A wise salesman once said that fishing lures don't need to attract fish in order to be sold: they need to attract fishermen. As someone who grew up in a fishing family I can confirm that lures are often bought based on fisherman enthusiasm alone. Does this selection method lead to endless success in landing fish? No, it does not. I fear that there is a similar dynamic at work in the cybersecurity market: products tend to fall into one of two categories. The first category consists pieces of technology, marketed to technologists for use by technologist, which makes sense. The second category consists of management consulting services, marketed to executives but aimed at technologist procedures and processes, which doesn't really make sense. (If you want help with the technical side of cybersecurity, why not go to a specialist firm, such as Pythia Cyber or CI-Discern , instead of a general-purpose management consulting firm?) Why aren't management consulting firms selling you...

Human behavior is a huge part of cybersecurity, say I and everyone in the room nods sagely. But like Lake Woebegone, where all the children are above average, in Cybersecurity Culture we all seem to be immune to the foibles of the human psyche. What does that mean? An example will help. One of my buddies in college, JG, was an applied math major with a penchant for mechanical engineering courses. At a deep level these two fields are closely related. But they are not the same, especially with respect to the personality traits of the practitioners. This fact first came to my attention when JG joined other of my friends in taking a course entitled "Design Optimization and Failure." JG loved this course. He loved using Finite Element Analysis to figure out which part in a complex system would fail first, which set the standard that all the other parts would be held to. He loved the head-spinning math required to constantly re-assess as they tried to make a complex system a bit st...

The core feature of Pythia Cyber's talent practice is a talent-oriented assessment. The goal of the talent assessment is to capture in score form the candidate's capacities to be successful on the job. People keep asking me what, exactly, they get when they have us assess a candidate or employee. Here is an overview of the process: You indicate who is to be assessed. We send that person a personalized link to a web-based assessment. The assessment is timed and takes between 20 and 30 minutes. The assessment is scored by the platform. The scores are made into a profile by a specially trained AI A human expert reviews the profile and makes recommendations You get the expert's report and a comparison to our library of profiles The library of profiles is not random: we have curated it by carefully selecting who is in the comparison group. This group is not a "normal" set of subjects because we have selected particularly effective people against whom to compare any giv...

Sometimes I am asked how Pythia Cyber came to even offer NIST CSF-themed cybersecurity talent assessments for engineers, for managers and for leaders. The answer is my career has included both executive decision support (making data tell a useful story) and cybersecurity (maximizing authorized access to digital assets while minimizing unauthorized access). The technical part of cybersecurity gets all the attention and is mostly pretty well understood. The Talent Acquisition & Upskilling part, TAU, is so often overlooked. While moving along these different tracks  of technical cybersecurity and executive decision support I often wished that I could do for cybersecurity TAU what I was doing for executive decision support: gather data and put it into context. But to that I would need someone who was a research psychologist, a partner organization that built assessments, and a colleague who could tune team dynamics. Putting all these pieces together created Pythia Cyber. A way to l...

The phrase "hidden talent" survives because it is so useful. It is so useful because non-physical traits are often difficult to perceive, let alone measure. In the face of this uncertainty humans often respond with unwarranted confidence. It may be hard to tell which candidates have talent, but we all feel that we are the exception to the rule and that we can do it. It may be almost as hard to tell which familiar employees would excel in a very different role, but we feel that we can make this determination. In part we do this out of necessity: we are often called upon to guess at a candidate's potential or an employee's hidden talents. Since we have to do it, we do it. There seems little point in contemplating how bad we are at it. Few of us are dedicated enough to our management roles to actually keep score, but most of us have a sense that we are not doing such a great job. It is hard to measure hidden talent, but not impossible. Pythia Cyber has teamed up with Con...

Cybersecurity is a balance of risks. Risks require trade-offs. An easy trade-off is: do we move as quickly as possible with an 80% solution with the known risk of having gone down the wrong path, or do we wait until we get to 99% certainty and then execute? Bots move quickly and break things, you say. This requires speedy response. Yes, though the psychology of decision-making under time pressure is gloomy. We're veering into the Daniel Kahneman " Thinking, fast and slow " territory where speedy decision-making relies on what Kahneman referred to as " System 1 " thinking where decisions made under time pressure engage heuristics. These are snap judgments based on pattern recognition, the goal being to conserve time and effort in making decisions in new instances that are -- maybe -- similar to previous instances. For example if you go to a new coffee shop and you like cortados, you might order a cortado w/o reading the menu. There is no need to think about it. T...