Security Confidential S8 E2 Ken Underhill

Manoj Tandon: Hello everyone and welcome to another episode of Dark Rhino Security’s Security Confidential. Today, we are honored to have Ken Underhill join us. Ken has his own show on cybersecurity, and he is a best-selling author. I’m hoping that I’ll get to talk a lot less, and he can take over as a talk show host here. Ken is the CEO, executive producer, and host of Cyber Life. He’s the best-selling author of Hack the Cybersecurity Interview, a complete interview preparation guide for jumpstarting your cybersecurity career. You might have seen him before on Forbes, Reader’s Digest, TechRepublic, Fox, NBC, Dark Reading, and several other places. He’s a well-known person; we’re honored to have a big name like him. Thanks for being here, Ken.

Ken Underhill: Yeah, thanks for having me. I really appreciate it.

Manoj Tandon: So, Ken, I gotta ask you: I looked a little bit at your background, and you obviously have a deep education in cybersecurity, but here you are doing a show. So, what gives?

Ken Underhill: Yeah, so back in the pre-COVID days—back in the ancient days—I had a podcast called Cyber Life. People wanted to basically stalk me when I went out to Black Hat in Vegas, and so I created the podcast just for that, to give my thoughts as I did the conference and stuff. And that blossomed into—probably about four or five months after that—I got an opportunity. Some people I knew were creating a media company and they said, “Hey, do you want your own TV show?”

And I’m big on “opportunity favors the bold,” so if an opportunity comes, I always say yes, even though I have no clue what I’m going to do. I had no clue what I wanted the show to be on, didn’t have a name for it, or anything; I just said yes. So they asked, “What do you want the name to be?” The only thing I could think of was Cyber Life, which was my podcast. Then they said, “What’s it about?” I said, “Cybersecurity,” and of course, we all know that could mean a million different things.

So the show was born. Because the pandemic and everything delayed production and all that stuff, it actually came out last year. I was with that other media company, and then I changed to a different media company around November or December of last year. And it just kaboom—it just exploded. Now I’m in over 20 media outlets globally—Amazon, Roku, all that stuff. A few million people a month watch the show across all those channels, so it just exploded from there.

And it’s really cool because, unlike social media and even podcast platforms, you’re really at the mercy of them. Tomorrow they can shut down and you have no options. Tomorrow they could say they don’t like one thing you said, and now you’re banned forever. Whereas with the TV show, I guess I can literally say whatever I want. I keep it G-rated, but I can say whatever I want on the show, and nobody cares. My guests can say whatever they want. That’s very impactful for people from disadvantaged backgrounds specifically—minority individuals or those from disadvantaged backgrounds where they can actually share their voice without a biased algorithm blocking them.

So for me, it’s very impactful for them to get out there, get their face out there, get their message out there, and get their wisdom out there. Then from there, there’s some little kid out there that’s going to see someone that looks just like them on TV and say, “Oh, what’s this cybersecurity stuff? I want to go down that path.” So that’s really the purpose behind the show as well.

Manoj Tandon: So have you given up on being a cybersecurity practitioner then, Ken?

Ken Underhill: No, I’m still doing it. Yeah, I still get in trouble. Cyber Life as a brand is a training company. So we do, of course, the B2B side, but also the consumer market. We have the Cyber Life School, where the vast majority of stuff being built is going to be free or low-cost, just because we don’t want economic barriers for anyone. I can share a story around that if you want.

Manoj Tandon: Please.

Ken Underhill: And then, under that umbrella, we also have the Cyber Life television show, which is the media division. The story behind the Cyber Life School—just one example—is that I had a course years ago on forensic stuff. People are always asking for free stuff. I’m sure if you own a company, you know people are like, “Oh, give me, give me, give me.”

People always reached out for the course for free. This one gentleman reached out from Bangladesh. He asked for it for free. At first I was like, “Forget you, come on, it’s ten dollars. It’s ten dollars for a course. That’s less than Starbucks.” But he’s Bangladeshi. And he was like, “No, that’s my average monthly salary.”

So I looked it up because I’m like, “Let’s do some fact-checking here, buddy, I don’t believe you.” But no, that’s true. And so I was like, “Oh crap, yeah, there’s people out there all over the world that cannot afford the things that we take for granted here in the United States.”

So I gave him a coupon to take it for free. I said, “Make me proud.” I heard nothing back. And I don’t look at students as they’re going through stuff; I don’t really monitor that because most people aren’t going to do anything from my experience. It was probably like six, maybe seven months later, I got a message from the guy, and he’s just like, “Oh, thank you.” He gave me all this praise, “Thank you so much, you changed my life.”

He was sharing how he took that course and was then able to get a job. In that job, he was able to work with some government agency over there. He was actually able to send his young daughters to school finally; he actually had the money to do so.

I started kind of at that point—you know, when you create courses or books or anything and people share their stories—you don’t, at least I didn’t, fully recognize or appreciate the bigger impact that type of stuff has when sharing your knowledge with the world. That’s where I realized it’s not just this one person getting a job; it’s more about the ripple effect. Now his daughters get educated; now they may have something—maybe they turn out to be a heart surgeon that figures out a new solution so that you can just click a button and magically all your atherosclerosis goes away. By the way, that doesn’t exist yet, so if you’re out there, cheeseburgers don’t count.

But it was really a moment for me to realize that there’s a huge ripple effect out there when you’re sharing your knowledge. Honestly, one thing I realized—I’ll share one other story real quick. I know we’ve got to be mindful because I tend to talk a lot. You were talking about staying in our limit; I’m like, we’re going to go for like eight hours here.

Manoj Tandon: Look, I talk a lot as well. Being somewhat of a podcast host goes with the territory. It’s great having somebody else on who can pick up for me so I can be quiet for a change and really listen. These stories always fascinate me; the story is the real deal. So please, another story.

Ken Underhill: All right, we’ll give you another story. I created a course years ago; it was a course on health and very, very basic stuff, like you should eat vegetables. Stuff that we kind of take for granted, like vitamins and minerals, amino acids, all this stuff. It was a very generic course and I put it out for free.

Of course, there’s hate mail. Anytime you create content, someone’s like, “You’re a jerk and you should die,” and “Kill yourself,” and all these loving messages from people on the internet. I kept getting a lot of the hate mail. I think it was a Sunday, if I recall correctly, or a Saturday. It was a weekend. I remember it was raining here—a thunderstorm. It’s almost like a novel, right? It’s a thunderstorm, it’s dark, and you hear spooky sounds. I don’t hear spooky sounds, but you get the idea.

I logged in because I was like, “Man, forget these people, screw them all. I’m not going to ever create something again. They can all just eat cheeseburgers and go to hell as far as I’m concerned.”

So I logged in and I’m seeing them—there’s like 60 or 70 just jerks, trolls. “Yeah, you burn in hell,” all these things. I’m like, “God, what…”

Manoj Tandon: That’s part of the territory, man.

Ken Underhill: No, it is. And that’s what you’ve got to realize, right? The more successful you are and the more people you help, the more a-holes are going to be out there. So I’m looking through all these messages, and I was just about to unpublish the course because I thought, “Forget it, I give up.”

There were still probably 20 more messages I had to go through. Something said, “Look at the next one. Look at that next message, just look at one more.” I was like, “All right, whatever, let’s see what this a-hole has to say.”

It actually turned out to be this guy named Miguel. I wish I remembered where he’s from because I would love to track him down. I don’t remember his last name or anything, but he sent me this message and he shared a story. He said that about six months prior, he was in the hospital and had a liver transplant. The doctors came in and said, “Look, your body’s rejecting it.” I think he was in Spain or Mexico, I can’t remember. But basically, “Your body’s rejecting the liver, and you’ve got about six months or less. You’re going to be dead,” so he had to get his affairs in order.

The thing is, his daughter was supposed to graduate high school in just about six months, and he wanted to see her walk across the stage. He went online searching, and I mean, God, there’s so much information online you’re just like, “Mind blown, I don’t know what to do.” So he got frustrated. He said he closed his laptop and just sat there and cried a little bit in the hospital. Then something in his gut said, “Just do one more search.”

And somehow he found my course. I didn’t do marketing or anything back then, so I don’t know how he found the course, but somehow he found it. He went through it. The way I teach things resonated with him, and more importantly, he actually took the information and did something with it instead of just sitting on his ass.

He shared that he got healthier. By eating healthier, the doctors were amazed because his body stopped rejecting the new liver. He was able to leave the hospital, and he sent me that message. It had to be a Sunday because normally they do graduations over the weekend here in the States. He sent me that message saying that the day before he was able to watch his daughter walk across the stage and graduate. He was just saying, “Thank you, thank you.”

I immediately forgot all about the trolls out there. We may have to blur out something.

Manoj Tandon: There are a lot of them out there.

Ken Underhill: Oh god, they’re everywhere. You could post a cute photo of a little puppy or cat and they’ll be like, “Burn in hell.” I’m like, “What’s that got to do with anything?” Like it or unlike it, but Miguel shared his story. It was just like a pivot in my mind where I just turned a switch, so to speak, and I blocked out all those haters.

They kept coming, yes, but every time I dealt with a hater, from that point moving forward when I put out a course, or later put out a podcast or video, I always thought about people like Miguel and their stories. I said, “Well, I don’t do it for the haters.” I could care less; you can all die tomorrow, I don’t care. It has no effect on me, I assure you.

But there’s a Miguel out there, or whomever you are out there, that needs that message, needs the information, and can only learn from me and not somebody else. That’s one thing I also realized, and why I shared the story of Miguel: we all have a gift. People oftentimes do things that we think are just regular, but other people think they are extraordinary.

It’s honestly a disservice to the world if you’re not willing to share that through whatever medium you’re comfortable with. It could be a video, it could be a podcast, it could be writing a book, could be blogs—it could be a million different ways. There are a lot of ways to share that, but I think it’s a huge disservice to the world because there’s someone out there that can literally only learn from you. They will never be able to learn that topic unless you teach them.

So I think that’s a message for the audience listening here: All of you listening right now, you have a gift. You think it’s something just regular; you don’t even think about it usually. But you can check with the people around you, like your loved ones and friends, and they’ll be like, “Oh yeah, you’re really good at…” whatever it is—maybe painting, gardening, cooking, or something like that. You take it for granted because it comes naturally to you, but it’s something that somebody else would really love to do. Again, they can only learn from you.

Let’s just use cooking as an example. Maybe you put a video out and throw it on YouTube. I don’t use TikTok, so you throw it on YouTube where somebody 20 years from now can still find the thing. They look at it and then they become a world-renowned chef because they watched your video at age 10. You never know what kind of impact that will have.

I’ll give an example with the book. I think we’ll talk about the book a little more later, but when we put the cover out before it even launched, I posted that on LinkedIn. This young woman said, “I finally feel like I belong. Because of this cover, I finally feel like I belong in cybersecurity, because I see someone like me on the cover of this book.”

Those things that we take for granted—for us, we just didn’t want the “hacker in the hoodie.”

Manoj Tandon: Not everyone’s a hacker in a hoodie.

Ken Underhill: Yes.

Manoj Tandon: Well, that’s the… I mean, 99.99999% of people think that’s who practices cybersecurity—a hacker in a hoodie.

Ken Underhill: Well, I’ve got my hoodie in the other room. I wanted to tone it down for this episode.

Manoj Tandon: But see, it strikes me that you actually have a real sense of purpose here, and you’re actually trying to make a meaningful difference. I think that gives a lot of meaning to what you’re doing, and that’s a wonderful thing.

Ken Underhill: Yeah, I’ll share another story and then we can move on. I’ll stop with the stories after this.

I grew up very, very poor—extreme poverty. There are actually a lot of people in cyber that had very similar backgrounds, whether they grew up in the city or in the country like I did. I grew up in a rundown trailer. You’d fall through the floor because it was all rotted; the roof was rotted so it would always leak and stuff like that.

Underneath the trailer, it was a very small space. When you first went under there, it was probably about two feet—maybe a foot and a half—high. As you got more towards the back of the trailer, where we had this addition built on, it got down to about a foot. The problem with that is there was a bunch of spiders under there. If you crawled under there, the spiders would think you’re prey, so they’d be dropping down on you.

What I would have to do in the wintertime is—we had this paper tube that ran from the one heating vent that worked in the living room area to this back bedroom where the kids slept. That was the only way we had heat in the winter; otherwise, we’d have frozen to death. What would happen is skunks would get under the trailer in the winter and tear open the tube because they were trying to get warm, too. Come on, right? They’d crawl under there and be in the tube.

So I’d have to go under there, crawl under there—and I was really small growing up. I’m still kind of a smaller, shorter guy, but growing up around this age, just picture a toddler-sized kid in your head crawling under this trailer with a flashlight that half the time didn’t work and a roll of duct tape. You’re crawling back in the darkness and you’re hoping, number one, the spiders don’t get you, because there are poisonous spiders dropping on you. You also hope that there’s no skunks in there or anything else, because sometimes I’d go in there and there’d be skunks and I’d have to try to scurry back out real quick and run for my life. I got sprayed a couple of times.

You’re crawling under there and trying to wrap this up with the duct tape to keep the heat in. I had to keep doing that over and over growing up. So when I actually create things, including the book, it’s in the essence of helping everybody, right? Yay, warm and fuzzy feeling. But in reality, I’m trying to help that little kid under the trailer.

I’m trying to give him… For example, the book. I actually was able to get it in the library I used to spend a lot of time in growing up. They’ll get it later this week; I shipped them a copy. What I want with that is for that little kid in a trailer, or in the hood in a city, that’s having a real crappy life right now, to pick up that book. I also got it in a community college locally here as well; I just got the email back from them today.

Manoj Tandon: Awesome.

Ken Underhill: But anyway, I want a kid to be able to pick up that book or watch a course or something of mine—probably pick up the book—and just believe in themselves. “Oh, I can do something different.” Because I had people who did that for me.

I’ll share another story and then we’ll move on. When I was in freshman year, I got called down to the principal’s office. I was a fighter growing up; I got into a lot of fights. So I was like, “Oh, what’d I do now?” You’re expecting the worst. I go down there and enter the principal’s office, and he says, “Sit down,” in an aggressive voice. I’m thinking, “Somebody ratted me out for something.”

So I sit down and he slides this piece of paper across his desk. I’m just like, “What’s this?” And he said, “One of your teachers recommended you for the Talented Scholarship.” I don’t know the official name of it now, but basically some teacher from fourth, fifth, or sixth grade recommended me for this scholarship program at the community college in the next town over.

Like I said, I was poor. I had no money for college; that was not even an option in my head. I was heading down the wrong track in life at that point. That was a huge moment for me because somebody believed in me, and it let me know that someone believed in me. I took it somewhat seriously. I was still a high schooler, so I was still partying and stuff, but I took it pretty seriously and focused. That was kind of the grounding factor there.

I’ll share one last story on that: I was partying a little too much, just “drinking water”—imagine that at your age. It’s crazy, it never happens. You’re just drinking water back then because it’s illegal for you to get alcohol.

Manoj Tandon: Sure, yeah.

Ken Underhill: I was partying too much, but I got called down to the counselor’s office during junior year. It was the first semester of junior year, right at the beginning. He sat me down—I don’t remember his name, gray-haired guy—and he said, “Look, you’re going to lose your scholarship if you don’t get your grades up.” I had below a 2.0 at that point, and you had to have a certain GPA to keep that scholarship.

During that first semester of junior year, I got my act together. I buckled down and I pulled off 4.0s throughout it and graduated with—I don’t think I got a 3.0, I think I hit like 2.9 and some change. Hey man, we’re rounding up. I got above the minimum; that’s all that matters. People think they need straight A’s; no you don’t, you need C’s to pass.

But sharing that is to say that somebody planted that seed way back then. With enough hard work and dedication—because you can’t just sit on the couch—that work got me to where I am now where I’m having this impact. When I create content, whether that’s video, books, or posts, that’s the impact I’m trying to have: that somebody will get a seed planted and they’ll go on to do something. It doesn’t have to be in cyber; it might just be being president. Who knows? We definitely need better presidents, so please.

Manoj Tandon: Well, that topic we could get into a lot of stories about. And if you want hate mail, we can definitely talk about that.

Ken Underhill: I’ll get it no matter what.

Manoj Tandon: Two questions on this—I want two secrets from you. One: you come across as a very positive human being. Given your background and how you’ve gotten to such a successful place, what was your secret to avoid being the victim—the “woe is me, bad things only happen to me”?

Ken Underhill: I was headed on the wrong path, and I think that for me, it was that scholarship. I had friends that were moving a lot of narcotics and stuff like that. In fact, one of my friend’s dads was in organized crime. One of the biggest things he actually said to me was very impactful. I learned to be very… I don’t like the word “humble” because I think that degrades how much work you’re putting into things if you actually look up the definition of it. But I think that what he said is the best way to say it. Basically: “Real gangsters move in silence.”

If you actually look at organized crime, that’s true. Real organized criminals are more business-minded. It’s a business; you’ve got to run the business. Sure, they’re doing nefarious things as part of the business, but they’re very quiet about what they’re doing, as opposed to someone on the street corner in front of the liquor store obviously slinging dope. You can spot them really easily.

Manoj Tandon: Oh yeah, it’s a dead giveaway. You can find the crackhead or the pot dealer.

Ken Underhill: Exactly. You don’t want to be that. To me, that’s a lesson for anyone. As you become more successful in your life and career, I think you need to—instead of using the word “humble,” because again, if you really dig into the definition of that, you would be downgrading your success. Words are very important. You shouldn’t do that, but you shouldn’t be out there throwing it in people’s faces constantly.

I think that quote is honestly the best advice I could ever share on how to deal with success: “Real gangsters move in silence.” Really just let your success speak for itself. You don’t have to go out there constantly—it’s okay to kind of plug things. Like I plugged the book; I’m like, “Oh look, we’re helping people,” or “We’re doing this or that.” I’m not trying to sell more copies of the book; I could care less. You’re not going to make trillions of dollars off a book. But I want to get the book into more hands, so maybe that’ll get someone to share the post. I think you just need to remember that phrase as you become more successful in your life and career.

Manoj Tandon: There’s a plethora of cybersecurity podcasts. In fact, it’s one of the topics out there that is very well-written about and talked about. But it seems like no one is listening. If they were, there is such good advice given—not just here, but by our colleagues who have great shows. You are one of the few who has captured the ear of the audience. What’s your secret on such a dry topic?

Ken Underhill: Yeah, you just relate it to things they actually care about at the end of the day. Not to knock anybody—there’s a lot of great podcasts with a lot of great information. I know a lot of people with them. There’s this place called Dark Rhino that has a really cool podcast as well. But I think the general public doesn’t care at all about security. They literally don’t.

But when you relate it to things they care about, that’s when you can get the message across. For example, nobody cares about a ransomware attack. The general public could care less. “I don’t care about ransomware.” And they don’t care about hackers. Let’s be real.

But when I say, “Hey, do you want someone to look at your little girl through the baby monitor?” No. “Do you want to protect against that?” Yeah. “How do I do that?” Oh, do these couple of things. You don’t need to dive into the theory. People get too technical. Make it as simple as possible.

A few people that I brought on my show, I made them explain a ransomware attack to a little kid. It’s interesting to see how everyone does it. But you’ve got to take whatever the topic is and break it down. For example, if you want to talk about “defense in depth,” nobody cares—except for technical people.

Manoj Tandon: I can agree with that experientially. Nobody gives a rat’s ass.

Ken Underhill: But you know what you do? You say, “Do you like Mexican food?” They say, “Yeah.” “Do you like tacos?” “Okay, cool.” “Do you like tortillas?” “Yeah, of course.” All right, great. Think of defense in depth this way: I have a taco and I want to add things to it because I want to make a really yummy taco. So I add avocados, spinach, meat, cheese, or salsa—whatever you like.

Manoj Tandon: I have not had lunch yet, so thanks for that.

Ken Underhill: Well, I knew that because I hacked your laptop earlier, and so that’s why I brought up the taco thing. But you layer it.

Another good example of defense in depth, which I actually have used in trainings before, is to think of it like your house. You and your neighbor have side-by-side houses with the same design. Both of you have really big-screen TVs, jewels, and money. You want to protect yours. Your neighbor has nothing to protect it. You have a fence, a dog, a security system, and cameras everywhere. Maybe you put landmines in your yard—I don’t know what you do. If you’re in Texas like me, maybe you do some weird things to protect your house.

Manoj Tandon: I don’t go to small towns in Texas for a reason, so I’ll just leave it at that.

Ken Underhill: But you have different things in place. When a bad guy comes and says, “I want to steal that TV,” they look at your place. It’s got a fence, dogs, and all this stuff. They look at your neighbor, where they can just walk in the front door because it’s unlocked. They’re going to go to them, right?

Manoj Tandon: It makes sense: the path of least resistance.

Ken Underhill: Criminals, as a general rule of thumb, are lazy—just like criminal hackers. They’re lazy. What’s the path of least resistance? Well, I can get Larry in accounting to click on something so I can get in, or I could try to do all these fancy hacks. I could just socially engineer Larry in accounting and get in every single time. That’s the way I’m going to go.

So you just have to relate anything you’re talking about regarding cyber to really get it across to people. First off, you need to figure out who the person is and what they’re interested in. That requires you to actually talk to them and listen a little. From there, you can find out what they like—maybe dogs or cats, or they travel a lot.

You could say, “Hey, when you’re out traveling, do you take a lot of photos to capture those memories to share?” “Oh yeah, I share them all the time on social media.” “Okay, well, what would happen if somebody attacked your phone and you couldn’t use it? Can you still take the photos?” “Well, yeah, I can.” “Okay, well then what happens next when they attack your social media accounts and they start posting random nude photos from porn videos instead of your vacation photos?”

Then it becomes something that people start caring about. At least people might listen then. You can’t control what they actually do, but at least they listen.

A good example is business owners. Unless they’re in the tech space, they don’t give a damn. They really don’t, because they’re worried about sales and marketing. “I’m trying to grow my business, I don’t care about this tech stuff.” But when their social media account is hacked because they didn’t enable two-factor authentication—I’ve had several reach out to me like, “What do I do?” Or they could have written a whole bunch of checks they shouldn’t have because somebody socially engineered them. Now it’s an interesting problem. Or your crypto account gets hacked, so the $80,000 you had in there you don’t have anymore.

These little things—when you relate it to examples that people actually care about in their everyday lives, that’s the secret. That is the secret to getting them to actually care.

Manoj Tandon: You’ve brought up in your answer several pitfalls regarding the impressions people have about cybersecurity and teaching. One observation is that if you can’t break down the topic into something that’s digestible—if you’ve forgotten what it’s like to be “blind”—you shouldn’t be teaching. You make too many assumptions about what people know and understand, and you should assume they understand nothing.

The second thing is the perceived technical nature of cybersecurity. People often think, “Well, that’s such a technical topic; it’s all about firewalls, routers, EDR, XDR, AI… I don’t know anything about that stuff.” Yeah, and that is unfortunately a myth. That causes a lot of dysfunction out there, but I’ll let you comment on this.

Ken Underhill: Yeah, I’ll comment on both of those. Number one, I’m checking off all those terms on my buzzword bingo card. I’m pretty close; I’m excited. I don’t know what I win—probably some ransomware.

Touching on the first thing you mentioned regarding teaching: When I create content, I’m always thinking… I have a grandmother—I won’t say her name—but she doesn’t touch the internet and she doesn’t do social media. She’s completely non-technical. If you could picture the old lady that people always think is non-technical, she’s it.

So when I teach anything, I build the content as if I’m talking to my grandma and I have to explain it. That forces me—if you know your stuff, you should be able to do this—to break it down. I don’t care what level you are as a practitioner; if you actually know the thing, you should be able to break it down for someone non-technical to understand it. Again, relate it to things from everyday life.

When I create content, I always focus on grammar. I’m fortunate that I have a grandmother who’s not technical. If your grandma’s a hacker, then just think of my grandma who’s totally non-technical. Figure out how you would explain it to her without any technical terms whatsoever. For me, she likes to cook and bake, so anything I wanted to teach, I would have to use that as an example for her to be able to understand it. Otherwise, she would just be like, “I don’t know what you’re talking about,” and ignore me. I don’t even think she watches a lot of TV, either; she’s totally electronically disengaged. “I don’t want to deal with any of that stuff.”

Cybersecurity itself… people hear a term like that and some people don’t even know what the hell “cyber” is. You say “cybersecurity,” and they’re like, “What is that?” You have to explain it to them in a way they would understand. If you start with some definition you found in a book, they’re going to be like a deer in the headlights—tuned out.

With cybersecurity, number one, you don’t need technical skills to get in. I’ll put this out there, and it’s probably going to piss a lot of people off, but I don’t think you need to have technical skills for your very first job. You need to have knowledge, regardless of what job you’re going into, but to get your very first entry-level cybersecurity job, you do not need to put your hands on a keyboard, in my opinion.

The reason I say this is because I speak with a lot of companies and hiring managers, and none of them give a damn that you’ve worked with Splunk or something, because they can train all of that. They just need you to have a general idea of what the hell is going on, and then they’ll take you and put you through paid training to get you the hands-on technical skills.

I think there’s a disconnect there because what you see on social media is… everybody that can’t get a damn cyber job is saying, “Let’s do a 100-day challenge.” What the hell is that supposed to do for you? Nothing. I get it, there’s some value there, whatever, but let’s be real: you need to focus on a couple of main things. Number one: your personal brand. Number two: your networking.

Figure out how you can network with the right people at the companies you’re looking at, not just the jobs you’re trying to find. At least 90% or more of cyber jobs are never advertised. They’re never going to be advertised; you get them because you’ve made a connection with someone.

Say you want to be a GRC analyst or privacy analyst. You tell Ken that you’re looking at that as a career. I see you working hard on LinkedIn, building your brand as you’re learning things, and sharing them to help other people. When someone is like, “Hey Ken, I’m looking for someone. We just came out of a meeting. I’m looking for someone entry-level who could jump into a GRC role, someone who’s willing to put in the work. We’ll train them.” Guess whose name I’m going to say? I’m going to say your name, because you come to mind.

You’ve shown that you built that real connection. You’ve shown that you’re someone I can stamp my brand on. I think there’s a big disconnect when people talk about networking. There are what they call “LinkedIn Open Networkers.” I forget what they are called. They’re master jackasses. Let’s call them MJ from now on: “Master Jackass.”

That’s the wrong way to network. You don’t just get a bunch of connections and say, “Please, give me, give me.” Build real relationships with people. That way, they feel comfortable stamping their brand on you. If I stamp my brand on you, that means I would feel comfortable hiring you.

That goes a long way for the person on the other side who has a job opening. They know I’m not going to send them a jackass just because someone connects with me on LinkedIn. They know I’m only going to send them someone who has been vetted. You can get vetted even if I’ve never met you in person by being that person who builds a personal brand, shows you know something, and gives back to the community.

To do all those things, you’ve got to work at it. That’s the four-letter word that blocks so many people: work. People think, “Oh, that’s a lot of work.” Of course it is. Do people really think that you or I just sit around eating bonbons all day long? I don’t even know if they have bonbons… I haven’t even had lunch and you got me thinking about tacos.

It takes a lot of work. It’s not going to be easy. Getting your first job is nothing compared to what you’re going to have to keep putting in. That’s why it’s important to build that muscle. When you’re starting out, build the muscle of: “I’m willing to put in the work.”

The other thing I’ll add on the job thing is: be open to not getting the job you want as your first job. What do I mean? There’s a ton of sales jobs, marketing jobs, and technical writing jobs. All these jobs that don’t have “cybersecurity” in the job title can get you into a company like Splunk. From there, guess what? You can move laterally throughout the company, just like a criminal hacker moves. Ironically, that is exactly what a cybersecurity professional is supposed to prevent: lateral movement. But you can do that at security companies.

So many people are so hell-bent on, “I’ve got to be a SOC analyst,” or “I want to be a pen tester.” They’re unemployed for two or three years when they could just take an SDR job and work the phones. Yeah, it sucks. Every first job sucks. I worked a lot of jobs that sucked. But you could get in and make maybe $60,000 to $80,000 base salary with some bonus structure here in the US. That’s not the point. The point is to get something on your resume.

If that company has other openings, like Splunk or Trend Micro, you can start moving laterally after about 6 to 12 months. They’re going to say, “Oh, well, you’re already vetted. You know the company culture. You work well with teams.” You’re much easier to hire for me as a hiring manager—even if you don’t have the experience—than it is to bring in someone more senior for that role. I’d rather train you up because you’re already here and we know you’re going to stay.

That’s a way you can get past people with experience, too. People just don’t realize that—or they realize it but don’t listen to me or others who say it on social media. That’s the fastest way to get a cyber job. The people who have listened and done that are usually getting jobs within two weeks.

Manoj Tandon: No, that’s real. It depends on the hiring process of the company, but I agree with you. It happens relatively quickly if you find the right person. What they don’t realize a lot of times is that you’re hiring for personality and for that fit within the organization. It’s just not the technical. Granted, I will say there are some roles where you do need the technical background. But at entry-level, you want the “good clay.”

Ken Underhill: Exactly. You want people with two main things: the right attitude and the right aptitude. Are you going to fit in with the company, or are you a “Negative Nancy”? Are you going to be a jerk and poison the rest of the team? It only takes one bad apple.

And do you have the right aptitude? By that, I mean: are you trainable? Or do you think you know everything already? If you’re trainable and can fit into diverse teams, then I can train you in everything. I can literally train someone non-technical in anything technical. It might take them a little longer, but if I as a hiring manager get the right mold, I can mold that into someone really great within a short period of time—three to six months in many cases.

Manoj Tandon: I think when we hear the term “cybersecurity,” we immediately think “technical” and we run like hell away from it. It’s a mental roadblock for a lot of people trying to transition out of whatever they are doing now. “I’m no good with computers. I never code. I’m not a computer science guy.” You hear a huge laundry list of excuses. But you’re absolutely right: if you’re willing to put the work in and you have a vision, you can absolutely get into this industry. It’s a young industry; there are a lot more jobs than there are people. It can be done.

So, let’s say you’ve established your brand and done the work. How do you “hack” the interview itself? You actually wrote a book on this topic.

Ken Underhill: Yeah, the book is Hack the Cybersecurity Interview. Shameless plug again.

Manoj Tandon: Where can we find it?

Ken Underhill: You can find it at any of the local book sellers, online at Amazon, Barnes & Noble, and stuff like that. There are also a number of public libraries here in the US, and also college and university libraries that have started to put orders in.

I will say that if you go to your local public library, just tell them to buy the book. If they say they don’t have it, ask, “Are you going to buy it?” That way, they can put an order in. If you don’t want to buy the book, you can make the company invest in you. Even if it’s a public library, they have a budget they have to use.

The book itself goes over a number of different roles that a lot of people are looking at, including Sales Engineering. A lot of people don’t look at that, but I mentioned that it’s a good route.

Manoj Tandon: That’s a very important role, by the way.

Ken Underhill: And you can make a lot of money at that. The other thing it does is it forces you to work with people. Especially in an SDR role, you’re going to be dialing the phone a lot, so you’re going to hear all sorts of excuses and objections. Guess what? That may suck while you’re going through it, but that’s going to help you as you grow in your career and start having to go before the board to get more budget for your cyber team.

Now you know how to negotiate. You’re used to objections and overcoming them in a professional manner, instead of just saying “F you” and hanging up the phone. You know how to address those different individuals and the things they care about. Sales roles are so underestimated. Learning sales can help you in so many different cyber roles, no matter where you go. It’s a great foundation, same with marketing.

If you learn the fundamentals of marketing, you can literally get into any company you want, even without experience, because you know how to market yourself appropriately for the job. These are fundamental skills people overlook because they think, “I want to be a SOC analyst,” or “I want to be a pen tester, I gotta hack things.”

People don’t understand how hard it is to get a junior pen tester role with no IT background whatsoever. You really have to have someone willing to take a chance on you, which goes back to branding and networking. It’s very rare for that to happen. People may get mad at that, but it’s very rare.

Being in the “top 1%” on TryHackMe… Honestly, for real hiring managers, people will lie to you on social media. People will say, “Oh yeah, TryHackMe top 1% is the key, I only hire people with that.” Those people don’t hire anybody. They’re not hiring managers; they’re other people trying to get a job. They don’t know anything about getting a job because they’re trying to get one too.

Manoj Tandon: You’re going to get so much hate mail; this is going to be great.

Ken Underhill: I don’t care. I was a guest on the Cybersecurity Marketing Society’s podcast a while back—I think it was in July. I talked about my “block party.” I’ve had a block party going on for years on social media. I’m happy to add anybody that wants to hate; I put you on the block party. I don’t know what music’s playing there—that’s still up for debate—but you get an invite right away. Happy to send you there, and you never have to worry about hearing from me again.

Manoj Tandon: It’s refreshing to hear somebody say what all of us have known for quite some time. What you’re speaking is the truth.

Ken Underhill: It’s not because we’re trying to be jerks; we’re trying to tell you the real deal. We’re trying to pull you aside like a parent or a good friend and say, “Look, you’re being lied to.” A lot of companies want to make money off you for certifications, degrees, or boot camps. There are a lot of great programs out there, I’m not knocking them, but let’s be real: a lot of people are broke. They’re trying to get into cyber because they want a job that pays well. Reality is, “feeling good” doesn’t pay the bills. Cyber can be very lucrative.

We’re all just trying to tell you how it really is so we can set you up for success. Some people are going to hate, some are not going to listen. But maybe somebody a year from now who said “F you” when they first heard this episode will be in a different spot mentally and say, “You know what? That was good advice, let me try that.” All of a sudden, they get their dream job because they finally listened.

I’ve had situations like that—not cyber stuff, but books I’ve bought. I buy the book, read one page, and think, “This sucks,” and set it on the shelf. Two years later, I’m looking for an answer and I see that book. I look at it and think, “Oh, there’s the answer I was looking for. What a great book.”

Understand that you may be hating on what we’re saying right now, but a few years from now, you may realize that was some really good advice because now you’re in a different mindset. That’s why I don’t care about the hating. If at some point in the future this helps you, that’s all any of us care about.

Manoj Tandon: Do you have an opinion on pursuing a cybersecurity career versus doing something else? Is there any bias you have towards cybersecurity as a new career to reinvent yourself?

Ken Underhill: The fastest way to make cash is to sell drugs, but that’s illegal, so you’ll go to jail. Cybersecurity can be lucrative. I always recommend people do an IT job first if possible. You may not be in a situation where you can take a lower-paying job, but I recommend it if you can. Specifically networking. I think that’s number one. I like it, so I’m a little biased, but it gives you good exposure to an organization.

Just about every job in the world has some kind of cyber component. I used to be a pediatric nurse. To make everyone listening say “Aww,” I worked with very little babies who were very critical. A lot of times they would “code”—basically they stop breathing—and you have to bring them back. I worked in the home environment, so you’re the first responder. You’ve got to keep your skill sets up.

It was a very rewarding job. Some kids make it, and unfortunately, some don’t. When I went back into IT and then “cyber”—because “cybersecurity” is a sexy term—I would teach security awareness to healthcare staff. I was able to relate it to what they cared about.

I pulled real examples. For example, “When you’re charting on a patient and you have to get away from the computer, you normally lock the computer so nobody else looks at the screen.” Some of them were just leaving the screen up. “The reason you want to do that is because of HIPAA and other regulations. If an auditor comes in and sees that screen up with nobody around, you’re getting in trouble. You may lose your license. If you lose your license, you can’t pay your bills. Do you like vacations? You wouldn’t have money for them.”

If you’re looking at cybersecurity as a career and wondering how your transferable skills translate, I’ll give you examples. As a nurse, you’re following a process. If you do a blood draw or put an IV in, you’re following a process and maintaining patient safety. These are things you should put on your resume because those are keywords. They can follow a process; they maintain safety. If they can do that for a patient, they can do it for critical data or services.

Same thing with someone working at a grocery store stocking shelves. You’re following a process to stock shelves and label things. A lot of jobs out there have transferable skills. You just have to figure out what those things are that lead into cyber.

That was a long-winded way to say that I think you have to do what makes you happy. We have a number of companies; one of them is a credit repair business. I found that I like credit stuff. I like the knowledge of it because I didn’t have that financial education growing up.

You have to explore things that interest you. If that’s cyber, cool. If you’re just getting into it because media outlets say there are millions of jobs paying multi-six figures, that’s the wrong reason. Explore with free and low-cost learning first. See if it even interests you. If it doesn’t, put it aside.

Find something that interests you because there’s a lot of burnout and stress in this industry. There are instances where geopolitics gets mixed into private sector cybersecurity. You may find yourself with a hit team after you while you’re just trying to do your job. These are rare cases, but they cause stress.

I’m not saying that to scare anyone, but you should do what makes you happy. You don’t know if tomorrow you’re going to get hit by a bus. If you’re trying a lot of different cyber areas and nothing’s clicking, find something that clicks for you. Maybe that’s knitting sweaters, and that’s okay. Maybe for the next six months you put out courses on how to knit sweaters and make millions. Then you might come back to cyber and decide you really like forensics. Do what you love.

Manoj Tandon: You just mentioned forensics. You’ve done so many interviews; your channel has an eclectic mix. Of all the advice you’ve been given, can you boil it down to some salient things companies should be doing that actually make them safer and mitigate their risk?

Ken Underhill: There’s no one thing. Most companies do their best effort. When people look from the outside at a data breach, they think, “Ah, kill them.” People don’t realize how complex things are. They say, “Just secure your S3 buckets,” but there are like 400,000 of them. There are going to be mistakes made, even with automation.

If you’re getting in, talk to two ends: on the company side, there’s a lot of best practice information out there. There are good podcasts, like The Cyber Wire or Dark Rhino. Learn from people with “boots on the ground.” Cloud Security Podcast is a good one; he’s a phenomenal guy who always dresses well. Depending on the problem you’re trying to solve, find podcasts with that information.

If you’re trying to get into this, immerse yourself in podcasts and learn from people who have been there already. Companies are already doing a lot of these things using frameworks. Whether you’re currently in the field or trying to get your first job, there’s a good book called The CISO Evolution. It’s a great book on how you can communicate cyber stuff to the business side.

At the end of the day, a business is a business, and cyber is just one minute component of the risk. If you’re able to communicate how this affects the broader organization, that’s going to help your career. That book also breaks down financial things. A lot of people suck at finances.

If it’s in your budget, take a course on Udemy for financial analyst training. Learn the money of business. If you speak the language of money, that’s going to help you so much. Wishlist the course and wait for a sale; they usually run sales on Mondays for $10. If you learn about money, that’s what the business understands.

I understood money because I kept learning about it, and that’s how I jumped into executive leadership very quickly while others spend 20 years trying to get a mid-level manager job. If you’re just starting out, put the technical stuff aside for a couple of weeks. Read The CISO Evolution or take a financial analysis course. Learn how things work—financial statements and projections. Then come back to your technical studies. Getting a junior pen testing job is going to take you more than a couple of weeks anyway. Invest that time wisely.

Manoj Tandon: Ken, you’re providing actionable intelligence, which is very rare in cybersecurity.

Ken Underhill: [Laughter]

Manoj Tandon: We’re at time here, but I wanted to see if there was anything new you’re up to. Are there any new shows you’re producing? Anything you want to plug?

Ken Underhill: Yeah, we’ve been shamelessly plugging the book: Hack the Cybersecurity Interview. We have more TV show episodes coming out. Meryl Vernon, a well-known purple teamer, will have an episode.

Manoj Tandon: She used to work for us!

Ken Underhill: Oh nice!

Manoj Tandon: She’s fantastic.

Ken Underhill: Mike Jones—not the rapper—will also have an episode. I brought Joe Stymack back on. He’s the CEO of AcuHire.com and has helped build interview programs at big companies like Bank of America. He’s going to share what hiring managers and HR people should be doing to fix biased hiring processes.

I also interviewed a gentleman named Carl who does background checks; he’s going to share some interesting stories. Veronica Rose, an auditor in Kenya who is very well-known in Africa, will be on. If you want to be on the show and have something to share, reach out. I have a strict “no jerk” rule. If you’re a jerk, it’s not a good fit.

We also have sponsorship opportunities. I created the TV show to give people in cyber a platform to share their story. People are looking at these careers saying, “I can’t do that because of X.” In reality, someone else has already overcome that challenge. I recommend the episode with Chip Harris. It’s neat to talk to someone in that outfit—I’ll just leave it at that.

I’ve had great guests like Chris Roberts, Zead Savy, Mary Galloway, Tia Hopkins, Renee Small, and Chris Kubecka. Chris lives in Europe and has so many interesting stories. I’ve been fortunate to bring these guests on and am always looking for more. Again, if you’re not a jerk, I’m happy to bring you on.

Manoj Tandon: You’re doing great work, Ken. It’s meaningful. Thank you and keep it up.

Ken Underhill: Thanks for having me on the show. I appreciate it.

Manoj Tandon: It’s been a pleasure, Ken. Hope to have you back sometime.