Episode 24 - Speaking Security So Leaders, Boards, and Buyers Actually Listen

Welcome to Corelight Defenders. I'm Richard Bejtlich, strategist and author in residence at Corelight. In each episode, we explore insights from the front lines of NDR, network detection and response.

Today I'm speaking with Julie Parrish, Chief Marketing Officer at Corelight. Welcome, Julie. Thank you. Happy to be here.

I am glad you're here. I've been looking forward to speaking with you because our topic today is communication. What I'd like to ask you first about, uh, are communication skills for security people, and then we'll turn to, uh, marketing, 'cause I'm sure we have some people in that audience as well. Sure. Just to start with the security practitioners, do you have any advice for practitioners who are trying to influence how their CISO runs their team?

Yeah. Yeah. I mean, I think the first thing to think about there is it, it makes sense. Practitioners are naturally gonna get frustrated if their CISO doesn't instantly buy the best tool or solution that they're proposing to fix a vulnerability. But I think the key is helping them understand that CISOs operate under different constraints, right? So framing things in risk versus technology can be very helpful.

You know, you're not necessarily trying to sell your CISO on things like our SIEM is missing logs for, you know, ABC protocol. Instead, think more about, you know, uh, an angle such as we have a blind spot in our cloud perimeter, and that's going to increase our risk of unmitigated ransomware.

Um, framing it more that way to tie back to one of the things the CISO is gonna care the most about, which is risk, can be very, very helpful. Hmm. I, I think it helps as well to know what is your CISO's background because- Yes ... you can come from the technical world, you could come from the business world, you can come from a financial perspective, and if you don't know what that person's background is and what matters to them, how are you supposed to communicate with them? That's right. That's exactly right. And many CISOs are very technical, so while you could actually go down a technology path, I still kind of think at the end of the day, regardless of the background of the CISO, they are going to-- You have to look at what are they being measured on. They're typically being measured on things like stay in compliance, uh, reduce risk, uh, be sure that we've got business continuity, those, those areas. Let's say you're the CISO, and you know, everyone's got a boss, right? This is a perfect example-

Yeah ... of that. So if you're the CISO, you have to communicate with another layer, and you're trying to get resources from that group, uh, you're trying to perhaps get more authority for your team. Do you have any advice then for the CISO who has to communicate with, uh, the people that that person works for? Yeah, sure.

And it kind of goes back to, um, the point you were just making that, you know, CISOs can come from many different backgrounds, and I, I mean, I would venture to say many of them are fairly technical. And so a trap that they can fall into is hiding behind or providing a lot of technical metrics to, you know, try to get support for a purchase or something that they want, uh, the board to approve. But again, you know, it's kind of a know your audience question, right?

You gotta step back and think, "What does the board care about? What does the CEO care about?" And they're gonna care an awful lot about reputational damage, brand damage, uh, audits, things like that. So making sure that you are finding ways to tie back to that. The other thing to remember is, I think unfortunately for many companies, um, particularly in the commercial space, security is still seen a little bit as a grudge buy, um, as opposed to something that's going to help the business move forward. So finding ways to show actually this could be a business enabler if we can get to this level of compliance, this level of SOC maturity, it's going to help us do ABC more quickly. That kind of thing can work.

Hmm. Do you think boards are unfairly stereotyped? Like, I think there's this, there's this idea that boards, they don't know what they're doing with when it comes to security, and they, they can't handle complex ideas. I-- just personally, I found it to be exactly the opposite. I, I've had to-

I would agree ... bring boards-- Okay, good. Yes. Yeah, yeah. Tell me... Yeah, tell me more about that. Yeah, no, I totally agree. Um, I think that that shifted some time ago, five, five years ago even, or more, I'm not sure what, what your experience has been there, where many boards actually now have former CISOs as part of their board. Um, they have, um, increasingly put people on boards that actually have cybersecurity background.

Um, so I do think that they're becoming much more, and I'm not sure I would go quite so far as technical, but they're certainly much more savvy when it comes to understanding cybersecurity, the risks and what you need to, you know, be thinking about with those purchases. You know, I hadn't even thought about sort of mining either current CISOs or maybe retired CISOs to be board members because- Yeah

... the-- I mean, there's a cohort now. I mean, the CISO job has been around for over twenty years, so there are people who could fill those roles. Do, do you think it might be a good idea if you're on a board to say, you know, you, you think about boards, and they, they try to balance for different levels of experience in, in different areas. Maybe having a, a former CISO, um, on your board is something that a company should consider. Absolutely. Absolutely. I think that's a, a fantastic suggestion to make.

I, I've always tried to have a great relationship with marketing teams because if you can't get your message out, you know, there's this-- Some people think, "Oh, my product's so great it'll sell itself." Yeah. That is absolutely not the case no matter how great it is. Ever.

Ever. Uh, right? Uh, so a-and e-even just the term marketing, it's just communication, right? You're trying to get your message- Yeah ... across in a way that will resonate, uh, at least this is my, my perception of it, you know, in a way that will resonate with, uh, the other, the other party. So, um- In your experience, what has been the biggest mistake that you've seen, uh, security marketers make when trying to address either technical leaders or, or even CISOs? Yeah, I think one of the biggest mistakes is, um, using buzzwords.

You know, you have to realize that CISOs, SOC leaders, practitioners, they have very high kind of BS detectors, if you will. They get marketed to all the time. They are all very, very technical individuals, and, you know, using things like abstract buzzwords, next gen, seamless, AI-driven. Oh my gosh, don't look now, but I think Corelight might be using a little bit of AI-driven in some of our marketing . But, uh, with it, without explaining the underlying mechanics, um, isn't going to get you very far. Um, technical leaders view a lot of that marketing fluff, uh, potentially as a sign that the product lacks substance.

So trying to stay away from the hype, try to stay away from the buzzwords, and focus more on translating your technology into something that is of value and lines up with the CISO, the SOC head, et cetera, is what you wanna do. Do you think that there's, uh, in some cases, uh, too much use of military metaphors?

Like- ... wh- when you s- when you talked about that, the term that came up for me is military grade. Like we use- Yes ... military grade whatever, or you'll see- That's right ... battle-tested or... What, what are your thoughts on that?

Yes, I do think it's overused, um, along with sports analogies. I know there's a lot of them out there, but, you know, the, the military one is useful, I think, when you're selling into the federal government that has a natural, um, you know, understanding of what a lot of what, what military grade might mean. But back to the buzzword issue, j- be sure that you can back that up. If you're saying military grade and you're talking to somebody in the DoD, you better be sure you have a way to back that up that's gonna resonate based on their definition of it. When you're outside the government,

I think the military analogies are overused, and unfortunately can even be a little off-putting to somebody. Yeah, that was my experience coming out of the Air Force. I didn't even think about it, but one of my readers, uh, Marcus Ranum, who, who was a famous security practitioner from, from decades ago, I think he's living on a farm in Pennsylvania.

Like, I've got so many friends who just left security and live on farms in Pennsylvania. It's, it's amazing. But- Are you sure they really left security, Richard? Yeah. Maybe they did. Maybe they're all forming a security- You better check that farm silo. Yeah, exactly. Exactly.

Uh, but w- w- when he read my first book, he said, "Oh, you can tell this guy came straight out of the military." And it didn't even occur to me like, "Oh, was I still that way?" Like, the book came out three years after I got out, but I guess I still had that stuff in mind. So I've been sensitive to that ever since to try to- Yeah ... uh, not be, you know, too, too invested in that, in that language and everything. But it is one of the few areas where you do have an intelligent, adaptive adversary, as opposed- Right ... to, say, like the weather or, you know, even a disease is adaptive, but it's not intelligent, so, uh- That's right.

Yeah. Y- You just have to be sure, you know, regardless of the analogy, uh, whether it's a military analogy or a sports analogy or health, um, immunology comes up a lot in cybersecurity trying to, you know, uh, connect it to resilience.

You just have to be sure it's not a bridge too far for the, um, audience you're speaking to, and that again, you can make a connection that instantly makes sense as opposed to, "Oh, okay, I kinda see what you're going for there." I think that's kind of the challenge with analogies in general. Yeah. Well, let's talk a little bit then about tailoring your message because I think one of the challenges you might have is you've got, you've got an audience out there, and I know there's a lot of, of, um- Mm-hmm ... specification you can do and say, "Well, I'm gonna ad- address this group." But even within that, you're gonna have people who perhaps they're more strategic, like they have sort of an overall risk concern. You've got others- Yes ... who are more tactical, like they worry about mean time to response, uh, or alert fatigue. How do you, how do you deal with that? How do you try to tailor messages?

Yeah. Well, it does get complicated quickly, and I do think it's very important to take the time to create kind of your list of persona, um, that represent, I would say, no more than four or five functions, um, that you're trying to target.

Truly understand the day in the life, what are they doing, how are they measured, what are their key concerns. And, you know, I think the great thing about the digital world that we live in is it is becoming a bit easier to then line up, okay, for all my threat hunters, this is the set of messages that are going to resonate the most, I'll come back to what that might be, and line that up in your, you know, outbound ABM program so that that set only gets the messages applicable to them. You could do the same thing with your C, uh, your CISOs, et cetera. So number one, start by actually understanding the persona. Um, to simplify it a little bit though, and

I think you actually just hit on it, you know, going back to the CISO seat, um, in general, you just are going to have to continue to focus on messaging that is around risk reduction, compliance, business continuity because they're going to have to justify large purchases to the board and the CEO.

Those are gonna be the terms that make sense. That's what they're gonna care the most about. When you're looking at that SOC lead or a practitioner, it, it tends to be more workflow efficiency, signal-to-noise ratio, time saved. They care a lot about a lot of the metrics that you and I would be very familiar with, mean time to respond, mean time to detect. Um, so it really is just a matter of Understand the persona, what they care about, and how they're measured. Um, and then leverage the heck out of your digital strategies to make sure that you can get very targeted in how they receive that information. You don't create one message for everyone- No ... and try to stuff it all into that one message, right? You, you have multiple me- like, you'll have different- Yes ... uh, I mean, guess we could use the term campaign, right? You'll have different campaigns- Yeah ... with different audiences.

Different campaigns, different channels. Um, I think the only time that you really end up with one message that has to resonate, um, for everybody is when you get to kind of your big branding, your big awareness- Hmm ... level.

Um, and they're, you know, very simple messages, uh, defensible AI, SOC, um, disrupting attacks with evidence. You know, you've gotta kinda pick something broad enough that you can hang all of your supporting pillars on, and then refine for your different audiences.

And you can use that same strategy, I think, on an individual basis. And the reason- Yes ... I thought of that was, uh, we, when I worked at, uh, General Electric, we were trying to get our message through to the many CISOs in the company about what we needed to do to deploy sensors, and we were having a hard time. It seemed like everyone would sorta look at each other, and no one wanted to go first because they were afraid of what they would find. And we, we, we were able to connect with one CISO who worked in healthcare, and it s- he struck me, he was sort of like this good old boy from the South. Mm-hmm. And he took it very personally. Like, when we told him they were stealing the data from his organization- Yes ... he took it personally. He says, "Well, we have to do something about that."

So once we made that connection with him and, and realized he, he was taking this as a personal affront, like, "How dare they do this to my organization," that was the way we were able to communicate with him. And then he got the others on board. But even then we had to say, "Okay, well, this, you know, person in aviation, they have a, a certain way of looking at the world." And so yeah, this can work on an individual basis as well.

That's a really interesting example too, because sometimes you will find that person in the room who, yeah, is morally offended

Right ... by what, what they're hearing, right? And they wanna take action. Other times you end up with a person in the room who is, quote, unquote, "morally offended" because you are potentially calling their, their network or their strategy ugly, if you will. Hmm. Um, I worked for a vendor several years ago, um, and one of the claims that we liked to make, because it was true, is,

"We are absolutely going to prove to you that you can't see at least 20% of your network assets." Hmm. And some people in the room were like, "Oh my gosh. Please show me immediately. This sounds like something I need to go, you know, figure out." Others were like, uh, "Yeah, no.

Um, I, I don't buy it. I don't believe it. I'm not interested in it." So it's just g- very interesting to see where people are on that spectrum. Yeah. That, that is so funny you say that because I used to tell people that the job of a incident detection and response.

team is to tell people that their babies are ugly. Absolutely. Yeah. Absolutely. Yeah. Oh, it's a, yeah, it's a tough job. It seems like there's some marketing teams that like to rely on

FUD, which we know is fear, uncertainty, uh, and doubt. Um- Yeah ... so, you. know, you've got these teams that all they're doing is putting out, scare tactics. W- what is- Right ... a good way to, avoid that? What's a good antidote to that?

The way to market around something like that is to think about enablement. Take the uncertainty out of the equation for the person. So if we think about something like

Mythos, um, and the work that Greg Bell, and Vince, and probably you and many others did to come up with what would be the best messaging to put out there, we didn't go down a path of, "Oh my goodness, the vulnerability storm is coming. You're gonna be completely overwhelmed. You know, the, the, uh, patch window is, is, you know, almost nonexistent."

What we did was say, "Hey, let's remove some of the uncertainty here. Let's provide a useful perspective, um, that gives, you know, whether you're talking to CISOs or practitioners, gives them something to consider to think about, and more importantly, let's show them a possible path to success."

Now, the way to keep that credible though is to not immediately anchor it back to what, in this case, Corelight does,

'cause I think that's where you start losing the credibility. Hmm. Let's get it out of the FUD. Don't use explosive, um, you know, exaggerated terms.

Educate, provide perspective, um, because that's how you buy the credibility that will then hopefully have that prospect or that person come back and say, "That was really interesting. That was really useful. Tell me more. Uh, what else can you guys specifically do to help us?" You said the keyword for me there, and that's educate.

Um- Yeah ... if you can help people d- better understand an issue, uh, you're, to me you're, you're halfway there because the, the- Yes ... in this case, the prospect, the customer, whoever, the partner, will see you as someone who has some idea of what's going on.

Right. Right. And they could, they could be of, of benefit just, just for that. Yeah. Because everybody, and Mythos is probably a good current, current day example. I mean, most, many vendors are already out there with, you know, marketing, to the same, you know, Fortune 500 CISOs with their Mythos messages. So you gotta think about how you break through, and this is absolutely where the buzzwords aren't gonna help you. The fear, uncertainty, and doubt angle is not going to help you. Be that vendor that is helpful. I' just spoke with Steve Smoot, our, our CTO, and- Yeah

... uh, we, we sort of leaned into the topic of his initial job was to make sure our customers were successful using our product. And- Yeah ... I didn't take that for granted because I'm sure we've, we've, we've both been in the industry for a while now. We've both seen, uh, vendors who sell a product, and they don't care if you put it up on a shelf And it's simply there to, to check a box for compliance- Absolutely ... or whatever. I mean, what a, what a waste it seems. But if, if you're the type of company that's trying to help your customers get the most out of, out of their money, and let's face it, you know, budgets are tight and- Yeah ... we may be in an era of, of, uh, maybe inflation-adjusted it stays steady, but, uh,

I don't think we're gonna be seeing big security budgets coming down- No ... the pike anytime soon. No. No, that partnership angle and helping the customer be successful, um, I firmly believe that can actually trump, um, you know, a shortfall that you might have in your product. It, it's the thing that will bridge, uh, a customer if you're going through a quality challenge or that kind of thing. So always anchoring as much as you can on the enablement, let me help, let me be the best possible partner to you in this process, and make sure that you're getting the value out of it, is really critical. Yeah. Yeah, well, that's one thing I've liked about Corelight is we do a lot of just free stuff that we think will help people.

Like, um- Yes ... we just, we just published a new NDR book. Um- Yep ... we, we've had a threat hunting guide that we, we keep updating. Um, we just like to put a lot of content out there. I m- mean, even these, even these podcasts, right? We're trying to help people- Yes ... understand these different issues with, with security.

So, um- Yeah ... I hope, I hope the audience finds that useful. Well, they... I'll tell you what, they definitely do, and I could speak for the, the threat hunting guide for sure continues to be our most popular, most downloaded tool ever. Always. Wow. Um, and I think the NDR Essentials book is also off to a great start as well. And it a- again just comes right back to the same point, enable, educate, help.

So let's talk a little bit about the threat hunting guide then. That's a good example of using internal experts at Corelight to translate what they know and put it out there for people to use.

Um, w- we also have people who do threat hunting at the Black Hat NOC. Um- Yes ... are there any risks to doing this? Like for example, could you find yourself, uh, through sort of a game of telephone, uh, simplifying their mes- their message to the point where maybe it's not quite what they at first intended? Or are there any other risks when you're trying to translate that, uh, initial probably very technical material into something that you can be sure a general audience can, can consume?

Yeah, there are definitely risks, and I, I think you hit on the, the core one there is, you know, translating that technical material and watering it down too much, which is why, and particularly in the case of great people like James Pope and Mark Overholser and some of the folks that we have, we put them right in front of risky business to do the podcast, go write the blog, because we know that they are addressing and speaking to the audience that cares the most about what they have to say. So it... I think I'm a big fan of, gosh, there's plenty of times where you don't need marketing in the middle of that other than to, let's, let's give them a platform. Let's go find, um, an analyst for them to speak with, a, um, yeah, a podcast, a press opportunity, et cetera, and ways to give their work visibility because they are highly credible. Over a third of YouTube viewing is done on a regular television now.

Um- Oh, wow. Yeah. It's... People, I mean, I, that's oftentimes what I'm consuming is I'm watching YouTube videos on my TV during lunch. Like, that's... I'm not watching the news. Actually, I do, I watch BBC, and then I'll put on a YouTube video usually. Uh, but- Yeah ... do you see any places that seem to be on the rise and maybe some places that are, are, you know, stagnating? You know, one's on the rise.

YouTube is a very interesting one, um, because YouTube has been around for an awfully long time, and so I keep thinking, "Oh, it's, it's probably gonna start declining a bit and something else will, will come into play." Um, YouTube is an interesting one. Um, I think the other one that's really interesting and really challenging for us as, as marketers is, um, kind of the advent of the AI-driven search. So I think where a lot of people actually still go is, quote unquote, "Google," um, type in, um, more complex prompts, um, to get answers. And what we've now been seeing for at least the last year is it...

AI is going throughout all possible sources and pulling together answers. So YouTube, yes, people are still going there. Is it on the rise? Maybe a little bit, but more on the rise is the kinda AI-driven search.

Yeah. And even getting into a conversation with Gemini or your platform of choice and saying, "Here's my problem- Yeah ... can you suggest to me some answers to this? Either some vendors, some products, or explain to me what this does." And if you're- That's right

... if, if that's not been trained on your material... Uh, and I think this is something we've talked about. Like, we wanna put good stuff out there that is reliable- Yes ... so that we end up in those conversations even though we don't know we're part of them. Go back two years ago and basic search engine optimization was about optimizing for keywords and keyword searches and things like that, um, and all the things that you need to do to make that work. But about a year and a half, two years ago, it really started shifting into this AI model, and now what we have to optimize on are prompts, like longer prompts. So we do an awful lot of work to test different prompts, look at volumes associated with the prompts, and then optimize our own content and the rest of our strategy around that. But I think increasingly,

AI. It's, that is where people are going. Well, I'm glad we were able to talk about that, but it was at the very end. So we we didn't lead with it. Uh, so thank you so much, Julie. This has been a really interesting conversation. It's given me a lot to think about and, uh, you know, who knows? I think there's so much going on with this. We could talk again in six months and have brand-new things to talk about. I would, I would love that. Appreciate the opportunity. Thank you. Thank you for joining us on the Network Defenders podcast, sponsored by

Corelight. We will see you on the network. You've been listening to Corelight Defenders. To stay informed with expert intelligence on today's cybersecurity challenges, please subscribe to ensure you never miss an episode. We'll see you on the network.