Inside Black Hat: Andy Ellis on vendor buzzwords, AI hype, and the future of the CISO role

Hi, I'm Joan Goodchild, cyber security journalist, former editor in chief of CSO online, and I've been covering security for over 20 years.

Welcome to the inaugural episode of Security Sessions, where we'll talk to security leaders and other influencers and thought leaders about some of the issues that are shaping cybersecurity. I'm excited today to talk to Andy Ellis.

He is a veteran CSO, also one of the members of the CSO Hall of Fame, former CSO of Akamai, among his many accolades.

He is currently serving as an advisor and leadership thought leader when it comes to talking to different people in the industry now with their pain points and so forth through his consultancy, Duha. So welcome, Andy. Thank you for joining on this first episode.

Thanks for having me here, Joan. So tell me a little bit about, Duha first, some of the things that you do and some of the things you're focusing on now. Sure.

We're focused on the intersection of cybersecurity, leadership, product and messaging. And the idea is to bring a spark of genius. We have a lot of organizations that are really good but want to be great. And oftentimes they seek greatness by outsourcing work.

And even if you can find greatness when you've outsourced the work, you didn't learn from it, right?

You bought somebody doing something and then they go away.

And the idea is to come in and help level people up, whether it's engaging with a product marketing team on how to think about messaging to CISOs, or whether it's engaging with the CSO on improving how they interact with the board and with other executives, or engaging with executives around leadership issues.

You know, especially in this moment, as we see this sort of transition from a meritocracy to Di and to what's next, which I think needs to be the inclusive meritocracy, right? Take the best of both worlds and get rid of the ugly stuff. Okay.

And you're drawing upon, you know, decades of security experience yourself. Like I said in that intro, you were with Akamai for a long time.

Really kind of one of the initial people to have the role of CISO in the broader industry. Tell me a little bit about kind of just briefly, like the evolution of the industry as you've seen it.

And how it brings you to the lens that you give to the work you do now. So when we started as security professionals, we were covering the blind spots left behind by I.T..

You know, folks may not remember when the CIO first became a C-level executive. It really reported either from a dotted line or linear line to the CFO, right?

That nobody really knew what the CIO did, except they spent a lot of money and socios stopped doing innovation and governance. And really were doing cost management. They did a great job.

Just to be very clear. We got a lot of technology that did a lot for us, but they were the living embodiment of the 8020 rule, right? Focus 20% of the cost, solve 80% of the problem. Forget everything else. E-commerce in the internet changed that.

All of a sudden, engineers were doing what IT professionals used to do build websites, deploy them, and some foolish security practitioners looked at it and said, oh my God, I've got to fix that.

And that was the birthplace of the first chief security officers. It was the people who dove in, tackled that problem, and became the only person in their org who was doing it. And that's where we started from. So we didn't start from a real executive position.

We started from like forcing our way into the spotlight. And as we've evolved, that's always been the mindset in the mantra of most security professionals.

I think today we sit at a cusp where the chief security officer, chief information security officer is almost a first class, but not quite C-level executive. They're often not really in the room.

I think that's going to change, but it's going to require that job merging potentially with CIOs or with CTOs and being more of an actual business delivery agent versus just a governance and critic professional still looking for that seat at the table in some organizations or in a lot of organizations to be able to drive that conversation and, of course, make decisions about the technology that they use, the tools that they purchase, and that kind of thing, too.

Exactly.

But the seat at the table is earned by people wanting you to be in the room because you're delivering value. They don't want you in there saying no. They want you in there saying, here's where we need to be ahead of everybody else.

Yeah, I mean, I know from my, vantage point to as a journalist who's been covering this space for 20 years, we've talked about the evolution of the role to where it really has gone to that, you know, now, very outdated perception of the Department of know, too.

How are you demonstrating ROI for your efforts? And, you know, how are you, demonstrating that your business minded in what you're bringing to the organization. So it's really been an interesting evolution to see where it was 20 years ago to where it is now. Yeah, absolutely.

It's been changing. And I think people are starting to understand that when you talk about ROI, you can't really sell risk reduction as ROI because everybody feels like you make up the risk number and then you say you brought it down.

So it's sort of the self-fulfilling, well, of course I can claim a lot of risk reduction. People want to see how your efforts are driving either revenue generation or revenue retention. You know, how are you actually impacting the top line?

Because the bottom line is nice, but there's limited cost reduction activities you can do because at the end of the day, you don't have an unbounded amount of cost to solve.

Now, you know, I know any, CSO or CSO that we've met over the years knows that they are inundated with inquiries from vendors absolutely. Every single day, emails, calls, that sort of thing. So much noise out there. And you, went to Black Hat this year.

You're at Black Hat. I'm sure most years as I am walked the floor, looked at 350 vendors and put together a state of the security vendor, which I'm very excited to dive into those details now.

So first of all, let's talk about your inspiration for it. Why did you do it? So I originally wasn't going to go to Black Hat. You know, I just, you know, left having a full time job to start up my consultancy.

I didn't have any clients who wanted to be at Black Hat, so I wasn't going to go.

And I had a friend who's a CEO of a small startup, and he said, you should be there. Like you're part of the community. You should be there. I'll pay for your travel. Like I don't need you to do anything for me. Come to my party.

So I'll give him the promo. It's, Gary Evren over at Nasdaq. Oh, sure.

And he was like, you should come. This will be amazing. So I thought, okay, I'm going to come, but what am I going to do? Like, I can go to the parties at night and all the social events.

And I was had one speaking opportunity because I reached out to a friend and they said, oh, join the community conversation and that'll get you a badge so you can get onto the show floor.

I said, okay, I keep telling vendors what to do. But I've never walked the entire show floor in any conference. You know, I will say probably 15 years ago to RSA, I strolled the whole show floor, but he didn't stop and look at every single booth.

I said, what if I did that? You know, I sit here and I try to lecture vendors on what to do, what not to do.

What if I actually looked at every booth and said, what could I learn? So I just said, you know, let's walk down and write down everybody's taglines, and then I'll figure out what I want to know after I've done that.

And so that was just how it started was I said I'm going to walk everything. So I had my Kindle scribe and I just started writing notes as I'm walking like here's a move vendor.

Here's what I could read of their taglines. And that was really the inspiration was what could I learn? Just by doing that?

What was fascinating was I actually had my report out, I think two days after Black Hat and like a week and a half, I start to see all the analyst reports.

I'm like, well, it looks like my report, except without any data, is just, oh, my gut feel is everybody was mentioning AI and I'm like, yes, but I can tell you how many people were mentioning I yeah, yeah. All right.

I want to get into that in a minute. But where you mentioned some of the other analyst reports and so forth, you said yourself in the write up of the report that you did because I read it, that admittedly, the methodology was awful. Yeah, I think about that.

So I think that when you're doing any kind of a survey, which really this is right, I'm surveying the vendors the to do it.

Well, you should know what questions you want to ask. And I didn't know the questions. I didn't record like who had a bigger booth.

I didn't think about the fact until I'm halfway through walking the show floor that booths have different sides and some vendors make them look very different.

I had like ten vendors who had double entries in my data because I walked the show far in one direction and then back in the other direction, and I didn't even realize I had already written down this booth because it looked different from the other side. Oh, wow.

So there were a bunch of things around that category. Thinking about, like, what verticals people are in where questions I had to later think about and ask. So I would really want to change that. I might want to ask myself if I did this again.

You know how did the booth staff actually behave? Because when I talked to CMO, that was the first question every CMO had for me was, well, what did my booth staff do?

And I said, well, hopefully they did nothing because I was like standing 15ft away from your booth, scribbling notes, trying to be inconspicuous. So I think that's the idea. When I said my methodology was awful, it was literally just writing down some observations.

And then all of my analysis is analysis of observations that were not really well structured. Right, okay.

But that said, as we said up at the top, you're a veteran security. So this comes from a place of experience.

Yeah I do think my methodology is better than any of the analysts who just, you know, walked around, glanced and said, oh, I see a lot of AI. So I will say that I was the buzzword. Okay.

And let's talk about you said, you know, you get a lot of questions. Do you want to follow up from CRM? I was what did my booth staff do. Where they where they okay. So you knew you mentioned doing the report like the approach.

You know, a lot of just sort of, you know, highs and so forth.

Like what did you make of the way that people interacted with you? So it was fascinating. Was the bigger the booth was, the less situational awareness the booth staff had that they were really focused on the people who'd walked up to their booth to interact with.

Very rarely were they looking up and saying, oh, there's people across the aisle from my booth, but looking at my booth.

So I didn't get a lot of engagement on the first day, and I thought this was fascinating.

And in fact, I did a post on LinkedIn in which I made that comment, and the number of CMO was in crows who are reaching out to me going, I want to talk was at my booth. I need to make sure.

Apparently some CMO forwarded it to their whole team and said, I do not want to be named in Andy's report tomorrow. So if you see him, go talk to him. So I then tampered with my own data because now everybody knows there's an observer.

What I noticed was, there was sort of a greediness in some places where I'd be walking by very deliberately, not engaging with booth stuff.

I've got my head down, I'm writing in my book, and people would step up and say hi. Right. It's this the same thing you'll often see when there's, you know, political pollsters on the street you're walking, and they just try to create a conversation.

They don't tell you what they want. They're just trying to force you to stop moving by saying hi.

I personally hate that. I find it really obnoxious. And so that was what I was calling out, like the if you're just going to say hi, just to try to get me to stop. Like if I stopped, I'm fine with.

Let's start a conversation with hi, how are you doing today? Are you interested in my booth? Are you interested in this problem?

So that certainly was an observation in the startup section near the smaller booths. Could not walk through without multiple engagements. Right, everybody, there is. No, no, you're in my my. I'll. I'm going to talk to you. And so what do you make of of that approach.

I mean you talked a bit about brand you know effective brand messaging and so forth.

I mean is that initial approach do you think may help to make that impression too for these vendors.

So if I if as I think through it, I think the challenge is that the larger the vendor is, the more they think of this as, I've got a brand moment. And so I'm trying to get my brand big and bold.

And if you're already interested, you'll come talk to me and, you know, and so I'm going to scrape leads. I'm going to do all the things with getting trick or treaters to give me their badge.

The smaller the brand is, the more they recognize that they actually have to figure out if you're in market and help you be in market.

And I think too many marketers forget that the job of marketing is to bring people into market, not just to find people who are in market. And so I think a lot of companies overspend on getting these big, glitzy booths, but they're not doing any market development.

They're just trying to capture a smaller market. Okay, let's dive into some other stuff too.

I mean, you know, obviously the thing that everybody's going to be wanting to know about and listening for and that sort of thing is right up top. The mention of AI is so it's everywhere. Let's set the landscape first. I mean, everybody's talking about it.

Out of 350 vendors, it was mentioned. I think it was like 108 vendors I think had either AI or agent okay in a tagline somewhere or in their name.

There were a couple of vendors I thought was fascinating, had AI in their name, and I knew they weren't AI company, but their tagline didn't say AI. And I was like, that was a very interesting choice, Okay. And you saw that in a couple of different places.

But what was really interesting to me is that if you're a buyer who isn't yet really well informed on AI, I don't want to just put a pin on that for a moment.

So I think this is a recurring trend in the industry. You didn't know what these companies did based on their taglines. Some of them you did right. There were a couple that were great. That's like, you know, AI for your level one and level two security operations.

You know, your AI coworker I'm like, great. You're doing a really good job of getting across the message of what you do. Yeah.

But then there were people who were like, AI for security, security for AI. I think that might have been Microsoft, but I'm not sure. There were so many of them that they sort of blend in.

In fact, the really big companies all had some very pablum, AI and security like code, you know, coexisting.

And so I think it's this pattern we've seen before, big data zero trust, where you have a phrase that is both conceptual and might have very specific technical implementations, and which you end up seeing in the marketing.

It's just this reference to the conceptual, and it doesn't help buyers figure out where do you fit in my stack. And so if they know who you are right, it's a branding.

But it's not marketing of helping people figure out, oh, I have a problem that you will solve. Or there's a the problem is different than I thought it was last year.

My favorite two who, didn't even mention I think it was directly was Backslash and Mirror, who literally both mentioned vibe coding. I think one was like vibe coding secured and one is like fine vibe coding.

And I thought that was brilliant because there's a problem that CISOs recognize, which is we have executives vibe coding and that that's going to create a whole bunch of issues with bad code.

And so they tackled right to a problem. If you're worried about vibe coding, here are the two vendors that are the only ones who mentioned that.

Now, I know that there were at least 12 other vendors who had security solutions in that space, but none of them talked about the problem. Interesting.

Okay, so again, putting on my, journalist hat, you know, covering stuff that has to do with AI in the industry, how it's being used and how security leaders are approaching it and so forth.

There's certainly a lot of different angles to look at, but I saw something that was probably on LinkedIn or whatever a few weeks ago that was, you know, a meme or a cartoon, and it said, it had like a crowd of stick figures that said, CEOs, what do we want?

And they said, AI, and what do we want to do with it? We don't know.

Or why do we want it? We don't know. So there's just so many, you know, still vague ideas that we need to be talking about AI. We need to say that we're using AI. We need to include that.

But I there's just, you know, still a lot of questions around how it's being used and why and how you're getting, you know, your money's worth out of it, so to speak.

So do you think that what you observed at Black Hat kind of mirrors that a little bit or. Oh, absolutely. And I've got two anecdotes on the opposite ends of the spectrum that support. I love, love the weave, the that stick figure thing.

One was a CEO at a startup that has been in the middle of selling their company for the last year, a few months, he said.

We didn't have a strong AI story when we started this, and every M&A team we talked to, that's the first question they asked, what's your AI story? So I realized I can't sell my company without an AI story.

We're not an AI business, so we had to go build a product just to be able to have a conversation about selling our company.

Yeah, and it's a great product. Like we love it. And now we don't know if we want to sell the company. Maybe we want to develop that product instead. Okay.

So we'll see on the other end of it, I was talking with a CSO who within their company, the mandate came down. Every vendor must have an AI strategy.

And now the way that I interpret that is, if you're a vendor and someone asks you what is your AI strategy? And you say, I don't know, I don't know that I want to do business with you because you haven't figured out that the world has changed.

It would be like saying, I don't know what my cloud strategy is.

You'd be okay to say, my cloud strategy is I'm not going to use cloud and here's why. Or I'm not gonna use AI and here's why. That is an AI strategy. So that's I think the first thing is this is a, seminal moment. Technology has changed.

And you need to know how you're reacting to the change. And I'm just waiting.

And seeing is probably not the right answer. Right. And I think that's what drives a lot of it. And the second one is, great comment was made. Adam and I'm blanking on his last name is the field CTO. But I, I'm feel I feel very embarrassed. Adam.

I'm sorry, I don't don't actually, I've now blanking on your company as well.

And he said the Jim Burrows don't work out to look good for women. They work out to look good for other Jim Burrows. And it really resonated with me. It's something of a funny comment, but that's the the state of marketing as well.

Marketers are often showing up at conferences to look good for other marketers. Certainly booth designers are the person who designs your booth is not trying to sell to the security professional.

They're trying to sell to another CMO who's going to look at your booth and be like, oh, that's amazing. Who is your designer? So I can hire them? Yeah. Good point. Right.

So I think there is a little bit of this, you know, the marketing echo chamber of we're talking to each other rather than talking to the buyers. Yeah.

Okay. I the most popular thing that, you know and that was well-represented topic. So it was the most well-represented buzzword. Yeah. Okay. I think the, the biggest topic was actually code security. And so there's a big overlap between the two.

But when you look across all of the vendors, who's who somewhere in the path is they're trying to solve the problem that you have unsafe code that way.

More I want to say it's like 120 hundred, like a huge and like one third of all vendors there, whether it was source code analysis or application security testing or vibe coding protection or cloud security, dealing with configurations or pentesting, this is very clearly the unsolved problem.

Like I might be a solution to this. Honestly, I think it's going to make it far worse.

While it might also make it better, I think it's going to get worse faster than it gets better. So I think that's actually for me, my biggest takeaway is this is the thing we haven't figured out how to solve organizationally. It's not a technology problem.

And as long as we can't solve it organizationally, there's fertile field for vendors to keep coming in and fighting in this red ocean.

Okay, I want to go back to buzzwords in a minute. But in terms of other, you know, sort of tool categories or, you know, or even if it's problems to solve, what else were you seeing? What were some other well represented areas among those boots?

So a lot more in the PRM and GRC space. So I think that's growing.

While at the same time, a lot of people were debating whether they wanted to use the word risk.

So, you know, exposure sort of was popping up in a lot more places, you know, whether it's the, you know, the C tab in the can, was it continuous threat and exposure management. Talk about just putting four buzzwords together kind of space.

It's price you know I guess for for it it's got to go in a quadrant. But that's about so that was a big buzzword.

I was I was sort of surprised that human didn't show up more like certainly the human risk management space, whether it's, you know, the Mimecast or the no. Before is, you know, all the security awareness and phishing, you know, they're all saying human risk management.

But I thought we would see more of this tension between human and AI. And there were a few vendors who did who basically were like, you know, AI enabled, human managed, but it was very rare.

But it was a thing that I was looking for was, you know, where is this going to show up? And it didn't show up very much at Zero Trust, I think there were 4 or 6 vendors.

Interesting, because going back to your point before about patterns, you know, I mean, ten, 15 years ago we had internets of internet of things. We had big data, zero trust was everywhere about 7 or 8 years ago. So yeah. Okay. So that was not well represented.

Any other big topics that you would say? Nothing. Certainly nothing that rivaled AI, but anything else that stuck out for you.

The thing that also stuck out as a nobody has the right conversation here, but it's it shows up. It was identity. And we see a bunch for non-human identity like that.

Certainly popping up especially is sort of a subset problem of AI, but it feels like identity also remains an unsolved problem.

And there's everybody coming at it from different places, whether it's, you know, identity aware for your sim, because so many Sims have no idea who the user is, they just have an IP address at a point in time, whether it was, you know, identity management, identity, you know, what is it?

It's our identity threat detection response. Look at that. We love the four forward, captions here. So that felt like another space that I saw a lot of. But I didn't have a coherent like, here's the theme for this space. Yeah.

We're a few years out now from the SolarWinds incident, you know, but was supply chain security and vulnerability management within the supply chain?

Was that talked about at all, in your opinion? Did you see a lot of that? So it was fascinating. Was the phrase supply chain? I think I only saw in two booths if I, if I recall correctly, you know, third party risk management shows up a lot.

And I think the, the, the biggest challenges we, we don't ask the right question of our vendors.

You know, people are so focused on how do we protect the software itself. And of course, we saw, you know, Chain Guard and Minimus and a couple of other, you know, folks who are in the the, you know, how do we minimize containers?

But we didn't have what I think is the most important question we should ask of all of our vendors.

It's actually two questions, but they're the mirror image. One is how would I shoot myself in the foot using your technology? And what do I need to do once I'm using your technology to be safer overall? Right.

Instead we, we inundate people with these PRM questionnaires that are like oh, answer 900 questions about your password management on your corporate laptops.

And then we forgot, oh, the auto update will allow this to call out to anybody. When you install our software you should, you know not allow outbound connectivity except to our domain. Like that's a solvable problem. Like you've got DNS.

You can say this machine only allowed to make DNS queries over here. Have a nice day. So what do we take from all of it?

What says the sage mind of veteran security leader. Yeah. Andy Ellis, on what you take from this. You know what? What goes into effective brand messaging then with all of that considered?

So I think that the most important thing for companies to think about is what are you there to do? You know, if you are a Microsoft or CrowdStrike, you know, one of these huge players, right?

It's fine to just show up, slap your logo everywhere, have some fun slogans and buzzwords because you're not actually trying to sell a product. You're selling your brand.

And in fact, I think it was HP who had like the my favorite of all of the booths, actually, was one of my two favorites. I'll say, because it just said like find, wipe and or find and delete laptops.

It was, you know, just tagline that was like it was the data recovery of, oh, if you've lost a laptop, we can find it and wipe it even when it's turned off. And I'm like, this is HP and they're selling one feature and I love it.

Like that's very clear on point. We want to remind you were HP were huge were massive.

And if you want to buy this feature have a nice day. Like that's great. If you're not in that position of already being a mega brand who everybody thinks they know what you do, you do have to always do market education.

And if you're not doing market education, at every time you get a moment of somebody's eyeball, it's a missed opportunity.

And I think this derives from this, this phrase I've heard my whole career, which is everybody sells or always be closing, is another one that sales reps like to say. And I think I don't want to give you an explicit rating, but I think it is bovine manure.

And the reason for that is you cannot sell if someone is not a buyer.

And so the art of sales is detecting that someone is a buyer. And fleecing them for all their worth and making them happy. You did so right. It's like, okay, you're a buyer. I can get $1 million from you. I'll give you 3 million in value to you.

You're happy. I'm happy. The world is good. But if the person is not a buyer, you're not going to get any money from them.

And tactics designed to extract money make them really annoyed. And so instead, you have to educate them. And I like to say you're brainwashing them, you know, subliminally, without their permission, no consent to believe things that will make them a buyer. Right?

Do they have a location that has a problem that is urgent? Is it their problem to solve?

Do their peers want them to solve it? Do their stakeholders think that they should solve it? You know? Do they know all of the ways to solve it? Is your solution viable and do they have budget? If they believe those nine things, they become a buyer.

Marketing's job is to make those nine things true for as many people as possible.

So when you show up at a conference, you should be saying, which of these truths are we making, is sure is in our tagline so that someone sees it and is reminded, right? Like Mimecast, who says human risk managed was literally the biggest thing on their booth.

So they're saying you have humans that work for you. Reminder. Like whether you agree with the the blame, the human messaging, which we could spend a whole conversation on, they started with one of their truths because you have humans, you have risk.

So second truth there and then managed is them implying that they're a viable solution. So three of nine truths in three words like that's all you're doing. Either someone sees it and says, oh yeah, I was thinking about that. I need to solve it now.

I'm going to walk in and learn more, or they walk by.

They're like, yeah, I don't actually care about the human risk right now, but you've got this moment where they thought about humans as a problem, and as they go forward, you know, they're more likely to come back to this in the future. Sure.

All right. We're almost out of time. But a couple other, closing questions. First of all, we talked about buzzwords. Any predictions on the next big and emerging buzzwords based on your time on the show floor this year?

So I think that MCP is going to be massive at RSA. That's just going to be my guess. For those not yet familiar with it, it's the model context protocol.

The easiest way to think about it is that instead of having an API that is tightly defined between a client and a server, you just put an Lem on either end of it and let the LMS negotiate what they want to talk about so that you can very quickly connect systems together without having to have SDK, is that you're exchanging it is going to revolutionize software development, and it's going to make it really scary because now instead of asking for the weather, you're going to ask ChatGPT to go negotiate a protocol with something that might have access to the weather, and to your bank account.

And so maybe instead of getting back the weather, you'll get back somebody else's bank account. So, you know, I only saw a couple of vendors at Black Hat who mentioned MCP. I think we'll see it more going forward.

I think the the Tron movie might actually contribute to this, because every time I see MCP, I think master control program, because that's how old I am.

I remember the original Tron movie. So, you know, I think there's going to be a little bit more of that. But other than that, the thing about buzzwords is they hit us out of left field every time.

Like they're really hard to predict which one is going to capture the gestalt.

I think we should watch what Gartner and Forrester and Omdia and everybody's going to be saying in the future over the next few months, because I think that's also going to then drive to what will be the buzzword at RSA. Okay.

And the question we ask everybody, unpopular opinion. What unpopular opinion do you have in this context that security vendors might push up against with the, you know, you maybe you will die on that hill?

So my unpopular opinion is that cold emails are amazing marketing opportunities and you're all wasting them. Everybody is sending cold emails that are basically trying to say, talk to me today.

You should think of them like billboards. As people are driving down the road, maybe they will pick up the phone and talk to you or they'll respond to the email.

But if the email doesn't contain anything educational, you have missed out on the opportunity, even if it's just two sentence. So they just see the headline. What are the phrases?

You're trying to brainwash them so that over time they're like, oh, I do actually need this. And I remember the people who are doing it. Okay, so they're not just a nuisance in the inbox. You say they're a wasted opportunity that have a lot of potential for ROI.

They absolutely do. Like if you're getting eyeballs in the inbox, make it a positive moment, even if they don't talk to you. Okay.

Andy Ellis, thank you very much for your time today. It's been a great conversation. Thanks for having me. Okay. And you heard it here from Andy. Look out for MCP when you're walking around at RSA next year.

And, marketers, you know, or I guess maybe the sales folks need to up their email game because, you know, and he's got some ideas for you.

So reach out to do. Ha if you want more suggestions on that. Of course. Thanks so much for watching the first episode of Security Sessions. We really hope you enjoyed the conversation. And if you did, please like please subscribe.

Please leave us your comments and we hope to see you next time. For now, I'm Joan Goodchild.

Have a great day.