The One About Paloalto

My first time at Black Hat, I was super excited to go. I had been hyped up about it for years —ever since I started working in security—and I was finally working for a company that was sending me!

Little did I know that the company was sending me as a booth babe.

I didn't realize it until attendees at the event we were holding were surprised that I was a security practitioner and told me that I was obviously a booth babe.

"You can tell because none of your male peers are greeting people. Also, that shirt they gave you is 'racy'," I was told.

It was. I hadn't recognized any of that. I was just delighted I got to attend an event like this with my peers.

I was ashamed that I hadn't even noticed that I was only sent to Black Hat as marketing, even though I was a security leader at the company. That shame put me off of attending Black Hat for YEARS.

So: I saw the story about how Palo Alto Networks used faceless,? lampshaded women (https://www.theregister.com/2024/08/14/palo_alto_networks_execs_apologize/) in their booth at Black Hat.?

Here's how I see it. From the heyday of Budweiser commercials targeting brosephs, to Calvin Klein trying to sell jeans, or even Doritos having a hot model lick the orange guck off a guys face—sex sells. I have no qualms with that. If a beer or a clothing brand or a snack wants people to feel sexy thinking about their products, that’s great.?

The problem here is that the time, place, and manner were not well considered. This is a tech industry conference.

In 2024, when there is a perception that women don't want to be in engineering. When the women who are in engineering perceive biased treatment against them. At a conference that is basically the nerd-camp for everyone in the industry to go and network and learn. Having a cocktail party where the hosts are women dressed in sexy dresses, with lampshades on their heads (covering their faces like they are objects and not humans)—is completely tone-deaf.?

Paloalto’s CEO Nikesh Arora and CMO KP Unnikrishnan (Unni) have apologized. They said that this doesn’t align with the company’s values.

I am unmoved. I want to understand how this marketing was approved. I want to understand what they thought they were doing, other than selling sex. I really want to understand so that I can decide whether this was an actual mistake or an intentional slight. The verbiage that it doesn’t align with the company values rings hollow. Who looked at this idea and said, “Yep, that’s going to make women engineers want to come work here”?

“Actions speak louder than words.”? You know this, Palo, because you make a big deal about it on your lengthy company culture page: https://www.paloaltonetworks.com/about-us/inclusion-diversity These were your actions.?

Here’s what I think you should do. Nikesh, Unni, stop writing apologies and give us a root cause analysis. Explain how this decision was made and then request that the ultimate approver resign—and if they don’t, fire them. They clearly do not align with your “diverse and inclusive culture.”?

As a CISO, I know that a mistake must be severe for it to be punished with firing. This is that severe.