Next up, securing the future of work, we have Ben Agner. Ben from Aflac. Ben, welcome to the program.
Thanks, Hunter.
Good to see you. A happy client here of Aflac, by the way. Quack, quack, right?
Got to love the duck.
Got to love the duck. Hey, when you think about securing the future of work, what's on your mind?
Really, it's about the shift, the new normal, right? It's the fact that those physical barriers that we used to have for security are gone now, right? That trusted space that we all used to work from and we all used to come from no longer exists. Really, I think it kind of gives us an opportunity to rethink how we do security and how we secure our workforce because, fundamentally, I think that this is going to shift the way that people do work perpetually at this point.
Excellent. Yeah. Do you see any upside to this new model? Any benefits?
There definitely is. I personally work remote, right? Aflac is based out of Columbus, Georgia, and I'm based out of Charlotte, North Carolina, right? Historically, there's been some lack of communication there, right? Because I wasn't physically in the meetings. I wasn't getting coffee at the coffee pot, right? What this has done is opened up barriers, right? The things that I'm seeing more than I used to see, and I'm connecting dots better than I used to connect dots because people are shifting to the work model that I've been used to for years. Now I'm no longer digging for information. People are coming to me with it, and that's a huge thing.
That combined with, obviously, the increased funding for digital transformation and everything that's happening across the board there, it's been nice to have the purse strings open up a little bit to get some stuff accomplished we've been looking to accomplish for a while.
Excellent. Hey, Ben, stay with us. I'll circle back to you. Next up, we have Lisa Tuttle. Lisa is the CISO for SPX Corporation. Hey, Lisa, a little bit about SPX and set the context on your role.
Sure. SPX is an international company. We're an industrial manufacturer across several segments, doing mostly configured-to-order equipment, but everything from commercial HVAC to transformers to a segment we call detection and measurement, which is obstruction lighting, underground utility location, transit systems, and drone detection.
Wow. A global company, right?
Very much so, yeah.
Interesting. In this new work-from-home environment, what are some of the strategies that you've instituted, and what's the success been?
Actually, it was a fairly smooth transition. We were fortunate in that last year, we started shifting much of our security endpoint protection to a cloud solution, that was ripe for remote work capabilities, that off-network protection that we were now able to provide outside of VPN. That was a really big win for us. We're also a company who does a lot of M&A, that was another driver for getting us to more cloud-based solutions, when we want to integrate networks, we're not waiting for several months before we feel that full connection to the network can occur. We're leveraging a cloud solution to provide immediate protection.
That's amazing. Any thoughts regarding this pandemic helping you drive innovation with the business?
Absolutely. While there's certainly Zoom fatigue, the adoption of it has been great, in a way that I think we would never have realized had we not all been in this position. The collaboration has definitely improved. People across our businesses who I've worked with a lot of years via email or conference calls, all of a sudden, you're having these face-to-face conversations. So much so that I've even established a relationship with some folks in the business where we do once a month an accountability check. How are we doing maybe on a specific project, how are we doing just from a leadership perspective?
Interesting stuff. Thanks so much, Lisa, for coming on the program. Stay with us. I'll circle back to you in just a minute. Hey, next up, Michael Piacente. Michael's a partner at Hitch Partners. Michael, welcome to the program.
Hey, Hunter. How's it going? By the way, that was probably one of the best examples or explanations from the [VD] that I have heard on that topic.
Oh, you agree?
Absolutely. That was great. I actually wrote everything down.
Very solid. Yeah,
Yeah, that was great.
Good thought leadership. Thanks, Mike.
Yeah.
Hey, when you think about it, you're the one outlier on this panel, by the way. Michael's a top search exec. You guys might want to take a note of what he's about to talk about. What are the trends, Michael?
Yeah, I think, well, first of all, Ben and Lisa, great to hear your stories. It certainly resonates with what we're seeing on a kind of global level. We focus on cloud-based companies, specifically companies that are cloud-native or cloud-first, that's really our niche. Being a niche player in that, we've seen kind of a tenfold increase in cloud solutions, not just companies putting their infrastructure in the cloud, but just really the productivity and collaboration tools around that. Specifically companies, and I think Lisa kind of pointed out, is getting closer to the business and also getting closer to product, and being more involved in the product innovation. If you think about a lot of enterprises over the past nine, 10 months have become larger software development companies than they were just a year ago at this time.
They've always been developing technology, but now it's at a totally different level. This opposition to digital channels or tools has really been waning, we're seeing much bigger emphasis and a reliance of cloud security. That's probably the biggest single area. The other thing that the pandemic has really driving the future of work is around hiring and management practices. If you think about the CISO and the CIO, during this pandemic, they've really been the two key hiring managers and, in fact, many are the only hiring manager for strategic positions in companies. We're seeing many of the go-to-market functions sort of shutting down or freezing. The CISO, for instance, has still been hiring at a rapid pace. How they're doing it, they're not actually meeting their candidates, and the candidates are not actually meeting them.
They're not enjoying this cultural connection of walking into an office and feeling like they belong, and the same thing for the hiring managers. They've really had to adjust to that. We've seen some really interesting techniques. Same thing goes on the actual management of teams. Spending a lot more one-on-one time, spending a lot more time with the vendors, hearing presentations. I think everything around these two areas have really intensified and changed in 2020, and for the most part, for the good.
Pretty exciting time, wouldn't you agree, Michael?
It is. I've said it before on your channels. I think it's a strange year for everyone, but for CIOs and CISOs, this is definitely a golden age.
The notice, the level of communication, it's very exciting. It's going to continue, and I think we're going to just try and move on.
It's the time, it's the year of the CISO and the CIO being the rock star, right? Ben, you want to jump in on that one?
Absolutely. I work heavily with our subsidiaries as well, we kind of use our subsidiaries as sort of incubators for technologies and security plays and some of the more emerging tech. Prior to coming onto Aflac corporate proper, I was the head of security for one of our subsidiaries here in Charlotte called Empowered. They're a software service company, super agile, super fast, and have some very interesting technologies. We were able to implement Zero Trust, BeyondCorp, whatever you want to call that three, four years ago. Looking at what their response to the pandemic has been, it's basically just been business as usual. The security controls haven't changed. We know what the users are, the user experience hasn't changed.
The only difference is that instead of them sitting in three-person pods doing their standups, they get on a Webex call or a BlueJeans meeting and go around there. A RingCentral. It's been very interesting to see us be able to model off of some of those incubated companies for what we're looking to do for Aflac corporate proper. We tear down the global barriers that we've got, as people are able to work kind of seamlessly across time zones and across the globe, we're able to take those models that we've had previously and kind of implement them across the company.
Thanks, Ben. What's your stature in the company in terms of, or your position about getting buy-in for everyone being part of the security solution? You can't possibly do it yourself. It's really building a team of warriors out there helping keeping the enterprise safe and secure. Ben?
Absolutely. We've been shifting toward the DevSecOps model for years. That's really been an enabler. We work very closely with digital services and the teams there. Even at the incubated company that we were talking about, Empowered, they don't have a traditional security team to speak of. It's all just kind of integrated pods and everybody talks to everybody else. It's not about, "Hey, security will get that handled." It's about security ownership across the organization, I think people are kind of seeing that now as it's brought more to the forefront, that digital enablement just kind of requires security from the forefront.
Ben, I love winning, more than winning myself, I love having clients and people in the network win. Really demonstrate amazing results and impact in the enterprise. Lisa, when you think about you're building a culture of people that are on board helping to keep the enterprise safe and secure and educating the C-suite and the board, what do you think about?
Well, part of it's learning to speak their language. We're so close to the tools, sometimes we forget how to create that walk or that journey for them. One of the things I've always believed is if you want somebody to be your partner, you have to create a win for them because there's an inherent, probably internal reaction that, "Ugh, security. It's just going to be more that I have to do that I don't see value from." Where you can create those openings, whether it's a compliance regulation, a customer request, something that's driving a need to get you to the table, I think that's the beginning of that journey. The board wants to hear more now. Like you said, it's kind of the golden age for the CISO right now.
Everybody's got their ears up, how you deliver that message, for better or for worse, is going to determine, I think, the effectiveness you have. You want to be that seat at the table. For compliance, there's been some IoT laws that California passed. That was an opening in with our development team to say, "Regulation's coming." They don't want to have to be the expert in that, use that opportunity to learn about what they're doing, what their roadmap is. Help promote a little bit. "Oh, did you know part of your shared service includes we can do penetration testing, we can do vulnerability scanning?" Things that, again, they may have always considered us the back office corporate people, now helping them understand we're really there to be the front lines with you.
Interesting times, right?
Yes.
Do you get called into the C-suite much to explain what's going on?
I do. I have a regular quarterly cadence of meetings with them, as well as with the board of directors. Again, a large shift over many years ago when I started in security, those opportunities weren't being asked.
Excellent. Good job, Lisa. Awesome. Hey, Michael, you have an annual survey that you're pretty fond of. What are the trends that you're seeing out there in terms of hiring?
Yeah. First of all, I wanted to just point out, Lisa, you're spot on for what we're seeing. I'm based in California, and we're always messing things up with compliance and governance standards. You're welcome, the rest of the country. No, that was great. On the hiring front, we have our 2021 just getting organized. The big emphasis this year on our compensation, it's actually a reporting structure survey too. One thing we found four years ago was that CISOs weren't quite sure what they were supposed to be making, because it was all over the map, and they weren't quite sure where they were supposed to be reporting, because that was also all over the map. It's only gotten more intensified and obscured in 2020. I think we'll see that trend until it settles down a bit.
The main focus that we have for this year's study, which I'm happy to share with everyone, is around CISO protections. One of the big trends right now, I think probably the last seven or eight searches we've had some level of pre-negotiated severance, some level of double trigger, forward vesting in the change of an event on equity, RSUs or others, or options. Then the other piece was ensuring that the CISO and/or the CIO are placed on the D&O insurance. These are requests from the community, and they're very serious about it. I think the days of the CISO and CIO coming in and sign off on this FedRAMP or SOC 2 or ISO, and you may be the sacrificial lamb of the business are no longer. I think we've seen some really interesting high-profile situations.
That's really the emphasis on this hiring trend. I think in others, we just mentioned it earlier, but we're seeing a rapid increase from the enterprise. We see it on the startups, which we work with, but on the enterprise, looking around to Ben's point, looking at putting more structure around what was maybe a kind of a grassroots DevSecOps environment, now becoming more of the enterprise way of going and finding that clear cloud leader, cloud security leader, someone that can look across architectures and really describe the business risk. We're seeing that as a focus area as well. I think the other thing is on the hiring, kind of on the soft skills, the last piece I'll end with is, there's three distinct requirements that we're seeing in interviews.
One, how are the CISOs, the CIOs dealing with a new level of conflict as they move up the chain in the communication process to the board, to Lisa's point, on the C-suite? What's that level of conflict? How do they narrate and almost be a referee of that conflict? It takes a lot of focus on that. The other one is just really knowing your audience. The audience has shifted quite a bit just over the last 18 months, specifically since the pandemic started. Knowing what level of audience, you could walk into different meetings and have a variety of audiences. The last one is just really understanding your level of humility. It's no longer about we are going to implement something and everyone's going to just adopt it. That really takes an enormous amount of awareness, security training, and other tools.
The humanizing factor for the CISOs and the CIOs right now we're seeing come up in new kinds of interviews, which is pretty fascinating.
Hey, Michael, one quick question, I hope you have a quick answer here. How important is it on the way in negotiating stock, equity, as well as a change of control agreement? Is it important?
I would say that today it's almost critical. If you think of companies today, especially startups, you're basically being asked as an executive, let's say you're coming from an enterprise into a budding startup. You're being asked to leave money on the table, where's the delta coming up from? It's usually coming in an investment in the company's equity over a three- to four-year period. Really negotiating what that looks like and making sure that you really are seeing a fair negotiation, but also making sure you're protected in the change of control. CISOs and CIOs are sometimes the first to go in a replicated environment. Making sure that what you started building a couple of years ago, that you at least have the opportunity to make your own choice of exit as opposed to being absorbed somewhere else.
I think there's just so much
I don't want to accentuate any fear there. I just wanted to punctuate that. I think that's an important idea in one's career ascent to have that ask in the mix, right?
CISOs and CIOs are builders, they're problem-solvers, they're also very good people, and they want to do the right thing for the organization. They're really there to help to really solve the most complex problems. They want to be in an environment where they're going to do that. Once they get into a maintenance mode, or something that's more neutral, they want to look out for the next opportunity to build the next thing. Pretty natural behavior.
Excellent. Hey, Michael, thanks for the program.
Yeah.
Ben, final comment around the changing environment and strategically things that folks should have on their radar?
I think we've pretty much covered it, right? Look at Zero Trust if you haven't. Look at your cloud programs and make sure that security's involved in that. Look at your people and make sure that your workforce is happy, and that they're working, and that they're doing so securely.
Exciting time to be in tech, Ben?
Very exciting time. Yes.
Very cool. Excellent. Lisa, exciting time to be in tech?
Yes, more exciting than ever. 20 years ago, wouldn't have imagined where we would be today. The career has definitely changed.
Awesome. Hey, Lisa, great to have you on the program. Thanks, Ben. Michael, always good to see you. Hey, stay tuned for this next segment. I think you'll like it.
Thanks, guys.
Thanks, Hunter.