Security Confidential S11 E2 George Kamide

Manoj Tandon: And welcome to another episode of Dark Rhino Security Confidential. Today we are honored to have George Kamide join us. He’s a fantastic person, and he’s a podcast host. Actually, he hosts two podcasts: First Watch and Bare Knuckles and Brass Tacks, which we’ll talk about a little bit.

You know, he’s currently a senior director at Safeguard Cyber, but what’s really interesting is that he was once an anthropologist, believe it or not, a rock climbing instructor, a wedding photographer, and a creative writer, and now he’s in cybersecurity, which is really kind of cool. We get such great varied diversity into the profession.

He’s also an advocate for greater representation in the information security space. He sits on the advisory board for Vision and Voice, a community dedicated to lifting women into cybersecurity positions. He, of course, has briefed U.S. Cyber Command and the Congressional Cyber Caucus, so we’re honored to have him. Thank you so much for joining us, George.

George Kamide: Yeah, thank you for having me. I’m excited to be here.

Manoj Tandon: You know, I’m sure you’re bored of it because I think you’ve been on a couple of podcasts, but for our listeners who don’t know you, give us your origin story here a little bit. Most people want to become rock climbing instructors or anthropologists or wedding photographers, and you went the other way.

George Kamide: Yeah, that’s a fair question. It’s fair to say that it was a circuitous route into cyber. I will also say, as somebody who has interviewed a lot of people in cybersecurity, I have found that very few of them have a linear path like that. There’s this imagined path that goes from, say, IT help desk all the way into security engineer and up to CISO, but that has not been the case.

For myself, I am intimately interested in people, and I think that’s why anthropology was so attractive to me. It helped give me a frame to understand different cultures. I’m a product of multiple cultures, and it helped me understand people as inhabiting a universe—not just customs or language or how they dress or how they talk.

Then I got into writing while I was doing things like rock climbing and taking wedding photography. Writing has always been a part of my life. Tech has always been a part of my life. I am the son of immigrant parents who paid for me to get coding classes at seven. You know, they spent a lot of money they didn’t have on a 386 computer when I was a kid.

Manoj Tandon: Wow, yeah, I remember those. That dates you a little bit.

George Kamide: Yeah, I learned BASIC and could functionally type by nine, and that was them investing in what they saw as the future, right?

Then I remember in 1994, my dad dropped a pile of books on the table, and it was all HTML. He’s like, “You need to learn this.” I mean, he saw it.

So I played around with that; I did some web design. I think I never thought that I was a “tech person,” but I was sort of tech-adjacent.

But then the writing led into marketing. I like to joke—I guess it’s half-joking because it’s also true—that creative people end up in marketing because they need health insurance. And so I was working for a big agency doing largely B2B marketing.

Manoj Tandon: Okay.

George Kamide: I happened to start working for a cybersecurity startup because I moved laterally from doing social media security strategies to a company that was doing a lot of work in securing companies against risks in social media and now subsequently other communication channels, which is at Safeguard Cyber. So that felt like a good move.

And then I’ve told people before, I think a lot of people are intimidated by cyber, but it’s very welcoming, especially if you’re curious. I think it’s very hard to get far in cyber if you’re not curious. I mean, the tech is always changing; the risks are always changing. And I think it’s very rewarding and has been very welcoming.

Manoj Tandon: That’s fantastic. I think for our audience listening, it gives them a little bit of insight. Again, trying to break into cyber, you really took a zigzaggy path there, but you can absolutely make it in if that’s what you want to do. You don’t have to be a super technologist to make it happen initially. Find a path, carve at it, and go for it.

Now, you briefed U.S. Cyber Command; can I ask what that was about?

George Kamide: Yeah. So I think as you said, if you have a path—yes, ostensibly I entered cybersecurity as somebody working in marketing, but at the time we had a lot of data on—and this was around 2018—Twitter bots that were being controlled by Russia. We could see within our system certain things, and I took essentially the anthropology of that schema. You could study them, study behaviors, and begin to catalog them.

So, part of marketing in cyber is to put out thought leadership, and we put out a report on the activity that we had been seeing.

We were then approached by some folks at Cyber Command to better understand that. I think at the time people had thought of then it was called disinformation; now it’s kind of known as influence operations, but they sort of thought of it in these wartime analogies. Like, here’s the village, here are the trolls lined up on the hillside, and there’s like this fusillade of disinformation just sort of being thrown at the village like cruise missiles or something, or heavy artillery.

What we found was actually that it’s really more like drug trafficking, right? They go down into the village and they find legitimate supporters and they pass that information. That’s what was really interesting to me, and that was interesting to them because they were looking for ways to understand it so they could obviously disrupt it.

I made a lot of good friends there and continue to talk to some of those individuals.

As part of that work, we were also asked to come in and talk to the Congressional Cybersecurity Caucus, which was, I will say, kind of inspiring. At the time, you know, it was a very fractious political environment, a lot of political theater. It’s one thing to see them go back and forth in the press, but when you’re talking to the caucus, a lot of them are the staffers. These are the people who write the bills, who brief senators and members of Congress.

Republican and Democrat alike were sitting in this room asking very detailed questions, very nuanced questions, and they all go and hang out at the bar afterwards. It was really interesting to see how much cohesion there was around that issue, even though it may not have looked like that in the popular media.

Manoj Tandon: Do you think Congress has an understanding of the risks—the cyber risks—our nation faces?

George Kamide: I think some of them do, and I think that’s increasing. I’m sure we’ll get to this, but when the Congressional AI Caucus was started, for example, it was like a dozen people, and it has grown considerably. I think that there is a real appetite to learn these things.

I think especially after the rather embarrassing social media Congressional hearings—the big tech hearings—where it was just very clear that elected members do not really understand how the basics of even the internet work, there was a very big perceived need for that education.

I think anything can be politicized, but I think behind the scenes the staffers are really hungering and seeking out that knowledge. Also, to be fair, they are recruiting SMEs in those categories. Some senators will have a security advisor to them inside their office.

Manoj Tandon: Now, that’s good to know because we see it. We’ve seen it in some of the work in the energy sector; it’s well known there are vulnerabilities with our grid and there are things that are very hard to patch, and there are things that could readily be done.

In the “readily to be done,” it often seems a lot of times there’s inaction because of politicization—that’s a word, right? But it’s good to get a confirmation here that maybe there are people paying attention and things will change.

George Kamide: Yeah, I think with the elevation of things like CISA and coordination with the FBI, it’s getting a lot better. I would say to listeners, again, you sort of see one face of it, which is the external political theater, but behind the scenes—especially with lifelong civil servants—people go in with a very ardent sense of service. There are a lot of dedicated people in there who are really trying to help.

Manoj Tandon: Switching gears here a little bit, you have two podcasts: First Watch and Bare Knuckles and Brass Tacks. What’s the story behind them? What is your work there?

George Kamide: Yeah, so for First Watch, that was started when we were a security startup. It was a chance to engage in conversations that were important to our work, which was maybe a bit niche and less known in terms of an established category. We weren’t like an EDR provider or a CASB provider where you have a pretty big definition.

But it was also a chance to have conversations and talk to different kinds of people—not just security leaders. We talked to policymakers; we talked to newcomers who are just starting in the field and getting that journey story so that other people can understand how you get into cyber.

Of late, I’ve talked with a number of people who have made career switches—from TV producer to pen tester, or from gym owner to SOC analyst. That’s been rewarding to just get those stories out there so people know. As we all know, we need more talent, and I would like to demystify the fact that you don’t have to come in as a hard coder into this industry.

Manoj Tandon: Yeah, and there’s a lot of strength with that diversity of people that are coming into cybersecurity because it’s bringing in very different viewpoints.

George Kamide: For sure.

Manoj Tandon: And it’s illuminating problems in a different way.

George Kamide: Yeah, because I talked with a CISO who said the best SOC analyst he ever had was actually a history major, because he suspected that person’s training had made them very good at pattern recognition—looking through reams of text and trying to find patterns. That was a skill set that would have been hard to train from a 101 level.

Manoj Tandon: Oh, absolutely. I’m waiting—I have not yet had a guest on that came over from psychology. I really think that—and this one I bring up because it’s been something that I’ve been pushing out there—we often focus so much on mitigation, on defense, but really, if we’re going to make an honest attempt at being disruptive in this cat-and-mouse game, we really have to get in the mind of our adversary as well.

George Kamide: Yeah.

Manoj Tandon: Understanding their motivations, what drives them, what’s going on over there is foundational in developing strategies that are more proactive—that are not the obvious “let’s hack back.” Two people can play mind games; it’s just a question of how well you understand your adversary to be able to—

George Kamide: Yeah, for sure. To return to your question, the other podcast, which is called Bare Knuckles and Brass Tacks, is more of a passion project that is outside the purview of working life. That was started over a conversation. I met a CISO named George Al-Koura at Black Hat last year. He and I have similar views on some of the bad practices that have developed between vendors and customers, and I pitched him the idea. I was like, “You’re George on the CISO side, I’m George on the vendor side. This podcast writes itself.”

So every week we try to—we call it Bare Knuckles and Brass Tacks because Bare Knuckles is really just us letting loose some steam. There’s an explicit rating on the podcast for a reason. We are breaking down some bad practices, but then the Brass Tacks is like, “Well, let’s not just admire the problem; let’s really try to offer a solution.”

We’ve been surprised at the reception to it, especially since there’s little to no marketing effort behind it because it’s just a side project for both of us.

Manoj Tandon: You’ve got to illuminate us here a little bit. Give us some of the learnings on the bad practices that happen between vendors.

George Kamide: Well, yeah, good question. So let me back up a little bit. As I said before, I worked at an agency and we did a lot of B2B marketing. I think a lot of the practices that were around traditional B2B marketing—I mean, go as far back as selling printers door-to-door—sort of trickled down but into massive scale and automation. A lot of technology just gave us really fast ways to do bad things faster.

Manoj Tandon: I love that.

George Kamide: So the common B2B sales tactic is to just work this numbers game of leads, cold calls, and emails. It’s a bet of percentages. It’s like, “Okay, well, if I send 3,000 emails, all I need is like 10 to open it.” They just keep working the numbers down.

Manoj Tandon: I told our marketing company once—they told us one percent is a fantastic response rate. I’m like, “All right, so then we’re just spamming the hell out of everybody.”

George Kamide: 100%. At that point, nobody—probably not even—

Manoj Tandon: I get thousands of emails a day, man. I don’t even open them anymore. I just deep six them.

George Kamide: Well, let’s stand back and kind of step out of the stream, out of the inertia, and think: Does that make us any safer?

If there’s this trust divide between buyers and vendors—like, there are buyers who legitimately are thinking, “I’m not really happy with the solution; I need to look for a replacement,” or “We moved from on-prem into cloud, therefore we need this new capability.” But what is the trust if I am the marketer/vendor and I’m just treating you as a number? You’re one lead in this giant bucket, and we’re just going to either spam you by phone or we’re going to spam you by email and just hope to bludgeon you into submission for a demo.

Then maybe—I don’t know—it’s not a model that is sustainable given the number of vendors coming online. And it’s not sustainable, I think, post-COVID where a lot of people are working from home and those cold calls are going to their cell phones.

I think, to be fair, the cybersecurity community is probably still processing a lot of trauma from the lift-and-shift to work-from-home and having to do a lot of extreme work under extreme circumstances, and they’re just not putting up with it anymore.

I was telling some friends, I have never seen such a huge divergence between customer and solution provider as we have now. Think about Coke and Pepsi: for the last 10 years, they’ve been buying up every brand that is not soda because the data is like, “People are not drinking as much soda.” They’ve still got their core product—we’re still going to sell Coke, we’re still going to sell Pepsi—but I’m also going to sell Honest Tea or Aquafina or whatever. That’s what margin is.

But what do we do in cyber? It’s like our customer saying, “I’m really worried about diabetes,” and we’re saying, “I got more sugar.” And they’re like, “Well, I’m really concerned about my diet.” It’s like, “More sugar!” We just have these—we’re talking at cross-purposes, and it is, again, not making anyone any safer. That’s what we’re trying to help.

Manoj Tandon: I’ll tell you—I’m going to just speak from a personal basis—to me, a lot of those emails are just somebody—I don’t even know if they’re written by a human. I wonder how many people out there are just using ChatGPT to write them.

George Kamide: Certainly now, certainly yeah, and just sending more crap through the channel.

Manoj Tandon: But you mentioned trust. Is this legit? What is this, a bot? Is this even a human being? Did they even bother to research us a little bit? You know, all our stuff’s out in the public; you can find so many things. Did they spend two minutes to understand us, or do we just get spammed, man?

And then nobody cares.

George Kamide: Yeah, we’re entering the age of synthetic reality, so trust is going to be the number one differentiator for businesses.

Manoj Tandon: How do you do that? As a marketer, someone who’s had extensive experience in it, how do you develop that trust with someone in an electronic medium where everyone’s using it to spam the living daylights out of somebody else?

George Kamide: Yeah, I think it requires a pretty big cultural shift. You have to really go to the sales team, and marketing and sales have to work together. They cannot work at cross-purposes. You can’t go out with one message and sellers go out with another.

You really sit around the table and you’re like, “Look, this is what we’re going to do: we’re going to focus on the companies that we think are a higher intent to buy.” We’re not just going to go, “Here’s a list of companies in a spreadsheet, hit them all.”

We have certain technologies that we can use to see, “Are they searching for these terms? Where do we judge them in the research process?” Let’s focus our energies there, which is more efficient. Then when you do that outreach, really teaching your teams to understand the business.

Like the vulnerabilities or the risks, I should say, that for example a software company is facing are fundamentally different in terms of their environment than say a manufacturing company that has a hard infrastructure and factories that need things like OT and ICS controls. So just being able to batch your research and understand that, and also work through the channel, work through partners who are already embedded there to build that trust—that’s what you have to rally around.

It’s really hard because you could be doing that and then you look over your shoulder and say, “But competitors are just—we see them going to every conference and they’re doing all these things.” It’s very tempting. There’s a lot of cultural inertia, and you just have to have these principles and you kind of have to stand by them and work inside them, but it can be very tricky for marketing teams. I do feel that sympathy—that there’s that pressure—but it leads to a lot of thrash; it leads to a lot of pivoting.

Manoj Tandon: So, okay, I guess this sets up in this age of AI that we’re coming into and the resulting automations taking place.

Now you’re describing a cultural change. I would think that you’re really trying to swim upstream then, because the temptation is going to be, “Let’s just use the AI and have it—why doesn’t it just research the companies and come up with a subject line and write a note?” No one will read it before it even goes out to see if there’s any context to it, but let’s just have it do that. It’ll be more efficient, and we can hit a lot more people versus the old way, which was you actually put some time in before you sent a meeting request to an executive.

George Kamide: There’s a bit of a paradox at play here. Yes, you’re right; in terms of being able to do the research, I do think of some of these models as being more efficient data processors than they are necessarily generators.

For example, asking ChatGPT or Hugging Face Chat or whatever to process a 10-K filing might get you to the nuggets that you need to glom onto as a seller faster than, “Just write me a generic email,” right? Because then you sort of are doing the same thing as everybody else. But if you can get that competitive edge, it’s how you apply that technology.

But the paradox is, I do believe that more human interaction is going to build that trust. You might see more emphasis on spend for local conferences—think of like Rocky Mountain conference—getting local and getting face-to-face and establishing that rapport and understanding people rather than sort of the “spray and pray.”

So I think it may require—and I’m not there yet, but it may require a restructuring of how sales and marketing teams work on the ground. But I do believe those face-to-face interactions are going to make all the difference.

Manoj Tandon: And they always have.

George Kamide: Exactly. I mean, I say paradox because that feels a little bit like going back and knocking on the door to sell printers, right?

Manoj Tandon: That’s right, exactly. And the idea now—well, in the last two decades almost—has been “let’s automate as much as possible, create the volumes, and just rely on statistical—you know, the law of averages that says X number of people are going to click this thing.”

George Kamide: Yeah, it’s a Capital One model. You know, they pioneered the sign-up-for-a-credit-card—I mean, this is what I would say to anyone who’s listening from the marketing and vendor side: there are two forces at work.

One, your customers talk to one another, right? So that terrible feeling that my co-host, the other George, has—he has shown me his inbox where he’s got 686 emails from the same vendor in three months’ time. He’s telling all of his friends, “I will never do business with this company because it’s abusive.” And that rep has no idea; the metrics that they may get is, “Oh, George is not opening my emails; I should send more.” What he doesn’t know, or she doesn’t know, is that they’ve effectively torched their entire territory because he’s already talking to all of his CISO friends, right?

This exists; we know they have these collective Slack channels. So I don’t know if it’s really worth it or sustainable in the long run to do that, because once you get that bad rap, I mean, that’s your entire business in terms of the trust.

The second force at work is—and I’ve said this before—if you want to apply these new transformational technologies to just do the status quo cheaper, that is—and I will say it for the people in the back—the dumbest application of that technology. Why would you not want to leapfrog where you are now and unlock that excellence, rather than just write stupid emails faster?

Manoj Tandon: Right.

George Kamide: You said one percent—are we going to fight over the marginal gains? Are we going to cheer for a 1.2 percent open rate?

Manoj Tandon: You know, I hate to say it, but there’s a huge crowd that would cheer for that percent.

George Kamide: Yeah, and that’s why I’m encouraging people to step back and look at the madness and say, “Is this a sustainable business model over time?”

Manoj Tandon: Yeah, it’s going to be a monumental cultural change, because there are so many metrics that are established around this that become people’s compensation and their bonuses and their effectiveness.

George Kamide: I mean, we are living through a generational shift. A lot of leaders now who are using those metrics and those models came up through the old B2B model, and you’re sort of either open to the shift or you’re not. There’s little that I personally can do about that, but I will tell you after interviewing people, we are seeing a difference.

We have a guest coming on soon who is a BDR who was referred to us by a CISO, who said, “Look, I write 12 emails a week and I get nine meetings.” I mean, who wouldn’t want that conversion rate versus, “I automated 3,000 emails and I got two meetings,” and meanwhile our email servers got blocked by the—

Manoj Tandon: Well, you know what, George? I bet you that BDR, first of all, has knowledge about what they’re selling, right? I guarantee you that they’re probably not just out of college in their first sales gig cutting their teeth. That person must have some knowledge of whatever—if they’re selling security—about security.

And they must know a little bit about how the business works.

George Kamide: Well, and as we said at the beginning, I think this is an industry that rewards curiosity. If you come in here for the paycheck and not wanting to know more, I mean, you’ll probably churn out pretty fast.

Manoj Tandon: Yeah. That’s the only way you can get those kinds of results: to build something that might resonate with the prospect that’s based on an actual problem that they might have.

George Kamide: For sure.