This week on Random Access Memories, I’m diving into my conversation with George Kamide, Head of Community at the CISO Society, co-host of Bare Knuckles and Brass Tacks, Executive Director at Mind Over Cyber and one of those people who seems to have about four jobs at once.

George is also one of my favourite people to talk to because he thinks differently. His background is in anthropology, not cybersecurity or marketing, and it shows. We went everywhere from burnout and why cyber attracts people who struggle to slow down, to why most cybersecurity marketing is broken, what startups get wrong with their first customers, why CISOs need to understand how their company actually makes money and what AI might do to the way we've organised work for centuries.

And apparently we both agree that 90% dark chocolate is basically self-harm.

Let's get into it →

Watch the Full Episode Now

Consistency beats intensity.

George talked about setting daily, weekly and monthly goals, but aiming for around a 70% hit rate rather than perfection.

I loved this because I am terrible at it. Whether it's marathon training, work, learning Hebrew or the card tricks I apparently decided I wanted to learn this year, I tend to turn everything into another target.

George's point was simpler. Build things you can sustain. Three walks a week. Ten minutes practising something. Small things done repeatedly.

You don't need to win every day. You need to keep showing up.

Cybersecurity marketing is scared of original thought.

This was probably the point where George really got going.

His view is that too much cybersecurity marketing is still recycling tactics that worked years ago. FUD. Cold calls. Huge top-of-funnel numbers. Scanning thousands of badges at RSA and pretending that's success.

Meanwhile buyers are sitting in private communities sharing exactly what they think about your company.

George asked a brilliant question:

Do you know how you're being spoken about in the rooms you're not in?

Your first customers should change your company.

George thinks startups need customer success much earlier than most founders realise.

Not someone who appears 90 days before renewal. Someone embedded with those first customers, constantly learning what works, what doesn't and feeding it directly back into product and marketing.

One question he asks founders stuck with me:

If someone uses your product, could it help them get promoted?

People still buy from people.

We love pretending purchasing decisions are completely rational comparisons of technology. They're not.

George's view was that most cybersecurity companies probably aren't going to lose because their technology is dramatically worse. They lose because support sucks, nobody answers the ticket or the customer simply feels like nobody cares.

A smaller company with slightly less feature parity can win because someone actually picks up the phone. The flip side is personal brand. The people representing your company become part of how people perceive the company itself.

Your company's reputation affects yours. Yours affects theirs.

How does your company make money?

And a surprising number struggle to answer it.

We've created a profession obsessed with proving technical credibility. More certifications. More domains. More expertise. Meanwhile the CFO, CRO and CEO are thinking about customers, revenue, growth and incentives.

Security doesn't exist to protect an abstract collection of servers. It protects the thing the business sells.

If you can explain an incredibly technical piece of work to another engineer but can't explain its value to your mum in four sentences, George thinks your career eventually hits a ceiling.

My favourite line from George in the entire conversation was probably: “You need to be a fanatical anthropologist of your early customers.”

It obviously makes sense coming from someone who actually studied anthropology, but the more I thought about it, the more I realised how applicable it is to cybersecurity generally.

We spend an incredible amount of time telling people what they need. Founders tell CISOs what their biggest problem is. CISOs tell engineers what the business needs. Security teams tell employees how they should behave. Marketers tell buyers what they should care about. Then we're surprised when real humans don't behave the way our strategy deck predicted.

George's point was that startups, particularly with their first 20 or 30 customers, should spend far more time simply observing. How do people actually use the product? How do they describe it to someone else? What frustrates them? Who influences their decisions? Where do they spend their time? What actually makes them successful?

One example I loved was George talking about companies scanning hundreds of badges at RSA and celebrating the number as a marketing success. But how many were actually relevant? And perhaps more importantly, what are those people saying about your company when you're not in the room?

It reminded me of something I've increasingly realised throughout my career. The closer you get to the actual humans experiencing the problem, the more different reality tends to look from the PowerPoint.

We love frameworks, dashboards, analyst reports and market data because they make everything feel measurable and predictable. But sometimes the best research you can do is shut up and watch how people actually behave.

Spend less time studying the market. Spend more time studying the humans inside it.

Something George said right at the beginning of the conversation stuck with me.

I always ask guests who their hero is. I've had parents, grandparents, famous leaders and all sorts of answers. George chose his daughter.

What I liked was his reason. He talked about watching her become an independent thinker. Someone who doesn't seem particularly interested in impressing everyone around her or constantly looking for validation.

As someone with Ollie and Izzy growing up in a world that seems increasingly built around validation, I thought about that a lot.

As parents we worry about the obvious things. Are they doing well at school? Are they making friends? Are they confident? Are they resilient? Are they going to be successful? I know I probably spend too much time trying to prepare my kids for whatever I think the world is going to throw at them.

But perhaps one of the best outcomes we can hope for is much simpler. That they become comfortable enough with themselves that they don't need everyone else to approve of who they are.

That's probably harder now than it was when I was their age. Likes, followers, group chats, algorithms and a permanent window into what everyone else supposedly looks like, owns and achieves. Although, to be fair, adults aren't exactly immune. LinkedIn might just be the grown-up version.

I don't want my kids to ignore other people's opinions. There are plenty of times I desperately need them to listen to mine!

I just hope they learn the difference between listening to other people and letting other people define them.

If that's what George is already seeing in his daughter, I completely understand why she's his hero.