Feedback and Foresight: Strengthening Corporate Intelligence with Red5 Security’s Karna McGarry

00:00

Chuck:

Karna McGarry is a seasoned intelligence and security professional with two decades of experience spanning the private sector and the intelligence community. She has held key roles at the CIA, State Department, and Office of the Director of National Intelligence, providing intelligence and analysis and risk assessment to senior policymakers, military leaders, and corporate clients. In the private sector, Karna has led intelligence programs for multinational security firms, advised fortune 500 companies on threat management and risk mitigation. And as vice president of managed services at red five, she continues to refine corporate intelligence strategies and develop security programs for businesses and private clients. Karna, welcome to the Connected Intelligence Podcast.

Karna:

Thank you so much. I’m thrilled to be here.

Chuck:

Do you like that pause? It kind of makes it more like, because we have a Jane Bond today, right? We’re going to talk about all that. No, no, no, no, I know we already did that. I’m excited because it, you know, it’s not well, it’s, I always enjoy somebody who’s come from the government side, but already has a robust, you know, background in the corporate side to kind of talk about what do you see? What’s different? What’s, you know, what’s the same. So I really appreciate you spending time with us in the audience today.

1:49

Chuck:

Let me jump right into it. So as I said, like you’ve seen a variety of. Analysts and security programs from, you know, the agency to now your work and efforts at red five. If you could, if I could ask you to kind of sum up those and think like, what are some common issues and things you see amongst intelligence teams?

Karna:

Yep. I think one of the, and this ties well to what we’re talking about today is, when teams aren’t set up to incorporate feedback, there’s a sense of they’re just sending stuff off into the ether, right? Remember when banks had the pneumatic tubes, you put your stuff in there and off it went. Like that’s how it can feel for an analyst, whether you’re at a GSOC, whether you’re a geopolitical analyst, or even sometimes a analyst at the agency. The most unsatisfying thing for an analyst is you’ve done the time, you’ve done the product and off it goes. Did it matter? Did anyone read it? did have any impact, that’s a very unsatisfying, not only from a professional development, but just where’s your place in the mission, where’s your place in the operations, how are you helping to protect people, places and things, whether it’s an enterprise or even a national security. So surprisingly, even within the agency, you would still have those days. And I still see that translated in the private sector. Another issue which is common is just pace of business. So that pace of business, impedes the ability then for analysts to make sure we’re doing forecasting, that we have time to do signposts and indicators, that we’re looking at trends, again that we’re incorporating the feedback that we know where the overall structure is going, right, because you can see as an analyst you’re so buried in the day-to-day, the weeds, the threats that are coming in, and sometimes you’re right here and you forget to see What’s happening? Where are we going? Um, and the pace of business is that’s just a natural component of it. And for me being in both sides and management, both sides that really falls to the managers. And I’m even guilty of it too. Now, like even in prepping for this podcast, going through some of the best practices, it’s like, Oh man, when was the last time I did that with our team? And I had my own. sort of list of items. So that’s a commonality. And we can talk about in our chat today, some quick tips of how to get around that.

Chuck:

But yeah, first off, let me I love the idea about feedback. I mean, when, you know, a few decades ago, when I ran the global Intel team, or, you know, I had the global Intel team at a fortune 50 under my purview, you know, something we would talk about a lot is, is, you know, especially folks that came from the government side is like, you know, if you can just take 5 minutes and help them understand your analysis helped drive something. Sometimes you can’t always say exactly what, but I think you’re absolutely right, because it does help connect the sense of purpose to the analyst. Because that can be very unfulfilling, can it?

Karna:

Yep, yep, exactly. And you Exactly. I read your background, so I know how big that bureaucracy was, but even the government, right? And so the best feedback would be, you know, as a CIA analyst, if I’m sitting, let’s say I was supporting you in the war zone, I sat across from you and I’m helping you, you could be like, Karna, today, I’m really concerned about this, this, this product you read. I have a question about that I get that amusing and I know as an analyst how I can help you my customer would be commander POTUS ambassador, but the structure in the enterprise I think that’s one differentiator is there’s not quite that intimacy, right, because we’re not sitting side to side in the war zone,” or, I’m not walking down the hall,” or, I don’t have a chance to go brief you. And so I think the challenge is higher in the enterprise sector to make sure that feedback from the upper leadership trickles down to that day-to-day.

Chuck:

Yeah, that’s interesting, because, I mean, to kind of use the vernacular that we just have been here, they’re not warfighters. So, you know, you don’t always have a warfighter mentality all the way up. And by the way, I don’t think that’s either of us saying that’s good or bad. It’s just an observation in an enterprise or a corporate level where, so there’s not that maybe, um, and if, if I get this wrong, please correct me. There’s not maybe that urgency of that you might have with a war fire, like, Hey, we’re going to go after a high value target. Everybody’s on point. And there’s a certain level of, uh, um, energy around that as opposed to, Hey, we’re getting ready to go launch something or we’re going to go do something. Thank you. And then walk away. And now the analyst feels like, well, was that even important? I mean, I know in some level, we’re talking about the intelligence cycle here too, in the idea of feedback.

Karna:

Exactly, exactly. Yep.

6:29

Chuck:

Let me ask you about pace of business, which I love. And my first thought that was like, what is the, what was the equivalent of pace of business? on the .gov side?

Karna:

Well, I came in at a time when we were fighting two wars. I was a Mideast person, so I didn’t come in on a slow account, right? And we were at a time, too, where they were sending people who were atypically probably not being sent overseas, overseas a bunch, and that was primarily analysts. I did back-to-backs-to-backs, right, because mission mandated it, so there you are. So that pace of business was Right here on fire. I immediately was into something and it was from zero to 60 pretty much. Yeah. Yeah. Yeah. Throw it in the deep end of the pool and you go and you know, you hit the ground and it’s the chief yelling at you or the ambassador or the CG or whoever. And you’re like, okay, this is, this is how we do it. Um, but that’s unique to the agency and that’s unique to agency also in certain situations in time. That being said, a lot of scar tissue came out of that and it was useful coming into the enterprise. When there is a sense and everyone is busy, I’m not diminishing that, but to your point, Chuck, like it’s not that American lives are immediately at stake. And if we don’t get this right, this could go sideways. There is moments to pause and break. And I think that’s one thing in this conversation I’d like to encourage my colleagues and especially managers is actually have more space than they think. And some of the things we’re talking about, I think at first glance, people assume, oh, I don’t have time for that. This is going to require taking people offline for an hour or where am I going to fit this into my day versus you already have some natural rhythms that can help with that feedback process in your day. And it’s just a matter of finding those and incorporating this. This shouldn’t be an extra lift for anyone, but there’s a cadence. It’s just a matter of allowing yourself to pause, you know, having your analysts be part of that, having your peers management and find those waypoints to incorporate that feedback.

Chuck:

You bring up a really good point about scar tissue, um, that you bring with you. And I, It just occurred to me now, like, and I’m guilty of this. So I’d like to apologize to all those people that worked for me before. And I brought a false sense of urgency when one wasn’t required, because that is the muscle memory that I brought with me from my, my military side over to my civilian or my, my enterprise side, as you say. So how do you, I mean, how do you, as a manager or a leader coming from that side where it’s all hands on deck all the time, everything’s on fire. We are very, you’re right, we’re very guilty on the corporate side sometimes of making false fires because that’s just what we’re used to. So how do we, one, how do you recognize that in yourself? And two, how do you counter that so that you can see true fires as opposed to everything being a fire?

Karna:

Yeah, no, that’s great. And I like to think like, I always kid with people, there was, you know, the war zone version of Karna and the version of Karna today. Karna today is much more enjoyable.

Chuck:

What kind of knife did Warzone Karna have?

Karna:

But I mean, as you know, it was just, it was so intense and you had to be intense to survive and do your job. And it was what it was like, but there was that transition. And I’m sure everyone listening who had that experience, you have to downshift, you know, it could be bumpy, but yeah, making sure that sort of adrenaline fix or especially when you come on the IC and it’s, you know, You’re making, we’re protecting a nation and you’re making history and you come into enterprise and it’s super important as well, but it would be irresponsible for me to bring that tension. And there were times where when I first came in, I had to learn to, you know, pull off the throttle, give more, give less. Um, but that’s part of that, just watching what’s the culture of the enterprise to some enterprises. If they are doing, let’s say, contracts with the government and they are involved in defense, they’re going to have a little more of that, right? Like each enterprise is different. However, I think, especially as a manager and at senior leadership, and I’m sure you know as well, it is our job to be calm. Right? Like I think that’s part of that scar tissue is we know what that intensity is. And so then I can recalibrate and say, this isn’t that. How do I rack and stack it? And if my team is panicking, you know, that ethos comes from the top. I’m not serving them well if I’m also panicking or if I’m also worked up. It’s my job to be at the helm and say, I’ve got this. We’ll see you through. Let’s, you know, pace it through it is, but I shouldn’t be panicking because my team looks to me to say, all right, Karna’s got this. This is how we go through. So you can still go through the paces. You can still be busy, but you have to, I think, you know, this is more of a leadership component, but you need to project. Like you’ve got it, you’re in control. And then they trust you to know when you say, now I am a little worried. Now they know to be worried too. Right. Because if everything’s a fire, then now you’ve negated the purpose of having some things escalated or not.

11:28

Chuck:

Yeah. And I’d like to like underscore and highlight that if they see, if, if you’re seen in the right way as a risk leader, if they see you running, everyone’s going to stop and say, what the heck is happening? So I mean, make sure if you’re running it, there’s a reason because all eyes are on you. You’re absolutely right. I think that’s, I think that’s, that’s spot on. Um, I’m curious as we think about like, you know, government to private side and all that, and you know, you have a storied career. I mean, do you have one or two or three, like lessons that you’ve learned that you impart on others? about that transition or about what you take and what you leave and how you should think about it? I mean, you’ve given us a few now, but do you have any, like, let’s call them Karna-isms? I just hashtagged that, by the way, so.

Karna:

Yeah. In terms of transitioning, just from Gov to private sector, Is that what you’re looking for, or more?

Chuck:

Well, OK, let’s, you know what, let’s take it on several levels. One, do you have a, you know, there’s a lot of folks that, I’m, I’m very cognizant, as you and I were talking, you know, there’s a lot of people that are being released into the private sector. So what might be one or two lessons learned that you would say, Hey, here’s two things to think about as you do that. And then I have a follow-on that’s more operational.

Karna:

Yeah. The first thing, um, again, I wish younger Karna would have listened, but I undervalued, or maybe I didn’t appreciate how awesome government training is. No, one’s going to train you as well as the government, right? Military, civilian, it doesn’t matter the amount of money and, um, high quality training that we get is phenomenal. I didn’t appreciate it at the time until you got into the private sector and you realize. how training is at a premium, either in just taking people offline or getting access or the money. So I would encourage everyone is all that training you got, that is invaluable. And especially at the agency you got top tier training, don’t discount that. That is a hugely valuable and all those skills transfer to the private sector. And it’s interesting enough, we bring this up. I was just reconnecting with a colleague a few weeks ago, same thing. He stayed in. You know, and I was encouraging him, like you have so much training experience that is directly translatable to enterprise. And for all the reasons you and I were just talking about when you are in, um, those stressful positions, the ability to, in a moment’s notice, rack and stack, what’s urgent when needs to happen, how can I translate actionable intelligence that’s timely and relevant to this customer when I’m sitting across when the, you know, The four stars mad and he wants to know what’s happening. And I see what that is. I have to make sure that when I open my mouth and I give that to him, that’s going to add value, right? Because we know. He’s gotten all the intel he needs from his theater of operation. So if I’m going to add something, it better be good. And so that ability to quickly hone in on what is of use to your customer and what is going to be of value to help them make that decision. I mean, the translation to the enterprise is obvious, right? Think about, then you’re sitting across from CEO, CFO, whatever. If I’m going to open my mouth, I’m going to give you something of value. So then later they’re going to be like, you need to make sure chief security is next to me and all this stuff. Like that was always my goal of when I was by the ambassador or someone else who has all the information, they’re reading all the raw Intel. And I’m there not representing Karna, I’m representing the IC. If I’m going to give something, it has to be a value and so it has to be worth their time, right? And that’s the lesson I carried through today. When I’m going to talk to my clients or I’m going to talk to a board or the CEO or whoever, if I’m offering something to them, I need to make sure that it’s good and it’s timely and it’s actionable and it’s carrying their information further than what they already have so they can make a decision.

Chuck:

You say something else in there too that I think is really important is you could be in a big enterprise or you could be like Red Five where you represent multiple clients, and you have to be on multiple calls a day, they might not remember Chuck Randolph or Karna, but they’ll remember, like, Ontic or Red 5 or whatever, and the feeling they have. So I think that’s also very important. Like when you’re there next to the ambassador, or say, you’re there next to the CEO, and they say, Karna, should we evacuate people from Ukraine? You know, that’s, that’s a that’s a bold question, and it’s going to have a statement. And, and they may not remember that, you know, who was that person that did it, but they’ll remember, you know, that analyst from corporate security or that analyst from Red 5 was the one that kind of gave that good advice. So what advice might you have for people transitioning?

Karna:

I would also say to not undersell or appreciate what those skill set and how it is transferable and I’m sure you saw the same there’s a tendency when you’re surrounding yourself, whether you’re in the military or I see everyone does the same things and by nature we rack and stack ourselves right so maybe You’re this, but you’re not even in this special operations community. They do it right. Like you’re this, but were you this and this and this. And so we hold ourselves to a very high standard. And then you’re trying to buy everyone who does all really high speed, cool stuff all day. So you think, well, I’ve got nothing to offer instead of no, actually you do. Back to your ability again to handle pressure situations. I think, especially with the agency, that creativity, the number of times the chief was like, This was not in my wheelhouse, but I’m going to ask you to do this and you need to work with this person, this person and figure it out. Go. And the enterprise that’s huge, right? Like how do we bring different groups together? How do we bring the analysis, the operations, the mill? We all had a problem solve something because we were asked to. That ability to bring different groups, different stakeholders. I think people in the government should reflect how often they do that and how much that transfers to the private sector.

Chuck:

Joint operations is a superpower that you bring with you from government or military service that is a superpower. Because sometimes in enterprise, look, we, I deal with enterprise level folks all the time, you know, just like you. And just, you know, how often do we hear like, break out of your silos, kid? Well, there’s probably somebody in your organization that came from the government or the military or that has been on a working group or a joint information operations group or a joint intelligence group or something. I think you’re absolutely right there. So let me, let me now pivot this same question to, OK, you’ve given some valuable advice. And by the way, I love that, because I know I’ve had folks before that have given me resumes in, in my past careers are like, I was an Army sniper. Great. What does that mean? Walk me through what that means. Like, one shot, one kill is not what we’re looking for here. But perhaps we’re looking for the ability to plan, manage resources, you know, all these other things that, that come out of that, that’s very important. But now let’s, let’s ask you as, as a practitioner, do you have anything that you’ve come out with that maybe over your time in your experience that you’ve said, like, Look, here’s some valuable lessons I’ve taken as an individual analyst and practitioner and leader in, you know, again, you’ve kind of inferred a few at the beginning, but anything that you’ve kind of, that always comes to mind when, when, as you’re, you’re working now and helping others?

Karna:

Yep. There’s two. And one of them we touched on before, but again, back to that scar tissue and being yelled at several times, but, you know, I have in my head, like, why are you telling me this? And it was a particular principal who was challenging, but that would start. Every session would start as almost a test. Like, why are you telling me this? Um, but I have that because I think it goes to, again, if, you know, whether it’s a team, the talk, threat alerting, whatever it is in the private sector, if I’m alerting up or if we’re writing a note or we’re doing a mass comm, why am I telling you this? At some point it has to be beyond an event happened. You have to think as an analyst, the person receiving it, what are they going to do with it? And the enterprise and same with government, it’s to action something. It has to inform a decision at multiple levels. But if you can’t answer that basic, I think sometimes that’s good floss. And the second one, which was. I think people might find interesting, but I’m sure you can relate to it, was how analysts, we want to tell you all the ways things can go bad, right? Like nothing’s worse than an analyst saying, tell me about this situation or that, and we can tell you this could happen or this, the likelihood or the probability, and that’s where analysts kind of have their groove. But I think what’s missed sometimes is it’s equally as valuable to tell the client what’s not going to happen. And the first lesson I learned this was, was in Iraq, away from the flagpole, up at a, further out, a new unit came in, and of course, they were just getting hammered by the enemy, right? Because they knew someone new came in, and they were trying to figure it out. And we were invited, I was invited to sit in the back of the briefing. Commander’s getting briefed from his intel shop. Everything was going to happen, right? Like, everything, all the information they got, all the intel, they’re going through and just watching him Take that in, he had maybe been in country, not quite two weeks. It was a lot. This was at a time too, when nothing was going well for us or the Iraqis. Like it was a very intense time. And as he was getting briefed with all this intel in my mind, since I had worked the account for so long, I could rack and stack like, well, that probably won’t happen. And here’s why this could happen or not. Or actually that’s not, he doesn’t need to worry about that. And so. He had all of it and he kind of paused after he got his briefing and was like, you could see his shoulders kind of go up of like, what, what am I supposed to do with all this? Right. Cause it was all the threats. It was all the scenarios. And so again, back to, if I’m gonna open my mouth, it has to be a value. And I was like, sir, and I just walked through everything. I racked it and stacked it for him. There was some stuff I took off the board completely. And afterwards he was like, thank you Karna and had me on every meeting. But it was the first time that I learned there was value in taking stuff off the plate, right? Because as analysts, I could have been like, oh, and this could happen and this and this. And I could have, you know, gone down the rabbit hole of all these scenarios, but that’s not what he needed, nor would that have been helpful. Instead, what he needed is, what do I need to worry about in the next six hours, 12 hours, 24, and a week from now? And so my ability to say, take off this and this and this, here’s some signposts and indicators, we’ll watch that next week. it changed the room, and it changed that tempo. And it allowed him as a decision maker to be like, Okay, I don’t need to worry about that today. And I made the case why, right? It wasn’t an opinion. It was based on the Intel and the analysis, and it was solid. But it was a true lesson of there is value sometimes in telling that customer what they don’t need to worry about.

Chuck:

And that I think that’s important, too. Because if you think about it on a, let’s say, on a corporate side, now, of being able to say, like, Here’s likely, likely issues that will pop up. Things that we’re going to continue to monitor, but also here’s some opportunities in all this. And because with every risk, there is opportunity. And I think sometimes in the, in the private sector, we get very caught up in the, where we’re still kind of playing the role that we played from wherever we came from. And now, you know, and even if you’re, even if you’re not from government and you came up through, through education or school, having a moment to say, You’re right, we’re not all Eeyore, the sky’s not falling. And it’s OK to say, here’s other things going on. And oh, by the way, here’s opportunities that we could, I don’t want to say exploit, I just can’t think of a different word at the moment. Here’s opportunities that we could expand on.

Karna:

Right, exactly. No, that opportunity analysis, exactly that. So yeah, that was a huge lesson.

Chuck:

I’m thinking back to some times myself in Afghanistan and other places where it was all like, here’s every doom thing that can happen. And at some point, you just kind of stop listening because you think like, well, everything’s going to heck in a handbasket. And there we go. But I think it was those folks that came out and said, well, here’s the things that are the immediacy. And I think, again, on the enterprise side, like, if you’re reporting to a COO or you’re talking about supply chain issues, or let’s say, let’s think about back, back to like the Fukushima plant that, that, that went up in Japan. And we’re now talking about, are we moving people? What are we doing? Like, here’s the things right now that we need to focus on. Because a lot of times, look, senior leaders, they’re senior leaders for a reason. Most of them probably should be there and they’re, and they’re good folks, but our job, and if you feel differently, please, but I sometimes think our job is to tell them, maybe not how to think, but what to think about. Like, there’s a lot of things on the plate. I need you to consider these 5 things right now. Because they’re, they’re, to me, I feel these are the most, like, to use your words, actionable.

Karna:

And even on that, it’s, um, there remains just something to, we would get taskers and I’m sure that happens in enterprise where they come down and there was a way to answer it and you could answer it to really help guide the customer to the question they should have asked. You know, there’s that time too, where you just help pivot them, but because that’s the whole point is right. Like we know this is what’s going to impact. We know this is the information. Well, maybe it wasn’t asked. Right. So you kind of pivot them toward. This is what I need you to focus on. But again, as we talked about at the top of the hour, that feedback loop, that can only be done through mature teams who actually are aware of what those key decision points are.

26:10

Chuck:

You bring up a good point. And I want to ask you about the intelligence cycle, which most people listening, it’s a very, I would say it’s a tenet of intelligence. And it’s something I think that is, it’s almost subconscious to us that do intelligence work. And I’m wondering, like, I’d love to get your opinion on how we communicate the intelligence cycle and its importance to senior leadership to show like, you know, I tell my, I tell my kids all the time, like sometimes in math, you need to show your work three or four times. And then once the teacher gets it, they’ll, they’ll let you, they’ll let you have a buy. I mean, should, I mean, maybe I’m wrong on this hypothesis, Karna. Should we, Should we be talking about the Intelligence Cycle to senior leaders? Is this a place that we can help them understand how our role is and how we can help them? I mean, and does it help them see us as a strategic asset other than just like a cost center?

Karna:

Yeah, I think using the phrase, we want to brief up the Intelligence Cycle, again, I would say that would depend on the enterprise, the culture, who the people are. I think using it, though, Yeah, it’s, we, to your point, like those who come in, it’s so inbred, not inbred, it’s so second nature for us.

Chuck:

No, no, I know what you mean.

Karna:

Yeah. Like we just know it. And so I, you know, if I though went up to a board, I don’t think I would brief. Oh, this is the ODNI’s plans. You know, it’s planning, collection, process, exploitation. I don’t think that would get it. I would use that cycle and I would use different words in terms of, um, what we’re doing to make sure that they understand it. I think for senior leadership. The bigger issue is feedback. And I would put it just in, we can’t give you what you want and you put all this money in if we don’t know what’s of interest to you. And obviously you wouldn’t say that plainly. Um, but back to that feedback loop, it is, um, incredibly important. I think that’s, I mean, I don’t know if you want to go into this now in the detail of it, but like, that’s, I think is what’s missing. What I’ve seen the transition from perhaps best practice of what it was in the ICU to the enterprise. that’s the part I think on the enterprise. And some corporations are good at it. But if I was going to generalize, it’s that part.

Chuck:

Like they see, yeah, no, I, I think you’re, yeah, I think you’re spot on because I like the idea. Like, look, it is, it is just like, it’s subconscious to us that the idea, like we use the Intel cycle every day, do I think that we need to go into the boss’s office and say, Hey, I’m going to talk you through the, you know, the intelligence cycle and how we think no, But I think there’s a may might be a moment of education where you say, like, ma’am, we kind of, you know, how do you guys come do this? Well, we use something called the Intel cycle, we do this, this, this. And what’s important here, that was the feedback. Because if we understand what the organization’s requirements and objectives are, like, say, we read the 10k. Why? Because we need to understand the objectives, which helps us, you know, devise intelligence requirements, signposts, etc. But that feedback, because you could, again, you could look at it and say, if I, if you take nothing from this, understand that when we ask you for feedback, it’s very important for us because the better feedback we get, the better output you’re going to get as a senior leader. And it’s going to help you drive your objectives. And, you know, you can, I mean, I’ll, I’ll use a select tongue in cheek, like you can weaponize us to help, you know, help you make better decisions.

Karna:

Yeah. And I think on that too, Chuck, the idea of feedback, um, To your point of educating your upper leadership or those who didn’t come from the IC, I’ve seen where that becomes almost turns into like performance management cycle and getting them to understand that’s not what it is. I don’t want you to tell me, yes, I like the look of your report, some good graphics. It was easy to read. That’s not what I want. I want to know, did you read it? Did it help you make a decision? CIA analysts, some of the best feedback I personally liked, not everyone did, but was when a customer would be like, I don’t agree with that. Cause that let me knew they engaged with my piece. If they were enough to be like, I’m not so sure about that. Um, I don’t know what that means. You know, one of my best examples of that was a POTUS briefing and he pulled out my paper that I wrote with custom and had red lines all over and gave me a look was like, we need to talk about this. I, you know, Yep, exactly. But it let me know he read it, he engaged with it. I don’t need him, what we talked about before, this isn’t about Karna or Chuck. I don’t need him to like me. I need him to know the product writ large of what we did or what the Intel team did. Does this help you? And so I think getting C-suite to understand we’re not asking for performance feedback. I need to know, are you getting alert fatigue? When we send you this, do you just like silence it because it’s too much? I need to know that. I need to know if, you know, you’re getting weather updates, but really every meeting, you’re talking to HR, and they’re concerned about labor changes in Europe, or there are sounds outlawed. Like, that’s that feedback that needs to trickle down. So we know, we being myself, you know.

Chuck:

That’s the thing that keeps you from becoming the BBC of your organization. Like, look, team, I can read the news. But what I can’t read is the, so what to us. I mean, I love your idea and philosophy. It’s very Socratic of you of like, if I can learn something from you or we don’t agree, but I walk away and great. And then we’ve learned as opposed to, I love it. You know, I liked your font size and the graphics look great. Awesome. More of that, please.

Karna:

Right, exactly. Yeah. And I think too, I mean, you’ve seen this more, but my guess is maybe part of that feedback loop, if folks don’t know how to ask for that, or perhaps it’s framed in a way where it’s perceived as, give me performance feedback, vice, are we giving you what helps you, you know?

32:23

Chuck:

But how do you do that, Karna? I love that. By the way, I love that. I think it’s gold there. Like, the, and I could see where it’s a default for the corporate side, you know, whereas, say, the military side, the feedback was, Hey, guess what? That worked. We got our person. Or that didn’t work. Things went south. And now, bad things happened. But on the, I think you’re absolutely right on the, on the enterprise side, as you say, like that becomes like, Oh, it’s a performance model because look, the, the intelligence cycle is a circle. I see that before it’s a performance loop or something. So how do you, how do you create that space to say, Hey, appreciate that. But I really need constructive feedback that allows us to really hone in on the things that are going to be actionable.

Karna:

Yeah. I think first, if I was going from top down, right, so let’s say I’m a chief security officer and I’m sitting there, I would use every median as I’m collecting, right? I’m listening to all my stakeholders and the other customers that read the product that my department is responsible for. I’m reading them. When it comes through, are they engaged? Are they asking questions? Do they do like, great, thanks? Then off they go. I think you have to know your peers in that space. You have to know when HR keeps bringing something up, you got to take notice of that and write that. You got to check them after the meeting. You got to walk in the hall. If your CEO never reads your stuff and gives you feedback, you have to ask for that. Say, we’re giving this. Is this helpful for you? Do you find it useful? If not, why not? What can I do? That is at that level. But then that all the way down, I think sometimes maybe leadership, you know, they’re so busy and they assume what they know, everyone else knows, where your people below you can’t read minds. So it’s also a bit of a discipline where maybe every week, okay, I had these meetings, HR kept talking about this, legal talked about this, Bob in accounting was not paying attention or was concerned about this. Bob, he’s always my example, but then you start creating patterns and that’s it. You as the chief security officer, you don’t have to do the patterns. That’s the job of the Intel manager and everyone below you, but just push out that information and then those people below can start seeing, huh, the last four weeks, HR has been interested in this issue can we start watching that.

Chuck:

Yeah i mean it’s interesting to because not only are you collecting but you’re also shaping the two probably the two probably um uh tenants that you need to do if you’re in intelligence in corporate world or or your security leaders you’re right absolutely one listen to collect not collect information on people like you know betty said this or johnny said that or bob that guy But like, what are they talking about? But then also shape the environment to say like, Hey, we have the ability to help you with that. We can do these things. We’re tracking these things.

Karna:

Yep, yep. And I would even say for that, just to tee off what you said at the end, we’re tracking. That is where you see a great example of mature teams that have a robust feedback loop, right? Because every analyst in the team, even if you’re doing threat monitoring and talk, You want to, at some point, someone higher up in the chain is out of that 24 hour cycle. You have to, especially in the security, to be like, what are the trends we’re seeing? What are those ripples in the water? What are the changes? Interesting that this law is going to impact. You know, labor unions here in Europe, how will that impact us? Or there’s been a virus that’s happened in this part of Asia where shipping is, or, you know, you can seal that. And then that’s where the worth is and the value, because what would be even better for the CSO to be like, Oh, our analysts are already watching this and here are the signposts and indicators. That’s when everyone’s head snaps. And you’re showing, we’re already watching this, we’re 10 steps ahead of you, right? And that reinforces, if we’re going to make business decisions, we better make sure our security is there with us. Because they’re going to let us know what to watch for, right?

Chuck:

Yeah, and you’re, you’re anticipating, because you’re, you’re collecting and shaping, now you have an anticipatory stance. saying like, Look, OK, we’ve been tracking this because this is what we hear emerging from this. So we’ve gone ahead, we’ve looked at those signposts, we looked at those key indicators. And here’s the trend line that we’re seeing. And somebody, you’re right, somebody suddenly goes, Well, where have you been? And, you know, we hear a lot in the leadership world is like, Hey, don’t lose your seat at the table. But I’m always one that says like, Just don’t get kicked out of the room. You may not need to be at the table for everything. But you know, you definitely want to be on the periphery of the room and never kicked out of the room. That’s probably one way to help stay in the room.

Karna:

Exactly, exactly. And that’s to, back to that feedback loop, right, that top-down. What you as a CSO may think, Oh, everyone knows that. just capture it all and let that filter down and let the people below decide, huh, you know, he may not have realized that the last five weeks he’s told us this from that group, or so-and-so has been interested in that. And you give it to the analyst, can you run this down, see what that is? And that goes back up, right? And then that informs the CSO. So maybe they’re like, oh, I didn’t realize actually for the last four or five weeks we’ve been talking about this because I’ve been so worried about this problem.

Chuck:

Exactly.

Karna:

That’s why you have the team. So leverage the team to let them do what they can do, also to support you as the, you know, enterprise leader.

37:48

Chuck:

I’m cognizant of who I have on the horn here. And I want to make sure that I give you a chance, because I’m curious, I’ve been thinking about this, like, from your perspective, you know, 2024 might seem, or 2025 might seem like a lot of 2024, what seemed like a lot of 2023. I mean, from your perspective, what are the most pressing global risks that intelligence and security teams should be thinking about? I realize like, that’s a big question, you know, but I’m just, you know, you have a purview where you’re helping a lot of folks and you’re seeing a lot of things. I mean, are there any trends or anything that you’re particularly of interest to you individually?

Karna:

Yes, it’s, I’m glad you mentioned 24, 23 to 22, because I think that’s one thing of analysts. I, I mean, we all put out white papers for this year, but There’s not really trends in security that tie to the calendar.

Chuck:

The white paper train starts around September and goes through what, February? Yes, we all do them, but they have to be done and it’s important.

Karna:

They have to be done, of course, but as we all know, these issues span, they don’t go to the calendar year. I appreciate you acknowledging that.

Chuck:

Risk doesn’t care what day it is.

Karna:

Right. It doesn’t. Yeah, exactly. Um, I would say two pivots perhaps is how answer this that I’ve noticed. Um, especially from, again, we do a multiple of clients. The first one is the increase in, um, the counterintelligence, right? I think there is still an education gap, um, where enterprises and some that are in the space and, you know, I’ve sent with a client the other day and, um, you know, an idea that, oh, we operate in this country, we employ their people, you know, ergo, everything’s fine. Why would they? And it’s like, wow, well, I can tell you 10 reasons why, and you are a great target if I was, you know, a foreign adversary. So, and even briefing some boards on that as well, I think there is still an enterprise space, and you and I were talking about this before we even started, for those of us who came from the other side, Like, it’s hard to get that out of us of, you know, I still, um, how we incorporate those practices in our life, but that I think is a gap. Um, I’m still shocked to be honest, when I talk to leadership, um, either they dismiss it and I’m not sure why, or they’re just not familiar with it. And I think that’s a space we’re going to have to. lean in more, and I think especially for those who are building not only insider threat programs, but just security, and this ties to EP as well, but getting their leadership to understand, especially certain industries where they operate, their personnel they do, it’s a component now that shouldn’t be seen as like a nice to have or a little extra, it really should be seen and given the proper attention. And so I think that’s a big, That’s something I think we’ll see more of. And again, repeatedly, I see enterprises who even have robust mature teams are missing that component, right? And part of it is if you don’t have someone who’s had that experience and making sure it’s conveyed in a way, especially to, if you’re briefing a board. Um, that isn’t fear mongering, but it’s also practical and they need to understand the lay of the land and where they fit into that. The second issue is after what happened in December, several companies with the universal healthcare. recognizing to their C-suite, you know, not every. One needs executive protection, you know, there’s times and place, and that’s based on the risk profile, but just even best practices, like how exposed are you online? Right. And I think there, again, there’s an assumption of like, Oh, these are successful people and business leaders. Well, just because you’re a successful business person doesn’t mean you, your behavior such where you are doing best practices with your online and your social media. Like, so again, just reinforcing those basics of making sure those areas are, you know, given a little fresh look again, maybe.

Chuck:

And don’t make yourself an opportunity target.

Karna:

Yeah. Yeah.

42:01

Chuck:

You know, yeah. You might not be at a certain level where you require 24 seven security, but let’s think about where you are and is it an opportunity, which we’re finding out in that particular case with the unfortunate, you know, murder of Brian Thompson, that it may have well been an opportunity as well and not targeted to him individually. but he just happened to be the opportunity for him. Yeah, that’s great. One question that we ask everybody is that, and I’m sure you’ll have a particularly interesting answer to this is, Karna, what does Connected Intelligence mean to you?

Karna:

I’m going to just stay with the theme, but for me connected really is that intelligence cycle. Like I secretly love it, but you can’t escape it. Whether you’re cognizant of not in enterprises, it’s happening and maybe yours goes this way and breaks and Turns that way, but it should be a living, continuous breathing thing. That’s just clicking and there’s harmony in it. Um, so for me, that connectedness means everyone has a single purpose and mission and focus, and you have the tech. Tools and people that all are aligning together, right? It’s not, you have analysts here doing one thing. You have your talk here. You have this tech here and someone else’s here. Like in an ideal world that there’s synergy and sort of an elegance that is all connected, but everyone can speak with that common goal and mission. They all know why they’re doing it and their part to play in it. And I think when you go to enterprises and maybe people can’t answer that, or they don’t know why, that should be an indicator of your intelligence cycle isn’t humming internally, right? But for me, that’s connected intelligence. It’s holistic, it’s combined, it’s people with people, purpose, sense, mission, but they’re all going the same way. It’s not Intel teams here, you know, HR is here, business ops is somewhere else. Like you all have to be aligned and have the same direction. And then there’s that connection.

Chuck:

That’s great. And what a great tool to align everybody on, you know, at worst, you know, at worst we need common operating picture. So we need common operating language and common operating information. We can all come to it from the Intel cycle and talk about each of the, each of the, uh, of the areas of the Intel cycle, where we fit in and then how we continue to manage risk and things we do around it. I love that actually. And that’s a great, that’s probably one of the most original answers we’ve, we’ve had on that. So I appreciate your feedback on that. Karna, I appreciate the time, my friend. I appreciate you coming on to the Ontic Connected Intelligence podcast.

Karna:

Thanks so much for having me. I enjoyed this.