What do you wish security professionals would start/stop doing?

Start talking about what security enables an organsiation to do, rather than trying to stop the org from doing anything.

"We have a a CASB, this means we can allow access to tools you need to do your job"

"We have SASE, this means we can enable remote working with fewer controls"

and so on

STOP thinking about security as some kind of super exclusive club, where you need to have a kazillion certifications to even get started into a career. Most of it is common sense and can be learned by doing!

Stop spreading FUD (Fear, Uncertainty and Doubt) to get increases in budgets and head count (rather than using real metrics, historical quantifiable risk data and fact-based evidence).

Stop acting like they have a law enforcement background. Unless the security professionals have genuine experience at the CIA, FBI, or NSA it’s often a bit of an dog and pony show that turns off the audience. Be approachable rather than appearing knowledgeable.

I am absolutely passionate about both AI and cybersecurity, and the community. There's quite a few opportunities in terms of building a community around cybersecurity, where for the most part, things have been siloed and more so the enterprise-centric old way of doing things. Obviously, as you just catch up, the world keeps changing. With the amount of change that is happening, it's hard for everybody to stay up to date. So I have a few thoughts in terms of creating a community for incident responders. Like we have tried with threat intelligence. It was good, but that's not actionable. So when we talk about specific incidents and sharing that knowledge among peers, that is actionable, which makes more sense.