What Actually Stuck After Four Days in Vegas

I’m writing this during my connection at SEA, waiting on a flight out after four days at BSides and Black Hat. I’m still processing, and honestly I’m not sure all of it will resolve before I get home to an air quality warning and a heat advisory. But a few things, mostly from day three, stuck hard enough that I need to get them down before they blur into the general haze of a week in Vegas.

Starting Before The Conference

An intake recruiter had connected me with a cybersecurity vendor whose hiring manager was somewhere on the Black Hat floor, but our schedules never aligned for an in-person meeting. The call went well; there’s potential to reconnect with ISAC organizations and lead original threat research, which is the kind of work that makes you lean forward. It was a good reminder that the conference isn’t just about what happens in sessions; sometimes, it takes a follow-up call or two.

Mentorship Pays Forward

Sam Pizzey gave the last BSides Proving Ground talk of the conference on extracting zero days from large language models cost-efficiently. The room was nearly full, the talk was livestreamed back to his parents in the UK, and he nailed it for a first-time speaker. My only note was more audience engagement next time, which is a minor tweak. Throughout the week I’ve received unsolicited thank-you emails from people I worked with at the Monday Proving Grounds rehearsals, which caught me off guard in the best way. And later at Black Hat, Gianna Whitver insisted on introducing me as a famous person, when to me, she’s the one who earned that. Showing up for people in this community has a return I didn’t expect when I started doing it.

The Job Market Reality Nobody Wants To Admit

Lunch was with Alexandre Sieira and Adrian Sanabria (Adrian’s presentation from day two was excellent, for the record). Then a consensus, first at the CISO Society VIP Reception and carrying over to CVision afterward:

A recruiter confirmed the CISO market is hard right now and return-to-office mandates are making it worse
Ira Winkler and Larry Whiteside Jr. both said the CISO market is tremendously difficult
A series B startup was growing their team ahead of another raise, a useful counterpoint. Opportunity exists; it’s just narrower than it was
At CVision afterward, Sue Bergamo and I compared notes, and she pushed me toward IC roles, which tracks with what I’m already thinking

I enjoy vCISO work and I like helping companies make their cybersecurity marketing not suck. But I’d love to be associated with a single brand, whether that’s as a field CISO, a manager or director, or an individual contributor. I feel like I have a lot left to give to the right organization.

Our Industry Still Can’t Talk Money

Here’s what kept surfacing all day across different venues and groups of people: we can’t translate technical risk into financial terms. At the CISO Society reception, multiple CISOs were genuinely surprised to learn the widely repeated statistic that 60% of breached companies go out of business is false. I covered that in detail based on Adrian’s talk on day two. Independently, people suggested I turn my book’s material into a course or mastermind for CISOs struggling to communicate cyber risk to business leaders.

At CVision the pattern held up again:

AI companies pitching agentic guardrails couldn’t explain their value in anything beyond vague technical jargon, and they’re still getting funded
A Section 508 accessibility firm flagged AI as a persistent accessibility challenge, which is a conversation worth following up on
A Portswigger SE talked through selling continuous software development controls to buyers expecting it to be free and frictionless

Companies that aren’t able to communicate their business value or that keep insisting cyber risk is a thing are in for a bad time next fiscal year.

Vendors Who Got It Right And Wrong

Alexandre’s TPRM play with a vendor analysis tool is unique in the market and focused on Latin America. Even though his English newsletter and podcast drew bigger audiences, the Portuguese-speaking market isn’t saturated with cybersecurity content. A sales engineer who’d spent his day working a different booth told me he’s considering going out on his own. We had a frank conversation about how much of that work is pure sales effort, which I don’t think he’d fully reckoned with.

Closing Tradeoffs

I missed the USMC bar event with a friend because of the early flight. We’d seen each other Monday, so it’s fine, but it’s the kind of thing that reminds you a conference is a series of tradeoffs. Four days of noise and signal and I’m taking home more to process than I packed.