EP 018 Dr Gavriel Schneider talks about Resilience, Presilience and High Performance Leadership

Dr Gav is an acknowledged business leader, author and specialist in the field of human based risk management and the psychology of risk. He is the creator of the Presilience® approach and is a serial entrepreneur who has been running his own businesses since 2001. He has conducted business in over 17 countries and provided a wide range of services for a very diverse client base, ranging from heads of state, to schoolteachers. He is a leading academic and subject matter expert in his field and is a much-sought after International speaker. He has, over the last two decades, had extensive experience as a CEO, Master Trainer and Consultant as well as a Director and Board Member of; for profit, not for profit and community organisations.

Summary & Experience:

·       He is the CEO of the Risk2Solution Group which is a group of risk consultants and advisors, security, safety, medical and emergency response companies that focus on innovative integration and consolidation solutions.

·       Extensive senior level management and leadership experience and is an acknowledged subject matter expert on Integrated & Human Centric Risk Management, Safety, Emergency, Crisis Management and Security.

·       Extensive Tier one consulting and advisory experience with a diverse portfolio of clientele

·       Fellow of the institute of Strategic Risk Management (FISRM), ANZ Chapter Chair and member of the Global Advisory Committee 

·       Fellow of the Governance Institute of Australia (FGIA), Fellow of the Australian Risk Policy Institute (FARPI), and Fellow of the Australian Institute of Management & Leadership (FIML)

·       Extensive Board and Director experience for a diverse range of for profit and not for profit companies and organisations.

·       He holds a Doctor of Criminology Degree as well as a Master of Technology Degree (UNISA).

·       Completed the HARVARD BUSINESS SCHOOL / HBX – Certificate in Disruptive Strategy 

·       Academically, he is the Head Lecturer and Program Director for the Australian Catholic Universities (ACU) post graduate program on the Psychology of Risk. 

·       He is a published author, with two books published as well as numerous academic and advisory articles. His second book “Can I see your Hands” was nominated as ASIS book of the year in 2018

·       Extensive international experience in over 17 countries.

·       He has served as an Industry Expert Witness for the Legal Sector.

·       Dr Gav has a wide range of additional qualifications including; 

·       Graduate Diploma in Strategic leadership 

·       Graduate Diploma in Management (Learning)

·       Advanced Diplomas in Project Management, Integrated Risk Management, Work health and safety and several other related qualifications. 

·       In addition, he holds numerous trainer, educational and coaching qualifications, has been a martial arts full contact champion, is a 7thdegree black belt and recently has been acknowledged as one of the worlds greatest martial artists by the Martial Arts Masters Hall of Fame (and in his own right, Dr Gav has trained thousands of people globally.

https://www.linkedin.com/in/dr-gav-schneider/

Security Circle ⭕️  is an IFPOD production for IFPO the International Foundation of Protection Officers

Transcript

Yoyo 0:15

hi, this is Yolanda. Welcome. Welcome to the Security Circle podcast You can find us in all of our podcasts@www.ifpod.org. Now with me today is a very special man doctor. Actually, he is c e o at risk. The solution group. He's a serial entrepreneur. He's the creator of the Brazilians approach. He's also certified chief Risk Officer. He's Australia and New Zealand's regional president for the Institute of Strategic Risk Management. He's an. He's an academic and a researcher, and He specializes in human-centric cyber and physical risk management. his team were recognized for their work in resilience by making the most prestigious, innovative companies list in 2020. his research, consulting and teaching the psychology of risk at postgraduate level for six years has given him a unique insight into how humans think and make decisions. He's one of the very few to make IFEC global influencers in security thought leadership. Top 20 lists for four consecutive years as 2019 through to 2022, as well as being awarded the risk consultant of the year 2019. And not surprisingly, He's a much sought after international speaker listeners, I have him here for you today. Welcome, Dr. Gal Schneider. Thanks for having me. Very happy to join you. Thank you so much. Now listen, you've also authored dozens of articles and you've published two books. We'll talk about those. But most importantly, where I wanna kick off Gav, is that you are a lifelong martial artist with master grades in several systems, and you've been listed as one of the world's greatest martial artists. And when I read that, I kind of caught my breath on thinking, wow, I didn't even think such a thing existed. The Martial Arts Masters Association awarded you that you had a journey with martial arts in your career. Take us back to the beginning. Which martial arts did you choose and why was it important that you chose it? Nice place to start yoyo, because that really is the start of all of this. Like, in fairness, my entire security career, my business career and arguably even my academic career have been underpinned by skills, capabilities, discipline, and other aspects that I've learned through the martial arts. So I was a very sickly child and there were some doctors that said I'd never exercised my whole life I was pretty asthmatic. so I started with karate when I was about five years old. And when I was about 10, I was introduced to a garba, the name of Vernon Rosenberg, who became my Jisu and Jujitsu instructor. I got a black belt under him, my first one when I was 14. Um, I really, really loved the martial arts. Like it became my thing. And all I did really probably when I was going through school, school was a, was a waste of time for me compared to martial arts. So I pretty much just went to school so I could do my martial arts in the afternoons when I was about 13 or 14, just before I got my first black belt in Jisu. I was about the same heart I am now, but I was really skinny. So I started with TaeKwonDo, which is a kicking system, and made the South African TaeKwonDo team not too long after that. And then when I finished high school, I had two second degree black belts in, in 1 set in Jisu, one in TaeKwonDo, and actually land up going to Israel to join the army. That was my intent at least. But I was introduced to a guy by the name of Dr. Dennis Hanover. Who is considered the godfather of Israeli martial arts. And as fate would have it, it was just a stroke of luck and alignment. I landed up as a living student with him and instead of training the army, I just lived with him and trained in his school for almost a year on the first trip. Um, I was graded at black belt under him after six months and got my second Dan at the end of that year. And my martial arts journey has continued ever. I mean, black belt at 14, that's pretty stunning. So in school, I guess no one bullied you, right? well I think it's always, it's always interesting like, and it's kind of a joke by my, my sister's quite a high achiever in her own R too, and probably till I was about 10, she bullied me incessantly, which is kind of interesting. Yeah, I was, I was, wait, I was waiting to, to see your reaction to that. But it, it really is interesting because I started teaching adults at the age of 14, and, you know, there's no way that a teenager will ever be physically capable or strong enough to beat adults. So, you know, already then there were lots of life lessons that were coming my way, where no matter how good I was, you know, physically people say to you things like, oh, size and strengths don't matter. They matter. Right? So, you know, it's, it's much like along the way as we'll get to talk about security and risk. You know, not all measures are equal and not all threats are the same. And you know, a along the journey, I'm, I'm grateful for almost every Interac. Yeah, I have injured myself many, many times along the way, and I'm paying for that now in my mid forties, where my body's pretty, pretty sore. But with, without doubt, I would recommend kind of the martial arts pathway to anybody who has kids and wants to develop some of those attributes. I was an older sister and my brother certainly gave back as much as he got. Put it that way. We, we bickered incessantly until I was about, you know, 17, 18, and then we started to hate each other as young adults and then we started to go out our own way. But it's amazing isn't it? The sibling relationship. Did, your sister take. martial arts as well. She, she did in the beginning. We trained karate together and she was a natural athlete, which interestingly enough didn't attract from it, but she stopped when she was, she's about two years older than me. She stopped probably when I was about eight or nine and focused on other sports, and I just kept going and it, it kind of became my. so you went to join Dennis Hanover in, in Israel. What did you, what were your Lear life learning lessons being his apprentice through this period? So many, in fact I've got a trip planned then about two months. Dennis is now 86 years old, and I'm taking some of my students there next month. I think there were so many things. The first one really was honestly humility because I got there as a pretty cocky 18 year old thinking I was okay at what I did, and pretty much had the beep beaten out of me continuously for the first three months. I'm, I'm imagining karate kid here, the actual story, you know, wax on, wax off. Was it like that for you? Probably a little e esoteric and a lot more combative. You know, their, their system. Anybody who's ever come across what Dennis did and how he created is really a mix of conventional military kra maga with judo, jujitsu, and full contact karate. And there's a lot of physical punishment that you absorb, and for me it was quite different because I was training an average of three to six hours most days, and some days teaching up to four or five hours. So on a long day, I'd be martial art for eight to 10 hours. And most of the other people who were training there would be coming two to three times a week. So they'd have a lot of time for their bodies to recover where I didn't. But it was just a really good opportunity. And I think it's also an interesting piece around human motivation because there were so many things that made me want to quit and come home. There there were very few who had done what I did and became living students and trained there and there were none that stayed. And actually, So I was one of the first who did that. And when I left, one of the people who motivated me to go actually said to me, don't, don't be ashamed, but I'll probably see you in two or three weeks cuz it's really tough. And even things like that became quite good motivators for me that you know, if people think you can't do something, it's a really good motivator sometimes for people like me to go, okay, I think I will. So when there's so much making you wanna quit, what made you stick with it? So I think to your point there, there, there are many variables, and these are probably life lessons that have enabled me to be more successful in business. You know, there, there, there, there's also academic work well known author and academic. Angela Duckworth talks about grit and, and she's written a book on it, but realistically, And I have seen this throughout my martial arts career as just one example. It's not the most talented, nor the most physically able that become really great. It's those who don't quit because you can learn something really quickly. And for those who pick these things up with natural talent and natural skills, they often stop short of the thousands and thousands of repetitions You need to make something intuitive and reflexive. Whereas for people, and I've definitely fell into this category. Who don't naturally get the stuff and have to work a lot harder to actually build the skills we land up doing so many more repetitions. And I think the other piece for me that was incredible was opening my mindset to the fact that there are many different ways to do something and that we shouldn't be bound by one approach or one method to do something. and I found that a fascinating piece both in business and security and risk because we tend to get boxed or fixated on this is the way somebody taught me to do it and this is the way it has to be done, as opposed to what is the outcome I'm looking for and what are all those variables that could combine for me to achieve that outcome effectively? to that point, I, I'm finding myself thinking, yeah, I'll tick that box, tick that box, tick that box. As many people who will be listening will be thinking. But then I find that I'll give you an example. I'll kind of talk myself out of it because I'll risk it that much and then I'll find many reasons why it won't work because of the, maybe the conscious bias or unconscious biases I have. So, for example, I joined the police, I knew I'd be a lousy criminal because my risk assessing brain would work out that the only way to successfully commit crime is to do everything by yourself, because then you've got no risk of anybody else grasping you up or failing in their part of the process, you know? So I've already worked out. There's just no point in going down the crime route because I, I can't do everything myself, to make it successful. Does that, does that make any sense to you about how I process? Almost talking myself out of doing something. Cause I'm thinking, no, that won't work. That won't work. That's being tried and tested. Interesting. So we kind of fast forward into the psychology of risk and the way we make decisions, which we could spend five, or six podcasts talking about. Just that aspect. But yeah, it's, it's really interesting because in the research we've done and in teaching aspects around the psychology of risk, The first starting point is an intrinsic knowledge of yourself, right? So if you don't understand how you make decisions, how you process information, it's exceptionally difficult for you to be successful. And while there are common traits across most people, and you highlighted one there by bringing in the concept of cognitive biases, Most of us, and we only need to look at the researcher of people like Daniel Kahneman or Dan aei to see that decision making is rarely not the strong suit of humans. We tend to make decisions based on bias, emotion, and we use shortcuts like heuristics to make decisions. So to your point, we are far more likely to find reasons not to do something than to do something. And it does come back to, um, I'm, as, as we talk, you'll get to know me more. I'm, I'm a self confessed risk nerd, so while I have a martial Oscar, I love everything academic around risk decision making and how it intersects. And the idea with risk is that on a human level, a very personal level, we all have our own appetites and tolerances, the things we are willing to do. And we also, know the tolerances, the things that we, if we go too far, will. It's, it's interesting to see also that, you know, those tolerances, for example, are less, are less developed in teenage boys and boys in their young twenties, which is why we see them make terrible decisions and often hurt themselves or others. Um, so back to you though. So the interesting piece there is that, you know, it, it's fascinating when you look at it because if you think you can't, you're right. But if you think you can, you might also be right. So this is the hard part. We set these limitations on ourselves. Or we make decisions. And I would say your decision not to be a criminal is a great decision. Yes. Because we wouldn't be having this conversation had you chosen a different pathway. Right. But the, the interesting part there is your decision piece was a very rational flow. Where you had actually looked at going, well, what do I need to be successful? If I look at that pathway and it's, when we look at decision making architecture Daniel Kahneman likes to divide the mind into two systems. He talks about system one and system two. Thinking. System one is our intuitive gut feeling based decisions, and we make roughly 95% of our decisions with those. Okay? So most of our decisions are not thought out decisions. They're reflexive, intuitive decisions based on bias. System two is I like to refer to as the risk manager of the mind. That's where you engage your deep thought. You weigh up pros and cons. It sounds like you did what most humans didn't, used a bit of both because it's a serious decision that's actually good. You get better decisions out of it. So I would argue that your decision was great. Just how you got there might have been interesting and, and to your point, most people would go, Hey, hold on a second. You decided not to be a criminal. You're an ethical, moral person that, that has structured, but humans don't necessarily default that way. Because what's, you know, ethical and moral to me, might not be ethical and moral to you. You know, what's right to me might not be right to you. And that's the other piece that fascinates me about the psychology of risk and resilience and societies in general is we, we all think that there's this baseline of common. But in reality, we've all got our own common sense view of the world and we all think we are right. You know, if you ever talk to anybody about their view, even people who hate the world and hate laugh, they'll still try and convince you that they're correct in hating the world and hating laugh. you know, it does stop with a piece and, and I think this is the important part, it's about understanding as a fundamental starting point, Hashtag the Global Society of Flat Earthers, like is what comes to mind for me. when you say that everybody thinks they're right can be dangerous, can't it? Absolutely. And I mean, we we're going down a segue here, but yes. If we look for example, at the way information access is happening in the world today where, any search agent, most social media. they're, they're not designed to share information. They're designed to make you stay on the platform. So they will continually feed you narrative stories or ideas that will keep you on the platform and reinforce whatever it is that that algorithm has calculated will keep you on the platform. it's fascinating to see, for example, that flat earthers are getting a resurgence you gotta, you gotta wonder and go in the modern world where literally anyone can buy a telescope and look up in the sky. Or jump on a plane and actually see the curvature of the earth. So let's go back to the psychology of risk. when did it become the sun and your solar system in, in relation to your business narrative. Oh, okay. Interesting. Probably when I started running my own business is when it rarely started. So I set up my first business in 2000, sorry, 23, 24 years ago in South Africa. it was originally a training business that morphed into a protection and security business that morphed into a risk business. at its peak we had about 150 close protection and security managers working in about 20 countries all over Africa and a bit in Southeast Asia. it was fascinating to, for me to observe a few things. I was a lot younger then, and I mean, I started that business. I was 23 years old pretty, pretty young to be kicking off what we did. there were probably two or three incidents that got me really trying to understand this stuff. The first one that comes to mind Trying to understand my own clients. So very often what would happen is the phone would ring, and this is South Africa, which is a high crime rate environment, and very often it would be somebody going, I'm under threat. Somebody wants to kill me. I need security and protection. So we were a risk management business. We would normally start off with how I would hope any specialist business would start, which is why, who what? Give me information so I know how to help. it blew my mind that those conversations more often than not started with money is no object. I need to be secured. And our basic strategy with that was until we could do a proper threat assessment and risk analysis, we would always send at least four people in two vehicles because you need to cover a 24 hour shift and you need someone to watch your back. So at the very least, you need two people per 12 hours at the very. And it was fascinating to see how even clients' perception would just change from money's no object to, oh, can I just get away with one guy and one car? You know, that sounds a bit expensive. Where, where three minutes before money was no object. Somebody wanted to kill them. and then there were many other pieces. You know, for example you know, I had a client at one point who was under risk. But insisted on every now and again testing the protection team by trying to show that he could lose his protection. Team That's the most self-defeating behavior you could ever think about. Yes. But, but, but it also goes back to the motivation of the actual punter. So if we look at our staff, for example, One day we sat down and we thought we were so smart. Me and my business partner, we went, how do we motivate our staff? Like how do we rarely get them going? And we came up with a few metrics. So we ran weekly training sessions for all of our employees. We did quarterly, all round assessments, which covered all the physical and technical skills that a protector would need. So we came up with three metrics. We went, look, if you could attend three out of four training sessions, a. If you can ace your quarterly assessment. And then the third metric was positive feedback from your client. So if your client loves you, we will give you up to 15% more of your salary. So 5% bonus for each of those. And we were thinking, man, this is gonna be so good and it didn't work. Why I'm interestingly enough, the reason it didn't work is that some of our employees at the time found that the only metric that really counted was if your client loves you. So if your client liked you, you could, we couldn't fire them because the clients would look to terminate the contracts and it was a whole bunch of variables like that that started to get me going. I need to understand humans better. I need to understand why, for example, that decision is being made. By somebody that would view themselves as a professional protector and should be embracing training and skill sets, but instead with maneuvering ways to avoid them. You know, somebody who was paying for a very expensive protection service but then trying to dodge their protection team. Why was that happening? So my PhD focused on high consequence decision making associated with use of force, and it was a bit of a marriage for me of my two loves then, which were security and protection. And use of force and martial arts and one of the things that amazed me in doing the research and putting together a best practice model was we know how to train people to make the best possible decisions under pressure, which is really what that comes back to. Because if we look at a use of force decision, if you get it wrong, it could cost your life or the persons who's attacking you's life. Which, you know, there's massively high consequences to that. arguably often higher consequences than investment decisions or financial risk. Yet financial risk has had all this work done around metrics and quantification. Were measuring. Human motivation is often a bit different. It's harder. when we look at how that comes together, it, it was really fascinating to see that despite us knowing how to prepare and enable great decision making, there were still many schools of thought. I finished my PhD in 2012, so this is going back to about 15 years ago when I started the research. That there were already so many different models and thoughts. You know, some, some of some schools of thought were along the lines of if we have a linear model, you know, you do one, then you do two, then you do three. And we teach people that model and we indoctrinate them in that they're more likely to make good decisions. That is true. Provided you have a high control of ver of the variables, and a situation plays out exactly the way the model was designed to work. But in reality, it doesn't. And when I was building the model of Brazilians I had a lot of input from a guy name of Tony McGirk and I'd encourage her listeners to have a look at him. Tony was the fire chief of Mercy Side in the uk and he's written up in The Economist for taking what was one of the worst performing fire departments and turning it around into a success story. There's a lot of pain and a lot of challenges in that. And you know, he had to do a lot of work to change the mindset de unionize some of the structures because it just wasn't affordable. But it was really interesting in talking to Tony around some of this stuff, because what we should do is often something that's hard to do. Back to your point earlier about decision making. But just because things are hard to do doesn't mean we shouldn't tackle them. So in Tony's case study, for example, it's such a good case example of how to apply Brazilians. He analytically looked at where fires were happening and they were happening in people's laundries and kitchens. most firefighters, the, the model a rescue model, right? a response model. We wait for a fire and we rush there like heroes, and we put it out, we save. It's not a preventative model. So Tony flipped it on his head and he had all these firefighters actually physically ex stalling fire alarms in people's laundries and kitchens for them. And that became a social outreach thing because you had fireies knocking on your door and talked to him. Yeah, nice. And, and, and sur surprise, surprise, you know, the, the rate of fires went down tremendously and occasionally went up and, and they got better results. So, you know, in a very long winded way. Psychology of risk and decision making for me become intrinsic parts of human performance. So if we look at where this has all evolved to now, I link three or four concepts together because they are all intersected. You cannot separate them. Leadership, high performance risk and decision making are all four components of the way we need to be building our own capabilities. And for those of you who are viewing yourselves as leaders already, or potential leaders or transitioning into leadership positions, you need to make sure you look at these aspects as integrated pieces, and it's one of the big failings as we've moved into training and educating and coaching and even doing culture change for some of our clients. That one of the big failure points we often have is we talk about leadership as a bu, as a bundle that sits to one side. We talk about management skills as another bundle. We talk about risk as something that leaders and managers don't wanna think about, and then we don't really teach them how to make good decisions, and then we wonder why they fail. So, you know that, that, that's really the basis of what we've built with Brazilians. There's a model that enables high performance in volatile and certain and complex. Ambiguous operating environments. So going back to your point where you said that your business morphed from one thing to another thing to another thing that tells me that you already had great insight back then to be agile in not only how you thought, but how your business could change and deliver better and different things. I can't take the credit only for that. There are probably three or four variables. One I had, I had, and he still is an owner in my current business, a really good business partner there. And we were very synergistic in how we looked at the world, but we were also opportunity centric. And that became another kind of hinge point of Brazilians, which I'll circle back to you later in that we were quite open and probably in hindsight not open enough, but we were quite open to client demand. So if a client said, I have a problem, we very rarely went, Ooh, that's something we will never touch. It was, could we help you solve the problem? So it was almost a logical progression for us where we started as a specialist training business. In fact, our first contracts were with the military and police in South Africa. But as we morphed and as we grew, we then got into corporate training and we ran a project for Standard Bank, which is the largest global emerging market bank. This goes back a good while, but I'm happy to share this case study with anybody who wants to see it cause it is a written up case. Example. We trained 23,000 people for them over three years and took their culture from switched off to switched on. And learned a lot through that process. So that was the birth of our corporate training. But that evolved because the banks could not afford to give everybody a bodyguard. They had to come up with a solution to empower staff to look after themselves. We also were training lots of protectors and training lots of people. So that's where our operations division started, where clients would come to us and say, look, you've got this base of people you've trained. I need a. And what landed up happening then was we had two divisions, training and operations. Anything that didn't fit into training and operations, we, we didn't have a place to put it, but we were getting asked to do a broad range of things from threat assessments to, um, fraud investigations. So we parked that into division, we referred to as risk management, and then that kept evolving and growing. But to your point, the world changes quickly. Things change quickly. We are now Harper connected. we are connected across geographic domains in a way we never were before. we have got access to the world's knowledge at the click of a finger. So change is now inbuilt into the way we should be thinking and operating in a way that it never has had to be before. I like your phrase, switched off to switched on because that, I mean, that I think resonates across so many things and so many platforms. I go back to pre covid commuting into London, and it seems that and I laugh because everyone's quite human until they arrive at the train station, and then as soon as they arrive at the train station, it's like they literally go into zombie mode. You know, and everyone just is a zombie. They don't look at each other, they don't talk to each other. There's a little bit of archy bargy to try and get the best suit on the, on the, on the train, and everyone literally turns into an asshole and because everyone turns into an asshole no one looks at each other, cuz everyone knows they're around assholes. So I'm think. Whenever I went into the commuting mode, yeah, I had my own little bubble and I, I tried not to be an asshole, but I can't help but think after years and years it rubs off in a little way or whatsoever. But I always made every single part of that journey a conscious thing. and I made sure I didn't fall subjected to that zombie because I would learn on the chi train and I would read on the train, I would do my studying I'd think, you know, I'm gonna spend an hour here, I'm gonna spend an hour there. And rather than it be a waste of my life, I'm gonna turn it into something massively productive. So I get that switched on approach. But what do we do for those listeners who are in environments where they feel that everybody is in that kind of swed off mode? What's your advice? that's a very good question because it's been part of my life journey. and it's still a challenge to me that and I'll share a little anecdote first, which will give you a little bit of a, a, a view of why I look at it this way, and then I'll give some pointers that would maybe be useful for your, your audience. It, it hinges off and I, I did write about this in, can I See Your hands? And that's why I wrote a book about how to switch yourself on, because even though there's excellent work out there that preceded my. I felt that we were still missing the exact how-tos and people like, you know, Jeff Thompson and Gavin De Becker and David Grossman had all done good work. In fact, some of an excellent work. So good that all I wanted to do in some cases was reference and integrate their work as opposed to repeat it. But I had one thing happen to me in South Africa, so this was, I think 1998. I was a full contact martial arts champion in the styles that I was training. So I was actually competing. I just started my career as a professional bodyguard. So I thought I was awesome And you know, this being South Africa, it was a Sunday night, the phone rang and it was my mother, she was on the way to the hospital. My stepfather had just been shot in the head in an attempted carjacking. Wow. I grabbed my go bag, which had my firearm, first aid kit, et cetera, into it. Rushed to the scene. Got there. There were two guys looting the car, and I actually drew my firearm. I was in literally centimeters, millimeters away from shooting them both. And it actually turned out they were both cops, but they were actually looting the car and stealing stuff. Anyway. But you know, another decision point had I actually pulled the trigger, what would've. Rushed to the hospital and he was shot in the head. He passed away several hours later, but it became a fundamental turning point for me because I had all the knowledge and skills to keep them safe. They did many wrong things from a security perspective. My failure was in focusing on how good I could be, not sharing that knowledge with people around me who needed it. And it's changed the way I've run my businesses. It changed the way I think fundamentally. And to your point, yes, we should be the best version of ourselves. And I'm not saying your, to your listeners, you should not keep making yourself a desirable, qualified, competent, expert in whatever you do. that probably has been one of my contributing success factors, that whenever I came across a qualification, a skillset, or something that I thought would be useful, I embraced. So, you know, I went back to university two years ago and completed a year of study in cybersecurity because that's where we're going. to your point, it's exceptionally difficult to switch people on, particularly those people that feel, and let's talk about the domains, knowing that this is the I F P O podcast. you know, most of your listeners are probably people that have a natural sheep dog mentality. they work in security cuz they wanna be insecurity. Mm-hmm. they, they feel they want to protect something that is a, an innate driver that I feel there are some humans that innately have it and there are others that don't. And it's not a gender nor age thing. Some of the best protectors I've seen have been older ladies that just rarely care. and I'll Harper vigilant and we'll do an incredible job at, you know, some sort of observation reporting piece. So the first challenge we've gotta accept and understand is that if you are naturally a sheep dog, many people are not. And that needs to come with an understanding of managing our own judgment as opposed to leaping to the conclusion of, Hey, you're useless, or you're an idiot if you don't apply some sort of vigilance protective methodology, even if it's just about your own decision making. this is the interesting piece too, because I've often found that people focus very much on one domain of their life and they measure themselves on that. So it doesn't help that you might be the most vigilant, switched on, capable person in one domain, but then you're absolutely negligent, ignorant, and in denial in others. And I can give you a ton of examples on that as we go. But a simple one is you might be excellent at being a physical security guard or protector, but you might be terrible at cyber and online protection. It doesn't help because we, we live in a world now where we've got three competing domains that all intersect your work life, your personal life, and your virtual life. I actually refer to that intersection as the whole of person model. And when we build training and when we develop people, my goal is to build skills across all three domains. If I'm only giving you a skill in one domain, I'm actually not preparing you for the world we live in. I prepare you for a world that. And, and it doesn't work moving forward. So first piece of advice is make sure you manage your own judgment biases. Second piece of advice as we work through that stuff, is apply that whole of person model. Don't just be thinking about one domain. The third one is understand human motivation, and I'll make that. Statement with a caveat, and that is a lifelong journey. And the, the second you think you know it, you're probably gonna be surprised. But what we found in teaching the psychology of risk is that there's really four layers we gotta be thinking of. Step one is the self. That's me. What goes on in my head, how I make decisions. If I don't nail that one, the others are almost irrelevant, because without control of self and understanding of self, You have no ability to influence others effectively, which is the next domain. So you might influence others, coincidentally, charismatically because of your personality, for example. But it's exceptionally difficult to get large scale change, which is what we need to switch on groups of people. The third stage is organizational, and it's fascinating because I've seen a lot of my graduates do very well on the individual and team piece. So they transition themselves quite well. And they develop great balances and checks for the way they are being switched on. They then are able to influence their immediate colleagues and their team around them, but they struggle to get change at organizational level. Mm-hmm. And there's a, there's many variables to the organizational piece that we need to be cognizant of. And it's not easy. You know, we, we run a, a postgraduate certificate and a postgraduate diploma, and it's about a year and a half of study before I feel people are able to start tinkering at the organizational level. And too often what happens when people get excited at the organizational level. Is they actually often break things more than they fix things because they'll implement a project, which seems really good, but it's not understanding the whole organization. And there are so many examples, but because your audience of security centric, I'll give you a good example. we were asked to go in and do a security uplift, culture, vigilance uplift project, and. One of the first things we found is that we were part of a holistic risk assessment that was done, and security culture, education and vigilance was an action item that had to be addressed. Other things were things like access control, cc t v, physical security, et cetera. So what was happening was a rare, um, proactive security manager was ticking these things off and he had installed a cutting edge access control. But what that, what he had done is he hadn't consulted or collaborated or got buy-in from the people who worked there. So what you found is that people who'd been coming in and out of that building for 20 years, all of a sudden now were stopped. They had to carry their swap cards and even though with a security hat on, we'd go, that's great for them. They were going, you don't trust me anymore. so a well-intentioned move actually broke the culture. and it made our job exceptionally more difficult because pre-install, installing the access control people just didn't care about security. Yeah. post the access control, they hated the idea of security and they were antagonistic against the concept of working to make it safer. Which is, you know, when you, when you look at it, why would people be against being safer? It should not happen. But pragmatically people are driven by intrinsic motivation, so, If I was motivated in what's in it for me, we actually refer to that as the whiff them, you know, the what's in it for me? Motivator. It's the strongest motivator of all. Because if there isn't a whiff them for individuals, they aren't gonna play with you. They may say yes, but then they'll do whatever they want when you're not looking. So we, we've gotta find a whiff them. We've gotta hook people in. That's not easy to do because different people have different wms. in relation to the what's in it for me piece, cuz I love that with them, it's almost like the employee engagement piece was missing because we've started to look at, certainly in the uk the touchpoints process, you know, the journey, for example, that someone has to go through. And this is very good in particular when you're looking at concierge security and to sort of build in this kind of consciousness that before someone walks through that front door, they've. Been on a train with loads of assholes and a crammed tube, and it's windy in their own umbrellas, blown inside out, and they just wanna go in and sit at their desk because everything they've had to go through since they've got up has been, you know, pretty challenging. And it's a daily thing. It's a daily grind. So that what's in it for me? Just understanding the journey that people go through, the journey to getting through the day, the journey to getting home, and it's all part of that. Wider engagement piece, isn't it? so you, you've nailed something there and, and this is really important if we're talking in the organizational level, right? And this was an epiphany for me when we started teaching the psychology of Risk in 2015. We won a contract with one of the universities here, and we started running this postgraduate program and I brought in several behavioral scientists. I still have two behavioral scientists that work for me in my business. And it was a fundamental hinge point for me in starting to understand human motivation at an organizational level because it, it's mind blowing, but engagement has been proven to be one of the variables that drives performance. It drives outputs, yet it's the piece we keep missing when we look at any sort of risk solution. And there, there's a lot of science behind how we've landed up here, but we are coming out of an era where management centricity, you know, the idea of planning, organizing, and leveraging limited resources to get the most efficient output was the primary driver. And it was such a strong driver that it was more important than people, more important than their motivation, more important, their wellbeing. In fact, if we look at most, I, I think back to when I did my first management training, um, and my first set of studies was in management, marketing, and leadership. We were literally taught that a good system is a system that functions regardless of the humans in that system. And that humans are cogs. You can pull in and out. And if you've done that, you've built a good. I don't dispute that at all. It makes perfect sense if we're working with robots. Okay, it makes perfect sense. If we have a high degree of control and a high degree of certainty. Fast forward to the world we live in now. Almost all of us have limited control and very limited certainty and most of our decisions. So therefore, a lot of the modeling that we are taught around organizations and performance doesn't work anymore. so back to your point, we have to do things differently, this was one of the drivers around Brazilians when we were teaching the psychology of risk and looking at how it works. For me, risk is, any of you who haven't, it's worth going to actually study up and look at, for example, ISO 31,000, the risk Management guideline. It's a good tool. It explains a lot of things that are useful, but it defines risk as the effect of uncertainty on objective. It doesn't talk about attack vectors. It doesn't talk about hazards, But yet we've consistently looked at risk as a negative thing. Oh, how do I stop a bad thing happening as opposed to actually, I cannot be successful and I cannot capitalize on opportunity without risk. So one of the things I'm really passionate about is positive centered risk and that taking risk is not a bad thing if it's calculated, measured. And we've got enough sophistication in managing things when they happen. I love that positive centered risk. I really love that it's really hard in security and and conscious who your audience is because the measure of success in security. Is that nothing bad happens, which means if we are doing our job well, nothing bad happens. And it often leads to executives or people who allocate budget going, oh, nothing bad's happening, so therefore we don't need security anymore because nothing bad's happening. Whereas in reality, it's the security functions, the things we invest in that often create that outcome of nothing bad happening. So I wanna understand positive centered risk. I'm interpreting that as using the knowledge of the present risk to drive more resilience, to drive change, to drive consciousness to certain areas to drive I improvements is, am I right? Is that what it means? It's significantly part of it. but let's just look at modern day risk management. And it's in many ways, depending on the organizational sector you work in, but a lot of modern day risk management. And this was a very interesting journey for me, transitioning from security risk into broader risk, which happened about 14 years ago in coming to Australia and realizing that this place is very, very different to what I was used to and most of the security risk issues within Australia. particularly back then, were handled by government agencies. So private sector security risk, which where I was from in Africa, Africa and other third world environments, you know, you paid for the best. You never went to government authorities because they tended to not have the best, they tended to have what was available so within Australia was a different mindset as I expanded into, let's call it the broader world of. And it's fascinating to see that risk itself when we actually break up the domains. There's financial risk, reputation or risk program management risk, project management risk. These things just all evolve in, their own little sub worlds of specialty with their own unique people. Um, anybody's ever dealt with engineers and looked at the way engineers tackle risk? No. It's significantly different. To, to the way, for example, a threat assessment from a counterterrorism perspective would work. realistically to look at your point around positive centered risk, it's about a balanced approach. It's about not just fixating on how do we stop the bad thing happening. It's also looking at how do we enable good things and force multiplication pieces to manifest. So I'll give you an example, and I'm gonna go back to that access control example I used earlier on paper. It's a no-brainer that if an assessment was done and the fact that anybody could enter into your building with no access control. There's a vulnerability that needs to be addressed, but what is the point of solving one problem to create many more? Because arguably, and this was my perception from working with our client, they would've been better off holding off on the access control and getting their people aligned to being part of the solution before they implemented the access. So a lot of the stuff comes down to timing and understanding, but we can't get that correct picture without human engagement, which is what we spoke about earlier and the correct information. part of what we've gotta do is balance, threat and hazard type decisions with opportunity and cost of opportunity decisions. So we are not just making decisions like, hold on, without access control. Somebody you could come in and hurt or steal. We are actually going, hold on a second. Is that the necessary control? Now, first, if I could get my people switched on and engaged first. I might not even need the access control because interestingly enough, they already had perimeter access control in place this was access control into the building. So it was the, it was the second layer. So one of the things we've gotta get really good at is understanding systems. And there's a lot of work that's been done in systems thinking. Um, I'm a massive fan of things like complex adaptive systems theory, which links back to chaos theory, and there's a whole bunch of work around that too. But one of the things that we often see as a failure in security is that security becomes a standalone island that nobody wants to talk to. Because we are often the people who look scary cuz that's our job. We are the people who, if you have to talk to us, something is wrong, somebody's stealing, something's broken. And very often we are not that approachable, friendly, or engaged. that's not the way we get good outcomes from a group of people. While, while humans still with our question, do present with the biggest risk of all, they also are biggest opportunity 100%. And you know, one of the things I'm really passionate about is, you know, when we started this discussion, you made the, the comment of when we were analyzing your own decision making and, and I kind of shared back with you, if you think you can, you're right. And if you think you can't, you're also right. If we think security is only about God's gates, guns, cameras, et cetera, we are failing. The best outcomes are people who take responsibility for ensuring their own security and safety, and owning the organization's security and safety. Because if people are doing that, all your other stuff will work. If they don't do that, I can guarantee you they're spending most of their time not liking you. working their way around things. So they're going, okay, how do I not have to wear my ID card? How do I not have to sign my staff member in or out? How do I bypass using the software system so I can use the one I want? we've, gotta find this balanced approach to trying to make sure that risk moving forward is actually an enable. Don't get me wrong, there's a, there's a significant place for hardcore straight art defense based approaches, but I would say even those, the efficacy is tremendously diminished if we don't get the other pieces right. and you know, when you look at sort of security over the decades, it used to be a, you know, if I tell you I have to kill you kind of thing or you know, you couldn't possibly do what I do or know what I know. Whereas I think now, and I certainly your journey, you've demonstrated that you've kind of shared more than kept things. Close to your chest. And I think that's, that's probably where we all went wrong in the past was by not sharing that risk with the wider employees, the wider companies, the wider partners. Because had they known those potential risks and had we not all kept everything so close to our chest, maybe we wouldn't have had such a sort of a steep hill to climb there. There's a lot of validity to that. And probably your point is right in that that is also a hangover from an era that's gone. the vast majority of people tackling security challenges had a very distinct police or military background and perceived that the rest of the world had to work that way. and, and in their defense, honestly, some of the best security people I've seen do come from those backgrounds, but they're able to morph and change into what's required by their environment. And I would say it, it's really interesting. I chaired a session just before Covid with one of our police commissioners and the head of KPMG's defense practice, and I was moderating the session between the two of them. Ian Stewart, the former Queensland Police Commissioner, made the comment that the world has changed, and from an Australian perspective, he actually used the point saltwater insulation. You know, we are, we are a large island in the middle of nowhere, very far from everywhere else, and that for many years created its own natural defense. You know, small population, easier to police, easy to control our borders. But even the law enforcement side of the house has to change their thinking now because his point was salt water installation is gone and the police and the authorities cannot tackle the challenges that we're facing now. Alone. We need public and business support, and we need public and business stakeholders to engage and solve their own problems instead of just relying on authorities to do it. so that game has changed. If we are in a business where we think the security department are the ones who must do security for everyone. We are in a, we are, we are setting ourselves up for failure because most people are now working from home or working from anywhere. and we don't have the ability to be everywhere at once. So our modeling has to change based on what we're facing. And to your point, a model where people understand why and bind into the purpose of what you want them to do, where they trust the security or risk practitioner as an expert. Mm-hmm. And where the expert is able to engage them with a whiff them, tie it back to organizational and strategic. will lead to a better result. So, you know, it's not rocket science, but it's quite difficult to do, which is why most organizations are not doing well in this space yet. I'm still gonna find it funny every time you use the term w Your, your WM seems to be enjoying humor, which is a great trigger to, to keep a good engagement. So win win for both of us and for your listeners. Isn't security just dull off to some people? You know, having a little bit of joy is, is part of it So when we look at your profile on LinkedIn, we can see Brazilians all over it. Where did that come from? Te take us through that. Security people naturally are trained to apply Brazilians. We are taught vigilance, we are taught awareness, but we are still in the minority of the way people think and act. And by definition, the majority of people are now being bombarded with this concept of resilience and you can't really understand pre resilience unless you understand resilience. So let's just run through the sequence. So when I started teaching the psychology of risk at uni, at postgraduate level about seven years ago, I love linking things and looking at how things intersect. So for me, security management and security risk management is literally risk management leadership, and high performance in practice. I can't do either of them without putting them together. When we look at security, it's really just managing risks, right? We're worried about the risk of fraud, cyber attack, physical attack, terrorism, you name it, which are all threats that you know are risks. So for me, no matter how effective we are at risk management, life is risky and you don't control the variables around you. I think in our chat we spoke about VUCA volatile and certain complex and ambiguous, and that business as usual operating contexts are now different. And the simple fact that we are hyperconnected and plugged in 24 7 and the lowest level stakeholder has access to an audience that they can influence has changed the power dynamic and the way businesses need to think and work. So if you think about risk, and we go risk literally as per asset, 31,000 is the effect of uncertainty on objectives. If I have certainty, it's no longer a risk. It's just something that's going to happen in, in which case we're actually doing issues or incident management as opposed to risk management, which are interrelated, but different disciplines. So if we are good at risk management, our goal is to take something unpalatable and minimize the likelihood of it occurring and minimize the potential negative impacts of that incident occurring equally. So we would like to be maximizing the potential benefits and positive output of something occurring or not occurring. So even if we good at risk management, there's residual risk left over, something may happen. So risks get realized and I think that's one of those pieces that's always fascinating for me around people that work in any sort of risk vocation, is that we forget the reason we exist is that sometimes bad stuff happens and it's sometimes hard to convince stakeholders who are allocating budget that no matter how good you are at your job, bad things still may happen. So that's where the resilience piece comes into play, and I like to look at risk and resilience as two sides of the same coin risk. It hasn't happened. Resilience is when it has happened. That's what we need to get through the incident, cope, respond, and recover. So to your question, why then resilience? If risk and resilience are good enough to explain the equation, if they're two sides of the same coin, why do we need something else? So I became fixated, uh, as a kind of a self acknowledged risk nerd. I love everything to do with risk and security. And when I, when I get fixated on ipr, tend to research it a lot, which I did with a world of resilience, which is a very big world when you start looking at it. Disaster resilience, cyber resilience, disaster recovery, yada yada. But modern day resilience thinking, business continuity, et cetera, really, uh, evolved from, and, and matured from disaster recovery and daughter recovery in the US as a primary driver for that sector. So when we actually look at that, we became so siloed in the way we tackle resilience and, and no offense to my, uh, brothers and sisters in the world of business continuity and business resilience, but. Realistically, we can have the most effective business continuity, business resilience, planning, and we lose the focus on the number one most important variable because we fixate on planning. And that most important variable is the prevention of bad things happening in the first place. And resilience tends to ignore that variable. And the more we canvased it with a lot of our stakeholders, the more, even if you just think of it phonetically resilience reaction, right? Resilience reset. It's really hard, to link it to this idea of proactive prevention. And there've been many, many attempts to do that, yet they keep failing. And even if we look large scale, most of our first response agencies, whether they're firefighters, whether they're law enforcement,, the motivation for people at the top of those organizations is very rarely based on proactive prevention, even though it rarely should be. If you look at human drivers, most of the time their motivation is power and securing their position, which they tend to solidify by getting more assets, more people, more budget. You get more assets, more people, and more budget when bad stuff happens and you prove your worth, you don't get more assets, budget and power when you stop. Bad things happening and nothing happens. So we then went, hold on, we've gotta reframe this discussion. So we, we looked at three aspects. We looked at compliance, which is the stuff you have to do. And if we looked, for example, at Martin's Lawn Protect Duty that's coming into the uk, yeah. It's kind of scary that we have to legislate that people should do the right thing, but yet we are still stuck in a society where, What's that all? Sorry. Democracy is not a great system, but it's the best one we have, right? you know, we've got capitalism, I think, but hundred percent. And then you've got these capitalistic, and don't get me wrong, I, on a business, uh, if I don't make money, my shareholders are not happy. Neither am I. But on the other hand, if we're not properly structuring these pieces so that we prevent the things that are fatal, these critical risks, these things that will cost lives and destroy people's, mental health, et cetera, we are missing the game. So originally, pr pr, uh, Brazilians was actually proactive resilience when it started in 2017, when we coined the concept and the idea we went, right, we've gotta get away for people to stop thinking about after the effect or during the effect and put the effort ahead of it. Through covid, we actually found a different piece around Brazilians, and that's really interesting. And when you look at the world of resilience, you often hear people talk about the concept of bounce forward as opposed to bounce back. But it's a very unpalatable thing for anybody in business continuity and business interruption because their primary focus is how do we get back to where we were before the disruption as quickly and efficiently as possible? And it's a logical assumption for people who have to plan, because if I go, how do I get back to a better state because of a disruption, what does that state look like? How do we define it? How do we map it into something? It's too hard to document because it requires human skills, opportunity, centrism, agility and adaptability and a, a heavy dose of entrepreneurship and innovation. But in a world that's moving so quickly, um, every disruption is an opportunity. And one of the things that always amazes me, you know, the old hands who've been doing risk, safety, security, cyber management for years, I always have a giggle when you have an off the record chat with them and they, they whisper in your ear and they go, one of my secrets to successes, I never waste a crisis, and almost always after an incident like that, is when they get more budget and they get a lift in, in profile. So we sort of went, hold on, we've gotta change this modeling, we've gotta change the way people are thinking about risk generally, and resilience. Secondly, but what do we do? We want them to focus on two things. One, it's not binary, it's not resilience, verse resilience. It's not compliance verse resilience or compliance verse resilience. It's an integrated pack of compliance. Do the stuff you have to. Resilience. Even if you do the stuff you have to something bad may happen. So be ready and prepared. Now you could do those two things. So you can legally perform your functions, hopefully, and you can respond if common disruptions hit you now, you could put the effort and energy into the Prezi, which is developing the capability to be innovative and opportunity centric when something happens. And two, hopefully preventing negative things from happening in the first place. So that's the history of Brazilians., it's been a great journey, or at least as much as is in within one's organization's capability to be able to mitigate. But there are gonna be some things aren't there that are outside an organization's capability. I think. Is it fair to say that the stronger the business unit is, the stronger they can deal with even any un unplanned event? Well, I know we're gonna segue and talk about our leadership and our performance and some of the other pieces a bit later, but realistically, what we want is not necessary a naive perspective that, hey, everything, everything bad happens for a reason, and it's okay. We can, you know, persevere. You actually want a real learning culture. You really, really want organizations to be able to go, if something bad has happened, what do we take from it? Because, to your point, no matter how good you are pro to prevention, we are humans and our opposition of the threat Act is looking to commit whatever crime or, or a attack they want. they've got every, every benefit and every advantage on their side. We've got budget restrictions, imagination, restrictions, resource restrictions, and for most people, even people who professionally do security, risk management for a job, they're juggling more than their resources can enable them to manage. if we take cyber for example, and cyber threat, you know, roughly n between, depends which research you look at. Between 83 and 95% of almost every cyber breach was because of a human behavioral error. Yes. Factor or issue. Yes. Yet so true isn't continue. And yet we continually tackle cyber by trying to come up with more tech pieces that try and minimize the human factor. I genuinely feel that you were eavesdropping on a conversation I was having earlier. Because that's exactly what we were talking about. And a lot of technical people who are very skilled and very clever, they think that making solutions can only be around their field of expertise. But actually it takes several fields of expertise around people, processes and technology. And technology is just a third of the whole piece, isn't it really? You're a big speaker about enhanced decision making. Take, take us through what that means. Well let, let's just explore that for a second, right. What risk management itself is literally hinged on the concept of decision making. Right. We weigh up variables, we assess aspects of likelihood and consequence. We, if we are in the world of security, we think about things like, um, threat, actor capability and intent. We, we try and understand the way something bad may unfold, and we often do that by learning about the way it's happened before. So ultimately, why bother with risk management? And in essence, why bother with security risk management as opposed to security management? Cause they're different things, right? Security risk management is about managing events that d haven't happened yet or may happen. Security management is about managing the apparatus that are physically in place to respond, recover, and prevent, hopefully prevent not the, the path that we often ignore. Um, so realistically, risk is about making good decisions and we get lost. I'm so passionate about this piece. I talk about this at risk management conferences all the time because. Risk management in its modern sense really evolved out of the insurance industry. One of the things insurers do very, very well is risk quantification because they've got actuaries and the smartest people in the room adding data to things we don't think about, and it's fascinating when you actually explore that. So what we wanna be doing is driving better decision making through risk management. That's what we've gotta do. So why enhanced decision making? Pretty much, because risk management, much like security and safety, don't have great reputations, particularly in the corporate or business sense. They tend to be viewed as roadblocks or dis enablers. They tend to be viewed as cost centers where people throw money into and get nothing out of. Yeah, and I think we spoke a bit about this on the previous podcast. The majority of security people historically, you know, came out of defense or law enforcement backgrounds with a level of stoicism and limited customer service that, that didn't inspire, uh, let, let's say collaborative business behaviors. So e even cyber for example, it's fascinating, you know, going from conventional security and risk to studying cyber security, I am blown away with the militaristic language used in cyber threat vectors, threat attack, threat, this threat that, and you actually look at those things and you go, no, realistically, most of those are crimes. So you don't hear law enforcement officers talking about, you know, attack vectors and, you know, there's different language. So yeah, it's not a surprise because you know, the, for forefathers of modern cybersecurity, We're electronic warfare practitioners. Yes. You know, so we, we need to look at where we've come from to understand where we're at. So, mm-hmm. Long, in a long-winded way, why enhance decision making? Because I've very rarely ever had an executive in an organization tell me that they don't think that good decision making is a good thing. I've had many executives tell me, I'm not interested in risk management. I've got a department that does that. I'm not interested in security management. My security people must look after that. In fact, uh, quite interestingly, not gonna say which one, but I had some off the record information about a big cyber attack in Australia, one of the big ones, uh, that recently happened. And that the, IT and exercise team of that organization invited the CO to participate in a simulated ransomware attack. And she refused on two occasions saying, it's not my problem that your problem. I hire to do that. it's not the leadership's fault because they've been trained to run businesses in a different way that's not ready for where we are now. And the thought, like honestly, I would look at that and say, that's good business practice because people are busy and they have to allocate their limited time and energy in the right places. It's a failure of effective internal education where an executive doesn't understand the risk, therefore a failure of decision making. So, you know,, that's where the decision making piece comes into play. And we're not, we're not teacher risk management. I'll always start with the individual and we go back to you. How do you as an individual make decisions if you are not good at risk managing your own life? What makes you think you're gonna be good at risk? Managing a business? do you have any. Use cases ga that you can talk to and anonymize to take us through real life, situations, perhaps how you solve problems. the, the starting point with that is what is the problem? Because not all problems can be solved, right? We've got this pool of problems that are generally referred to as wicked problems, you know, and a wicked problem is a problem that's defined as a damned if you do, damned if you don't type a problem. Yeah. And those are the ones that we either tend to ignore or we just do what we did last time. Or we look around and we go, what are the others doing? Is that good enough? So part of the challenge in the modern world we live in, and I think last time we chatted a little bit about complexity. And by default, you know, complexity does not have a binary. Linear solution. It requires the adaptive and agile capability to solve problems as they present and have a systems view of what's going on. It's even more difficult now because having a systems view is great, but we need an ecosystem view because we're so interdependent on so many other pieces and very few people have got A, the time. B, the information and C, the and C, the understanding to look at an entire ecosystem and understand how it works. I mean, academics spend their entire career just studying one type of ecosystem to understand and nevermind running a job at the same time. So a few use cases and examples. Because our business is so broad and we do, security, secure risk management, cyber risk resilience, we also provide manpower and we look at a broad range of solutions that come into play. We do training. So I don't think there's such a thing as a off-the-shelf solution that works in every situation. And my business advisors and the people on my board often look at me and go, GEV your job. Your job is to build the scalable, replicable solution. And we try and do that wherever possible. But realistically, if we just go back to the human in the equation, I feel what works in practice is trying to understand who the influencers are and what their decision making process is. Otherwise, what tends to happen is you do a piece of work that doesn't move the organization forward. So one of the things we spending a lot of time on in my organization, and thank goodness we are now big enough that we can actually choose the clients we want and say no to certain pieces of work. It's been a long journey to get to that point, but we've gotta go, what do we want to do? So I go back to my model of compliance, resilience, and resilience. Where we'd love to be playing is with clients who have the mindset of Brazilians. So step one is actually educating them on where are you at? If you are stuck in compliance, then honestly any auditing firm, and many of them play in our space, will, will probably be your go-to and your go-to, you know, Deloitte, kpm, g y, one of those big firms who will come in without any expertise in your vo, in your area, do an audit and tell you what they think you need to do. And you'll pay four times the amount you would pay an expert to do it, but you perceive it's okay. So in case you can't tell, uh, I'm a bit frustrated with the market that is stuck in the compliance mindset because it doesn't work. But compliance is still the ticket to the game. So what we try and do is identify where the client's mindset is. If they're stuck in compliance, we may or may not take the job. Sometimes we will take those jobs if we think a, we are well placed to do it. We have a relationship with a client, or B, this is part of a bigger journey where we can move them and mature them and nudge them along. Because, you know, lots of organizations have realized they need to change. They don't know how, they dunno where to start, and they're actually in denial because it, it's really interesting, uh, clay Christensen, the founder or the Fuck, who's considered the father of disruptive innovation, passed away a few years ago. And one of the things he, he often referred to was this idea that an organization won't disrupt itself, it's against its own interests. So if you are coming to the organization, and you've probably experienced this, I think we've had chats with this. When you, you come to an organization, you wanna do something better, you want to tweak a system, change a system, add a software piece, And people just push back and go, that'll never work. We tried that years ago. Well that's no good. Or What are you doing? The system isn't broken. Why are you trying to fix it? And you sort of sit there and go, a, it is broken, that's why I wanna fix it. Mm-hmm. B even the parts that work don't work efficiently. So I like to fix that and see, most of the time these things happen, it's because people are not following those processes anyway because they don't work. They found workarounds, but people get so anchored onto the way it's done. So I think a lot of this stuff is change management and changing perceptions as opposed to providing linear solutions. And, and that part we've had pretty good results. I'll give you one user case um, probably, I dunno. Five years ago I spoke, I'll speak to you at a conference. There was a, an, an award-winning c e o of a medium sized local city council who spoke just before me. And it was a really good session. He, he spoke about what they did and it sounded good. They took us 31,000. They took all the jargon out. They built a paper-based tool for the older generation workforce who didn't want to do online reporting. They integrated all of the stuff into a system that did, uh, data analysis. It sounded so good. I actually went up to, after a shook, hiss hand, I was like, well done. You, you've, you've taken risk management and made it a living tool that works in a bureaucratic organization structure that didn't want it. About three days later, I got a phone call from his head of risk and strategy, and off the record, she said to me, uh, Marcio said, I should call you. Maybe you can help. We launched our new program a year ago and we've only had one person use it. So very interesting because what they built is awesome, but what. Happened in practice was quite different. So a lot. So with the consulting hat on, we went in, spent quite a bit of time with them, understood the stakeholders, understood what the drivers were. And fundamentally when we really got down to it, what it was was their c e o, who was a very dynamic leader, had a perception that risk management is something all his managers and leaders do. So why is there a separate function for it? And it caused him frustration and cognitive dissonance. He hadn't even come to the term, the realization of that. So what landed up happening is when they rolled out the new program, one of his better performing directors went, had a crack at it, and then went into the CEO's office and said, look what I've done expecting to be praised as being the first one. And instead the c E O ripped him apart saying, that's not right. This is not how it works. Which quickly faltered through the organization going, don't even touch this thing because you're gonna get in trouble. Right. So in the discussion we had,, there were about several other nudge factors and variables we'd, we put on the table. But one of them was, let's rebrand your program. Let's call it an e d m, an enhanced decision making program, because that part, the c e o 100% agreed with he, he was totally, for his people making better decisions. It honestly, it took the risk team a morning to go through all the material, all the documents, and change in the right places the term risk to e D m enhanced decision making. And, and the, the program had good uptake. So, long, short, long story, short story, it doesn't matter what we call these things, it's what, what's gonna make it work that counts. And then of course who's driving it, to perform well. Look, let's talk about driving performance here and looking at leadership and high performance. Big key area at the moment, especially in the uk, and I know that this is being mirrored in other northern hemisphere countries. I can't really speak for the southern hemisphere, but we know there's a lot of unhappy employees. We know there's a lot of tentative, we know the recruitment industry is bubbling. We know that there's a lot of people feeling disconnected to their employer. There's a lot of people, you know, feeling very like quiet. Quitting is is another subject being talked about at the moment. So how do you drive leadership and high performance in your, in your world when you've got generally quite a dissatisfied corporate workforce? How do you deal with that? So let's take three views to it. So the first view is, I'm gonna talk about what I do in my own business. The, the second view is I'm gonna talk about what we do with our clients. And the third view is where I'm gonna actually start the conversation, which is what we see out there in the market. Which is, um, well articulated by yourself in the way you explained sort of how people are feeling and the, the desperation is probably the wrong term. It's, it's more frustration, you know, it, it's, it's more, uh, lack of value. It's more lack of purpose that people are feeling. And the, and the perception then is if I just change jobs, I will feel like I have a purpose, I will feel valued and I can contribute more. So as a starting point, let's understand the human, so humans are driven, ironically, not by money alone, even though we think that that's the primary driver. There's a ton of research that shows money's a great motivator up until a neutral point. And that neutral point is usually just enough to have a, an okay line, right? I think in the US it was about 70,000 US a year as a salary there and thereabouts, probably gone up now with inflation. Um, so, I don't know, maybe 40,000 pounds a year would, would be a, a mark where, where anything above that actually can often lead to negative behavior, if that is the primary incentive. And we've seen that with research into, for example, banking executive. Um, Enron is a great example in the US where the organizations were chasing profit incentives, personal incentives based on financial performance, and did highly unethical things to achieve those because the incentive was greater than the ethical driver. So part of the challenge we've got, and for your listeners who are frustrated, we are in a very interesting stage of human evolution right now. We need to actually pause, stop, and understand where we are. Where we are is in a transition from, let's call a process centrism and business centrism, which was rarely designed in the first industrial revolution. And we are still operating on systems that are five to 700 years old and they were built on the premise that the system, the employer, the output is more important than the person. Yeah. So the system itself is in flux right now. Mm-hmm. And most of the leaders we have today, were trained on an idea that people are not as important as the system. Yep. People are cogs, you plug in and out and if you get fixated on people, it is a waste of time. And that's als It's not their fault because they were taught, like, I still remember when I did management training 25 years ago, we were taught plan, organized lead control. Right. The leading component was about 25% of it. If you, if you took them on a, an equal piece and arguably was the least discussed piece because it was more like, Hey, leadership is, pick your leadership style, tell people what to do, and you know, that's about it. Where we, where we are now is we are in an interesting state where some of the requirements that we have to do fall into the space of conventional management. So any of you are in a management position, you know, you still have to roster, coordinate, inspect, maintain things don't happen on their own. But we're also in a state now because we are hyper connected, because people can jump on the internet at any time and see what's happening to everyone else in the world. Because we are also primed and this, this part we need to really reflect on. We are primed on social media by the 1%, the people that have all the cash in the world live a, live a lavage lifestyle. And we, we see that all the time. So we start to believe that is the norm where it's really not, it's a, it's a misinterpretation. We also, every now and again hear about, you know, tho those of us who read business journals and business articles, we hear about these great case studies of business performance. And then we kind of go, I want to work there. I wanna work for people like that because they seem to have it nailed in reality. So I've been doing this for about 25 years. I've never seen an organization that does it perfectly, even my own, we put a ton of effort in, but it's always a work in progress. There's always something that can be done better, some stakeholder that has a better idea, something that's not working. Right. So starting point is, I would ask your listeners, those who are frustrated, those who are hating where they're at. I don't think in many cases changing jobs solves the problem because in a lot of cases you go from one dysfunctional workforce to another. Yeah. Which I think you and I have had a chat about before. Yeah. So part of, part of it is asking yourself your own intrinsic motivators. What is driving you? And you know that old saying like, the grass always looks greener on the other side because there's more. There and, and, and there's a lot of truth to that. Like we, we, we've, we very rarely have people leave our organization more often than not when they leave. It's by mutual agreement because we want them to either pursue something else, they wanna pursue something else, or to be honest, they don't fit. And most of the time that's a mutual discussion because, even people that don't fit in my organization, I want them to be successful. Yeah. We are just not the right fit. So step one is intrinsically what motivates you and how can you affect that within your own workforce? Step two is a question then for our leaders and the managers. And the, the question I'd I'd like us to ask is, what gives you leadership authority in the modern world? Historically it was title and it was number of reports, and it was the perception of power and accountability. In the modern world, what we found is sometimes the most influential people in organizations are not the people with hierarchy and title. They're the people that other people listen to. So this is the challenge we've got in a lot of these organizations. Um, it's not the fault of the, uh, aging boomers who most of them are at the top of the workforce now, and they're on the boards and they're in the executive structures.. It's really hard for them to actually understand what is happening in the world around us. I spend a lot of my time briefing boards and executive teams, and one of the jobs I feel I have is I'm a translator. I need to very diplomatically try and get them to realize and understand that. There's a challenge around the way the world works and the world has changed around them so quickly and uh, it gives us the opportunity to be able to do things differently. So part of what we've gotta do is we have to move away from this concept of blame allocation, cancel culture. it doesn't necessarily always work when we feel that we are right, that someone else is wrong. We have to understand. And it's very hard for a worker who's been treated poorly and is frustrated, feeling powerless to actually step back and take the view of, hold on a second. What is happening in the organization as a whole? Why is this occurring? But that's a good starting point. Understanding the self is a good starting point. Then we can look at the organization, our leaders. And in all fairness, we've just come out of covid, like we are still stuck in this covid hangover state for two years, give or take. We ProMED the world with fear. We told people not to leave their homes or they will kill other people. We put incredible pressure on leaders of organizations to try and pivot exceptionally quickly, motivate their people, keep the lights on. So a lot of our leaders and managers are exhausted, they're fatigued, and they're acting badly because of those pieces. So we actually need to have a little bit of empathy here. And I, I, as a business leader and a business owner, I've got about 255 people that work for us. We constantly deal with our staff not understanding what's going on at a leadership level because they don't care and they really don't, it's not their fault because their job is to do their job as well as they can. Not my job. But we need to cut each other some slack. And I think that's a good starting point when we understand where we are and we can empathize with each other. We then can start on a neutral platform to create change or drive change. So, long story, short story, I don't think stopping jobs is gonna make people more motivated. I don't think changing jobs is gonna make things more effective in terms of outputs or productivity, cuz we'll circle back to high performance shortly. So one of the things we've gotta look at, and I say this often to people that are trained, is, what influence can you have from where you are right now? What changes can you make from where you are right now before you leap to the conclusion that the position you're in is no good? And you have to go somewhere else. Look at what you could do to make where you are better. Try whatever you can. And if that doesn't work, then maybe legitimately you need to find another job. Like maybe where you're at is just too stuck, too rigid and you, you are not gonna be satisfied there. But if you have the perception that wherever you land is gonna be perfect, you're just gonna be disappointed again. Because we've got this weird intersection of, you know, outdated management practice with very poor leadership development. For a lot of our leaders, we've got this, uh, fatigue post covid. We've got this mindset of cost and disruption and anxiety permeating the business world. inflation and financial pressures sitting on top of all decision making. This is not an easy time for anybody. So the people are driving this then it's, you know, when you look at the old model about the, the sort of militant kind of seniority and structure within organizations, that's kind of fading out now, isn't it? You know, we don't call our bosses superiors anymore. That language is changing. And to your point around the influencers within business are the ones that people are listening to, is not just a natural style of leadership, but just phrased in a different way. Cool. So I know you and I had a little chat around Nature First Nurture and, you know, things like resilience or leadership or people just born with it or can they build it? and those are pretty robust debates in their own right, but, I think a few things. You know, there's, there's lots of leadership fads that come and go. You know, these ideas of, these ideas of, authentic leadership, servant leadership, um, they, they all have value, but ultimately people follow people. and, and this is the truth, like one of the things we, we keep forgetting is we want, we, you know, we are, we're in a world now of, uh, almost instant gratification. If I have a problem, I want it solved now. And it's, it's really interesting to see also the new entrance into our workforce. Our Gen Zs who are coming in and they're in for a horrible time because they've grown up in a world that literally was based around them, where instant gratification was what they grew up with, and the perception of what they do being important and having purpose is a driver for them. And unfortunately, the, the business world they're stepping into is not ready for that. But we are incrementally getting better. And I think this is the part that I, that often gives me comfort, particularly when I come across as we all do very poor decision making, very poor leadership behaviors, sometimes highly unethical behaviors, and people are just going, oh, whatever. That's the norm. it's not acceptable. But if you look only a few hundred years ago, we had slaves all over the place. The wealth was really held by a. You know, a certain class or classes, it wasn't equally shared. People had almost no agency to choose a job, choose a career, and, you know, live a fulfilled life. Our societies are getting better, but we are not there yet. So I think this is one of those pieces that often people get frustrated with and they go, ah, we want things to be right now. You know, one of the things I think we've gotta do is change the perception from not right now, how do we make it a bit better? What is my role as a catalyst there? And don't get me wrong, like I, I still have to make money for my stakeholders. But one of the things we often throw around in our business is this idea of make a dollar make a difference. It doesn't have to just be a binary decision of, oh, how badly can we fleece this client now, because that just destroys trust long term. It's really interesting too, like we work with a lot of government sector clients and government is finally the ho. this is the hardest for them. There's a natural distrust of the private sector. There's a natural distrust of people that are profit driven and the system itself supports that. Yet we keep talking about the need to drive, you know, multi-sector, private public partnership, get these collaborative initiatives going and most of them don't work, to be honest. They work with a limited efficacy because we haven't built that human to human connection. So let's go back to, sorry, I did segue there, but let's go back to the question you asked, which is around leadership, nature, verse nurture. We we're born with it. Yes. Yes. Cause, because look, you think we are born with resilience? All right, let, let's go. Absolutely. Some people have more natural attributes than others. Yes. And, and to and to and to say we're all equal. It's not true. Like, look at some of the best athletes in the world. Like they're all the most talented people in the world. Some people have gifts that others don't, and that would include aspects like resilience or leadership. And, and I'll give you an example, a personal example for me. Um, so I've been training martial arts since I was five years old, and along the journey, my perception of toughness has constantly changed. So in the beginning I thought, okay, you know, I got onto this Africa TaeKwonDo team, which was a, a full contact version of TaeKwonDo. I thought that was tough. Then I got to Israel and I started training with those guys and I was like, wow, that is tough. Like that is much, much tougher than I was used to before. Then I came back and I started working in close protection in, in South Africa, which is a high crime rate environment, and I looked at those guys and I was like, wow, you know, some of you guys can work for pretty much three days in a row with like two hours sleep a night and you can still perform. You know? That's tough. Then we started working with special forces units. And I was like, wow, now that is a different level of tough. Then I became a business owner and through my career some of the toughest things I've had to do was make staff redundant counsel, people that I care about or dismiss people who are good people but can't do the job they need to do. And I'd honestly say those are probably some of the toughest things I've had to do compared to, you know, working without sleep or doing an extra set of pushups or taking a punch or whatever else it is. So I think part of the challenge we have with this is yes, we, it's not a basis of fairness to say we all start with the same capability of leadership and resilience. Particularly resilience. You know, resilience is earned and we earn resilience through, you know, as fighters talk about, they talk about the school of hard knocks, you get experience because you get bashed. Mm-hmm. Laugh is like that too. But the challenge we've got now, and, and I'm just gonna talk about what I see in Australia a little bit more compared to what I see in other places. We've got a clashing of concepts. So our workplace health and safety legislation, rightfully so, is written around the protection of the worker here. We, we should not be creating environments that stimulate stress. We should be wrapping them in cotton wall and making life work. Virtual interactions as safe as conceivably possible is really the, the onus of it. But when we do that, we take away the resilience building componentry, and we actually take away the agency from the individual because we tell the individual, the company is gonna keep you safe. The company will protect your data. The company will do this, the company will do that, and if they don't, the government will punish them. So the government is responsible for that now, which those sort of regulatory models have been proven over and over and over again, not to work. Because one, they're not incentive driven. And two, for them to work, the consequences have to be so significant and the enforcement capability has to be so broad that nobody can get away with it. And where's the personal accountability for employees in that model? So you've nailed it. So this is the gap. RC is often missing. This is, this should be to, to get this working. It actually should be a partnership of individuals, teams, organizations, and government structures all aligned. But only a few years ago, just before covid, we lost a pretty big government tender for resilience, C, resilience, capacity development. And the reason we lost it, as we were told by the government client, was we set in our tender response that we would simulate stress so that the people we trained could apply the tools we taught them to manage that stress. And we literally got told there's no way they would give us a contract if we were gonna stress their people out. Cause they're already stressed. They've missed the point. They're talking, you're talking about tabletop exercises and you know, yeah, so, so we are stuck in a very weird place now where we've got competing priorities, right? Yeah. So building resilience in the modern world is much harder than it ever has been because we've got these competing priorities that are pulling and pushing us. Security's a great example because most of the time resilience comes from failure, right? Somebody's able to steal something. We then interrogate the process of what they did to be able to steal that. And a good security professional will then start plugging those vulnerabilities. They'll plug the holes and ideally they'll come up with solutions that transcend one type of attack or one type of vulnerability. But we are learning from hindsight. Then we also have the, the problem then of a reach and capacity, and this I think is something that risk and security people have to change their mindset. We will never have enough resources to secure our, our businesses, our clients, et cetera. We'll never have enough resources to analyze every risk. We've gotta move to a mindset of how do we become enablers that enable other stakeholders to do this as part of an ecosystem. That is hard. Why? Particularly now, and this is where the conversation started. People are tired, people are feeling undervalued, thus we are looking at people jumping off dis drugs. Yeah. Disinterested, disconnected, not committed, isolated. Sounds like you're in touch with how a lot of the workforce is feeling, at least in the uk. Yeah. Well, I. As, as you know, I'm coming there shortly, but, uh, I live in Australia. I have 10 months of the year where the weather is beautiful. So if I lived in the UK, I might also be a little bit more miserable around what's going on. Yeah, it's a good job. Didn't say that very top end of the podcast because people, you could just really turn people off, but get very, we're just going into our spring now, so we're, we're living in hopeful times. But, but to your point, this is one of the other variables that we seem to ignore that environmental factors play a huge role in how people feel and act. And to a large degree, organizations can control those environmental factors when staff are under their control. So let's look at that. We can control environmental factors when you're coming to work, uh, when you're in the office environment. We control, uh, and where you agree with the way we operate. Look at how we are working now. Most workers are Harvard. There's this mix of work from home, work from the office. Um, and it, it, it's not optimized. The very few organizations actually have that working in an effective way that works for the worker and works for the business. It's tough. So one of those pieces too is how do we feel connected to a workplace? How do we feel valued when those environmental factors are the same as the ones that you live around? Because you, you, you control your own environment when you work from home. And it's really tough because we would resent a work, a, a company telling us how to set up a home office. We'd resent a company telling us what we can and can't have on our desk at home. You know, what happens now? We resent having to get on the train and spend three hours a day commuting when we can use that three hours doing something else. So I couldn't agree with you more. And, and this is the interesting discussion. So my team is almost all virtual. Eh? I've got people who work for me across the world. I've got people who work for me across Australia, and it works in some ways incredibly well, and it works really badly in other ways. We, we found that we actually have to have at a minimum of two conferences a year where I bring everyone together, which is much harder now with the cost of international travel. And we're actually finding that some of our international staff, we actually can't afford to bring them in because airfares are so high at the moment. Yeah. So connectivity and linking people to purpose has never been tougher. Yeah. So, uh, so to your point, I think there's a few dynamics and we've gotta play a three level. So we do this on our Brazilians leadership and high performance training courses. Step one is me. If I can't, can't control the voice in my own head, if I can't modify my own behavior, if I can't drive my own enhanced decision making, and I still sit in a state where I'm blaming others for my decisions, you're never gonna get high performance. No, because intrinsic motivation has been proven to be a fundamental driver for sustained high performance. We keep looking for the in extrinsic motivation, am I gonna find a boss and a company that makes me feel good? If I earn that little bit more money, will I do better? Those are, those are, you know, don't get me wrong, that's a good motivating factor, particularly if you really need the money, but they're not enough to drive high performance. They're enough to get some performance. So this is the hard part. The next part then is around our middle management and supervisory level and the way we educate and train them to motivate and lead. So I've made our resilience, leadership, and high performance program mandatory for all of my leadership stakeholders. Anybody who's a supervisor and us and UP has to do it, or all my office staff have to do it, and voluntary for all my other staff members. I want them to do it. They don't have to pay. Because we've built operating models that now grow the capability for the individual. We want to grow our middle managers to be the best possible balance of leadership and management that they can be. And then we want to connect them to my executive so that we are, what, that the term we like to use is tactical. A combination of strategic and tactical, not one or the other like that. I'm gonna make a note that's tactical. I wish it was my term. I was actually giving a lecture to the u to the Australian, defense Force. And I had somebody from Army Intelligence come up to me when I had a slide up around strategic and tactical and understanding your abilities. And he said they're actually now starting to use the term tactical because they want people with both, they want people who could be strategic and tactical, which, which is actually what we need now. it's kind of funky. So long story, short story. Yes, it is hard. Will it continue to be hard? Life is hard if you view it that way, or life is incredible and there's a ton of opportunities for growth if you view it that way too. So it it does, you know, the glass is either half full or half empty, and that's up to you to decide which some of the most influential high performers I've seen in my career are people that have neither hierarchy nor status, but people follow them and they get stuff done. Yeah. I'm gonna, I'm gonna just, let's talk about you, for example, right? You're running a podcast that's influencing the way many, many people think and behave. Yet you don't have the title Chief Executive Officer, right? I, I hope people will pay you a lot of money to do what you do, but mm-hmm. That wasn't your driver in getting it started. No noise that your driver in continuing it. Correct. So, one of the things we have to do is change this mindset, uh, that, that people feel powerless. One of the best parts of the world we live in now is we are not powerless anymore. And if we just flashback a hundred years ago, legitimately, workers were powerless. They were cogs in a machine and they had no ability to drive the efficacy of their life. It's not like that anymore. So the piece are always drive back to, um, my stakeholders is, I'm like, what? I don't wanna hear you complaining unless you're coming to the table with what you are gonna do about it on your level of influence, then I will commit to you what I will do about it at my level of influence. And if we align our levels of influence, we should make things a bit better. It, it's not easy, don't get me wrong, like the start of leadership is really hard. It's exhausting and it's unappreciated, but it's a ton better than the command and control leadership style that we previously had, which works great in wartime, but doesn't work well for human motivation. I'm seeing a parallelism here between the British police force being called the British Police Force, and then moving over to being called the British Police Service because they're trying to remove that militant type of language. And we use this further language here in the UK as well around policing by consent. And it's that model that I think is now happening in the workplace in the sense that people consenting to be managed rather than before, like in the fifties and sixties and seventies and eighties and nineties even. You didn't consent to be managed. You were managed and that was not a consensual part. So that's, that seems to be a parallelism. A parallelism. I agree. And it's, it's another example of the way the world is changing around us. But you know, one, one of my behavioral scientists, Kate, she's brilliant. Um, Wacky, but that's what you want your behavioral scientist to be. She often, she often talks about culture and particularly an organization's culture. It's much like a fish swimming in water. The fish doesn't even know it's in water, and it doesn't even know that that water is sustaining it or that it's behaviors are driven by its environment because it's just the nature of where it's at. The only time it realizes when it's pulled out and gone breathe that it wants to go back. So the hard part we've got is things are changing around us, but it's hard to keep pace with that, and it's hard to recognize it. So one of the things I think is really important is for, is for people who feel frustrated to not lose hope and not get so frustrated and worn down. Why? It's never been easier to get professional education. It's never been easier to join associations or networks of like-minded people that can pull you up. You know, I, I know, uh, I F P O sponsors your podcast. You know, that's an association for security guards and practitioners. It's not asso, it's not an association for, you know, you have to be a CSO or CSO to join. Mm-hmm. So, and that's just one example. There's many more. So one of the things I'd be saying is you're not alone anymore. And the more alone you feel, the more you have to counter that narrative by bettering yourself and surrounding yourself by with people that will help to put you up. There's a whole part of neuroscience and the way the mind works where we are biased to be pulled down and it's so much easier to get pulled down and to stay down. But that goes back to the intrinsic motivation. I can't do that. Uh, I accept that it exists cuz I can see those traits in a lot of people in, in, in, it's mirrored in how they think and what they say. But I've never subscribed to that at all. I've always had the view of, you know, you shouldn't expect anyone else to pick you up. You have to pick yourself up because maybe one day there isn't anyone to do that. So, so half off of glory and success. But your point is, right, and this is an interesting piece, like my view of the UK has been as an outsider, but one of my mentors, uh, was an ex British Army major by the name of David Chop, who passed away. He was, a, a career soldier and was a prisoner war in the Korean War. And fascinating, wonderful guy. I learnt a lot from him. And then we had a business in the UK for a while, and I look at the UK through the IRA era. Yes. And, and it was a really good balance in the way the population were prepared, but not paranoid. Mm-hmm. Uh, alert and ready, but not disempowered. Yeah. And you know, I feel that over the last two or three decades, much like most other first world countries, That piece has been eroded. I even see it in Australia to a large degree. You know, you look back 50 to a hundred years, a Australians were the toughest people you'd ever find. Everything in Australia wants to kill you. You know, the environment wants to kill you, kill spider. Hundred percent. Yeah. But pre covid, we, we had 30 years of continuous economic growth. Yeah. Which is crazy. That means most people in the workforce, the first difficult thing they ever faced was Covid. Yeah. And don't get me wrong, like, uh, you know, covid Covid wasn't a fun time, but we weren't being asked to send our children to war to die. We were told we'd stay home and watch Netflix. Yeah. It's not that bad on the scale of what humans have had to sacrifice through hardship, yet it's broken a lot of our people because social cohesion is a big driver, but, Tell me, well, for some people, for some people there were a lot of naturally introverted people who were so glad they didn't have to lie to people anymore about why they didn't wanna go to for work event or the server or a meal, and they could just, you know, relax in, in just being alone where they wanna be. And I thrived in the Covid period because I found ways to, to combat the, other things that were bringing people down. And I found, and I still believe now that those extroverted people who really need social engagement were the ones that struggled the most because they felt very isolated. And it's almost 50 50. when you speak to people, you get a lot of people that say, oh my God, no, it was great. I was quite happy doing my own thing and helping the neighbors out and volunteering. And it meant I could go out when I wanted to. And it wasn't change of the house, then it was all on my terms. And then your other people who were just screaming because they couldn't be with people. And I think they struggled the most. So back to your point, one of the things humans love to do, and there's a psychological concept called chunking. We take, we take that little concept. Yeah, I think you Google it. Interesting. We take information that we are not familiar with and we find one little piece or two that is familiar to something we know, and then we go, oh, okay. It's exactly like that. Yeah. So one of the things we love doing is generalizing. So we go, oh, in general, COVID was terrible. Your point is right. It wasn't terrible for everybody. Mm. And the, the challenge we've got though is by definition, humans or social creatures. And we're actually wired to be in small tribes or small groups or small herds because that's what increased our historical likelihood of success. Okay, so one of the challenges we've actually got now in addition to all the other things we've discussed is let's talk about introverts and extroverts. So extroverts for, and, and, and there's the interesting piece in the middle, which is often referred to as an ambivert. You know, people who can live both. Right? Okay. Uh, or you've got people like, like me for example. I'm actually introverted by nature, but I'm a trained extrovert because I need to do that for my job tool set. Correct. You've got tools you use. Yeah, I'm the same. Correct. So without generalizing too much that we all have our own drivers. That's why I go back to that intrinsic motivation versus extrinsic motivation. When I know how my mind and brain work, I can find the things that motivate me, but we have to move away from the mindset of it's totally up to my job and my employer to give me all of that. Yeah. Having said that, there is a level of fairness where you are going. Hey, at the very least, meet me somewhere. You know? I don't want to come here and be pulled down to the point that I feel my life totally sucks, because why bother them? If you're trading a third of your day for money to do something for someone, wouldn't it be nicer to enjoy that time? Yeah. So I sort of say to my people, let's just be real though. There, there is no job in the world where a hundred percent of the time you're gonna go, this is the best thing I've ever done. The balance though, should at least be 60, 40, 60% of the time. You should be liking what you do, liking who you work with, and feel motivated by it. Yeah, and, and I'm always saying to my people, if that's dropping below that barometer, you better come talk to us because one, you're either gonna suffer some sort of mental health issue. Two, you're gonna be me dropping your outputs and work performance. So the plan and, and I don't like to lead to a conclusion to go, Hey, just because you're hating more than you're liking what you're doing means the job is not for you. Many times it's a per it, it's just a phase people are going through or a difficult client that they're working with or a challenge that they have to overcome and things will get better. So then it's internal support. So we've got a performance coach who works for us and is available for all my people to use. Um, we brought her on in Covid more for mental health support, but now she's switched over to being a performance coach and she's trying to drive performance for our people. Cool. We try, we try. Don't always work if we try it. Yeah. So the little things, isn't it really that make a difference? But you've nailed it. Yeah. Yeah. So this is the trick. We all want one universal brush that will sweep everything clean and we go, that'll make it right. It's not the world we live in. It's so complex. And I go back to complexity theory. It's actually a combination of many, many little things that lead to cumulative improvement. Same with changing culture in an organization. You can't do that in the modern world the way we used to do it, so the way we used to do it was somebody at the top says, this is gonna change issues and instruction. Everybody below changes or they get fired or penalized. That was the old way of doing it. Right Now, when that sort of command and control methodology runs up, what tends to happen is people go, I don't like that. You're making my life suck, so I'm not gonna follow that rule. Or, okay, I'm gonna do it, but I'm gonna whinge and complain about it behind your back. So I'm gonna put everybody down. Yeah. Or I'm not gonna do it. I'm gonna wait for you to penalize me. I'm gonna see how bad the penalty is. Before I decide whether I play this game or not. And we see this all the time, like with our risk consulting and security consulting pieces on software vendors are really, really good at selling stuff. So they'll sell a solution and they'll go, if you buy this governance risk compliance tool, this security risk assessment tool, this business continuity management platform, your life will be great. And I'm always saying to my clients, if your people are not happy and can't do it with a spreadsheet, what makes you think buying them an automated spreadsheet is gonna make life better for them? Yeah. And they spent millions of dollars on these risk theater. Things that don't get me wrong, if they use properly, will improve performance, but the uptake is so low that they don't actually make things better. So what we've gotta do is instead of looking at the top down model, we've actually gotta look at an integrated model where we build the change around our influences. And many of those influencers are sitting, scattered in different parts of the organization. So the first part is to, to identify them. Yeah. The second part is to harness them. Yeah. The third part is to educate and upskill them. Mm-hmm. Motivate them. And this is what we do when we do cultural change. We go, right, there's some skills. Everyone should have that. Many people don't. People should learn situational awareness. They should learn vigilance and mindfulness. They should learn critical thinking. They should learn decision making. They should learn effective and directive communication. And they should learn AC an action stroke review cycle so that they can self monitor and go, I did this, it didn't work, or I did this, it worked really well, and how do I feed that back into the system? So everyone should be trained on that stuff. We tend to call that stuff soft skills, and most organizations don't invest in it still because their mindset is stuck in the dark ages of, yeah. The process is more important than the people. So why would I invest in that? Yeah. It, it's, it doesn't work in a VUCA world anymore. We actually have to invest in these people and we also have to have the big view, and it's a hard view, but this is my take on it. I actually want every single person that my organizations touch to be better off for the interaction. So if you work for me and you decide you wanna move on, I am thrilled for you because it's time for your next evolution. And how can I support you in doing that? If you're a client, how do I make you better? If, if you're a partner, how do we make each other better? If it's our government clients and we struggle, honestly, we struggle so much to get our government clients to realize we are on their side and it's not in our interests to, to rip them off or to do the wrong thing because they won't use us anymore. It's in our interest. Yeah. Not defensive. Yeah. It's in our interest to build an ecosystem That's good for you. Good for us. Good for the greater good. Yeah. And it's tough, like the, the, it's honestly much easier to take the other route. But once we've trained everybody in those basic skillsets, and this is, we've recently done it for an organization, it took three years for us to do this process, we then take the influences and we teach them a higher level of influence, emotional intelligence, change methodology, and critical thinking and decision making. We actually don't teach them risk security or cyber in those terms, but if that's a requirement for the organization, those pieces then get bolted in. Mm. At the same time, we've gotta work with the executive teams on the boards because they still remember we're in this weird place. There's still a little bit of, you know, top down hierarchy and then Yeah. Yeah. And then a little bit of disruption, stroke, dissatisfaction in between. So we've gotta address both. I, I do have to say that some executive teams are incredible. But they don't know what to do cuz nobody's ever helped them. And to be honest, they feed off a lot of the traditional advisors they've had. So when I say traditional advisors, it's financial advisors and legal advisors, lawyers and accountants. They're, both of those vocations are linear vocations that are generally pretty black and white compared to, for example, security risk, cyber risk, mental health management, performance management, et cetera. And, and don't get me wrong too, like those, those people are important because if we're breaking the law, you wanna know about it. And if we are gonna not have any money in our business, you wouldn't wanna know about it. But they often have more authority and clout than the CEO themselves. They often have more authority, clout, and influence than a lot of the other stakeholders. And one of the things I'm seeing all the time now is chief security officers, chief risk officers who have got to the top of the career chain, yet are almost helpless because they don't have enough budget, they don't have enough influence, and they don't have enough trust with their stakeholders on those boards or those executive teams. It's changing, but it's changing very slowly. So we have to educate them, we have to empower them. And the bottom line with all this stuff is it's gotta be tied back to the organization's objectives. Because if it's not, what bother, and this is where the ethical piece comes in, that if you don't believe fundamentally in what your organization does, then, then you've got a problem working there. Yeah. But what blows my mind is how often we'll work with organizations that have an incredible purpose behind them. Let's take law enforcement or security as an example. Like what greater more noble function is there than to protect. Others. It, it's beautiful. Yeah. Yet undervalued, underappreciated, grudge. Spend not considered a vocation. I, I had a short stint as a, an expert witness and I, I started doing some of that stuff and eventually I was like, I don't wanna do this anymore, because I landed up in the witness box and it was, I wasn't arguing the merits of the case. It was arguing where the security itself is a vocation and a specialty or an industry. And I sort of sat there going, if that's what I'm being asked to argue about, I'm just not gonna play like I'm out. And, and it has been since the, since humans, you know Yeah. Started operating and started thriving. Yes. So, long story, short story with this stuff. There, there, we, we need to change the view from pessimism to a more balanced view. Don't get me wrong, blind optimism is dangerous. And just thinking everything is okay is very, very dangerous. Right? But converse, be falling into a trap where you go, this is terrible. It's never gonna be okay. There's no place I'm gonna find a job that's gonna satisfy me. You know that that's not gonna lead to any sort of performance. Ha, nevermind high performance, nor is it gonna lead to an individual's life being better. that's an awful lot there. Thank you so much. Really appreciate it. Awesome.