From Buzzword → Reality: How to Make Your Messaging Resonate at Conferences | Leo Cruz

Interested in sponsoring an episode like this with your target buyer?

→ Reserve your sponsorship here. ($2,575)

Guest at a Glance:

💡 Name: Leo Cruz

💡 What he does: Leo is currently the CISO of St. Joseph’s School for the Deaf and advisor architect for Cisco.

💡 Noteworthy: He was part of the NOC at Black Hat USA 2022; He also sits on a couple of boards across the education and vendor-agnostic space to give back to the community; Leo is graduating this Friday with a formal B.A. in Cybersecurity and Forensics.

💡 Where to find Leo: LinkedIn

Episode Insights:

What motivates Leo to wake up in the morning and do what he does:

Leo is motivated and focused on giving back to the community. Offering his candid feedback based on previous experiences, failures, and expertise that he has is important to him. He loves what he does and is intrigued by the fact that he doesn’t know what conversation he is going to have tomorrow with his colleagues and friends.

“I love security. I want to do this. The right people pushed me and mentored me and guided me. And it's why I want to give back to the community. And it's why I focus on the education sector so much because I have, I guess, like a motto:

If we give kids and even adults that are trying to break into the industry today a beautiful experience from the very beginning, a motivational experience and a positive experience, they're gonna feel empowered and confident that they can do this. Even if you're 50 years old or 10 years old or 25 years old, regardless, you wanna get into cybersecurity? We will help you. The helpers are out there.”

Leo’s experience at Black Hat USA 2022:

Leo was invited to Black Hat to help with the network operations center (NOC). In essence, it’s also the security operations center (SOC).

He got to get an inside look at how the conference gets up and running.

He was responsible for doing the surveillance and ensuring the network was safe and up. An experience he defines as “really awesome.”

“The collective and cohesive nature of all the engineers and analysts working together from different vendors to ensure that, you know, people's information was kept private, secure; the training sessions that went on were, you know, they remained uninterrupted. And at the end of the day, it was really just a learning experience for me.”

Leo was thrilled to be able to meet people he has never met before. He felt a sense of camaraderie, particularly because the community hasn’t gotten together in over two years, which made the experience that much more special.

The difference between Black Hat USA 2022 vs. previous years:

• More vendors were listening vs. trying to sell
• People were curious about:
  • How the pandemic changed viewpoints in security
  • What are new concerns for security professionals, from the human element?
• The conference was a lot more intimate and not as packed as it used to be, which allowed for a lot more meaningful conversations to happen.
• New technologies are emerging from VC-backed startups to tenured vendors that are coming out with new innovations, pioneering new ways for security professionals to continue to safeguard the digital space.

“It was honestly refreshing. People were really just curious and they wanted to understand how that pandemic impacted us as humans - how we're obviously operationalizing and consuming technology today, but how the pandemic really changed our viewpoint in security.”

What positively stood out to Leo on the exhibition floor:

• There was a shift from a vibe of competition to camaraderie among vendors.
  • Leo started to see vendors talking to other vendors to assess how they were doing and what they are seeing from clients.
    • What are the trends you’re seeing?
    • What are the attacks that are impacting the way your clients purchase?
    • How do your clients POC?
    • What are the challenges you’re facing?

“There were a lot of cohesive conversations going on, which I generally never saw before. I did see two startup vendors that competed in the same space in identity talking to the same client and figuring out what makes sense for them based off of third party integrations or alliances; trying to really learn from the client. And again it just goes back to people who were really trying to listen, trying to understand, but it was great to see the vendors communicate that.”

• There was a shift from swag central to more meaningful conversations on how to work together cohesively
  • Adversarial attacks are getting much worse and Leo believes we have to stop competing at some point and understand that everyone can potentially use every technology. However, it’s the human element that is the most vital resource.

“I really wanted to understand from everyone how the pandemic impacted them, how they're doing, and honestly just learn, how do we get better? How do we actually start working cohesively? Not just talking about technology, integrations and APIs, like, really working towards benefiting the world.”

Cardinal rules vendors broke at Black Hat USA this year:

• Some startups and tenured vendors obviously had to sell but they were too pushy. It was how they approach the audience, which negatively impacted the way Leo viewed them.
• Trying to get the conversation when a person doesn’t express interest in talking or said “no”

“I was flagged down by someone after I spoke to someone for like two seconds, like, “Hey, have you heard of us? I said, “no, actually, no, but do you have a card? Do you have a document?”

It wasn't actually at a vendor booth. It's just in the common walk space. And as soon as that person walked away, someone came running and said, “Hey, I just saw you spoke to my colleague. Since you haven't heard of us, can I tell you a little bit about it?

And me and me and one of my friends, we actually had to be somewhere and she was following us the whole way.

“There comes a time where you have to respect the boundaries.”

On more listening and meaningful conversations at Black Hat:

• Leo is a firm believer that you shouldn’t avoid any one vendor in security. He believes that some niche or startup vendors that might not have a backing or are privately funded might come out with something that is going to impact humanity for the greater good. He recommends to talk to as many people as you can.

“Even us as evaluators when we're picking a vendor, we need to be open-minded.”

Booths that stood out in Leo’s eyes:

As soon as you walked in, you obviously saw the vendors that had the most budget. You had, like the massive statues of super heroes at CrowdStrike’s booth.

Cybereason had a massive area as well.

SentinelOne had what looked like a purple tree of life, which was really awesome.

“That stuff is catchy because you gotta look at it one of two ways. They're probably trying to get your attention for a valid reason, not so much,Hey, we're flashy. We just wanna bring you in and get you the free swag and talk to us.”

But the vendors that stood out to Leo were in Innovation City.

“There were a few vendors that deal with threat intelligence, that consume threat intelligence from a lot of different parties, whether it's vendor, whether it's private, whether it's a nonprofit and what they do is at that point, they feed federal government agencies so that they can respond and they can analyze it and sanitize and realize like, you know what, this is a credible threat. I thought that was really interesting.”

Leo believes that a lot of the smaller vendors have a very similar mission in that they are breaking into the industry because they want to change the norm, not just sell. They want to offer up a service.

It’s finding the people that can do the services vs. finding the technology that interests Leo because although the tech is tangible, it doesn’t give him anything that he is looking to solve long-term at the end of the day.

“It's the small vendors that, that lead with, we're not really selling a technology. We're selling a service that can help the human being become that much more efficient in their role. And those are the vendors that, honestly, I was really interested in talking to. Some of them just dealt with the governance risk and compliance space. Some of them dealt with threat intelligence.

Some of them did CISO advisory services, which is another important area and topic of adding value. Because as a newly minted CISO of a school system myself, I was very candid with the school system. I can't do what you expect me to do based off of someone who has 25 years experience.

Although I do have the experience to get the role. I need help. So what am I, what am I going to do? I'm going to actually reach out to some of those vendors and say, Hey, you do continuous monitoring on compliance? Do you handle it completely? It's pretty cost-effective? Let's talk.”

When Buzzwords Actually Work:

 Leo feels a lot of vendors hurt themselves in their marketing messaging because they were trying to compete with the bigger players or, really, everyone.

When is it okay to use buzzwords?

If you understand what the buzzword actually means and what’s really behind it.

If you can back it up with data and nuggets of how your tool or solution ties to the buzzword.

That’s when the buzzword becomes a reality.

“Come at me with XDR, come at me with SOAR, come at me with cyber resilience. That's fine. I get it. But then give me, you know, the meat and potatoes behind it. What it really means. I think vendors just have to change the way they lead with buzzwords.”

How Leo sorts through vendors he saw at the show to evaluate who to talk to:

• Leo takes home a big bag of business cards.
• He looks at the vendor and Googles them and the individual he spoke to.
• He will then siphon through and rank them based on specific needs - industry sectors, identity access management, vulnerability management, VDR, and forensics.
• Once he’s placed them in those buckets, he will look at where they are in the industry as well.
• He will look at their messaging and also experience if they have webinars on YouTube.
• He will look for more collateral to see what they’re leading with.
• If he finds them doing other talks or pitches to save him time asking questions, he will consume that because he doesn’t want to ask them the same questions he could learn from their data sheet, website, or YouTube videos if they presented at RSA, for example.
• While he is doing that he is focusing on what he is trying to acquire.

“For the school system I work with, I'd look at the three biggest areas that I know potentially are at the moment risky for us and that we have to fill the gaps on and look through some of those vendors and see which one of these actually makes sense for us. That's why I'm gonna look at all the collateral.

And at that point, I'll pick two. I won't really go crazy and pick three or four, because I just, I don't wanna open up, you know, like too many conversations and maybe give a vendor false hope. I'd rather have two conversations.”

• If those two vendors don’t benefit him or if he doesn’t see value, he will then choose the other two he didn’t choose prior.

When does outreach post-show help?

The post-show thank-you emails rarely are useful for Leo.

What is useful is customized emails based on conversations, meetings or relationships he established at a conference.

“Customize it. Make it specific to that individual. Mention something that'll resonate. If that person that they spoke to gets a generic email, that person most likely is just gonna be like, ‘ah, you know what? They're not trying. If it was worth their time as well, they would've tried to look me up a little bit more.’”

Interested in sponsoring an episode like this with your target buyer?

→ Reserve your sponsorship here. ($2,575)