Revealing Hidden Talents

The phrase "hidden talent" survives because it is so useful. It is so useful because non-physical traits are often difficult to perceive, let alone measure. In the face of this uncertainty humans often respond with unwarranted confidence. It may be hard to tell which candidates have talent, but we all feel that we are the exception to the rule and that we can do it. It may be almost as hard to tell which familiar employees would excel in a very different role, but we feel that we can make this determination.

In part we do this out of necessity: we are often called upon to guess at a candidate's potential or an employee's hidden talents. Since we have to do it, we do it. There seems little point in contemplating how bad we are at it. Few of us are dedicated enough to our management roles to actually keep score, but most of us have a sense that we are not doing such a great job.

It is hard to measure hidden talent, but not impossible. Pythia Cyber has teamed up with Conchie Associates to do just this, specifically in the cybersecurity sphere. Learning that we have done this almost always leads two immediate questions: why? And how?

Why, Part 1: The Hard Master Problem

Some technologists are "hard masters" in that they do a deep dive into technology. They want to know everything about it. They quickly spend the legendary 10,000 hours and then exceed that. I knew one such person who did a deep dive into early firewalls, specifically for Unix servers (which were the dominant Internet host at the time). This meant being an expert at ipchains. And he was an expert at configuring, maintaining and monitoring ipchains. Servers under his care were well-protected. Managers were comfortable with the idea that he was an expert and an exceptional contributor.

Then the state of the art moved on, specifically to iptables (and has since moved on to other tools such as nftables). Conceptually very similar and even somewhat similar in deployment, these two tools differ in important ways. Our hard master struggled to learn a similar-but-different tool, not least because he wanted to try to master it completely. That takes time. As we age our neuroplasticity often decreases which is probably why so many of yesterday's hard masters are today's nostalgic bores, forever droning on about how it was better back in the day when they were current. Our hard master eventually came up to speed, but not before his managers had been deeply disappointed by the transition. They thought that his ipchains mastery had been evidence of talent but instead it turned out to be evidence of a learned skill with no guarantee that future skills would be learned quickly or to the same high standard.

Why, Part 2: The Pigeonhole Problem

We have all seen the following dynamic in the workplace: someone is given a task that needs to be done. That person does a great job, so the next similar job that comes down the pike is given to that person and so on until that person is only doing that kind of job. What else can that person do? Who knows? This is how I have come to work with database administrators who were trained as genetic researchers and programmers who were supposed to be experimental physicists.

Given how often this happens, how do you know what your staff can actually do? All you know is what you have (relatively recently) asked them do to. When needs change it is often cheaper, faster, easier and more effective to transfer or promote from within, but many of us quail at the thought of risking your high performer in a new role, of shuffling the deck at all. In many organizations looking inside the organization is a bad career move: if it works you won't get much credit and it is doesn't work you will get much blame. (The big except is overloading existing people with unpaid new responsibility: that seems to be a very popular tactic and an effective way to get promoted. It is also often a self-defeating path of eventual failure.)

How?

Pythia Cyber can measure talent with our unique and proprietary assessments,  which are constructed using behavioral science and experience. We are not measuring skill, there are other ways to do that. We are not measuring domain knowledge, there are other ways to do that. We are measuring the likelihood that a given individual will behave in certain ways in certain situations. This is the SAT for cybersecurity: you still have to know what your organization needs and how to weight those needs. Instead, this is a prediction of future performance in a given role. You can hire whichever candidate you like, but with our assessments you aren't operating in the dark. Or worse, in the light of false confidence.

Talent Acquisition & Upskilling: TAU

Especially in cybersecurity your staffing needs are a moving target. Continuing education is a blunt instrument: who should be educated? What should they study? Knowing what you need now means knowing what you already have. Knowing what you will need is so difficult that we recommend hedging your bets by hiring talent (which is adaptable) more than skills (which are not).

TAU is just an acronym unless you have a sound foundation. Assessing talent is hard. We can help. Ask us how.