The Yin of Talent & The Yang of Experience

At Pythia Cyber our focus on blending behavioral science with classic cybersecurity means that we have to address something other cybersecurity consultants do not: wishful thinking. Magical thinking, if you prefer. The tendency of people to believe whatever they have to believe in order to accommodate an inconvenient truth.

At the top of the list of inconvenient truths is that experience in a previous position is a mediocre predictor of success in a new position. We all have firsthand experience of the new hire for "the exact same job" who cannot cut it.

Near the top of the list is that credentials are a mediocre measure of capability. We all have walked into the cubicle of a mediocre colleague only to find their walls covered with certificates of courses passed and plaques of participation in impressive projects.

Believe me, we understand why people cling to these ideas despite the personal contradictory experience. Not only is the dream so appealing (more below) but this tendency is built-in: since these rules of thumb are true sometimes they form a kind of intermittent reward system, which is a terrifically good way to condition people (and rats). That is why we call them mediocre instead of simply wrong.

We all know that in order to succeed in most tasks in most modern office jobs you need minimum competence, an adequate attitude and a modicum of talent. To succeed in cybersecurity, in which you must compete with motivated adversaries who have either more time than you do, or more money, or both, you need all these things in abundance.

Ah, but the dream is so appealing! In an ideal world experience and certification would be based on talent and would require a good attitude, so all would be well. This is a bit like saying "I like dessert so it must be healthy since I evolved to like things I need." Well, uh, sort of. To some degree. With a few glaring exceptions.

So it is with experience. A brief job description doesn't tell you how well the job was done, or how quickly the job was mastered, or if the actual activities of that previous job closely match the actual activities of the new job. Similar experience is better than nothing, but it is far from a guarantee.

So it is with certification. Certification generally rests on a test. Test-taking tells you something but sometimes it is a reasonable proxy for "how well did this person absorb the course material" and sometimes it is a reasonable proxy for "how good is this person at taking tests."

Talent isn't everything either, but it is a real factor. As basketball coaches say in private, "you can't teach height." At this point in the conversation with our clients they tend to get a little defensive and cranky. "Well, yeah!" they say. "We know that experience and certification are mediocre predictors of success, but what are we supposed to do instead?" What you do instead is augment your processes by adding talent to the mix. Specifically, a talent assessment to help you frame your weighing of experience and certification.

The usual initial reaction is "of course we would like to do that, but if there were a way to do that we would know about it." That is fair enough: talent assessment is in its infancy and has yet to reach critical mass. Our answer to that is simple: don't decide based on our sales pitch and don't just take our word for it: give us some people you know to assess. Once you see how closely the assessment matches your actual experience of people you won't really care about the other stuff.

Once you are on board the Talent Train you will find personnel decisions are easier, which makes making those decisions much more attractive. Ever wonder if you have your team doing what they do best? Let's see. In a way that isn't subjective and isn't as risky as the reorgs of yesterday.

Are you feeling the lack of experienced cybersecurity candidates? What if you could hire inexperienced candidates with confidence that you could train them without excessive investment and that, once trained, they will perform well? What if you didn't have to pay for possibly irrelevant experience and possibly misleading certification?

Imagine the many benefits of adding talent as a dimension to your Talent Acquisition & Upskilling programs. Best of all that shiny possible future isn't a dream, it is something that you can build now and inhabit in the future.