This week on Random Access Memories, I'm looking back at my conversation with Mike Privette, founder of Return on Security.

Mike spent years climbing the cybersecurity ladder, eventually becoming a CISO. Then he walked away to build a newsletter.

That newsletter became a cybersecurity market intelligence business, and Mike discovered an entirely different side of the industry. Building products, analysing investments, tracking acquisitions and understanding where the money was actually going.

And then, after all that, he became a CISO again.

I think that's what makes his story interesting. We've become obsessed with the idea that careers should follow some predetermined trajectory, where every move needs to be a promotion and changing direction somehow represents failure.

Mike's journey challenges that.

We also discussed the AI security gold rush, where he wouldn't invest $50 million, why companies are obsessed with exits and the sacrifices we make chasing professional success.

Sometimes the best career move isn't up. It's somewhere completely different.

Let's get into it →

Watch the Full Episode Now

Mike went from security engineer to CISO, left to build Return on Security and eventually returned to being a CISO. Apparently careers don't have to follow the neat progression LinkedIn would have us believe. We spend so much time worrying about whether our next move looks like a promotion that we forget to ask whether we'll actually enjoy it. Mike's time building a business gave him an entirely different understanding of the cybersecurity market, which arguably makes him a better security leader today.

Moving sideways, stepping away or starting again isn't necessarily a setback. Sometimes it's how you become better at what you were already doing.

Mike started Return on Security because he was genuinely interested in understanding the cybersecurity market. What began as a spreadsheet eventually became a database, newsletter and intelligence platform. But when he wanted to publish his first personal blog post, his employer took six months to approve it. Six months! We've somehow created corporate cultures where people are encouraged to be thought leaders, provided they don't actually share any thoughts without permission.

If your employees are building expertise, developing new skills and becoming more valuable to the industry, perhaps stop treating that as a threat.

Mike spends an enormous amount of time tracking cybersecurity investments, so naturally we discussed where the money is going. AI has attracted ridiculous levels of investment, but putting a language model behind a security dashboard doesn't automatically create a valuable company. Mike believes the market is starting to distinguish between superficial wrappers and companies solving genuinely difficult problems. I hope he's right.

If your competitive advantage disappears every time a model provider releases an update, I'm not convinced you've built a business. You've built a temporary feature.

I asked Mike where he wouldn't invest $50 million. Application security was one area he'd approach cautiously, given the extraordinary competition and convergence across AppSec, cloud security and autonomous testing. But we also discussed the obsession with building companies purely to sell them. Raise money, grow at all costs, sell to a giant and repeat. What happened to building a profitable company that customers actually love? Mike has spent years building Return on Security without following the traditional venture-backed playbook.

Maybe the best business isn't the one somebody eventually buys. It's the one you never need to sell.

Mike talked about moving his family from America to the UK and how his career decisions were increasingly influenced by the life he wanted outside work. He'd spent years travelling while his children were young and wanted greater control over his time. It's something I think about regularly. The years we're expected to work hardest, travel most and establish our careers are often the same years our children are growing up.

You can always take another job. You can't go back and be there for your children's childhood.

I think we've got career progression completely wrong.

Analyst. Engineer. Manager. Director. CISO.

Congratulations. You've completed cybersecurity.

Now what?

We've created this ridiculous expectation that every career move should be upwards. Bigger title, bigger company, bigger salary, bigger team.

Anything else is somehow viewed as failure.

Take a career break? Falling behind.

Start a business? Risky.

Move into a different discipline? Why would you throw away everything you've built?

Go back to a previous role? Clearly things didn't work out.

It's nonsense.

Mike's story is a great example of why.

He became a CISO, decided to build something completely different, spent years learning about cybersecurity from an entirely new perspective and eventually returned to the CISO role.

Does that mean Return on Security was a failure?

Of course not.

He built a business, developed new skills, created relationships and gained an understanding of the industry that most security leaders simply don't have.

And he didn't have to permanently abandon one career to explore another.

Why do we insist on treating careers like irreversible decisions?

I've experienced something similar throughout my own career. Some of the most valuable things I've learnt haven't come from doing the job I was employed to do. They've come from advising companies, speaking, writing, building relationships and increasingly through conversations on this podcast.

None of those things fit neatly into a traditional career development plan.

And that's probably why they've been so valuable.

We also discussed Mike's experience of needing six months of approval just to publish a personal blog post.

That tells you everything about how some companies view professional development.

They want innovative employees who challenge conventional thinking, develop expertise and become industry leaders.

Just don't do anything independently.

Don't write.

Don't build.

Don't experiment.

And definitely don't develop a reputation that exists outside the company.

Then they wonder why talented people leave.

The best professionals aren't necessarily the ones who've spent twenty years climbing the same ladder. They're often the ones who've had the courage to climb down, try something else and come back with an entirely different perspective.

Mike left the CISO role.

Built something he cared about.

Then became a CISO again.

Maybe the lesson isn't that we should all quit our jobs and start newsletters.

Maybe it's that changing direction doesn't mean you've lost your way.

I was thinking the other day about how quickly Ollie and Izzy are growing up, and how little time I've actually got left with them being kids.

Ollie's twelve now. He's started secondary school, becoming more independent and increasingly interested in spending time with his friends rather than his dad. Izzy's eight and still wants me to play Bouncy Cat on the trampoline, answer endless questions and spend hours doing things that probably look completely ridiculous to anyone watching.

And I know those moments have an expiry date.

It's something Mike and I discussed during our conversation. He'd spent years travelling for work while his children were young, building his career at exactly the time they probably needed him most. He talked about wanting more control over his time and making decisions that allowed him to be more present.

It made me realise how backwards the whole thing is.

We're expected to work hardest in our twenties, thirties and forties. Build careers, earn promotions, establish financial security and make sacrifices so we can eventually enjoy the rewards.

Except those are also the years when our children are growing up.

By the time we've built enough financial security and career freedom to slow down, our kids are teenagers or adults who have their own lives and don't particularly want to spend every weekend with us.

I've worked incredibly hard to build my career and create opportunities for my family, and I don't regret that. But I also don't want to spend the next ten years chasing financial freedom only to discover I've finally got all the time in the world and nobody at home particularly needs it anymore.

I don't think the answer is to stop being ambitious or abandon our careers. Our families need financial security too, and I want my children to see the value of hard work.

But there has to be a balance. One where we can build successful careers without constantly sacrificing the years that matter most.

The world seems to expect us to sacrifice time with our children now so we can afford to spend time with them later. Except later, they might not want it.

And that's probably why finding balance now matters far more than achieving freedom eventually.