Employ Skills But Hire Talents

At Pythia Cyber the conversation about who to hire and how to management often detours into distinguishing skills and talents. This comes up often enough that it is time for blog post.

Let us start, as so many middle school assignments do, with the dictionary definitions. Today we are using Merriam-Webster as our source.

skill noun ˈskil 

1 a: the ability to use one's knowledge effectively and readily in execution or performance

1b: dexterity or coordination especially in the execution of learned physical tasks

2: a learned power of doing something competently : a developed aptitude or ability

language skills

talent noun tal·​ent ˈta-lənt 

1 a: a special often athletic, creative, or artistic aptitude

1b: general intelligence or mental power : ability

2: the natural endowments of a person

3: a person of talent or a group of persons of talent in a field or activity

A skill is an ability. A talent is an aptitude. Talents can help you acquire skills but "practice makes perfect" as the adage goes. If you have a skill, does it matter how you acquired it? If you can hit a golf ball or use Claude Code or tie your shoes or bake a pie, why does it matter if this is the result of diligent practice, natural talent, or some combination thereof?

In many contexts how you acquire skills is your business and performance is all that matters. But when you are hiring people into your cybersecurity program it can matter a great deal how quickly the candidate learns new skills and how much talent for the field in general the candidate possesses. In large part it matters because this field changes so quickly. If your candidate took months to learn how to scan web server access logs to look for current problems two years ago that is a problem because current problems now are pretty different. Remember how we all used to obsess over computer viruses which were hidden on USB drives? That is hardly our major concern now. How about automatically running .EXE files attached to emails? Ah, those were the days.

Skills are great for now, but are not great for the future and in this business the future comes at you pretty quickly. Skills are so comforting in their ease of detection and measurement. If you are willing to let other people do the detecting and measure by going by a candidate's experience or certificates that skills are even easier to use in hiring.

There is a tired old joke that the Operations Research folks all loved: walking home at night you see a drunk on his hands and knees, looking for his keys in the gutter. You kindly stop and help, but quickly come to the conclusion that the keys are not there to be found. "Where is your car?" you ask. "Over there, across the street." "Why are we looking here?" "Because this is where the light is."

Beware of looking where the light is. Skills and knowledge and experience can shed light on minimum competence and help you secure the present. That is important because we all live in the present. But we only live in the present for a short time. Keep an eye on the future. Skill is good but talent matters in the longer run.