The discussion presented in this episode revolves around the intricate dynamics of the cybersecurity industry, emphasizing the multifaceted roles within it. Our esteemed guest, Zara Pirzada, the managing partner and owner of Infinitus Management Consulting, elucidates her journey into cybersecurity, highlighting the importance of understanding various market strategies for startups. She articulates a profound perspective on the necessity of aligning marketing strategies with genuine product value, thereby ensuring that organizations effectively communicate their unique selling propositions. Additionally, Zara draws attention to the critical nature of fostering trust and transparency in client relations, particularly within the context of evolving technological landscapes. As we delve deeper into these themes, listeners will gain invaluable insights into navigating the complexities of cybersecurity practices and the imperative of continuous learning and adaptation in this ever-changing field.

#Cybersecurity #MarketingChallenges #Podcast

Takeaways

• Zaira Pirzada's journey into cybersecurity was unintentional but evolved into a passion.
• Open source intelligence (OSINT) played a crucial role in Zaira's early career.
• Listening and learning from others is vital in the cybersecurity industry.
• The transition from analyst to CMO involves understanding market dynamics and customer needs.
• Unique value propositions are essential for startups to stand out in a crowded market.
• Data is a key asset in cybersecurity, influencing decision-making and strategy.
• Building trust and reliability is crucial in cybersecurity communications.
• Negotiation in cybersecurity is evolving with the introduction of AI and data valuation.
• Education and knowledge sharing are fundamental to success in the cybersecurity community.
• Continuous learning is necessary to keep up with the fast-paced changes in the industry.

The discourse presented in this podcast episode is a profound examination of the multifaceted nature of cybersecurity, featuring an engaging dialogue between the host, Joe Carson, and his esteemed guest, Zara Pirzada, the managing partner of Infinitus Management Consulting. The conversation commences with an exploration of Zara's unconventional journey into the cybersecurity domain, which was catalyzed by her academic pursuits in security policy and civil affairs. This formative background has endowed her with a unique perspective on the intersection of military and civilian dynamics in cybersecurity, particularly as it pertains to the emerging threats posed by asymmetric warfare in the digital realm. Zara elaborates on her transition from studying militant non-state actors to delving into the intricacies of governance, risk, and compliance (GRC), a field she notes serves as a pivotal entry point for many aspiring cybersecurity professionals. As the dialogue progresses, the hosts delve into the critical role of effective communication within the cybersecurity landscape, emphasizing the imperative for professionals to cultivate a shared understanding across diverse roles. This theme is further elaborated upon through the discussion of the evolving nature of cyber threats and the necessity for holistic security practices that transcend traditional silos. The conversation also touches upon the challenges associated with keeping pace with rapid technological advancements and the implications for organizational security posture. The episode culminates in a reflection on the significance of mentorship and knowledge sharing within the cybersecurity community, highlighting the collective responsibility of seasoned professionals to educate and empower the next generation of experts. Throughout the discussion, Zara's insights resonate with the audience, underscoring the importance of adaptability, collaboration, and continuous learning in navigating the complex cybersecurity landscape.

Hi everyone.

Welcome back to another episode of the Security by Default podcast.

I'm the host of the show, Joe Carson.

It's a pleasure to be here and always excited to bring new guests and new conversations and new knowledge to all of the audience out there.

And I'm really excited about today's episode.

I am joined with an amazing guest.

Zara.

Do you want to give the audience a bit of a background about yourself, how you got into the industry and what you do?

Sure, absolutely.

I want to remember exactly how we met.

This is something that's on my mind, but let's listen.

We did a podcast together a long time ago.

Yeah, we did, we did.

It was maybe about two or three years ago, maybe even more.

Well, yours was an incredible episode.

We can touch on that.

That was very similar to an experience that you've had in the past.

So, Zaira Pirzada.

I am the managing partner and owner of Infinitus Management Consulting.

It's a consulting firm that helps cybersecurity startups from see to series C grow by combining a very sharp go to market strategy with sleeves rolled up execution beyond just that.

I am an avid poetry writer, I play sitar and I love to keep fit.

A former powerlifter and continuous strength trainer is what I would say getting into my older age, besides that, getting into cyber security, much like anyone else who is in their 30s and above has gotten in there by stumbling into there somehow.

And so mine was a stumbling in kind of journey.

So what did you start off, what was your educational background and kind of what did you start off with?

Was it poetry?

Was it what you educated to be for writing or what was that journey like?

It was unintentional.

It was so unintentional and it slowly became intentional.

So I went to graduate school for security policy.

I was studying civil affairs, civilian military affairs.

And I was more, at that time, I would say, nearly obsessed with the idea of how civilian bodies could keep an equal balance with military in such a way that one wouldn't assume the other.

And it's a very unique balance that humans have to keep within nation states.

And then started to study militant non state actors.

And with studying militant non state actors, I grew an affinity towards their understanding of alternate forms of warfare or asymmetrical forms of warfare wherein cybersecurity fear fit in as a discipline not by way of just security as I understood it then, but this proverbial cyber warfare in quotation marks, which is something we can't attest to have fully, but more by way of, let's say state to state tiffs.

So I was studying that, right.

I was studying that for, for a bit and did some internships there and then started to grow into what I felt was the easy way in.

Interestingly enough I talked to a lot of kids today who feel like GRCs.

An interesting way in or an easy way in?

Governance, risk and compliance.

That's interesting.

So big, it's a big area though.

It's a massive.

I mean there's many different parts of governance side of things.

Whether you've got the regulatory side of things, you've got compliance, you've got insurance and those two very different viewpoints.

There's the ones who kind of do the audits themselves and then there's those who have to make sure that they're actually compliant with the audit.

So it's a massive area and a massive field and also sometimes very complex.

It's interesting that that's an entry point for a lot of people.

That's, that's a.

Because it's a great way to get into the industry because it will definitely give you a lot of knowledge very quickly.

It will.

There's a slight misconception that happens which is that security engineers and security architects have to be that much more engineering savvy than GRC people.

I'd hope that everybody is just as much right.

We all do have to be able to, I mean we have to be able to translate and understand interpretation, shared knowledge and a shared viewpoint that we're all on the same page.

The techn skills, you know, it's more about the execution side of things and that's a different kind of, kind of mindset or different approach.

We definitely do have to have the understanding about, you know, what, what's the impact, what's the risks, what do you need to do, how do you reduce them?

And we all need to be.

Whether you're a very kind of dev technical coding person or whether you're just somebody who's looking at making sure that the right rules are in place.

We definitely all have to be aligned.

I think so.

And there's so much more to say, say about this hypothetical and ideal state of security must be practiced to be understood.

How not ideal and how, how sometimes, how impractical sometimes configurations are.

Our development is for the sake of moving, be it faster or just moving in general.

So there's a lot to say.

But what, what I was trying to say initially was in fact I got in through open source intelligence, OSINT World and I did because there Were a lot of jobs and due diligence in D.C. where I was living at that time.

I was in the DMV area.

So I know people who live at DC and are from dc, but where did you live?

And then I'll say Virginia.

So let me say I was living in Virginia and in the dmv.

Jobs that were available to people with my, you know, knowledge and degree at that time, in my early 20s, were in due diligence or an investigation, things like that that require you to be more or less a researcher.

So that was a pain, with all due respect.

And then realized what it was to be in the discipline, that it wasn't just investigations, diligence and research where I was.

But there was a practical idea about security in an enterprise.

And everyone had a role to play.

And not every role was beautiful.

Not every role was easy, not every role was ideal.

But it was all necessary.

As I was growing in my career and then left, that ended up on television in an interesting way for the OSINT work that I would do.

And there was a reality TV show that CBS wanted to create called Hunted, where they wanted to give you just the name, birth date and last known location in a confined area in the East Coast.

That's one of my favorite things to do.

It's one of my favorite things to do every year.

So actually it's coming.

It's coming up for the audience.

What we have is in Estonia we do, and I've been doing it now for over 10 years, is.

It's called in Estonian, the translation Suva Cyclist, which means summer adventure.

And what it is is basically a massive geocaching 4x4 in the nature looking for things that you have very little information to go by at the beginning.

And it's a four day event.

It is so much fun.

And it's all about the.

Yeah, the three days are split in so.

So we end up having.

So literally from an OSINT perspective, I'm coming in with all my gadgets and technology, drones and everything.

I'm like literally, fully, fully kitted for this thing.

And what happens is on the first day, on the Wednesday night, you get what's.

You get a map, a legend, and it's literally the counties where you meant to be for the next three days after that.

That's insane.

And what you get is about 70 to 80 questions, which basically are questions that will tell you where you need to be to answer the question that you get the next morning.

So you had to create the legend and it's riddles, it's things like tiny pieces of information of history and you had to try and find.

Actually we just got the massive, what's called as the, the nut, which is the big.

It's the big one that gives you the most points over the three days.

And it's a riddle.

Sometimes it's in binary, sometimes it's in like code or riddles or words.

And then you have to try and find it through open source intelligence.

Very difficult to do it in Estonian for me because then language becomes a bit of an issue.

But that's, that's one of my favorite things to do.

So that TV show sounds like a lot of fun.

It was absolutely fun.

But that sounds, that sounds like.

I will share with the, for the audience what I'm going to do.

I'm going to share some pictures on social media.

It is literally one and you've got 150 teams competing.

You've got about 50 different vehicles and jeeps and everyone goes by and it's the middle of nowhere.

Sometimes it's so frustrating because you might be like 2, 3 o' clock in the morning, you're in the middle of nowhere in the dark and you've got your phone and you're trying to answer a question that says you're too far from the answer because to answer the question you have to be within 5 meters because the off the location, because it has to be at the right location.

And it's so much like, it's so intense because it's so competitive that everyone's competing.

This is awesome.

And it, and it goes from you, from 7:00 o'clock in the morning, you get the first set of questions and then you have to go to all the places in the legend that you hope that you got the right locations from the night before.

And you literally spend 24 hours answering all of those questions.

So, yeah, it's like, it's like one of the biggest nature cyber hunts that you can do every year.

So it's coming up end of, end of July.

I'm so excited.

I want to learn more about it as well because I think it's possible in New York.

I'm working more in my backyard these days, finding cyber startups here to work with and trying to evangelize this as a career in my own backyard, which is an ocean of a career.

But at least getting people more acclimated to the fun of the discipline, which it can be.

This is so fun.

This is so fun.

I got in through.

I loved Michael Bezos work on intel techniques.

If you remember inteltechniques.com or even just now I was reading his work the well, open source intel techniques and then there was the Bible and then the extreme privacy book that he had and then I got into.

They're sitting on my shelf over there.

Yeah, okay, great.

All right.

Do you have Nico Decken's like work as well?

I'd follow Ray Bakers or Justin Seltz.

A lot of different great sans authors that I would follow like Mika Hoffman.

So all of, all of this work I started to dig deep in and really fell in love with it and that was my way in.

But short lived because then I, I went to Gartner and I went.

It's, it's a, it's a great place to get surrounded by amazing people and great knowledge.

It's definitely, it's a great place to really accelerate careers.

It is, it is.

I am grateful until the end of days for Gartner, for all of the incredible analysts who I've met and for all of the work that they've done.

It's beyond Quadrant guide hype cycle.

It's beyond that.

The notes that GTP technical professional analysts are writing, TSP is writing on the markets or IT leaders.

There's all these different groups at Gartner.

It goes beyond just the proverbial analyst and more into a Here are these multifaceted intelligent human beings with just as diverse careers as we would assume.

Anyone in cyber from I would say our time, which is to say we didn't have disciplines in college.

Right.

In cyber security, for me it was just when I started off, it was back in the early 90s.

It was just generic.

That was just joy.

That was starting.

It was just starting.

And when I was there, there was no such thing either.

This was a we start, we created as an enterprise function.

And how could it even end up as a discipline in college?

I'm so shocked.

These days when I'm mentoring kids, they're like, oh, I'm taking this course, I'm taking that course in cyber.

And I just thought I met somebody who was great at what they did.

It wasn't everything in cybersecurity, but it was something.

And then they met.

They introduced me to someone else who did another something and another something.

It was never a.

It's pretty impressive how focused some of the courses getting get into is.

You know, for me it was.

I mean, I was doing basically assembly language when I started off in college and machine code.

I was writing machine code so in binary and everything else.

And it was like.

It was all.

Because then it was all about modems and you know, manual and digital communications.

So you were basically translating everything.

It was, it was pretty done to the fundamentals, which was a great start because then you learned basically the foundation of how everything's built on.

But now the disciplines become so narrow, so focused into very to forensics or to mal reverse engineering or looking at strategic decisions and commitment.

Then it was just you did everything, but you did a little bit of.

Everything that it's beautiful to see a discipline grow.

What feels like almost exponential considering the limited amount of time and the depth at which something, even just one section to say you're looking at setting identity security, even spend a life on identity security and still surface by every year something new and just by sake of innovation.

This is the absolute beauty of technology and also the human mind.

So it is beautiful to see that something is.

But you being an og, have such a privileged.

Which is a beautiful thing, which is such a privileged, privileged place to be.

Because it's hard in many disciplines for anyone to say what staple can you say that is an OG of cybersecurity?

You can be an actual OG and be here and be able to say this is where the inception, this is the starting point.

Now we don't have to go all the way back to our understanding of intelligence in the 60s and 70s to say that that's the inception point.

You know, we can.

But for you, at least as an enterprise function, you can, you can say, I know day one, I know day zero.

I remember, I remember when I started my first in university, we had, what was called was.

We had these kind of, you know, intern years where you go and work for a company for the year in between your course.

And for me it was.

I did it in two places.

The first place I did it was in medical records in the hospital.

And it was exactly the time of the hospital was digitalization of medical records.

They were taking them from old paper, so we had to take them from all the shelves and the paper like these massive folders on like.

Like a massive library, everyone's health information.

And we were moving it to basically mainframes at the time.

And that was basically, you're using dumb terminals, McDonnell Douglas dumb terminals.

And you're taking all of that information and making it available to a doctor.

Where previously it would have taken 30 days to get that medical record off the shelf and in the doctor's basically desk where we were then changing that, that it was actually instant.

Now the doctor had your medical record sitting in front of them at a dumb terminal.

So from an Excel, you know, efficiency side, you saw, we saw firsthand about the changes and improvements from going, it was very manual, very mundane, very resource intense to literally where the doctor could sit.

And then you improve accuracy as well, because then different doctors are looking at the data, are looking at people's handwriting, going, what did that person write?

And they misdiagnosed and misinterpreted interpret things.

So the, even the integrity improved significantly.

But even I started seeing.

One of the other areas that I did the intern side of things in my early career was in the general practice practitioners.

These are the GPs who were sitting at different branches around different health, health centers.

And I did the initial trans digital, the digital transformation which was going from typewriters to computers.

So, and that was for me, that was hilarious.

It was a hilarious time.

Every, every time I think back to a moment, what I never, I laughed so much, was that time when you were like, you know, you're getting, getting support calls and you would go, somebody saying, you know, something's not.

My.

My foot pedal's not working.

I.

Foot pedal?

What foot pedal?

I didn't install a foot pedal.

So you go around and basically see where the person, you know, previously had a typewriter and they had a foot pedal, which was a Dictaphone for recording.

And they had the mouse from the basically computer on the floor and they're stamping their foot on the mouse.

You're going, no, that's not, that's not a foot pedal.

I mean, other times I go around, I see people with their cans of drinks stuck in the CD trays because they thought it was for holding drinks, a drinks holder.

So you see the CD tray popped out and the actually can drink scan sitting in it.

Those times when I think that's just.

You can still do it today if you can find it.

But the memories of those times going.

And I laughed.

I mean, when I was watching some of the things that people were doing on computers at that time, from that early change from typewriters to proper, you know, desktop computers, I think it was at the time it was even.

It was Windows 3.1 plug and play, and then it was just at the verge of Windows 95.

And they were probably some of the most funnest times I had doing support calls, so.

Absolutely.

I mean, I've been around for a long time, but my early part of my career was at that fundamental moment where people were going from not having a computer to actually having a computer sitting in front of them and really starting their career in.

And the digitalization side of things we all talk about the Net boom and stuff was mostly around the web boom of web applications.

But even before that, when the hardware digital transformation happened, that was a fun time.

That's beautiful that you've seen that.

I think.

Yeah, you're right.

People often talk about the commercial Internet and cybersecurity from the commercial Internet perspective or the transformation of technology, at least from there.

I think before that, things are such a distant memory to people who feel like they're not inundated with those problems anymore because they've replaced them with a million other problems.

Lots of microservices.

One big, massive, mundane system is now, you know, thousands and tens of thousands of microservices that.

That.

That fundamentally replaced it.

Incredible.

Incredible.

And with that, of course, a lot more vulnerability.

Absolutely, absolutely.

Yeah.

You can't.

When the crown.

The shoulder has to manage the weight of the crown.

So.

Absolutely.

The more advanced.

So tell me about what you mean.

You spent a number of years as an analyst at Gartner.

How was that in your career?

And, you know, what did you learn from that process?

And then how did that shape your Nick's changing career when you moved on from Gartner?

The biggest lesson I've learned at Gartner is quite funny.

I say this to everyone to keep my ears big and my mouth shut.

I think that's not just a gardener.

I think that's in our entire industry.

We have to do better at that.

We have to do better at, you know, when we're talking to users and people, we definitely have to understand and listen more, you know, because sometimes we think more about what our job is there to do, but we have to understand about what is their job and how do we.

How do we help them.

That is definitely a lesson, I think, for everybody and a very important one.

Yeah, it's the best one.

It's the best one.

I've become more verbose as time has gone on, for sure.

But I think that comes with the confidence.

Having heard so much, listened to so much, and continuously practicing that ear and understanding what I'm willing to take a Risk on, especially if I espouse it.

So if I say something and I decide something or if I do something now, it not every risk is, is going to yield absolute success.

So another big lesson I've.

I've learned as well at Gartner is that you learn more from quote unquote failing, which I think is just falling down, than you do from succeeding.

And those two things.

Gartner analysts continuously teach me as well that the smartest person in the room is not the richest, which is one thing.

Having a gut, Being clever and knowing people and understanding people, moreover and acclimating to their room is going to be one of the greatest strengths.

All of these things are going to be our greatest strengths.

Because being smart is not good enough.

Being smart can also be a vice.

Being so smart can also be a vice.

And I think career wise.

I continue to learn that we have to have a balance, especially when we're oriented towards research and fact based knowledge.

That we have to continue to understand that the world does not work like that.

For as much as we believe by our compendium of knowledge.

What is the right or the direct way is not the way that humans act.

And that's why laws claim that the rational man or mens rea, the ideal human, acts this way.

Because there are so many non ideal irrational beings in this world and we too are liable to be that every so often.

So I've learned that there's a unique balance everywhere that you go to how to tap into that is art more than it is smart.

Absolutely.

I completely agree.

This is something for me.

A lesson I've always learned is definitely that the smart people in the room and the ones I've worked with over the years are always the most humble as well.

They tend to be the ones that are always opening, always willing to share their knowledge, sometimes in exchange, just for coffee, which is, you know, it's, it's very kind of enlightening as well.

Yeah, I love, I love the people.

You know why I love our discipline so much?

It's because I've met more people here that lack the hubris in the great way, in a great way that I've seen in many other disciplines, which is there is a barrier of entry.

To my knowledge.

Yes, the career may have this barrier of entry, considering many different useless blockers in the real world.

It must have sort of certification this age, et cetera, et cetera, et cetera, while they're being hacked by young children.

I think there's something dumb about that.

But I know that people who have actually practiced in cybersecurity have been incredible mentors and incredible in helping you grow because they have a shared mission with you.

Yep.

Yeah, everyone.

A lot of the people I've had as guests over the years on the podcast that I've been hosting is that they have this shared.

Kind of want to be educators and teachers.

They want to take the knowledge that they've been forced off because when they were very young getting into this industry, they also had mentors and people who helped them shape their career and help them move forward and learn new things.

And in turn, it's almost like they've, they've become the mentors themselves and also have now dedicated to sharing and, and passing on that knowledge.

And I think it's a great, it kind of circle of life in this industry that we all have this kind of passion to teach.

You know, it's, we do the hard research, we spend hours and weeks and, you know, time looking and trying to understand how something works and how to really get into the fine details.

And then once you finally get it, once you finally get that success and you see it working, you want to share it.

And again, that's what, you know, the community comes in together to listen to this person sharing their knowledge as well.

So I think it's a great, a great industry and a great community.

Yeah.

That really definitely defines knowledge sharing in such a way where it, it definitely takes on a life of its own in many cases.

Yeah.

Yeah.

Hope it always stays that way.

I hope so too.

So tell me, tell me a little bit more.

In the recent, you've been recently a CMO as well?

Yeah.

And after, you know, after doing open source intelligence, which I think that's, that's such a great place to start because it allows you to really fundamentally, you know, really help you find the data that you need to find.

And then an analyst is then really interesting because then it's, it's understanding and shaping the data to make it actually explainable and make it actually, you know, something that has value and has meaning and then to becoming a cmo, which is then how do you use that data in order to build trust and build what's the expectations and build explainability.

So for me, your journey's been very fascinating because all of those really kind of build on each other to much greater knowledge.

So in the recent years, how has been a CMO in this industry, how has that been different from your previous experiences in the past?

It's being a chief sacrificial officer.

Okay.

And it's funny, CISOs and CMOs can sit in the same room and complain about the same things in different terms.

And I've realized it's possible CMOs can sit there and say nobody listens and we look like a spend function and we look like a risk function and CSOs will sit there and say same.

Yep, it's the cost department.

And while CMOs give the perception of brand integrity and understanding, so we're perception functions, we're not like CFOs and CROs backed by hard dollar amounts accrued by the actual tangible efforts of our team.

Now, CMOs are obviously in great CMOs, let alone great marketing teams.

The CMO is a great title and I believe there are so many people well suited to have it and continuously, over and over because they have that resilience to understand that as much as a CISO who is revolving continuously as a CISO has that resilience to understand that this isn't going to be easy every single time and every dollar counts and we can't promise from every dollar that we'll be secure, let alone we can't promise from every dollar that we'll get a return.

So we see each other eye to eye and we're sailing in different boats on the same ocean of an enterprise.

So I have to say it's very much like that.

Now, more specifically, I'd say this because I didn't classically come from a marketing background, but I had all of the absolute chops to be a fantastic product marketer.

I came in as fractional to companies and advisory, which I am doing again now to startups to help them say, well, very much similar to what Gartner would do, but being more an interpreter of the markets.

Now this is where you would fit in and this is where you'll succeed and you have a high probability of success.

This is where you may not succeed and this is where the probabilities are less.

And it's not just because of perception, brand value and the acronym name game that you're playing, but more now because of my CMO position and what I've been able to understand, what the cost of your tool is, what people are willing to pay for it, what are investors willing to trust out of your company to continue funding it?

And if you don't have investors, what do you need to prove?

And furthermore, what do you have to do from a solutions engineering and architect position to a sales position and sales motion and then marry that to bring to market?

None of that is intimately Understood as a Gartner analyst.

None of that is intimately understood as a practitioner.

You're there buying the tool and judging the efficacy of the tool.

But the entire engine it takes to run a company and that to find your place in a startup, it has been a very rewarding experience.

I realized from that, well, you know what I can do?

I can.

I'm going to go back to Infinitus and now build my own company.

Put time into building your own self.

Why?

Because I feel like I've accrued so many individuals in my life, experts in what they do, be it in lead and demand generation, brand in graphic, SEO, sales in general, or architecture engineering, customer success.

I've learned from all of them and said, well, I found a way to package and service this for the companies I care about, which are seed to series C, but more specifically seed to series B because the failure rate is so high and it doesn't deserve to be when you know there's great product, but it's just the engine isn't running.

And I love great products.

Winning, not great.

I totally agree.

Because of the game.

Yes.

It's, it's, it's.

I completely agree.

I've been fortunate enough for me to be in across numerous startups that have succeeded really, really well.

And I've seen other startups where they have, you know, sometimes it's just the timing, sometimes it's their strategy to go to market, sometimes it's their pricing, pricing, sometimes it's their message.

And it's really important that startups are going through those early.

Yep.

When they're going through that process is they really need to make sure about who they're selling to and what their appetite is, you know, what they're willing to pay money in order to solve those problems, but also to make sure that they don't.

I was talking with a friend earlier this week and we were talking about rsa and everyone in RSA had the same message.

And it really became that for me, that if you're a buyer, and now it's hard to, you know, distinguish the unique value, each of those vendors, that if they're all having the same message, then all of a sudden you've got, you know, not just a few vendors that's, you know, trying to solve that problem.

You got hundreds of vendors and thousands of vendors, and now it's about what's the unique value.

And that just overcomplicates the market by everyone saying the same thing.

And it's really about kind of focusing on what you're really good at, focus on your core value that you really the problem that you're really solving and make it very clear.

Everyone's jumped on the AI bandwagon, the zero trust bandwagon, the security by design band begging.

And it's kind of like, you know, now applying buzzword bingo at a conference is actually frustrating because it's too easy.

It should be.

Buzzword bingo should be hard in order to meet all those buzzwords.

So for me, what do you think is, you know, taking all those lessons you've learned, you know, what, what makes good marketing?

What, what should the marketing, if it has been seen as a cost center and simply is seen as just, you know, a brand message for the organization, what things should it be focusing on and what should be trying to change in order to make it successful?

Especially for the startups, I have to.

Admit, it's far more complicated than just standing out at a conference or on a data sheet or in a demo.

It's far more complicated than that.

We do play buzzword bingo here, but we play it because we're stuck in it.

We're stuck in this maze.

It's the way that the markets are understood and evangelized by way of this, by people who have or vendors who have more money and more time to do it.

And then that becomes the ask on an RFI or RFP and then that becomes a part of the brand.

So even when you have the best product marketers in the room, even when you have fantastic relationship from marketing to product to product to sales and just something that works among them, you'll realize a few things.

One is that you can find your USP or your unique selling proposition and you can find your differentiated narrative.

But you have to know who to send out to deliver that message.

And there is an engine that goes behind this.

Are you going to use development reps, business or sales development reps?

Are you going to go on the ground because zoom meeting fatigue or teams or whatever you want, whatever platform fatigue is too much, you might just get to the first meeting, our second meeting, the demo might flop.

So what, what is working these days?

And I think great marketing is looking at this after we have tailored the suit and we have tailored it on the person who is meant to go to the party, can that person talk?

And that is big and are they at the right party to talk?

Are they at the right thing?

And is it costing us more than we need them to do?

And this is marketing becomes more of a game of not just SEO and advertisement and bringing in inbound.

But a, do I have the right performers out there on the field to sell this product, to get the deal through?

Because sales cycles are super long now.

And even if you have the same message across three other vendors, people buy from people, people don't buy product.

And so do I have the team to make it happen?

That's one lesson I'll share.

Just another one that I've realized.

You want everyone in the company to understand what makes them different.

If it's even just one niche thing across the entire swath of same in this industry, what is that one thing that makes them different?

They don't have to all share the same elevator pitch, but they have to share the same mission.

And the only people that can make this happen are dedicated founders and dedicated C suite teams.

If I've learned this and I've seen this over and over again, if you have founders who are just money hungry, they aren't founding a product or a team for the mission.

If they cannot tell you their elevator bridge, they cannot tell you why they love the product.

They cannot tell you what they're willing to do and what they're willing to give up in life.

Because you have to give up so much when you own your own company.

So freaking much.

So some people lose their marriages over this.

They have to have some people lose life with their children.

If you're willing to lose all of it, you must know what you're willing to lose it for.

And if I meet founders who don't know what they're willing to risk it all for and they just want to sell and move it fast, make it clear to the market, make it clear to partners, resellers.

Don't put all your money in an engine to make it move.

And to be big, you don't have to have the most unique message at that point.

You just have to have the best message to someone who's going to buy you.

Yep.

And something that's very clear in context.

You know, it's straight, straight to the point, you know, get rid of all the fluff.

The fluff just is to satisfy the kind of the competitive or the market differentiators.

It's everyone's kind of pushing people to do something or to say something just because other people's doing it.

I always say keep to your core and keep to what I always find that works the best is when you're educating about what you do.

If your education and knowledge becomes kind of fueling, which results in people then learning more about your products, it's the best way to go to market, you're giving value already by adding educational knowledge out there rather than just a product pitch, which is you're going straight to selling.

Then you have to have a product that really solves a big problem.

Mostly I hate.

I've been in the industry for a long time and I get so many sales pitches.

Do you have 30 minutes for demo?

What problem are you solving first?

Why do you want 30 minutes of my time before you, before you even tell me what problem you're solving?

Some of the pitches and sales kind of methods are just, I will say the most valuable thing that we all have in this world is time.

Yes.

And the moment that anyone starts asking for my time is that you got to have something of value immediately.

That is clear to me.

That doesn't take a 30 minute conversation.

In order for me to understand it, you have to do it in the first sentence of your email, the first sentence of your message, or the first kind of, you know, phrase that comes across.

It has to be simple and has to be straight to the point.

So true.

That is so true.

There's a lot of room in the cybersecurity vendor market for vendors to first and foremost make sure that they're offering a real product.

So there's a lot of room for that, number one.

The number two, understanding what problem they're solving.

I just, there's not a lot of room for those two things.

Make sure you're really actually offering product, number one.

And number two, make sure that that product is something people need and then make sure that that need is, is, you know, something you can sell in everyone's body.

Yes, everyone, Everyone, you know, that is, is, is kind of, you know, has similar, similar problems.

That's one of, it's also one of the things, you know, usually when I'm presenting at conferences, the first thing, the first, you know, pretty much slide is for me to make that connection with the audience that we all have that same fundamental problem.

We all have the pain of, you know, certain things in the organizations that we're struggling with and we don't have the visibility or we don't have the ability to control it or to report or to meet regulatory compliance from the GRC perspective.

And we all have different pain points and it's about making that connection with the audience about, do we all, we all agree that this is a pain that everybody has?

Not everyone, it's not 100%, not everyone's going to have it.

Some people solved it in their own way or own Methods but you definitely want to make sure it's the majority of the people.

And that's one of the things for me when I'm doing buzzword bingos at the conference, one thing as I always go and it's like, you know, take, you know, three minutes, they have to explain their product and for me to really cut through is what they're advertising really what they're doing.

And I can tell you in most cases it's not.

When I see AI at a lot of the booths and I go basically and try to get them explain it to me.

I'm going, what?

Just because you've done an integration with another GPT engine doesn't make your product AI.

It doesn't, it doesn't change the value.

So it's really important to make sure that to cut through the FUD and really get down to what organizations are doing.

And I think one thing I really enjoyed what you were doing the last couple of years was the report that you were creating every year which the report that was being generated, reading it showed for me as consuming that information.

One is that you're educating me.

Coming back to my fundamentals of, you know, I want to be educated.

Two is that a lot of effort went into creating it.

You can see the amount of effort that and knowledge and time that went into creating the report.

So that gives me kind of, that kind of, kind of assumption of expertise within the company.

And then in turn that creates a trust.

It's, there's that, okay, you're coming to it with the report, you're educating me.

There's a lot of time and knowledge and expertise went into creating it.

And that builds a trust in, in the brand and community.

So for me that was one thing I always actually seen and I, I think more companies should take that approach.

Yes.

Because it's a very, you can see it's approach that does work and it is something that you know then teaches me also what the organization does as well.

I, I thank you for that.

I believe companies like, you know, regardless of what people's understanding is ethic, they want to keep this out.

Just for sake of the example.

Tesla is a successful company not because it sells cars, but because of its data.

It's a data company.

It's worth because it's because of its user license agreement.

The user license agreement is what determines because in the user license agreement as you sit in that car and you accept that license agreement, what you're stepped in to do is all the data that that car is generating is Owned by Tesla.

And that's ultimately what makes the money.

Yes, yes.

You'll find I personally will invest in companies when I see their IP mode being their data.

And this is the same perspective I take to cybersecurity because I've seen it as a transferable lesson from other industries.

When you have the best data, then you need the best analysts and then the best storytellers and then the people who can make it pretty and go run with it on the streets and sell it.

But it must start from that IP mode.

And that's something I look for all the time.

Doesn't mean I'll always go to, you know, threat intelligence platform or I'll go to a TDIR threat detection incident response company or something.

I won't, I won't choose them based on them saying all we do is threat intel.

What I like to look at are companies that will create a strong defensible IP based on how rich their data is first and foremost and how unique it is.

And then where can you drive it?

And thank you for pointing out that report because it's about showing proof and proof of value in marketing is also here is everything that we are collecting or maybe a sliver of the pie.

And I want to show you how rich that is and how much more it could be if you like.

Absolutely.

For me that's one of the biggest, biggest advantages that companies can do is show the knowledge that they have and the data that they've got because it does two things.

It either helps educate the world and I could use that intelligence in order to do so much more with a lot of the products or a lot of the services and solutions that you're investing in already.

And then the second part is that how much time am I wasting doing it manually today?

So to my two points is the two biggest values that we get is one is that is the data something of high value that allows me to do much more automation and ultimately return reduce wasted time.

So does that data help provide me qualitative and quantifiable kind of intelligence that can then be used in order to either help me accelerate things much faster that would take a lot of time to do, or reduce wasted time that I'm doing trying to create it in a manual way?

I believe absolutely.

Reducing waste of time?

Yes.

And fatigue Analysis.

Fatigue analysis fatigue is so serious because think of how many poor decisions are made in stressful times.

And if we're to create trust and reliability on a fact basis, we can use that have lower cortisol response and at least channel a more direct, emotionally balanced, less stimulated response.

And that means we can be more centered with understanding our environment and the interplay among humans.

Because overall our entire discipline is human v human, initiated by process and technology.

That's it.

It's human v Human.

It's the process and technology are facilitators for us to make human based decisions and actions or kinetic results Right.

Against other humans.

It's to serve us, to empower us.

Right.

Defense is not done well under stress.

Defense is done well under not only courage, but calm, trust and confidence.

Defense is done very well that way.

It's because you simulate and you practice.

So that becomes, it becomes habit.

Yeah.

And data's a very big part of this.

It is.

I don't know if you started reading the book that I was releasing at all.

Inside the Mind of Threat Exposure.

No, not yet, no.

Okay.

I'm releasing a 10 part series that will go into the human idea of threat exposure.

So this is how do we respond to security functions?

What happens to us chemically?

What happens to us like neurobiologically?

What is, are the societal dynamics we're playing in US V attackers, general attackers.

And then slowly moving into the political, economic and then into the technology facilitation.

And the entire series.

I'm releasing it on LinkedIn.

You'll see that two parts have been released.

Another two parts are on their way just now.

But it, it has received some good response.

And this is my big research journey today.

Okay, fantastic.

Well, it's, it's interesting.

A lot of, you know, last year was interesting.

Some of the incident response cases I worked on beforehand, the first half of last year I was still, you know, you're still interacting and communicating with the attackers directly either through, you know, telegram chats or you know, burner emails and stuff.

Interesting.

The second half of last year, the incident communication was then with AI chatbots.

So the attack then basically had taken out the middle people.

Even cybercriminals were losing their jobs to AI chatbots.

And it was interesting because then to your point, when you're dealing with those types of communications now it's a chatbot, there is no human empathy.

There's no kind of ethics and response.

They just have a task and if I'm not satisfying the task, I'm not meeting their goals.

So it's quite interesting that the more of those processes we move humans out, of which then questions the integrity and the empathy that is it there to serve humans.

I'm more than certain that even these systems Negotiation support are going to totally create an economy in support of negotiation at a bottom dollar, a bottom line which will.

Maybe this will be controversial to say, but looking at the perspective you just offered, give us a more adequate and true value or range value for our own data.

Because right now negotiations will not give us a median value for where our data is, how it's priced, what it is and what price it ranges from.

But if you were to then create a logic supporting that and say this is the median or this is the, you know, nadir value, the lowest value, I'll pay for this.

Now we've finally found for insurance providers this range that is reliable to negotiate within, which means we are supporting that economy more or less.

Right, versus just saying I will not negotiate.

So something will come out of it by way of economy.

Absolutely.

It reminds me back of a couple of the negotiation cases that used to be years ago.

It was about how many terabytes the attacker stolen.

That was it.

It was a per terabyte or per gigabyte ransom or per device.

Now it's about the quality and the.

Type of data and that's so subjective.

And it also depends on mood, it depends on the confidence of the group, it depends on how they want to project themselves into their own environment.

Absolutely, yeah.

So a question for yourself.

So what?

I'm definitely going to get the link to your 10 part series, the threat intelligence piece.

So we'll make sure.

We will.

I'll add them to the show notes and make it easier for the audience to gain access to it.

So.

And what, so what do you do to keep up to date?

How do you stay?

What's your source of intelligence and knowledge?

Where do you go to everything?

I hate to say it, but everything.

So I'll.

I'll look.

I carry different subscriptions on medium.

I have behanced subscriptions as well to several, I think movers and shakers there.

I do the same thing on LinkedIn.

Of course I'll also have a Google feed going.

I will follow several vendors and evangelists that are present there.

I have your classic, like clearly I have your classics.

Yeah, they're good in general.

Right.

What else?

My mind is escaping me.

My problem is that this sort of obsession has to be.

You're never gonna get everything and you're often going to get what you need to execute on the role that you're doing on a daily basis.

And considering that I'm running a business, much of my knowledge then becomes very centered on what it is that I'm doing.

For my clients and I'm in this world specific.

So if I right now I have a AI agent security, I have a another vendor I'm working with that's doing autonomous red teaming.

I have another vendor as well that's doing the typical doctor so they're looking at three different market spaces wherein I have to keep up.

How much time that takes leaves this much time.

So for every source I gather from I have to admit to you no matter how many sources I gather from, it's not as though I get to read everything.

So I'm keeping something on all the time I'm watching and I'm keeping abreast when it ever comes to policy these days and regulation these days because it's so erratic as well as funding in the United States that I'm kept most busy by how economy is moving here to support the vendors I work with.

Yep.

That's I think is a global.

It's a global scenario.

We're saying that's the kind of the stability and kind of where different organizations of vendors come to from a global perspective is very unpredictable at the moment.

Interesting times.

It is interesting times.

Interesting products make crunch.

It does indeed.

So it does indeed.

I'm just keeping up.

I have to admit to you I wish I could take everything in with the multiple pursuits I have.

I take as much as I can take in to be successful, as much as I can take in to be happy and then as much as I can take in to stay curious.

That's the important part is make sure you always spend time on yourself to do the things you enjoy and motivations and stay happy.

So keep, keep up with all of your your sports activities for sure.

What's.

What's the best way for the audience to if they want to reach out, if they're interested in coming to you and learning more about your advisory side roles and the knowledge and services or what's the best way if they have follow up questions to contact you.

How.

How is the best way for the audience to get in touch?

Absolute best way is LinkedIn.

It's LinkedIn Zyrazada P I R Z A D A and then otherwise my first name Zaira Z A I R A infinitusmc.com Fantastic.

I'll make sure that we add those to the show notes as well so it'll be easy for people to find you.

Many thanks for being on the show.

It's been awesome.

I always enjoy talking to you and hopefully we'll get to catch up a conference or somewhere in the near future, grab a coffee, chat more about sports.

Yeah, likewise.

We owe it to each other.

We owe it to each other.

I feel like we're always passing each other somehow at conferences we are attending.

So I absolutely owe it to you too.

Once, once my recovery is through from sport related injuries, we will have for the audience.

We're both having the same recovery process from similar injuries.

So we'll see.

See, I think yours is going to take a little bit longer than mine, though, because I'm already on the recovery side.

Well, by the time I get out there again, you'll be first on the list.

Fantastic.

Okay, thank you very much, everyone.

Stay safe, take care and tune in to the Security by Default podcast every two weeks for future updates, future guests and great conversations.

Take care and all the best.

Bye.