hand? Right? So things like easy access, right, is a pretty good example. So if we get easy and secure access, right, big topic. Right? How do we get secure access done properly?

It's a huge battle, right, which we have across all layers of the organization because you need to look at so many things that... Moving parts, right, that could go wrong, and then you want to have a good user experience. So you end up talking about user experience extensively. And I guess that's what's absolutely critical. If you like the business, if you feel it, right, and you can also take the perspective of people that really do the job for the company on a day to day basis and how you give them an edge and kind of make their life probably a little bit easier that... And still protect the risk. Right? Then that's probably the middle ground we're all looking for.

That... That's such a great piece of advice because I can imagine if you have seven different ways you can propose to solve a problem, but you have empathy with the folks that are on the ground actually using it, you would self edit out those... Some of those solutions that you know are gonna be heavily disruptive to those folks because you've walked a mile in their shoes, for example. So that's that's very, very... Yeah. That... That's that's great advice.

Probably one more thing. At an organization our size, you never have one population. Right? No matter which layer you go, you always have dozens of populations.

Right? So you end up getting pretty custom, pretty tailored to certain customer, quote, unquote, customer groups, employee groups, partner groups, what have you. Right? So you try to really figure out how do we deal with that complexity while still getting economies of scale.

I guess that's the other dilemma you have here. If you're so widespread, right, you have all sorts of flavors.

How do you get something that still scales, right, where things are still common in nature while you can't afford, you know, 500 different flavors of a solution? That's just not durable. Right? You can't also do the costing for that.

Right? So maybe that's the last point. You need to have a certain entrepreneurial view of what does that actually mean in the long run. Right?

So you have built, but you also have run cost. You have life cycle cost. So the costing side, the impact, the user perception, user experience topics, right, these are all elements, right, that need to come to bear to make a kind of a complete picture. Right?

And as cyber experts, we often tend to just look at it from one angle. Right? And I guess in that position, you need to look at it in a three sixty degree view, right, and then really figure out where do I need to lean to. Right?

Do I have to tell them a hard story? Because it's just impossible. The technology doesn't give me the ability to simplify it even more. So they probably have to go through that high route, but only once.

Right? It's like a bad medicine. Right? So you take it once and you cure it.

But, unfortunately, that event where you have to swallow it, that's an unpleasant experience. Right? And you can't help it.

Two more questions for you. Yeah. The first is, have you seen a real shift just in terms of the CSO's view and insight into cybersecurity over the last few years?

Has has there been a shift? Are they more focused on it? And what do you think's changed the most just in terms of a CEO's awareness of cyber and the cyber issues?

Maybe a couple of steers. One, they obviously get influenced by big partners. Right? So they...

No matter whether they're suppliers or customers. Right? So either way, they get data points from them. Right?

And it...

It's peer information. It's big suppliers' information. Let's say it's trusted source information that gives them a steer. Then also the entire situational awareness we have right now, right, and everybody's under siege, right, so we know that.

And that accounts for a certain amount of incident levels, right, big or small. But just the sheer number, that's the reason we also did threat intel education, right, to really give them a chance to understand what is the magnitude we are dealing with. Right? How many hundreds of thousands or millions of events do we have to process for our infrastructure before it trickles down to an analyst desk and how many are left then?

Or do it...

What does that eventually mean for the invest we have to take, and why is it important that we have that level of transparency? Right? So it's kind of lighting up a little bit the way they operate, and they operate very much from a resiliency point of view. So we just recently had that conversation in in operational technology.

Right? Yeah. They all have nice dashboards and tell you how great the operations are running and the red and the green lights, but they don't see necessarily if somebody is going low and slow, and three days later, all of these green lights will turn red. Right?

That's a different view. Right? And they, first of all, have to appreciate they're looking the wrong direction.

So, yeah, you guys have a great ops team. Right? And they do a fantastic job. Right?

And they always have your back. Right? But what you don't see, you can't defend. Right?

So you need to look in a different direction to be prepared. So we ended up having a lot of preparedness conversation. And to...

Back to your point, so big incidents, right, in the industry. Also, let's say, invest that was done in other places, right, that are comparable. So we had that conversation. What do you deem to be a comparable enterprise, you look for advice.

Right? Because at that level, there's very few people you can look for advice.

Right? So who you take as a trusted adviser and who is probably a trusted source you would listen to. Right? So if I know that, I can talk to that person.

Right? They could figure out, okay, what did they experience? So you're playing a little bit full. Right?

Yeah. I I love that. It's it's getting to the source that's then informing the CEO, but but not in a bad way. You're just trying to understand what other similar business leaders are thinking about, and thus what they're communicating. And is this is this actually a good comparable? And you can advise the CEO based on that.

They have their peer groups. Right? So within the Fortune 100, I mean, most of them know each other, right, for a long time. Right?

And then you can sell your CEO x y z from your peer group, right, here and there. And we had that issue here. Right? So in confidence.

Right? This was a topic they had to deal with. Right? That could happen to us as well.

Right? But you think about how we deal with this. And it doesn't have to be an incident, but it actually gives, let's say, valuable information that he can relate to and which makes sense in the context of maybe a business operation that's similar on our side.

Well, Frank, the last question for you. So much valuable insight during this conversation, And this this is the tough one to ask, but if you had to boil it down and you could give advice to another CISO or even maybe an aspiring CISO, what's the one skill that they should start working on right now if they wanna be effective in front of a CEO?

Get what the business does. Right? So really get what the company make... What makes the company successful. Right? That's that's always the heart of what a CEO worries about.

Frank, I can't tell you how much I appreciate your time. I I know our listeners really will appreciate this conversation. So much valuable insight.

And thank you for being here. Listeners, thank you for tuning in. Please keep the conversation going in our RSAC membership platform by visiting 1rsac.com/membership, and be sure to check 1rsac.com

for new content posted year round. Frank, thank you again. Thanks for making the time for this. Really appreciate it.