Thanks for having me. I'm excited.

I always looked at it in a way of: you don't have a talent problem. People are very talented. We've had amazing, talented people for 20 years. What you have typically in cyber is a training problem. We didn't necessarily always get the best budgets to train people and get them up to speed, so a lot of the time we leveraged the vendors we bought tech from to train us on those tools. I always looked at it as: I never got to train people as much as I wanted to. If you look at any elite organization — Navy SEALs, whatever it is — the majority of their time is spent training. I'm not sure cyber should be that much different. I think they need more reps, more training — but more training and reps on the right things.

And I think what we've done is — IAM is a great example — you've taken poor talent and they just ended up in IAM. And no one wants to admit it. I talk to CISOs about it all the time and everyone kind of smiles when I say it, because they know it's true. Okay, well, why did that occur? In some ways it occurred because they had poor tech, and poor tech sometimes attracts poor talent. So in a lot of ways we took talent that wasn't trained, that maybe didn't do well, and we put them around tech that wasn't that good, that had a lot of noise, that required a lot of ticket taking. And we've just seen it over the years. If you look at titles and organizations and the way titles have been formed — you know you have successful technology when title changes match the tech. Right?

That's when you know. Okay, great — you're not a detection engineer, you're a cloud detection engineer. Okay, that's Wiz. And then it's like, what are these endpoint engineering groups? Okay, that was CrowdStrike. Start looking at that. So I think we're fine on talent. I think we need to train people better. And I think we need just massive automation on the bottom 40% of tasks. That talent doesn't want to be doing that in the first place. And then you retrain them for other things.

A hundred percent. I don't think Gartner sets the category. I think the operators do, with recs. Just look at what their rec says and what their title is, and then you know: all right, that's a good category.

I always split it into two different things: a log management budget and a SIEM budget. I got taught really early on in my career — we were saying, hey, the SIEM isn't any good, we're not getting anything out of it, and I got educated by an engineer once: well, you don't have a log management program, so you shouldn't expect to get anything out of your SIEM. So I quickly started splitting budgets and going, okay, this is log management — clean air coming in, breathe clean air, versus the exhaust that we've been working with — and then the actual technology around the SIEM. It was typically the most expensive. Eventually EDR surpassed it. And that's just the evolution of it all.

I didn't mind paying for it. There were always these comments around, oh, the throughput, I don't like the pricing model, that sort of thing. I didn't mind any of that as long as what we were feeding it was valuable to us. If I'm feeding it valuable data but I'm not tuning it the way I need to, to get the most out of it — well, that's on us. That's an operational, procedural thing for us. I've been through probably four different SIEMs, ripped and replaced them multiple times, done it all wrong several times. I didn't mind doing that if it was truly a technological problem, but the majority of the time it's operational, it's procedural, it's on us. It's just easy to blame a technology.

So I didn't mind paying for it until I started realizing I just wasn't getting the value out of it I used to. And that's when you start getting squeezed. It's just: okay, I'm still paying 7 million, but I'm watching you come in in the morning. I used to track this with my teams — the initial login for detection engineers and ops was the SIEM. They would log in first and they would stay the longest. And then gradually they started switching to EDR. If I was a betting man back then, that's a great indicator that EDR — endpoint — is going to become something. And then they stopped logging into the SIEM and switched to EDR, and then they switched from EDR to cloud. You could watch that evolution. That's when you start looking and going: you're not innovating anymore at that level. Okay, SIEM, you're in sort of maintain mode. I still need you to be in innovation mode, and you're not. So I don't want to pay 7 million anymore. That's usually the first indicator — you're not innovating, and I'm not getting enough out of it that I used to. So it's not 7 million, it's five. And that's where you start squeezing and squeezing and squeezing. It's a slow bleed that, if people are paying attention — okay, this is just the way the industry is going, so you need to change something foundational in your technology, or we're just going to slowly start moving away from you, or using you for more remedial-type things.

And the best advantage you can have is to take that problem away from the operators. Have the technology do it — and we have seen that now with AI and with the models that are out there. Like, okay, that's doing it for me. You're taking away that excuse from me, and then you're also allowing me to go focus on other things. So it's fantastic, the state that we're in right now in 2026 and what's coming.

So, yeah, I have a very different view, having been on both sides, and I'm critical of a few different sides on this one. We're moving too slowly in cyber. It is very frustrating to me — the innovation curve that occurs with infrastructure technology versus cyber, it's not even close. We saw this with endpoint. We saw it with cloud. I won't name the company, but at one of the places where I was a CISO, we got there and went to the CIO: "What's your biggest risk? What are you worried about?" He was like, "Hey, look, I need some security built into GCP." And I go, "What's in GCP?" And he goes, "All of .com." All right — Fortune 14. We should not be that far behind. The companies in cyber that innovate the fastest and build the fastest, by adopting the change that occurred in infrastructure — where you learn from them and go, okay, this is how we should be — I think they're the best companies out there. I think we're too slow because we're too slow to adopt as operators. It's pretty incredible to me: you look at infrastructure companies and Fortune 100s that adopt those new technologies, but yet I'll still talk to a CISO and go, "Well, I'm okay with X technology that's 15, 20 years old." I just talked to someone earlier — "Hey, we're still using X." I was like, "That company still exists? Why are you not innovating as fast as others?" So we're always a few years behind. That's where I'm critical of the operators. I think they need to take more risk. I think they need to update their tech faster. So that's sort of the operator side.

I think we like to be patient, to see what the business application is. I used to have a CIO who would tell me — and he was so right on this, such a great quote — he would go, "The business sets the strategy. IT is an enabler of that strategy. And security is the barrier to progress." He said that to me once in a meeting. I was so mad at him for it. And then I walked out, and like a day later I was like, oh my God, he's right. I'm waiting for the business application to occur. I'm waiting for IT to enable it. And then I'm coming in going, "Well, now you can't, you can't, you can't. Guardrails, guardrails, guardrails." I was just on LinkedIn the other day; I said, I don't want to hear about guardrails anymore. Just give me rails. Think like infrastructure and like the business. Enable them to do great things, and then you can move just as fast as they do.

Security — we don't. We pause, we wait. We wait for attacks to occur that then scare boards, that then give us more budget, and then we come in 12, 18, 24 months later. I don't know why we do it over and over again. It irritates me. I think it's shortening: you have companies like Wiz that were seven years after cloud adoption became sort of a norm, and I think you're seeing it with you guys and others where now it's like two years, 18 months. So it's shortened, and that's a great advantage for the AI side. But I still think we're too slow. We need to be thinking: hey, we're a business enabler. I want you to be able to go do this and sell this widget, but let me get in at the inception of an idea and help you innovate and enable you — not wait two years to come in after you've already been doing it and then try to pull it back. It's impossible.

I think it was worse — harder. And I think every year it gets a little easier and easier. It's just not fast enough yet for me. So yes, it gets better and better. I think the other holdup is switching cost. I was 11% of the CIO's budget at one place; I was 8% of another CIO's budget. Okay, that's good money, but it's not a ton of money for me to go: I've had this SIEM in place for three years, I don't like it anymore, I want to switch. What is that switching cost, all in — labor, tech? And we don't talk about that enough when we're talking to operators. How do I switch you off of this? Okay, I have to buy your tech for a million a year, but my switching costs are another million, and I don't have that.

It would be really interesting to see how it's going to affect adoption, to your point. It's so true. I was in a board meeting the other day and someone said, "Hey, you know, we can switch them in two weeks." And another board member just immediately goes, "Two days." That's how fast we want it to occur. I don't want you to have any excuses. My job is to take away your excuses, so you just focus on the value prop that I'm providing — and that's switching costs. And I think that's what we're building into foundational technologies: to be able to do that, just get them to parity and do it as fast as possible, so that I can eventually just decom. And then maybe it's not a million new — maybe it's just 250K, because I'm saving right off the other one.

So the easiest thing is the rebranding phase. Cyber is pretty good at coming up with new names and rebranding. We used to call things honeypots and then we switched them to deception. We're just always getting fancy with our words. The first filter I use is: did you just change language? We won't name them here, but you could probably list 10 companies right now that have been around for 10 years, and now all of a sudden you're an AI security company. That's freaking impossible. There's just no way. So the branding piece I get rid of first. Hey, you've just changed language on your website and you're using a frontier model on the backend — that's not AI to me. And I want nothing to do with those companies, mainly because I think it's just as easy for those frontier models to get their data, train their models, and just replace them. So that's number one.

Number two is I'm looking for founders who truly have expertise in the field. Because what you're also seeing is rebranding of resumes: oh, I'm building an AI security company. Yeah, but you're not an AI security expert. Okay, what does that mean? Well, you don't have any ML background — that's typically what we're looking for. Much more indexing towards core technical engineer types. I actually like CEOs who used to be CTOs. It's also a fun experiment to watch: all the things you blamed your previous CEO for, now they're on you. I want ML. I want a true technical background.

The last piece has really nothing to do with AI: you have to have a look about you. You've had that look — you have that look. I saw it in Yevgeny and Nadir at Armis. I saw it in Assaf and Yinon at Wiz. I saw Evan at Abnormal. You look at these founders and they have a look about them that is a little bit scary, a little maniacal — all these things where you look at someone and go: they're going to figure it out. And it's such a basic term that I've used with the team, and I know it irritates them sometimes. I'm like, we should do this deal — he's going to figure it out. And they're like, it can't be that simple. I'm like, I don't know, maybe it can. If you have all of those other things and there's a highly technical background, maybe it is that simple. Rate of change for a set of founders and technologies: do you have the ability to admit when you're wrong, and that that tech isn't working, and pivot? You can do that quickly now and not really have that much of an impact. And are you a true backend ML AI security company? Anything outside of that, I have a challenge. ...

So I put something on LinkedIn the other day that I got a couple of private comments about — and it's not controversial, I don't think — but it was: we have too many cyber companies. We don't need this many. We need to focus. In some ways we need to stop funding them. Let's focus on, like, the top hundred and give them all the money, give them all the support, and then we're going to grow the next 10 public cyber companies. The other side of the coin on why I say that is because we have inundated operators with too many companies. They're exhausted with just the messaging confusion that occurs in cyber. As I've said publicly, we don't have a marketing problem in cyber, we have a messaging problem. Your message doesn't differentiate you from the other four. And that is really, really important — for CISOs and operators to do the work, to just get rid of, like, the 70% of the exhaust and focus on this top 30%.

Similar ideas, or similar examples: are they core technologists at heart? Can these people build? Hey, they can build shit — let's go do it. That's something. The pedigree, sure — everyone's going to look at the investors. If you've got Sequoia on your cap table, everyone's going to give you more attention. Okay, fine. But it's not that indicative of building a great company. To me, it's the founders and the technology. When I was a CISO, I didn't pay attention to the founders. I just looked at the tech with the team. It wasn't until the last couple of years at Home Depot that I started going: well, who are you? What's your background? What makes you an expert in this, and why am I going to trust you to protect my company? I think they need to do that earlier.

Look at the tech, look at the people, and my God, talk to each other, and narrow it down to the 30% that are the best of the best. I don't give enough credit to people like Craig at B of A — he was the CISO at B of A; I think he's a CIO now. Jason at Fidelity. Ariel at Aon — I was just talking to her. I would call them. I remember calling Craig and being like, "I think we're going to buy SailPoint." And he's like, "Oh, we just ripped it out." I was like, "Oh, okay — why? What didn't work?" And we still bought it; it ended up being like a scale thing for them. But talk to other CISOs about the technologies that did and did not work for them, and why. It's almost like we need a forum, where once a month you can get a bunch of people on there and be like, "Oh, just rip this out." "Why? I just plugged it in." And you start going through. I don't think we're collaborating enough between CISOs. There are all these collaborative organizations, but they are not sending — and maybe this is the answer — don't send the CISO. Send the head of detection engineering. Send me the head of ops. And let's talk through what you're looking for and what's available. I wish I did that earlier too. So those are probably a couple of things.

What I love about cyber is there's an evolution, and it's just Father Time. To give you a different example: every 13 years there's a new endpoint phase. Between the Symantecs of the world and the Darktraces and the CrowdStrikes, we're literally at 14 years from when CrowdStrike and that crew was created. Okay, what does that mean? Well, the reason why CrowdStrike became what it did — SentinelOne and others — was because cloud became what it was, and they built on cloud environments. Now you have AI. Okay, is that another technological shift that changes endpoint? I could say the same for SIEM. I could say it for identity, and I can tell you which ones are overdue. CyberArk's overdue — it's been like 25 years, 22 years. So there's an evolution: Father Time eventually catches you, to go, this is a complete revamp. I don't like waiting that long, to my point earlier — I think we wait too long — but there just becomes a time where we're like, we're just not getting the value out of it, and we want to switch.

If my team came to me right now — and I'll acknowledge, looking back, that I was a pain in the ass as a CISO in doing these things — whatever plan they had, I would throw out immediately. Because I think everyone is underestimating what's going to happen over the next two years.

I just think the technological shift — once we start adopting more and more of what we learned from the infrastructure teams. People still aren't having discussions like this: we used to use the phrase, and we still do, "eyes on glass." What if I should be thinking about the fact that I don't want any more eyes on glass? I want eyes on glass for the top 2%, and all I'm doing on eyes on glass is validating what the AI has done for me and checking some boxes. Okay, that's machine versus machine, and that means we're fast enough to compete with the adversaries. And I guarantee you, the first time the project would be presented, they wouldn't think like that. So a lot of times what I would do is give them some ridiculous goal: no eyes on glass — I don't want anybody looking at anything. And have them come back, and they'll tweak it and tune it and be like, hey, it's 20% eyes on glass. And then you start stretching their brains to go, okay, you're now thinking about this completely differently. No one ever assumed we were going to land a booster rocket back on a platform in the middle of the Pacific. Okay, well, think like that. But you're not — you're playing it safe and you're thinking, oh, well, how do we reduce exhaust or noise by 40%? Screw that. You want to do that? That was five years ago.

So we have the capabilities now to completely change how we operate and change how operations perform, which means the tech can influence an org structure — the type of talent that I hire, the levels that I hire, all of that. We talk about level one, level two, level three, these entry-level ops people — how long have we been talking about replacing them? I was on the board of Torq. Fifteen years — didn't happen. Okay, well, now make it happen.

And don't come back to me with a plan that just gets me 20% better than what I have. The switching cost isn't worth it for me. I'm not going to do it; I'll sit patiently and wait. I have this phrase with our companies: sometimes you're not competing with a competitor, sometimes you're competing with do nothing. Competing with do nothing is worse, because you can't convince them. They may look at you and go, yeah, I think you're better than what I have — I'm still not going to do anything. And I just hated that with my team. I would stretch the rubber band: I don't think you're understanding what's going to happen over the next couple of years and how it's going to change the landscape. It has to be machine against machine. If you're doing anything with me where you're predominantly human-based, I have no use for you, and you're going to lose. You just are. ...

On the investor side, I'm just constantly saying: you're not going fast enough. It's such a fast-paced world right now. You're not building fast enough. I'm sure I irritate you and others, because I'm constantly looking at it and being like, it's not happening. We'll get there — but not fast enough.

And I'll use the same type of thing with the CISOs: you're not adopting fast enough. You're too comfortable with do nothing. And you're too comfortable with — we hear these things like "platforms win." Platforms win bestows mediocrity. They're all great technologies, they're great companies, but if you want to innovate and you want to be cutting edge, you have to adopt faster and you have to take more risk. It's not a budget problem — I don't agree with that anymore. The money's there. Take 0.5% of every Claude install, figure out a way to do it. It's a cybersecurity tax: I'm going to do this. Both sides have to move faster right now. And CISOs will hear this and call me and be like, oh yeah, it's easy for you to say, you're not a CISO anymore. I get it. I'm not saying I did it when I was there — I didn't move fast enough, and I moved pretty fast and broke a lot of glass. But right now, neither side is moving fast enough. If we think of it as, you want to protect a country, you want to protect critical infrastructure — neither side is moving fast enough.

So it was the biggest ever, right? This last one.

You better move quickly. You can say failure to plan is planning to fail. ...

Awesome.