When the Perfect Job Candidate Is a Deepfake With Cyberr

[00:00:00] Scale your business with agentic AI with limited risk. With Denodo's AI data layer, your agents are provided with real-time company data and guardrails for company protection. Create the business you always dreamed of with Denodo. And you can do that by simply visiting denodo.com to learn more. But now, back to my guest.

[00:00:28] Welcome back to the Business of Cybersecurity podcast. Quick question for you all. What would you do if the perfect job candidate appeared on screen, answered the technical questions, looked perfect on paper, and turned out to be somebody else?

[00:00:46] Well, my guest today is Sam Swift. She's Chief Marketing Officer at Cyber, spelt with two R's. And she's a cybersecurity practitioner with 27 years of experience across technical support, instant response, product development, and marketing.

[00:01:06] And I suspect that she's picked up more than a few war stories along the way. But today, she will share the story of a deepfake applicant whose polished CV survived the first checks until some inconsistencies in the voice, in the video, in the identity, and the answers began to add up to something different.

[00:01:28] So we will discuss today what finally broke the filter, why hiring security has to start before the interview and continue after that laptop is delivered, and how companies can verify candidates without treating every genuine applicant like a suspect.

[00:01:45] And we will also take aim at fear-based cyber security marketing, dramatics, unrealistic hiring models, and professional networks that have forgotten the cybersecurity professionals. And even more important than that, we'll have a bit of fun along the way. My guest is a real breath of fresh air and a real pleasure to spend time with. And I know you're going to love this one. So enough from me. Let me introduce you to her now.

[00:02:13] So thank you for joining me on the show today. Can you tell everyone listening a little about who you are and what you do? Oh, that's difficult. I'm old. There's a lot to tell. But we'll do the Reader's Digest version. Thank you for having me on, by the way. It's lovely to be here. So I'm Sam Swift. I've been working in cybersecurity for 27 years now. And I am chief marketing officer for a company called Cyber, with two R's. But I'm not your general marketing person.

[00:02:42] The marketing thing is, I'm a cybersecurity person that does marketing. So I've worked, I've done all sorts, incident response, built products. I've spent a long time in industry and I do a lot with the community as well. So marketing is a word of a job title that I have, but it's not who I am. It's just, it's what I do. Are they the same thing? I don't know. You are in good company on the oldie side of things. And I was looking at your backstory there and have all the roles that you've been in.

[00:03:12] And very similar to myself, we've had various roles across technical sport, threat response, product development, cybersecurity, marketing now. But I'm curious, we've both seen a lot of changes, but how have you seen the industry from each of those positions change? And how has it changed the way you judge whether a security claim is credible as well? Because you've probably seen and heard a lot of BS over the years. I've seen a lot of BS over the years. It's funny, some things change, some things very much stay the same.

[00:03:41] When I started in cybersecurity in the olden days, people were arguing about whether they needed antivirus. And we don't even use the term very often anymore, certainly not on the B2B side. And who says antivirus? Maybe my mum. But it's, a lot's changed. I mean, the industry has exploded. And technology explosions, with that comes, you need cybersecurity.

[00:04:09] So the minute there's any sort of new thing, I wonder how far I can get without saying the two letters that everybody says all the time now. Yeah. I'm going to try, but it won't be long. The minute anything you have. So Internet of Things was a good example. The minute we wanted to connect everything from a fish tank to a fridge to a pair of shoes to the internet, with that came the need for cybersecurity.

[00:04:35] And innovation and security don't run at the same speed. It's always a catch-up game. No, it is always a catch-up game. So people want to get their cool new thing out there, whatever that might be. And this security as an afterthought has been a kind of running theme throughout.

[00:04:52] And it tends to be people will wait for something to go wrong, or there is a compliance requirement where they have to go and do something to make the folks who can find them happy. But even that, it's a stick. We always seem to be lacking in carrots quite a lot in cybersecurity.

[00:05:13] And then, yeah, when the stick turns up in whatever format it does, if that's a breach or a scandal, or it might be the ICO, not particularly loaded with fangs, it feels. But that's when people tend to do something about it. Or it could be a business issue, right? It could be, you know, this company wants to buy your thing, but you don't have this program in place or these letters and numbers in place to say you've done whichever audit they require.

[00:05:41] It becomes a struggle around doing business. Back to the BS thing, because this is a topic dear to my heart. But the industry for a long time has, from a marketing point of view, you're always told as marketers, you know, you've got to find the pain. There's a certain thing as well, find the pain. And so therefore, the negative aspect of a lot of the messaging around, you know, ooh, bad thing, has been alive and well since the beginning.

[00:06:10] I can remember at McAfee years ago, them doing a booth at a big event in London, where they had a computer in a box and then snakes and stuff crawling over it. I feel like there might have been an alligator in the box. I might, maybe I'm making this up, I don't know. But there were definitely things in there that were like physical animals to like show, you know, the fear of what could, you know, what could happen to your computer by this thing and all your problems go away.

[00:06:37] And it's that terrible thing moment to buy my thing, everything will be fine flow has been a common theme in cybersecurity marketing for such a long time. And it doesn't work. I mean, OK, people still buy stuff. The industry, there's a lot of money in the cybersecurity industry. But the buyers, especially, and the users, like they don't need to be told how rubbish their life is.

[00:07:05] And, you know, the fact that they are constantly fighting a fight that is, you're never going to win 100%. You can, you know, you can keep improving, keep improving, keep improving. But it never, ever, ever gets to the point where you're like, cool, we're secure now. Brilliant. Thank God we bought that thing. That thing was the one. And, you know, they scared me into buying it. So, yeah, the whole bad hackers will steal all your stuff messaging. You know, what keeps you up at night? Like doom is not good.

[00:07:34] People want to know, like, operationally, how is something going to help them? Is it going to keep moving the needle into, you know, OK, we are a bit better than we were yesterday? Or I can see things in a way I couldn't before? Or I can help my business go and do this new thing in a way that doesn't terrify me or is just, you know, loaded with risk? So, yeah, there's a lot that's wrong.

[00:08:02] And personally, and maybe I'm biased on this, I would argue that having someone who understands cybersecurity in your marketing team is really, really important when you're trying to sell cybersecurity products to cybersecurity buyers. 100%. 100%. 100%. And listening to you there as well, you've also shocked me because you've made me realize I've had an epiphany there that we've not mentioned antivirus software, that phrase, in about 10 years. And I've never even realized until you said it there.

[00:08:27] And we will try and avoid the two-letter acronym there that might run the risk of us getting arrested. Of course, I want to tech podcast. It's almost the law now, isn't it? But one of the things that put you on my radar is cyber recently encountered quite a convincing deepfake job applicant with a strong CV and a professional profile. But we've all seen those kind of automated software where you can just apply for 200 jobs in one click.

[00:08:57] But what happened during this interview and which small inconsistencies eventually revealed the problem? Because it's an incredibly cool story and slightly frightening as well. You know, it's interesting because I've been fascinated by tech always. It's been a thing in my life since I was very young. And seeing this whole, you know, you can make videos where I brought John McAfee back to life, not physically. But I have got videos of him singing songs with me using the two letters.

[00:09:27] Let's just do it. Let's get it out. The AI, we've done it. It's done. It's done. Yeah. Right. Good. But the whole deepfake thing, it's been talked about a lot. Yeah. And there have been some stories that have kind of hit the news around it. KnowBefore was kind of one of the biggies where they actually ended up hiring somebody that turned out they'd used deepfake technology as part of the process to infiltrate the company. Because the deepfake technology on its own, it's like a lot of things, right?

[00:09:56] You know, a knife cuts things. Yeah. It's not necessarily there for stabbing humans. It could be there to cut your steak or open a box or whatever, right? So without getting too far down other rabbit holes to try and justify... Disposable barbecues. Disposable barbecues. Oh, goodness. Don't even. So the deepfake technology on its own, it's always about, you know, what is the intent?

[00:10:24] And what happened to us was, I found the whole thing fascinating. And this is where, again, being a cybersecurity person versus generic marketer came into its own. Our chief product officer had an interview with a guy for a back-end engineering role. And we've been on a one-to-one. He cut it short and he's like, I've got to go and interview this guy. About 15 minutes later, he came back and he sent me a short clip of a video. And he's just like, oh.

[00:10:50] He used three letters in his thing that were two Fs and an S. And I was like, hang on. He's like, yeah, this guy wasn't who he said he was. I was like, okay. And he's like, can I watch the video? So without hindsight, it's a wonderful thing. But just like in the moment, thankfully, Craig had clocked either something was wrong on the video. And we're used to now, you know, people being on bad connections.

[00:11:17] There's always the horrible moments where we kind of get stuck pulling awful faces. There were a few things that weren't right. The guy had a backdrop on. That's quite common. Nothing ordinary there. The video and the voice were a little bit out of sync. He did look quite ironed, I guess is the way. You know a lot of my video software now. You can hit the touch up my appearance button. Yeah. But it was more than that.

[00:11:45] And he'd applied for a job under the name Andrei Moldovan. Now, you could have that name and have any kind of, I guess, ethnic background. That's not necessarily a clue that you're going to look like, you know, stereotypical Eastern European. Yeah. But there was a big inconsistency between kind of what you'd expect. Maybe, you know, we have our preconceived ideas and our biases. What you think. And Andre Moldovan is a name. He's like being called Andre Smith here. Like this guy said he was in Romania.

[00:12:15] But didn't quite look right. But again, it's a little thing. And you can't judge. People can be called what the hell they like, really. Yeah. When it really came into it, though, there are some things that the deep fake technology just isn't very good at at the moment. And we'll get onto the hands thing in a bit. But it can do, like you can change your voice. A friend of mine, Jake Moore, did a bit of research recently. And he presented it at InfoSec. It's very cool.

[00:12:42] He managed to get two jobs of using deep fake technology as part of the MO to get to apply for this job and use it during the interview process. First time he did it, he did it as a guy. Second time he did it, he did it as a woman. And the woman that Jake created had a woman's voice. Where the technology still is falling down. And someone said the other day that, you know, it's as expensive and as bad as it's ever going to be, this technology right now. It's always going to improve and it's going to be easier to access.

[00:13:12] Where it falls down is on the non-words. So the ums and the uhs and the uh. And it was very, his accent was coming through much stronger on those. And it just kept unraveling piece by piece. So there was that, there was the visuals. And then it got into when he was talking about the role. Because a lot of times when people are using these during the hiring process, they'll have some AI helping them with the questions.

[00:13:41] I don't think they'd invested much into what this guy had in front of him. He wasn't very good at explaining what we did as a company. And that's quite a common question. You get, you know, why do you want to work here? But like, what do we do? He was very prepared for questions about, you know, being a back-end engineer and having done the right projects and all those kind of things. Because on paper, this guy looked perfect. He really did. Everything was tailored. The profile, the CV.

[00:14:09] He couldn't have been better for this role. Like, at all. It was 100% across the board on paper. But it was in, on the video where things started to go wrong. So, anyway, net-net, Craig's spidey senses are going off at this point. Like, things aren't all adding up. And there were two killer moments, I think. One is, and the guy could not, he could have prepped for this, I guess. He could have dug further into Craig's background. Craig's wife is from Moldova. Yeah. And speaks Romanian.

[00:14:38] Ah, okay. So, he did the whole, you know, where are you? The guy's like, oh yeah, I'm in Bucharest. Okay, cool. He's like, oh, I speak some Romanian. Do you want to do the interview in Romanian instead? And at this point, like, the wheels fell off. Really. You could see the guy was like, no, no, no, no. Well, we should do it in English because you're in the UK. Yeah. And he just threw in a question again. And I tried to smooth it over without, Craig didn't push it, but he's like, I've got you.

[00:15:09] And he even had the CV open on the screen of this guy with the guy's picture. And it's clearly not him. Like, on the video. And he's sharing his screen. He's like, showing the guy. It's just like. Something doesn't add up here, yeah? No. So, eventually he calls it out. And he's like, I don't think you are who you say you are. Yeah. So, again, the guy's laughing and being all like, no, it's fine. What do you mean? I don't know what you're talking about. So, he's like, okay, can you put your hand up?

[00:15:37] And this is, again, where the technology will get better. And I'm sure somebody somewhere in a lab has already got it working. But the minute you, AI can't do hands particularly well. We know that with the six fingers and the randomness that goes on in AI-generated images. But where it really falls down is if you break the filter. So, first of all, he asked him to put his hand up like that to see how it dealt with his fingers. And you can see there's an inconsistency at that point. And the guy's like, okay, good. And he says, okay, can you put your hand in front of your face?

[00:16:07] Because that's a bit that breaks the filter. And he wouldn't do it. So, they ended the call at that point. So, yeah, it's a lot of little things that add up. And then when we went back and looked at it, again, hindsight is great. I did some digging because I was like, give me the guy's stuff. Let me have a look. LinkedIn profile hadn't been around long. And then disappeared as well, not long after the interview. Some of the information on the CV, like the phone number was one you could buy.

[00:16:32] Because you can go and buy a phone number, not as a SIM card, but even just to borrow a phone number for things like something needs an SMS number in a country. And for you to get a code. So, you can buy access to phone numbers pretty easily. So, you'd use that as his phone number in Romania. His email address was completely – it had a name in it that was nothing to do with the name he was giving as Andrei Moldova. And I'm not sure it had anything to do with his actual name either.

[00:17:02] But this is where it gets really exciting from my point of view. This goes back to the FUD thing on messaging. Yeah. But it's very easy for people to go, oh, yeah, was it the North Koreans? Or is it China? Because, you know, they're the only bad countries in the world. Oh, Russia. We forgot about that. UK and US never do anything bad, of course. Yeah. So, I spoke to a friend of mine. In fact, in the barrage of things behind me, this is his book. It's a guy called Jeff White.

[00:17:32] He's an investigative journalist. And he's done a lot around North Korea and specifically the Lazarus group. And I was explaining to him what happened. And he's like, well, do you want to check? Heck, I said, I've got some details about the guy. And he went off and spoke to somebody, came back, and he said, look, I can't tell you 100% this was North Korea. Yeah. And I kind of didn't want it to be, really. I was like, you know, I don't want to jump to the team. But he said, that format in the email is what they use. I was like, ooh. So, we hold a lot of data on cybersecurity people. Yeah.

[00:18:02] And having access to those backend systems gives you access to all that data. So, had we employed this guy and had Craig not spotted all the inconsistencies or even just not done a video interview, which people can talk their way out of fairly easily. If we had hired him, the access that he would have had to that information is all of it, really.

[00:18:34] Even with security measures in place, the fact that you're in the network at that point and you can get to stuff, it gives you much better chance of being able to, you know, find ways of decrypting stuff, whatever it might be, to get to that information. And that having thousands of security professionals contact details, it gives you an awful lot to be able to then go and, you know, try and defraud them, attack them, get into the networks that they are responsible for.

[00:19:03] So, I see it makes sense that it could be a nation state that we were targeted by. But certainly, we are a target. We know that. And this type of methods to become the insider threat is more and more common and easier and easier to do. Wow. And I'm slightly disappointed it wasn't a 17-year-old called Billy in Barnsley or something like that.

[00:19:26] But seriously, I mean, the chances of your friend that was, your colleague that was interviewing there, having that Moldova-Romania connection as well, it all kind of just fell apart. But as video and audio improve, what checks should hiring teams listening horrified right now, what should they be introducing to make legitimate candidates feel like they're being treated without making them feel like they're treated as suspects, saying, put your hand in front of your mouth before we start and things? Seriously. What should they be doing?

[00:19:58] You've got to start much earlier. And I don't subscribe to the whole idea of the human firewall, and you want to make sure that everybody's trained to find all the things. People need to be able to do their jobs. And security's role is to empower them to be able to do their jobs and ideally not get in the way, but also protect the important stuff for the business. But there are things you can do, for sure.

[00:20:24] And that will help you even just reduce the time wasted on talking to people like that, let alone reducing the risk perspective. So before you even get to talking to somebody and taking up that hour of your time, especially as you're going further up the chain for maybe important jobs, doing the verification of their ID. It doesn't necessarily mean that the person who shows up on the video is going to be the same person,

[00:20:53] but you can verify things about them ahead of time. And I think by showing that you are doing those checks, and you're not this open doorway for anybody to just roll up is a good thing. You can start doing background checks earlier. Background check software now actually has got a lot cheaper than it used to be. So depending on the role, and I think taking a risk-based approach to this is always important, depending on the role you're hiring for and the level of access they would have to your systems,

[00:21:21] your information, your customers, whatever that might be, is you kind of you apply a risk framework to the level of checks that you need to do. And for a security role especially, and this was back end but still close enough, a good person will be okay with you doing the checks ahead of time. And then it does become to a point a training thing. The phone call versus the video call is an example. So many times I've got on with, you know, if you apply for a job,

[00:21:50] one of the first people you'll talk to is talent acquisition. And it can be a phone call quite commonly. And I would say you make sure it's video straight away because they will, you know, that person can start socially engineering you before they even got to the deep fake side of things. But they'll ask questions beyond what's on the job spec. And someone who's trying to help and get, you know, get the hire done, the talent acquisition person, that's their job, right?

[00:22:19] They're getting good candidates in so they can share information that maybe you wouldn't want shared. So it's a two-part thing of making sure, A, the person knows what they can and can't say. And that is the business's job to make sure that person is trained in a way to not overshare. But also demanding the video as early as possible. And a lot of the video tools now are already trying to bring in more technology to help spot deep fakes or help spot any sort of AI enhancements.

[00:22:49] As long as I don't get rid of touch up my appearance, we're good. That will make me cross as an old person. So, yeah, there's a technology side of it. There is a training side to it. But what else can you do ahead of time to put in checks and balances to reduce the risk of someone coming, you know, into the process who really isn't who they say they are? And then it continues the other side as well. So say you do hire that person. A lot of us are remote. There is a whole other, we'll call it a campaign.

[00:23:19] And yes, sometimes it's a North Korean thing, but other cyber criminals are available. So having people to accept a laptop on behalf of the fake candidate in a country where they've said they are. And you may have had these yourself. Do you want to earn £250, £400 a day? Very easy. You just have to accept this laptop and install something on it or accept this laptop and send it on.

[00:23:47] And that then, you know, they've got the hire, but then they've also now got a box that has access to the systems in your company. So they're paying people to go and accept those devices. And you become a cyber criminal at that point. It sounds like easy money, but, you know, nothing sounds too good to be true and all that. So it's right the way through of doing the checks, the identity check. Is it, again, is it the person you think you're hiring? Nothing is 100% foolproof.

[00:24:13] Could they get a fake passport to the person accepting the laptop and is the delivery person paying attention? I mean, it's harder to deepfake a human in real life. But, again, you know, does the delivery person do the checks they're supposed to do? Yeah. Or do they just take a photo of the passport and say they've seen one? You know, oh, no, you know, my wife's out right now. I've got her passport, though. She said that's OK. They might still hand over the laptop.

[00:24:42] So, yeah, it's all the way through. And then when, you know, monitoring when someone's in the environment. It's not, you know, it doesn't stop. So, yeah, from the job description through to making sure you're monitoring employee activity, you have a job to do with security. You know, it's there to protect the business. And good people, I think, for the most part, will not take umbrage at that that is part of working somewhere, especially if it's a high-risk environment.

[00:25:11] And I'd love to bring it back to cybersecurity marketing for a moment as well. Because over the years, cybersecurity companies, they often, as you said at the very beginning, they rely on fear, absolute claims, incredibly dramatic language. But why does so much security marketing become disconnected from the work that actual practitioners are doing? Because as you said at the very beginning, it doesn't actually work acting that way, does it? It's strange. I think there's a few things. Yeah. It's very easy to get caught up in your own hype.

[00:25:40] So you've built this product. You think it's really cool. You've seen it solving a problem. And you can almost become, like, just buried in that segment of the world of, like, hey, we've got this thing and it is the best thing ever. Without thinking about the full ecosystem of what cybersecurity professionals actually have to deal with on a day-to-day basis.

[00:26:00] And, yes, your shiny new thing may be the very, very best, in your opinion, at solving this tiny little piece that has thus far been unsolved. Like, cool, well done. That's awesome. But that may not be the most important thing right now to the person you're trying to market at. Not even, you know, to, it's at. And when they don't immediately go, oh, my God, that's the best thing ever.

[00:26:29] Let me just, I'll come over personally with the PO. Let me just, like, buy this immediately. I'll bring you cash from my pocket. The tactics then can actually get quite aggressive as well, which is, you know, that doesn't work either. But some of it, I think it's a lack of understanding for who you're selling to marketing at and trying to apply techniques that maybe work in other industries.

[00:26:56] You know, if you've been to marketing school and you've been told this is how to market to everybody, it will definitely work. And you don't understand the people, not just the buyer, the people who are going to use it. And the reason that somebody might buy it for their people, because, you know, people want to, marketers and salespeople often want to sell to the budget holder. And they're desperate to try and get a hold of them. And maybe they'll speak to them in a language that resonates, maybe.

[00:27:28] But that person isn't going to be using it every single day. They might get some output from it. They might get something into their reports they have to do that might be taken up to the board. But the people who are, you know, at grassroots level doing the actual work, it might seem amazing to their, you know, their boss's boss. But does it fit into the workflows? Does it, is that the problem that it's solving actually impacting them at all? Are there 77 other things that are actually in the way first?

[00:27:56] Or does it mean they have to go to another screen and they have to do something in a completely different way? Like having it in the ecosystem versus I made this amazing UI are very different things. Like is there an API they can call to pull it into their own systems? But the, yeah, the marketing language and the understanding of the ecosystem don't just, they don't align so often. And I am a big proponent of go and speak to people.

[00:28:26] Like go into the community. Spend time with the people doing the real work. See how do they react to the thing you're showing them? What questions have they got? And you might well find that just because your user interface has got lots of pew pew maps on it or, you know, the colors are amazing or, you know, it's written in a way that's going to be cool for the Gen Zs, yo. Does that mean that, you know, as a practitioner that my life is going to be better? Can I get, can I go faster?

[00:28:55] Is this thing going to go away or is it actually going to just create more noise for me? And that's what I love about your story here because you've earned your stripes in technical support, threat response, product development and cybersecurity marketing now. And for people that are cybersecurity marketers and they're in this space but they don't have any of that experience, what could they maybe learn by spending time with customers, instant responders and grassroots security communities? That's where it all happens. What could they learn from doing that, do you think?

[00:29:26] So much. I think they'll understand, finding out about what, you know, people do every day and guess what? It probably isn't just the thing that your product solves. But yeah, what's, it goes back to, you know, what is their day-to-day life like at work? Where are they struggling? What else do they have to worry about? And I would strongly recommend, and I am a little biased here because I help organize them.

[00:29:53] There's a whole set of community conferences called B-Sides. And there's, I mean, there's a lot of community conferences. There's, like any industry, you have the big kind of flagship events that you can spend literally the value of a large house on by having a booth at these big events. And having the shiniest, biggest booth definitely means you'll get more money. Generally not.

[00:30:16] But some people have, you know, more money than God and can put their name all over hotels in Las Vegas as well as, you know, having a booth that is unnecessarily ridiculous and will probably wind up in landfill. These small events where the people are at, and you can, A, you can go, you can go meet them, kind of get involved more in kind of what the culture is like. But go to talks and understand, you know, learn a little bit more about some of the things people are doing.

[00:30:42] And even if you don't understand it on a big technical level, knowing that, you know, the world exists outside of your product area and asking folks questions. People are generally super lovely as well. If you've got questions and, you know, you go and ask in a humble way, they'll help you. So you can go and you can learn. And if you sponsor these things, you can go and, yeah, you could show somebody your product and get real feedback from the actual practitioners as opposed to, you know, I make this cool demo video.

[00:31:09] Or, you know, this is, you know, my standard patter that I use when I talk to the people who are the budget holders. I show them and you'll hear the questions coming from them. But, OK, well, that's cool. Or did you know, yeah, I've actually got this in this other product that you might not know about. But giving, taking yourself into the community and giving back to the community by sponsoring and participating at those types of events is huge. And I think as marketers, you will learn an awful lot.

[00:31:35] I think also product people should go and do the same thing because that's you'll feel the reality, not the shiny big trade show or the whatever hype you've come up with in a room with a whiteboard this week feeling that sounds really cool. Or here's my new competitive messaging where I'm going to beat up on XYZ competitor because that works. So, yeah, it's get into the community, go and talk to people, real people.

[00:32:03] Your pick your AI of choice bot is not going to give you the same level of feedback as you are from going to these things. And they're cheap to go to. There's their B-sides, especially. And if you talk about the UK just on its own, I think we've got more B-sides per capita than like any other country in the world. If, yeah, there's, it's the letter B sides, like a B side of a record. That's how to find them. But yeah, so there's lots of other types of events.

[00:32:32] And there's meetups and things you can go to. It's low cost. It's high value. And I know that as a security person, seeing vendors come and actually, you know, meet the real people, it means a lot. So it's, you know, it doesn't cost you the price of a house. The benefit is huge.

[00:32:53] And people will give you real valuable feedback as opposed to maybe, you know, the synchronic AI tool that's telling you all your ideas are great. Or, you know, trying to do the same thing over and over again and expecting a different result. Which. Yeah. And if you look elsewhere, the tech, if we scrolled on our LinkedIn news feed, it'll tell you tech is replacing jobs. A lot of fear out there.

[00:33:19] And on the flip side of this, cybersecurity as a well-known skilled shortage, there's always a lot of headlines around there's a 0% unemployment rate across the industry. You can work anywhere. But despite all this, many people still struggle to enter or progress in the profession. So what's going wrong here? Where is the hiring model failing? And what should employers change now? Is it about bringing their own staff and training them? What do you suggest here? What are you seeing? It's interesting, isn't it? Yeah.

[00:33:49] The. It's funny. We kind of throw the same FUD at these numbers. The whole 3.5 million unfilled roles. Pick a number of choice. And then I know a lot of really good people right now who aren't finding work. So it's not just about people coming in, which is difficult to. You know, it's always hard to, you know, people want experience. But to get the experience, you need the job and you're kind of stuck in that. But I can't get the experience till you give me the experience. If you say you want somebody, you know, as an entry level role.

[00:34:18] But how do you get your entrance? And the industry is changing all the time, which is why I love it on a personal level. But cyber with two Rs, where I'm CMO, we started out as a recruitment company. And my CEO, when he first started the company, cyber recruitment, I wouldn't say it was just easy money, but it was one of those industries where there's always people hiring and there's a lot of good people.

[00:34:46] So, you know, to get from A to Z was a fairly straightforward thing. Enter stage left, as has disrupted everything. The two letters that we talked about. AI has flipped a lot of industries on its head. What's happening with AI and cybersecurity around the hiring side of things, again, isn't specific to the cybersecurity industry. There is a lot of organizations right now where they think, you know, they're going through the whole, oh, we can just replace this function with AI.

[00:35:16] Yeah. Which is not always true. And I've seen people already start to backpedal on that from a, OK, it's actually doing what it's supposed to do. So there's a disruption happening of businesses are trying to figure out what they're supposed to do and are being told, oh, yeah, just throw more credits at the problem. And, you know, AI will take care of it.

[00:35:40] That with it in itself, you know, the Tuesday, it was actually a weekend, I think, in February where everyone became a developer. Where you could start, you could start easily writing agents, which is cool, right? Let's take away from the fact that there is a lot of cool stuff you can do with AI. You'll prize my lovable out of my cold, dead hands.

[00:36:02] But at the same time, what's being met, it's creating this huge, huge security war zone, really, that because, you know, people aren't thinking about, again, back to the IoT thing I said. They're not thinking about securing it. They're thinking about, cool, what can I do? But it's creating a much wilder landscape for security professionals to have to defend. Yet, the hiring market is in flux right now because of the whole, you know, what can I replace with AI? What can't I?

[00:36:33] I've never known it be like this. It's really, really strange at the moment. Again, seeing amazing people struggling to find work, but the skills are needed. And the skills that are needed, even that's changing at speed. I mean, if you ask for it, it's an AI security person with 10 years experience. There are some out there, but there's not very many. I mean, a very, very small amount.

[00:37:01] So the need to secure things, I think, has never been bigger, wilder and more different than it's been before. The skills that people need to be able to do that. There is this huge learning curve that people have been going on to, you know, that's going to your AI security certs. AI is evolving at speed.

[00:37:25] And employers, even when they are looking for people, they're not, this has been a problem for years in cybersecurity, but for talent acquisition people especially, what they're actually looking for or being told to look for is changing at such pace. Like for them to keep up and understand, you know, is this person A any good or is person B the better one? They don't know. So, and it's what was true yesterday may not be true today on that front.

[00:37:54] What I said at the beginning, though, some things have changed. Some things have stayed the same. Yeah. I did a talk on this recently with my fiance. We were in Vegas talking about AI security and everything is, it's all different and it's all terrible. And, you know, like the vendor FUD machine is in full, full loud mode right now. Some of the things haven't changed at all. Data is still data.

[00:38:22] So having a security program where you're actually thinking about what matters to your business, where is my data, who has access to it. A lot of these things have not changed as far as whether AI is there or not. Like the existence of the artifacts you have to protect or the systems you have to protect, they're all still there. What's changed is the speed at which things can access them.

[00:38:46] And the speed in which people can come up with new exciting ways of doing that. You know, we got this far without saying mythos, which is quite something. But the principles in many ways haven't changed as far as from a security point of view. So I think getting back to that is super important.

[00:39:11] What's changed though as well, where this speed thing has come in and the ability to make mistakes at speed, which is basically AI, is when you said you've been doing these checks and balances that maybe your little checklist for pick your compliance of choice has said or the auditor said, you can find ways of proving you're doing them. AI has kind of ripped the band-aids off there a lot. So saying you're doing something and actually doing it, you might not come unstuck in the old world. You very much will now.

[00:39:42] So hiring for the important things to your business hasn't changed. The skills and the mindsets is where things are different. I want to do a little shout out to an organization I'm involved with called The Hacking Games, which is super cool and I'd recommend people go and have a look at it. That could be its whole own podcast. But what they're working on is helping people with non-standard backgrounds and their roots into cybersecurity.

[00:40:08] Because I gave the Einstein quote earlier that everyone uses about, you know, over and over again. There's a better one, actually, is that you can't solve a problem with the same mindset that created it. Yeah, yeah, yeah. And what Hacking Games is doing is actually finding folks with, you know, they haven't got the cybersecurity degree. They've actually been at home tinkering and they've been playing games online.

[00:40:34] But they've been pulling stuff apart and seeing how it works and then putting it back together again or trying to get it to do new stuff, which is actually that's hacking. The good side of hacking is just curiously breaking things and finding new ways of things to do things they're maybe not supposed to, but not necessarily maliciously, right? Yeah. So the hiring model for cybersecurity, I think, has fallen down repeatedly over the years. If you keep putting the same job description up or you just keep hiring your employees' mates that think the same way,

[00:41:04] you're not going to find new creative ways of solving problems. So my big message is to change how you cast the net, change how you maybe think about the jobs you're hiring for, and maybe like sit down in a room and go, actually, you know, what is the problem we're trying to solve? Because we've been trying to throw the same solution at something for a very long time. The problems are changing. So the way that you solve them has to change. There you go. That's my pragmatic moment.

[00:41:33] On the back of everything you've mentioned there, I was reading that Cyber2Oz is building a professional network specifically for cybersecurity people. So I'm curious, when you went out to do this, how do you create that useful community without allowing it to become another noisy sales channel, which we've all seen on some of those other platforms? Yes. Yeah. Mentioning no things in at the end, not mentioning them at all. No linking required there.

[00:42:03] I remember when that platform was really good. Yeah. We were using it to connect with people. It was about the people. And it doesn't feel like it's that anymore, just generally. It's you are a marketing segment. And as a marketer trying to use it as a marketing tool, it's a bloody expensive one as well. Yeah. But you are being treated like a marketing segment ultimately. Microsoft is a subscription business, arguably. And LinkedIn is there to sell subscriptions.

[00:42:32] Other networking sites are available. So, but what's happening, and it's very easy to do this, is you're being bombarded with adverts that have little relevance a lot of the time. And they're very expensive to run, FYI. The collaboration side is, I guess, maybe if you're lucky enough for the algorithm to decide that the thing you're saying is important enough to push it back up,

[00:42:58] generally to someone who doesn't care about what you're talking about because they're not connected to you and it's got nothing to do with them at all. So, yeah, it's gone from being somewhere. Maybe you go for jobs. Maybe you go there to collaborate with people. And cybersecurity, especially, is a super collaborative industry. And we want to hear about things people are doing. We want to be able to talk to them about the problems they're trying to solve.

[00:43:21] We want to be meeting people through those platforms and having those interesting online conversations without going to, you know, Reddit is great and has its own uses, but it's different again. But for a professional platform, we made some decisions with cyber to us quite early on that I think are super important.

[00:43:45] One is that you can't post or direct message people or comment unless you've been ID verified. So that helps reduce the bots and the sock puppet accounts where people are pretending to be somebody else because they want to go, you know, either it's going to be awful to someone or, you know, maybe hide who they are and say things they wouldn't maybe say if they had their own face on it.

[00:44:10] So we built that in early as a security measure, but also as a quality measure to make sure that, you know, people know that the people they're interacting with are who they say they are. So that was important. We didn't just want to grow like member numbers for the sake of member numbers. It's very easy to get hung up on those sorts of metrics of like, oh, you know, we've got 250 new people today. So what?

[00:44:37] Like a member to a platform could be lots of different things. They could be somebody hiring or somebody looking for a job on a professional platform. They could just be someone who's going to come and contribute. They could be at different stages in their careers. They could be there to mentor somebody. So we brought mentorship in as a function early on as well, because that was something we kept hearing is people, senior people want to do mentoring or junior people want to find mentors. Doing that, you can do it in a big company potentially,

[00:45:05] or you can find people through recommendations, but it's hard to find that direct route. And to be able to be matched with someone who has maybe a similar background to you that you can then it's easier to relate to, or someone's in a role that you really want to get to. And how do you do that? Talking to a real person about how they've got there is helpful. So even down to where is somebody in the world? Are there things about their life that are more related to you?

[00:45:35] So we've got this kind of mentoring match system as well for people to find the right person for them, because mentoring is ultimately a relationship and it goes both ways. And just because somebody has a job title that you might like, that's not enough to necessarily mean that they would be a good mentor for you. So that we built in. And the biggest thing I think that we've done recently, and it's in response to two areas.

[00:46:03] One has been this huge growth of everybody can spin up their startup in an afternoon, and there is a lot of need still for the security skills, even if the defined roles aren't as common as they were, and that's ebbing and flowing like nobody's business. But the need for skills is there. And the need to secure systems, answer security questionnaires, just get senior guidance at a small company.

[00:46:32] There's been no good way to access that. As long as I can remember, and this has been an issue for startups and small businesses since time, really. A lot of the cybersecurity companies, they want to go for the enterprises. That's where the money is, right? They want to go after the big companies with the big budgets, the big paychecks, who might care about their gigantic booth that cost the same as a house or had crocodiles in or whatever.

[00:46:58] But the smaller businesses who are now, I don't want to be too doomy about this, but yeah, a cyber event could send a small business under very, very easily. It could send a big business under. But at the same time, to flip it into a positive, for startups, small businesses to grow, cybersecurity is part of the cost of doing business, ultimately. And it can help you break into new markets. It can help you change your customer base.

[00:47:24] If you do want to go and sell to a specific vertical or country, cybersecurity and compliance are things you have to do. So, you know, there can be business enablers. But what was missing is how do you access that? And it could be, okay, well, I spoke to my son and he knows this guy who can come in and do this stuff. And it's all a bit, you know, it's not, can you recommend me a window cleaner? It's a different thing.

[00:47:53] And especially when we get into the realms of compliance and access to data, you want to find trusted people that know what they're doing. And if you're a small business or a startup, how do you know that that person is actually going to be any good? And there are lots of great people and companies, small companies out there. That's their focus. But they don't have to reach, you know, as these giant other cybersecurity companies do.

[00:48:19] Like if I'm Sam's little small business and I want someone to go and manage my security for me, I'm not going to go to pick huge company of choice. Like I'm just, I haven't got that budget and it's not what I need anyway, because they're going to potentially try and throw the kitchen sink at me. It's not designed for what I do. So anyway, net net, we've created this platform called Healer because nothing's ever spelt right in the world. And vowels are for other people.

[00:48:49] It includes everything. Like real words have gone away and they're too expensive for domains. The Healer is H-E-E-L-R.com. And the Heal bit is about the momentum. So this platform launched very recently. And what it does is brings the expertise and the smaller companies together so that they can find what they need. And it could be like a fractional service that they need. So maybe they need someone to be their security leader, but they don't need it full time.

[00:49:18] They need someone to do a day a week, whatever. And that's enough for them. Or they need to have their product tested before they go to market. And they need someone to go and really kick 10 bells out of it to make sure that it's as ready as it can be to go into the real world and not be this gaping security chasm the minute their customers start using it, either exposes data or allows someone to come in and steal things. Because that's not a good experience for anybody.

[00:49:46] Or worse, you know, gives access to your entire organization and then boom, no fun there. So bringing the expertise to the people who need it in a way that makes it more accessible. So we're kind of the matching layer in the middle. And I genuinely don't know why this hasn't happened sooner. But we've kind of relied on this sort of distributed, oh, somebody knows somebody or do we even need to do that?

[00:50:14] But now, you know, compliance is everywhere. Again, cost of doing business. But having access to somebody on a, it could be a project basis, on a one-off job basis, through a platform where, you know, ID verification has been done as part of this person is who they say they are. I mean, you could get, you could go to somewhere like a Fiverr or an Upwork and look for cybersecurity. I've done that. It's terrifying.

[00:50:38] But I know that as a security person, that I wouldn't be comfortable offering quite a lot of those people access to my business. But if you're, you know, excited founder with your cool product and you're like, oh, yeah, we need to get some security. How would you know? You don't. Your job is to build your business.

[00:50:59] So having, being able to get to an expert so you can carry on with what you're doing and it not just be somebody on a generic hiring platform or someone who knows somebody or worse. I, you know, I, this guy contacted me on Instagram. Like, no, no, no, please. So, and then we're also for the folks who are out there who've got the skills but are not in full-time employment at the moment or are consultants or small businesses that do this.

[00:51:28] Give some access to be able to go, you know, have those opportunities too and help people, you know, move their businesses forward. Well, I will include a link to Heeler.com, H-E-E-L-E-R. And obviously, cyber is the world's largest networking platform that is built exclusively for cybersecurity professionals. So anyone listening, they want to find out more about cyber. They want to join the community. Maybe even want to connect with you. Where should they go? Yeah. So, yeah, I mean, you can find me on cyber, which is cyberwith2r.ai.

[00:51:58] So if you have the link in there as well, that's, I'd say that's the best place to get hold of me. You know, I am on various social networks in various guises. I am on the one that we're all on. But if you work in cyber security and you've, you know, you don't have to use a necessary evil anymore. There's a better place to come to where you can collaborate and learn and not be bombarded with adverts, which is always nice. But, yeah.

[00:52:26] So if you're outside of cybersecurity and you still like to connect, I'll pass my links over. But, yeah, I'm on the Twitters as well still just about. And I still call it Twitter. But, yeah, you can grab me on LinkedIn. But, yeah, cyber2r.ai. Healer.com is where you can come and do the whole – if you either want to provide services or get them, that's where you go. And then I'm going to do a little bit of self-promotion if that's okay. Yeah, go for it.

[00:52:53] Yeah, cyberincrement.com is my company as well. So you can find me there for assistance with various things. Well, for everyone listening, I will include links to everything that you mentioned there. A poll from your Instagram. We won't put that on there. I encourage people to check it out. There's so much going on. We covered a lot in a short amount of time today. But just thank you for sitting down with me. Really appreciate your time. Thank you. I really appreciate this. And I hope this has been interesting for the folks, if there's anyone still listening.

[00:53:22] I think the most useful lesson from Samantha's story today is no single check exposed the fake candidate. It was the accumulation of small signals followed by the interviewer who trusted his gut, his instincts, and asked an unexpected question. And as deepfake tools improve, asking someone to wave at the camera will not remain much of a security strategy.

[00:53:47] But businesses do need proportionate identity checks, early video contact, trained hiring teams, secure equipment delivery, and monitoring that reflects the access that is attached to each role. And Samantha reminded us today that security should help people perform their job, rather than turning every employee into some kind of superhuman firewall.

[00:54:12] But more than anything, just a big thank you to Samantha for bringing some much-needed honesty, humour, and 27 years of experience to the conversation. I will include links to everything that she mentioned there in the show notes. But over to you, would your current hiring process have caught the candidate mentioned in this story today? Let me know. techtalksnetwork.com Remember, we have 4,000 interviews over there. Different ways you can work with me.

[00:54:42] You can leave me an audio message. But if you really want to break that fourth wall, go to the top, have a look at events, see if I'm coming to an event near you in your town. And maybe we can meet and have a hot coffee or a cold beer. But that is it for today. So I'll be back again real soon with another guest. Bye for now.