Security Confidential S16 E1 Ken Underhill

Manoj Tandon (00:01.055)
Hello everyone, this is your host, Manoj Tandon. Welcome to another episode of Dark Rhiino Security, Security Confidential. Today we have an alumni member back with us, Mr. Ken Underhill. He appeared on the show almost two years ago. And just to refresh everybody’s memory, he is the former CEO, executive producer and television host at Cyberlife. He is the bestselling author of Hacked.

the cybersecurity interview, a complete interview preparation guide for jumpstarting your cybersecurity career. He’s been on NBC, Forbes, Reader’s Digest, yada, yada, yada. You can look him up. He doesn’t really need an introduction. Ken, again, thank you for honoring us for your presence. For the second time, I guess the first one didn’t leave you reeling too badly.

Ken Underhill (00:56.022)
You know, I think we did so much cursing on that first one, if I recall correctly, that I was banned from any media appearances for a few years. So thanks for having me back finally. Your ears have finally healed from that. You you mentioned the Reader’s Digest, just real quick. I had a grandmother, she’s passed away now, but she was grown up. So I’m older, for those that don’t know, I know I look like I’m 10, but I’m legitimately older. And so she was a big collector of Reader’s Digest. And so when I got…

featured in that and it was just on they’re website years ago, some article, I talk a lot of trash. They said, hey, let’s publish some of this trash. But for me, that was actually one of the more meaningful ones personally, because she was long deceased at that point, but it was kind of like, okay, cool, this one’s for grandma, if you will. You also mentioned the book, we just came out, I don’t know when this will publish, but in 2024, I guess I shouldn’t say when we’re filming this, but whatever, at this point, who cares?

Manoj Tandon (01:53.256)
Yeah.

Ken Underhill (01:54.382)
We came out with a second version of the book. I don’t know if people could see you know on the screen. I should have a copy here Real quick for anyone that still uses eBay if you’re if you’re old Any signed copy by Tia Hopkins that stuff goes for millions on eBay’s when I sign a copy People just complain like why’d you mess up my book, right? So I don’t get it I don’t know if tears wife, you know is doing a prank on me by posting there whatever But yeah, we you know, it’s it is a best-selling book international bestseller

Manoj Tandon (01:58.399)
yes we can.

Ken Underhill (02:23.714)
We came out with a second version. For those that don’t know, books are a labor of love, very painful. You cry a lot, at least I did, you know, writing things. But we, at the end of the day, we hope that it helps somebody. know, that’s at, if you help one person, in my mind, you’ve done good in the world. And you can sit down and you can retire and all that stuff.

Manoj Tandon (02:43.134)
Yes, you have.

Well, I would say most of the world would agree if you’ve helped another life, it matters. That actually matters, which is somewhat not in line with our meritocracy-based system that we have. Yeah, you need to go to Harvard, get the Ferrari, work at…

Ken Underhill (03:04.366)
What do you mean, like, people saying you need to get a Ferrari and get a My Bosch, get the Manchia and get the, you know.

Manoj Tandon (03:15.423)
you know, an investment bank. My only thing is if everybody did that, then who would do any real work? And where would we be at?

Ken Underhill (03:24.29)
Well, hey, I’m busy driving my Ferrari, so that’s not my problem. To figure that out, yeah.

Manoj Tandon (03:27.571)
There you go. So I got to ask you a couple things on the new version of the book. First off, we had a guest on that explain that they were able to use AI to cut the time to write a new book by 90%. Did you use any AI in the production of your second edition?

Ken Underhill (03:52.13)
Well, no, so me, no. And as far as I know, at least our director from the publisher is, no, you can’t use AI. I don’t know who they published through if they did self-publish. Now, you can use AI for thoughts, like, hey, I’m trying to struggle with the thought on this or that. And I think that’s… This would probably make people mad, whatever. I don’t think you should use AI to write a book.

Manoj Tandon (04:00.351)
or you can’t.

Ken Underhill (04:22.09)
And the reason I say that, I guess it can save you time and an effort and things like that. And it could probably do a pretty decent job of writing things if you don’t wanna to type. If you’re a slow typer like me, yes, I can hack things, but I’m the slowest typer in the world. So like, if you need to hack the Pentagon and you gotta have someone fast, fast typer to do it, don’t call me. I’m gonna fuck it up. I was trying not to curse. so no, I don’t know. And I don’t know, I don’t think Chris or Tia did either. Like they actually,

Manoj Tandon (04:44.254)
Hahaha

Ken Underhill (04:52.564)
scan the chapters that we submitted for AI usage and anything. And it was interesting because we actually had it flag on a few things and it was things from the first book. I’m like, well, that’s our words. That’s our own words. But they still made us make some adjustments to the verbiage because it was flagging as AI generated. I’m like, they stole our book. Right, right. So you have those things. So yeah, you could

Manoj Tandon (05:14.929)
Yeah, I mean, that’s just part of the language model, right? mean, anything you’re putting it.

Ken Underhill (05:22.484)
use AI to write a book, my personal opinion is not to do it because I think there’s so many AI generated books on Amazon. Like can spot them. Like I’ll buy a book, I’ll look at the first chapter and we’re like, this douchebag used AI. You know, this is chat GPT all the way, right? You can tell that by the words like crucial, you know, and the shit like that. So like, I personally can’t stand that. And as someone that buys a lot of books, some people call it an addiction, whatever.

There’s worse addictions out there than buying books, let me tell you that. But like, think that what is missed these days when people use AI for everything is that you miss the human, I guess the best way to say it is like that human connection, right? Like when I read a book from way back in the day or something, like a favorite book or something,

Manoj Tandon (05:54.204)
I’m sure, yes there are.

Ken Underhill (06:18.388)
I in some way feel connected to the author based on their writing style and based on all these things. And when you start using generative AI to make a book, it’s like cookie cutter. Like there’s no flavor. It’s kind of like, I shouldn’t say this. It’s gonna piss people off. But I’m white, I can say this. A lot of white people don’t season food. I’m just gonna call it like it is. So people out there will understand that. Other people will get pissed off, whatever.

Manoj Tandon (06:42.067)
That’s a new one, actually.

Ken Underhill (06:47.79)
Sometimes you got to take a position in life. And so with that, I equate like an AI-generated book is like not flavoring your food, right? Not putting any type of seasoning on there. And that’s what it is to me, right? So like I, there’s actually a lot of people in cyber that are using AI, generative AI to write they’re books. And some of them, you know, I liked them as a person, so I bought they’re book, but then I look at it I’m like, well,

Manoj Tandon (06:47.891)
you

Ken Underhill (07:16.654)
Like this is straight up AI. I don’t know, just, to me, it takes away from it, right? It’s like using AI to generate like a video with like an AI prompt, reading it, an AI voice. And I’m like, it’s not the same as like Minaj or Ken or Emily or whoever talking trash on a podcast, right? Like if we use just, if we scripted out this podcast and just let AI generate the voice and stuff, it’s.

Manoj Tandon (07:43.881)
yeah.

Ken Underhill (07:44.918)
It’s not the same, the tonality, the, it’s just, I don’t know, I just equate it to life without seasoning is kind of the way.

Manoj Tandon (07:49.619)
You know what, should do that actually. It should be like a short 10 minute episode. I just want to see what it comes up with. Yeah.

Ken Underhill (07:53.196)
Yeah. This, this is Ken and I am on the podcast and you know, it’s like, it’s just, you know, and, and, and don’t get me wrong, right? Like I think that AI, generative AI, I there’s applications for all this stuff, right? I think it’s very beneficial. It saves a lot of time, especially like if you’re a business owner and you’re not good at copywriting or doing marketing stuff, like AI is great at generating ideas. It can do a decent job at copywriting if you know, you know, if you prompt it correctly. But I think like,

things that are gonna stand the test of time like a book, or we hope would stand the test of time like a book, I think those things, I think it devalues the book in my opinion. Again, that’s Ken’s opinion, someone out there is gonna be like, know, F you, you’re wrong. But I don’t think it’s right. And like I said, with our publisher, use PACT, they scanned everything for that. And like I said, from version one of the book, it was like, this is AI, I’m like,

Manoj Tandon (08:36.357)
when

Manoj Tandon (08:49.799)
it actually flags. But there was no AI in version one of the book. It wasn’t there in the open market.

Ken Underhill (08:52.246)
No, those are Ken’s words.

Ken Underhill (08:57.196)
No, yeah, no, no, exactly. Not at all. Yeah, that straight up can be in ghetto in that first version of the book. And I assure you, it still can be in ghetto in version two as

Manoj Tandon (09:05.951)
So Ken, let me ask you from the first edition to the second edition, what’s changed in these two years? Give us some highlights in the job interview. Yeah, well, don’t give it away, but give us the sound bites.

Ken Underhill (09:12.066)
Nah, dude, you’re have to read it. Well, yes, the high level stuff that I can, know, again, once we finished the book, I like blocked it out as a traumatic event. like the main, kind of the main things we did based on feedback on the first book is we added a couple more jobs, including what I call transition jobs, like,

I think we got product manager. I think we have a sales engineer. Some of those jobs that people out there right now listening that are like, want to get a cybersecurity job. They can get these types of jobs at a cybersecurity company and then work they’re way into that more technical sock analyst, pen tester, whatever that they ultimately want to do. So that was one thing we added is some more jobs. also kind of refresh a lot of the questions. The first version was written really

more for that, in my opinion, that more entry level consumer market. And some of the feedback we got was like, if I’m experienced, like these interview questions, like this is, you what’s the CIA triad? if I got 10 years in, unless I messed up the interview, I’m not gonna get like that question, right? Or unless they throw me a softball. So like we added some questions that are a little more kind of technical in some of the roles as well to try to capture, you know, what

you know, what people might actually face in the real world. Behavioral interview questions were, you know, originally, for lack of better words, I think that section was, you because I did some of that section, I think it was kind of ghetto and some of the answers and stuff. So like these are more, this version of it is more like if you’re like coming from like say a sales job or, you know, whatever kind of those transition jobs, like here’s how you might answer these different behavioral interview questions. There’s a lot more of them.

and there I think this time around. Look, I’ve got the book right next to me. I could look, I guess. The other thing in the last chapter of the book is what we call, I think, final thoughts or whatever. In there, the addition, at least from my end, is adding some additional places to look for jobs, for cybersecurity jobs. And I’ll just say those places here on the podcast for those that don’t have the money for the book or whatever, because they charge, the publisher charges.

Manoj Tandon (11:28.276)
Okay.

Ken Underhill (11:36.942)
I think it’s expensive for a book. It’s like 30, 40 bucks for a book. I’m like, I don’t, the only reason I buy copies is sign them for people and send them to them. Otherwise I wouldn’t like it’s out of my, you I don’t buy more than a $20 book on Amazon and I buy literally hundreds, not thousands of books. So the only reason I buy my own book is like, if someone’s like, can you, you know, like this copy here actually is going to someone in India. By the way, if you’re in India listening to this, no, I will not be sending you any more signed copies. It’s expensive as heck to send.

just a book to India, it’s ridiculous. And you can’t send it USPS. Yeah, it was published all over the world, right? But for me to sign it, which was, and I do it in rare cases. I’m not like, I know some people that’s like a side hustle, like they write a book, then they sign it and they, a few people have reached out. There are people that have given a lot of value over the years. So I’m like, all right, I’ll eat the, I don’t send it USPS cause you’ll never get it.

Manoj Tandon (12:08.017)
It’s not being published over there?

Manoj Tandon (12:15.169)
Ken Underhill (12:35.0)
People in the US understand how bad the post office is. Hopefully no one from the post office is listening to this, but I send it FedEx. And so it’s actually comparable pricing and it actually gets there. It takes a few weeks to get to India from the US. Most of that’s customs. They’re looking through, make sure I didn’t send you cocaine or whatever, but it is what it is. the main other thing of the book is adding, so you can go on Black Cat USA sponsor list, the company sponsor list.

Manoj Tandon (12:54.302)
not that you would ever do that.

Manoj Tandon (13:02.652)
huh.

Ken Underhill (13:03.466)
Look at those companies on the lower tier level of sponsorship. Look at they’re websites. A lot of times you could find open jobs that are never posted on LinkedIn, they’re not posted on Indeed or any of these other job boards because the companies are too small. They don’t have the staff to get 10,000 resumes and look through them. Another spot is venture capital firms, so they’re portfolio companies. Look at the venture capital website, look at the portfolio companies, even if they don’t have a job listed.

think about your skills and how you might be able to help one of those companies, then send an email if you can to the venture capital firm saying, hey, my name is Emily, I’m learning cybersecurity skills right now, here’s kind of my background of other things I’ve done, I’d love to see how I can help your portfolio companies, whether volunteer work just to gain some experience or if there’s a role open that someone thinks I might be a good fit for, I’d just love to talk to someone more about it.

you’re usually gonna get a response in some capacity. It might be like F off, but in most cases, they’re probably gonna have a call with you because you’re different than everybody else, right? Like everyone else is lazy. 100%, dude, 100%. Yeah, yeah, everyone else is on LinkedIn. Submit, submit, submit, and then they’re like, I can’t find a job for two years. Yeah, that’s why, right? It’s sales. It’s sales 101. I gotta do cold outreach. Like if I have a business and I just sit here in front of my computer, looking at my camera,

Manoj Tandon (14:03.603)
you’re actually being proactive, which is a very rare thing, right?

Ken Underhill (14:25.078)
Looking at the mirror like, I look good today. I’m never going to have business because I’m not marketing. not doing, you know, cold outreach to try to get clients. I’m just sitting here looking at my computer screen. I will never get a client. It’s just not going to happen. You know, I think, I think people when they’re looking for jobs these days, like back in the day, dude, like I had to go get the newspaper. I had to save up to get like the dollar 25 in quarters to go, you know, right to Sunday. You know what I’m talking about, man? Sunday edition.

Manoj Tandon (14:48.137)
Sunday edition.

Yeah.

Ken Underhill (14:52.45)
look at the job postings, and I had to reach out to all those places. I couldn’t submit my resume on a website that didn’t exist back then, really. I had to go to places, so that’s gas money, or I got to ride a bicycle, whatever, to get there, and then hope that I can get the actual interview or whatever. And then from there, nail the interview, stuff like that. This game is different, but it’s actually the same. There’s more tools out there.

You can, you know, it’s easier to just click like, apply on LinkedIn or Indeed or whatever. But if you really want to get the job, as you mentioned, you got to be proactive. You got to, you got to be a hustler. You got to, you know, you got to go out there and grind. But the people getting these jobs, especially ones without IT background that are trying to get into cybersecurity right away, which by the way, is not really an entry level career, but that whatever people are going to get mad at me saying that, but it’s not, it’s really not, it never has been.

Manoj Tandon (15:44.52)
Yeah.

Ken Underhill (15:49.006)
It’s just been easier traditionally in past to get those kind of entry-level jobs or what we call entry-level. But if you’re not proactive, you’re not going to be one those people getting those. You’re going to be… And by proactive, I’m not talking about becoming tri-hackney top 3 % or what. That’s not proactive, right? Yeah, that’s kind of part of building your personal brand in a way, but that’s not really proactive. Proactive is more that cold kind of sales outreach.

right, that finding these companies that maybe have open jobs or that are, you know, more willing to create a job for you, because the vast majority of the cybersecurity job market is not on LinkedIn. It’s not on Indeed. It’s not on, I’m going to call it different names like Dice, ZipRecruiter. I don’t know if people still use monster.com. There used to be a thing called a career builder. Like, you know, I’m not endorsing any of these sites by the way, like, but like,

Manoj Tandon (16:43.647)
Right.

Ken Underhill (16:47.822)
These places where everybody can find the job, you’re never going to hear back for an interview in 99.9 % of cases. So you gotta be proactive.

Manoj Tandon (16:57.759)
So let me ask you something there. A couple things. Ghost jobs.

Ken Underhill (17:04.546)
Yeah, I always want to like, I always want to dress like a ghost when I talk about this. Yeah. So, so ghost jobs. So, yeah. So, well, you know, and there’s really no way to navigate them, right? So for those that don’t know the term ghost jobs, that’s what I call it. I don’t know what others call it. You know, they call it stress, whatever. but basically a ghost job in my Ken’s definition, there’s probably a real definition, but my definition, basically a job requisition is created, but there’s no actual like funding, you know,

Manoj Tandon (17:09.959)
navigating those. Yeah.

Ken Underhill (17:34.338)
for the job, like it’s not a real job, right? So like you’ll see a job on LinkedIn, Indeed, know, whatever website, you’ll apply for it. You won’t hear jack shit and you’ll be like, it must be my resume. must be, you know, I gotta go pay some resume writer hundreds of dollars. You know, it must be the fact that, you know, this or that or whatever. Well, right, and so they, right, so the ghost jobs, a couple reasons say typically, again, this is all Ken’s opinion.

Manoj Tandon (17:52.061)
No, they’re just not hiring or it’s not real.

Ken Underhill (18:01.88)
somebody out there get upset, just know I don’t care if you get upset, that’s your problem. But one reason they do this, companies will do this is they wanna inflate they’re hiring visibility. So basically they might be going for like a funding round. So they want investors or potential investors to be like, look, you’re hiring a lot. So they create these requisitions with no actual dollars to fund them in the hopes that they’ll get funding at some point in the future to be able to fill these jobs.

So you see the job though, tomorrow on LinkedIn, you apply for it, you’re all excited. You’re already making plans in your head. I’m gonna get a bigger house and Ferrari and all this stuff. And you’re never gonna get that job. So that’s one reason they do it. Another reason they do it is they wanna see what kind of people apply for the job. So for example, let’s say they write a cybersecurity analyst job description. They put it out there and then they see like, okay, the vast majority of people that apply for this job have five years experience, they’ve got.

Sec Plus, CISA, they’ve got CISSP, insert whatever certification, right? They got college degrees, whatever. They’re just trying to get a baseline of what’s the market look like. And also, usually they’ve got a little field like what are your salary requirements? Because now they’re trying to figure out how low can we pay people, right? So if they ever create that real job in the future, can we get people for the lowest rate possible essentially, right? So it’s basically intelligence gathering at that point, right? Just trying to figure out how can we do this in the future.

Manoj Tandon (19:27.096)
Aren’t there a lot of data collection houses that already have that?

Ken Underhill (19:32.843)
There are, mean there are right, but like if I’m a company

And I, and number one, I’m going, I want to go for funding. I’m to put out the fake job. know, I don’t want to say it’s a fake job, right? But it’s, it’s a job requisition. So it’s actually created. And there could be a variety of reasons it’s not funded, but in many cases, it’s just created to inflate, you know, those numbers and kind of make them look good or to gather that Intel. And yes, there are, there’s, there’s a lot of companies out there that have, you know, salary data and, know, and data on what, you know, what kinds of people are applying for things.

what kinds of people are quote unquote high performers and things like that and kind of gathering those data things. But really, the biggest thing in my opinion that drives this is that, excuse me.

Excuse me one second, I’m gonna go on mute.

Manoj Tandon (20:23.647)
Are you okay? Grab a drink of water there, Ken.

Ken Underhill (20:29.762)
Talking too much shit. But basically, I think the revenue thing drives it, right? I think it’s trying to inflate the numbers. That’s the biggest thing I see driving it. I don’t have any data, but I would posit or suggest whatever the right word is. Some English major out there would know the right word. But I would suggest that at least 80 % of jobs you see posted are those ghost jobs, at least.

Manoj Tandon (20:31.335)
No

Ken Underhill (20:59.286)
And that’s why when you apply for jobs for these job boards or whatever, like LinkedIn, Indeed, whatever, you never hear back. It’s not usually your resume. And in many cases, it’s not the ATS system. It’s just simply that nobody’s looking. Nobody’s looking because there’s no legit job there for someone to hire for.

Manoj Tandon (21:21.887)
So now on that topic, let’s go a little deeper into a few things here. So first, you made a statement earlier about in the old days, you’d have to save up $1.25, and then you’d have to put a postage stamp on your resume. And that cost you money. And there was, do you think in that old system, first question, this is a three-parter, so I’ll just do it in pieces. First question is, you think

We were getting better candidates the old way than the mass generated email scan way of delivering these resumes.

Ken Underhill (22:04.002)
Well, think, so with that question, I think that with advances in technology, can’t, you know, we can’t do the old way. I don’t want to say we’re getting better candidates because I interviewed a bunch of, you know, douchebags, even, you know, even back then for things. like, I just think that the, the barrier to entry was higher to where like someone, you know, I’ll just pick on India, you know, cause I’ve got a lot of friends there. Like where, like if I’m a U S employer,

I wouldn’t have 10,000 resumes from people all over the world that are looking for visa sponsorship, which in my job description, I’m not even saying I do. So don’t have like all these like kind of unqualified resumes to look through back then, but I still had them, know, but like just the volume, the sheer volume, I think is higher these days. So we have to leverage, you know, the technology. I don’t think there’s a good fix, man. Like, I don’t know that’s the next part of your question, but I…

Manoj Tandon (22:54.367)
That’s right.

Manoj Tandon (22:59.601)
Well, this is exactly where we’re going. You’re already preempting it. So now you ruined the movie. There you go.

Ken Underhill (23:07.182)
Yeah, so I mean, everyone wants like this simple solution, right? That staples easy button or that thing that vendors promise you at a conference just, yeah, just integrate our solution for $2 million and it’ll fix everything. And then you pull it in and it fucks up your whole network. And I won’t name names, but you all know who you are. But I think, yeah, leveraging tech.

I think writing better job descriptions of like what exactly is needed. And I’ll give an example of that. I had this hiring manager reach out. I won’t say the name of the company. This was maybe a year or two ago, something like that. And they’re like, hey, you know anyone good for this role I’ve got? And so I looked at the role and I mean, was a dude, it’s a wishlist. I’m like, you want someone with Splunk, QRadar radar, you you want it to be an expert in, I I don’t remember exactly the tech stack, but I’m like, know, CrowdStrike Falcon.

or whatever EDR, they’re like, you want a unicorn for this entry level job? I was like, what exactly do you need? Like what, like if you had to pick one skill that this person came in with and then you trained them on everything else, what is that? And he’s like, Linux, I want them to have, you know, some background as a Linux sysadmin, right? So some skillset configuring and securing Linux servers. That was nowhere in that job description, dude. Like nowhere.

Nothing about Linux, nothing about like it was all this other BS, right? So I think, I think the main thing, honestly, and I know others have spoken on this. I think the main thing is we really need for these job descriptions, like what, what’s like the bare minimum that I as a hiring manager need someone to have coming into this role. And let’s put that out there, right? Let’s not put this wishlist because what we do with that is we take, you know, people of color, other disadvantaged individuals, and they don’t apply for these jobs, especially women.

because they don’t feel they’re 100 % qualified for what’s in the JD. And none of that in the JD is what we really need, right? If we use that as an example, and that was a big tech company that was doing that, right? This isn’t some small startup that’s confused on what the, this is a mature organization where what the hiring manager wanted was nowhere in that job description. So I think if we had to fix something, if we, as an industry, put our efforts on something,

Ken Underhill (25:28.846)
let’s focus on that stuff first. Let’s come to a consensus on what are the key skills that a job title as a cybersecurity analyst needs. Because we see, analyst at one place is 100 % different. You see a job description, you’re like, no, that’s engineer skills. Or you see the job description for a pen tester, and you’re like, well, no, they’re just looking for someone that can do some basic vulnerability scanning. It’s not like an actual pen tester they’re looking for.

We as an industry, we’ve like let this crap balloon out, right? Like, I don’t want to say that when we did newspaper stuff that that was any better, but you had a small amount of space in that newspaper to advertise as an employer. And you had to put like the couple of key things that you were really looking for. And, know, and, and again, I’m not saying the talent pool is better. Like I said, there was a lot of douchebags back then too, applying for things they weren’t qualified for, but.

You had to you know be more specific and I think we’ve gotten away from that with a job board where you know where we can put You know, I don’t even know what they’re Yeah, we can have like an eight page job description of our wishlist and it you know But that’s not what we really need

Manoj Tandon (26:33.577)
some crazy years.

Manoj Tandon (26:41.543)
So let’s get to that as well. I think one of the things that made cybersecurity such an interesting place, and this is my opinion, was the fact that you didn’t have one type of candidate. You didn’t have your typical computer science guy with a four-year degree, a technical background, and they went into cybersecurity. You had a lot of diversity.

from which people came into this industry. And that brought a lot of diversity of thought. And I think that is absolutely needed when you’re looking at building a defense in depth approach and you’re trying to build a system against a group of people who the hacking community has not also typically a computer science group. Those guys came from all over the place. they’re common thread, they’re ultra creative.

and they’re super motivated. It has nothing to do with a security plus, a network plus, CompTIA, whatever, whatever, whatever. I don’t think any of those guys in fact have any of those qualifications, but there are still geniuses at what they’re doing. The creative element is there. Not that I’m saying that what they’re doing is right, but…

You gotta admire the fact that you have a bunch of people who are beating the run of the mill crowd, you know, who are putting creativity to the test. So are we not doing a disservice by closing down our hiring to this meritocracy based environment and eliminating the possibility of people like we had before that could enter into our community from

maybe non-technical fields, but brought a huge thought advantage that we normally would not get just by having certain certifications.

Ken Underhill (28:46.752)
Yeah, so I think of an extremely complex issue that is way outside of what we can accomplish on this podcast. But some thoughts around it is, mean, there’s people that, psychology degrees, mean, there’s a woman that she used to sell like swimming pools, and she’s one of the top people in GRC these days. So like I…

Manoj Tandon (29:05.343)
There’s human factors people that I’ve seen.

Ken Underhill (29:16.706)
I think our main issue, right, is, for lack of better words, I’m going to say the bad guys, right? But I think that here in the US, we’re very spoiled and we don’t understand. A lot of people, they think of, know, someone’s doing malicious hacking, they don’t understand that in a lot of other places around the world, they don’t have capitalism. So they don’t have the economic opportunity we have in the US, right? And I say they’re not spoiled and I’m not.

As someone that’s come from extreme poverty and like not having food in many cases growing up and stuff like that, I’m speaking on this. I didn’t have that privilege of some people. And so what I think that here in the US, we forget that in other places, in a lot of cases, this is the only way for them to make any money to feed they’re families. And I’m not saying that’s all of them. I mean, there’s definitely…

that organized crime element that’s solely focused on profiting the organization. But when we think about the lower tier people, there’s a lot of complexity in that of when we say a bad guy.

you know, where are you in the world? Right. Because U.S. hacks, you know, other countries and stuff. like, we’re the bad guy there. But like here it’s like, yeah, go U.S. Right. So like, we’re not going to dive into that really in the pocket. But I just want like people to kind of think like outside the box a little bit on that regard of like when we’re talking about the opposing parties, it’s very complex of why people do the things that they do. But when we’re talking about. Well, no, 100 percent.

Manoj Tandon (30:47.793)
Absolutely. Money though is a big motivator though. I mean you see a lot of the guys

Ken Underhill (30:55.182)
But that’s what, look, dude, money is the biggest motivator for people trying to get into cybersecurity, right? Like they’ll sit there and tell you like, I want to save the world and hug teddy bears. And the reality is they want to make more money, right? Like they see all these education programs like, you’re going to make six figures or these idiots with they’re coaching program. You’re going to make six figures. I did a post the other day. You’re going make six figures in 90 days with no IT background, just by my coaching program for 10 or 20 grand.

Manoj Tandon (31:22.291)
No way.

Ken Underhill (31:23.022)
No, exactly, dude. It never happens, right? Never. And you can look on, so if people don’t believe me on that, just search on YouTube in comments of those people’s videos of people like, I bought your program. I didn’t get a job. You know, I’m still waiting two years later. So like, you know, we, I forget where I was going there, but here, some of the challenges we have on the right side, you know, if you want, I’m putting that in quotes, if you can’t see my fingers, if you’re listening, we follow the law, right?

Manoj Tandon (31:47.144)
Yep.

Ken Underhill (31:53.026)
Hopefully not, not if you’re Boeing and you’re assassinating your employees. Anyways, whole other conversation. We’re getting all sorts of hate mail off that one. They’ll be like, if I start seeing random people in my neighborhood, they don’t recognize them. Like, yep, someone from Boeing heard that. our challenge is right, we’re following the law. So basically we’ve got a challenge of like where…

Manoj Tandon (31:59.168)
Now we’re gonna get hay mail. Now we’re getting hay mail.

Manoj Tandon (32:10.289)
and

Ken Underhill (32:18.05)
We’ve got to follow the rules. We’ve also got a challenge of like, how can we, with so many candidates, how can we have some kind of measurable thing to like measure against to see like, is there kind of a bare minimum, right? And that’s where we, you know, traditionally it’s been certifications, which for someone that grew up poor like me, like I didn’t have certs till I was in for a long time, Same with college degrees.

Manoj Tandon (32:38.961)
I going say it would disqualify a whole bunch of people, here’s the thing.

Ken Underhill (32:42.03)
No, and it does, you know, but so like, think, I think when we talk about job descriptions, I’m not talking about keep listing search. think that’s, I think that’s wrong. I, well, I think, I think it’s, yeah, it’s nice to like, Hey, you got this knowledge, but I think it’s wrong because it’s, it’s, it’s a blocker, right? I think college degrees are a blocker. think we should never be asking for that because a lot of people don’t, they don’t have that money. Like if you’re going to pay for it, great. Yeah, whatever you want, you want me to have a PhD, pay for it. Right.

But if you’re not, if I got to pay out of pocket, if I grew up poor, I don’t have that money. I mean, yeah, I can get scholarships, whatever, like, dude, back when I was growing up, I mean, yeah, there were scholarships, but I didn’t know that. the information wasn’t there, right? It wasn’t like my high school career counselor was useless on that. I don’t remember his name either, but I’ll still tell him he’s useless to his face. Right, exactly, right? Like that information wasn’t there. And yeah, it’s better these days, but still, you know, like.

Manoj Tandon (33:29.309)
That’s how useful he was.

Ken Underhill (33:38.19)
I think for me personally, I think a job description, like I mentioned with that one about the Linux experience, excuse me, I think that as a hiring manager, whoever’s writing that job description, you need to come up with like a top three, absolute top three to five of like actual skills or think outside the box of like transferable skills, like, okay, I really need them to have good communication skills, right? Or I really need them to have good EQ or whatever.

That’s what a job description should be, right? It shouldn’t be about certs, you know, and again, I understand certain contracts will have certain requirements of the people coming in need to have, you know, this or that. I get that, but what I’m talking about here is I’m talking about more broader perspective of the industry because the vast majority of contracts and things, they don’t require a cert. They don’t require a college degree. They don’t.

Manoj Tandon (34:31.635)
Well, look at our three letter agencies that are recruiting out of high schools. Those kids don’t have certs and they’re going to some of the most prestigious agencies in the world in a…

Ken Underhill (34:38.496)
Ryan Witten.

Ken Underhill (34:43.254)
Well, know, mean, those, but you know, those places, they have to recruit out of high school because they don’t pay a lot. Right. Because once someone gets that experience and they get the clearance, like, Hey, I’m going private sector making like triple, you know, what I was making. but no, hundred percent, dude. And I, and I think that, you know, we’ve, we’ve tried it. In my opinion, we’ve tried it the certain degree way. Right. We’ve been doing that for, you know, 15, 20 years at least.

Manoj Tandon (34:54.183)
Yeah, but they still don’t have the cert when they got in.

Ken Underhill (35:09.076)
let’s try this other way. Let’s try Ken’s idea here of like, let’s actually look at the job that we have open. Let’s say what are the, you know, and let’s even work with, you know, the other team members are going to be working with this person. Like what, if we came together and we pulled together a list of three to five, not just technical skills, but I’m talking about soft skills as well. Cause someone coming from a background at McDonald’s probably ain’t going to have that tech, you know, they may have try hacking or whatever, but they, they’re not going to have that technical skill set usually as far as experience and stuff. like instead of us,

gatekeeping like we always do in this industry, which is a lot of BS, let’s instead come up with that three to five bullets of our absolute top combined technical and soft skills. Should be at least three skills on that list. Let’s say five bullet skills. Three of those need to be the top soft skills that someone absolutely needs to have. And then a couple of, know, like we really want someone to have these technical skills. Now,

If you wanna go crazy and you got extra time, then you can say like, here’s the 10 nice to haves. Like if they had these, we’d be like, yeah, that’s the one for us. The other thing I think we need to do, and many orgs already do this, is I think we need to sanitize. When we put a resume in front of someone, we need to sanitize the data off that. And what I mean by that is I’m not talking about the experiences, I’m talking about the name. Because I’ve done testing on my own with fake resumes.

And I’ve had Lily White sounding names like Preston and stuff like that. And I’ve had more diverse names with the exact, like literally the exact same work experience listed, the exact same certifications, everything else. It’s the exact same resume, just the names changed. And the diverse names, nothing, right? Like in most cases, and again, this is a Ken statistic. just, I don’t remember exactly what it was, but probably at least like 70, 80 % of the time.

the little lily white sounding name like a Preston or, you know, Stacy or whatever that would get a response like, Hey, you know, sometimes it was a rejection, but it would get a response of like, either we want to move, you know, we want to interview or, whatever. vast majority of the time. Well, and I would say like, maybe like, I don’t know, man, it’s been a while since it’s been years since I did this, but like 10, 15 % of the time, if it was like, you know, if it’s not, if the name was like Tomiko or something.

Manoj Tandon (37:05.982)
Yeah.

Manoj Tandon (37:29.811)
Right.

Ken Underhill (37:30.318)
That’s when they would get, know, like 10, 15 % of the time there’d be a response, you know, and most of them were rejections. Again, I’m not saying that’s every org, but I I applied, I was like, God, I did that experiment like, that was probably like three, four years ago. It was before, it was before the C word. We can’t see the C word because social media might block us, you know, on the podcast. But I just did that and I only sent out, it’s maybe like, I think I put together like 15, 20, you know,

Manoj Tandon (37:49.471)
Right.

Ken Underhill (37:58.39)
fake resumes with fake names, you know, but it was like, it was literally just changing names. just coming up with names off the top of my head and sending them out there and seeing, you know, what happened. And I was applying at big companies. was applying to small companies, just trying to see, you know, what, you know, what’s what type of thing. Some of the names were my sock puppet accounts. I’m not going to, obviously not going to say those names at all. But I think that, you know, I see on social media, some people are like, we don’t have an issue of diversity anymore. We do.

Right, and I think what we’re talking about here, these barriers, we need to get rid of those, but also like the barriers of if someone’s got a different name, that’s, know, like AI is biased. Like, I’m sorry, you know, there’s…

Manoj Tandon (38:40.115)
Well, it’s going to be biased by the people who program.

Ken Underhill (38:43.118)
No, right. know, funny, funny. Well, not not a funny thing, horrible thing. But I was Adobe came out with Genitrivi. That was last year maybe. And like you could do images or whatever. And so they were all excited about it, whatever. So I tested it and I was just trying to get it, just trying to get a photo because my wife’s black. I was just trying to get a photo of a white guy and a black woman together as a married couple.

Dude, no. It was giving me black and black and white and white. And then it gave me Hispanic and Hispanic. I’m like, black woman, white male. And I tried to give it hair colors. It was totally biased, dude. And so I sent them a message. And I’m like, this is what they did. And kudos. I don’t know if they ever fixed the issue. But they at least responded, no. We’re so sorry. And we’re going to send this information to our developers. And who knows what happened there.

Manoj Tandon (39:09.765)
It’s struggled.

Ken Underhill (39:38.754)
When we, mean, other people have done experiments like this, you know, with Genetrave AI and, you know, it’s going to be biased based on who, you know, designed it, which in a lot of cases is, you know, not me, because I suck at software engineering, dude. Do not, like, if you need something coded, I’m not your dude. I’m not your dude. I will mess it up. Again, that goes back to the slow typing, you know, the two fingers, you know, whatever like that. So, but I think, you know, to your question, I think it’s such a complex issue.

Manoj Tandon (39:50.824)
Yeah.

You don’t want anything done. You’re not your guy

Manoj Tandon (40:01.139)
Ha ha ha!

Ken Underhill (40:06.87)
I think if we start with those job descriptions though, if we look at what someone really needs and we also look at the soft skills and pick like our top ones of that, I think we still keep the diversity coming in because we absolutely need that. Some of the most brilliant minds in cybersecurity right now and in the past that I’ve met are people that have those non-IT backgrounds. And when they think through a problem, it’s just amazing.

at least for me, it’s just been amazing watching them work through a problem based on, you know, whatever. Let’s say they, you know, mowed lawns, or did landscaping or whatever for a living. Like just seeing them think through a problem set a different way. It’s like, my God, I never would have thought about, you know, that solution.

Manoj Tandon (40:54.897)
And that’s what made our industry so cool. It was that diverse.

Ken Underhill (40:57.91)
Right. that’s what I mean. And let’s just, know, for those listening, you know, that are maybe newer, like we’re not saying that, I mean, we’ve still got a huge problem with cybersecurity of diversity, right? Like it’s still a very male dominated field. It’s very, I think what, maybe, maybe a quarter of the industry’s women and even smaller that as women of color. So we, we still got a huge way to go. That all being said, you know, when, people think about diversity, you know, we

Traditionally, they’ll think about women or, you other races and not, you know, not a white male. But when we talk about diversity of thought, it’s not always that. Yes, we need, you know, we need to focus, especially getting more women in and however you gender identify, right? We’re talking binary on this podcast, but like, just understand however you gender identify, we totally love and appreciate you. And we’re not, generalizing to keep things simpler in how we discuss these conversations and answer questions, but like,

Manoj Tandon (41:56.531)
Well, you really don’t want to get hate mail.

Ken Underhill (41:56.822)
It’s applicable to. Well, you I mean, you can hit on me all you want to. I’ve got friends, you know, like I don’t care. I’ve got friends that are across the gamut and I would literally, you know, you know, give my life, you know, maybe not take a bullet for y’all. Like I love y’all, but like, you know, that getting shot hurts. But, you know, but like I would stand up, you know, I would defend you, you know, like I’m not going to let someone mess with you essentially. Right. You know, so like you’re everyone’s welcome is kind of what I’m getting at. But like, I just want to put that out there. Like when we talk about.

Manoj Tandon (42:12.415)
Ken Underhill (42:25.262)
male, female, we’re talking about him and her, we’re not talking about, if you’ve got different pronouns or if you’ve got, if you’ve got multisexuality or however you gender identify, whatever it is, right? Whatever you use to describe you as a person that’s amazing that we wanna work with. I just wanna put that out there. We’re not, we’re just being general again to keep kind of our answer simple. So, cause I talk a lot anyways, like we’re coming up, I think I’m maybe an hour of, or whatever feeling there.

Manoj Tandon (42:52.325)
Yeah, we’ve got five minutes left.

Ken Underhill (42:55.66)
Do we really? crap, I knew I was talking too much.

Manoj Tandon (42:58.055)
Well, let me say something on this thing. know, was just yesterday, Apple News actually had a statistic on it, or it was an article I read on Apple News, that most people who get fired, they get fired in the first 18 months of employment. Of those getting fired, only 11 % get fired because they didn’t live up to a technical expectation.

89 % of the people get fired because they have lacking or misrepresentative or dysfunctional soft skills of some kind. Whether they can’t participate in the team or they’re abrasive or they don’t know how to write, they can’t communicate. But that’s for everyone listening, that’s a, that’s, and hiring,

That should be pause for thinking. That’s a big thing that 89 % of the people get let go because of soft skills, which means, as you’re saying, if we’re going to put five things down, put three that are solid soft skills and pick maybe one or two that are the technical, because they’re in reality the technical you can train to a large degree.

Ken Underhill (44:20.27)
Yeah, I was gonna say, dude, I can train anyone on technical. there was a woman years ago, I trained her and she was probably, she had no technical, she hadn’t even used a computer in years. And like in the first week of, you know, kind of mentorship slash training, she was hacking things at like maybe a three to four year pentester level, right? Like anything technical can be trained. I can do it, I can do it myself. I can have, you know, other team members sit with you. I can send you to paid training, like, you know, your splunks or whatever the world.

There’s a million ways I can train you technical college classes. mean, try hack me, hack the box, whatever the security blue team. I feel like I’m doing free marketing for these places all of a sudden. like technical skills, 100%. Soft skills for the most part are built by life. And so like, if you have been spoiled rotten by your parents your whole life, and they’re always getting you out of trouble, stuff like that, when you come into corporate,

and you’re used to getting your way, there’s that reality check, right? You’re gonna probably let go pretty quickly, because you’re not a team player usually. So soft skills for the most part are built by life. Now you may be saying, well, Ken, I wasn’t really poor like you, I had a safe home, I didn’t get beat every day, all these things. So how do I develop these, right? You could do that through courses, but also just…

going out and interacting with humans. Like I’m a huge introvert. I know it seems weird when you see me in these podcasts, you’re like, he’s a total expert or whatever. Dude, I try to hide. Like if I go to a conference, I’m trying to hide in the corner or something, you know, cause I’m just an introvert by nature. And I’m just like, my God, all these people, what’s going on, right? So to build your soft skills, can, you know, do courses, things like that, you know, if you need to work on those. I will say that the easiest two ways not to get fired. And this is like,

Manoj Tandon (45:53.437)
No way.

Ken Underhill (46:18.338)
other people I’ve mentored or most of them, I just tell them this. Like this is all I did when I worked in corporate. That’s all I focused on. Here’s a secret, super secret. Get your pen, paper, your phone notes, whatever. Here you go. Make your boss’s life easier and make they’re boss’s life easier. And depending on your bosses, you have to like just go ask him like, Hey, Minaj, like what’s, you know, what’s a couple of things I can take off your plate in the next few months to make your life easier. He’s going to figure out something.

He doesn’t want to do as much work, right? So like, he’s going be like, all right, you know what, what can I, you know, and that’s also a great question for an interview. Like when I start this job in the first couple of months, like what are some things I can take off your plate to make your life easier? Right. And then you want to figure out who your boss’s boss is and have a meeting with them at some point once you’re hired and then ask them that it’s like, Hey, you know, I want to, I want to grow as a leader in this organization. So as you kind of think about me, maybe over the next, you know, six months or year,

Is there anything that I can help you with? Anything I can do to make your life easier, et cetera? When you do it like that, I’m not gonna say you’ll never get laid off, but you’re usually one of very last people. You’re definitely, it’s rare that you would get fired. You really have to screw up. I’ll give you an example real quick. I worked at this place in corporate. I never had an official performance review, like how I would have to go into a meeting and sit there and they…

They just did them and gave me like top ratings every time and got me the top, you know, pay range every single time. I, in fact, when I left there, I was like, you know, you know, doing the exit interview, I’m like, I never, I was like one thing that I, I was like, I never had a performance review. So I never knew like if I was doing, you know, good or not. They’re like, yeah, that’s what I learned. They’re like, yeah, we were just, you know, giving you top ratings and you know, whatever, because you made our lives easier. And that was my boss and you know, and they’re boss that I was talking to. So this, it works.

That’s the easiest way not to get fired, dude. Like, figure out how you can make they’re lives easier. That’s the top.

Manoj Tandon (48:18.687)
There’s some real usable advice. Now, unfortunately, we are at the hour and we haven’t even, but I want to give you the last minute. What do you want to plug here, Ken?

Ken Underhill (48:28.523)
yeah.

Ken Underhill (48:34.862)
Well, mean, you know, I, you know, I should come up with a coaching program, right? And promise people, you know, 90 days, you’re going to make six figures. I mean, I think that, I’ll plug actually organizations like, breaking barriers, women in cyber security or BWIC where I sit on they’re advisory board, great organization. If you’re a woman in cyber security or trying to get into cybersecurity, men too, but mostly it’s a safe place for women. I’ll plug a women’s society of cyber Jitsu. So Mary Galloway, many people know her. She’s.

Manoj Tandon (48:40.744)
Yeah.

Ken Underhill (49:04.058)
the CEO over there, phenomenal individual. Of course, I’ll plug people like Tia Hopkins. I’ll plug minorities in cybersecurity. For those that don’t know about that organization, Mary Cheney, who’s a privacy attorney who will sue you because she’s an attorney, but she doesn’t like you. That’s a great organization. They have a conference every year. I think next year it’s in March, usually in March in the Dallas, Texas area. So if you’re in the US, you want to go to that.

Manoj Tandon (49:18.589)
Hahaha

Ken Underhill (49:31.786)
It’s a more kind of intimate conference, great place to network, you know, with like-minded people. And then the last one is going to be Black Girls Hack, which I also do some volunteer work with. Just, there’s just a lot of great organizations. I think that when we talk about networking, people always think about networking on social media. But I think that the lesson here is there’s a lot of great organizations, depending on who you are and your interests, get plugged into those because that oftentimes can lead to a lot of jobs as well. So for me personally, I guess, you know, just plug in the book.

know, buy a copy if you want to off Amazon. Well, so it’s already out on Amazon, the second edition. It’s like weird, like they do, they put it as a separate listing instead of just like updating the whatever. I don’t know why they did that. There’s probably a reason. So you actually have to look for the second edition of the book, but it will be the one that says like international bestseller on the cover. It’s the same cover. Let me just show it real quick for those watching the video. It’s like the same black woman on the cover.

Manoj Tandon (50:02.449)
Let us know when it’s going to be out.

Manoj Tandon (50:29.257)
Got it.

Ken Underhill (50:30.19)
Which again we had to fight for like I don’t know why we have to fight for that every single time but Is what it is? But you know this version has international bestseller on the cover because the first version was an international bestseller Hopefully this one is too. Let’s you know, we’ll see what happens. But yeah

Manoj Tandon (50:46.077)
That’s awesome. Well, Ken, you do good work and you know what? Unfortunately, we’re out of time, but don’t take two years to come back.

Ken Underhill (50:55.394)
Yeah, well, mean, send me the invite anytime, man. We’ll book it for six hours next time and, you know, we’ll get, you know, we’ll just go crazy.

Manoj Tandon (50:59.931)
Yeah, we’ll do it then people just throw a lot of stuff at us like who does a six hour long podcast you guys my god people be like you guys are well, we get a lot more than hate mail Hey, well Ken, it’s a pleasure as always

Ken Underhill (51:06.869)
my goodness, can you imagine the hate mail from a six hour one dude? goodness.

Ken Underhill (51:13.435)
all sorts of things. We probably got some bomb threats called into us. Who knows what? People are weird these days.

Yeah, pleasure’s mine, man. Thanks for having me. I appreciate it.

Manoj Tandon (51:24.889)
Absolutely, absolutely. Thank you again. Take care.