Security Confidential S6 E8 Eddie Thomason

Manoj Tandon:
Hello everyone, I’m your host Manoj Tandon with another episode of Dark Rhino Security’s Security Confidential. Today we have a great guest joining us, and I’m honored to have him. He’s another podcast host in the cybersecurity space—Eddie Thomason. Eddie has an impressive background: he’s a Regional Sales Manager at DataLocker, a best-selling author, and has been featured on ABC, CBS, and FOX. He’s worked with multiple Fortune 500 companies to improve revenue and was named one of the top business professionals by the Chamber of Commerce. Eddie also hosts the Simply Secure Podcast, where he covers all things cybersecurity—I encourage you to check it out; we’ll include the link. And when he’s not working in cyber, he’s building cutting boards and furniture through his passion project, ET Woodworks. Welcome to the show, Eddie.

Eddie Thomason:
Happy to be here, Manoj. I feel like you hyped me up a lot, so hopefully I don’t disappoint the audience.

Manoj Tandon:
It’s a privilege to have you here. And to our listeners—before we started, I had a list of questions ready, but I’m tossing that out a bit. Eddie and I share some common ground—we both started cybersecurity podcasts from a place where, let’s say, there was a bit of a knowledge gap at the beginning. That journey and the “why” behind both of our shows really align. So today, I want to take a different angle—get to know Eddie better and pull out practical insights. If you’re a CISO looking for deep technical content, this might be lighter on that. But if you want actionable knowledge and perspective, this is the episode for you.

Eddie Thomason:
I’ll add to that—CISOs aren’t always as deeply technical as people assume. Conversations like this help develop the leadership side: how to manage teams, communicate in boardrooms, and translate technical needs into business terms. A lot of CISOs understand technology conceptually, but their teams handle the deep technical execution. Their role is ensuring business needs are met, and that’s where conversations like this really matter.

Manoj Tandon:
That’s a great point. Now, you’re a sales professional, and I’ve spent over 20 years in sales myself. How do you establish credibility with CISOs or CIOs, especially when they might assume you’re just trying to sell them something? How do you become a trusted advisor instead?

Eddie Thomason:
That’s a fantastic question. From my experience, CISOs and IT leaders tend to be very grounded, “salt of the earth” people. So I don’t approach them with a pitch right away. I focus on adding value first—joining conversations in LinkedIn groups, engaging in discussions, and sharing insights without trying to sell anything. If someone asks about encrypted drives or USB management, I just contribute what I know. That’s how relationships start. Then, instead of pitching, I stay curious—ask about their career, their challenges, what keeps them up at night. That’s actually how my podcast started. I had zero cybersecurity background, so I used it as a way to learn. Most people are open to sharing knowledge, and that exchange of value builds real relationships. Honestly, most people I’ve connected with, I’ve never even pitched DataLocker to—it’s about building genuine connections.

Manoj Tandon:
That’s straight out of How to Win Friends and Influence People. People love to talk about themselves and share knowledge. And you’re creating value on both sides instead of just handing them a brochure.

Eddie Thomason:
Exactly. And here’s something I’ve learned: even if you have the perfect solution, if you approach someone the wrong way, they’ll ignore you. Fear-based selling—FUD, fear, uncertainty, and doubt—is common in cybersecurity, but people hate it. They want a trusted advisor, not someone trying to scare them into buying something.

Manoj Tandon:
You mentioned something interesting—you keep a list of other companies to refer clients to if your solution isn’t the right fit. Has that ever caused issues for you?

Eddie Thomason:
Not at all. It reinforces trust. If all you ever offer is your own product, you’re not really a trusted advisor—you’re just trying to fit everyone into your solution. I prefer to build relationships and make warm introductions when something else is a better fit. Plus, DataLocker is very niche—we focus specifically on encrypted USBs and their management—so there’s little overlap with broader security tools. It’s really just about creating value.

Manoj Tandon:
Let’s shift to small and mid-sized businesses. There’s so much noise—tools, technologies, frameworks. How should they navigate cybersecurity when everything seems focused on technology?

Eddie Thomason:
If you’re a small business, you need help. It’s rare to have a dedicated security professional in-house. You might have an IT person handling security, but that’s not the same. So I recommend working with an MSP or MSSP—but not just any provider. Find one that takes time to understand your business, not one that pushes a one-size-fits-all solution. The best providers will talk to different departments—finance, marketing, operations—to understand how technology is actually used and what impact changes will have. That upfront work may take time, but it ensures the solution fits your business instead of disrupting it.

Manoj Tandon:
What are some simple questions business leaders can ask to evaluate an MSSP?

Eddie Thomason:
First, ask whether their solutions are proprietary or built from best-in-class tools. You want to know if they’re selling a rigid package or leveraging proven technologies. Second, ask about availability—how quickly can you reach them during an incident? And third, ask for references. Talk to their clients. If they weren’t responsive during something like Log4j, that’s critical to know.

Manoj Tandon:
Let’s talk about friction—between cybersecurity and the business, or cybersecurity and IT leadership. How do you reduce that?

Eddie Thomason:
It almost always comes down to communication. Most friction happens because someone is misinformed—either security doesn’t understand business needs, or leadership doesn’t understand security risks. As a CISO, you have to understand the entire business and communicate in terms people understand. If you talk in technical jargon, you lose your audience. But if you connect security to business outcomes, you reduce friction and gain support.

Manoj Tandon:
That word you used—context—is key. People don’t resist security because they don’t care; they resist it because they don’t understand how it impacts them.

Eddie Thomason:
Exactly. And that ties into risk appetite. You need to understand what level of risk leadership is willing to accept. Some organizations just want compliance, but compliance doesn’t equal security. As a security leader, you need to identify risks, communicate them clearly, and document everything. Then leadership can make informed decisions.

Manoj Tandon:
That’s where it gets tough—those are hard conversations, especially in smaller organizations.

Eddie Thomason:
They are. But at the end of the day, it comes down to values. For me, decisions are grounded in my values—faith, family, and business. If I’m in a situation where those are compromised, I’m willing to walk away. I won’t sacrifice my values just to make an organization comfortable.

Manoj Tandon:
That’s a perspective not everyone takes, but it’s hard to argue with. Let me ask—what are some of the biggest mistakes you’ve seen security teams make?

Eddie Thomason:
The biggest one is lack of communication and engagement. Many employees see security teams as blockers, not enablers. And often, they’ve never even interacted with them. That’s a problem. I heard a great example—new security hires were required to meet with 30 people outside their team to understand how the business operates. That’s brilliant. Security is a business function, not just an IT function, and everyone in the organization plays a role in it.

Manoj Tandon:
If people understand the “why,” resistance drops significantly.

Eddie Thomason:
Exactly. Security needs to be an ongoing conversation, not just an annual phishing test. Education and communication need to be continuous.

Manoj Tandon:
Let’s talk about career transitions. If someone is in a completely different field and wants to move into cybersecurity, what should they do?

Eddie Thomason:
Start with your network—find people you already know in cybersecurity and learn from them. Then identify your “why”—why do you want to enter the field? That will guide your path. You don’t necessarily need certifications right away. Start by exploring tools and gaining hands-on experience. And most importantly, practice. Cybersecurity interviews are very hands-on, and your ability to demonstrate knowledge matters. Also, your background is valuable—different perspectives strengthen security teams. What matters most is curiosity, persistence, and the drive to solve problems.

Manoj Tandon:
I’d add—motivation can outweigh pure technical skill.

Eddie Thomason:
Absolutely. That drive to figure things out—that’s what teams really want. That’s the “it factor” you can’t teach.

Manoj Tandon:
Let’s circle back to USBs. They’ve been involved in major breaches—how do you secure them?

Eddie Thomason:
It’s a two-part approach. First, standardize the type of USB devices allowed in your environment. Second, implement strong device control—like a DLP solution—to ensure only approved devices can be used. At DataLocker, we focus specifically on encrypted USBs with centralized management. That allows you to track usage, control access, and even remotely disable devices if they’re lost or compromised. USBs aren’t going away, so instead of banning them outright—which creates operational issues—you need to control and manage them effectively.

Manoj Tandon:
That’s practical. Before we wrap up, anything you’d like to share?

Eddie Thomason:
I’d point people to the Simply Secure Podcast. I started it as a way to learn, but it’s grown into a platform where people at all levels—whether you’re new, experienced, or moving into leadership—can gain value from different perspectives. I encourage everyone to check it out, and I always welcome feedback—it helps me improve.

Manoj Tandon:
With that, we’ll wrap up this episode. Eddie, thank you for joining us—it’s been a great conversation.

Eddie Thomason:
Thank you for having me. I appreciate it.

Manoj Tandon:
Thanks everyone for listening. We’ll see you next time.