The core feature of Pythia Cyber's talent practice is a talent-oriented assessment. The goal of the talent assessment is to capture in score form the candidate's capacities to be successful on the job. People keep asking me what, exactly, they get when they have us assess a candidate or employee. Here is an overview of the process: You indicate who is to be assessed. We send that person a personalized link to a web-based assessment. The assessment is timed and takes between 20 and 30 minutes. The assessment is scored by the platform. The scores are made into a profile by a specially trained AI A human expert reviews the profile and makes recommendations You get the expert's report and a comparison to our library of profiles The library of profiles is not random: we have curated it by carefully selecting who is in the comparison group. This group is not a "normal" set of subjects because we have selected particularly effective people against whom to compare any giv...

Sometimes I am asked how Pythia Cyber came to even offer NIST CSF-themed cybersecurity talent assessments for engineers, for managers and for leaders. The answer is my career has included both executive decision support (making data tell a useful story) and cybersecurity (maximizing authorized access to digital assets while minimizing unauthorized access). The technical part of cybersecurity gets all the attention and is mostly pretty well understood. The Talent Acquisition & Upskilling part, TAU, is so often overlooked. While moving along these different tracks  of technical cybersecurity and executive decision support I often wished that I could do for cybersecurity TAU what I was doing for executive decision support: gather data and put it into context. But to that I would need someone who was a research psychologist, a partner organization that built assessments, and a colleague who could tune team dynamics. Putting all these pieces together created Pythia Cyber. A way to l...

The phrase "hidden talent" survives because it is so useful. It is so useful because non-physical traits are often difficult to perceive, let alone measure. In the face of this uncertainty humans often respond with unwarranted confidence. It may be hard to tell which candidates have talent, but we all feel that we are the exception to the rule and that we can do it. It may be almost as hard to tell which familiar employees would excel in a very different role, but we feel that we can make this determination. In part we do this out of necessity: we are often called upon to guess at a candidate's potential or an employee's hidden talents. Since we have to do it, we do it. There seems little point in contemplating how bad we are at it. Few of us are dedicated enough to our management roles to actually keep score, but most of us have a sense that we are not doing such a great job. It is hard to measure hidden talent, but not impossible. Pythia Cyber has teamed up with Con...

Cybersecurity is a balance of risks. Risks require trade-offs. An easy trade-off is: do we move as quickly as possible with an 80% solution with the known risk of having gone down the wrong path, or do we wait until we get to 99% certainty and then execute? Bots move quickly and break things, you say. This requires speedy response. Yes, though the psychology of decision-making under time pressure is gloomy. We're veering into the Daniel Kahneman " Thinking, fast and slow " territory where speedy decision-making relies on what Kahneman referred to as " System 1 " thinking where decisions made under time pressure engage heuristics. These are snap judgments based on pattern recognition, the goal being to conserve time and effort in making decisions in new instances that are -- maybe -- similar to previous instances. For example if you go to a new coffee shop and you like cortados, you might order a cortado w/o reading the menu. There is no need to think about it. T...

  Early 2026 givens: 1. Your organization needs an AI strategy. 2. Your organization needs a cyberdefense strategy. Late 2026 givens: 3. Your organization needs an AI cyberdefense strategy to secure your operations using AI. 4. Your organization needs a cyberdefense AI strategy to use AI securely. Your organization will have all of these by early 2027, right? Right? Quick, call your peers and ask them what they do! I've sat in those meetings. You've sat in those meetings. Big Consulting Company is in the building. Your natural tendency is to buy whatever the vendor is selling you because it's new and shiny and your bosses like bright shiny objects.  Look, we get it, Big Consulting Company has The Latest Ahead-Of-The-Curve AI product. It even was featured in Ivy League University Business Magazine. Your company just bought a product.  Sure, they said it was "consulting" or "advising" but being entirely candid it's a product. The difference is that a p...

Just as the leading edge of AI adoption by business is starting to show signs of wariness the cries of "what is your AI strategy?" are starting to be deafening. While it is often rude to answer a question with a question, in this case I have no choice. When I am asked "what should our AI strategy be?" I am forced to reply "in what domain?" Talking about AI without specific reference to the processes to which it is to be applied is to put cart before the horse. General statements about AI are simply not useful as ways of defining how you will apply AI to your daily operations. AI is a general-purpose tool. Perhaps the most general-purpose tool humanity has ever devised. It is not meaningful to talk about AI as if it had narrow fields of application. Consider a more narrowly focused utility, such as cloud computing: it is reasonable to ask what strategic decisions your IT folks have made about cloud computing. Do you need server capacity in such great quanti...