Secure Sanity: Bronwyn Boyle, CISO @PPRO

This transcript was generated automatically by AI. If you find any mistakes, please email us.

[00:00:00] Announcer: Hello, everyone. You're listening to Cloud Next, your go-to source for cloud innovation and leaders insight brought to you by GlobalDots.

[00:00:12] It's a typical Monday morning and you're gearing up for another busy week. You grab your coffee and sit at [00:00:20] your desk only to find a critical vulnerability has been discovered in your hybrid cloud environment.

[00:00:25] Your team is working frantically to patch the system, but questions about governance, risk management, and the efficacy of your tech stack keep swirling in your mind. How did this happen? Our guest today is Bronwyn Boyle, the Chief Information Security Officer at PPRO. [00:00:40] With over two decades of experience in cybersecurity and a passion for resilience and innovation, Bronwyn brings insights that hopefully could prevent these kinds of headaches.

[00:00:48] We will also deep dive into the impact of AI on security and governance. productivity hacks, practical advice, better mental health support for tech security professionals, altruism projects, [00:01:00] and diversity in the tech world. Bronwyn, before we start, what should the audience know about you?

[00:01:04] Bronwyn: Well, you've just given me such a lovely intro there, Ines.

[00:01:07] So thank you so much for that. And also thank you so much for having me. It's a real pleasure to join your podcast. Yeah, I think you've pretty much summed it up. So, um, long time, long time tech and financial services and security wonk. [00:01:20] Um, very passionate about all the topics that you mentioned. I kind of feel myself sitting in the intersectionality of cyber trust and safety and kind of that cyber psychology piece.

[00:01:28] So really keen to just explore the topics and get stuck in.

[00:01:32] Ganesh: Great. Um, we would like to start, you, you come from a pretty rich background and been with some [00:01:40] pretty high profile companies. Um, so is there something you can share with the audience around the biggest challenges in managing risk and governance and what are some of the common pitfalls that organizations face?

[00:01:51] Um, and maybe your effective strategies to tackle this?

[00:01:54] Bronwyn: Yeah, absolutely. So again, I think I'm I'm pretty lucky to have had a very eclectic and [00:02:00] varied career. So I've worked in lots of different types of organizations from, you know, small startups and scale ups to, you know, big banks and international financial services companies and everything in between.

[00:02:11] Um, and yes, you know, regardless of how unique each organization is, you know, you do find some of these consistent trends and, and, uh, kind of challenges that recur. [00:02:20] Um, I think the point around kind of the, the, the rapid diversification of our technology stacks, I mean, they are introducing very, very increasing challenges for, for the security folks that are helping to manage these and also the governance and compliance and risk management folks that are looking to make sure that they are monitored, managed and maintained in a safe and secure way.

[00:02:39] [00:02:40] Um, We're at the moment in a little bit of a perfect storm, right? I feel in that, you know, not only is there increasing velocity in, in, in all of the kind of the, the, the technology and infrastructure that, that underpins most of the services that we rely on in a digital environment. Um, we're also seeing kind of increased business demands, you know, cause companies are being kind of, you know, pushed to [00:03:00] innovate for harder and faster and present.

[00:03:01] You know, new, new and enhanced products to the two customers who have a rightly and never demanding set of expectations, which is, which is fantastic in that we're, we're, it's great to see that level of innovation, but that comes with increased, increased challenges and increased, uh, increased attack surfaces as well, right?

[00:03:19] So we have [00:03:20] far more to look after and safeguard and, and act as custodians often than we had previously kind of around 10 years ago, where it was a much more homogenous bounded. Um, a state that we would have to safeguard. Um, Equally, you know, many organizations now have to do more, more, more with less, right?

[00:03:36] So, I mean, we all know that it's, it's tough times out there, right? [00:03:40] Cost, cost of living bites, uh, across the board, not just for individuals in society, but also, you know, there's a lot of businesses having quite a tough time these days. And, and that means, you know, kind of challenges on headcount, challenges on the, the amount of budget that can be, can be marked for investment.

[00:03:55] And, and often it can be quite difficult sometimes to make that, um, return on investment business case. [00:04:00] things like security, for things like governance and compliance. Let's face it, they don't always sound the sexiest topics, right? And I think as security professionals as well, sometimes we don't always do as good a job as we might in terms of explaining the business value that we can bring.

[00:04:13] Um, so I think, you know, With all of that, uh, you know, as a kind of a, a, a kind of a precipice that we're, we're, we're looking over [00:04:20] and then along comes AI as well. Right. And that brings amazing opportunities for, for lots of businesses and, and a fantastic opportunity to maybe democratize and lower the barrier to entry to kind of code development and technology development, but on the flip side, it's also lowering the barrier of entry to the bad guys.

[00:04:36] Right. And, you know, they don't have to go through governance and risk and supply [00:04:40] compliance processes to use AI, right. They can just get stuck in, um, and they can, and they will. are, you know, so I think we're, we're really seeing the asymmetry in terms of what we can do from defense to attack an increasingly technically proficient, uh, cyber criminal and adversary network is, is kind of really starting to bite.

[00:04:57] Ganesh: Totally agree with everything you just [00:05:00] said. And actually it, that was just like the perfect summary of life as a CISO actually in the current age, it's like a massive explosion of the attack surface with a constant requirement to reduce the budget. There's something, I've been talking about this with a lot of people in particular, I spoke to Greg Notch, [00:05:20] who's the, um, the CISO of Expel, which is the SOC as a Service Managed Detection Response.

[00:05:25] And, um, the need for CISOs to be personalities in order to get those budgets, like it's not enough to sort of explain the risk. You have to use, You know, more, more smart techniques in order to pull the budgets out of companies in order to do it. [00:05:40] Um, yeah, it's, it's definitely an interesting world and the, and the world of AI is only going to make it like 10 times more interesting.

[00:05:47] Um, it's, it's, we, we jumped into the topic of AI, so let's go that way. Um, It's a buzzword and it affects government and risk management, but how does it, how does it work across hybrid [00:06:00] environments? And what's your experience of that?

[00:06:01] Bronwyn: Well, look, you know, I mean, it's interesting, right? I, I find, I find there's, um, many camps at the moment in, in terms of, you know, their, their views on AI and, you know, whether it's new or whether it's always been there and we're just calling it something different and is it AI or is it machine learning and lots of kind of academic debates.

[00:06:17] I think for me, you know, I think the key is, you know, [00:06:20] yes, we have been using it in some, in some kind of shape or form for quite a while, quite. successfully. And again, you mentioned, you know, you mentioned kind of SOC as a service and SOC applications. I mean, I think for some time, the, the, the types of, of, um, security orchestration and automation technologies have been using machine learning to kind of winnow out, uh, the, the kind of false positives, try and kind of reduce [00:06:40] that signal to noise ratio for very over beleaguered SOC analysts.

[00:06:44] and try and kind of propel them up the value chain. That said, I mean, there's no doubt about it. Generative AI is a game changer, right? I mean, it's changing radically, kind of how we interact with computing. It's changing again, how the bad guys can, can potentially weaponize, um, you know, uh, you know, previously [00:07:00] existing threat vectors at, at scale and at, at cost.

[00:07:02] pace. Um, and I think, you know, the other instance as well as, you know, as I mentioned, like the, the, the innovations that we're seeing, they take a much longer time to hit the enterprise, right? They really do. So, you know, I think just the last few days, like looking at, at, at the latest open AI, it's not a large language model anymore.

[00:07:18] It's kind of a large world [00:07:20] model, right? It's taking in text, it's taking in, you know, images, it's taking in video screening. And I mean, that's a very, very powerful innovation. Now, again, you know, many organizations, you know, have to have the luxury or the, the, the, the, the functionality and the budgets to be able to set up sandboxes, to start experimenting safely with this.

[00:07:35] Many of those don't, right. Or they have, you know, folks who are resistant or they have also [00:07:40] workforces who are challenging, challenging kind of around, you know, wanting statements around AI is not coming for their jobs. Right. So it's, it's much harder to penetrate into an organization than it is to penetrate outside the organization.

[00:07:51] And I think this is one of the big changes for me that I see, like nearly every other technology shift has happened in the. office first before it hit the public, right? [00:08:00] So I remember my dad coming back with a computer, you know, back in the age dot and the dot matrix printer and all the rest of it. And it was, it was technology that was given to people in companies and then they took them home and then it kind of seeded out.

[00:08:11] We're now in a totally different model, right? Where nearly things are happening in the wild and then they kind of, you know, they, they, they get turned into commercial offering. But, but I think that, that, that [00:08:20] ability to, to kind of put some sort of a safe framework in place is, is really essential. And, and it all comes down also to understanding the risk, right?

[00:08:27] So, you know, again, there are very diametric views on AI, you know, is it just, you know, it's just another kind of element of your SDLC or, you know, actually, you know, it's something that requires kind of, you know, distinct and unique treatment. And again, I suppose [00:08:40] some of those views change, whether you're an AI developer of, of your own models versus are you a consumer of kind of what's publicly available.

[00:08:47] And, and again, you know, there. would be different controls for both. Um, but, but I think, you know, one, one very interesting thing that's probably coming home to roost is that it is also lifting a lid on where there might be challenges or gaps in [00:09:00] existing security controls, right? So if you're not kind of, you know, looking after your data security, if you're not looking after, you know, kind of the, the, the, uh, the, the right levels of kind of data leakage controls, all the rest of it, like AI is going to hyper, hyper accelerate that, that threat vector for you.

[00:09:14] Ganesh: Yeah, big time. And I. Um, from [00:09:20] being in a WhatsApp group, which, you know, very well, the, the discussions in there around using AI within businesses, even for text searching inside their organization creates an enormous problem. Because if you pull all of the data in there, then you start asking questions that you shouldn't be able to see the answers to.

[00:09:36] You shouldn't, you need like a filter on your AI, um, [00:09:40] total game changer. And actually it's, we're, we're, I've seen a, I've seen a lot of A surge in people asking for that as a service, because it's so foreign to companies generally to put an AI system in there, you know, it's AI is a bit like teenage sex, lots of people are talking about it, but [00:10:00] nobody's actually doing it.

[00:10:01] So to actually set that up is like even an unknown thing, which is totally scary for CISO is because how can you. have something you don't know how it operates, have a third party come in and install it and be confident that you're not going to leak data. It's just like, no chance.

[00:10:16] Bronwyn: Exactly. And you know, I think it's such a valid point as well.

[00:10:19] You're, you're, you're [00:10:20] also highlighting the fact that, you know, the skill sets to be able to kind of. you know, very effectively manage maintain and also kind of, you know, mitigate risks associated with this are, you know, they're not, they're not widespread right now. Right. So, so I guess the question is, how do we kind of try and rapidly upscale a workforce, you know, in a completely different domain?

[00:10:38] And, you know, we saw this a little bit when, with the cloud [00:10:40] explosion, right. A lot of. You know, I'm an old fogey, right? I started back in, you know, security, kind of, you know, back in, back in the late 90s, early noughties, you know, you know, it was on prem environments, right? And then all of a sudden cloud happens and everybody's got to try and, you know, get, get with the program and learn a different approach.

[00:10:55] And again, the risks are different. The controls need to be different. I'd argue, I mean, I don't know whether [00:11:00] we're still as mature as we should be from our, from our kind of evolution of security professionals. We still have gaps. But now AI is kind of, you know, bringing another seismic change and the pace and the scale of it is, is far more rapid than I think we've ever seen before.

[00:11:14] Ganesh: Yeah. It's funny, actually, you talk about that because we do operate in cycles because the way, when, [00:11:20] when, when the internet first arrived, we didn't have WAFs and then we had to sort that out and do IP limiting and blah, blah, and then the cloud came along and then we didn't know we had S3 buckets open and we needed cloud protection from, you know, the laceworks and the WIRs and whatever.

[00:11:32] And I feel like we're on top of that now. I feel like this is just the next thing, right? This is just the next challenge that we have to step up to. And I [00:11:40] know we will. I mean, as someone who does, um, a lot of talent scouting, I have been put in front of an, a sort of, I would call it an AI WAF, basically.

[00:11:49] which is, um, yeah, they're people are already building that stuff. I thought someone must be, and then they stuck me in front of them. And sure enough, they were, and, um, searching for all kinds of things, [00:12:00] you know, like, um, hallucinations within the system and, um, extreme content, let's say, and things like that.

[00:12:08] So it's, uh, it's something we're going to have to just come to terms with, because it's not stopping.

[00:12:13] Bronwyn: Something else

[00:12:14] Ganesh: that I wanted to come back to that you mentioned was. The idea that the hackers don't [00:12:20] have ethics or something like that. It's so common. I'd love to get your take on it, but people complain about if, if you do an email phishing campaign internally to your own people, you get complaints like, Oh, people were duped and they felt sad about that.

[00:12:35] It's like, well, the hacker has no ethics whatsoever. So, so why should they see? [00:12:40] So what's, what's your experience of that? And what's your view on that?

[00:12:43] Bronwyn: Yeah. So look, I, I, it's, it's a really interesting topic. And again, I, it's interesting seeing again, some of the, um, security awareness going on. Companies are now kind of pivoting to kind of a multi channel mode of phishing, right?

[00:12:54] So they're no longer just sending the emails. They're looking at kind of, you know, again, using AI to [00:13:00] generate much more realistic phishing scenarios over WhatsApp and text as well, and leveraging publicly available knowledge, which is, which is really helpful, I think. But again, I think if you look at the majority of, of legacy approaches, you know, they, they don't quite match the scale and scale of adversaries.

[00:13:14] And I think that can be really, I mean, it's, it's getting quite concerning at this point because the Delta between the [00:13:20] comfort blanket you think. feel because you had a, you know, under 10 percent click through rate on your phishing attack simulation versus actually what attackers are going to do. It's becoming bigger every time.

[00:13:30] But you mentioned a really interesting point there. I mean, I do, I do feel very strongly about the fact that, you know, we need to have a no blame culture. And we need to have openness and that, you know, [00:13:40] my, my least favorite, um, catchphrase is that people are the weakest link, right? I think people are our greatest line of defense.

[00:13:47] And I think we need to advocate for them and kind of, you know, trust them and also empower them to help kind of them stay secure. And also for us to say secure, um, with, with the phishing testing, you're absolutely right. I mean, it's, it's one way to particularly, [00:14:00] absolutely burn the trust that you've generated with, with other parts of the business and with other kinds of C suite if you don't do properly.

[00:14:05] Right. So I'm, I'm, I'm an advocate. again, every environment is different. Right. But I, I feel the, as long, you know, you need to hold the trust that you've built in, in a very kind of high regard. And you need to safeguard that because once it's lost, it's very, very difficult to rebuild.

[00:14:19] Ganesh: I like [00:14:20] that. I I've, I've always disliked that people are the weakest link thing as well.

[00:14:24] I mean, it's sort of true, but it'd be better to say. Uninformed people are the weakest link, and then it puts the blame, like, on being informed because I think that's it basically.

[00:14:35] Bronwyn: But I think also, aren't we getting to a little bit of a paradigm shift now? I mean, [00:14:40] and I appreciate probably we're not necessarily at the, at the kind of the tipping point of this, but It is happening.

[00:14:45] I mean, if you look at the sophistication now that a motivated adversary, uh, can, can generate something that, you know, it would, it certainly would fool me. I mean, I'll put my hand up and say, I, I, you know, I'm, I'm in a constant state of paranoia, right? Because are you real [00:15:00] now? Is this real? Is this an AI generated speech?

[00:15:03] I don't know. But I mean, I, I think, you know, again, the, the, the informing of people is absolutely spot on, but again, you know, they're, they're, the, I mean, we're, we're going to have to be far more critically aware and kind of, you know, are, you know, You know, what our eyes and ears are telling us may not be the reality.

[00:15:19] And I think we need [00:15:20] to find a kind of a green cross code style way of, you know, validating offline before we, we trust what we're seeing on our screens.

[00:15:26] Ganesh: I totally, totally believe you. And. Yeah. It's funny. I heard something recently that with the German parliament, basically they won't allow any zoom calls to have official meeting because they don't, they can't be [00:15:40] sure the people are who they are.

[00:15:41] Bronwyn: So

[00:15:42] Ganesh: if they want to have Angela Merkel, if you want to have a decision from Angela Merkel, she has to be there

[00:15:46] Bronwyn: basically,

[00:15:47] Ganesh: which is totally makes sense because deep fakes are so good now. I mean, they're, they're apparently they're deep faking Biden because he can't make it to the end of a sentence now, but like, The, you know, that is basically the world we're going to get [00:16:00] into.

[00:16:00] And I believe that tech will actually have to come to the solution. I think you'll have to have, like, the minute we have end to end encrypted chat, right? So you know, allegedly, that it's all encrypted between the ends. I think we'll have to have something that says, you know, a little icon in the corner that flashes and says, you're speaking to the real Nesh.

[00:16:17] We know because we're plugged into the, the real [00:16:20] Nesha later or something, you know, we, we have to come up with that.

[00:16:22] Bronwyn: Elon's brain chips. That's what it's all about.

[00:16:25] Ganesh: Yeah. After talking about how to like, you know, put trust in people and gain relationships, telling them all they've got to have a brain chip is probably not going to go down.

[00:16:35] Let's not

[00:16:35] Bronwyn: do that. Sarcasm alert. Sorry.

[00:16:37] Ganesh: Yeah. Um, [00:16:40] We can't avoid the subject of women in tech, and I know that you have been at the forefront of the diversity struggle for a little while. Um, we would love for you to share some of the experiences. You don't have to get into names and specifics, but high times and low times.

[00:16:57] Yeah. What would you like to share with us? [00:17:00]

[00:17:00] Bronwyn: Well, you know, I mean, it's, it's interesting, right? I, you know, we've, we've had this conversation that, and I, I always appreciate how open you and the GlobalDots guys are to kind of supporting diversity in tech. And, you know, people do ask me, does it get a bit boring talking about it?

[00:17:13] And it's like, sometimes, but you know what, we got to keep talking about it until it changes. Right. And. I think, you know, again, as somebody, you [00:17:20] know, started my career, you know, back in 99, right. You know, I would have come through kind of quite, quite a, um, quite an interesting environment and there's no doubt about it is getting better.

[00:17:30] But I think, you know, again, some of my more recent experiences would, would kind of have given me pause for thought. I mean, I, I, it is a shame to see that it's still, you know, an [00:17:40] issue for so many women in tech that there's still, you know, maybe challenges on their ability, that there's still, uh, there's still kind of problems around, around, you know, potentially.

[00:17:48] You kind of having, having a kind of a, a trust in a trusted forum and, and also can be quite lonely. Right. So I had a, um, I was talking to an amazing, um, female security engineer from one of the [00:18:00] cloud hyperscalers. Um, and, uh, she's super talented. You know, she's absolutely, you know, exactly the, the, the right type of talent that we need to, to, to, you know, be, be proud of and, and retain and, and cherish and kind of, you know, safeguard.

[00:18:14] And she just said to me, Bramman, I'm just exhausted. I'm exhausted from representing women and from being the only woman in the [00:18:20] room and from always having to fight. And, you know, I, I know that feeling. I recognize that feeling. It does get a little bit wearying. Um, but I think, you know, it is, it is still an issue, right.

[00:18:29] And I think certainly for me in security, I mean, the stats speak for themselves. There's still very, very few, um, female CISOs. I remember when I was, previous CISO [00:18:40] role, I remember, you know, there was a big, um, a big kind of hoo ha made about the fact that, you know, there was only four female CISOs in the, in the Fortune top 100 cloud companies of which, you know, we were one.

[00:18:51] And when I left, it went down to three, right? It's like, you know, it's it's just sad to see we don't seem to have a pipeline and we don't seem to kind of also [00:19:00] manage to retain, um, women in leadership as, as, as much as we should. Um, I also feel again that, you know, I mean, things are changing, right? And there's no doubt about it.

[00:19:09] I mean, it's, it's, it's heartening to see the fact that, you know, genuinely there is a level of care on this and people are leaning in. Um, but I do worry slightly that we haven't quite got it right yet, right? [00:19:20] Because we're just not seeing the pipeline. We're not seeing that retention. Um, and it was interesting.

[00:19:24] I mean, I went to my niece's, um, school kind of graduation thing. Um, and it was really lovely because it's an all girls school. And, um, Yeah. They had like about 120 girls who were graduating and doing A levels and they all kind of came up and, and the, um, the teachers told, told the kind of the, the, the [00:19:40] assembly, you know, where they were going on to study or do apprenticeships or whatever.

[00:19:43] And only two out of 120 were doing technology. Now that for me, you know, that was a real eye opener for me because I thought actually we've made tech more accessible. There are more kind of girls and younger women interested. And that was a moment of truth, I think, for me where I went, look, no, we have to, we really have to kind of lean in and we have to do [00:20:00] better on this.

[00:20:00] Ganesh: You know, it's somewhat. Um, hypocritical or something to be a middle aged white man in tech, talking about how there's too many middle aged white men in tech, but there just, there just is basically. And you know, I know the mold can be broken because they've done it in Israel and I [00:20:20] believe probably the reason behind that is through the military because they have a more open access to that.

[00:20:25] And it just, it feeds into the system. You know, they have lots of very, very. Smart, savvy women in tech and you don't need the military to provide that you don't have to use that as the mold, you know, [00:20:40] like the source of the intelligence was women, not the military. You know what I mean?

[00:20:45] Bronwyn: Exactly. Exactly. So we have to find a way.

[00:20:48] We do. We do. And I think to your point as well, I mean, you know, that there is, there is so much more we can do to kind of, I don't know, make it more appealing and demystifying demystify it. I mean, I did a talk, um, [00:21:00] for, um, group of women sponsored by some of the folks that you know well and we worked with before, plug out to Lacework and AWS because they are doing an awful lot in this space.

[00:21:08] Um, and, uh, you know, again, somebody said to me, Oh, you're the first female CISO I've ever met. And, you know, that was great. You know, I mean, I was kind of sad to hear that because, you know, there should be [00:21:20] far more examples. You were far more proficient than me, but I, the, the topic that I spoke on, I did a talk on why, why Taylor Swift would be a great CISO.

[00:21:28] Right. Cause I was like, actually, if you look at so many of the characteristics she has, if she decides she gets paid, board of being a global megastar, you know, it's nice to know that she has options. You know, she would be smashing CISO. She's, you know, all the, you [00:21:40] know, her storytelling, her, her leaning into tech, the innovation that she does.

[00:21:43] And, you know, she's, she's proven that she's very good on incident response, you know, and some of the, some of the stuff she's had to deal with, with deep fakes and stuff. And, and, you know, again, loads of people have said to me, my God, I would never think of security with that, with that, lens. And, you know, it was a bit silly and a bit cheesy, but, you know, it did present [00:22:00] security in a way that, you know, quite a few women there said they hadn't thought about it before.

[00:22:03] And we, we need to find those ways of telling our story better.

[00:22:07] Ganesh: Yeah, completely. And I don't think it's a cheesy thing, actually. I think it's like. I think that's quite fitting because probably Taylor Swift is someone that people would look to just as a sort of pop [00:22:20] bimbo. And that's, it's totally not, totally not fair and it helps to sort of level out that sort of mindset.

[00:22:26] And yeah, that we, we noticed, you know, we obviously know there's an issue, but I mean, the, The, the mutual group that we're in on WhatsApp, which has something like 320 members in now. It's a complete sausage fest. I mean, [00:22:40] there is, it's like, it's, I don't know how many women are in there, but I don't think it's more than like 10 something.

[00:22:45] So, um,

[00:22:47] Bronwyn: Yeah. And I think the other thing as well is, and, and, you know, I mean, I've had to learn a little bit on this and reflect on my own, my own kind of, um, I suppose tendencies in terms of communicating. I mean, I'm very happy chatting, but I feel I don't feel as [00:23:00] comfortable sometimes in, in certain types of communication.

[00:23:03] And so I feel that again, some of those, those groups are amazing. They're so supportive, you know, and they're, they're, they're great sources of knowledge and, and, and collaboration. But again, they can be a bit intimidating if you're already feeling like you're a bit of an outsider and you're feeling a little less comfortable.

[00:23:16] confident because of that, then it can be even harder to kind of [00:23:20] just chip in with, with kind of a, you know, a, a kind of a thought or a suggestion because you're, you're kind of, you know, you're, you're, you're natural inclinations to think you're going to get shot down and sometimes you are.

[00:23:30] Ganesh: Yeah. It kind of reminds me of like large groups of lads going out, just being very laddy.

[00:23:37] And, and, and, and, you know, [00:23:40] it's like, it's the least possible way to be inclusive is just a group of men all huddling around together. Um, so on that topic. We, we want to foster inclusivity in our environments and we want to pull people into the organizations. You're a leader in this. You're a talker in this.

[00:23:59] What can you [00:24:00] share to other organizations that they can, they can help promote this or include this?

[00:24:04] Bronwyn: So I think, you know, back to your topic around kind of being informed and, and again, you know, you know, the, the, the recognition of this and the, and the, the, the fact that it is a topic that folks are kind of, you know, happy to discuss and advocate for and, and, you know, hopefully walk the walk as well as talking the talk, you know.[00:24:20]

[00:24:20] That's absolutely vital. I also feel, you know, again, there's, there's a few areas in the pipeline that I think we could really target. Um, first of all, as entry level roles, I mean, I think we are missing huge swathes of talent either because again, young women and girls aren't as interested or. Or also because they're from a nontraditional background and they don't have [00:24:40] expensive certs or they haven't been to university or whatever.

[00:24:42] So they're not necessarily getting the same access, um, to learning what cybersecurity is all about, but also to kind of even getting into as an entry level role in, in certain, in certain environments. And I think, you know, that, that entry level, um, you know, uh, pipeline is so, so important to get. That right, right.

[00:24:58] Because again, you know, we know that [00:25:00] women were likely to drop out. So, you know, if we've got a small, small population to start with, they're, they're also more likely to feel marginalized and less included on that dropout rate is likely to increase. Um, I think the other areas that we need to kind of lean in on it, you know, there are, there's a very significant, um, drop again in, in women who are kind of, you know, mid career, [00:25:20] um, who are choosing to leave technology.

[00:25:22] And I mean, this is a real kind of, um, I don't know. I mean, it's, it's, it's something that's been noted, not just in security, but in lots of other areas. And there are multiple factors that are influencing that. But again, I don't know, um, apart from kind of talking about the problem, I wish I had more concrete examples of what we're doing to successfully [00:25:40] combat it.

[00:25:40] Now I have seen examples work really well. I mean, Lloyd's Banking Group are a great example of this, right? They have returned to work programs for women who've taken career breaks for caring purposes or for other reasons. So they get them back in, they get them, you know, they get them brought up to speed with things that might've changed and they provide a very inclusive and supportive environment and set to.

[00:25:57] to really foster that, that [00:26:00] connection back with the workplace and that works. And again, you're, you're bringing people in who have organizational knowledge, who've, you know, who, who have also life knowledge and, and also cross cross skills potentially that they can, they can bring to bear. Um, I think we need to see that more concertedly applied at a, at a kind of a broader level, at an industry level.

[00:26:17] Um, because it, it does seem to work, [00:26:20] right. So I think that's, that's huge. And then I think the other area, you know, being a CISO, you know, You know, CISOs are having a bit of a hard time lately, right? So we're, we're, you know, a lot of the, a lot of folks are, again, choosing not to leave. I mean, I think, you know, we've all seen those stats about people saying they're either looking for a new job or looking to get out altogether.

[00:26:36] And, you know, I, I understand that you, you know, you then [00:26:40] factor in somebody from a minority, you know, be they female or from, you know, you know, a, a different ethnic minority or, you know, neurodiverse or whatever, you know, it's lonely already. You know, you can understand why they would feel that's even, that's even harder.

[00:26:52] So I think supporting a pipeline. of CISO talents, you know, across, across different, um, different excluded groups would [00:27:00] be, would be really helpful.

[00:27:01] Ganesh: Wow. wise words and the dropout rate is quite upsetting. And I know, um, I mean, I know you personally, and I know some of you told me some of the things in private and we would, you know, we certainly don't have to go into those in the podcast, but just essentially quite harrowing stories to the, you know, to the point where [00:27:20] I've been, um, like pretty much shocked and alarmed and not shocked and alarmed, just using those words, but genuinely shocked and quite alarmed that people's behavior would be.

[00:27:31] thusly towards women in the environment. And I think you're right. You know, it's, it's about fostering the pipeline. And I mean, nobody, [00:27:40] obviously we, nobody quite knows what the solution is because everybody's facing the problem and we haven't solved it yet. So there's no go to, there's no go to model of how we solve it.

[00:27:48] But I definitely think it's on the shoulders of everyone. You know, I think it's, you know, like, it sounds a bit dramatic, but the, the, we had the Me Too movement, yeah, which kind of stopped people from, you know, [00:28:00] pinching girls bums and doing stupid things like that. And it, it, it sort of, and not, not essentially the shame's the right way to go, but it shamed people into, into behaving in the correct way.

[00:28:09] Or, you know, it was a, it was a steer to get people to go the right way. We almost need like a, uh, a movement like the hashtag me too, but for women in tech, like hashtag me too, [00:28:20] women in tech, or I don't know, it's a, it feels like that sort of moment where it's not really, It's not on the shoulders of the people who want to be in the tech so much, as, as much as the environment needs to change to allow it for them to come through.

[00:28:33] Um, I think

[00:28:34] Bronwyn: that's a really, a really nice way of articulating it. There's a, there's a fantastic book called Brotopia by Emily [00:28:40] Chang. And, uh, the subtitle is, breaking the boys club of Silicon Valley. And it talks about again, all of the different elements of the tech ecosystem from, you know, from funding and kind of the type of support that female investors or founders get, or don't get down to kind of how, how they, you know, women, women, you know, experience working in predominantly male tech fields, you know, to [00:29:00] even kind of sales and kind of, you know, that kind of that whole go to market life cycle.

[00:29:04] And it's fair. It was. It was a really interesting read for me, actually, because, you know, it, you know, when, you know, when I was having kind of tough times, you know, it gave me a better reflection point on kind of what was maybe within my gift versus what might be more kind of systemic. And, you know, again, it's, it's, it's very heartening to have, have the support of [00:29:20] people and the allyship for people.

[00:29:21] And again, I don't, You know, I don't particularly like talking about the bad bits because who does? But I mean, there's no doubt about it. I mean, you know, a lot of stuff that kind of I and other women have normalized, you know, when you do say it out loud, it's like, no, that's probably not okay. Right. So, you know, and I think again, you know, I've, I've seen just very small interventions, but very powerful interventions [00:29:40] from, you know, people like you and, and, and allies, you know, where they're speaking up and they're speaking out and, you know, not, not always taken very well, but I mean, you know, male allyship and support is, is absolutely foundational and fundamental to actually change.

[00:29:52] And as you say, change it from within the system rather than, you know, trying to batter our way in from the outside.

[00:29:58] Ganesh: And quite interesting. You [00:30:00] mentioned the, um, the sort of the bros in Silicon Valley that loops back to the AI problem. The fact that AI is mostly been programmed and built by middle aged white men or certainly middle aged men, if not white, um, and what biases have been programmed into that as it's, as it's been built out, you know, we've sort of exasperated, exacerbated the problem [00:30:20] of it.

[00:30:20] Yeah. Uh, of the sort of super male mind in, in the computer. Um,

[00:30:26] Bronwyn: right. And, and not just that also. I mean, again, you know, there, there's kind of this rumbling, you know, that you, you know, you see the kind of the top leaders kind of going, we're not really kind of comfortable that it's completely safe, but you know, the market prevails, right.

[00:30:38] Market forces [00:30:40] demand that we put this out there and it's like, well, hang on a minute, you know, really, we can, we can decide that ourselves if we try. Right. But I mean, you know, we, it does feel like we're on a bit of a, a bit of a kind of a machine that's kind of making. Making kind of some fairly, um, systemic and epic choices for humanity with, without necessarily kind of having the lessons learned from where this didn't work out so well.

[00:30:59] [00:31:00] Social media. I'm looking at your direction.

[00:31:05] Ganesh: No, the wheels are, the wheels are off at this point. It's just, it's wrong. The wheels are off. The brakes are off at this point. The wheels will come off later. The wheels are

[00:31:13] Bronwyn: probably coming off. The wheels are definitely

[00:31:15] Ganesh: probably coming off as well. Um, actually wheels coming off. Leads us quite [00:31:20] nicely to the next topic because We know that you are heavily involved in raising the subject of mental health support in the tech industry.

[00:31:28] I actually don't know too much about this, um, already, but we'd love for you to elaborate.

[00:31:33] Bronwyn: Yeah, absolutely. So, so I, again, it's funny how kind of the universe works sometimes. I mean, I, I was actually having kind of a, a bit of, a [00:31:40] bit of an old tough time and, uh, and I was, you know, and again, you, you, you and I were having chats and you were very supportive now.

[00:31:45] So thank you for that. But, you know, yeah, I was, I was feeling of tapping out of security altogether. I mean, I was, I was kind of done. I was like, you know what, I've, I've, I've given it the old college try and it's not really for me. And, you know, it's just a bit, it's wool in the too hard basket because, you know, it's just not my place.

[00:31:58] Um, [00:32:00] and I was at a bit of a low ebb and actually just, you know, with the magic of serendipity at the same time, uh, I, I reconnected with a fabulous chap named Peter Koroneos, who many of your listeners will know already. He's a bit of a, a bit of a legend in the world of cyber from Australia. He founded the cyber advisories network and, uh, he's, he's an all round.

[00:32:17] Good egg. Um, and he's, he's got a really [00:32:20] fantastic combination of a neuroscience background plus, plus, you know, you know, 40 years of cyber skills. So, I mean, he, he knows what he's at. And again, he was, you know, really worried about the overall kind of trends of burnout and kind of, you know, mental health challenges within cyber, you know, and I, I was literally like, you know, this, you know, this is me.

[00:32:37] It's like, you're literally describing my [00:32:40] brain right now. Um, And he has set up an initiative called Cyber Minds as a not for profit initiative to basically support cybersecurity professionals better manage their psychological resilience. Um, and it's founded on a protocol that, that has been proven, you know, in, in, you know, really, you know, gnarly conflict situations and military situations, but it's [00:33:00] taking that and situating it in a cyber context.

[00:33:02] Um, and again, you know, it's, it's, it's not, it's not. brain surgery or rocket science, but it is brain science. Um, you know, it's, it's, it's focusing on mindfulness. It's focusing on, on kind of, you know, taking a step out of that massive fight or flight mode that so many of us are constantly in with constant kind of adrenaline, you [00:33:20] know, just kind of.

[00:33:21] coursing through us at all nights of the day. And, uh, you know, it's just designed to try and reset our mental activity into, into more of that steady state where we can make better cognitive choices, where we can regulate our emotions, you know, where we don't feel so overwhelmed. Um, and again, I mean, I'm, I feel like I'm, you know, I'm hugely passionate about it partly because, you know, it was, [00:33:40] it was a really, um, you know, huge kind of saving for me.

[00:33:42] It's really changed how I approach things. I, I was really struggling to kind of keep Keep my, uh, myself regulation. So we say, um, emotionally and, and, you know, I've, I found this a really great help and I think the idea of scaling that out and making sure that, you know, it doesn't matter if you're in a breach situation, you've got the [00:34:00] tools in your, in your, in your backpack to be able to kind of take a step out and get off the hamster wheel and, and kind of, you know, allow that cognitive reset.

[00:34:08] Ganesh: Yeah. You know, uh, it's quite amazing when I had a burnout of a, and a few years ago was just way too much on way too many direct reports, [00:34:20] way too much traveling, way too much everything. And just project after project after project. And, um, ended up having a panic attack on the underground, you know, thought I was having a heart attack.

[00:34:29] I had to get myself into the hospital to see what was going on. And then as I recount all the things that I'm doing to the doctor, why he's asking me the question. A kind of the light bulb is going off. It's like, you know, how many hours do you [00:34:40] work a week? And, uh, do you do this and do you check your emails out of work and do you blah, blah, blah, and you kind of realize that, okay, uh, now I see.

[00:34:47] But I think it, it takes quite a large wake up mode. I think it basically takes most people a panic attack or some sort of burnout to realize they're going to burn out and actually. You know, there's a, [00:35:00] there's a classic meme. It's like recharge your batteries at 80%, you know, 80 percent used, not a hundred percent used, you know, that way, that way you won't reach the end.

[00:35:09] And it's like learning that.

[00:35:11] Bronwyn: And, and, you know, I really feel you Nash, because, I mean, I think again, it's more common, you know, again, the more you talk about this, the more you realize, you know, so many other people have gone through it. And I [00:35:20] think, you know, taking a step back also in looking at the workforce of the future.

[00:35:23] I mean, you know, it's not been an easy run for Gen Z, right. They have been, you know, through COVID they are living in. In a completely different digital world to us, right? There's much higher levels of anxiety, and now we're saying, yeah, come and join us in cyber. It's a great career opportunity, but we're, we're not really kind of setting them [00:35:40] up for success in terms of that psychological resilience and that kind of mental health support.

[00:35:43] So I feel like it's, you know, we, we have to do something different, right? If we're going to kind of keep this a sustainable career, and we're going to kind of look after ourselves at each other, you know, we need to kind of really lean in on this and keep talking about it as well, because, you know, and, and, and, and again.

[00:35:56] You know, more power to you. You're a great advocate for, you know, that openness and [00:36:00] transparency and, and you'll, you'll enable other folks to, to hopefully talk as well and feel comfortable with that.

[00:36:04] Ganesh: Yeah, thank you. That's very kind. And the, I think there's, it's happening to way more people than you, than people would believe because people aren't talking about it.

[00:36:13] You know, something that I found when I mentioned it, suddenly three or four colleagues came and spoke to me and said, Oh, I'm really glad you said something because [00:36:20] also that's happened to me, but I just was too scared to come forward. And I think then the businesses also, they don't back it up. You know, you have these, um, HR welfare programs where it's like, we want the best out of people and they'll put a ping pong table and a snooker table in the office.

[00:36:35] But like, that's, that's not mental health, basically, that's, that's a ping pong table.

[00:36:39] Bronwyn: [00:36:40] Exactly. Exactly. And, and, you know, you're absolutely spot on there, Nash. I mean, I remember, you know, again, seeing where this has done well, you know, I was working at Lloyd's Banking Group when their new CEO at the time, Antonio Huerta Rosario, I mean, he came in to roll and he was going great guns and then, you know, he, he had to step out for a few months and, you know, again, you know, quite a public, you know, You know, CEO figure saying, look, [00:37:00] you know, I'm stepping out for mental health reasons.

[00:37:02] He came, you know, took a few months out, came back and smashed it for years, you know, did such a great job, which was fantastic, but really changed the dial in terms of openness and, and kind of kind of giving permission for people to talk about it. And really, again, also put very, very, um, forward thinking and very, um, very kind of [00:37:20] positive measures in place, you know, not ping pong tables, just actually proper support, proper support, which was really good to see.

[00:37:25] Yeah,

[00:37:25] Ganesh: I think is it. Talking, talking, walking the walk and talking the talk, basically. It's sort of, it's been given a lot of lip service up until now, both culturally and in workplaces. I think probably it's time for the workplaces to step up. Exactly, [00:37:40] exactly. We've got a couple of sort of questions in closing.

[00:37:42] The, the, the one we love to give people is. Well, what I now call the Donorian question, which is if you could go back in time and give yourself one piece of professional advice, um, what would it be?

[00:37:54] Bronwyn: Um, I think it would be to be myself because, um, you know, I think I, [00:38:00] it's, it's probably something I'm only really kind of, really kind of leaning into in my, in my later years as a middle aged albidi, um, in, you know, when I was starting my career, I was forever told, you know, that I didn't have enough gravitas and stuff like that.

[00:38:13] And it was like, Oh my God, you just had to pretend to be an elderly gent to kind of try and get anybody to take you seriously. [00:38:20] And, you know, that idea of being authentic or, you know, you know, kind of servant leadership or being empathetic or compassionate was just like off the table. It was a massive sign of weakness.

[00:38:28] And so I really kind of, um, And, you know, it was just the environment. It was the time, you know, it was just the way things were at the time. But I think it, it did maybe hold me back a little bit more from, from kind of being [00:38:40] kind of me in, in situations, which first of all is bloody taxing, right? Cause you end up masking all the time and, you know, it takes a lot out and I'm sure my hamster in my brain wheel would have been far more productive not having to deal with that bit.

[00:38:51] But also again, it, it, um, you know, you, you, you kind of. perpetuate a particular mode of being and doing that also excludes other people who want a [00:39:00] different way of engaging. So I, I kind of feel it was, uh, you know, I, I'm so much more comfortable now just kind of doing, doing my thing my way and, you know, again, trying to, trying to kind of drive positive, positive leadership as much as I can.

[00:39:13] Ganesh: I think that's an awesome piece of advice to anybody, whatever the hell you're doing anywhere is to just be [00:39:20] yourself. I mean, I can't think of a more delicious piece of advice. It's something I tell people, new people we're onboarding. I tell them every single time they want to know how we sell or how we do this or how we evaluate tech and all that.

[00:39:34] There was lots, lots of, lots of it is around like the, how you do things. I'm like, I have found my [00:39:40] own way. Uh, you, you find your own way. Like it works for me because I'm me. It's not going to work for you to repeat my lines, but yeah, it's, um, that's gorgeous. Um, and then in closing, would you have a few tips to, for women looking to make an impact in the tech world?

[00:39:57] Bronwyn: Absolutely. And I think, you know, first and foremost, get [00:40:00] involved, right? You know, we need, we need. You know, your voices, we need you in the community, you know, and, and I think particularly now as well, Nesh, you know, I'm, I'm really interested in what, you know, the younger generations can, we can learn from them.

[00:40:12] You know, they, their approach to technology is completely different, right? They've grown up in a completely different way, you know. outside of the office, you know, [00:40:20] my dad's giving me his old office equipment, you know, it's been a completely different model for them. So getting involved, you know, and, and finding also finding, um, finding their niche and security, you know, it takes a village.

[00:40:30] We have such a broad discipline and it's one of the beauties of, of our, of our profession. You know, there are so many different avenues people can take. So, you know, explore things with an open mind, you [00:40:40] know, try and probe all the different elements that you can get involved in. And, you know, if you're somebody who enjoys coding, awesome.

[00:40:46] If you're somebody who's more philosophical, we need so much support. support on cybersecurity and ethics, you know, there's cyber psychology disciplines, there's the legal side, there's the risk side. So it's so much more richer than I think maybe the, the standard kind of, um, what's [00:41:00] the word like, um, uh, yeah, like kind of perception of, of security as kind of somebody hacking into something or, you know, the, the, the, the kind of the green screen with the numbers.

[00:41:09] So, yeah, keep an open mind, get involved and also connect with the network because there is a really wonderful community out there who want to do good and who want to support. That's

[00:41:18] Ganesh: super great. [00:41:20] I'm so glad that you are still in this network. I'm so glad it was so glad you didn't tap out. It's such a great personality to have in a tech community and a real great spokeswoman for this, um, this movement of mental health, women in tech, and just sort of changing, changing our environment that we're faced with at [00:41:40] the moment.

[00:41:40] So. Bronwyn, it's been, um, totally awesome to have you. Really, really a pleasure having you on the show. Um, any closing words from your side?

[00:41:47] Bronwyn: No, just thanks for having me and, uh, yeah, keep, keep doing the great work. It's just a really, really good avenue to get to hear from different perspectives. So thank you for having me join today.

[00:41:56] Ganesh: Thank you so much.[00:42:00]

[00:42:03] Sound editing and mixed by Bren Russell. I'm Ganesh the Awesome. And if you're ready to deep dive and start transforming the way you approach cloud practices and cybersecurity strategies, then the team and myself at GlobalDots are at your disposal. We are cloud innovation hunters, and we search the globe looking for the future [00:42:20] tech solutions so we can bring them to you.

[00:42:22] We've been doing it for over 20 years. It's what we do, and if I don't say so myself, we do it pretty well. So have a word with the experts, don't be shy, and remember that conversations are always for free. GlobalDots. com