It was quite a turnaround. Honestly, it was not that difficult.

Turning around a failing customer relationship is one of the more rewarding things you can do as a founder. It is also relatively easy, if you have a growth mindset and can handle some pain.

Let’s look at how you can turn the most spittle flecked, rage monster into a champion for your company.

For Sale: Pain Relief

While your company may sell products and/or services, that is not what customers purchase. Customers buy pain relief. They have pain(s), your products and/or services will make the pain(s) go away.

Customer pain comes in many different flavors, such as inefficiency, inconsistency, human errors, excessive costs, or a barrier to progress. In 2011, my customer needed better security scanning to pass audits and win business. The lack of security monitoring was a barrier to opportunity. Opportunity barriers are especially painful to companies. Companies spend millions (billions?) a year to remove these barriers since they limit revenue and growth. For example, the entire cloud computing industry is one giant virtualized ibuprofen that makes deploying applications easier.

This customer hired my company for pain relief. We were doing the opposite, causing pain. The customer did not care about our internal problems, inexperience, or the consultant’s incompetence.

Consequently, to make the situation right, I needed to make a commitment.

Growth Commitment

The consultant assigned to the project got overwhelmed. Rather than ask for help, he blamed the customer, the firewall manufacturer, the sales team, and so forth. More specifically, he approached the project with a fixed mindset. He believed that since he was unable to do the work, it was therefore impossible, and the company should never have sold the customer the service in the first place.

I fired the consultant and took on the project myself. I approached the issue with a growth mindset: there was a solution, I merely did not know it, yet.

I did lot of reading and tinkering. After a few long nights, I figured it out. While it was difficult, it was absolutely possible. When the firewall operated as expected, I had a great sense of accomplishment. The customer was delighted. The pain was gone.

If you want to turn around a relationship, you must commit to relieve the pain. Otherwise, what use are you? Incidentally, this same concept applies to friends, neighbors, spouses and most relationships. If you want rewarding relationships, you need to commit.

Your Value is Your Commitment

In my recent blog, Should You Fake It Until You Make It, I discussed the importance of commitment when building a business. Customers judge their vendors based on their ability to uphold commitments. Likewise, people judge you on your ability to meet commitments. If you can make and keep commitments, you are going places. If you blame others, make excuses, and play the victim, you are going nowhere.

Furthermore, you cannot push your problems on to your customers. If your team lacks the skills, they need to acquire them, quickly. If your product cannot do what it says, then you need to fix it, now. If your salespeople overpromised, then you need to overdeliver. Once the deal is signed, you cannot back out of that commitment. You also do not get to re-write the story to suit your inability to handle learning.

As a founder, you must stomp out toxic, blame-culture at the first signs. When your people are blaming others rather than solving problems, the company is on a bad path. Furthermore, you must uphold and nurture a growth mindset. For more information, read Carol Dweck’s book Mindset or FS Blog has a good summary.

Focus on Pain

Lastly, your entire company, must focus on how you are reducing or eliminating customer pain, not causing it. I have sat in countless meetings (in my own even) where people blathered endlessly about all their grandiose ideas, telling one pointless story after another, never once addressing how they are going to reduce a customer’s pain. You are either reducing pain or increasing it. Be on the left side of that equation.

The simple formula to turn around irate customers:

• Listen to the customer and their pain
• Ensure every aspect of your business understands customer pain: sales, marketing, messaging, pricing, delivery, customer success, support, etc. Nobody gets to avoid or ignore the customer’s pain.
• Require a growth mindset. Stomp out blame.
• Make and meet commitments.

It really is that simple.

What do you think? I love feedback, even the negative kind. Email me at andrew.plato@zenaciti.com with your thoughts, suggestions, or insults.

The post Customer Pain appeared first on Zenaciti.

I am not the only one noticing all these stressed out CISOs. Here are a few recent stories:

• CISOs Have the Toughest Job in the World
• CISOs Struggle to Cope with Mounting Job Stress 
• Average tenure of a CISO is just 26 months due to high stress and burnout (which cites the same report as the first item)
• I Was A CISO for Six Years — Here’s Why Burnout Is Such A Problem 

I spent time lurking in CISO hang outs recently.  I heard a lot of stories that all centered around a common adjective: frustration.  CISOs are under tremendous pressure to keep their organizations safe.  There is too much to do, too little time, and too few resources.  Moreover, the complexity of modern enterprises coupled with the persistent threat of ransomware attacks makes CISO jobs profoundly difficult.

However, frustration is only part of the story.  There is another adjective I heard frequently: hopeless. One CISO summed it up succinctly: “they blame me for everything that goes wrong.”

Yeah, I know how that feels.

Maybe this is why many CISOs get the title Chief No Officer slapped on them?  Faced with hopeless odds of success, it is easier to say no than to fight to make things work.  I used to think CISO that did this were weak leaders.  However, the more I hear them talk, the more I think they are stuck in a classic Kobayashi Maru (a no-win scenario). No matter what they do, they get blamed.

It works something like this:

1. Company hires a new CISO
2. The expectations are ludicrous:
   • Executives and board members expect the CISO to protect the business with absolute precision and perfection.
   • Other departments expect the CISO to implement security without disrupting any existing business functions.
   • Third party vendors expect the company to align with several intricate compliance regimens.
3. The CISO implements a plan.  There are two common outcomes:

The CISO implements effective security controls: 

• • • The controls fail, company gets hacked  > CISO blamed and shamed
    • The controls work, but it causes other systems to fail > CISO blamed and shamed
    • They work, security becomes routine and dull. Executives wonder why the company spends so much on security > CISO blamed and shamed

The CISO is unsuccessful, security languishes: 

• • • Company hacked > CISO blamed and shamed
    • Company somehow does not get hacked, executives wonder why they have a CISO and no security controls > CISO blamed and shamed
    • Company fails a compliance audit > CISO blamed and shamed

5. The CISO quits or is fired
6. GOTO 1

There is no way to win.  Mistakes in security (and technology as a whole) are common.  Since many CISOs rose through the ranks from technical roles not business schools or investment firms, they usually lack the skills to navigate the petty politics of organizations.

When people are trapped in situations where they feel they cannot succeed, they become bitter, resentful, and eventually give up.  Why work hard when you will be blamed for every problem, whether you caused it or not.  I once witnessed a company put their entire environment at risk, because a vice-president wanted to spite the security team for using a different cloud service provider.  Eventually, the CISO tired of these antics and left the company.

It is unsurprising then that many CISOs feel frustrated and are quitting. With that in mind here are some ideas for CISOs stuck in a frustrating job:

• Adapt Communications: Each person you interact with has a particular communication style. Take a moment to consider how people will listen to you more effectively.  Some people prefer to get right to the data, while others may require a gentler touch. Remember, you are responsible for being heard.  It is not the listener’s responsibility to understand you.
• Stay Strategic: Play the long game.  Have a plan and stick to it. Avoid getting mired down in petty squabbles. Keep reiterating the value of security.
• Snuff-out the Gaslighting: One-way bad leaders distract CISOs is with irrelevant questions and faulty logic.  For example, they may use anecdotal reasoning, where they recite some situation from their past an expect you to replicate that when you know it will not work.  Listen, show respect, placate where necessary, but stick with your plan.
• Arm Yourself with Data: When the blame starts flying, have data on your side.  Data might not save you, but it is a powerful weapon against the forces of idiocy.  Make sure goals, plans, and commitments are documented.
• Stay Off the Range: Security is an easy target for developers, IT, finance, HR…everybody who needs a scapegoat.  Do not allow your team to be unprepared.  Be on top of your goals, metrics, and plans.
• Hold Vendors and Service Providers Accountable: Do not allow the companies providing you products or services to skip out on their commitments.  If a vendor promises you something, get it in writing and require them to deliver.  This is how you can show strength, resolve, and discipline.  Be firm, do not be a jerk.
• Battle the Bullies: You may have board members or executives who think they are security geniuses because they have money and authority.  These people are often deeply insecure bullies.  Keep your discussions with these people focused on threats.  Talk about the competition, ransomware, hacker groups, and all the catastrophes that will unfold if security is sidelined.  Bullies innately understand threat.
• See and Sell a Brighter Future: It is difficult to scapegoat a person who speaks of a brighter, better, and more prosperous future. While you may need to pound the bullies on the board with fear, spread optimism, vision, and hope elsewhere.  Optimism is attractive.

While I cannot fault anybody for giving up when things feel hopeless, you must take something from each experience that helps you in the future.  You might not make a difference in every place you work, but every place you work, can make a difference for you.

However, I would urge all CISOs to hang in there.  With persistence and perseverance, you can make a difference.  Lastly, make sure you mentor and train others along the way.  Leave your employer in a better place then when you got there.  The people you mentor will support you.

The post What Is Wrong with the CISO? appeared first on Zenaciti.

These are all reasonable explanations, yet they ignore the most obvious one: outlandish valuations. Is a startup with $5M in revenue worth a billion?

No…and to think otherwise is outright delusional insanity. However, I do not fully understand the absurd valuation math of Silicon Valley. It seems that if an investor believes a valuation is true, then it is.

Keep in mind, this is the place that minted valuation absurdities like Theranos, Webvan, and (here is an oldie but a goodie) Cue Cat. Yes, that Cue Cat. In fairness, for every Cue Cat that Silicon Valley funded, there are dozens of genuinely innovative companies that contribute to the forward progress of humanity.

Whether it is absurd valuations or the lack of baby formula, a reset for startups seems inevitable. So, what kind of evasive maneuvers can startups take to weather the coming dark times?

Vision

To paraphrase the great philosopher Freewheelin’ Franklin: vision will get you through times of no customers better than customers will get you through times of no vision.

Vision is a description of the future. A well-defined, well-articulated bright future inspires hope. Hope that the company will successfully navigate through the darkness. Hope that rewards are attainable. Hope that all the struggle, toil, and stress will be worth it and have meaning.

To paraphrase Jyn Erso, startups are built on hope.

To promote a brighter future, startup leaders must emphatically promote the company’s vision. To do that, answer four questions:

1. Why does the company exist?
2. What problem(s) does the company solve?
3. What are the values of the company and its people?
4. How can people find meaning and relate to those values?
5. Where is the company going?

Do not make your vision about money — ever. Money is a weak motivator. Moreover, nobody cares about making money for the investors or founders. Vision must be about something people can genuinely care about. Money must be the result of staying true to the company’s vision, values, and mission.

Vision gives people purpose. Without purpose, employees invariably ask themselves “why am I here?” It does not matter how smart you are, or how many big shots you know, or how much money you have in the bank, without purpose people have no reason to stick with the company.

Vision will get you through the downturn. However, words alone will not solve everything. There are some other ways to stay on target.

Automate

One of the many ways we sap meaning from people is to put them into roles with repetitive, boring work. Automate repetitive tasks and promote the people into more meaningful work.

The mere act of shifting people’s focus from performing a repetitive task to automating that task, provides a more satisfying job. Moreover, one a task is automated, your products and services become more reliable, scalable, and valuable.

Put that Coffee Down

Maybe you need Alec Baldwin to yell this at you: Always Be Closing. You need to sell, sell, and sell some more. To do this, you must arm your sales team with the resources they need to effortlessly demonstrate your company’s value.

For example, all salespersons must be able to expertly demo your products at a moment’s notice. If you sell services, you must have a library of sample output (reports, content, etc.) that demonstrate your capabilities and expertise. Demos and samples are effective ways to communicate your company’s competitive advantages.

In my experience, the only way out of a hole, is to sell your way out. There are only so many cuts you can make to staff or spending before the company becomes ruined. Investing in sales and marketing is the ticket out of the dark times.

However, before you charge ahead, be clear with your sales and marketing teams that results are the only metric that truly matters. Effort is expected, but results are what they are measured on.

Product Improvements

You know the next valuation is going to be low(er). So why not actually improve your app and have something more valuable? Downturns are an excellent time to clean up all the crap in your app that is holding you back. Quit dickering around with every dumb customer feature request and go back and fix the big stuff.

Emerge from the darkness with products and services that are more valuable, and therefore can command reasonable valuations.

Repackage

When times are tight, buyers go bargain hunting. They expect every app, service agreement, and subscription to go farther, offer more, and solve more problems. If you are a special little unicorn app that only works in a narrowly defined set of requirements, then it is time to repackage yourself and broaden your appeal.

Build packages that solve entire business problems all in one. Moreover, reprice everything into monthly subscriptions, usage-based billing, or extended terms to make payment easier on customers.

Partner Up

Rather than be a lone sinking ship, partner up with other sinking ships. This also can help with repackaging. If you can bring partners to the table that fill gaps in your offerings, then you have more to offer.

However, before you sign up a bunch of partners, make sure you understand how each partner makes money. Each partner must be able to see how they can benefit, otherwise it is not a real partership.

However, be honest with your scale. A $5M startup is not going to have the market reach of a titan like Cisco or Microsoft. If you partner with a bigger player, then you need to accept the inherent unequalness of the partnership.

Be Brutally Honest

Unfortunately, tough times mean doing more with less people, resources, and time. Layoffs, cutbacks, and delays always feel bad.

Do not sugar coat the unwelcome news. This only makes you look foolish and desperate. Also do not make it about you. Be honest about the changes. Show remorse but show resolve as well.

The intent is to show you care about people, but you are committed to staying the course and seeing the bad times through. This is why vision is so desperately important in bad times. Layoffs and lost deals are the ideal time to double down on the company vision, values, and mission. It pulls everybody back together and recenters them on why the company exists.

Conclusion

Do not give up. Downturns are inevitable. Yet, nothing bad lasts forever. Startups can survive (even thrive) in bad times. Moreover, as the Wired article points out, troubled times can mint stronger companies. The key to coming out of this storm is keeping your eyes on the prize.

To quote one of the greatest philosophers I knew: perseverance furthers.

The post Surviving the Startup Crash appeared first on Zenaciti.

“At least I did not kill my startup like that!” one founder exclaimed.

This set off a discussion about all the ways startups collapse. Stories of failed startups are uncommon. However, for every sensational fail like Theranos, there are many more that simply fade into irrelevance. After a lengthy discussion, we came up with ten things that can kill a startup, as well how leaders can commute a startup death sentence.

1. No Sales

You can have the greatest idea in the world, but if nobody pays money for it, you might as well throw it away. Startups that cannot sell are startups that cannot survive.

Solution: Always be closing. Sales must be the top priority for everybody, especially the CEO.

2. Angry Customers

While customers of startups often know they are taking a risk, that tolerance has limits. Unhappy customers spread bad news quickly. When every sale is important, angering customers with poor support, unfulfilled promises, or unfixed bugs can be devastating.

Solution: Dedicate a person (or team) to customer success. Have a mechanism to capture and respond to customer feedback.

3. Irresponsible Cash Burn

Most startups burn cash. Not all cash burning is good. Burning cash to hire (the right) people or procure necessary supplies is good. Burning cash on ludicrous parties, lavish offices, or expensive vendors not only shows a lack of leadership, but it also shows a lack of control.

Solution: Aggressively scrutinize spending. Implement spending controls to prevent any executive (including the CEO) from spending more than a set amount.

4. Lack of Product (Management)

This may seem obvious, but plenty of startups get funded based on innovative ideas, and then faceplant when they confront the reality of product development. Even releasing flawed products, that are fixed later, is better than releasing nothing.

Solution: Hire a product manager, set goals, and meet them. Do not allow perfection to become the enemy of good (or even mediocre) product.

5. Internal Strife

It is profoundly difficult to build a product, bring it to market, and convince customers to buy it. It is impossible to do those things if the people in the company are going in different directions. Unifying everybody around a common set of goals and values is mandatory for success. Equally important is getting rid of the people will not get on board.

Solutions: Provide leadership coaching for executives. Require unity to a strategic plan a condition for executives to remain employed.

6. Financial Shenanigans

Most founders find budgets, sales forecasts, and unit economics boring because…well they are boring. However, they are also supremely important to running a company effectively. When leaders begin messing around with the finances, to either hide failure or reassure jumpy investors, there is nowhere to go but down.

Solution: Empower finance team to report independently to the board. Perform annual, independent financial audit.

7. Outmaneuvered

When an innovative product emerges, competition is inevitable. Startups that become stuck on early success and fail to keep pace with their competitors can get outmaneuvered and rendered irrelevant. Moreover, if a large competitor (like Microsoft) enters the market, they can outspend smaller players resulting in the same result.

Solution: Pay attention to the competition and meet those product development goals.

8. Failing to Plan

While it may be a cliché, failing to plan is a plan to fail is an accurate statement. It is easy to become distracted with everyday struggles and problems. Moreover, it is equally easy to dismiss planning as overly formal, especially in fast-moving DevOps companies that promote a “fail fast” mentality. The purpose of a business plan goes beyond formality. Plans set boundaries and keep the company focused. Moreover, they prevent any one person (or team) from redirecting the company into some other product or effort.

Solution: Document an annual strategic plan. Get buy-in from the team. Enforce it. Stick to it.

9. Arrogance

When money floods in, some leaders transform into lunatics. This can lead to spectacular flameouts, such as WeWork. When arrogant leaders fancy themselves as prophets, the company is on a one-way trip to an early grave.

Solution: Do not enable craziness. A healthy dose of skepticism and reason can quickly defuse a lunatic.

10. Lost Vision

Among all the things we discussed, the most insidious killer of all startups is one of the most difficult to detect: a loss of vision. Vision is what a startup hopes to achieve and become. It is the intangible why of a company that Simon Sinek references. Large companies with an established customer-base and entrenched internal power structure can stagger along for decades with no vision. Startups cannot. The company’s momentum, enthusiasm, and focus all depend on the vision. Many startups lose vision when the founders exit, or the products fail to gain traction in the market. Immature leaders will dismiss talk of vision and core values as “touchy feely” nonsense.

It is vitally important for startup leaders to cultivate, communicate, and command a clear vision, mission, and core values. Many of the other items on this list can trace their origin back to the loss of vision within the company.

Solution: Document the company’s vision, mission, and core values. Refer to them regularly.

Conclusion

Startups are fragile things. Unlike big companies, which can weather mistakes, startups have less of a safety net. The primary advice this group of founders had was simple: stay on target. Startups routinely get lost and distracted along the path to success. Whether you lead a startup or work at one, stick to a plan.

Moreover, money is seldom why a startup fails. Rather, its leadership (or the lack thereof) that causes the chain of events that lead to lost money, lost deals, and lost opportunities.

The post How to Kill a Startup appeared first on Zenaciti.

When people work face to face, trust builds naturally.  Casual interactions, body language, and frequent socializing strengthens the bonds between people and therefore builds trust.  Consequently, leaders who were able to manage accountability through casual interactions pre-pandemic, lost this ability when the workforce became remote.  Since remote work is here to stay, this problem of accountability persists in many organizations.

As mentioned in a previous blog, I have been lurking in many on-line forums for leadership as well as Reddit’s (in)famous Antiwork forum.  Lack of clarity around expectations, schedules, and responsibilities is a persistent source of ire among Antiwork commenters.  In one Anitwork post, a remote worker dodged repeated, angry calls from his manager demanding he get online to finish a project, that was not his responsibility.  Likewise, in my work with other startup CEOs, there are recurring complaints about holding remote workers accountable and maintaining deadlines.

Accountability (or a lack thereof) impacts both leaders and employees.  Yet, like many other organizational problems, leaders must embody the behaviors they wish to see in others.  As such, here are ten tips for improving accountability among a remote workforce.  These tips are derived from my own experience as a founder/CEO as well as providing advisory services to other startup CEOs.

Ten Tips for Remote Worker Accountability

1. Doc It

Talk is cheap and easily forgotten.  Whenever a decision is made, an issue discussed, or a plan made, document it.  This ensures everybody is working from a shared, trusted source of information and not memory.  There are numerous collaboration tools, like Atlasian’s Confluence, Microsoft Sharepoint, or Trello which provide tools to capture agreed upon goals and plans.  For lower tech workplaces, pen and paper are equally effective.

2. Make Meetings Matter

It is extremely easy for people to waste time babbling and pontificating in meetings.  This feels like work. It is not.  Silence the babblers, stay on task, and keep meeting short.  Also, document action items from meetings, to prevent repeating the same topics in subsequent meetings.

3. Hope is for the Holidays

One of the more insidious weasel words in corporate speak is “hope.”  As in “I hope to get work done.”  When people say hope, they are avoiding commitment and passing off accountability to the whims of fate.  Stop all use of the word hope.  Require people to use the word “plan” or “intend.”  This may seem trivial, but it makes a significant difference in perception of a commitment.

4. Be Curious

If your team is missing deadlines, rather than blame, be curious. Use exploratory questions such as: “What is holding you back?” “How can I help you?” “What happened to delay the project?”  Avoid “why” questions, as they sound like blame.  Curiosity drives people to hold themselves accountable.

5. Silence Blame

Blame is a potent workplace toxin. Blame is how everybody (managers and employees) side-steps accountability.  It feels satisfying and justified to blame somebody else yet it accomplishes nothing. Shut down blame and refocus everybody to solving problems and accomplishing goals.

6. Pour on the Praise

If blame is a workplace toxin, praise is an effective antitoxin.  When team members meet commitments and accomplish goals, praise them openly and profusely.  Reward the behaviors you want, and you will get more of them.

7. Set and Respect Schedules

Have all team members set and commit to a recurring work schedule.  This not only replicates the cadence of going to a physical office, but it also sets boundaries for when meetings or quick chats are acceptable.  Boundaries that leaders must respect.

8. Open Calendars

Shared calendars are an ideal way for everybody to transparently communicate their availability as well as their work schedule.  This ensures those boundaries mentioned earlier are communicated effectively.  Communicate the importance of this transparency to the team.  Then ask the IT team to open calendars for sharing.  Establish a requirement that everybody, including leadership, is expected to maintain their calendar.  Anybody concerned about privacy issues can block out private meetings or use a personal calendar on a different platform.

9. Beware of the Likability Conundrum

Being clear, resolute, and consistent with expectations are good leadership practices.  Those behaviors will also cause some people to dislike you because they do not like being held accountable.  This is the Likability Conundrum.   You can be an effective leader, yet people will still dislike you. When the team meets goals, produces results, and receives praise for the success, the dislike caused from being held accountable will fade.

10. Cameras On

When you can see a person’s face, you communicate more effectively and build trust more naturally.  Require cameras on for all meetings.

Conclusion

The core concept of holding remote teams accountable is increased formality.  When people work face-to-face, they build informal avenues of accountability.  Remote workforces demand a more formalized approach, especially when it comes to documentation.

Moreover, formalized practices also set clear boundaries.  This allows both leaders and employees to work within established rules and expectations, while also allowing people to leave work behind when the logoff.

Even with the pandemic subsiding, remote work is here to stay.  As such, rather than forcing people back into the office, update your accountability practices to work for both remote and on-site people.

The post How to Improve Remote Workforce Accountability appeared first on Zenaciti.

However, security automation is a daunting task.  Cloud service providers, security vendors, and consultants are all fond of promoting the promise of automation.  Yet, as teams struggle with the complexities of cloud environments coupled with the nuances of security controls, these promises can quickly unravel.  Paradoxically, a key component of security automation success is neither security nor automation, but something far more pedestrian: documentation.

To paraphrase the famous World War II general Omar Bradley, amateurs talk, professionals document.  While talking about policies, theories, and strategies for security automation are a good place to start, at some point all that promise must translate into action.

Documentation is where the promise of security automation becomes reality.  Like any complex task, security automation demands the mastery, coordination, and implementation of a disparate set of tools, techniques, and talent.  On rare occasions, a single person can do everything and keep the details in their head.  More commonly, automation projects engage multiple people, working across multiple tools, all with multiple (competing) agendas.

Without documenting the details, you are entrusting the entire effort to the whims and memories of people, which are notoriously fickle and fleeting.  With documentation, you can unlock some important powers that fuel success.

Documentation creates transparency and accountability

Documentation can be shared, reviewed, and referred to later.  Documentation puts ideas, plans, issues, and decisions into a tangible form.  Moreover, you can hold people accountable to what they wrote or what was shared with them.  It is much more difficult to hold people accountable to what they said, since they can deny it or dismiss it.

As the pandemic has driven more teams to work remotely, old methods of accountability, such as casual hallway chats no longer work.  Documentation is the only way to overcome this loss and promote accountability among leaders and employees.

Documentation can identify confusion and eliminate it

Documenting the technical details forces the author(s) to organize and clarify their thoughts.  When other team members read the content, they may be confused.  This may force the author(s) to reorganize the content.  Ultimately the process of revising the content will help everybody, including the authors, understand the details better.

Many years ago, an employee had an idea for a security automation for the Security Operations Center (SOC).  The idea seemed innovative, but confusing.  After some high-level discussions, I asked the employee to document his plan.  In the process of writing the plan, we discovered that not only did the team lack the skills or resources to build the feature, but that the feature was also financially impractical.  The act of organizing the details into a document exposed the weaknesses in the plan.

Documentation builds upon itself

Once a plan is documented, people can analyze it, alter it, and augment it.  Documents invite improvement.  Implementing and configuring security controls requires multiple iterations of testing and refinement.  If these efforts are documented, future teams can learn from those efforts and build upon them.  Moreover, as automations are encoded into languages (like Terraform or Azure ARM templates), future security experts can update, refine, and improve that code.  Documentation inherently begets improvement.

Conclusion

It is easy to get lost among the alluring promises, strategies, and technologies of automation.  Cloud service providers like Azure and automation tools like Terraform are powerful.  These platforms can accomplish almost anything in a cloud environment.  However, the tools themselves are useless and your talent wasted if all your strategies do not coalesce into functional automations.  Much like logistics were Omar Bradley’s secret weapon to win WWII, documentation is your secret tool to make security automation work.

NOTE: Bradley’s actual quote is “amateurs talk strategy, professionals talk logistics.”

The post The Most Important Part of Security Automation is Neither Security nor Automation appeared first on Zenaciti.

However, Antiwork is only one side of the story.  Consequently, I also started lurking in a number of other forums focused on leadership, entrepreneurialism, and startup businesses.  These forums tell a profoundly different story.  While some leaders (like myself) are genuinely sympathetic to the struggles of workers, most are not.  These leaders blame everything from weak education, government handouts, and even Hollywood movies for causing workers to revolt.  They are genuinely panicked, but conceal it with rage, arrogance, racism, and many other forms of hatred.

Predictably, these leaders never blame themselves.

In the midst of all my lurking, along comes some new research from the Association for Change Management Professionals (ACMP). This article provides fascinating evidence on how toxic work culture impacts turnover. A core conclusion of this report is that companies with good cultures have lower turnover.

The ACMP research also shows that the Great Resignation defies simplistic answers.  However, among the many insights, there is a loud and clear one for leaders: workers are fed up with the toxic, American work culture. While low pay and weak benefits are undoubtedly significant factors driving resignations, toxic work culture is the real leviathan lurking under the surface.

Fixing corporate culture is equally a complex effort that also defies simplistic answers. However, one of the lessons I learned in my own leadership training was: when there is success, look out the window. When there is failure, look in the mirror. This was a reminder to reflect on my own behaviors when there were problems, rather than jumping to blame everybody else.

While a top ten list of ideas to improve corporate culture is woefully inadequate, there is only so much I can jam into a blog. With that in mind, here are my 10 ideas for leaders who want to improve corporate culture

Ten Ways to Clean Up Corporate Culture

1.       It is Not About You

I am appalled at how tone-deaf many leaders are about their own importance.  They will toss around all the big and important people they know, as if that is some fabulous accomplishment that grants them authority over everybody.  Workers do not care that you met Andy Grove at a really chic party.  Proximity to power is not an accomplishment. Bragging about your own importance only makes sycophants respect you. For everybody else, this makes them feel inferior and resentful.

Talk about the team and their accomplishments. Talk about great ideas. Talk about plans for the future. Talk about anything other than yourself, who you know, and what you did ten years ago – nobody cares.  Which is a good segue to the next item.

2.       Listen

Following from the previous item, nobody likes the blathering blowhard who talks over everybody (boy, did I learn that the hard way.)  There are numerous Antiwork posts from workers fed up with being talked down to, bullied, and ignored from leaders. In one post on Antiwork from a few months back, a young woman said she was talking to her boss about a problem with their computer system. The boss just shut her down and told her she did not understand how it worked.  Fed up with the bullying, she walked out and quit on the spot.

A few years ago, I discovered a great truth about leadership: the more you talk the stupider you sound.  Shut up and listen.  Listen to the workers’ worries, concerns, and complaints.  You might not be able to solve the problems, but listening will show empathy and build connection.

3.       Stop the Hustle Culture Nonsense

Everybody has the exact same number of hours in a day to spend.  If you want spend 14 hours a day working, that is your choice.  You cannot impose that expectation on anybody else.  It is unrealistic.

If there is a lot to do, then focus on prioritizing what must be done with the time you have. It is unhealthy and unsustainable to push people to work more hours. Even the people who freely choose to work long hours should be required to take some time off. It will be good for them and everybody else.

4.       Home Invasion

Working from home and being on-line 24×7 is now the default arrangement for many workers.  There are a lot of benefits to work from home, but there are also some huge drawbacks. One of those is that people’s work is now inside their home and invading more of their time. Going into a workplace imposes a natural barrier between work and life.  Those barriers are disappearing.

If working 14 hours a day is unreasonable, so too is expecting people to be available 24×7. Work must respect people’s time off. If you need people working at odd hours or on call, then you must hire enough to balance those demands, otherwise do not offer it.

5.       PTO is Sacred

Speaking of time off, it is precious. There are a multitude of studies that overwhelmingly prove that taking a healthy amount of time off makes people more effective as employees.

However, unlimited PTO is a lie.  Make PTO simple and sacred.

6.       It is Inflation, Stupid

People are asking for raises not because they are lazy entitled communists who hate America, but because milk, bread, and cat food cost a lot more than they did a year ago.  Blame whoever you want for this, it is a serious problem that impacts the lowest paid people the most. Ranting and raving about lazy Millennials, government hand outs and the decimation of American exceptionalism only makes you sound like an idiot.

7.       COVID is not a Hoax

900,000 people are dead in the USA from COVID. That is twice the number of US citizens who died in World War II. Protecting your team’s health is a top priority of any leader.  If you are unclear on this concept, read Simon Sinek’s Leaders Eat Last.

It is completely unacceptable and irresponsible to demand people to come to work if they feel ill.

8.       Get the Jerks Out

Nothing kills corporate culture faster than enabling or supporting bad behaviors.  A jerk employee can obliterate productivity and loyalty in mere moments. However, there is a fine line between being a jerk that destroys culture and a rockstar that defines it.  Both jerks and rockstars can have a lot of energy and ambition. Both may work hard and produce results. From a leadership position, it is easy to confuse these two.

The simplest way to tell the difference is what they talk about.  Rockstars talk about great ideas and praise others.  Jerks talk about themselves and praise those in power.  Jerks drive away good employees, rockstars drive away bad employees.

Do not hesitate. Fire the jerks. Keep an eye on the rockstars and make sure they do not devolve into jerks.

9.       Compassionate Curiosity

You want to build a healthier, happier, more engaged workplace?  Be compassionately curious.  Ask questions, seek out new ideas, and encourage people to share. Compassion builds connection with people, while curiosity drives the company’s interests forward.

We all learned this in kindergarten, and it works.

10.   People Need Purpose

One of the most common complaints from workers on Antiwork is how they feel like their job is meaningless.  Once again, I am routinely amazed at how dismissive leaders are to communicating any kind of organizational vision, mission, and values. I have observed leaders dismiss these ideas as stupid, New Age touchy-feely nonsense.

A company without vision, mission, or values may make money, but it will never make a difference.

Defining vision, mission, and values is well beyond the scope of this blog. However, the Society of Human Resource Professionals has a good primer on these concepts. The best way to build a healthier corporate culture is to define core values, mission, and vision and then strive to achieve them every day. It can provide meaning to work that may feel meaningless.

Conclusion

That last item is, in my opinion the most significant deficiency in many workplaces: a lack of meaning.  Few people work because they love what they do.  People work to feed themselves and their families.  If you look at companies which are weathering the Great Resignation well, there are some consistent themes. Obviously, good pay and benefits are part of that.  However, as the ACMP article shows, company culture has an even significant impact on employee engagement.

Corporate culture is not a pizza party, a birthday celebration, or a hoodie with the company logo.  It is the values on your wall, the mission you share, and the vision of your leaders.  If you truly want to improve culture, then:

• Stop talking about yourself or all the money the company makes
• Start talking about the mission, values, and vison of the organization, and how that solves problems and helps people.
• Keep listening to those around you and show compassionate curiosity.

The Great Resignation is many different things.  Ultimately, it might be the best thing to happen to American workplaces.

The post Toxic Corporate Cultures are Driving the Great Resignation appeared first on Zenaciti.

Zenaciti CEO Andrew Plato is quoted.

Read the entire article at CIO.com

The post Secrets of Successful Vendor Negotiation appeared first on Zenaciti.

However, not all startup pivots are as drastic as rice to Donkey Kong. Many are ordinary business model adjustments in respond to customer demand. For example, in early-2000s YouTube was a dating site, where people uploaded videos looking for love. While the dating service was a dud, the video sharing was not. 

I was a founder who pivoted my company three times:

• In 1997, I ended my technical writing business to focus exclusively on being a cybersecurity product reseller (VAR). 
• In 2013, I sold off the VAR business and changed to professional and managed services. 
• In 2017, I launched a cloud security platform service, and began moving away from professional services. 

While the company remained in the security industry, each of those changes was necessary to keep pace with shifting customer demand. Each of those changes was also excruciating. Like changing the wings of the plane in mid-flight, I had to oversee drastic organizational changes while keeping the business running and making money.

All that struggle taught me some valuable lessons. Namely, it taught me that pivoting a company is a delicate dance, on a collapsing wooden bridge, over a river of lava, filled with sharks.

In other words, pivoting a startup is not something you do on a whim. 

With the benefit of hindsight, I identified six major lessons from my pivoting experience. While I wrote these six lessons with a business leader in mind, they are equally relevant for employees enduring a pivot as well.

1. Why?

There is a reason I used the image of dancing over lava. Changing the direction of a company is dangerous. If it fails, the company collapses. Before doing or saying anything, you must nail down your reasons for doing it at all. 

When I pivoted away from the VAR business, I had powerfully precise and personal reasons to make the change. The VAR business model is profoundly outdated (I documented this in the Anitian blog, Goodbye Yellow Brick VAR). However, what truly motivated me was that running a VAR was turning me into somebody I hated: a cruel and selfish leader. 

As you move through a pivot, you will face a tremendous amount of self-doubt and detractors. You must ground yourself with a clear reason why you are making the change, otherwise the self-doubt will crush you. It will be too easy to abandon the pivot and go back to what is comfortable.  Pivoting a startup will never be comfortable, which is why you need to know why. 

Your reasons why will ultimately help you convince people to follow you into this new venture. This is why Simon Sinek reminds us to start with why. 

It helps to write down your reasons and keep them close (like taped to your mirror so you look at them every day.)

2. Where?

Once you know why to pivot, the next question is “where?” Where is the company going? 

When I changed from a services company to a product company, I spent a year talking about a new kind of security company. I laid out my ideas in presentations, articles, and goals. This vision of a new company, with a new set of products and services helped guide employees, partners, and eventually customers through the change.

The ultimate question you must answer is: after the change is made, what will the company look like? Who is employed in this new company? What do they do? How do you make money? Who are your customers? Why do your customers buy? These are all basic questions you must be able to answer.

However, you need to be careful with all this discussion in the early stages, which leads to the next item on this list.

3. Control

Pivoting a company is a bit like running a nuclear power plant. You must carefully control the rate of change to achieve the outcome you want. The unstable element in this reactor is (as it always is) people. Change too quickly, and your employees and customers will react in unpredictable, and potentially devastating ways. Change too slowly, and your efforts may sputter out.

For example, as I pivoted out of the VAR business, I slowly modified our sales pitch and marketing content over a 12-month period. Each quarter, I had the sales team focus a little more on services, and less on products. I also made small changes to commissions to reward service sales. The changes were small, easy for people to handle, and always linked back to the vision.

In the early phases of a pivot, the changes to the company need to be almost imperceptible. This allows your team to ease into the changes. Make these changes small, but keep talking about the old business and its value. You want people to see movement toward the new business, with a grounding in the old. 

In time, you must accelerate change, which increases fear, stress, and opposition among your employees. Once the pivot heats up, the stakes also increase. You are no longer controlling change, but playing a tense game of poker with the old business.

4. Stack the Deck

As change accelerates, your team will notice the changes. This will make them uncomfortable. At this point, you must not only accelerate the changes, but make it so there is no “going backwards.”   

In the tense final days of my VAR business, one of the finance people became frustrated as I questioned an outdated process. Exasperated, he said, “that’s not how we do it. We cannot just change everything overnight.” Amused, I replied, “why not?” This person had come face to face with a new reality. The old, comfortable ways of doing things were ending.  A new order was coming. 

People derive satisfaction and value from their expertise and experience. Change threatens this balance. When the discomfort of change becomes overwhelming, people will revolt and undermine your efforts to pivot the company.

I faced this dilemma many times.  After some trial and error, I devised a strategy to keep the pivot moving: stacking the deck. 

It works like this: 

1. Identify the people who are resisting the changes and unlikely to come on board with the new business model. 
2. Keep those people comfortable working under the old business methods. This keeps them satisfied and keeps the existing business (and income) chugging along.
3. Hire new people and train them exclusively on new processes and new business (what you are pivoting the business toward.) 
4. As the new business model takes hold, slowly marginalize the old business and the people working in it.
5. In time, the resisting employees will have to face a choice: get with the new business or leave. 

And leave they will. Tensions will increase as the old and new business clash. When the tensions hit a boiling point, you need to hit the gas. 

5. Tipping Point

Pivots hit a tipping point, when everybody sees change happening. Tensions are high. The old business and new business are fighting for prominence. 

Once this tipping point arrives, you must go all in. Wipe away the old business swiftly. You cannot hesitate at this stage. Change must be decisive, conclusive, and absolute. 

When I exited the VAR business, I pulled down the website on Friday. On Sunday, a new site was running with all mention of the VAR business wiped away. On Monday, I made an announcement to the employees, we were done being a VAR and there was absolutely no going back. Some were shocked, most were not. Anybody who had been paying attention saw this change happening. The only people shocked were those that were never going to accept the change in the first place. 

Rapid change like this will shock people, partners, and customers. Yet, it demonstrates your resolve. When the tipping point arrives, change must be swift and final. 

Nevertheless, there will be fallout from the change, which gets to the last item. 

6. Leave the Past in the Past

A company pivot, regardless of the scope, emotionally affects people (including you). Former employees may feel betrayed and lash out. Employees that remain will feel confused and uncertain about the new direction. After enduring the stress of pivoting the company, this emotional collateral damage can unravel everything.

For example, after dumping the VAR business, I harbored unhealthy levels of anger and resentment. I felt like a failure. The anger was blocking me, worrying employees, and threatening the whole change.

Time heals all wounds. I was fortunate to have a network of coaches, counselors, and supporters who helped me deal with my emotions and refocus on the future. However, your people may lack these resources.

Intellectually, we all understand that change is necessary (usually). However, change generates uncertainty, which in turn causes anxiety and discomfort. It is natural for people feeling unsure about the future of the company, to reject the changes, undermine leadership, and push the company to return to “the good old days” when they felt more comfortable. I saw this happen repeatedly when I went through my pivot in 2017.

People derive their self-worth from their experience and role in the company. Changing the company threatens their self-worth. Change becomes the enemy.

How can you resolve this?

1. Acknowledge the Past: The previous business was a necessary step on the road to the future.
2. Show Gratitude: Openly thank and praise to those who stuck with you and the company during the change.
3. Full Speed Ahead: Be firm and clear there is no going back to the old ways.

The first step shows people that the past has value and creates a bridge to the future. This helps people feel like their previous contributions had value.

The second step reduces anxiety, fear, and feelings of loss. It allows the people who stayed to continue to earn self-worth from their experience (which they need.) However, it also reassures new people. Seeing experienced people get praise, shows newer employees they too can earn praise if they stick with changes and remain agile. Public praise is the most powerful motivator you have as a leader (it is significantly more powerful and long-lasting than money.)

The final item, and the most important of my list, cuts off any return to the past. People need this. They need certainty. Be decisive and firm that the changes are permanent. If you sense any attempt to go back to the old ways, snuff it out quickly. This is especially important with sales and marketing groups. 

Conclusion

Change is the only constant in life. How we deal with change is as least as important as how we deal with life. The necessity of change is often obvious (new technology, new methods, new markets, new demands, etc.) What people lack is the nerve to make the changes and embrace discomfort. This is why any pivot must begin with the leadership. 

A leader who respects the complexities of change can help people navigate that change and deliver success. Moreover, leaders can make a stressful experience, become an extremely rewarding one. When the change is successful, people look back on the experience with fondness. The stress and anxiety, in time, become positive feelings of growth and empowerment. 

Reflecting back on my pivots, they were all miserable, stressful, and exhausting…and I would do it all over again. I look back upon them with pride.  

There is a reason companies like Nintendo made their change. The path from rice to Donkey Kong was undoubtedly rough. Yet, could you imagine anything different? Pivots may be painful, but they are a necessary part of building a great business. 

Go forth and pivot.

The post How to Pivot a Startup appeared first on Zenaciti.

The posts typically sound like this:

“Hey vendors, here is a sure-fire way to wind up in my ‘never do business’ list,’ send me an unsolicited email asking for a meeting. BAM! I am never working with you!!!” You need to understand what it’s like to be a CISO. You’re not in my chair!

or maybe this one…

“I got email from a salesperson who did not take the time to do their homework. My time is too precious and important to be wasting with all these salespeople!” 

Yeah, how dare anybody want to talk to you.

This article in Forbes from a while back makes the same complaints, although in a less passive aggressive manner. It is not a bad article, but it still perpetuates the notion that salespeople need to be put in their place.

Why all the rage and disgust directed at people who are merely doing their jobs?

Insecure Leadership

I believe this is a variation on Imposter Syndrome. These “leaders” feel insecure about being leaders. They believe the only way to demonstrate their authority and importance is to lash out at people they deem beneath them. They conflate cruelty and aggression with being in charge.

There are so many things wrong with this behavior it is difficult to itemize them all. However, the most ironic aspect of this is that it contradicts itself. Leaders who post these rants claim they do not have time to waste on irritating salespeople. Yet, they are wasting time on irritating salespeople posting these rants. All this ranting about salespeople hide the truth: they suck at leading. They do not properly prioritize their time or treat people with respect. Two critical skills for any leader.

Unfortunately, this ranting works to some extent. While it does nothing to stop the salespeople, it does attract other weak leaders who share a similar need to berate people. Consequently, the weak leaders get what they really want: validation.

In the end, nothing good comes of this. Nobody gets anything, nothing is better, and nothing of value was created. A petty person feels better about themselves, we all feel worse.

Ugh.

No Sales, No Job

For better or worse, sales is a fundamental component of business. Without sales, there is no money. No money, no job. Indirectly, you and everybody at your organization, owes your job to one (or more) salespeople who bring in business to pay your salary. Salespeople have an important and difficult job. Ranting about them solves nothing, does nothing, and you are not going to stop them, ever.

Furthermore, innovative ideas can arise from anywhere, even annoying salespeople. Perhaps the product they are selling is excellent, they simply lack effective communication skills. A good leader can see through this and focus on the message, not the messenger.

Admittedly, harassing marketing is irritating (See Harassment Marketing). There are simple (and respectful) ways to respond. You can say “no thank you” or delete the message. This takes seconds to accomplish, costs nothing, and hurts nobody. Anybody who has done sales for more than an hour knows that rejection is part of the game.

Being a leader means respecting all people, even the irritating ones. You do not need to give annoying salespeople your time. However, posting self-indulgent rants about salespeople solves nothing. All it does is telegraph to the world that you do not know what you are doing.

Now, will sales ever be sane again? I wonder to myself.

For culture reference, the title of this blog comes from Panic from the Smiths. This blog was originally published February 2, 2018 and has been revised a few times since then. 

The post Hang the Salesperson appeared first on Zenaciti.