It's been an active month for me, chock full of engrossing conversations, engaging ideas, and free-flowing dialogue. I always enjoy attending RSA, teaching for SANS (this time in San Diego), and was very honored to receive an award. Seems like I've barely had a moment to exhale. Now that I've found some time, I want to reflect on an interesting interaction I had at the RSA Conference.
As you might imagine, AI was a hot topic at the conference...but it certainly wasn’t the only thing on people’s minds. In fact, the real buzzword du jour among senior cyber professionals was Velocity. Since ChatGPT was released in November 2022, corporations have become hyper-concerned about the topic of velocity. Put simply, businesses want to move faster than the competition to get to the finish line first. This has become of particular concern to cybersecurity professionals, who are often viewed as roadblocks or impediments to progress rather than as partners in success. In one after-hours gathering, a half-dozen CISOs animatedly discussed the situation. "We're increasingly being told to ‘move fast or move aside,’ yet if something goes wrong we're the ones being scapegoated," one technology CISO lamented. The others chorused agreement.
As the only non-current CISO at this gathering, I kept quiet and merely listened; then one of my colleagues called me out. “Okay, share,” she said. “I know you have an opinion. Spill it.”
So I did.
Let me begin where I intend to end: The formula for creating velocity starts with building an effective team...and building an effective team starts with making time for one another.
A team can only move together when they all have a single objective and a single mindset. Does a dog sled move when all the sled dogs are trying to go in different directions? Does a fan work if half the blades are bent or broken? Are a collection of people that look out only for their own self-interests; obfuscate to distort reality; hoard resources; and work on disparate initiatives with discordant goals actually a team? No to all of the above. Velocity can only be achieved when all members of a team pull in the same direction.
Sounds pretty basic, right?
Velocity, at its simplest, is “speed in a given direction.” In the past, I’ve used the phrase “motion versus movement.” If everyone runs off in fifteen different directions, they may be moving quickly, but they’re getting nowhere. Velocity - movement - necessitates directionality. Any organization bigger than one person requires some level of agreement on what that direction will be; otherwise, you get churn. Motion, not movement. Further, as most organizations are working on more than one project or objective in order to support the given vision (direction) of the enterprise, there needs to be true understanding, appreciation, and respect for the tasks and objectives of all members with whom you are taking the journey.
Being a team enhances productivity by bringing together diverse skills and perspectives. This normally results in more effective (and efficient) problem solving for the organization. This is not just my opinion, but is backed by scientific research. Now here’s the challenge that businesses run into: businesses are comprised of people, and people have agendas, goals, career aspirations, and performance objectives to meet.
Folks, velocity isn't a tactical fix; it's a cultural one that requires leadership (at all levels) to foster, reward, an nurture the team dynamic. Becoming a team requires more than off-sites, trust falls, and morale building exercises; it requires the visceral recognition that a truly collaborative focus accelerates an organization toward success. It starts with collective engagement as a team, versus as a “collection of individual relationships with the boss…(e)ach individual vying with the others for power, prestige, and position.”
Patrick Lencioni has expanded and marketed this ages-old leadership concept as the “First Team Principle,” -- the idea that my peers are my first team and that as a team we must rely on one another, trust one another, and work collaboratively in order to enhance the organization as a whole. This change in mindset fosters an environment of creative problem-solving and collaborative intention that elevates and edifies all members, rather than one or two ‘winning’ while someone else gets fired. An effective First Team actively helps and seeks help from one another to solve problems, thus allowing the organization as a whole to move faster. Unfortunately, many organizations decouple First Team principles from velocity, attempting to solve for the latter without addressing the former. While organizations can achieve short term tactical successes with this approach, they find themselves invariably circling the same issues over and over again with minimal progress because each individual is running a single script rather than the team playbook.
In my mind, my peers aren't just my First Team; they’re my brothers-in-arms, and their needs and concerns are, therefore, my needs and concerns. Thus, when my peers reach out to me, I respond...and I make responding a priority. My workday doesn’t end until I’ve addressed all requests from my peers. Period.
I put these principles into practice with an organization for which I recently consulted, which had repeatedly sought to remove "blockers" from the team with minimal success. As the virtual deputy CISO, I was asked to lean into the problem. I called the CISO's direct reports together and made exactly one pronouncement:
"If there is a conflict in execution, your first task is to talk to one another. The CISO is deliberately pushing the organization by tasking each of you 5% more than you think you can handle. Sometimes that raises conflict. Your job, bluntly, is to make lemonade out of two apples, a grapefruit, and a kumquat, and figure out how to make it work if at all possible. If after talking to one another you can't, then come to me and I'll set the priority, adjusting the timeline for the other impacted tasks and communicating the new timeline to the CISO. But if you don't talk to one another and get creative first, you're both still on the hook and no adjustments will be made.”
The first three weeks after this mandate found my calendar inundated with conflict resolution meetings. In some cases, managers tested my "talk to one another'' mandate and left empty-handed. In other cases, they needed input to help them towards a creative solution. After three weeks, my deconfliction meeting load dropped to about one a month...then to about one a quarter. Somehow, once they made time for one another, they figured out how to make the lemonade. Even better, their responsiveness to the enterprise as a whole improved measurably (and markedly!) as they were no longer tripping over their own feet.
Many leaders and organizations say they make time for one another...but do they really?
How many leaders make certain that they don't go to bed at night without answering a peer's email or Slack message? And, if that answer falls out of the bounds of a normal workday (and shame on you if it does because that means you’ve de-prioritized your peer), how many let their peer know when they will prioritize time for them the next workday?
How many leaders make sure that their peers’ requests for task completion are met within the required deadlines/timeframes? (I recently had a peer wait until the 3rd reminder to pass along a completion requirement to his organization…then stay silent when his neglect caused his organization to miss an opportunity and his people started complaining to me).
How many leaders leave time in their calendars for unscheduled peer conversations and discussions – and communicate those windows to their peers?
As I write these words, I can hear the chorus of excuses as to why these things aren’t happening. “Who has the time?” “My calendar is already full.” “I’m just too busy with my own projects.” To those who would make such excuses, I would state that you are sacrificing velocity (a strategic imperative) for tactical expediency. You are, therefore, your own speed bump.
Make time for one another, folks; you’ll be surprised at what it does for your team.
My two cents…