Be Water, My Friend
Corporate Culture – this phrase gets tossed around a lot. To be honest, I never really believed in it till my company started growing and I made some really bad choices and some really great choices.
Let me explain what I mean.
When I started Social-Engineer I just left a company that was amazing. It was like a family. The pain of leaving was real for me and like all family separation it wasn’t 100% smooth. I was heartbroken to leave but wanted to take every lesson I learned to my new company. I was determined to also take all the good memories with me. Yes, there were mistakes from both sides of the fence but instead of focusing on those, I went away remembering all the great times, life lessons and growth I had gifted to me.
I figured I would grow my company and by being a nice guy and working hard, and never demanding more from my people than I would give it, that would merit the same in return. I would say things to myself like, “well I did this so they should do that.” Or “I am this way, so they should be that way.”
And to be honest, it felt real. It felt like it was an honest appraisal.
But..But… But…..
I started to have people problems. Now this is odd to admit out loud for a company that basically focuses on getting people to do what we want. But here it goes....
I am a very strong, direct communicator and although in many ways that is a strength, it can be a weakness in other ways. I can often times be blunt and too direct, hurting people’s feelings. Even though I am very self-aware of this, I still mess up.
It seemed like an enigma to me – here I was on the cutting edge of this field helping dozens of companies make huge changes, my training was changing lives and helping people and I was assisting in stopping crimes against women and children - and YET internally we were hitting roadblocks.
To avoid an Internet war or embarrassment for any person I don’t want to call out specifics, as that is not what this post is about. This is about self-reflection and the lessons I learned.
Before I get to that, let’s be honest. In the rare occasion is any argument one way. Most of the time an argument is a 2-way street. So, there is fault on both sides of a disagreement. I had to learn that the hard way, but a lesson well learned.
It is easy, to ease any wounds, to want to point the finger fully at the other person stating what they did wrong. Heck just the other day I saw a post from someone calling me out as “toxic" and "manipulative” – that is easy to do behind the power of the Internet to name call and to point out others faults. But it is so short sighted, immature and negative for all involved.
Instead of taking that path let’s focus on the lessons I learned by doing it wrong.
Four Lesson’s Learned
I can probably outline many lessons that I learned as I grew my company over the last decade and many that have made me a better employer (I hope) and better person overall. But here are the top four.
ONE: Should All Over Myself
I see a therapist – I am not shy to talk about this. My therapist, Natasha, is an amazing woman. She is one of those great therapists that actively listens to all you say and then every now and then presents a thought as a question or a mild statement that hits you in the face like a Mike Tyson KO punch. I affectionately call her Doctor Molotov, because it feels like she throws one of these in my lap every session driving me into deep thought and self-reflection. She doesn’t want to hurt me, but to make me think. She wants to challenge me to change, challenge me to expand my thoughts.
We had this employee depart from Social-Engineer and it was not amicable. This person was malicious and stole our intellectual property, breached their employment contract multiple times and then slandered us. This person even went as far as to try and hurt the non-profit (The Innocent Lives Foundation) I started to help save children from the horrors of child abuse.
I was so angry I wanted to lash out, I want to ruin their career and to call this person out publicly. During some of this I almost let emotion dictate how I reacted. But now for the self-reflected balance. I was not perfect – nowhere near it. I said some pretty horrible things in moments of anger and when projects failed. I was completely wrong, and I am sure my list of mistakes is much higher than this short confession here. And for all of this we parted ways and not friendly.
Now here is the lesson. I am in my session with Natasha and I am saying things like this:
“I gave this person tens of thousands of dollars in a raise in one year, they should be more appreciative.”
“I helped this person build a name in an industry as a complete noob, they should be grateful.”
“I have a great salary, benefits and support package, this person should have been more thankful.”
Natasha stopped me and said, “well you just SHOULD all over yourself, didn’t you?”
I stopped, stared and her for a good 10 seconds and then busted out laughing. “I DID WHAT???”
She explained it this way. “Did you pay for loyalty? Did you pay for honor? Did you pay for appreciation?”
The sad answer is NO. I paid this person to do a job. And that job was done. Yes, sometimes it was very poorly and sometimes it was done amazing. But either way, that is what I paid for. Loyalty and appreciation and thankfulness are awesome extra’s, but I CANNOT EXPECT THEM.
That lesson has been profound for me. No matter what I do, good or bad, all I can expect is what I pay for. I pay a guy to come mow my lawn (I really do) and I don’t expect him to be my friend, or to cook me dinner or to listen to my problems… he mows my yard and that is it. Yes we are friendly, and we talk about the whiskey we like or my beehive or the flowers, but that is as far as it goes. Then he goes to his next client, etc etc.
Learn this early and you can save yourself a huge amount of heartache. Don’t should all over yourself with expectations that people will respect you and treat you good just because you do it first. BUT don’t let that stop you from being a great person.
TWO: Not Everyone Loves It the Same Way I Do
I love my company – and I should (yes I used SHOULD) because it is mine.
Expecting my employees to love Social-Engineer the same as me is silly and futile.
I have a vested interest and unless I give some of that to an employee, they have every right to treat this as a job. They can come 9-5 and clock out and that is fine.
I am so in love with social engineering and Social-Engineer LLC that it was hard for me to see why anyone would not love it the same. It was my baby!
Learning this lesson fast can make a huge difference for you.
THREE: This Job is NOT for Everyone
I met people that in my head I thought they would be amazing at this job. Heck, I had a few that even courted me for jobs and convinced me they would be amazing at this. Providing proof of past historical evidence or experience in an SE Competition as proof, and I believed it.
They come aboard and it became apparent quickly they are all talk, all ambition and no real skill, desire, or effort. Here is the lesson though, because that is NOT it.
When you see this you have a choice.
- Devote time to work with them and hope they get it
- Cut ties quickly and move forward
Now I can’t give you a blanket answer but here is what I can say. I have made the wrong choice a few times and every time it has hurt my company. In some cases, we have worked with folks and they have improved and are amazing members of my team, other times it was better to cut the ties and part ways. Where I have messed up too often is holding on too long. To the point where the company is hurt and the effect on the team is negative.
Now, I say this but I want to add balance. That doesn’t mean I come in and just fire a person on the spot.
I had this one young person working for me and we both determined it just wasn't a good fit. I asked to speak on the phone and as we conversed about the job and what it would take and the time it would take to get good, this person started to ask some really relevant questions. After we spoke for a quite a while there was a pause and this person just said, “Chris, I think I should find a different job.”
We made an exit strategy and helped them transition so it was good for both of us.
Open good communication helped with this problem. And the last tip can help you determine if spending time is worth your effort.
FOUR: There Needs To Be A Blend of Ambition + Humility + Knowledge + Skill
One of the things I look for in a new recruit is ambition. I realize there is coming a time where I want to do less, that doesn't mean I don’t want to SE, but I would like to have time to do the jobs I want, the research I want, etc. So I need hungry, ambitious younger folks to come in and want to take the reins.
But when that ambition is driven by their education, or desire for money, or desire for prominence – it leads to disaster.
I had an employee that could not stop focusing on the fact that they had a master’s degree as “proof” of why they are worth more. Even though the degree was not in anything to do with what we did for work. It is an amazing accomplishment, but the constant focus on it as a barometer of worth is where I find a problem.
Now don’t get me wrong, a good education goes a far way in helping prove your worth. But when I look at my team now I have 2 college drop outs, 2 actors, 1 quantum computing major, an ASL instructor, a building trades expert, a flooring expert, one engineer, one ex-accounting rep and a few other interesting people with very diverse backgrounds.
Yet, hear me seriously – this is the BEST TEAM I HAVE EVER HAD. Social-Engineer is the strongest and best it has ever been in its 11-year life. None of that has to do with the degrees or education of its people.
What is the success based on? My team has knowledge and desire to learn - yes some of this is education, some is self-taught and most of it is the desire to learn as much as possible. They blend that with ambition to succeed and drive to do better. They mix in a heavy dose of skill, and they help enhance each other with this skill. And the final piece, which is the most important is they all exude in overflowing quantities of humility.
I don’t know if words can express enough how important this one quality is.
Let’s imagine one employee who has an amazing education, skill pouring from ever fiber and they are ambitious to win – but they lack humility. Can you picture it? I can, I had that here. And it is damaging to the culture and the spirit.
But you take that same person and you blend in humility and what you have is everything in the making of a remarkable employee, person and social engineer.
Humility is such an important part of the equation for both the employer and the employee.
This world right now is crazy – and our community has no shortage of drama. So instead of posting negative, hurtful comments that lack wisdom, insight and humility let’s take a moment to self-reflect and ask this question, “Where can I change to make this better?”
The Final Lesson
You want to see the change that you so desire – then be the change. There is a famous interview with Bruce Lee where he is quoted as saying:
“Be formless, shapeless — like water. You put water into a cup, it becomes the cup. You put water into a bottle, it becomes the bottle. You put it in a teapot, it becomes the teapot. Now water can flow, or it can crash. Be water, my friend.”
I take that to mean if I want my company to be amazing, fun, powerful and forward thinking – then I need to be. I need to be the change I want to see. If I want my team to admit mistakes and show humility, I better take the lead in that. If I want them to work hard and be ever learning, I better be the front runner in that area. I need to be formless, shapeless and help mold this industry and my company as much as I can.
That won’t be done by name calling, insulting or immaturely pointing out SOMEONE ELSE’S faults, but it will be done by a self-reflective look at what I need to change to be a better person and a better social engineer and a better father and a better husband – a better human.
If I can create a positive, forward thinking culture for my company, it might be small – but that small change is a start. That start can make the people that you interact with feel better for having met you. Be Humble. Be Ever Learning. Be The Change. Be Water.
Will you join me in this change.?
By: Christopher Hadnagy
Security Awareness and Training Specialist
9 个月Tremendous and just what I needed to read today. Thanks!
Senior Cybersecurity Engineer | Global Speaker
1 年I think this is a really important point, and it's something that more companies need to be aware of. While many companies invest in technical cybersecurity measures, such as firewalls and antivirus software, it's often the human element that can be the weakest link in the chain. By training employees on social engineering tactics and how to spot and respond to phishing emails, for example, companies can greatly reduce their risk of a cybersecurity breach. It's also important to remember that cybersecurity training doesn't have to be boring or dry - by using interactive, engaging methods like role-playing and gamification, companies can make cybersecurity training fun and memorable. Overall, I think the message is clear: just as Bruce Lee said that "knowledge will give you power, but character will give you respect," when it comes to cybersecurity, technical measures can give you protection, but employee training and awareness will give you the resilience and readiness to respond to potential threats. And your books are vital, I am glad it was and is part of my training Christopher Hadnagy. ??
Organisational Change Manager @ Department of Justice QLD | AI Capability Specialist | Instructional Content Designer | UX | Digital Transformation | Strategic Communications
2 年Wow! You have incredible self insight and self awareness! Loved the article ??
Weather Radar Engineer | Experienced Technology Leader | Information Security Consultant | Cybersecurity Instructor
4 年Awesome post! Thanks for being so open and transparent.
Global Head of Red Team | Cybersecurity | Adversary Simulation | Penetration Testing | Attack Surface Management | Vulnerability Research | Risk Management
4 年Deep brother. I commend you on the self-reflection, humility, and self-accountability for your past on your journey of personal growth. Also on your bravery to post this publicly and speak from the heart to help others. Well done, sir.