DtSR Episode 725 - The Importance of Communicating Value

TL;DR: This episode is all about an essential skill few of us have mastered. How do you communicate value? What is it? And how do you make sure you're evaluating value in a way that makes sense to the person you're talking to? This is something that's essential to your career, your business, and your life, and Michael is a master of this art. Don't miss this one.

Guest:

• Michael Santarcangelo

Description

Most cybersecurity pros know the feeling: you ship real work, you reduce real risk, and the reaction is a polite nod and a budget cut. We sit down with returning guest Michael Tandarcangelo (aka Mr. Santa), who’s turned decades of “problems that don’t have names” into a clear philosophy at ValueSmith: delivering value in a world built to overlook it.

We get concrete about what “value” actually means and why it so often gets misread inside security programs. If leaders see the cost on a spreadsheet but can’t see the benefit, the mental math turns negative fast and security becomes a cost center. We talk through better ways to frame work like PCI DSS and SOC 2, how to connect controls to outcomes people care about, and why value is a dialogue not a declaration.

Then we go upstream to the real failure mode: solving the wrong problem perfectly. Michael shares a simple way to slow down just enough to ask smarter questions without looking “weak,” so you can align with the person who must recognize the result as valuable and make that value travel up the chain. We also dig into how market demand shifts over time, why certifications can be noisy signals, and why paying for outcomes beats paying for hours when you want great work.

If you want clearer stakeholder communication, stronger budget conversations, and a better handle on your own career value, hit play and grab Michael’s free Value Delivery Check. Subscribe, share with a teammate, and leave us a review if this helps you change how you show impact.

Transcript

Copy Transcript Copied

Welcome And Why Value Matters

SPEAKER_01 0:51

All right, good morning and good afternoon and good evening. Welcome down the security rabbit hole to another edition of the Down the Security Rabbit Hole podcast where we talk about cyber things. And if you listened to the last episode, not so cyber things or loosely related cyber things. This one we're bringing. You guys remember Michael? He was on with us for quite some time, and we're bringing him back. Michael's got a cool thing he does. He's going to tell us a little about it. And we're going to have a conversation around value. Listen, I I know this is not your typical cybersecurity conversation, but I promise you, if you take some notes and and you take this to heart, this will improve the way your career, your ability to communicate, and all that. So before we get into all the fun, deep stuff, Michael, welcome back to the show.

SPEAKER_04 1:46

It is nice to be back. It feels like coming home. And I'm not dead yet. I'm just just, you know, I'm in Florida now.

SPEAKER_05 1:54

Not Newton's, but I'm in Florida. So like, you know, it's sunny. You had to pick the other side of the state. He was like, I can't I can't go to the same side.

unknown 2:01

Yeah.

SPEAKER_04 2:02

Wouldn't the state have like toppled over if we're both on the same side? Doesn't it like collapse then?

SPEAKER_01 2:07

You you guys can't be on the same side of the state for disaster recovery purposes. All right. So

What ValueSmith Is Solving

SPEAKER_01 2:15

tell us about what you're doing now. Because you've got a you've got a new thing you're doing. It's really I we had to we talked about it twice now, and I thought, you know what? I need to get you on a podcast to talk about it because it is pretty cool.

SPEAKER_04 2:26

Yeah, I love that. Well, so a lot of people know I did Security Catalyst for 24 years. And somewhere near the end, I started to realize that a lot of stuff I was doing at Security Catalyst was good, but I started to look at the central theme to it, and it's now evolved into Value Smith. So it's less that Security Catalyst has done, it's more like the natural evolution of the things that I've been doing for the last 30 years have found their place. And the way I explain it simply is value Smith is the philosophy and discipline of delivering value in a world built to overlook it. So for the last 20 years, I have had the I'll say the pleasure and the honor. I have some scars to show, but I get brought in to solve the problems that don't have names. The problems that if they were easy to solve, then we would have solved them. And through that, I've been paying attention and documenting. And the thing that keeps coming up, as you said in our intro, so so what is value? And how do I communicate that? And why don't people see it? We're working hard.

unknown 3:29

Yeah.

SPEAKER_04 3:30

No one gets it. What do we do about that? And this is my focus to help us go answer that question consistently.

SPEAKER_01 3:38

I'll give you guys a story, just a personal reflection is to start this off. Yeah, I I I worked in a particular role earlier in my career, and I worked my butt off, I worked hard, and it seemed like to me, it felt like I might as well not be doing this. Like nobody cares, nobody values what I'm doing. And I and I for a long time saw it as a them problem, right? Like my boss just doesn't get how hard I work or how important it is what I do. And then through some, we'll call it growth, right? You realize that he he would have cared uh if I would have been able to communicate it properly and what in it, what it is, and the the extreme importance of communicating effectively on value. What is it that you do? Why does it matter? Who does it matter to? Those are those are very, very important conversations to have. And and I I think what's interesting is nobody taught me that any at any point in my career. Like there's no class I could have taken. Right? There's nobody like they'll teach you how to be technical, they give you, they give you presentation skills and all kinds of important things. But when it came to tell me about the value of this thing or this effort or this whatever, it was really hard for me to communicate it. I know I'm not the only one.

SPEAKER_04 5:03

No, I mean, this is this is the problem I've been chasing since a little before 2004. And it started simply. I had a group come to me and say, we have a team. It was in security, but I'll leave it broad. We have a team, they're doing great work, nobody realizes it. And when we deliver our results, they go on a top drawer and people are like, cool, thanks. We done here, and then they get back to it. And so they said, Well, clearly that's a communication problem. So we started there. Then I started realizing, well, it's a value problem. Then I started realizing, well, what does value mean? And a lot of people would say, Well, that's squishy, let's move on. So I've spent 20 years trying to understand that. And then lately I've come down to it's what did you do? Like you have to deliver something of value that allows someone else to recognize what you did as valuable. And to your point, Raf, there's no class for this. There's no class. There's it's not in any of our education how to do this. You either figure it out because you got it wrong the first time and the second and the third, and then eventually you figure out the pattern. Or you don't figure it out. And I think, you know, when you were talking, I realized I think a lot of people in our industry, and I'm I'm part of this, we don't like this idea of tooting our own horn. We're not gonna be a braggart. Cool. There's a distinction between delivering something that's valuable that could be recognized as valuable and being a braggart.

SPEAKER_05 6:27

What what industry are you talking about?

Value As Dialogue Not Declaration

SPEAKER_05 6:30

Not full of braggars? Seriously. We gotta stop. All right. All right, I was being polite. You're right. I think the difference though, I think what's interesting with value is there is often a miscommunication between what one person sees as valuable and another sees as valuable, right? I mean, security is a big thing of this, right? Like for security, there's so much stuff that security seems as valuable, but then when you go to the business, they look at it and they're like, but that's not val it's not valuable to them the same way it's valuable to the person presenting it. I think that's where a lot of people struggle, is that sure, I see value in what I'm doing, but is that value valuable to somebody else?

SPEAKER_04 7:14

Yep. And Raf made this comment on his intro. The question is, who ultimately needs to recognize this work is valuable? The second question is, and and what do they recognize as valuable? And so that's where we get into these mismatches a lot. We're doing something that we've decided is valuable, but we don't know if it's valuable to somebody else. And if it is, we're we may not be using. I always hate it when people say, Well, there's a language, stop. There's language, there's not a language, there's language. It's really about relationship. It's it's relating what they want, which is why I tell people like we you guys hear us all the time. Well, I've got a value prop. I'm so tired of value props. I like it in concept, but in practice, it's no good. Here's why value is not a declaration. If it was, all this valuable stuff we're doing, you just clap your hands twice and say, look, it's done, it's valuable, reward me.

unknown 8:03

Right.

SPEAKER_04 8:04

If that worked, we wouldn't be having this conversation. It doesn't work because value is a dialogue, not a declaration.

SPEAKER_01 8:12

I I agree. And so I I think the the the where where I want to place uh some emphasis on this is when we talk about value, you it's so easy to get into your perspective and say why this is why what I'm doing is important to you, right? I I think I I'm I'm gonna give you the example. Let's use let's use real world. I need to I need 20 million dollars in my budget because I need the company, I need to do work that gets the company PCI DSS certified, right? Why? Well, because we have to do this. It requires our our customers are going to require that that is poor value communication, right? And I believe that's I'm giving you an example of like one I've lived through. The the real one, the real thing that works is this is valuable to you because you have $10 million in business pending that certification. That's why I need to go get this money from you so that you can get that.

SPEAKER_04 9:19

Yeah, and you just pointed out something really interesting. Value equals benefits minus costs.

unknown 9:24

Yeah.

SPEAKER_04 9:25

Basic economics class. And one of the things we know is that people know the cost. To your point, I need $20 million to go build this program to do this thing. They have a spreadsheet, it has that. So where's the spreadsheet line for benefit? I have yet to see a financial reporting spreadsheet that has a column for benefit. Right. By the way, I'm sure someone's about to call in and correct us and say, no, you missed okay, cool. I got it. There's probably something somewhere that none of us get to use or see. So what happens then is that value equals the benefits minus the cost. They see the cost, they know the cost. It's it's written down. If they don't realize the benefit, then when they do that mental math, your value is negative.

SPEAKER_01 10:08

Well, that's how security got to be a cost center, right? Where all we do is we cost money. There's no, it's so difficult to articulate. And I've struggled with this for years, and Jay's, I'm sure you have, right? How do you, how do you how do you prove the benefit of something that is relatively, I mean, especially like earlier on my career, like relatively out there, it may or may not happen, but when it does, boy, it's gonna be bad, right? And and people are like, I I I can't like I can't touch that. I can't, I can't feel it. I don't I don't have that like fear that that's gonna happen. It hasn't

Making Benefits Visible In Security

SPEAKER_01 10:50

happened enough, it hasn't happened to us before, or it has happened, then yeah, we're still here, like it's not that bad. And so that's a tough one.

SPEAKER_05 11:01

I was gonna say, you got so much stuff going against you, right? I think in that situation, right? Like you're you're selling the sky is falling, the worst is gonna happen, these different things are gonna go, but then you've got all this evidence that basically says it's probably not gonna be like that, right? Like, well, sure, it could be, but probably history doesn't show that.

SPEAKER_04 11:22

Well, and what's interesting about that is I think that there's two things happening at the same time. If we keep the same value equals benefits minus costs, what we're saying is if this bad thing happens, if this affliction happens, the cost is gonna be so high that we must do this other thing to create a benefit. Well, what's the benefit? Well, that this bad thing won't happen. It's all very abstract. Abstract is hard for people to take a look at. But the flip side to it too is, and you started with this of I need this dollars to go build this program to meet clients' requirements. Okay, well, that's that's an aspiration now. I want clients, yes. Clients are asking for this thing, yes. Can I provide this thing? Yes. But interesting is if it nets me $10 million of business but costs me $20 million to build, that's still negative. If it nets me an immediate $10 million of business and then I can think of a hundred million dollars, now the $20 million is a no-brainer.

SPEAKER_05 12:20

Yep. Yep. Is that because we're going, do people go too broad with the idea when they think of value? Because I mean, we started rap when we're talking about like, hey, if we don't do this, we're gonna get hacked or we're gonna lose this. Like it's this huge amount versus taking it micro-sized and saying, you know what, I'm not looking at it as a I'm solving us not getting hacked, because we know we can't solve that, but I'm solving this problem that we're dealing with right now, right? Whether that's a customers are waiting on this certification or, you know, this is going to do X, but we're not sitting here saying we're solving for we're gonna be 100% secure, we're gonna be unhackable, all that. Like, that's not the solution, but it's it's what we typically go for when we don't have a true answer, right? It's like social engineering and phishing and all that stuff. Like there was a breach. I don't really have a good reason why you should do something. Well, it could be used for social engineering, right? Like it's that fallback, but it's not really what we're trying to solve for.

SPEAKER_04 13:23

What I've learned in the last couple decades is that the problem that we think that we need to solve is not always the problem that needs to be solved. It kind of goes like this, right? I think there's three things. Whoever asked you to solve the problem is not typically the person who needs to recognize that end result as valuable. That's an interesting disconnect because it means we're going to try to solve the problem that was presented to us. And a lot of us, especially in cyber, we have strong engineering minds, strong engineering backgrounds. We like to solve problems. You put a problem in front of me, I'm gonna run at that thing full tilt. But I think there's two other challenges. The other challenge is what somebody asks for, what they expected, what they wanted, and what they need, I also find are typically three different things. They might be related, but they're not the same. Take, for example, right? We're on a podcast right now. So if somebody comes in and says, Hey, I need a gray wall behind me, we say, Okay, boss, gray, go. But if you've had experience doing this and I've had experience getting it wrong, there are not only different shades of gray, there's a pigmentation in the gray. So now the new question is if you truly want a neutral gray wall to be behind you on a podcast, you have a lot more questions you have to ask. But that's actually not the problem we need to solve. If you can get down to the root of it and you say to the boss, hey, why do you want a gray gray wall? Well, I'm gonna be on a podcast. Okay. Why do you need a gray wall for a podcast? Well, I saw this thing that said that you should have a neutral gray, it shows up better. Okay. Is that the problem you're trying to solve? What's the problem? What's the core problem? And if you keep drilling, they'll say, Well, I want to look, I want to look and sound good when I'm on a podcast. Okay. So it's background, not gray wall. By the way, what's your lighting look like? What's your camera look like? What's your microphone like? What do you mean? But they took a guess, you know, I say they take a guess at the solution. I think a lot of us jump to solutioning before we get to problem decomposition if we don't understand the problem. If so, in this case, let's say somebody goes, they run out, they buy a gallon of paint. They come in, they move everything, they paint the wall. Person looks horrible on screen and they hate it, and they say, That's not what I asked for. You said you wanted a gray wall, I painted it gray. Well, this doesn't work, it's not what I wanted. What did you want, right? So that so the question then becomes do we get an ability to get to the end state that we wanted? And and when when do we know what somebody's asking for or not? Which goes back to your point, James. A lot of the stuff that we do, it's we saw it work for somebody else. Or, you know, I used to say we we had this drum beat

Solving The Right Problem First

SPEAKER_04 16:00

called compliance that started in the 90s. Why am I doing this? We have to be compliant, we have to be compliant, we have to be compliant. And I always say, yeah, but do we? Can we opt not to be compliant? Go back to your point, Raf, PCI DSS, which by the way started with 12 questions. And how many pages is it now? But but that's not the point. The point is 110 billion. Does a client require that? It's like so we've got to be SOC 2 certified. Why? Clients require clients require SOC 2, or that's the handle that they're reaching for because they want some level of confidence that you're protecting their information in a way that is acceptable to them.

SPEAKER_01 16:38

Yeah. Yeah, listen, I what when it when it comes to like you know, the the value anytime somebody starts to have a conversation around what value is, I always remember I had somebody teach me that like value is relative. Yep. And like it's the value of I saw a really great ad, and it was meant to like really kind of be a you know, like a spiritual pump-up, but it said like, you know, water at I can't forget who it was, like water like the at the grocery store is like a dollar. That same water bottle at the airport is like four dollars. That water, you know, at a sports event is like seven dollars. That water in the Sahara Desert may as well be a million dollars. It's the same water bottle, it's where you put it, right? And it and so the thing, the ad or the the bit ends by saying, make sure that you understand your value so you can communicate it and you're in the right situation. Effectively, it was like one of those like, hey, don't be in crappy situations where nobody values you. But knowing the but to me, that was like, okay, I get it, right? So if you're a this goes to careers too. If if you're a uh a sales rep and and you're really good at making relationships, that val the value of that uh skill or that ability is different whether you're a startup or you're joining, you know, a 25-year-old cybersecurity company with a thousand salespeople. If you're good at making relationships, that startup is gonna like eat you up and love you. Right. The bigger companies is just gonna give you a bunch of accounts and they're gonna say, okay, go cover these accounts, like go go sell to them. The the ability to be creative and go and do that is is valued differently. The ability for for some people that are highly technical, right, their their value is in a different part of the value chain, as I learned, than somebody who's really good at leading a team. Those people may have they may be able to do similar things, but their but their value is in different spots. That is that can be is that is that fair to say? Here's how I think about it.

SPEAKER_04 18:52

You have an individual value. And and I don't I don't conflate this into worth. Worth worth is an assessment of yourself. Yeah. We have an individual value. It's the unique abilities that we have, the way we think, the things we've done, the stuff that we've learned, it's ours, it's immutable, and frankly, it's never in conflict with anybody else's. I don't know what we have, seven, eight billion people in the world. Everybody's individually valuable in unique ways, which is what you were just talking about.

SPEAKER_01 19:18

Yeah.

SPEAKER_04 19:19

Then there's this great expression, it's loosely, I think it's attributed to Einstein, but it basically says, don't judge a fish by its ability to climb a tree. Climb a tree, yeah. So now what we're talking about is our economic value. Our economic value becomes context dependent. If you're really good at doing X, but situation Y doesn't require it, you end up commanding a lower value. If you learn what makes you individually valuable, then you have the ability to express that and work that in the place. We'll say this colloquially in a in a in a situation. Do we have the right people in the right seats on the bus? Right? Right person, yes. Right bus? No. Yes, right bus, wrong seat. That's that's the way we colloquially talk about these things. Here's the trick. In a business context, the goal is to take economic value of the individual contributors and blend that in a way that delivers business value. That's to me like the simple, like not full value stream or value chain, but it's just as an individual, you've got what makes you individually valuable. And in a situation, you've got what makes you economically valuable. And it's that combination of the economic value that delivers business value. Which brings us right back to so then how come people don't realize our hard work is valuable? Because they weren't hiring you for hard work, even though it may seem that way. They're hiring you for your ability to solve a specific type of problem to get to the outcome that people want.

unknown 20:46

Yeah.

SPEAKER_04 20:47

Right? So typically value esoterically is a change in conditions, a desirable change in the condition.

SPEAKER_05 20:55

Yeah. Is there a difference to like recognizable value versus I don't know, just I don't even know if that makes sense. But I'm just thinking as you're saying that you're getting hired to do a certain thing. You did it just because you weren't getting a slap on the back and a and a party thrown, doesn't mean that what you did wasn't valuable either. That's correct. Right. I mean, it was still like there's still value there. Again, it's how you're interpreting the reception of that value versus how you think it should be.

SPEAKER_04 21:26

Which is exactly why I distinguish individual value from economic value. And you're in in your So the way I look at it, if we go back to value equals benefits minus cost, they see the cost, they have to realize the benefit so that they can recognize the value. And you're exactly right. Can you do something that's valuable that isn't recognized as valuable? Yes. Can you deliver value that's not recognized as value and still pretend it's business value? No. Right. So the hard truth in that becomes your effort, if the result isn't recognized as valuable by the people who need to recognize it as valuable, then you Did not deliver value to those people. And that's the realm that a lot of us live in. And then it has that negative consequence that, well, then I'm not valuable. No. But you may not have solved the right problem, right? If you solve the wrong problem perfectly, you deliver no value and you register that visible loss because it's a miss. Does it mean that you're not valuable? No. Does it

Individual Value Versus Economic Value

SPEAKER_04 22:20

mean you're not doing valuable things? No. Your team's working hard, you're crushing it. You guys are doing value and you know it's valuable, but nobody else knows it. So that's a gap between what you know and what you can show. The thing, a lot of this is it's about visibility, right? And and there's a gradient to it. So somebody else has to be able to realize that there's something there that they can recognize before they can assess the judgment of whether it was valuable or not. So does it mean everything has to be judged as valuable?

SPEAKER_05 22:47

No. Well, and it goes up the chain too, right? Like your direct manager may think that what you did was valuable because it aligned to what they're planning to do. But then above that, you know, it's not seen as much as valuable because, well, it pseudo aligns to company goals or something like that, right? Like what we're trying to solve at level A is different than what's trying to be solved at level C. That's right. You're exactly right.

SPEAKER_04 23:11

I think that's where we talk about value travels, right? So the the challenge to it then is that the the people who are asking for the work may be part of your value recognition chain, but there's but there's somebody that they're reporting to. So now the question turns into are they able to demonstrate what you did was valuable that it can be recognized by whoever's next in the chain?

SPEAKER_01 23:39

Yeah, listen, I'll give you guys an interesting one to think about because this is one that that comes up a lot. And that is the the notion of like, hey, I'm thinking of changing jobs, but I I don't, you know, help me help me think through whether this would be a good idea. And it's usually centered around you know, better pay or or you know, more time at home or less travel or more travel or a better, like somebody asked me, what is my next, you know, am I what would I want to be a CEO? And I said, well, on a on a value scale, for me, knowing the CEOs I know, yes, they make a lot more, but also they are extremely uh involved and busy, and they spend like a lot of time away from the dinner table and the homework and and the you know weekends on the beach and stuff like that. And to me, I you you really like you'd have to throw in a lot of money in a very big hurry for me to give that up. So that like that time for me is more valuable than than the paycheck, right? And so like what it's always like that, like what do you value? Yep. What what's important? And it comes down to like what's important. Do you if you want a bigger paycheck? Well, what are you giving up for that? Like, what do you value more? Because there's always a give. There's always a there's always a give, right? Like, like even going to work, recording this podcast, we are giving up an hour roughly of our time. And to me, it's valuable. Like, I think this is valuable because I get to talk to the world out there, we get to share some ideas and and communicate some things that people don't often think about. And to me, that's valuable, right? That's worth whatever whatever the cost of the equipment and the internet connection and my and you know, like what I could get paid an hour and all that stuff. Like, it's worth it. But you know, would I you know, would I would I take a job that's another, I don't know, 20% if it meant I had to travel, like those consulting jobs, right? Those big four consulting jobs where you leave on Monday, come back on Thursday night, whatever. I did that for two years. Like that was it. Like two years, and I was like, done. Like, I can't. My kids are getting are getting old, like I there's no way. And and you sort of walked away from that because you're like, Yeah, well, you're not trading that.

SPEAKER_04 26:04

Well, you're explaining us a concept I call the value exchange. Everything we do has an exchange of value, and there's there's three primary levers emotion, logic, and finance. And most people wanted to to track it purely to the financial, but what you're bringing into the conversation is but does this work for me emotionally? Does this work for my situation? What's the exchange of value? Right. So we we're putting together this podcast, and so that there's a time to prep, there's a time to record it, there's a time to post, there's a time to put it out there. But somebody listening to this right now, they're also giving up time. And so one of the measures I always look at is is there a commensurate exchange of value?

SPEAKER_01 26:48

I I I mean, for me, the answer is I hope so. I hope if you're spending, and I think this is why somebody said uh I saw this thing on LinkedIn this morning that you know the podcasts are a dying medium, it's just not worth people's time. There's too much junk and it's not worth people's time anymore. I look at that and say, hey, our listenership has been relatively stable, if not like seasonally, it goes up and down, but for the most part, we've been really stable. I'm really proud of that. And that to me, that means we are delivering something that people care to exchange 35 to 45 minutes of their attention to receive, and that's a lot. Attention is a very good idea. I completely recognize that.

SPEAKER_04 27:31

Yeah, and and look, the prognostications about something dying or not, I I can remember when podcasting first took off. I was at one of the podcasting conventions,

The Value Exchange Of Time

SPEAKER_04 27:40

and I ran into a buddy of mine who was working for one of the big aggregators, and I made some comment about all these people are going to get into it now. And he said, Good. I said, Help me understand. And he said, You want more voices, and it starts to create a filtration system. And the more clean, I'll say it this way: the more clean signal, the more durable, the more useful voices start to rise up. Is it initially about the quality of the mic or the quality of the whatever? I would argue it's the quality of the substance. And so what you've done is remarkable consistency in a domain of knowledge where you've brought in other ideas and concepts, discussed them freely and openly, and gave the audience something to think about that helps them do better in their regular jobs, which is very different than I started a podcast, I'm going to run 10 episodes, and hey, let me talk about my dog. By the way, if your podcast is about dogs, then that's probably a great topic. But I think the idea that the medium is dying is, yeah, it's like telling me email is going away or telling me that passwords are going away. Like we get people like to prognosticate these things. But I think it misses the challenge, which still comes back to value. So, how do we, in our careers and our situations, make sure that we're doing things, right? And I say it's three rights. You've got to solve the right problems, you've got to pick the right path, and you've got to take the right actions. Because if you don't finish the work, then it then there's nothing you did you delivered nothing of value. If you want to argue, if you got personal value in the process of doing it, no argument for me. I accept it. But that doesn't mean, to your point, James, that it's recognized. Right? You still have to, you still have to. So I like to tell people, especially in our industry, we we work with smart people. You can solve any problem, you can maybe solve all of them. You sure as hell can't solve them all at once. And most people I know are redlining right now. We are we are pushing too hard, we're pushing beyond the seams. There's no slack in the system, there's no downtime. People don't understand how technology works, so they expect more and more. They see the cost. This is this is back to the they see the cost. Tell me how often you've had this conversation. I know what you do is important. I don't really understand it. I know what you do matters, but why does it cost so much? I don't care what you guys do. Why is this so complicated? Why can't you just flip the switch or whatever? Does it mean that we need to suddenly teach them how all of it works? No. Well, but that's a signal to us that they don't see the benefit. They see the cost, not the benefit, they question the value to it. But what happens when you solve the problem that they had? They suddenly love you forever. Well, it's not forever. They love you for a very short period of time until they hit the next challenge. Right?

SPEAKER_01 30:21

You know what's interesting? I I I got a I got another one, and I gotta get this one out of my head because I'm gonna forget it later. There was this great thing, and this sort of uh really puts a finer point on the intersection of worth as a self and then value to the system. There's like the story of like, you know, hey, there's a big container ship and it's having engine problems and the propeller's seized, and so they bring, you know, the captain brings in that he says, go get somebody that'll solve this, and I don't want to pay a lot. So he brings in the cheap mechanic, cheap mechanic toils at it for five hours, gives up, takes his money, and leaves. Captain goes, all right, maybe I maybe we're gonna have to pay uh the mid-tier mechanic. Brings that guy in, that guy toils for five hours, takes his money, can't solve it. Brings the top-tier mechanic in, she toils for five hours, she's you know, struggles with it, can't figure out. She takes her money, she leaves. And they're like, Who's left? And there's an there's an old guy, a retired, you know, a retired mechanic, been doing this for a long time, sitting on sitting there, just smoking his pipe, and he says, I'll do it. They're like, Well, well, these guys couldn't do it. What makes you think? Because I'll tell you what, I'm gonna charge you, you know, essentially 2x what everybody else charged you, but I'll get it, but I'll get it done for you. Captain's like, I'm desperate. If you can solve this, fine. He walks over, walks over, looks at it, looks at it, pokes at it, grabs his shoe, whacks some bolt. The engine starts spinning. The captain's like, wait a minute, you want me to, you that took you 30 seconds. You want me to pay you how much for that? For the for your time? He goes, like, he's like, no, he's like, you only worked on this for like 30 seconds. Because Captain's like, yeah. The mechanic says,

Paying For Outcomes Not Hours

SPEAKER_01 32:00

Yeah, but you know, you're not paying me for how long it took me to to do this. You're paying for me for the experience of time that I have to know where to smack my shoe to get your engine moving, right? So it's kind of a it's very similar to what we're what we're doing in our industry, because you've got you've got all these different roles, and they've they've they've got, you know, as as things progress in our industry, we started specializing. And so if you look at the timeline along the timeline, at first it was just in you know, enterprise security, information security, then that splintered, and you got like five disciplines, and each of those splintered in five ways, and now you've got hundreds of splinters that are splintering. It it reminds me of of that show Loki where you've got like all the timelines, you know, crossing out, and you're trying to figure out you know, like, okay, uh how much should how much am I getting, how much should I be asking? What's what's my salary? What am I asking? Right. And it's not your it's not how fast you can finish something, it's do you know the answer and how you know and and how how much is it how much resource is gonna take you to get to that answer? And I think that that's that's something we don't consider a lot in an economy and in a world, especially a lot of us come from consulting where we bill hourly. So there's a there's an actual financial penalty for being good at something. Yep. If you're really good at something and and it takes you 10 minutes, the consultant that bills hourly is gonna kill you because they're gonna they're gonna be like, wait, no, no, no, you can't do that. Like work an extra four hours. Like you you can't bill 45 cents for that. That's a that's a valuable thing.

SPEAKER_04 33:38

So you're talking about output versus outcome. Output can be useful on the process to outcome. And without turning into a side rant, this is why I believe firmly that hourly work is antithetical to good work. Because if I'm paying somebody by the hour, my incentive is to do as fast as possible. If you're getting paid by the hour, your incentive is to not do as fast as possible. And I said it that way because I don't mean delay it or stretch it out. I just mean there's there's a difference between those two things. Whereas, but now, how do you qualify the value of a job? How do you qualify the value of an outcome? People struggle with this. And and when I started looking at this 20 years ago, the answers were generally not good. Well, you have to determine what they think. No, that's not how you can do it. So I've had to build different models and methods of figuring this out over the years, but it comes back to our very opening position. You're working hard, you're doing something that's valuable, it's not recognized. Why? Well, because you need to understand who needs to recognize it, and you need an understanding of what they expect and or what they need earlier in the process. We tend to run at a high rate of speed at a problem, and only downstream after we spent time and money and bought the solution or started implement it to go, uh, that's not what we need. Well, we've already started, we're just going to continue.

SPEAKER_01 35:02

Yeah.

SPEAKER_04 35:03

We don't have we don't have a convenient way to check up front, which is why I built one.

SPEAKER_05 35:09

I think there's an interesting thing around value change as well, right? Your value changes over time. It shifts. Being an expert and cobalt was valuable at one time. Still is. Uh, you know, maybe a little bit still, but not like it used to be, right? Like you look back at Cisco engineers way back in the day. Like that was if you were a Cisco engineer, like you were super valuable. And then everybody caught up, and then all of a sudden that value changes. And guess what? Nobody walks in there and says, Oh, I'll go ahead and take a salary decrease because you know, Cisco engineers aren't going for 150K a year anymore, right? Like we're not writing our own ticket. I mean, same thing with security. Like, you were an expert at this level, the market gets flooded with engineers and all that stuff. You're no longer the only one that knows that simple little trick. Or now you're falling behind. I had an interesting thing when we had our ATT fiber installed here. The installer was a younger guy, and we were talking a little bit about some of the stuff. And he was like, you know, he's like, he basically just does fiber stuff. And he was saying how, you know, all the the older guys back at the office that all do the copper. And he's like, fiber's easy, light's going through it, or it's not. He's like, copper, there's attenuation, there's all this other stuff that like the new guys don't have that. The old guys aren't doing the fiber, right? Like, there's there's a time when what you were an expert at and what was the top stuff now all of a sudden becomes not so. Or like the COBOL guy, you're still, you know, there's still this niche, but it's much smaller than it used to be. But that value changes over time as well. And that's something I don't think we talk very much about that, you know, especially security. Like we come in thinking, like, oh, we're here at the top. And at some point, that top level starts kind of knocking down a few notches because there's all of a sudden there's all this AI stuff that's coming out. Like you say, you're gonna tell me you're an expert at this stuff now, too? Because if you're not,

When Market Value Shifts

SPEAKER_05 37:10

then your value just diminished a little bit based on your role. If AI now is something that you need to be aware of.

SPEAKER_04 37:17

Well, and you just introduced a new problem. As the marketplace has more options, how do I distinguish signal from noise? How do you so you say you have X? Okay, you have it. And then and so the commentary, well, I have the certification. I love Tommy Boy. I I can put a guarantee on a box of crap. All you have is a guaranteed box of crap. You so I'm not knocking certifications, they play a role, but there's still right, and this is why we say it's not a communication problem, it's a signal problem. How do we how do we index if somebody else has the domain knowledge that they represent that they have? Right? And that's that's where this all goes. And it and it's still it comes back to you then. So in your organization, if you want to deliver value and you want to be recognized for delivering value, you have to understand all the things that we talked about. Has the value shifted? Who needs to recognize it? What do they recognize as valuable? How does it fit into the bigger picture? How can you demonstrate your work in a way that is recognized as valuable because it's delivering a benefit that somebody sees relative to the cost that I guarantee you they know?

SPEAKER_05 38:22

It's it's interesting you mentioned the certification peak, because I'm thinking the same thing about like compliance pieces, right? Like all PCIs, not the same. Like every you say you've got it, but you've got people that just barely pass PCI. You got people that are blowing PCI out of the water, right? Like that PCI doesn't really give a oh, how good are you at security? It gave you some sort of check mark.

SPEAKER_04 38:47

What do they call the person who graduates last in his class of medical school?

SPEAKER_01 38:51

Doctor.

SPEAKER_05 38:52

Yep.

SPEAKER_04 38:54

So how do we how do we distinguish as you go?

SPEAKER_01 38:58

That's a terrible one.

SPEAKER_04 39:00

Yeah, but but it's no, but it's it's all around the same thing, right? Because value becomes an expression and it's recognized. Go look at baseball cards. Go look, right? You have a there are certain and people say, well, it changes, right? Because that's the other thing. People say, well, value is different. It's fleeting, it's positional, it's shifting. All of those things are accurate. And and the value of a signed vape roof card 10 years ago may be different than today, especially if you control for the cost, right? The inflation and money stuff. Okay, but there's still a marketplace for that. So now it gets into the efficiency of the marketplace, which is a whole another conversation. But you know, what I keep looking at is how do we in security and people in technology do better at not solving the wrong problem that delivers no value and gets them a visible loss?

SPEAKER_05 39:47

I think that gets the struggle we have is there's an a sense of urgency and immediacy needed or warranted, I guess, expected when you're there to solve problems. People don't want to sit there and talk about, oh, let's go 20 questions

Five-Question Value Delivery Check

SPEAKER_05 40:05

deep and really find out what the root cause is. I've got a fire, spray it with the extinguisher. There you go. Like, don't look to see the fact that you know this is the reason why the fire keeps popping back up as soon as you're done with it. Like they want the it's like the immediate satisfaction. I just want this thing solved because this is what's blinking as the problem.

SPEAKER_04 40:25

You know what I love is how how beautifully you just put that, because I think you're right. Two things. One, because the this check that I built, it's only got five questions, because it's that's all you got time for. But you're right. There's I think two things kind of happen at the same time. Everything is go fast and get it done and don't stop and ask questions. The minute you stop and ask questions, you're the barrier, you're the obstructionist. Or worse, for a lot of us, we say, it's gonna show I don't know. What I always tell people is is the distinction between asking a question that makes weakness or saying, I know how to figure this out, but I want to be clear. And if you can just register that in your head, game changer, then you get less afraid of asking questions because you want to deliver the value that somebody expects. But to your point then, so now I don't want to seem weak. People count on me to solve problems. By the way, let's put problems in air quotes. They want me to deliver some sort of a solution to whatever it is that they're seeing. So to your point, there's fires flaring up, grab the fire extinguisher and hit it. Whereas you're like, shouldn't we figure out why the fires are here in the first place? Like this is not a place for fires. Why are they popping up?

SPEAKER_05 41:31

I ain't got time for that. Let's go. I can solve your blinking light problem. I'll just smash the light. Right.

unknown 41:38

Right.

SPEAKER_01 41:38

Well, it's it's kind of like uh it's kind of like asking the value of a fire extinguisher in an empty house, not much. In an average house, significant, in a fire, indispensable.

SPEAKER_04 41:50

Yeah, when your RV converter generator thing catches on fire, you're really glad you have it a fire extinguisher.

SPEAKER_01 41:57

Yeah, well, there you go. All right. Listen, we're out of time. What do you want to leave people with? Give me a short, short thing.

SPEAKER_04 42:05

I built something, it's free, no registration, it's called the value delivery check. And the idea was exactly this. What I've been looking at is this class of problem that we were talking about. I said, there's there's no easy way to check before the costs get too high. Like it's like, man, it'd just be great. And I built it for the people who are listening and say, oh, that sounds great, Michael. I ain't got no time for that. I'll figure it out. No, no. It's the how do you know? Like, could you could you get it done? And so I've been playing with AI, like we all have. James, I'm an expert now, of course. Uh I'm not an expert, by the way. But so what I did was I took you know 30 years of knowledge and said, it comes down to these five questions. And and here's how you can evaluate the answers and then figure out what to do about it. It's on my website. People can I would love for people to grab it and test it and try it and tell me how it works. I mean, I know how it works when I when I guide people through it.

SPEAKER_01 42:54

All right. We'll give it a shot. Thanks, Michael. Thanks for joining us and talking about what's a again, kind of an adjacent topic, but I think I really do think it's important. I think it's it's it's it's a distinguishing feature when you're thinking about yourself and your career, your family, what you value, what other people value, and just sort of direction life. I think value is one of those conversations that seems kind of squishy, so you're like, ah, you know, I can do this without without thinking about this. And you can you can brute force just about anything if you put enough effort into it, or you can do it the smarter way, which is really kind of understanding value and being able to communicate it and transact on it. So thanks for sharing your knowledge. Thanks for uh give us the website one more time. ValueSmith.com. I can't believe nobody had that before you.

SPEAKER_04 43:47

It was a premium purchase.

SPEAKER_01 43:49

Oh,

Closing And Listener Callouts

SPEAKER_01 43:50

well, there you go. Fair enough. All right. Thanks for joining you guys. James, always good to have you, buddy. Folks, thank you so much for listening. This has been another episode of the Down the Security Rabbit Hole podcast with our friend Michael Tandarcangelo, more affectionately known as Mr. Santa. And we were talking about value. Hopefully you got something out of it. Go check out the website. Thing is free. I like free as an air, not beer. And we'll catch you guys another time, another place on another down the security rabbit hole.

SPEAKER_02 44:26

This is the last thanks for listening. Don't forget to leave my download and share this with your friends. Bye.