Stop Using Slides: Tell Better Cybersecurity Stories

On this episode of the Cybersecurity Mentors Podcast, we sit down with Jeffrey Wheatman to break down one of the most underrated skills in cybersecurity: storytelling. 

Jeffrey shares how he built a career helping CISOs communicate more effectively with boards, executives, and teams by shifting away from charts and data toward stories that resonate and drive action. 

We explore why storytelling is a skill anyone can learn, how it applies to leadership, presentations, and interviews, and why the best cybersecurity communicators think more like mentors than heroes. 

In this episode, you’ll learn:

• Why data alone often fails to move executives and boards
• How storytelling improves presentations, interviews, and leadership communication 
• The “Yoda vs. Luke” mindset shift for cybersecurity professionals 
• Practical tips to craft, structure, and deliver memorable stories 

If you want to influence decisions, lead effectively, and stand out in your career — this episode will change how you communicate. 

Come hang out with us in the Cybersecurity Mentors Skool community. It’s free to join.

Transcript

Why Boards Tune Out Data

SPEAKER_03 0:00

I was talking to CISOs who were going in front of boards of directors. I would see them really struggle because they would present a lot of data and graphs and charts. And I could see the board wasn't getting it. And what I quickly realized was it's really about stories. And on our podcast, we actually were talking just yesterday with my chief security officer Bob Mailey and our head of research, Furhat, about how to go to the board. And Bob said, Well, I want to tell them this. And I go, so yes, but what if you frame it this way? And he was like, That's why you're the storyteller.

SPEAKER_05 0:36

Could you teach me? Then learn fly. Nature ruled on your son, not the mind.

SPEAKER_01 0:44

I know what you're trying to do. I'm trying to free your mind, Nia. But I can only show you the door. You're the one that has to walk through it. What is the most inspiring thing I ever said to you? Don't be an idiot. Changed my life.

Host And Guest Introductions

SPEAKER_00 1:10

All right, welcome to another episode of the Cybersecurity Mentors Podcast. On this episode, I'm joined by Jeffrey Wheatman, who we've just, this is our first time meeting each other on camera. Um, but I had shout out to one of our guys, uh Jerry, who had mentioned a talk that he had given down in Florida. I think it was a maybe a B-Sides or ICA conference about storytelling. And on this podcast, I talk a lot about storytelling and cybersecurity and how storytelling, I did a whole talk on uh storytelling for another conference and cybersecurity. So I feel like Jeffrey and I are on the same wavelength about storytelling and how important it is. Um I'm excited because I'm always trying to get better, especially at this skill, which I do believe it is a skill that everybody can get better at. Um, but first, Jeffrey, just introduce yourself, tell us about yourself.

Jeffrey’s Path To Storytelling In Security

SPEAKER_03 2:02

Yeah, so thanks, John, for having me on. So my name is Jeffrey Wheatman. Uh, I am currently employed in an evangelist role that's not actually my title uh for a company called Black Kite. We are a third-party cyber risk intelligence platform. Uh, if anyone's interested, reach out to me, and that's it. I'm not going to talk about my job anymore. Uh so I've been doing that for four years. Uh, I spend a lot of time at conferences, a lot of time on stage. We have a podcast that we we host as well. Um, and yeah, so the funny thing, Jerry, who you talked about, he's been super engaged with my LinkedIn post. And I had the opportunity to meet him in person. I was like, oh my God, thank you so much. Because I go to events all the time and people say, Oh, I love what you put on LinkedIn. And I say, Well, are you liking it and commenting? And they go, no, not really. Well, then you're not going to see it anymore. Um so, so it was great to meet him. Uh, before that, I spent 15 years as a research vice president at the analyst firm Gartner, where I led research actually on storytelling, uh, on board communication, on third-party risk management, on security metrics, so all things that are ultimately about telling stories. Uh before that, I spent a little bit of time in consulting and and then the one I always like to share because people always go, oh, that's interesting. Uh, I actually ran security and network operations for Martha Stewart in New York City uh back at uh, you know, in the very early 2000s. So that that's kind of uh in a nutshell my background.

SPEAKER_00 3:29

Yeah, that when you mentioned that one, that one did stand out to me. So maybe we'll we'll get back to that. Um I thought that was cool. Um yeah, you know, so I I've talked about this before, but and I and I once I I've heard people tell good stories, I've had people be presenters that were you you come away from the presentation, you're like, man, that person was a great storyteller. And so I always felt like it was something that it was a it was a superpower and almost a secret uh ability that people had just had, just naturally had, right? And I do think there are people that are naturally gifted at speaking and and being able to craft stories, but I since have felt like and and have had this experience myself, number one, you know, that storytelling is a skill, just like public speaking. It's something you can get better at. I feel like I've gotten better at it. I I still need to keep improving and actually just keep telling stories. But for you, you know, why why you you you call you call yourself a storyteller? Like why storytelling and why do you feel like that's your calling?

SPEAKER_03 4:37

So I I have I have this sort of innate need for to be the center of attention. Um it's it's I think it's it's a failing to a certain extent, but it it's enabled me to build a career uh around that sort of being a connector and a and a communicator. But I've been, you know, I've been telling stories since I'm a kid. Um I I actually sort of picked it up from my dad, who was a uh bar owner and uh nightclub owner and manager, and he was a maider D in in restaurants. And I used to go and watch him at work. And I was just, I found it in him entrancing, and people were always drawn to him. And I always felt that, like when I was a kid, if I ever got in trouble, I would make up a story and it didn't always get me out of trouble. But if I got my mom or dad to laugh or got them to feel bad, it, you know, sometimes I was able to weasel my way out. And earlier in my career, when I first became a cyber person, right, right around like the late 90s, I was a pen tester for a while. I wasn't a great pen tester, but what I was really good at was social engineering, which is about telling stories. I would create a character. I would show up at a site wearing, you know, a denim shirt and a pair of blue pants, and I was an electrician, and I had a whole backstory. I was an electrician named Bob. And, you know, Bob grew up in, you know, uh Pittsburgh, and his dad was an electrician, and I would like create this whole backstory for myself, and it enabled me to submerge myself in the character, which enabled me to bypass a lot of physical security controls and get people to trust me. And and really that's kind of where it came from. And then what I learned is that I have this ability that I thought everybody had, but to your point, it's not, it's innate, but it's it's definitely something I've honed, which is I can create these characters and step into them. Because I'll I'll let your audience in on a little secret. I'm actually an introvert. If I had the opportunity, I would never leave my house. I would sit on the couch at my fabulous wife and watch Netflix. But nobody was paying me for that. So a long time ago, I realized I had to create a character and I step into that character. You know, now I'm in my late 50s and I've been doing this for so long, I don't really think about it anymore.

SPEAKER_04 6:59

Yeah.

Introverts, Personas, And Stage Energy

SPEAKER_03 6:59

But when I finished, like we just recorded two days worth of podcasts. And when I was done, I got to go stare at the wall for four hours because I have to wind myself down. And, you know, when I was talking to CISOs who were going in front of boards of directors, I would see them really struggle because they would present a lot of data and graphs and charts. And I could see the board wasn't getting it. And what I quickly realized was it's really it's about stories. And on our podcast, we actually were talking just yesterday with my chief security officer, Bob Maley, and our head of research, Furhat, about how to go to the board. And Bob said, Well, I want to tell them this. And I go, so yes, but what if you frame it this way? And he was like, That's why you're the storyteller. So, you know, it just really it just made it so much easier to get my message across, get the stories across. Um, I I have this this one thing that I I learned about maybe a year ago. Uh, it's called the ATU. It is a three-volume book. I am probably the only person that owns it who is not a PhD in folklore, but it's an index of thousands of fairy tales. And what's really cool about it is I went on LinkedIn, I actually just did it again the other day. I said, pick a number between one and a thousand. I will tell you the fairy tale and I will give you a cybersecurity story for it. And I had a half a dozen people get back, and it it actually was easier than I thought. And I think that mapping and the and the the sort of connection to the story with the understanding of what my end game is has just made it so much easier for me to communicate what what I want. And, you know, the the other example I give all the time, like there are a lot of comic, stand-up comics out there. I am drawn to the ones that build stories rather than one liner after one liner, one after one liner. And to me, that's always sort of what I've been drawn to. And I just feel like the joke is much more powerful when you kind of lead someone there. So that's you know, that's that's kind of the spiel there.

SPEAKER_00 9:10

Yeah, um, well, I tell people that too. I was like, I'm actually an introvert. Uh same deal, right? And people don't believe me. I'm like, no, no, no. Like I love I would rather be at home just in my corner on my keyboard. Um, but I have adapt I have adapted. And I don't know if I it's my persona, but I maybe it is. I just have not thought of it that way. But I have to move into that, put the hat on and say, okay, this is what I need to do. But telling stories has really helped me not think about the public speaking side as much because I always say, you know, when you tell us if you're getting giving a presentation, you're going through slides, right? It's so typical. A good example. I'm at the FBI uh CISO Academy at Quantico, right? And these FBI agents are telling, they're showing some this most interesting information you could probably see in a presentation. But it's like death by PowerPoint. I'm like, you guys have this amazing stories that you're not telling stories. You're saying, okay, we found this group, we did this, we found, we did this to them, we killed them, we not killed them, we cut the, we cut their access, we got, we got them out. But like, it's like almost getting boring because it's just slide, slide, slide, slide. But the at the reverse of that that I found is like when you start telling a story, everybody's you can just see it in the audience.

SPEAKER_03 10:34

Yep.

SPEAKER_00 10:34

Everybody's brain switches to a different mode versus data, data, data to okay, what's happened and what's going to happen next.

Turning Board Metrics Into Stories

SPEAKER_03 10:43

Yeah. I feel like there are two very deep cultural things in humans. One is music, right? And the other is is storytelling. And and, you know, I have uh the presentation that Jerry saw me deliver, as it's really, I'm always updating it and changing the stories and adding new slides. But one of the aha, one of the kickoff slides I had a bunch of years ago was pictures of the cave paintings from France that are really, really well known. And people are like, well, what do you mean? I said, well, okay, this is a story. And you know what this story is? This story basically tells you the lesson. If you hunt by yourself, you're gonna get gored by an elk. If you hunt together with us, we will be successful, we will thrive, and you will go on about your business. And people are like, oh, that's that's a story. And, you know, I I frequently lead off that deck with once upon a time, and then I pause. And I've been doing I've been doing it for years, and you know it's funny, you probably can't see it on camera, but when I say those words, the hair stands up on my arms still after hundreds of times. And, you know, people used to make fun of me because I'm a big talker at work. But I what I've come to realize in the last 10 years is I built a career around that, and I'm actually okay if you want to tell me I talk too much.

SPEAKER_00 12:06

Yeah. Um, I I've told people like, people won't remember your data. They were not going to remember your charts. Go to a go to a conference, any conference, you've been to many, many conferences. How many of those presentations do you remember? And if it's just data and data points and we learned this and we did that, people won't remember. I won't remember it. Right. But if you tell me a story, yeah, I'm I'm more likely to be engaged, I'm more likely to be hooked in, and I'm I'm more likely to remember that story, especially if it made me feel a certain way. You know, what are your thoughts on that?

SPEAKER_03 12:38

Well, there's a famous quote. There's a famous quote. It's actually attributed to a few different people. Some people say it was Maya Angelou. The earliest reference I've seen is actually a sociologist named Carl Buner, but but the quote basically goes something like, they will not remember what you told them, but they will remember how you made them feel.

unknown 12:55

Yeah.

SPEAKER_03 12:55

And I think you're absolutely spot on. And here's the thing: if they don't remember what you told them, but you engage them, they'll reach out to you and they'll come see you again. Like when I was a Gartner analyst, I had people who came to see me present, no matter what topic it was, because they were fans of what I had to say. Yeah, I always tell my wife, I'm I'm a geek star, I'm a geek rock star, which is, you know what, it's the best I've ever gotten. But we, you know, you get people who want to come come hear you. And, you know, the the the thing that I also find interesting too is that we have to be very careful when we tell stories that it doesn't become repetitive. Um, there is there is a speaker, and I won't name him because uh it's I don't like to shame people, but there was a movie based on his story. I saw him twice, six months apart. The first time I saw him, he was amazing. The second time, he was terrible. And the reason for that is he literally got bored of his own life story. Think about how horrible that is, because it was the same sentence over and over and over. And you can see he was bored. You know, I I deliver the same presentation slides and it's different every time. I have to keep myself excited and engaged because if I'm not excited and engaged, my audience is not going to be excited and engaged. And like that's that's the whole point.

Fairy Tales As Cyber Parables

SPEAKER_00 14:12

Yeah. I I gave a a talk this past weekend. It was a closing keynote keynote for a small conference, and I told a story. And I've told this story in public probably three times. That was probably my third time in public. In private, I've told it to small groups in my team and things like that, or you know, many times maybe. Um they probably get tired of the story. But I have I have a bank. I I do have a bank of stories, and that's the cool thing about cybersecurity, is that there's always something interesting, right? And so I bank those stories for the next time I need to present. And maybe there's something related to this incident that happened or something we need to do or a risk, whatever. And we'll get to that. But this story that I told, I thought it did it did well. I think everybody that had not heard it before, they were like, man, that was a that was great, right? Um, and because it has this kind of a surprise ending, which is always good. But I felt like I rushed it. I felt like I was like, ah, you know, you kind of get in the moment and you're kind of moving fast. Not that I wasn't excited about it because I knew most of the people hadn't seen it, hadn't heard it before. But it's just, I think you definitely have to practice, and maybe you can speak to that. Like, how do you craft your story? Say you've got your story and it's and you think it's a good one and you're gonna use it. You don't want to memorize it and just have it word for word, but you want to be able to, again, deliver it, that delivery piece of it.

SPEAKER_03 15:42

Yeah, I I refer to that as the bones of the story, right? Every story has to have a beginning, a middle, and an end. And when you start the story, you have to know kind of where you're gonna end. You want to know what what the moral of the story or the lesson or why are you telling this story. Uh, there's a great movie I love called Planes, Trains and Automobiles. And it's it's such a good movie, but there's a scene where um Steve Martin's character says to John Candy's character, you know, when you tell a story, it should have a point. And, you know, like I think that's the problem. I think that you you have to kind of know structurally where you're going. But I think to your point, if you if you memorize it, I think it takes away. That being said, though, when you're learning how to do this, memorization can be helpful because it keeps you from running away with where where you're going. And I think over time, as you become more comfortable, I think you you sort of get there. But I you do have to have the bones of the story kind of in in mind. Um, you know, when we were recording our podcast yesterday, they always let me kind of like riff at the end a little bit. And I don't know about you, but my brain goes way faster than my mouth. And sometimes I'll say, so we got this thing, and then I think I can't, like I can't even catch up with my own self. And I think the the practice, I always say rehearse, but don't memorize. Yeah, I think is is the way to go. But the flip side of that too is if you don't, if you're not comfortable with the story or the joke or whatever, you get to the end and you go, Where like where was I? And and that I think can be can be somewhat challenging. But I think even if you're good, you can even play that off. God, that's I was trying, I was just messing with you.

SPEAKER_00 17:53

Well, let's talk about some of the things you mentioned to me, and and maybe were in your presentation about archetypes or archetypes. Like, how do you utilize those?

Audience Memory: Feelings Over Facts

SPEAKER_03 18:02

So, you know, archetypes are basically story frameworks that resonate across culture. Uh, like some of the archetypes are a comedy or a drama or uh, you know, a love story, boy meets girl, boy loses girl, boy or boy, whatever. Um, and but the the most famous archetype is the hero's journey, which was identified by uh Joseph Campbell. And he looked back at a lot of old sort of epic saga stories throughout history, and he identified that there were a lot of commonalities in them. And, you know, there have been some things that have kind of taken away from it, but I still think structurally it's the call to action. There, there is an evil menace, and they go to the hero and say, you need to fix this. And he doesn't want to do it. He wants to stay at home, and he goes out and he fails. And he doesn't want to go home and be embarrassed. So he wanders and he finds the mentor, the wizard, the sort of sayer of truth. And that person gives them a weapon or a piece of information, and then they are able to take that, and then they're able to go defeat the evil, and then they return back home and they are victorious and they become famous and become the king. And I just find that story to be so applicable. And I think in particular, in the cybersecurity domain, I think the CISO thinks they're the hero, but they're not. The CISO is the wise mentor, mage, wizard. The hero is the CEO or the CFO or the COO or the board. And I think that's actually a really, really critical thing. You have to know your characters. But archetypes are powerful because everybody has those archetypes sort of embedded because those are the stories that they've heard. And I can tell you, any good movie adheres to one of those archetypes. And, you know, there's the old adage, right? Every story was told in the Bible, or every story was told by Shakespeare, or or the Quran, or whatever. And I think there is some truth to that because they're all archetypal stories.

SPEAKER_00 20:08

Um, it's great that you said that. One of the things that I didn't come up with this, one of my friends, Adam Anderson, came up with, and it really stuck with me because when I first started in cybersecurity, it was I'm here to to stop bad, stop the bad guys and stop bad things. I'm the hero. And that was really my thoughts. Like nobody knows it. I'm kind of like Batman behind the scenes. Nobody knows, but I'm here to stop the bad things. And then he talked about this this specifically. He said, you need to be Yoda, not Luke. Right. And Yoda is the the wise advisor, the guru, the guide. And instead of saying, no, you can't do that, no, this this can't happen, not on my watch, you're saying, Well, I really recommend this. I think we should do this. This is my recommendation. You don't have to, but I really, you know, no, Luke, you should not go fight Darth Vader.

Keep It Fresh: Avoid Script Fatigue

SPEAKER_03 21:05

And that's and that's where the stories become very powerful because instead of saying, I recommend this, you should say, Well, you know, I know 20 people who did this, and here's an example, and here's how it ended. I don't think you want to be that person. And I think that's where the storytelling becomes, you know, really useful, right? Because it's an ill it's it's the ability to illustrate a point. And one of the things I share all the time, the stories don't really need to be true, right? I have stories that I've been telling for years. I don't even know if they're true anymore because I've told them so many times. But as long as they help you illustrate your point, there, there's a lot of value there. And let's face it, some of the best stories are not true, right? They're they're fictional stories. And I think, you know, pointing to parables, like one of the examples, and I I delivered this on stage when Jerry saw me, and this is this is a real thing that happened. I had a good friend of mine that I was coaching. She was the deputy CIO. She had five managers that worked for her, all of whom were really, really good in their silo. But what would happen is they would get together in these meetings and they were arguing all the time, and they would say, Well, here, you wanted this, I delivered this. But this the department was super, super dysfunctional. So I got up in front of them and I told them this Indian parable about the blind people and the elephant. And for whatever reason, they decided to bring an elephant. Elephant out to the village square and they took blind men and they put them at different places on the elephant. And they said, What is an elephant? And the blind man that was at the leg kind of felt around and said, Oh, an elephant is like a tree. And the one that was by the midsection, the abdomen, said an elephant is like a wall. And one, you know, the one that was at an ear said the elephant is a fan. And the trunk, the elephant is a serpent, and the tail is the rope. And the point of telling that story is when we are so close to the problem, we don't see other people's perspective and we don't really know the real story. So I told them that story in this meeting and cut to the chase. Six months later, they were not arguing anymore. They were going into meetings and they were saying, hey, we're thinking about doing this. Is that good for you? Does that work? Will that interfere? Does that support? And it turned this dysfunctional department, this team, into a fully functioned department. Did they have conflict? Of course they did. But it enabled my friend to be able to be much, much more effective at building her program. And she no longer had to worry about that myopic view. And I think increasingly security is becoming so complicated. Technology is becoming so complicated. It is very, very easy to get super, super close, not see the bigger picture. And back to your point about being Yoda, Yoda sees the big picture. Luke only sees Darth Vader in front of him without understanding Darth Vader fits a role. The Empire's got this going on. The Emperor is over here, the rebellion. And I think that that taking a step back and getting that wide perspective, I think is a really valuable outcome from a story like The Blind Men and the Elephant. And I don't think that's even the reason the story was told, but that's how I leverage it. And it's been really effective in doing that.

SPEAKER_00 24:17

Yeah. So it is your approach to it sounds like you do you do a lot of research on stories and parables and things like that. Do you kind of collect those in your bag and then look for the right one? You know, how do you approach that? It sounds like you're kind of curating stories and then and then something pops up. You're like, oh, this might be the right story for this moment.

Building The Bones Of A Story

SPEAKER_03 24:39

I, you know, I don't think it's as deliberate as that. I do have a lot of stories that I tell, and I have a handful that I come back to on a regular basis, like The Blind Man, the Elephant is a great example. Um, but I also I am an avid reader. Um, I do a lot of audiobooks. Uh I don't anymore because it's gotten ridiculously expensive, but I used to go see a lot of movies, and then I'm surrounded by other people. You know, I heard my dad telling stories my whole life. So I uh to say I curate them, I think is probably an overstatement. I also have a very, very good memory for stuff that most people don't sort of think about. So I have these things that I can pull out of my pocket. And um, you know, depending on what I'm doing and and where I'm going, like I if I'm going in front of the board, I have a pretty good idea about what stories I'm gonna use. But if you and I are just having a conversation, like when we were prepping for this, you said you have some stories you want to share. And I said, Well, I got a whole bunch. I said, Why don't we do the podcast and then I'll send you a write-up of the stories that I used after. Um, you know, like as another example, I have a story that I love, which strangely enough was told to me by someone who is not part of what we do. And um, it's there's a guy in a balloon and he's floating over the desert. He's got the wind blew him, and he's got no idea where he is. And then off in the distance, he sees a guy walking on the ground. He says, Hey, hey, you. And the guy looks up, he says, Yeah, what's going on, man? And the guy in the balloon says, So can you tell me where I am? And the guy on the ground looks up and he says, You're in a balloon about 30 feet off the ground. And the guy in the balloon says, You must be in IT. And the guy in the ground says, Yeah, how'd you know? And the guy in the balloon says, Well, I asked you a question. You gave me an answer, which, while fact factually accurate, is of no value to me whatsoever. And the guy in the ground looks up and he says, I bet you're in management. And the guy in the balloon says, Yes, I'm a CEO. How did you know? And the guy in the ground says, Well, you came to me with a problem, you asked me a question, I gave you an answer, and now it's my fault. Right. And like again, a perspective story. And what's funny is I hadn't intended on telling that story at the event that Jerry and I met at, but I had some time at the end and I just kind of threw it in there. Right. And I have a slide that goes with it, but I didn't have it in that, in that thing. So, you know, I do have a small number that I go to on a regular basis, but that's why I'm always reading and that's why I bought that that ATU. And I, you know, I'll pick it up and thumb through it, you know, on a regular basis, just to kind of, you know, pick up new snippets. And I also do a lot of synthesis so I can pull pieces and parts from from kind of different stories and kind of bring them together. And I think that's that's a skill you have to practice.

SPEAKER_00 27:21

Sure, sure, sure. Yeah, yeah. And and and and tell stories. I mean, really, that would be the big thing is like, how do you get better at telling stories? I I think you need to to practice that. Um, and it could be just in the conversations like you're having, like, hey, you know, oh, and this this story that I'm baking in because it's relative rel uh related to this conversation that we're having. Um, and it could be just around the dinner table, right? Um, those kind of little short stories. Um another couple of things you mentioned, one was the just your your audience's drive. What what do you want to say about that?

Archetypes And The Hero’s Journey

SPEAKER_03 27:55

Yeah, I mean, you know, you have to know, you know, does your audience like romantic comedies or do they like uh, you know, sci-fi space operas? So understanding sort of what they care about is very, very important because that's gonna enable you to sort of, you know, hit that that emotional sort of hook, because that's that's the key part to to good storytelling. And, you know, I share that all the time. And what's interesting is one of the guys in the audience in Orlando said, well, what do you do if you have a different, a bunch of different people in the audience? And that that's when it becomes a little bit hard. And then then you're gonna call people out and and sort of make specific examples. So do you remember, right, John? I think you and I are about the same age. Do you remember the old choose your adventure stories where you get to the bottom of the page and say, Do you open the door or do you run away? Well, I feel like some of it is about that and and getting to a different sort of ending. Um, and and then also the key thing, and this is something I struggle with sometimes, you want to be able to pull back to the main story. Right. So I made a point for for Mary, who's the CFO, and now I'm gonna come back to the core story and then I'm gonna keep going. And that that's a that's a really big challenge when you get hit with questions, especially when you get hit with questions in a meeting by people who are higher up than you, right? You know, if I'm a CISO and I'm going in front of the board, I'm two or three levels away from that board. I'm gonna wanna answer their questions. And that's where, of course, correction. So that's a great question. If everyone is interested in hearing the answer, happy to do that. Otherwise, I'll meet with you at a time of your choosing, and then I can tell you this specific story that's gonna resonate with you. But understanding also how do you want them? We talked about how you want them to feel. So I always ask people before you build your stories, how do you want your audience to feel? And a common answer from security people is I want them to be concerned, but I want them to be confident in my ability, our ability to help them manage risk. Right. So you don't want to go with FUD, fear, uncertainty, and doubt, but you do want them to recognize that, you know, there's some danger out there that they should be mindful of. And, you know, a great example of that. So we spend, you know, my company is in the third-party risk management space. So I always talk a lot about how that stuff resonates. So, you know, there's a company called KP Logistics. Two years ago, they got hit with ransomware. They're also called Knights of the Old. They were, they were, and here's the key thing, they were a 156-year-old logistics company in the UK. They got hit with ransomware, they went to receivership, and in 90 days, they were out of business. So a 150-plus year old company out of business because of ransomware. And you say, oh, well, that stinks. It does. But you know who it really stinks for? Anybody waiting for one of their trucks to show up with raw material, or anybody waiting for one of their trucks to show up to pick up product. And I told that story in our customer advisory board. And one of the members who works for an aerospace manufacturer said, Yeah, that cost us five million dollars. Right? So that's the story based on fact, based on something real and that I was able to link back. And the other one I've been talking a lot, and this isn't even a story so much, Jaguar Land Rover got hit with ransomware last year. One company, that attack had an impact on the GDP for one of the five largest economies in the world. The UK's GDP went down by 1.1%. And you go, wow.

unknown 31:19

Yeah.

SPEAKER_03 31:19

Super short story, 20 seconds.

SPEAKER_04 31:22

Yeah.

SPEAKER_03 31:23

But it gets people to ask questions and they want to learn more and it makes them think. And if we get them to think and if we get them to ask questions, that's a really powerful outcome from any kind of story, long, short, or whatever.

SPEAKER_00 31:35

Yeah. One thing that we talk a lot about is interviews. This is this podcast is a lot of helping people in their career and and how do I use these skills to get better in my career. A lot of those are if you're in an interview, right, and you're going to and weave in your story, weave in stories that support what you've done or what you've where you've been, what your experiences are. Um the the caveat I always say is be careful not to ramble.

unknown 32:05

Yep.

SPEAKER_00 32:06

Because that's what I've my experience is like people will keep going and keep going and keep going. And then, like you mentioned earlier, have a point, get to that point, and then and then you've supported it now. Move on. But do you have anything that you've talked about for specifically? I'm in an interview. I want to have my, you know, maybe just have have those stories handy to talk about if I have the opportunity to share. What are your thoughts on that?

Be Yoda: Reframing The CISO Role

SPEAKER_03 32:32

I think the key, so he part of this is on the interviewer asking the right questions in the right way. And there are some terrible interviewers out there. But I think in your head, somebody asks you a question. So tell me about a time when, I don't know, you ran into conflict, you had an opinion, and they didn't listen to you. So, and it's okay to pause. That's a great question. Let me let me kind of formulate how you know how I can answer that. And then thinking about the ending and then working backwards from there. And I think that's really strong, right? I said before, understand your punchline, your the moral of the story, and then you can work backwards. And I think that will keep you from from rambling uh a little bit. And then also just be mindful, uh, you got to read your audience. Your audience will virtually visibly cue you if you're losing them, right? The phone comes out, they start looking down, uh, they're looking off camera if you're on a video interview, which are increasingly more common. Uh, but you know, again, that comes from experience and that comes from doing mock interviews. And, you know, sometimes those mock interviews will make you cry. And, you know, I think that that's a really key thing. So, you know, finding a career coach, finding someone that can do mock interviews, especially when you get higher up in your in your career. You know, I don't know that anyone's gonna ask, you know, an entry-level security analyst to tell a story, but if you're going in front of the C, if you're gonna look, you know, interview for a C level or an SVP, EVP story, you're gonna need to be able to do that. And it's also an indication of success at the job. Back when I was an analyst at Gartner, I was very senior. So I was involved in a lot of the hiring process. And I would always, at some point in the interview, pose this. So I'm gonna give you three elements and I want you to tell me a story that includes them all. And I would say, I don't know, um, a baby shoe, um, a dog, and an umbrella. Right. And what I wanted to see was not how good the story was, but I wanted to see how they thought about it. And I would interview people and they would tell me three little stories. They say, okay, well, that's first of all, that is not what I asked. And it you need to be able to tell stories when you're advising people. You know, the the sort of flip joke that I make when I was an analyst, my job was to tell you you were bad at your job and have you say thank you. Right? Well, the only way you can do that is by understanding your audience's drive and understanding where they want to go and kind of helping them, helping them get there. But I mean, you nailed it, right? You you should know when you're rambling. And and it takes practice to do that, especially for people who are not used to doing it, have not been, you know, I I mean, I, you know, I had that job for 15 years. Um, you know, when I went looking for another job, it was it was a bit challenging because I had to kind of really, you know, rein myself in.

SPEAKER_00 35:23

Yeah, uh, and I shared um Jeffrey listened to our episode that we did with Matthew Dix, and um, and I and I really like his work and I like his books. And one of the things he talks about is how to find stories. And some of that, I think it's kind of a combination of approach of what you mentioned, using stories from history, stories that are told over and over, stories that people maybe not don't think about, and applying those in different situations. And then one of the things I really like that he talks about are homework for life and recording those little moments that are, you know, it's part of your day, but maybe something happened that you could just make a little note about that thing that happened. Number one, it helps you remember what happened during that day. But number two, everybody has everybody live is living life. You know, everybody has those moments when they're sitting down for breakfast in the morning and their kids come in and they're running late, right? If there's ways to to translate that of everybody's relatable moments to the point of the story of how you're connecting it to the cybersecurity topic, right? And that that's a little bit of an art form, I think, but it brings everybody in and you can help, they can start seeing that cinema of the mind, like visualization of like, okay, yeah, I can see myself in that kitchen, I can see myself at that table doing this, that, and the other. Yeah.

Perspective Tales: Elephant And Balloon

SPEAKER_03 36:49

And that's that hook that resonates. And and you know, it's interesting you you say that because so the the version of the presentation I did in Orlando a couple weeks ago was I leveraged four fairy tales from uh Hans Christian Anderson, who is a uh uh the famous storyteller from uh Holland. And he has a quote, and I'll actually read it, everything you look at can become a fairy tale, and you can get a story from everything you touch. And I think that kind of comes back to what you're you're talking about, which is the fact that you can get stories from everywhere around you. And I think part of it is about stepping out and becoming kind of an observer of your life and and being able to take that back. You know, there's the expression, right? Stop and smell the roses. And I think, you know, stop and find the story. And I think that's really interesting. And then also, you know, going to conferences and and listening to how other people deliver. And hey, that was really interesting, or that I was not that interesting. And that's okay. And then you kind of tweak that stuff as you go through the process and as and as you learn. And, you know, it's interesting you mentioned that that prior guest. So I listened to that podcast, and it was actually shockingly scary how much I have in common with him from upbringing and how we kind of stumbled into this and not even thinking about the fact that, you know, this like I never refer to myself as a storyteller until fairly recently. What's interesting now, though, is I've been doing this storytelling gig for 20 plus years. Now everybody says there's they're a storyteller, but I listen and they're they're narrating, they're not actually telling stories. I don't see a lot of creativity. Uh, and there have been some great books on on business storytelling, but I feel like to a certain extent, we get to the point where the ends don't justify the means. And I think becoming a storyteller for the sake of telling stories, I don't think is super useful. It's a tool to help us get our message across. And I always talk about there are three outcomes you want from telling a business story. One is you want to educate and inform the user. I want to show you something you've never seen before, make you think differently than you thought. The second one is about driving change in behavior, right? I want you to do this instead of that because here are some examples of every time somebody does that, it ends badly. And then the other one is really about um sort of getting a shift in perspective, getting people to think differently about a behavior, an action, a thing, or or whatever. Okay. And I think those, those are three really, you know, kind of important things. And they overlap and it's, you know, not always that simple. Um and I think that that's why planning and sort of, you know, practicing this is really important. And let me tell you, there are lots of opportunities. There are story slams and contests and open mic nights. And um, you know, it's interesting. My daughter is a physician assistant, and her mom took her to this story slam. And I don't really see my daughter as a storyteller necessarily, but she told this story, and I was like, oh my God, Alex, that was so good. And she did very, very little prep. It was something that happened to her. You know, she's a physician assistant, and it was really a story about, you know, something that happened in the hospital that that she was working in. And she's living it. So she was able to tell that. If I went and said, hey, I need you to tell a story about cybersecurity, she would struggle with that. I've gotten to the point in my career where I could do what I do for any industry, for any discipline, right? I have what I have learned is a unique talent, which at the time I didn't realize, which is I can sit down at the table with two people with discrete backgrounds, distinct backgrounds, and actually get them on the same page. I thought everybody could do that, but it turns out it's not that easy a thing to do.

SPEAKER_00 40:49

Yeah. What would be your advice for folks that, all right, they're on board, they believe in storytelling, we've convinced them. Um, you know, now what? What do I do if I want to get better at this?

Read The Room And Choose Hooks

SPEAKER_03 41:03

It's just a great question. I mean, certainly people can reach out to me on LinkedIn. Uh, I'm the only Jeffrey Wheatman on LinkedIn. I'm happy to help people with that. Um I think, you know, watching podcasts like this, there's a ton of sort of open and free training. I would not suggest people buy books about it until you're already a little bit comfortable because I feel like it's hard to apply that to sort of the real world. Um, you know, watch movies and then at the end of the movie, think about where where the story works, where the story fail. Um, you know, like I like sci-fi and fantasy. And the thing I always find interesting is people pick at that. I go, wait a minute, you have a problem with this, but you're okay with the fact that there are vampires in the story. That's like being nitpicky. So doing that, you know, going to conferences, watching other people, um, you know, listening and identifying where the story is in the interaction because they're always there. And and I think that's a great way. And then rehearsing, you know, your significant other, your kids, um, you know, learning how to tell jokes. Uh, and but then you also recognize, and and I I had this epiphany on stage, I was doing a storytelling presentation in front of about 500 young security people. And I just kind of hit me. I went, I said, I just thought about something. You guys all think you can't do this. And they all kind of nodded their heads. And I said, So I'm gonna tell you a little secret. I I'm uh I'm an introvert, and you know, that's the thing. And I created this character, and the character can be whatever you want the character to be. And and I created this character. So create your own character. Who do you want your character to be? You want your character to be funny, sweet, kind, loving, empathetic, sympathetic, and and you can kind of build that and you can tweak it as you go.

SPEAKER_00 42:54

Yeah. Yeah. Okay. All right, great. Well, thanks, Jeffrey. Um, this has been great. And I really I'm learning stuff too. I again, I feel like it's something that everybody can get better at. It is a skill. You do need to practice it. You need to research, you need to learn. Um, reach out to Jeffrey. Um, I'm sure he can help you. And um, and that's it, that's it. Thank you, Jeffrey. Anything else you'd like to share?

SPEAKER_03 43:20

Uh just think about once upon a time. Think how powerful that is and and and use that and recognize that people people like hearing stories because it's so ingrained in our our sort of, you know, our culture. And it's true globally.

SPEAKER_00 43:35

So yeah. Absolutely. All right. Thanks, everybody. Awesome. See you.

SPEAKER_02 43:41

Thank you. Thank you for tuning in to today's episode of the Cybersecurity Mentors Podcast.

SPEAKER_00 43:45

Remember to subscribe to our podcast on your favorite platform so you get all the episodes. Join us next time as we continue to unlock the secrets of cybersecurity mentorship.

SPEAKER_02 43:55

Have questions, topic ideas, or want to share your cybersecurity journey? Join our school community, the cybersecurity mentors, where you don't have to do this alone. Connect with us there and on YouTube. We'd love to hear from you. Until next time, I'm John Hoyt. And I'm Steve Higgeretta. Thank you for listening.