This week on Random Access Memories, I’m diving into my conversation with Assaf Keren, CISO at Meta and someone I’m lucky enough to call a good friend. Assaf spent almost a decade at PayPal, eventually becoming CISO, before joining Qualtrics and now Meta. He’s also just written a book about security leadership, built around something I love: his own failures as a manager. We talked about why your team should tell you when you’re wrong, asking his boss to downgrade his performance review, whether AI is accidentally killing the path to becoming a CISO, burnout, PTSD and why great leadership requires stating reality while still giving people hope.

Let's get into it →

Watch the Full Episode Now

If your team can't tell you you're wrong, you've got a problem.

Assaf told a brilliant story about a PayPal leadership programme where someone watched one of his Israeli directs openly tell him he was wrong. She was horrified. His response was basically: if I'm wrong, why wouldn't I want to know? Assaf doesn't believe the leader should be the smartest person in the room. Neither do I. Your job is to hire people better than you at their jobs, then create an environment where they're comfortable challenging you.

If everyone in the room agrees with the boss, you probably don't have alignment. You have fear.

Why I asked my boss to downgrade my performance review.

This might be the most Assaf story ever. His boss gave him a performance rating and Assaf thought it was too high, so he asked him to lower it. Why? His individual team members had performed well, but the security organisation hadn't achieved everything Assaf believed it should. He wanted them recognised for their success while he took accountability for what hadn't happened. His obsession is with outcomes, not activity, and there's a massive difference between saying what you did and proving what you accomplished.

Success belongs to the team. Failure belongs to the leader.

AI might be killing the career path that creates future CISOs.

Most security leaders I know started somewhere near the bottom. SOC analyst. Pentester. Junior engineer. GRC analyst. You did the repetitive stuff, learned the foundations and gradually got trusted with bigger problems. AI is starting to remove exactly that work. Assaf thinks we'll need to deliberately bring back apprenticeships so experienced leaders can teach people the craft that previous generations learned by doing.

If AI removes the bottom rung of the career ladder, we need another way for people to start climbing.

Burnout can look a lot like ambition.

At PayPal, Assaf spent around a year working an Israeli day followed by a US day. On good nights he finished around 1am. Bad nights were 3 or 4am, with 15-minute power naps between meetings. The interesting part was why. He was scared of losing control, missing conversations and becoming irrelevant. Eventually he was physically ill, emotionally reacting to everything and close to leaving security entirely.

Sometimes the person closest to burnout is the person who looks the most committed.

Sometimes leadership is pressing Enter.

During COVID, Assaf learned someone on his team with PTSD was struggling and frightened to admit it. Assaf had PTSD too, but almost nobody knew. So he wrote about his own experience in a PayPal Slack channel containing around 40,000 people. Then he spent three days staring at the message, terrified of what would happen if he sent it. Eventually he pressed Enter. The response was incredible, but the thing he said afterwards stuck with me: "That was the moment I started healing."

You can't ask people to be vulnerable if leadership is never willing to go first.

At the end of the episode I asked Assaf for the one lesson he'd give people. His answer was simple: "State reality. Inspire hope."

Cybersecurity is REALLY good at the first half. Everything is vulnerable. Attackers are winning. AI is terrifying. Your supply chain is compromised. Your backups probably don't work. We're an industry that has spent decades getting very good at explaining all the ways everything could go to shit.

We're much worse at the second half.

Great leadership isn't pretending those risks don't exist. It's looking directly at them and still giving people confidence about what happens next. Yes, we're going to have incidents. Yes, something will eventually fail. Yes, there are things we cannot control.

But we know what matters. We know what we need to recover. We've surrounded ourselves with good people. We'll adapt when the plan inevitably goes wrong.

It's probably why Assaf's phrase resonated so much with how I think about resilience.

Resilience isn't believing the bad thing won't happen. It's knowing that when it does, you'll be okay.

Security has spent decades teaching businesses to be afraid. Maybe great security leadership is learning how to give them confidence too.

State reality. Inspire hope.

Something Assaf said at the very beginning of the conversation stuck with me all the way through it.

I always ask guests who their hero is. I've had parents, grandparents, famous leaders and all sorts of answers. Assaf chose his wife.

Partly because she built her own career as an artist while helping raise their three children and supporting Assaf through a security career involving incidents, travel and plenty of late nights. But later in the conversation I realised there was another reason his answer mattered.

His wife was also the person willing to tell him he needed help.

She pushed him towards therapy when he needed it. That's a very different kind of support from simply telling someone everything is going to be okay.

It made me think about Hayley and the people closest to me. The people who genuinely care about me aren't always the people telling me I'm doing brilliantly. They're often the people telling me I'm working too much, making a bad decision, being unreasonable or need to change something. And those are usually much harder conversations to have.

Being nice isn't the same as being kind:
Nice makes someone feel good. Kind sometimes means telling them something they really don't want to hear.

The right people challenge you:
Assaf wants employees who tell him he's wrong, a boss who holds him accountable and a wife willing to tell him when he needs help. There's probably a common thread there.

Build a network that tells you the truth:
We talk about surrounding ourselves with people who will catch us when we fall. Maybe equally important are the people willing to tell us we're heading towards the edge in the first place.

The people who love you most aren't always the ones who agree with you. Sometimes they're the ones willing to risk an uncomfortable conversation because they care more about you than your reaction.