This week on Random Access Memories, I’m diving into my conversation with Jason Cenamor, founder of the CISO Society and Confide Group.

The CISO Society started as a Zoom call.

No grand business plan. No five-year strategy. No carefully designed monetisation engine. Jason basically wanted somewhere CISOs could talk without somebody immediately trying to sell them something…It grew to around 2,000 members.

Which is particularly interesting because Jason did a lot of the things we're usually told not to do when building a business. He waited ages to monetise it. The money ran out. He went back and got a full-time job. He refused money when taking it would damage the community. Even now, he says no to vendors willing to pay because there simply isn't room for them.

That led us into a much bigger conversation about community, events, networking and why cybersecurity has turned the word community into something almost meaningless.

Because, as Jason put it:

If you're on a freaking mailing list now, you're part of a community.

You're not.

Let's get into it →

Watch the Full Episode Now

Jason built the CISO Society because he wanted CISOs to talk without somebody immediately trying to sell them something. Revolutionary, apparently. He spent months manually encouraging conversations, connecting people and making sure questions got answered. He could have monetised earlier but knew that turning members into prospects would destroy the trust he'd built. Compare that with the hundreds of companies launching "communities" whose primary objective is generating pipeline.

If the whole thing exists to eventually sell me something, stop pretending it's for my benefit.

One of the most interesting parts of Jason's story is that the CISO Society grew faster when he stepped away to take a full-time job. Members started conversations, invited others and helped each other without him orchestrating everything. Too many founders and leaders confuse being indispensable with being successful. If every conversation, decision and relationship needs you in the middle, you've built a dependency, not a community.

The real test is whether people still turn up when you're not there.

Jason and I agreed on something I've complained about for years. Most cybersecurity conferences are painfully boring. Endless panels, recycled opinions, vendor presentations disguised as education and sponsors buying their way onto stages. We've optimised events around how many things organisers can sell rather than whether attendees get anything useful. Jason's Anti-Summits deliberately restrict sponsorship and prioritise participation.

Maybe the reason people hate so many conferences isn't the content. It's that attendees have become the inventory.

Marketing wants to know how many leads an event generated, how much pipeline a dinner influenced and whether a sponsorship delivered ROI within ninety days. Jason told me about a vendor closing two deals through the CISO Society without ever attending an event. Members simply recommended them. I've experienced the same thing throughout my career. Relationships create opportunities months or years later, often through people you didn't even realise were involved.

We've become so obsessed with attributing revenue that we're destroying the relationships responsible for generating it.

Jason admitted he started networking far too late because he didn't want to become one of those people who seemingly knew everyone. Eventually he realised how much opportunity he was missing. I've never really applied for a job, and Jason sees similar patterns among CISOs finding their next role through the Society. Yet people still spend thousands on certifications while avoiding the conversations that might actually change their careers.

Nobody is suggesting competence doesn't matter, but being brilliant and invisible is a terrible career strategy.

We've absolutely butchered the word community.

Every cybersecurity company seems to have one now. Join our community. Attend our community dinner. Subscribe to our community newsletter.

No. You've collected my email address and put me in Salesforce.

That's not a community. That's a database.

And I think the problem goes deeper than terminology. We've taken something fundamentally human and tried to turn it into another measurable marketing channel. We want community engagement, community attribution, community-generated pipeline and community ROI. Preferably by the end of the quarter.

Then we wonder why people don't engage.

Jason's story challenges that entire approach. The CISO Society grew because people wanted to help each other, not because they were being nurtured towards a purchasing decision. When somebody asked a question, another member answered. When somebody needed a job, people helped. When somebody wanted advice, they got it without a sales pitch attached.

That's community.

And here's the uncomfortable bit. A real community doesn't need your company to be the centre of every conversation.

In fact, the best communities probably work better when you're not.

That's terrifying for businesses obsessed with controlling the customer journey. You can't dictate what members discuss, which products they recommend or whether they'll ever buy from you.

But perhaps that's exactly why it works.

We've spent years telling people to build trust while simultaneously designing every interaction to extract commercial value from them.

Stop calling it community when what you actually mean is customer acquisition.

There's nothing wrong with marketing. There's nothing wrong with selling.

Just stop dressing it up as something else.

I've started ending every RAM episode with a question from Izzy. She's eight, so her questions tend to have absolutely nothing to do with cybersecurity, leadership or whatever we've spent the previous hour discussing.

Jason's question was what he'd do if he could go back and choose a completely different career. Professional footballer was his answer. For Spurs, unfortunately.

But it got me thinking about the time I spend with Izzy. Whether we're playing Bouncy Cat on the trampoline, answering one of her endless questions or just messing around, I increasingly realise how important those moments are. Not because I'm teaching her something profound every time, but because she's giving me the opportunity to be part of how she sees the world.

Throughout my career I've been incredibly fortunate to have people give me their time, advice and wisdom. Karl Mattson helped me enormously when I moved into a Field CISO role. Jason has done the same. And I've found myself passing that advice on to others, sometimes without even realising where I originally learnt it.

I hope I can do the same for Izzy and Ollie. Not necessarily with career advice, but with the things that actually matter. How to treat people, when to stand up for yourself, why helping somebody without expecting anything back is important, and how to make your own decisions.

The funny thing is, I probably spend far too much time thinking about how to be successful at work, while some of the most important things I'll ever do involve answering an eight-year-old's questions or being chased around a trampoline pretending to be a cat.

Maybe the most valuable thing we can pass on isn't what we've achieved, but what other people took the time to teach us.