How NOT to Lead

Welcome to Cybersecurity Insights, the podcast for the CyberEd.io learning community. Our goal is to bring Cybersecurity practitioners the latest and most relevant education and training to upskill and dive deeper into topics that matter in today's modern Cybersecurity world. Good day everyone, this is Steve King. I'm the managing director for CyberEd.io and today we have the pleasure of Dr.

Chase Cunningham's company on the podcast and Dr. Chase is here to talk about, I hope, his new book called How Not to Lead that's about to be published by Wiley and Company. I think the publication date is January 24th. And it's a fascinating read, not just for cyber security folks, but for everybody in our audience who may not be practitioners or in the space because it has little to do, in my mind, with cyber security and everything to do with leadership in business and probably outside of business as well.

And there are great stories and great chapters and good stuff for everybody, no matter what they're doing. Those are of you who aren't yet familiar with Dr. Cunningham. He's also known in the industry as Dr.

Zero Trust. He's was the creator of the Zero Trust Extended Framework at Forrester, I believe, and was a cybersecurity expert with deep experience across all aspects of enterprise security and work at NSA, Navy, FBI, cyber division, other government mission critical groups. He was recently a chief strategy officer for AirCom software. It was the VP of Security Market Research at G2 and in addition to his services as a Forrester analyst.

So he began, I think, in the Navy as a chief crypto logic technician doing that weird magic stuff with scriptology and has been the director of red intelligence for companies like ARMA and the director of cyber analytics for decisive analytics and has written a few books now, Riptide, Gabriel, cyber warfare, truth tactics and strategies. Gabriel is a, we'll call it a nonfiction book, but fiction ish, fiction ish book as well, unfortunately. Yeah, yeah, yeah, yeah. And who knows, it's a day to day thing, we'll see, but it's very entertaining for those that enjoy what we call military, like thriller type stuff, thriller mystery.

Yeah. So welcome Chase. Thanks for being on the show. Thanks for having me.

It kind of reminds me I've been doing too much lately here in UCLA. Well, you do a lot. You have an amazing current career in addition to your past career. So let's talk about, you know, one of the chapters here is called is in the pudding.

I think it's the last chapter talks about a company that I know a little bit about thread locker. And instead of the focus being on how not to lead, Red lockers are a great example of a company who is, is, is, should be a template for how, how to lead. And in particular, this is going to go to folks that, you know, are in the cybersecurity space because, you know, they're the way they ran their company, of course, is going to be familiar to, or dissimilar to folks that are running cybersecurity companies. So why don't we start by telling us a little bit about Red Locker and your experience of them and why you think it's such a well run company.

Yeah, I mean, so I, I referenced two companies in there just because I never wanted to leave. I find a lot of books that I've read because I spend a lot of time reading like self help and business and whatever else books if I'm not doing cyber work, I'm probably reading a book along those lines. But a lot of them kind of leave you hanging with wall. Where's an example of, you know, the fix or the right way to do this?

And for me, having its knowledge of the folks at threat locker and the folks at Lumu were the two that I put in that chapter. And the reason that that made so much sense to me is that a lot of where we see folks in technology and cyber specifically kind of going wrong, those companies went pretty orthogonal to the current mantra of come up with an idea, get some angels, raise, raise, raise money, and then hopefully sell as fast as possible. And you devalue the hell out of what you're doing financially. And it causes a lot of pain for everybody just because they're dealing with VCs and the other side of the equation.

So these companies have done a good job of really sticking to their guns and following along with their approach. And they've kind of been in that space of we're going to succeed and we're going to succeed the way that we know that this is going to work. And if someone wants to tag along and benefit from that success, great. But they're really good examples, in my opinion, of companies that don't fit the mold that have done exceptionally well and are continuing to do well.

You know, Danny, a threat locker. I've known Danny for quite a long time now, and he and I were an accelerator together. And I remember literally people on day one of the accelerator telling Danny, you can't run a company with your wife as a COO. And Danny was like, I don't care.

That's my wife. I trust her. We're going to do this our way. And sure enough, Danny's unicorn valuation with his wife and his brother as members of the executive team sort of similar-ish with Lumu, where Ricardo was told by all kinds of people, like, you can't build a business doing cyber security, focusing on Latin America.

And R.V. was, he was by R.V. He said, no, we can't, and watch, and his business does a lot of business in Latin America, because no one else would kind of pay attention to that market. And it's just really good examples of smart people that have the intestinal fortitude to know they're doing something different.

And then we continually find ways to succeed. Yeah, it validates the, my premise that one of my startups, where my wife was the CMO and did a great job as a marketing, a cheap marketing officer for three years for us before we exited. And I don't think that would have been possible without her either. So yeah, your chapter one talks about the value of knowing what not to do.

Can you elaborate on what that's, you know, we spend a lot of time on, here's what to do. Here's the, here's the way you get from A to B, but we don't ever rarely talk about the things not to do. Yeah, I think for me personally, and I made sure to write in this book, like every chapter kind of starts out with either a personal story or someone that I've known that's been through something, the first chapter for me talked about when I was a kid and was growing up on a farm or ranch in Texas, learning a very valuable lesson of what not to do from a ranch and, and basically, he told me the right way to do things and what to avoid doing and me being the super intelligent person I am, ignored everything he said. And sure enough, it led to misery for me for days on end.

And further on into that chapter, I did a lot of research looking at Steve Jobs is always kind of seen as, you know, the pinnacle of innovation or whatever else and rightfully so. He's done a lot of great stuff. But what I found was really interesting was Steve made some super categorical changes at Apple, based on literally him writing on a whiteboard. Here's what we're not doing anymore.

When he came back to Apple and that really turned the company around and ultimately kind of changed the course of technology in human history so that the value of knowing what not to do, in my opinion, and I think my research kind of evaluates this, is as valuable, if not possibly more valuable, than trying to figure out what's the right thing to do all the time. I think your gut kind of tells you a lot of times what the right thing to do or your brain will if you actually do some analysis, but like having the insight from people that are telling you don't do these things can save you so much misery and heartache in the world of business. You're always looking for an edge. If I know what not to do from others, then that is my edge and I can run with that.

It's a simplistic value proposition for those of us that are trying to gain and grow and succeed. Yeah, I'm getting, I guess, pushing that cap up that shoot is a thought. You've several good lessons, didn't it? Yeah, I found out what Corralbert tastes like, which I would not recommend anybody.

Yeah, I'm right. Yeah, and I think there were what, 22 projects all going on at the same time in your reference to Josephson and Apple and super smart and prescient of him to kill them all. Yeah, I mean, except for what? Yeah, you just literally came in and said, we're all this is gone.

We're not doing that anymore in the course. Yeah, and then they're all good ideas, you know, but you know, the thing that was remarkable about Jobs in my mind and among other things as you point out is that he has this innate ability to know stuff that he shouldn't know at his age. You know, I don't know where that comes from, but his view of, you know, we start a product design and you commit to it. By the time you get to the actual design of the product, it's changed like 47 times and it takes 25 times longer than you thought, right?

And maybe did that once I learned that it's taken me like, I don't know, 12 times to learn that because even today I say, hey, that's a great idea. Let's think about it. Yeah, like, no, stop, right? Let's just let's just do the one thing that we're doing and focus on that stuff.

And chapter series talk about currencies that matter as a leader. Can you can you describe those for us? Yeah, so I think the what came out to me was that what are the currencies that really you should be focused on and then is there a kind of a banker way to store or spend those currencies and I did some research and some surveys and came out with really the three that most matter most in this context are time, respect and trust. And when you try to think about it, time seems like something that people don't give enough value to and that came out in the research as well is that a lot of leaders will not really realizing it take time from people from families from home from all kinds of things.

And it just continually degrades the other two things which are respect and trust for those people because if I don't, if I'm your employee and I know that every time some event comes up, you're going to start lining me up to take my time away based on whatever reasoning you have, my respect and trust for you starts to be affected. And it's this kind of vicious cycle that continues to go on and the follow on to that was really being able to make sure that you keep a bank of respect and trust with your employees and the people you work with. You spend it, most people spend it without really thinking about the fact that you're constantly training that account. You've got to keep a plus.

You want your numbers in the black for respect and trust with people because it's a commodity that is super crucial and critical and it is ever dripping out of that account. So it was just very validating for me to see that people did value these things differently based on what was actually most critical of them. And what's the most valuable currency? So trust actually is the most valuable currency that came out and the funny thing is that seems pretty logical like actually when I got the results from my surveys it was kind of like duh but the follow on from that was well how you build trust trust actually in this context is an equation.

It's a result of the addition of value from respect and the time that you work to give people to be themselves and do their own things. Trust is like the old thing about trust is earned is never more true in this particular approach. Yeah okay. One of your chapters talks about deserving what you tolerate and as we look around the real world we can see the consequences of that statement.

Can you elaborate a little bit about what you mean by? Yeah. So the quote actually from what I got from one of my chief's friends was you get what you expect and you deserve what you tolerate. And deserving what you tolerate is actually something where a lot of people will kind of knee jerk react and go well that's not that's not nice to say but in reality if you think about it and the point I was trying to make in this chapter is you do deserve it and you should expect to kind of get what you're putting into something if you're allowing people to disrespect you as a leader you're going to get disrespected and you deserve it and the only way to fix that is to address the problem head on.

Like you said I think turnly today we kind of live in a world where it's more super soft skills rather than folks being willing to kind of confront things face to face and say this is how we fix this. But if you don't actually deal with it and be real about it you're never going to get past that and you should expect as a leader that you know whatever you tolerate will be the outcome that's going to happen if you let people slide by sliding by is going to be the constant that occurs and it's interesting to over time that level of tolerance that you apply or give people only kind of continues to propagate that behavior and it's you know if you don't nip it in the bud quickly then you will have more of it and it just becomes compounding interest on a problem. Yeah exactly and we should all grow up on a farm in Texas also. You talk about flat organizations and flat fail what do you what's the correlation there?

Yeah so I was really interested in that one because I've worked at and consulted a lot of organizations really preach about their flat structure and what was funny was when you go through references and do the research on kind of what's published mostly organizations that were truly flat abandoned that approach because they found out real quickly it's a great idea to have this kind of kumbaya let's you know rally around the fire and everybody's on the same level thing but in a business organizationally it doesn't work you're going to have to have someone somewhere that can make a call and push things forward there's got to be some driver somebody in charge and it doesn't mean that you have to have a crazy draconian you know only do what I say type of thing but the flat side of this only causes problems and actually what happens is you get a lot of what I call in the book like mommy daddy speak where people are kind of playing leaders off of each other to get what they want it is absolutely antithetical orthogonal to being able to execute on objectives and that's not going to work for a business. What's a dumpster chicken? So yeah so a dumpster chicken in the maybe we call them dumpster chickens but if you ever been to a pier you'll see them flying around the dumpsters it seagulls really and the thing that I was trying to get across there is if you're a dumpster chicken some people might call them helicopter leaders where essentially you squawk and call from on high then you'll fly in everywhere take a crap on whatever everybody's doing it and fly away that's not actually helpful you might think that it's a good way to kind of align on the problem and let everybody know that you understand the issue but if you're going to be a dumpster chicken back to kind of deserving what you tolerate you should expect that people are not going to want to put up with that very long and it's going to be harder to actually get things done. You've got to be involved and engaged but you don't want to only be involved and engage for like this minimal amount of time nobody likes their boss to come by and say something over their shoulder and just keep on walking.

If you're going to tell me that you identified a problem then at least provide me with some avenue of fix otherwise you're just adding to the problem. Exactly. There's a lot of advice that has been thrown around the valley in particular about go fast and break things et cetera. You know the chapter called go slow and be fast or to be fast tell us about that.

Yeah so I got the expose to that doing military operations with the different special forces units and really what you hear there is if you look at you know Navy SEAL mantra and ethos and 75th Rangers and whatever they talk about smooth as slow as smooth and smooth as fast and most of the time in cyber we or technology really push push push innovate innovate some things down the throat of whoever's willing to buy it and then we go back and we kind of fix the outcome on the far end. It sounds like an okay idea but when you actually look at the data and the research across time that causes more problems than it fixes. So the smart thing is to say we understand where we're trying to go let's be systematic and intelligent and tactical about what we're doing but we're not going to just rush rush rush because you wind up coming back and fixing a lot of the problems that you introduced with speed and speed in some instances can kill and you don't want speed killing your business and it's hard to get somebody to go okay let's slow down but the research in it for my own experience working with companies most of the time that becomes the best thing that our organization do is say let's take a pause and let's just really cautiously think about where we're going and what we're doing. Yeah that brings me to a chapter that illustrates a shared experience that you and I have had related to Norse and Mary Landesman talk to us about Norse and your view of you know what I mean to me they're like the captain obvious of what not to do in business but yeah I mean they're yeah they were really interesting because I remember being it I think it was RSI or Black Cat when Norse was kind of coming out and actually bumping into a Viking like some dude dressed up as a Viking running around at Norse Boost and they had this super cool blinky light pew pew map thing that was over there and everybody that was kind of on the non-technical cyber side was super interested in the the pretty lights that were going on but all of the practitioners and all of the other folks that kind of know what was actually making that work were kind of a you know sitting back going something reeks of weirdness here and the fact that it was getting crazy funding and there weren't a lot of buyers but the valuation was going up it like you said it was just this perfect storm of shenanigans and it all came crashing down really fast and the bad thing was that they actually had a line on a really useful product offering but because of a combination of ignoring the market ignoring feedback you know not dealing with the market side of the equation they got handed you know they got their ass handed to them and they went under and they went under cataclysmically so it was to me like in cyber one of the best case studies of what not to do if you want to be successful.

Well I had a good story also right underneath all of that that the you know whatever was 100,000 sensors to honeypots all over the world and it collectors inside the you know strategic Iranian locations and so forth and I was feeding all of this and it worked to the extent that you know they were able to recruit some pretty good engineers and some pretty good analytical talent Mary Landesman is one of my best in the business before she retired and hey you know and she went over there and said wow this is a fantastic ship she wasn't you know enamored as you say by the visuals as much as by the Brett intelligence idea or ideal behind it and wanted to contribute to that as you say they were on the brink of a great product but as it turns out it was just a bunch of lipstick, milk and mirrors you know yeah so they certainly deserved what they got but that also was a great illustration of venture money chasing businesses that without the kind of intelligence that you would expect people investing $50 or $100 million. Yeah it's mind-boggling when you because I wrote a chapter on that too about bowl VC game because I found a lot of companies that I've consulted with that are small and startups like they're not intimately familiar with the actual other side of the VC game and it's it's not that they're necessary on the level into anything else but they're out to make money and if you're not prepared for the way that that's going to play out for your company you're gonna get gutted they're very good at this and that's not of the police you want to be. Yeah well you know and then kind of goes back to expect to get what you tolerate it I mean if you understand the business model of the venture investor then you know shame on you I think right I mean the business it's not like anybody's fighting anything they raise multiple funds they have to spend those funds in order to raise additional funds those funds are locked at a certain number 400 million 800 million whatever it happens to be and then they go out and find investments for that 400 million 800 million so that limited partners can get the kind of return in the kind of timeframe that has been advertised you know so and no one you know pretends that they're a technologist that they understand the actual nature of the companies in which they're investing however there is a level of diligence that you would expect there should be if you're a limited partner certainly and you're putting up your whatever return your own pension fund or the pension fund you manage or the investment fund that you manage or you're on money in many cases into these funds and but the whole purpose it's a gambling business right I mean you're betting on the role of a dice that if it turns up you know you're a number of once out of 20 times the return will be plenty to cover whatever the cost the other 19 are right I mean it didn't this spot forever so there's nothing wrong with you know VCs except when they try to pretend that there's something in what they are and yeah that was on one other point that I kind of made in the book because I learned this on my own going through some acquisitions and whatever was that if you're if you're a leader and you're you know you built this company and you've got these money or whatever else like there's things that will occur during that sort of transactional business that you should be aware of because I mean for me and maybe it's just me but ultimately if I'm running a company my goal is to take care of my employees first and foremost not the VCs and if you don't do it correctly unfortunately it's going to be those organizations that benefit and I tell a story in this thing literally about something in this book about something that happened that I sat in on and you you watch the employees of the company some of which could be there are two three decades that don't get the return that they deserve because of their efforts so it's it's like I agree with you it's great that VCs have the money to do these things that they invest but if you're the business leader or the creator or the founder and you're not familiar with how this works you're going to get into a place where you might wind up accidentally unintentionally screwing over your own employees and no one wants to be that person no you don't but at the same time you also in order to retain that leadership position and role that you have you have to represent the investor at the same time and so you know by doing that you may well plant that knife into the back of the three decade employee and you kind of have to walk away from and say hey you know it's my job like it or not so yeah it's a crappy business that's for sure what's a brilliant jerk well some folks would say that I am but yeah I mean I've never heard anybody say that I mean I did a lot of reading into that in research and that just because like Netflix has a great thing and there's a book published by called the No Asshole Rule and where they're trying to get to is it's okay to be really smart and be really good at what you're doing and be able to kind of tell people technically how to do things because that's your thing you're brilliant but just because you're brilliant doesn't give you a right to be a jerk to anybody and it's also for companies to know you might not want to take that person who is the brilliant brain and parade them around as you're kind of a go-to-market face there's a there's a very and there's some references I put in there and some stories around there's people that are better off just kind of staying in the back and doing what they do in creating technology and running a leading don't think that you shouldn't make them someone that is a public facing kind of go-to-market leader they probably don't want to do it even though they won't say it and it's probably only going to hurt your brand and your position if you do shove those people out there because their level of jerkiness will go up exponentially when they're doing things they don't want to do yeah certainly what's a mushroom farmer so a mushroom farmer is actually a leader that keeps their people in the dark and occasionally feeds them some shit and that is a very real thing that you see all the time I've told a story in this book about some events I was involved in where that was the case and it is painful to be on the mushroom farmed side of that equation and the weird thing is to looking at the research like there's there's a fine line between understanding what you should and shouldn't share with people to keep them in the light and then there's also a way to make sure that you're dealing with not growing mushrooms because the way I learned from writing this book was mushrooms actually operate on this kind of cool substrate I think fungi it's the same thing when you think about a business and people we talk to each other offline we share things offline we slack whatever rumors and that kind of feeds the growth of mushrooms because there's not enough light and not enough good food to keep them doing the things that they ought to be doing it's it's a really interesting problem that can get really big really fast if you've ever had one mushroom in your yard you know how fast you have 50 as a good analogy the money being the root of all evil is kind of a captain obvious statement but you also indicated it might yield success talk about that a little bit yeah that goes back to the whole piece about how do you kind of grow your business with with or using to take funding and I mean I put some references in there and some personal stories about like there's there's a good way to kind of do the kill what you eat model but there's also some logical and some intelligent decisions that businesses should make to figure out where they do decide to raise money and if you are going to raise money how should that feed that kill what you eat model instead of what we typically see people doing technology is raise raise raise raise and then try and sell and hope you hit the numbers high enough that the valuation has a payout and that seems to be kind of counted what a lot of people think is a good way to do business but the math and the data says that that's the smart way to grow your money yeah and we forget that people that run these businesses that are what regular people like you and me right that we put our pants on one leg at a time and have the same same range of and IQ and EQ and and brush our teeth a couple of times a day you know I mean there's no there's no real actual magic to this and however if you read a book called you know what not to do as a leader and you take that to heart as I recommend folks do with your book you're going to be way above the average the average player and in whatever your space is you talked in chapter 10 about choosing your horse wisely what is that about yeah so again I guess I put as many redneck references in this as I could because well you did quite a few that's right I mean that's that's where I'm from so yeah I kind of talked about this whole idea of choosing your horse wisely and I referenced the story from some people that live down the road for me that the wife had a great idea to try and take the road right resources and turn them into cattle horses and they don't work well so the point that was basically to say don't think that you have someone who is a eye performer does really well with this one thing and then take them and kind of chew on that square peg to make them fit into another opportunity or role because it won't work right they'll just get frustrated and then you wind up with a crazy thoroughbred biting stuff and jumping over fences and that's not what you want for your business it's detrimental to the operational side so you have to be very careful about the horses you choose and make sure that that is kind of what they're quote bred for yeah and that kind of goes hand in hand and away with a brilliant jerk thing and and kind of the way the Navy seals prefer their their or or characterized those seals who succeed through seal training which are and the ones they prefer which are not the smartest necessarily folks in that of that class but they could be average smart but but they would be the most trustworthy and so back to your point about currency early trust is the number one currency for business leadership it's also the number one currency to be a Navy seal all other things equal yeah so what's a fatal funnel that they need to get passed and yeah so I mean I think a fatal funnel is a concept that people use in house clearing operations so if you're going to go in and do a house to dress you were clear a house or whatever you never want to get stuck in a doorway because the doorway is the fail funnel if you're going to get shot that's kind of where it's going to happen and the way that that translates into businesses don't get stuck trying to shove things through as fast as possible and sit there and look at the problem for too long your goal is to understand where you need to go and how you need to get there and then get through it smartly intelligently with people behind you that are going to make sure they cover your six and then deal with the problems on the other side very often I found organizations and we even heard the term right analysis paralysis like that is very very detrimental to executing on an objective and you can't do that it is where you will die as a business if you're stuck in that fail funnel yeah good good advice along with never letting your ego right checks your body can't cash when you say don't lose perspective what are you referring to yeah it's it's a common psychological social thing where you see the people that wind up being CEOs and leaders they kind of forget where they came from a lot of instances and in some instances they never came from the the ground troops they just wound up kind of as position and they'll you know they talk down to people they don't treat them the way that they deserve to be treated they're kind of up on high and it's not good for a look it hurts your trust it hurts your respect all those things that we talk about they're so critical and you never want to let your ego write checks that you can't cash in in this book I give a really good story about someone that I personally dealt with it did this and it's it's an interesting run through to kind of understand how your mouth can get you in trouble and keyboard warriors are a very real thing in our space and be one of those yeah yeah right so easy it's so easy don't chase unicorns do you mean that's chapter 13 do you mean that don't try to become one is that advice here yeah I mean that's the thing is a lot of folks go wrong with trying to get unicorn status that's such a nice you know plaque to have on your wall or whatever that we get unicorn status the businesses that have actually done it correctly that have achieved that that big goal they never sat down and said we're gonna be a unicorn they didn't chase unicorns they just said here's what we're going to do here's how we execute and they continually innovate it and grew and then they hit unicorn status and it's been a much more valuable journey for them on finances and company presence so that that's the whole thing is don't chase them because they don't really exist if it happens it happens but that should not be your goal as a leader yeah and in chapter 14 you talk about the microscope telescope in it or mirror what what is that reference yeah so I think a lot of times people look in the wrong lens and that was kind of what I put in there was that there's the only lens that really matters is the one is the mirror you can look through a telescope and a telescope also has lenses and mirrors and things like that but it's really focusing you want a very specific problem you know with this sort of limited view when in reality if you look in the mirror most of the time you would see that the problem probably starts with you and I mean this is something that I personally do every day as I look myself in the mirror and I ask me my wife thinks I'm kind of nuts like what are you doing wrong and if you do that it actually you know take three seconds out of your day and do that it's sometimes hard to look yourself in the mirror and really realize that you're doing something that's not going to help out and that's the lens in my opinion that matters most yeah and that's a great exercise and one we all we all should be doing every day you're absolutely right I'm conscious of the time here Chase we got a wrap up here I love that Wiley moves so quickly on this I hope that it's successful not just for them but for you as well my read of this book is was highly enjoyable you're you're an easy very easy to read author and your story's redneck or otherwise you know you might have noticed redneck is making something of a comeback here in this country so that's not all bad right your stories are fascinating and enjoyable so so I want to thank you for the book and I and I urge people that when it's available or you can pre-order I guess right I'm kind of yeah you can pre-order yeah it's about for pre-order now and I hear that they are talking about doing an audio book so I guess I'm not to figure out how to start recording audio books. Well you've got such a crappy voice you know if you need if you need if you need me to do that for you I'm more than happy all right we'll work it out yeah all right how not to lead by Dr.

Chase Cunningham lessons every manager can learn from dumpster chickens mushroom farmers and other office offenders so I spent a pleasure chase thanks for being on the show and again I wish you all a lot thank you so much I really appreciate I'm glad you enjoyed the book sure and thank you to our audience for spending some time of this today and hopefully this was enjoyable to you as it was for me and until next time this is Steve King your host signing up. Thank you for joining us for another episode of Cybersecurity Insights you can connect with us on LinkedIn or Facebook or send us an email at social at cybered.io for more information about the podcast visit cybered.io or with slash podcast until next week stay safe and secure and we'll see you on the next episode of Cybersecurity Insights.