Are you a young writer interested in cybersecurity but feel like every topic has already been explored? In this episode, Joe Pettit, Director at Bora, shares his journey into IT security and how he's now using his expertise to help others break into the industry. Discover the importance of diversity in cybersecurity, the difference between hackers and cybercriminals, and the practical impact of empathy in this fast-paced field. Plus, learn how to create meaningful content on exhausted topics and how working in IT security can change your perspective on taking risks and running a business.
Many young writers feel every subject in cybersecurity has already been exhausted. This is probably true for many topics, but that doesn't mean the conversation is over.
Diversity is one of the industry's main traits, which means people from around the world can (and should!) bring their own perspectives and experiences, making an already culturally wealthy space even richer.
Today's guest is Joe Pettit, Director at Bora, the go-to place for IT Security marketing professionals needing to improve their brand awareness and generate high-quality sales leads. He’s a Business and Marketing graduate who left the UK for Spain for a change of lifestyle, pursuing his curiosity and appetite for adventure.
One of the main things for which I respect Joe is how he pays it forward! After receiving support from others to break into IT security, he's now offering young writers the chance to do the same. Through collaboration and the power of expression, they spread the word on the importance of cybersecurity while exploring their passions.
In this episode, you'll hear about Joe "fell" into the industry and his view of cybersecurity as a marketing and communications professional. Joe also shares his perspective on practical empathy, how helping young writers find their voice can improve cybersecurity, and how working in this space changed his standpoint on taking risks and directing a company.
Plus, Joe explains what it takes to create content about topics that have been wrung dry, the difference between hackers and cybercriminals, and much more.
In this episode, you will learn:
Resources:
Connect with Joe:
Let's connect!
[00:41] Andra Zaharia: What does it take to create cybersecurity content that people truly care about? What's behind the process? And what role does empathy play in all of this? I set out to answer these questions with the help of Joe Pettit, Director at Bora, an IT security marketing company that helps teams make their know-how and unique perspectives more visible. Now, I've known Joe for a number of years, and it's been wonderful to see his contribution to this entire space grow and simply reach corners of the internet that were unaware of his great gifts. In our conversation, trust is a recurring topic that's illustrated by life-changing opportunities that both me and Joe have had. Now, Joe explains how his lifestyle choices have influenced how he works, and the relationships he's built along the way. To top it off, his example of practical empathy toward younger writers definitely want to emulate. So enjoy this conversation and all of the stories it has to offer. So, there's this divide in the cybersecurity industry between people that love and embrace the technical side and people who are more focused on human psychology and everything that's connected to that. Today's guest is just the person to talk about this and to guide our way into what bridging this divide actually looks like. So, Joe, I'm so glad we're finally doing this. We're finally having a conversation on record, not just for our personal enjoyment.
[02:37] Joe Pettit: Definitely, me too. I'm really happy to be here. Thanks for asking me to come on.
[02:40] Andra Zaharia: It's been quite a couple of years since we've known each other, and since we've kept in touch. I feel like we've grown and developed in the industry kind of side by side doing similar work. And it's been so fantastic watching you grow the team and grow your contribution to the industry and always push standards for the better, just pushing for more quality, for more transparency, for more empathy, for more kindness in general. So, before we dive into what you do now, I wanted to take a step back—perhaps multiple steps—and understand how it all got started. How did you end up working in cybersecurity?
[03:21] Joe Pettit: Yeah, good question. I'm not sure that many people that I talked to plan on ending up in cybersecurity, and they kind of fall into it. Hearing people's different stories is always really fascinating. So, I finished university, I did a degree in business and marketing. Once I finished that, I was doing a job. It was in Legionnaires disease, actually, testing for Legionnaires and things like that. And it wasn't something that I wanted to do, it was just the job I had whilst I was studying. It worked for me at the time, finished, and started doing that. And I remember there was a turning point for me. It was the middle of December, I’m from England, and it was -16 degrees centigrade, I was sat in the car, and I had an eight-hour drive from, I lived in Lincoln, down to Plymouth. I sat there and I thought, “I don't want to do this for long.” I think at the time, I'd have been 21-22, I was like, “Yeah, this isn't for me.” I did it, I worked, and when I got back that weekend, I planned the next stage of what I was going to do in life. At that time, I had been to Spain a bit, I had some friends in Spain, and it just seemed a great fit. The thing that really got me was the dark nights, the cold weather, and things like this. So the following April, a few months later, me and a friend got in the car and I just drove to Spain. I didn't know what I was gonna be doing. I knew where I was going and I knew people, so I had somewhere to stay and things like that. And then once I got there, I had a degree in everything, but I just went and did bar work, restaurant work, and just did whatever I could to survive because I wanted to change that lifestyle. A few months down the line, things were changing, things were happening. I managed to meet someone over here that worked in marketing. So, with my degree, my background, and the things that I enjoyed, it kind of became a good fit.
[05:00] Joe Pettit: So, that was a guy called David Turner, who I work with now. At the time, when I met David, David had moved to Spain, he'd probably been here five or six years. He moved for a lifestyle choice too. He had a young family here. And at that time, he was working on the marketing for the RSA conference. I spoke to him about it, he didn't really have much work, that was full-time for him, he was very busy. I think it was like 5, 6, or 7 months of the year. And the rest of the time, he kind of enjoyed living in Spain. But he said, “Look, I'm interested in potentially doing more. Let's talk more.” And one thing led to another, and then I started to help him a little bit with that, although there wasn't a lot to do. But then what happened off the back of that was, we came up with this idea to launch our own site because, obviously, RSA is such a well-known part of information security and David had done a lot of work there. We set up a site called Information Security Buzz. So, that was brand new, we bought the domain, we set up the website, and we created that. And at that time, I had a lot of experience educational-wise, but no practical experience. So, for me, it was like David gave me the opportunity to take that on, develop it, build it, and manage it. And that was really how I ended up in the industry. So, from there, we took the site, we didn't know exactly what we were going to do, but we just started to publish news articles, we started to reach out to people to get contributions, working with PR agencies and things like that, to help get their clients work featured, and it just snowballed. And within a few months, we were getting a lot of traffic, we were getting people that were starting to reach out to us and contribute. And I just took that as a time to learn and try different things, and it became really successful. So, I think within 18 months, we developed the site, and I think we got to about 40,000 to 50,000 monthly visitors as well, which is quite a high volume in such a short space of time.
[06:49] Andra Zaharia: Especially, since back then, there weren't many publishing websites in the space. I mean, the content was not nearly as much and as insanely voluminous as it is now. There were just a few publications and a few websites that everyone knew. But Information Security Buzz was one of the first, I think, independent and nonjournalistic projects that came up in the space.
[07:14] D: Yeah, definitely. You have the sites like Info Security, which has been around for a while, but that's kind of off the back of the event, and there are a lot of the vendor blogs as well that are out there, which are then funded by the organization's themselves and they are lead gen related and helping them improve their own brands. But for me, it was really good. There were a few things that really worked well. One of them was, we sell this thing we called it an expert panel. And I know a lot of people can get a little bit nervous or not sure about talking to different people in the industry, there are a lot of big hitters out there, and things like that. And we decided we'll call it this expert panel. So we create a diverse group of people. And basically, once a month, we would ask these people different questions. Some of them would respond via video, some of them would respond via text, and then we would go away and we would collate these answers and then build this piece of content on a monthly basis based on a particular theme. So I would go to people but they had no idea who I was, but we use social media then as well because Twitter was probably only a few years old but people had a big enough following when using it enough. So you could kind of gauge who was important or engaging or had a good following. So I was asking people like Troy Han, and he would respond, and things like that were pretty crazy. There were people like Cairo, Javid Malik, all these people that I saw having their own brands, doing their own things on their own platforms and social media. And I was like, “Can you contribute to this?” And I don't want 800,000 words, it was never going to be a real time-consuming thing for these people, but just 100 words or 200 words. But then when you get 10 to 15 amazing people in the industry, “Okay, yeah, I can do that. No worries.” And you’re like, “Oh, wow, really?” Then you end up with 2000-3000 words and you have some really good content to work with all these amazing people, then they all start sharing it on their social channels, then the next thing you know, the social channels are growing, people are engaged, everyone's sharing the content. That worked really well and that method stuck with me. And I think that was my first insight into the industry and how amazing people are because it's really easy to be scared and go, “Oh, my God, that person's got so many followers. They're so involved in big projects and things like that. They’d never want to talk to me. Why would they want to talk to me.” But they do, you just have to go out there and ask them.
[09:27] Joe Pettit: I've met so many friends and so many colleagues from those early days that I still talk to on a regular basis now. And if we're writing blog content and there's a particular topic we want feedback on or insights on, I've got loads of different people I can go to and just ask and they'll give me a few words or we'll have a conversation on the phone where we can record, transcribe, or take notes. And that was really interesting from that perspective. And then we were just, like I said, publishing lots of different content, lots of blogs, lots of opinion pieces, working with lots of different PR agencies, different vendors. And it just grew, grew, and grew. And then from that, it was interesting. One of the contacts I made was with a guy called Antony Freed, and he, at the time, was the Managing Editor of The State of Security blog at Tripwire. And he basically had another job to go to, went and did a different role, and he put me forward to go and take on the state security. So, from that, I was in touch with the people at Tripwire, and we went for an interview process, and they asked if I wanted to do it. And it was interesting, actually, because they asked if I wanted to. I didn't feel comfortable doing it on my own because I had David that helped me and there was another person as well, David Bison, who I met in the early days, who did a lot of writing. So I wasn't comfortable I'd do it on my own. But I said, “Do it with me and the team.” And they were like, “Yeah, let's do it.” So that was the start of where everything led to with Bora and the rest of the team developing and growing. So, yeah, that's the backstory.
[10:51] Andra Zaharia: I feel like you've already told so many stories of empathy along this way in terms of how David supported you, how he gave you autonomy, flexibility, and just ownership over your project, and how all of these people turn out to be so much more open, passionate, and kind than you'd ever expect them to even if they don't know you at all, which is actually one of the ways that I discovered them as well in this way, just having this type of contact and seeing people just respond and be there and be enthusiastic about it, I feel it makes a huge difference and it just puts you in this virtuous cycle where you want to do more to highlight their work, where you want to do more to put their stories in the limelight simply because you know that there's so much that most people can’t see because they're not looking because they have their own stuff going on. So, just doing that I feel is such a great way to bring people together. Plus, there's the added benefit of helping readers have this incredible perspective from every angle, which you don't usually get because you usually read something that comes from one angle and from one person, and having this diversity is what really supports critical thinking, supports creative thinking. So I love that that's something that stayed with you. And it still works because it's valuable, not just because it's a content tactic, but because it delivers value to readers, which ultimately is our goal as communication professionals. And the fact that you mentioned that people fall into cybersecurity, I feel that this is so true for almost everyone in this space, that it is fantastic that we kind of have all the same origin story, it just looks very different as in a multiverse pattern, which I find, again, it's fascinating and also a bit heartwarming. Throughout all of these years, you saw cybersecurity before content exploded in this space before there were hundreds of podcasts and thousands of company blogs and everything else. I remember when I went into it in 2015, there was barely anything between highly technical stuff and highly fragmented superficial stuff. How did things change? What have you seen are the major changes that have led to shaping the space the way it is today? What's changed about your work, particularly, from your unique perspective?
[13:32] Joe Pettit: Yeah, it has changed a lot. And like you alluded to at the start, our careers have almost gone side by side, I think I would have started in the industry in maybe 2014, so maybe 12 months before you — so, very, very similar time. And I think one of the things that have just changed is the volume, the sheer volume of people writing content, the different blogs that are out there, the vendor blogs, the independent blogs, podcasting is obviously something that's changed and developed a lot of the year. So there are two things for me, one of them is just the volume, the sheer volume of things that are out there now. Like you said at the start, traditionally, there were only a few places you could actually go to consume that content. Now, there are too many, it's impossible just to read one blog or just to go to one place to consume it, there's so much content out there. And then also, the second part for me really is how it's delivered. Due to how technology has changed, remote working, people traveling less, and how people consume information, there are bits of content for everyone. And one of the things we like doing is, I think it was LinkedIn that came with the term, but they would call it like the turkey carnival. So you take a topic and then you would create different elements off the back of that. So, you pick a topic and you might create blog content around it, because people like reading 800-1000 word blogs, it can be quite quick and easy to consume. Other people don't like reading, so they want to hear about it in a podcast format. So you take the same topic and you consume in a podcast format. Then there's video, a lot of people spend their time on YouTube and they're always bouncing around and consuming different things that way. So, then, again, you can that way and create video content off the back of it. And then you get the longer form pieces of content where it's really in-depth, really detailed, you can get more visual stuff, graphics, social media. So, for me, I would say they're two of the biggest ways things have developed. it will only continue to develop in my opinion. I don't use TikTok and things like that, but I know people do, and it is developing, Instagram reels and things like that. And maybe I think there's still a battle there between cybersecurity professionals and those social media platforms. I'm not sure there's a massive uptake on all of them right now, maybe there is, maybe there isn't, I'm not sure. But they are some of the things that I definitely think have changed.
[15:41] Andra Zaharia: And that's absolutely true. And not just the content, but also the quality has evolved a lot. The fact that even companies get their own engineers in their own teams to put a lot of thought and work into creating content, I think, is absolutely fantastic. I see more and more technical specialists acquire communication skills, acquire content-writing skills, or just get help for someone to help them with editing, to help support them in every way, which we think is absolutely fantastic because their firsthand experience is incredibly valuable, and helping them just carry the message forward with stronger skills and, hopefully, more empathy is super valuable. They can inspire entire generations of engineers to not just contribute their technical know-how but also contribute to opening up the space to other people who are not usually part of the conversation or who are not usually interested, which I feel that is one of the biggest changes that I'm seeing now get stronger. We still have a long way to go but I think that we're making good progress with your work and with other people's work who are really pushing for this, which is fantastic.
[16:57] Joe Pettit: I think someone that from the early days as well for me that I still work with now is Graham Cluley. I look at someone like that and I know he has this fantastic technical background, but actually, he also is fantastic at communication. And there are not many people out there that are that good; they certainly weren't seven or eight years ago. So, being able to work with someone like Graham, you kind of see that insight. And a lot of the things I've learned from how he does things and how he communicates, I've applied that in what I do as well. And to your point about more engineers writing and things like that, some of the challenges, I'm a big advocate of trying to get, especially if you're going to work for a corporate blog or something like that, is people want to hear from the people at the organization, they don't just want to hear from the same voice over and over and over again because, one, it's boring, and two, it's not particularly insightful when you're hearing the same people talk all the time. So, one of the things I've tried to do is bridge that gap between these technical people that understand the topic more than I will ever understand it. But then they have that problem, potentially, with the communication side of things or it could just be a confidence issue. They're happy doing what they do, they know what they're good at; they don't necessarily want to go and write or go and talk on a podcast or do a video, whatever it may be. So, thinking and coming up with creative ways to help bridge that gap has been really important for me. One of the things I will do is when I talk to people for the first time that might work for a particular company, and they know they should contribute, they know they've got lots of good content, I talk to them about the two issues I see, the barriers: time and confidence. So, which one do you struggle with? And then from that, I will try and make the process as easy as possible. So, we'll pick a topic, then I'll go away and do a bit of prep work with some questions, I'll send them the questions, and then I'll find 30 minutes available on their calendar, put it on the calendar, record the conversation. And then, basically, we'll transcribe that, edit that up, and then we can write something, and it's in their words because we're using the transcript, we're using the recording. We're not having to second guess what they think, they're telling us what they think. And I've had a lot of success doing that, and that works really well to help bridge that gap. And I'm sure you've done similar things as well to help engineers and other people like that.
[19:02] Andra Zaharia: Indeed, and I feel like it's such a supportive and kind thing to do, such a generous thing to do. Because I've seen people transform and show their work with a lot more, not just self-confidence, but a lot more enthusiasm and just bring on their passion in a way that's visible to others. Because I feel like we as communicators can see that there are so many misconceptions and myths associated with cybersecurity in general about it being abstract, and they'll talk about technical specialists being a bit narrow-minded sometimes or just uninterested in what other people think simply because they're fascinated with the complexity and the challenges of the industry, and lots and lots more myths that continue to exist unless we challenge them systematically, and bring up alternatives and nuance in language, approach, and everything that we're doing. So, I love that you're supporting people through just that and supporting all of these voices to show up in the space, instead of just keeping them in a quiet corner or behind office walls. I feel like this is changing the culture, ultimately. And speaking of culture, I was wondering what kind of influences have you felt come into your life from cybersecurity and how it's changed you, personally, how you think about things, and perhaps how you do things. I’m very curious because you've definitely developed as a professional along with this industry.
[20:38] Joe Pettit: I think one of the things I've learned from it from a personal perspective is to question everything. The term “zero trust” is what it is. I think it doesn't matter whatever it is; if it's an email from someone, or it's a text message, or a LinkedIn request, whatever it may be, question it: why is this person talking to me? What do they want? I don't mean criticize them or anything like that, but just keep an open mind to it. Not everything is obvious. Think about things like that. That’s definitely something. I think, actually, communicating it with the people around you, the way you can make a difference as well. So I've got two young children, so teaching them the safety of being online, and how to be safe, and password managers, and just simple things. As we were growing up, we didn't have password managers, two factor, and things like that, but the next generation do. So it's educating them and making sure they know, and just people that aren't always that tech savvy because I think one of the things I see a lot of is when people work in cybersecurity, they live and breathe it. There's an assumption that everyone else does when they don't. And it's really, really easy, especially if you're a technical person to tell someone, “Oh, you should download 2FA on every single app or every single site your access.” Where for some people that's not practical. And I guess that's one of the things. I think it was Wendy Nather that described security as being like using a spoon; you don't buy a spoon and get instructions with it, everyone knows how to use a spoon. And security needs to get to that level.
[22:11] Joe Pettit: If we have the issues where people assume knowledge, or they talk down on people because they don't get it right, or they blame humans as the weakest link, and all these things, these aren't going to help us reach that mission or reach the objective of what we're trying to do. So, things like that, I've definitely had an impact on what I've done and what I've experienced. And I just try and help bridge that gap as much as possible and try and be empathetic to people and understand not everyone understands why we should be doing these things and teaching the why is really important, not just how, and I think if everyone can try and help two or three people that are around them to do it and pass that message on, then great. In October, it's National Cybersecurity Awareness Month, and I see lots of different people talking about it. And some people can be very negative towards it, like, “Oh, we shouldn't just have a month that celebrates this. It should be all the time.” Yeah, totally agree. But this is a starting point. For people that don't understand it, this adds value. It might add no value to us because we work in the industry and I know there can be a lot of gimmicks that come off the back of it. But actually, translating technical information into language that people understand then on an everyday basis that aren't in the industry is so important. And the more we all try and do that, the safer the world's going to be, which is just going to make everything better, isn't it?
[23:34] Andra Zaharia: It definitely is. Plus, we need to remember that we're not our own audience. I think that this is so so important because we tend to. And I think, I read this somewhere, we tend to judge people as we are, we tend to filter everything from our own perspective. And unless we're aware of that bias, we're always going to keep doing that. And yes, I see a lot of criticism as well related to cybersecurity awareness month, which again, I feel serves no one, or simply criticizing never has helped anyone. If you want to change something for the better, do something for the better, offer some alternatives. Just reframing this from a more constructive approach, I feel like, would better fit really everyone. Especially, because what cybersecurity awareness sometimes does is that it makes peopl, I feel, a bit more risk averse than rather making them comfortable with their ability to manage risk. And this is where communication comes in, this is where communication comes in to filter the language, to apply that empathy filter, to find that emotional connection with people and get them to actually listen and not just to go through the emotions just because they have to take this off their checklist and move on with their lives to something much more important to them, honestly. But I feel like we're getting there slowly, we're making changes toward that. Do you feel you've become more risk-averse since working in the industry? Or has it made you more comfortable with taking on risks because you've acquired the skills to manage them?
[25:21] Joe Pettit: Good question. I feel happy taking on risks. And that's probably due to the fact of what I've learned over the last 5-10 years of working within the industry. But I think it also allows you to understand risk more, and the different levels of risk, and what you’re prepared to risk as such. And everyone is different in terms of what they have to do. I run a small business, I don't have to manage hundreds of people, which is totally different. And if you're a CEO of a Fortune 1000 company, there's a lot of responsibility and there's a lot of risk to consider. There's still risk for someone like myself with a small organization and how to factor all the relevant things in there, but it's not at the same level. Would I be comfortable with that much pressure and responsibility? Potentially not. And guess that's why you have CISOs, and CIOs, etc, to fill those voids and do that. But I feel like I'm comfortable with risk, and I think learning how to manage it, and expectations that come with that are really important.
[26:23] Andra Zaharia: It really is. And there's so much to learn from conversations that specialists in the industry have in public. I feel like that's one of the greatest sources of learning that we can ever access. This is why I love the cybersecurity community when it was on Twitter because I got to see all of this happening in front of my eyes and understand nuance and see examples and see how people relate to different kinds of topics and experiences. There's no way you can pay for that. That's not something that you can access anywhere. You just have to go along and soak it all up and make sense of it. And one of the key topics that I've seen come up repeatedly over the past years, and I'm sure you've seen it too, is that marketing can be unethical, that marketing is bullshit, it's just so far removed from the realities of the product and the technology, and just the technical concepts in cybersecurity. And I was wondering how you see this. What do you think the sources are of this being true? And how you've seen perhaps specialists change their mind over this while working with you who handles marketing at the end of the day?
[27:45] Joe Pettit: I think that it's true, and I think it's the same in any walk of life, in any industry, wherever it may be. You take something like cycling, for example. I cycle, I'm a cyclist, there are people out there that are terrible on the road, they ride too far apart, they're not nice to the cars, and things like that. And then that gives cyclists in general a bad reputation. That doesn't mean everyone's like that. And it's similar here probably for marketing in cybersecurity. I think what we have to do is we have to help educate the people around us on how they should be doing that, and we should be helping educate different people we work with, whether that's vendors or partners, or whoever it may be. There are companies out there that sell on fear, uncertainty, and doubt. And that's completely wrong and you shouldn't be doing that. I feel like I've probably not heard the same conversations over the last couple of years, but I'm sure they're still happening. I do feel like people have toned their marketing down in certain places. There were some companies that were popping up and claiming some outrageous things. No one's ever gonna say that anyone can be 100% secure, it just doesn't happen. And if anyone ever claimed that, then they're wrong. But for me, it’s the little things. One of the things, as I read a lot of content, I work with lots of different writers, it's things like using the term “hacker.” So, a lot of people use that term as a negative connotation, “This bank was attacked and a hacker managed to do this.” Well, people are getting confused because you're not talking about a hacker, you're talking about a cyber-criminal or a malicious hacker or a bad actor, whatever it may be. So, then when you go on to a website and you're reading this blog, and it’s talking “hacker is doing this, hacker is doing that,” well, you’re giving the wrong message about what a hacker does. There are bad hackers, obviously, but there are good hackers, too, and they're extremely important in this industry. And I think that's understanding the industry as well because I know there are different causes out there that help support that.
[29:35] Joe Pettit: But if you don't understand the industry and you don't understand the people that work in there, if you're calling a good person a hacker and a bad person or hacker, that's not going to go down well and that doesn't work well. I try and educate and pass that back to the people I work with and say, “No, change this terminology. Do this and do that.” So, that's definitely one thing I've seen. And I think, as well, for me, one of the things I find a lot of people do, a lot of companies do, there's this line in marketing where there are objectives that companies have to adhere to. There are key performance indicators leads that the companies need to generate and things like that. So then there's pressure on people to make sure that page views are up, leads are coming in, sales qualified leads, marketing qualified leads, whatever it may be. So, how do they do that? So, if there's pressure coming in from the organization, potentially, people can be probably a little bit too pushy. And maybe that's in the content that they write, where it's all about them, talking about them, talking about their products, how they can solve issues, which for me is not about that, it's more talking about the wider issues. Fine, if you want to add a little call to action at the end or mention something during the article that says a small part of it that you could take out and it would make no difference. That's the way I kind of like to approach things because you want to educate the people that are reading it. And obviously, it depends on your audience. If it's a technical piece and it's going to engineers or someone like that that have a good understanding of the industry, you need to talk to them in a particular way. But if you are trying to target CISOs or decision makers have an organization because, ultimately, you do want to get them to buy a product, selling to them directly isn't the way to do. You need to educate them, entertain them, and give them different insights that they're looking for, help them in their day-to-day jobs. And there are loads of different things we've done over the last few years that I like to think gives people more than just a sales pitch in a blog post. So, that's kind of my answer to that question.
[31:35] Andra Zaharia: It's an entire universe that you've created with your work for several brands and for several communities. Again, because systems thinking is so popular in cybersecurity, I would love it for people listening to this conversation who work in the space to just picture this universe, this system, this ecosystem of content that comes to support things and support company growth because it's not enough to have a great product, again, if no one knows about it. And given the competition that is growing in this space and the amount of financing and money that's coming into this space. Again, it takes a lot more effort to stand out, it takes a lot more effort to differentiate, to figure out who you're uniquely suited to help and what your key perspective is on this, what your contribution is to the space, and how you're making, again, an individual unique type of assets for these people that you're serving. And in this sense, whether we're talking, content, business, product, or internal operations, I feel like cybersecurity offers a lens, it offers a way of assessing a company's health, not just its protection against bad actors and malicious hackers, but also, it’s a sanity check that makes sure if you're heading towards the right goals, if you're really building a strong business or if you're just there to make money, which is not a bad goal in itself but it does influence the culture a lot. And this is why I am such a huge supporter of advocating for security as a key cultural element in an organization because I feel that it changes things and it gives people an opportunity to do good and to do something that they feel is right and that represents their values. How have you seen the work that you do in cybersecurity aligned with your own values? How does it reflect those values?
[33:45] Joe Pettit: Going back to where we were at the start in terms of some of the experiences I had, where I would reach out to people and they would help me or other people would give me opportunities. I think, for me, some of the values I get are just trying to help other people, and people give me an opportunity. And I feel like my career and my life in cybersecurity have developed a lot. And I like to feel like I'm quite successful in this space now. And there are lots of people that are younger than me now that are wanting to come into the space. And it's about giving people opportunity. So, for me, that's something I focus on a lot and I try and do as much as possible for that. So, some of the ways I've done that in the past or how I do now, one of the good examples I've got from what I used to do was, it was pre-COVID, actually, but with The State of Security, one of the things I used to love doing was I used to go around to all the BSides sites. I used to look on the main BSides site and I would look to see when all the different events were. I would then find all the event organizers, I'd send them all an email, and say, “Look, I run this State of Security blog. Basically, what I'm doing is I'm looking for more people to contribute to the blog. So, I want you, if you're willing to do it, to send that email out to all the people that are speaking at your upcoming BSides event and just let them know if they want to write a blog post around the topic they're speaking about to plug their event and try and get more attendees, they can get in touch with me, I'd love to talk with them and learn more about what they're doing and put something on the site.” So I did that probably for two or three years, and that was probably one of the best things I've done because I met so many great people. There were so many interesting people that I never would have met if I didn't do that. So, for me, I always see these things as relationships. A relationship is always a two-way street. To me, I'm getting good content that's interesting to the audience I'm trying to talk to; to the other people, the people on the other side that are speaking at these events, what they're getting in return is they get to talk about their topic. And actually, for some people, the feedback I got was it was really interesting because they could write it out in how they were going to speak it, obviously, in a mature form, but it just kind of allowed them to process it and pick gaps.
[35:48] Joe Pettit: The second thing was for people, especially if they had done, if it was a researcher or someone like that, and they wanted to tease out some of their research, they will actually get direct feedback from other people in the industry and say, “Oh, have you thought about doing this? Have you thought about doing that?” And that actually helped them. So, for me, letting people have that opportunity via BSides was fantastic. And there were people like Zoe Rose is someone that I met. I can't remember what BSides event it was, it was so long ago now. But we're still in contact, and we talk on a regular basis, and she's definitely someone that I value as a friend in this industry. And that all sort of stemmed back from that relationship. So that's definitely one area. And the other thing that I try and do mainly because of the role I have now and what I do is giving young writers and different writers an opportunity. The State of Security is a big site, they get a lot of content their, and lots of traffic. And for younger people that want to break—not just young, but anyone—that's just wanting to break into the industry, it's an opportunity for them to contribute to a site that already has a following. So I've got a group of freelancers that I work with, and a lot of them will come through the site, and a lot of them will come through recommendations. So, for example, Zoe he introduced me to someone that I've known for a few years now and they're a student in Sri Lanka studying cybersecurity, and they wanted to do a bit of writing. So over the last couple of years, I've worked with them and they've been writing just one or two blogs a month, it's not a lot. Their knowledge on the topic is really good, but their writing skills weren't particularly that great. So myself and one of my colleagues at Bora, Bob, he's a really great guy and really good editor, we've been helping her develop her writing skills. So, for us, it gives us great content, and is brilliant, and a lot of it is really, really well. But for her, also, it gives her a little bit more purpose, it gives her some practical experience and some insight. She earns money while she does it as well, which is great, especially when you're a young student and you're studying. So, for me, giving her that opportunity has been fantastic and I'm really excited to see where her career goes. But that's just one example and there are loads of different people that I've tried to do that with and I'm very conscious of trying to do that just because people give me an opportunity and I want to try and give that back. And it helps me in my work because I get good-quality content and I like to think it helps them because it gives them one step on the ladder. And there are so many people I've seen that will share content and they'll say, “Yeah, I was featured here, here, and here.” And it's really satisfying for me to see that because they're all things that I've helped them work on and get them placements in publications. And if that means they go on and get a job somewhere else, a full-time job, and it's the start of their career, brilliant. If they pick up more freelance work from it, that's just as good. So, they're the things and the values I think I've taken from what I've done over the last 6, 7, 8 years.
[38:27] Andra Zaharia: And the generosity shines through every example that you shared. I love how you're passing forward all of these acts of empathy that you've received, and that you're giving back. I feel like setting an example or just trying to replicate examples that we've seen work for us is such a powerful way to get future generations to just feel supported, feel safe, feel like they can make mistakes, and feel like they can learn without being punished. Because I feel like, and of course, there are always differences between generations, but we were able to develop in a time where I think we were a bit less demanding of ourselves compared to how kids are pushed, and they push themselves to do so much nowadays, so much more than we ever did at their age. We have a bit more space to explore things and space to make mistakes. I feel like they're so adamant about making progress in this space and building a career, and they have a very strict plan and very strict discipline that they force on themselves, which is not a bad thing but you need that space where you can just grow and experiment and not have all eyes on you all the time. So giving people that space, I feel, is such a valuable example. It's the only way that we can build trust between these generations and all of these stages that people go through as they're building a career in cybersecurity, whatever that career is. Because it can look very different and it can look very surprising to many people, which is one of the best things about it.
[40:12] Joe Pettit: Yeah, definitely. It is interesting. There are lots of different journeys into this space for sure.
[40:18] Andra Zaharia: Exactly. And speaking of content that is super high competition in terms of volume and quality and visibility, I was wondering what you'd say to people who would like to start creating more content but feel like everything's been said and done before? What would you tell them to show themselves a bit of compassion? And what would you tell them to give them that confidence to just go ahead and do it?
[40:44] Joe Pettit: Yeah, and that is a huge challenge for people, there are so many people that I've spoken to that will say, “Oh, no, this has already been spoken about.” And of course, there are so many topics that have been spoken about, but that doesn't mean the conversation is over. And I think diversity is such a big thing for me in this industry because people look at it from different angles based on their own experiences. And you could take the same thing and get 10 different people to look at it, and they'll all do something different with it or talk about it in a different manner. And that's basically how they've been brought up and their experiences in life. So I would always say to people, especially if you feel like you're strong enough or you can give an opinion, then give an opinion with the content as well because your opinion is going to be completely unique to other people. So don't let that worry you at all. So I would definitely encourage people to contribute that way. One of the other things I'd also say as well is to start off small, don't overwhelm yourself and put too much pressure on yourself. So one of the things that we've done in the past, which I really enjoyed doing, and we've done quite a few of them. We've done one recently at Bora. We've looked at marketers looking forward to 2023 and some of the key things that they're going to focus on. Projects like that worked really well for me. We've done quite a few with a particular client, and they were so empowering to be part of the projects. What we did is we did these crowdsource ebooks, where we would go out to people and we would ask for a few comments and merge them all together. So, one of them was like, “Tell us about your journey into cybersecurity.” So we went up to all these different people and ask them about their different backgrounds and how they got into the industry. And we had people in the Americas, north and south Europe, Asia Pacific, everywhere, all around the globe, that all contributed to this.
[42:26] Joe Pettit: One of the things I got from that was no two stories are the same. And I think that's going to be exactly the same when you come to write unless you're going to use some sort of AI bot to write your content. No two stories are ever going to be the same, so don't worry about that. Start off small, try and do things that you feel comfortable talking about as well, and share your opinion, people are interested in it for sure. And if that means you comment on an article and you give some comments to a PR team to feature in something or you start your own blog, definitely do it. And I think the other thing is, think about a medium that works for you. I alluded at the start, people consume content in different ways, and people produce content in different ways. I don't produce videos and things like that, It's not something I feel comfortable doing, while I know there are a ton of people in the industry that will do that. So if you feel like you can speak well around a topic as opposed to write, then maybe focus on that. BSides is a great example, again, going back to where they have all these localized events, they almost give every single person an opportunity because I know living in Spain, there's BSides Barcelona, I think there's one in Valencia, I'm not sure. But I know there are two or three in Spain, I know there are loads in the UK. They are absolutely everywhere. And every time I go on the site and have a look to see the new names of new places that are there, well, BSides, they have the rookie track. They have obviously the people that are more experienced, they have different things like that.
[43:45] Joe Pettit: But if you've never done anything before, apply for a rookie track; you get a mentor that will help you and talk you through the process, that gives you your first step into potentially contributing towards the community. And I think that's the other thing as well to think about is whatever you're doing is a contribution to the community, it gets people talking, it gets people engaged. If that means you're a fantastic writer, go out to different places. I know, for example, Info Security Magazine, they have, I think they call it the next-gen series. So you can have a look on their site, and you can go to them, send them a message and say, “Look, I'm studying cybersecurity.” You might be doing it at university or you might be in IT support and you want to transition it over, whatever it may be, and you want to write about the topic, they will publish content from people that have little or no experience in the industry because they want to give people an opportunity to help them develop and grow into the industry. And I think that's so important because there are a lot of people that will put up barriers, and it's our job to try and take them down and give everyone an opportunity because everyone deserves that opportunity.
[44:47] Andra Zaharia: I love that. I love that so much. I love getting access to this space conversation. And I love how you're supporting everyone and making such a big difference. Again, not just by what you do, but through how you do it, I feel that that's one of the most important things. Because how we do things shapes everything; it shapes impact, it contributes to change, it helps open people's minds or keep them open and make people more welcoming of other people's opinions and perspective. And it also comes from a place of curiosity, and not from a place of telling people what to do with their lives. And that makes a huge difference. And I'm a firm believer that although this cannot be quantified that people feel this, they feel it in the content. I have recent examples, speaking of AI-generated content, a friend of mine has a social media class. She has students from a lot of different backgrounds, different ages, and a swarm of people in her class. At one chorus, she put up two pieces of content on the same topic and ask them to guess which one was AI-written and which one was written by a human, and they all guessed correctly. They couldn't explain what it was, but they felt it. And I instantly connected with that example because I know that even if this is a conversation for a different episode because that's going to take us a lot to dig into, I feel like this is the difference that we feel in any type of content when it's created with heart, when it's created with generosity, with kindness, with a true commitment to help someone, and with a true interest in just making things better for the other person and for yourself as well, because it doesn't have to be just for everyone else, it can make us happy as well to write something, to put something out there, to see our work reflected in a way that maybe we have never seen before.
[46:58] Joe Pettit: Yeah, definitely. I think it goes back to that relationship as well. It's the relationship with the content and with the audience. You need to feel like you're making a difference and getting something from it as well. But in return, they're learning, they're being educated on the topics that are important to them, and they're taking away things that they can apply in their everyday life.
[47:16] Andra Zaharia: Absolutely. I would love to keep this going, and I'm sure we're going to have a part two. Perhaps we can talk about AI-driven content and how things might look because I think that's going to be a very interesting conversation and something that people are wondering about, especially because it implies ethics and so many other topics that are very rooted in cybersecurity. But before that, I wanted to ask where people could find you, could follow your work, could follow your thoughts on this. I know that you don't spend as much time as you used to on creating content because you manage this entire collective of creators, but if people want to get in touch, where can they find you the easiest?
[47:59] Andra Zaharia: The best place is really LinkedIn, Joe Pettit. Search me on there, I’ll come up. You'll find me working with Bora. JoePettit2 on Twitter, that's the place to find me as well. I'm not that particularly active, but I go on there and I try and engage it and see what's going on. And then the business side, it's welcometobora.com. And on there, we've got a blog. And, again, when we were talking about creating content, what we try and do is to try and encourage the whole team to take part and contribute. So we give everyone a voice. I'm certainly not an expert in everything, but I will talk about the things that I'm most knowledgeable about when there are other members of the team that are experts in certain things so well to talk about though. So, if you work in the marketing space, specifically the content marketing space, then definitely have a look there as well. But yeah, that's where you can find me.
[48:45] Andra Zaharia: Thank you so much, Joe. Thank you for this conversation, for all of these examples, for all of this inspiration on how to support others and how to help them show their work and just do that for each other. It's been such a thrill to finally do this.
[49:00] Joe Pettit: Yeah, definitely. It's been so long. I really appreciate you asking me to come on. It's a real honor to be on here and talk to you about these things. So, thank you, I really appreciate it.