Lessons from the Frontlines

CHAPTER 8State Reality, Inspire Hope

I mentioned in Chapter 2 a framework that transformed how I communicate as a security leader: “State Reality, Inspire Hope.” That lesson came from one of the most embarrassing moments of my security leadership career, and it’s worth telling the full story here because it illustrates something fundamental about how security leaders should approach difficult conversations.

The moment happened in a conference room at PayPal, in front of Dan Schulman, the PayPal CEO, and a group of executives. It was supposed to be a meeting to discuss security issues we’d identified in a specific product. I had prepared thoroughly, gotten coaching on my approach, and felt ready to demonstrate the seriousness of our security posture.

I spent the first 15 minutes detailing everything that was wrong. Following what I thought was age-old security culture, I was highlighting how bad things were. I’d been told I needed to “tell the CEO how bad things are” to make sure he “understands.”

Fifteen minutes into my comprehensive catalog of problems, the CEO interrupted me. He was visibly annoyed.

“I don’t need you to tell me that things are bad,” he said. “I know they are. What are you doing about it?”

In that moment, I realized several things simultaneously. We had all missed an opportunity to build trust in our abilities as leaders. This was supposed to be a risk and security meeting to show how bad things were, but we hadn’t included the product owner or the engineering ...