Security Confidential S20 E2 Dr. Blake Curtis

Manoj Tandon: Hello everyone, this is your host, Manoj Tandon. Welcome to another episode of Dark Rhiino Security’s Security Confidential. We have another phenomenal guest, but before I announce him, you guys have to hit the like and subscribe button because the algorithm is telling us that you watch, but you are not hitting the darn button. So just smash that button. Show us a little bit of love. It allows us to keep bringing you this content, and we all deeply appreciate it. Without further delay, let me introduce you to Dr. Blake Curtis. He is a very interesting person. He is a cybersecurity governance leader, research scientist, author, and advisor. He specializes in AI governance, and we are going to get into what that means here in a minute. He is the author of ISACA’s CISM, 17th edition. Through his work across government, healthcare, commercial, and international organizations, Dr. Curtis has helped strengthen organizations with governance and develop more effective ways to identify and build cybersecurity talent. We are honored to have you, Blake. Thank you for being here.

Blake Curtis: Honored to be here. Thank you for the invite.

Manoj Tandon: We have to start with your origin story. Everybody wants to know how you got here because, in cybersecurity, everybody is from somewhere, and they are not all from the same somewhere.

Blake Curtis: That is definitely a good question. This is probably going to shock you, and you will definitely know the movie reference when I tell you about it, but I am from the deep, deep, deep Dirty South. I am from a place called Tishomingo, Mississippi. I was raised by my grandmother. It is a small town, so my story did not really begin with being exposed to a lot of technology or already having a career plan. It really began with a grandmother trying to raise a young child. She taught me that your character is really defined by your work ethic, to stay grateful, and no matter what room you are in, always be useful. After that, I liked breaking things, whether it was Power Wheels, TVs, or even old CRTs, which you should not be breaking apart because those things can kill you. I used to do that, and then I started out in desktop support. I was the person helping someone regain access and telling people to reboot their PCs. Later on, the day-to-day hardware started getting boring. I used to go to pawn shops, buy laptops, and build my own network together. That is what really got me into networking. I thought, “Okay, I really like this networking thing.” Then a show called Mr. Robot came out, and I got infatuated with it. It was all about ethical hacking, so I moved into incident response. I think I just got more and more curious as I got into it. Eventually, I moved into governance, risk, and compliance from a technical background. My reason for pivoting was that I was catching things a lot of other auditors were not catching. I would say, “Why are you accepting this particular artifact as a screenshot? It does not prove that.” I did that, then became a principal security architect and oversaw about $10 million worth of research grants. Then I thought, “Higher education is good, but I am a chaos junkie. What else can I do that is more difficult?” So I said, “Let’s go into healthcare.” I actually stepped out of leadership for a while. Then they said, “No, you build programs, so we want you to build this one. Can we just start with one member firm?” I said, “Sure, I’ll go ahead and do it.” I do not know why I said that, Manoj, because three months later they said, “Can you globalize it to all 33 geographies and 350,000 people?” Sure.

Manoj Tandon: Wow. From one person to 350,000, if that is not the switcheroo, what the heck is?

Blake Curtis: I thought, “Well, it looks like they are trying to get their money’s worth, so we will go ahead and do that.” I built that program, but then that turned into me being geographically distributed across multiple time zones. I was working 16 hours a day with people in India, Africa, Canada, and other places. I had just become a dad.

Manoj Tandon: Congratulations.

Blake Curtis: Thank you. I wanted to be present for my little girl, so I thought, “Let me go over to Amazon. I am sure it is not going to be as chaotic.” I do not know what I was thinking there either. As you can see, the pattern is that I follow chaos no matter what.

Manoj Tandon: Or create it. I think you like creating it. That is probably the fun part.

Blake Curtis: I think it is just that I do not like simple. I like things that get on everybody else’s nerves, and I like figuring them out and explaining them in a simple way. The last part of my story is that I went over to AWS. I built out what is called their AWS AI Governance Program. I was working with purple and red teams, and we were also supporting about 55,000 customer support agents. There, I was building mechanisms that were trying to detect risk at inference, not just outputs. That was interesting. Now I have done another switcheroo. I am in the financial industry, just trying to diversify my skill set.

Manoj Tandon: I will tell you, there are a couple of places I would love to go with that because there are parts of your background I did not have in your dossier. That is what makes this show fun. You hear something and think, “That is interesting. I have to ask a question about that.” First of all, when you ripped apart a CRT, were you able to do anything with the magnets that were in there? Those things had some pretty powerful magnets.

Blake Curtis: No. I did not know I was not supposed to be doing that at all. Touching the wrong components could send a serious shock through you. I did not know. The most I really did was take the back cover off, and I think I felt accomplished at that point because by then my grandmother caught what I was doing. She was basically like, “We do not have the insurance for that. You should probably stop.”

Manoj Tandon: I was curious because that is an electron accelerator, and I wondered whether you had done anything with it. The other thing is there is this notion that as people progress in their careers, they get higher and higher titles and then move into management. What your story described was a journey where that does not have to be true. You had teams and then said, “You know what, I am going to go back and get my doctoral degree, and I am going to step out of management for a second. Then I am going to go another route because that is where my passion is and what I want to do.” For our young listeners who want advice, is pursuing personal development mutually exclusive of pursuing a career goal? That is one question. And two, what is more meaningful, the personal development or a title in a company?

Blake Curtis: That is a beautifully articulated question. People are going to think we scripted that one. I would say, number one, they are not always mutually exclusive. I can say that because in other fields, sometimes you are going to have to take on roles that may not be directly relevant to what you ultimately want to do. But in IT and cybersecurity, it is a Pandora’s box. It is literally a playground because you are not as restricted by degrees, regulations, and things of that nature. That is both a good and bad thing. If you wanted to pivot and say, “I want to go do data science,” there is a track. There are certifications, courses, and labs. You can do that. You really cannot say the same thing about law or some other fields because there are blockers and gates. So if you are looking for somewhere with a little creative freedom, yes. To the second part of your question, is it better to follow your passion? If that passion is practical, yes, but we have to break that down. You still have to keep the lights on and pay the bills. About 19 years ago, I created a list of things I wanted to do. I wanted to break things, solve different problems, and become a better communicator. I would find roles that met those goals. I did not get so focused on whether it was a systems engineer or project manager title. It was about what the role did and what impact I could have. To me, the title really did not matter because, based on our other conversation, you are judged on your effectiveness and your output. You could be a CISO, CTO, whatever, but if you do not have the character, respect, and performance, that title is about as useful as a slogan from Burger King. It sounds great, but what are you actually moving?

Manoj Tandon: That brings us to the character question. You have managed teams in India, Africa, and other parts of the world, and you grew up in Mississippi. Those are very different cultural contexts. How do you deal with people who are in a completely different cultural context but are still working in cybersecurity?

Blake Curtis: There is a concept I use of base lining and not making assumptions about anybody. Just like when we first got on the phone call, a lot of the time we spoke, I was listening to tonality, preference, and how you communicated. Then I was using that to baseline what you were most likely to care about in the conversation or what I should avoid. For example, I should probably avoid using phrases like “I think” or “I do not know” because Manoj seems more evidence-driven. These are not skills I naturally had. I have always been a nerd. My soft skills were awful. So I would pick up books like The Art of Conversation or books on nonviolent communication to understand how you actually build connections. To me, the most valuable thing I could get from people from different cultures was perspective that I did not have here in America. I always knew that if I kept only this one perspective, I would have a very myopic viewpoint. I tied that to the idea that if I am taking time to actually listen, not just listening to respond, but listening and paraphrasing back to them, it always feels good when you know you are heard.

Manoj Tandon: Yes.

Blake Curtis: If you make someone feel heard and valued, you are actually giving them more than what they may get at home or even from friends. You have to look at that as creating a social 401(k). If you invest in these people, whether they are junior, senior, or managers, you do not know what that could compound into in the future for yourself. A lot of my success is because I contributed in some way, but I also made sure to reach out to people randomly and say, “I just thought about you. Are you working on something interesting?” That can lead to opportunity. People think you are just lucky, but you have some control over your own luck. You just need to be more curious, invest in the right people, and surround yourself with the right people too.

Manoj Tandon: That makes sense. Would you say there is more commonality across people than our perceived differences suggest because of these cultural divisions?

Blake Curtis: I would say there is more commonality in values. They are just articulated differently.

Manoj Tandon: That is exactly what I was looking for. I did not know I was looking for that, but that is what I was looking for. That is very true.

Blake Curtis: One thing I tell my wife and my boss is that I cannot assess or judge you against uncommunicative expectations. Literally every argument, conflict, or war exists because there were expectations and I just thought you should have known what they were. I did not take the time to confirm them with you. If someone feels hurt or left out, it may be because it seems weird to say, “Hey, when you communicate with me this way, do it like this. This is what I value.” You just never heard that. A lot of times when I diffuse conflict, if someone says something passive or something that does not sit right, instead of making a statement, I will ask, “Did you mean for that to sound like this?” or “What did you want me to feel from that?” It creates this weird meta-conversation between us, but it is also a vulnerable place where someone may stop and think, “I guess I need to think about what I am saying because it does have an impact.” Bringing that into the conversation has allowed me to understand different cultural perspectives and also become more amenable to change and less rigid in my thinking.

Manoj Tandon: That is brilliant. I lived for a stint in Tokyo, and that is a very polite culture. It is not that people do not disagree with each other. They absolutely do. But what I learned was that there is a very polite and roundabout way to state disagreement while still being respectful. That was a skill. As someone who grew up in Cleveland, I can tell you they do not work that way there. If you have a disagreement, it is pretty obvious there is a disagreement.

Blake Curtis: Same thing for Mississippi. If you ever hear someone say, “Bless his heart,” they are not saying that because they really care. They are saying, “He has a couple of screws loose.”

Manoj Tandon: That is exactly right. So transitioning to governance then, specifically AI governance, I am just going to say it on the air: I think it is an oxymoron. I do. Nobody knows what they are talking about in this thing. I have seen so many things change on a daily basis, and the behavior of LLMs is not even consistent. I can give you a list of experiments you can try, and you can absolutely break the boundaries these LLMs are supposed to be contained and governed by. So what is governance then? What does governance mean? Enlighten us, Blake.

Blake Curtis: If you think about it in layman’s terms, governance is setting a foundation for rules around what should and should not happen. The best analogy is how government is set up. There are things you should not exceed, and there are exceptions, like federal and state levels. If you come from a systems-engineering background, you can see similar behavior in Active Directory and organizational units. There is a parent domain, there are OUs, there is inheritance, and there is governance between them. The thing is that all of that is deterministic. The rules are set. They are not malleable. It is not highly conditional. With AI, you are trying to govern the very definition of unpredictability. It is not an excuse to avoid assurance, but if you look at traditional software, you give it the same input and you know what output to expect. When you look at AI systems behaving probabilistically, that result can change with a model version, the way you word the prompt, temperature, weights, context, and even your location or network settings. There are also concepts like caching, just like CDNs. For something to be effective, it wants to pull the closest response. You do not want a model hitting its CPUs from scratch every time. So it may pull cached responses. When you think about that, AI cannot rely on one successful demonstration. The way I approach governance and audit is to examine the system as a set of components, controls, and behavior distributions. You have to break it apart. Think about the input layer, the processing layer, which is usually the black box, and the output layer. That is as much visibility as we have.

Manoj Tandon: Give us the “how” in a way that we can all understand. Imagine we are high school students.

Blake Curtis: The first step is to define your purpose and boundary. What is the specific AI’s function? Do not just look at a frontier model like Gemini or Llama because those are generic. They are not tuned for a specific purpose. If you are going to use it for your organization, you usually do something like instruction tuning. You tailor it for your topic, area, or control. That is how you reduce a lot of unpredictability. So the first question is: what decision or task is that system supporting? The second thing is context. It cannot just be a generic tool. If it is designed for analysts, doctors may not be able to use it effectively. So you ask: who uses it, what data does it use, what systems is it connected to, and what is it integrated with? That determines context and risk. Then ask whether it can take action on its own or whether a human needs to remain in the loop. And finally, what happens if the output is wrong, biased, unsafe, or otherwise harmful? What I usually do is create something like a generative-AI threat model or life cycle map. I list all the things that can go wrong, then I start adding least-functionality principles. We do not need all these capabilities from the start. Let us build component by component. If we need more, then we can say, “You can have access to this asset for this limited session,” not across the whole environment. I then translate those risks into testable claims for executives in layman’s terms. I do not just say, “prompt injection.” I say, “Based on what your business is focused on this year, if you use this model and give it access to these things, you are going to put these business assets at risk.” My job in many situations is being the interpreter between the technical team and the executive team.

Manoj Tandon: Let us go to an example. Say I have an AI agent doing customer support. That seems to be everybody’s favorite use case right now. And by the way, if you offer a premium service, I can tell you, do not do this. But you are probably going to do it anyway because you do not care. That agent has access to our technical documentation. It has access to our rules that govern whatever business it is. If I am in a bank, it needs to know certain rules governing transactions or fraud detection. If it is healthcare, it needs rules around data disclosure, PII, and so on. I have to give it access to that. I may also have to give it access to some financial data: how much was your last order? Can you dispute this claim? For a host of reasons, I may need to give that agent access to sensitive data. Then I wrap that all in whatever your favorite technology tool is today and say we are going to isolate this agent as part of this group of agents. This group can only do A, B, and C, and beyond that, they are not allowed. They do not have role-based access to anything else. In a deterministic world, that works. But in a probabilistic world, drift happens. You already know where this question is going. That drift is not controllable. I have actually gotten systems to give me data they should not have. I asked a system, “Am I one of your top customers?” It looked and said, “Yes, you are a pretty good-sized customer.” Then I said, “Can you be more specific and tell me how my annual spend compares to other people’s annual spend?” Suddenly it spit out a list of the top 20 customers and their annual spend. I was like, “So that is who you work with.” I will not name the company, but this was their chat bot. It was beautiful because I did not have to convince a human being to give up the goods.

Blake Curtis: You just have to word it differently. One of my old bosses used to say, “I may not ask it how to make a Molotov cocktail. I will ask, ‘What are some things I should not do and what are the different ingredients?’” It will still give you the information.

Manoj Tandon: That is right. We are still going to get there, and it will even confirm it.

Blake Curtis: Exactly. You can use anti-behavior prompting. If you have malicious intent, you can frame it as, “I am afraid of this. What can I do to prevent myself or protect myself from it?” It gives you the steps. You deconstruct those steps, and now you still have a malicious payload. Going back to drift, a lot of people think drift is inherently bad. Drift is necessary. Drift is how the system stays malleable and learns. You do not want it to be static because then it would be dumb. Think about the human brain. Working memory and long-term memory chunk things that you know well so you have more working memory. That is similar to a context window. If you do not keep exposing yourself to the same task, you get worse at it. I used to be really good at basketball. Put a basketball in my hand now and I might look like a deer in headlights. LLMs work similarly. In order to optimize, they focus on the context that is necessary right now and start dropping things they do not need. But when you use AI to audit AI, your auditing tool itself will drift. So you have to evaluate whether the criteria you are assessing against is still at the same level. That means bench marking and checking every quarter. It is an ongoing job.

Manoj Tandon: So there is really no sure-shot way of stopping that kind of data loss?

Blake Curtis: Not right now. We are old school. We know the benefits of centralized management, and for a while AI stayed in that area. Now it does not. Everything is decentralized. There are open models. The attack surface goes from small local models to OpenAI, Claude, and coding agents with access to everything on the desktop. Think about that from a malicious actor’s perspective. I do not have to worry about pivoting as much. I need to focus on one area and exploit it. Most people are not going to be security-minded and apply concepts like least functionality and least privilege, which have almost gone out the window with the advent of AI. They are just going to click “allow every time” when they get a prompt, or they are going to turn protections off. We live in a world of convenience. When convenience goes against security, which one wins most of the time?

Manoj Tandon: Convenience always wins that fight.

Blake Curtis: Right. Even in national-security environments, a lot of the safety mechanisms we have are reactive. Think about both physical and digital controls. They are usually a reaction to something that happened. That primitive part of us is not very proactive. We have been in cyber a long time. We have been trying to get regulations and standards for basic cybersecurity for more than 20 years. Now the fact that AI scares people makes them say, “We should probably regulate it.”

Manoj Tandon: We have been trying to regulate human behavior, and that has not exactly worked either. Think about all the things that are illegal. Do people still do them?

Blake Curtis: Exactly. Think about what had to happen for those things to become illegal. People had to get hurt. Harm had to occur. That is a little late. I told my boss the concept is “implement first, think later.” I think AI is the best example of that. It is all fun, and everyone is looking at marketing capabilities. A lot of people are too concerned with whether it gets a brain of its own and becomes AGI. I say you need to be thinking about how some of the smartest and most malicious people could use it to advance their needs right now. AI-augmented malicious people are your immediate threat.

Manoj Tandon: And unlike a lot of people, those guys study the systems in detail and have a passion for finding a way to break them.

Blake Curtis: It is all they do.

Manoj Tandon: Exactly. And they will. Every human system created is flawed. It has to be because we are not perfect, so we cannot create perfection. Has anything really changed? Here is the context. Before AI, we had expert hackers and social engineers like Kevin Mitnick. If you read Ghost in the Wires, all he did was social-engineer his way into some very secure systems and do things that should not have been possible. Today, to a degree, we have replaced that personality with AI, but the outcome is still the same. We could not defend effectively against someone like Kevin Mitnick when he was operating. Unfortunately, he is no longer with us, but it stands to reason: will we really be able to defend effectively against these AIs?

Blake Curtis: If the paradigm stays within infrastructure, technology, connections, and so forth, I do think you can build a robust enough mechanism, framework, and maybe even regulation to put controls in place. You are going to have to zero-trust everything. You are going to need a kill switch. You can do that. What I do not think is possible is removing the psychological component. Think about how penetration testing works today. You do ping sweeps, map the environment, figure out what applications are running, identify the attack surface, and then start running malicious code. What would that look like against human beings who have access to social media, who post everything, who need validation, and who share communications, banking information, or whatever else? OSINT has turned into a psychological tool where I do not even need to focus on your data. I need to focus on you. I can take behavioral books and feed them to an LLM and ask, “What is his body language saying? What is his blink rate? Is he lying to me? What is in his background? Put that together based on time and place. Let’s build a malicious payload.” If I know who he hangs around with, I can introduce myself and get access that way. That level of expertise used to be held by a select few, people who studied advanced behavior techniques. The fact that we now have access to those resources, books, and courses means you can train an LLM to help you get there faster. You could even build a social-media farm that automatically scans for disagreement and reformats or suppresses certain content. To me, the tools themselves have become some of the most malicious enablers we have. I do not think most wars are going to be physical. It is going to be, “How can I psychologically break you down and get you to the point where you question your own self-efficacy?” When people are scared of AI, they are looking at it too autonomously. You need to look at how technology already impacts you today from a social-media perspective. How often are you on your phone? What would that look like at 10x scale, and what could people do with that? Coming from a psychology and cyberpsychology background, I look at it from that angle because those are the most dangerous vectors to me. It is not just about getting your bank account. It is about whether I can impact you as a human. That is another form of hacking.

Manoj Tandon: That is the most effective form of hacking, and it has the most devastating outcomes. If you hack that successfully, you can really change a society. You can have a dramatic impact on whatever you are trying to influence. Which brings us to education. How do you educate people so they understand this? We are living in a society that is very answer-driven. Kids grow up on multiple-choice tests. It is all about the answers, Blake. It is not about the process of how you get to those answers. How do you actually get people to understand exactly what you just described, that they may be getting played psychologically?

Blake Curtis: I think it goes back even more fundamentally, not just to AI, but to learning, experience, and what people think expertise is. Somebody was talking about the 10,000-hour rule from Malcolm Gladwell. I said, “Here is the thing. That was basically someone who writes articles misinterpreting the original research by Anders Ericsson.” It was not even a quantitative study. It was largely self-reported. What Ericsson was getting at is that expertise is not because you lived longer or spent more time in a seat. It is because of the quality of the tasks you performed. You can see people who played basketball for 20 years and are no better at it because expertise requires reflection, coaching, and deliberate improvement. People push against that notion because the whole years-of-experience fallacy supports our livelihoods. If you tell me, “You now have to re-perform these things because you have not automatically earned your seat,” that feels like a threat to how you support your family. But that is already in play with surgeons and other inherently risky fields because it is life or death. People do not understand that the work we do also supports nearly every industry and technology out there. So when you talk about learning, I do not want people focusing on “I need to spend X amount of time learning this.” I want them thinking about the situation. This is where you can actually use AI to support yourself. Look at a job description and ask AI, “What do I need to learn to do this?” Come up with a list of tasks, knowledge, and skills. Knowledge is book knowledge. Ninety-eight percent of people sound really good behind a keyboard until you put them on camera because a lot of it is AI-generated. Skill is what can you actually do, and at what level for that job? Competency is whether what you can do in this industry transfers to another context. You may be an all-county basketball player in high school, but that does not even get you on the bench in the NBA. None of those things are based on time. Yet we still have job descriptions saying they require X amount of years of experience, including for technologies that have barely existed that long.

Manoj Tandon: Some of those job descriptions are ridiculous. They say they need ten years of experience in a technology that has not even been around for ten years. Who put that description together? Do you even want to work for a company that cannot put together a competent job description?

Blake Curtis: It is weird. If you were going to make a competent job description, it should read like a description of successful work, what you are expected to do in the first 30, 60, and 90 days, rather than an age requirement. When a job says five or ten years of experience, it is basically saying, “You just need to have lived long enough.” That does not sound equitable. Instead of saying, “Must have seven years of cloud security experience,” you could say, “Within the first 90 days, you will independently assess the security of cloud workloads in Azure and GCP. You will focus on identity and access management, validate logging, and produce findings.” You want the job description to be about tasks and outcomes, not aspirations. That would also drive the interview. It would no longer be “I feel good because you talked to me well.” If every resume and every interview response was mapped against those task and outcome expectations, you could quantitatively say, “He went into depth here. He led this. He produced this outcome.” Today, it is often, “I felt really good. He seems like a team player.” Based on what criteria? If you do not have consistent criteria, such as the NIST NICE Framework or SFIA, then you are subjectively defining what expertise looks like in your company. That does not mean it is transferable. This goes back to the broader IT and cybersecurity field. It shows we are not really a regulated profession. Doctors and scientists have to demonstrate a minimum level of competency. Doctors get their degree, but they still have to do rotations, shadowing, and residency.

Manoj Tandon: They have to do residency, get board certification, and keep up with continuing education on a regular basis.

Blake Curtis: Exactly, and they need that to keep a license to practice. We have certifications that are voluntary. Even my barber has a license to practice. I remember finding that out and saying, “You need a license to cut hair?” He said, “Yeah, apparently there is risk with it.” It is interesting how we look at experience. If we keep going down the current path, we will disadvantage people who have not been exposed to the IT field. That includes Hispanic women, African Americans, older people trying to get into the field, and others who face ageism or access barriers. If you focus on years of experience, you automatically exclude a lot of people instead of focusing on what they can actually produce.

Manoj Tandon: So experience is a false god.

Blake Curtis: I think what we have been calling experience is really exposure. It is how long you sat in a seat and were exposed to the technology. It does not tell you at what level you performed, what the output was, or what you did for the company.

Manoj Tandon: Transitioning to a job interview or job description that is more outcome-focused is going to be work, Blake. That is not going to fit very neatly into the automated resume-review systems that are out there.

Blake Curtis: ATS, yes. The killer of all souls, hopes, and dreams.

Manoj Tandon: Exactly. Those systems are not going to be able to do this well. I have a quick story. At Dark Rhiino, we have some really good engineers. Some have degrees, some do not. There was one person we hired whose resume looked terrible. I mean, technically brilliant, but he could not write a paragraph to save his life. This was not someone you would put in front of a customer. But if you wanted someone to defend a system, absolutely, you wanted this guy. He found us in the parking lot and said, “I am not stalking you. Just give me five minutes. I want to work here. Here is what I can do. Give me a chance and let me show you.” He is no longer with us, but he went on to some really good companies and is now at a company everybody would recognize. That kind of determination and will cannot be found in a resume or an automated system.

Blake Curtis: ATS cannot find intent, motivation, or character. It cannot pull those things out of a resume.

Manoj Tandon: No, and that is exactly what you want. We are always looking for the person with that intent, someone hungry who really wants to do something and break something.

Blake Curtis: And you know it within the first three minutes. You are like, “This guy lives, sleeps, and breathes this stuff. This is who he is.” Versus someone else who says, “This is a job. I am going to do the bare minimum.” When you meet anybody for the first time, you get this philosophical ambassador version of who they want you to think they are. You do not really find out until on-boarding is over. Then it becomes, “Okay, they got in here and they are just skating by.” These are some of the risks of using outdated assessments and ATS systems. Doing the job interview right would be expensive and time-consuming. It is the same reason multiple-choice testing became popular. We wanted assessment-based approaches for education, but they were very time-consuming, and technology was moving faster. We needed a workforce that could grow. So multiple-choice tests became popular because they are scalable and they give you a baseline of what someone knows. The assumption was they would learn the rest on the job. But here is the scary part: if you look at most IT certifications, they are multiple choice. They are not, “Here is an environment. Protect this machine. Tell me what the evidence says and produce a report.” They are not performance-based. So when you think about the people you are hiring, someone says, “I have a CISSP.” Great. That is a lot of book knowledge, and I have it too, but it does not prove you can implement or audit anything better than the next person. I have looked at the data on that. A lot of the time, when you have someone with a CISA or CISSP, you can see high confidence with lower execution in some contexts. If you change the environment from Oracle to SQL, for example, performance may drop even further. That tells you that you are putting a lot of stock in a certification for something it cannot prove. These certifications can make you sound very good in an interview. They give you capability. But they should still be matched with vendor-specific technical certifications from AWS, GCP, or Azure. That is where the rubber meets the road. Theoretical cybersecurity certifications should be paired with technical certifications to bridge that gap.

Manoj Tandon: That completely makes sense. It also explains why, at least in the circles I am familiar with, so much hiring is based on referrals. A lot of the people we have hired were referred by our existing people, and by and large they have worked out really well because people know what capabilities their teammates have.

Blake Curtis: Exactly. The assumption is, if this person is someone Manoj respects and trusts, and Manoj does not have a huge circle of people, then I should probably interview that person because I trust Manoj’s character. That is an intelligent assumption. There is a bad side too. There may be people who are naturally introverted or do not speak as well, like the gentleman you mentioned, who may not get that opportunity. There is still a lot of work to be done there. If you want to fill the workforce gap but you are also busy optimizing costs through ATS, you have two competing priorities. You have to find a balance between the two.

Manoj Tandon: That was worth the price of admission for this podcast. I hope people actually listen to that advice. I think it is very true. One of the cool things about our industry in cybersecurity is that we still have a Wild West approach. We are looking for the best gunslinger, and we often find that person based on reputation. It is a very small community. We get to know about people.

Blake Curtis: It is like a big small community. Even though the industry is huge, somehow we all know each other or know someone who knows someone. I like the gunslinger reference too because once you find that gunslinger, your retention process has to match what they need. You put all this time, money, and effort into getting top talent. What are you going to do to keep that top talent? It is going to cost you more money to replace someone who may not be as skilled or passionate as the next person.

Manoj Tandon: That is another episode by itself. But I will tell you, especially with the latest generation of people, there are a lot of soft things they are looking for that we need to provide if we want to retain them. That can be done in a company organized with flexibility in mind. In a very traditional American corporate architecture, it can be difficult because those organizations are geared for something different. Think about the gunslinger at IBM. They are going to get bored.

Blake Curtis: They are. It is the same way with me because I like complexity and challenges. Something may look hard to the next person, but if it is something I did five or ten years ago, I will procrastinate and do it at the last minute because I know the quality will still be high, but it is not going to motivate me. I remember telling my boss, “If you want to motivate me, give me something that is probably going to scare the crap out of me and that I may fail at.” She asked why I would want that. Because that is growth. That is tangible experience. That is something I am going to be motivated to tell my wife and kids about or talk about in my next interview. If it is just business as usual all the time and you are not tackling anything hard, that also tells me the company may not be worried about growth. There are people out there who only want to focus on difficult problems, and that is perfectly fine. There are other people who do not want that. You need to find a way to distinguish between those two. If you do not, you risk losing talent. Sometimes it goes back to our original conversation: people want to be seen, valued, and heard. Performance reviews cannot just be about outcomes. You have to ask, “Am I giving you what you need to grow? Does this work align to your personal values? What is the bare minimum I need to do to make sure I keep you here?” Imagine your boss telling you that. You would think, “You actually care about me? I do not even get this from my best friend or spouse.” Soft skills are another area we have to develop as leaders. If we want to make sure the company is not impacted by losing talent, that is also a skill set we have to develop for the workforce. What can we do to motivate our employees to actually want to be here?

Manoj Tandon: And on that note, we are at the hour. It is a great question, and we are going to have to get you back to help answer it. Blake, this has been a fantastic conversation. We are honored to have had you for this hour. We also want to give you a couple of minutes to plug anything you would like with our audience. The floor is yours.

Blake Curtis: Right now, the project taking most of my time is a book I just finished. It is called Cybersecurity Auditing: Auditing Beyond Checklists in the Age of AI, Cloud, and Automation. That is with Packt. The book is grounded in this conversation about years of audit checklists and how those approaches are not going to stand up in the age of AI because of the probabilistic nature of these systems. I also worked on the latest version of CISM, which will be coming out within the next month or two. For those looking to get into AI auditing, I also contributed to the Advanced AI Audit certification. Other than that, I am usually nerding out, consulting, or reading a really good book. I know I do not look old, but I definitely act old. That is pretty much what I do week to week.

Manoj Tandon: Thank you, Blake. Everyone, that is Dr. Blake Curtis. Please look him up. Great guy. Thank you for joining us.

Blake Curtis: Thank you.