It has been 8 years since the initial research was performed by Jack Daniel, Josh Corman, Dr. Stacy Thayer, Martin McKeay, Gal Shpantzer, and K.C. Yerrid.  For the most part, the industry is coming to grips with the fact that burnout and stress are running rampant in our industry.  How much has changed in the 8 years?  What do we know now that we did not know then?  

Penetration testing is still largely misunderstood among companies and new information security practitioners.  My guest this week, Brad Ammerman, has been poppin' boxes since 2005 and has unique perspectives surrounding how penetration testing actually works.  In this episode, we talk process, tool, people, and clear up misconceptions of what a penetration test entails (as opposed to a vulnerability scan and red team exercise). 

Too often, we as information security professionals set out to complete a task without thinking about how the task fits into our own belief system. We are so focused on what we need to do, or how it needs to be done, that we forget why we are doing it. This can lead to cognitive dissonance, because we find ourselves tackling problems that are not congruent to our purpose for being. Leaders that have inspired and changed the course of history are the leaders that have a clear sense of why: Martin Luther King Jr., Rosa Parks, Bill Gates, Richard Branson, Steve Jobs, Greta Thunberg. Simon Sinek accurately states that people do not buy what you do; they buy why you do it. In an information security context, this is true as well. "People don't buy what you do; they buy why you do it. And what you do simply proves what you believe."Simon SinekIn this episode of the podcast, I am joined by Tarik Saleh, a good friend and former co-worker of mine whom I think understands the importance of starting with why. We review his career with a particular lens on why he gets out of bed every morning and selects the projects he goes for and those he passes on. 

K.C. Yerrid has had a non-traditional career trajectory.  During this episode, the host of the Information Security De-cyphered podcast shares a retrospective of his career, highlighting key moments that helped shape his current mindset on information security.