The View From Above: Sweeping & Undetailed

I have been watching a CEO replace their director of technology and this CEO is making a very common mistake with hiring technology people in general and cybersecurity people in particular.

That mistake is putting too high a value on what the CEO knows and too low a value on what the CEO does not know.

In my experience it is natural for there to be detail gradient from C-Suite to worker bee. Like this illustration, the level of detail is different at every level of the organization. The highest level tends to be almost devoid of operational detail. The lowest level tends to be saturated with it.

This state of affairs can lead to an unfortunate and often unconscious bias that the operational details don't matter. The higher up you go, the less people at that level had to deal with them. This can lead higher ups to feel that the details are not only unimportant, but a problem, since they must see the forest and not the trees.

In most cases this generalization is inaccurate to an acceptable degree. But forgetting that this is a generalization and not a universal truth can lead to the following risky dynamic when it comes time to hire someone to run your Cybersecurity Program (CSP):

1. I, the CEO, have the clearest view from atop the mountain.
2. I, the CEO, am responsible for corporate culture and direction.
3. I, the CEO, therefore should have the primary say in who we hire at the top.
4. I, the CEO, therefore should choose the options from which we all choose.
5. I, the CEO, should pick someone I like and with whom I feel comfortable.
6. After establishing the pool, other people can figure out if the candidates are qualified or competent

In my experience some CEOs are great at this. Good for them! But they are too rare to be examples of best practice. Far more common are the CEOs who choose a "good cultural fit" (which frequently means "someone I feel comfortable with" and not "someone who shares our core values") without sufficient regard to qualification or competence. Then the other members of the search team scramble to pick the best of a bad lot.

Shrugging and hoping that your favorite recruiter will do this for you is similarly prone to error. If you have a relationship with a recruiter who consistently finds you people who are both smoothly integrated and highly competent then count yourself lucky and maintain that relationship.

I get that this is difficult. I do believe in the gradient. I don't think that every level of your CSP should be staffed by hardcore technical experts. I think that more excellent managers can be brought up to speed on the technology than excellent technologists can be made into excellent managers. Ditto for the manager to leader jump.

BUT

The person running your CSP has to be technologically credible. Each level has to translate between their level and the level above them. Your CISO has to speak MBA-ese to the C-Suite, but cannot be utterly clueless about what the managers are telling them.

For years in my IT consulting practice I ground my teeth in frustration at how hard it is to strike this balance or to get successful leaders who are set in their ways to acknowledge their limitations. I realized that I did not have the training, expertise or experience to provide the CEO and the rest of the C-Suite with a way to round out their picture of candidates and colleagues. That is a big part of the reason that Pythia Cyber exists: I went out and found people who had that expertise, starting with Ted Hayes.

The solution we came up with is a set of behavioral science-based instruments to help you round out your picture of candidates and colleagues. These instruments either assess talents, to help you hire and promote people, or they assess potential problems, to help you fire or demote people.

Let us help you remove some of the risk in staffing. We don't tell you how to feel about the candidates or your colleagues; you still have to use your usual process. But we do help you base your assessments on data in addition to gut feeling.

Staffing your CSP is hard. We can help. Ask us how.