April 21, 2026 • 39 mins
Got a question or comment? Message us here!
Cybersecurity success increasingly hinges on cognitive readiness, the ability to spot patterns fast, make the right calls under pressure, and perform amid chaos.
On this episode of the SECURE AF PODCAST, Will Arnett sits down with Jessica Gulick, Founder and Commissioner of the U.S. Cyber Games, to discuss why cognitive training is critical, how esports players develop these skills instinctively, and why esports represents an untapped pipeline for elite cyber talent.
They also dive into how AI elevates the importance of human cognition—and how security leaders can strengthen SOC morale by leading more like coaches.
Watch full episodes at youtube.com/@aliascybersecurity.
Listen on Apple Podcasts, Spotify and anywhere you get your podcasts.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_02 (00:00):
Cybersecurity is one of the only fields, I think
technology fields, where thereis a declared us versus them,
right?
There is a mission.
We're here to defend.
Some of us are there to exploit,but for the most part, we're
here to defend.
And so there is that great umsimilarity with sports that
really helps.
SPEAKER_00 (00:23):
You are now listening to the Secure AF
Podcast.
SPEAKER_01 (00:32):
Welcome back to another episode of the Secure AF
Podcast.
I'm your host, Will Arnett.
I'm here today with a specialguest, Jessica Guleck, the
founder and commissioner of U.S.
Cyber Games.
U.S.
Cyber Games develops elite cybertalent through hands-on
competition, advanced training,and global collaboration.
(00:55):
It connects emerging andexperienced defenders, preparing
them to solve real worldchallenges while representing
the United States ininternational cyber
competitions.
But and as we'll talk about,it's not just a student thing.
That's one of themisconceptions, Jessica, that
you like to point out.
So we met at MU CyberCon atMarshall University, and you
(01:18):
gave a presentation that Iunfortunately missed because I
had to catch a flight.
But you gave a presentation thatargues that the biggest untapped
advantage in cybersecurity isnot technology, but trained
human cognition.
So let's talk about that for alittle bit.
SPEAKER_02 (01:39):
Absolutely.
I think that for years we'veheard that the human is the
weakest link.
There's been a ton of investmentin the evolution of technology,
in automating processes, in AI,in quantum, et cetera,
throughout our marketplace.
But we haven't investednecessarily in sharpening the
(02:01):
abilities of the human to beable to leverage these tools to
their highest point.
And that's where I think oursociety really needs to take a
moment and pause and look backat the entire pathway, if you
will, from education to trainingto careers, and say, what can we
do differently that willposition the human in a
(02:25):
successful way to be able toleverage these technologies to
really achieve the dreams andthe goals that we set out for
them?
And I believe part of that isthere's a ton of focus on
intelligence and education.
I think that it's it's time welook back at the basics and
(02:45):
realize that the human mind is amuscle and start training it and
building it so that it can takeon more information, make
quicker decisions to be able tounderstand and do analysis so
that we get uh to that pointwhere uh we are um actively
leveraging the machine, um, butwe're also in control and not
(03:08):
being controlled by.
SPEAKER_01 (03:10):
Right.
And that that that came up, theconference we were at CyberCon,
that just came up constantly,this element of this
misconception of what is AI.
And, you know, we hear peopletalking all the time about AI,
it's going to take jobs and youknow, everything's being
replaced by AI.
But, you know, we preach overand over and over, no, no, no,
no, no.
AI is just the tool, you know,it's not the solution to
(03:33):
everything, and we need to makesure that we're keeping humans
at the end of that.
And I think that's a lot of whatwe're talking about, especially
in the cyber games, andespecially with like this human
cognition, is the fact that howcan we train people, people to
be looking at these and to bealert and and to be stronger in
that.
Um, so talking about technology,so talking about AI, um, how
(03:56):
does AI change the importance ofhuman cognition rather than
replace it?
SPEAKER_02 (04:02):
You know, I think that our world is changing.
Um we have also uh our world ischanging because of AI.
It's going faster, as you said,it's replacing different uh
capabilities and staff.
It makes us want to think whatdo we need to do differently?
(04:23):
Uh and when we look at educationand preparing the workforce, for
example, we had a we had a talkum just a few weeks ago, and it
was all about AI and theworkforce.
And the reality is when you area business manager and you're
looking at leveraging AI forefficiency, right?
To start automating things, uh,to replace some of the tasks
(04:44):
that you have your staff doing,you still have your team and
they still have value.
So you have to re-look at how doI teach my team how to speak
with technology?
It's literally a language.
And I'm not talking aboutcoding, but thinking differently
about how you communicate sothat you can have AI do what you
need it to do and do itproperly, right?
(05:06):
Uh, and to be able to trust inthe results and the outcomes
that you get.
That takes a change in how youapproach your project.
It takes more leadership, uh,pushing leadership and decision
making down the chain, which isa lot different.
Before, traditionally, um, inthe last couple of decades, uh,
(05:26):
you have your traditionalmanager, if you will, and they
have their team and they do thetasks and they present the
information up.
The manager makes the decisionand takes the action.
Um, now we're pushing all thatdown, and AI is becoming their
teams.
And so we basically are turningour team into little managers.
Does that make sense?
I know that's simplification.
(05:47):
Oh, yeah.
They need to have the same skillsets.
They need to have the theability to know what the
strategy is, what is the realoutcome that I'm trying to
achieve, what are the trustedinputs that I need to um rely
on, and how do I get AI to dowhat I need to do properly?
Those are skill sets we haven'tnecessarily trained our
workforce on.
(06:07):
We didn't hire based on patternmatching.
We didn't hire based on umstrategic thinking.
We hired to do a task, and nowthe task is being done by the
machine.
Um, so how can we prepare ourworkforce and train them
differently?
And when we talk about training,it's not just training, this is
how I use AI.
It's re it's it's transformingtheir roles and their
(06:29):
responsibilities to a higherlevel, which has a lot of
competitive advantage andopportunity for companies that
are willing to embrace it.
Um, but there is no doubt thatthis is digital transformation
at its peak with the evolutionof AI.
So it's about looking at thehuman again and saying, what are
the skill sets and what is thetraining that my team needs to
(06:52):
be successful?
SPEAKER_01 (06:54):
Absolutely.
So speaking of that, so theseskills, um, how do you explain
the difference between cognitiveskills and workplace skills to
skeptical executives atcompanies?
SPEAKER_02 (07:08):
Absolutely.
Um, we've all talked about softskills or power skills,
workplace skills.
Um, they all have to do withyour typical teamwork,
leadership, communication, um,which are vital.
But cognitive skills areslightly different.
They're more of the operatingsystem versus the application,
right?
So it's more about readinessversus intelligence.
(07:29):
You go to school to educate,right?
You learn, you become moreintelligent on a topic.
With cognitive skills, you trainthem, right?
This is your this is liketraining your mind to have
better memory, um, to be able touh see different tactics um that
are going on around you, uh, tobe able to uh find the patterns.
(07:54):
So if you look at sports, forexample, let's say your
quarterback, if you're afootball player, or if not, take
a look at um NASCAR and um thespeed at which they are driving,
they have to be able to seecertain indicators and clues
incredibly quickly.
I mean, you're talkingmicroseconds to make decisions
and have confidence.
They aren't thinking in thosemicroseconds, they're reacting.
(08:18):
And reacting takes training anddrills.
So you go to school to learn thebody of knowledge, right?
To understand the tasks.
This is how I do spaghetti.
But what you do is you train forsports, or let's say a
quarterback again, um, so thatin the seconds where you have
the ball and you're trying toget into the touchdown, that you
(08:41):
can see you know where peopleare going to be, right?
You can see certain indicatorsof where the um competitors are.
Um, and you're able to make thatsplit moment decision.
You aren't thinking, you'redoing.
And the only way that you can dothat is by training again and
again and again.
Um, and your body just starts tounderstand and you're training
(09:03):
it like a muscle.
Um, you're working it out justlike you would go to a gym, but
you're working it out um in yourfield in order to be the best
that you can be.
Does that make more sense?
SPEAKER_01 (09:14):
Oh, yeah, absolutely.
Um, so yeah, it's funny becauseI was making this correlation.
I was thinking in my mind, it'sprobably the first time that
we've had a sports metaphor onthis uh podcast, and we've done
over a hundred episodes.
unknown (09:26):
Wow.
SPEAKER_01 (09:26):
So um, but yeah, it's it's as in as quarterback,
you're also you're looking atthat defense, you're looking at
the eyeballs of the defenders,the secondary, the linebackers,
and trying to read whereeveryone's coming from.
So it's almost like those arelike your alerts that are coming
in.
So there's this alert, there'sthat alert, there's that alert,
and trying to read and see,like, all right, what's what's
(09:49):
real?
And and there is that realsecurity fatigue.
And I think that's what you'regetting at with the cognition
with this training.
You're trying to fight againstthat fatigue that a lot of SOC
analysts um run up against.
So, what are some of the waysthat you train um specifically
for this?
Like, what are some examples ofthe training?
SPEAKER_02 (10:10):
Absolutely.
So there um, well, first off, itI find that interesting that
this is the first time you guyshave talked about sports.
Cybersecurity is one of the onlyfields, I think, technology
fields, where there is adeclared us versus them, right?
There is a mission we're here todefend.
Some of us are there to exploit,but for the most part, we're
(10:31):
here to defend.
And so there is that great umsimilarity with sports that
really helps.
Um, it's also that sense ofbelonging.
Our community is very strong inthe sense of belonging.
And that's what sports really uhcultivates.
And it again, it has to do withthat team expect uh perspective.
Um, and ultimately, what you'redoing in sports, whether again,
(10:52):
it's you know, fast driving orthrowing a ball, is you are
building instinct and intuition.
And that's what helps us startto predict moves of um our
opponents, right?
And so if you can build theinstinct and intuition into a
security operator inside a SOCthat perhaps is supporting a
(11:15):
global corporation and dealingwith attacks all the time, you
are now stronger from a defensestandpoint, right?
Because they know the tools thatthey have in front of them and
what the indicators are, andthey're very familiar with the
context, with the environmentthat they're in as well.
So it's fascinating to me.
Um, what we scout for and doevaluations for is really can be
(11:39):
simplified into three mainthings currency, proficiency,
and flow.
So how current are the cyberathletes, as we call them?
Um, are they in their field,right?
Are they educated?
Are they out there speaking?
Are they um actively looking forCVEs?
(12:00):
Are they playing capture theflag uh games on a weekly,
monthly basis?
How proficient are they incertain areas?
Um, are they um the best in thenation for their age range in
web security?
Are they known for their abilityto do deep digital forensics,
right?
(12:20):
Um are they uh very good atcryptography, pattern matching,
verse engineering?
So, what is their proficiencylevel on these skills?
So if you're looking at the NICEframework, if you will,
workforce framework, um, youhave the skills and the
knowledge areas, but howproficient can we see that they
are based on how quickly theycan do something, um, uh the
(12:42):
decisions they make to try tofigure a problem out, uh what
tools do they rely on?
Do they know?
Um, these are all indicators ofa strong candidate for a cyber
athlete.
And last is the flow.
And the flow is what we get fromum esports, at least the term,
but the concept we all know.
So in esports, they call theflow is that state in which
(13:05):
you're at at your highest peak.
Right.
I don't know about you, butgrowing up in our field, I
always called it as I'm in thezone.
Leave me alone, I'm in the zone,right?
Um, I am fully in, focused onwhat I'm doing.
There, it's that sweet spotwhere you can um really take it
this way or that way.
(13:25):
You're just you're in that flow.
And to have somebody who is incybersecurity, um in gaming, to
be able to get into that flowand stay in that flow,
regardless of the environmentaround them, regardless of it,
they're extremely tired becausethey've been traveling all night
and now they're in Australia andit's a different hour, and um,
(13:45):
they're not frustrated by thefact they've got a lot of noise
around them.
They were supposed to have theircomputer, their computer is
busted, so they had to borrowsomebody else's computer.
That ability to work through umsome of the issues and pressures
that you have and stay in thatflow, that high peak of
performance, that is veryimportant to us too.
(14:06):
That is something that you learnwith experience.
It comes with a little bit ofkind of how you grew up or you
know, who you are.
Um, but it's it's also somethingthat you can train, believe it
or not.
This is what athletes do all thetime.
We talk about it when it's aSuper Bowl, right?
We're always talking about therookies, who's never been to the
Super Bowl before.
Are they going to crash underthe pressure of the Super Bowl?
(14:27):
Um, it's the same thing in oursport when we travel
internationally.
Are they going to be able tohandle themselves as a
professional, be able to getfood and go to bed and wake up
and be ready to be in the gameon that day when the stress is
on them?
It's very actually difficult.
Um, people say that it's not asport, Jess.
Is they're sitting at computers,they're not running.
(14:50):
Mentally, it's exhausting,exhausting for a nine-hour
competition to be highly focusedon one particular area.
And that takes training andtakes techniques.
Um, and so we do scout for uh,we leverage attack and defense
competitions and just watchingthem interact with each other on
Discord and kind of thatimmersion over the combine,
(15:11):
which is our scouting andevaluate uh virtual camp, which
is about eight weeks long.
We get to know the students alot and their abilities to
withstand some of thecompetition around them.
Um, do they cheer each other on?
Are they cutthroat?
What decisions do they make?
How do they, how do they reactwhen we tell them, hey, the
meeting's not happening today?
(15:31):
If you're flipping out and youcan't take, you know, a change
in the tool, I know we weregoing to play this game, but
we're gonna play this game now,then you're probably not gonna
do well in competition.
Um, if your heart's in the rightplace and you, you know, you're
mentally stable, you'reemotionally stable, having that
ability to get to flow, that iswhere you get points on the
board.
SPEAKER_01 (15:51):
Right.
That and that translates to reallife scenarios as well, that
ability to be flexible becausewhen you're sitting in the sock,
you're not going to know the theattackers aren't going to
announce what game plan they'regoing to use today.
You know, you have to be awareof what can possibly happen and
things can happen, multiplethings can happen all at once.
(16:13):
Um, and so there's there's notreally a plan necessarily for
how the day is going to go.
You have to be quick on yourfeet.
And I found that interesting,what you were saying about, you
know, eating, sleeping, thoughvery important.
One of the things that our CISOdoes, whenever we have an
incident response and our teamgoes out, the first thing that
we ask the team at the businessis, hey, when was the last time
(16:36):
you slept?
When was the last time you ate?
Okay, we're ordering food, gofind a dark room and sleep.
We got this, we're taking youover this.
And that's very important tomake sure that if you're gonna
be able to survive in thisindustry in this field, you've
got to take care of yourselffirst so you can take care of
everyone else.
SPEAKER_02 (16:55):
Absolutely.
Absolutely.
SPEAKER_01 (16:58):
So, what cognitive traits would you say separate a
good analyst from an elite cyberathlete?
SPEAKER_02 (17:06):
Separate or in common.
Let's do let's do both.
It's funny.
What we um we started callingthem athletes, I want to say
five years ago, and we got a lotof pushback from the community,
um, mainly the cybersecuritycommunity.
They're like, they're notathletes.
Um, but when you look at theamount of time and energy that
these players, if you will, areputting into the game, you're
(17:28):
talking eight to ten hours aweek.
Um, that is on par with Olympictraining.
It just is.
Um, so they are um dedicated toa higher level of performance.
Uh, your normal analyst might becoming in um if you're hiring,
for example, and you have twopeople in front of you.
One is from our team, one isnot, right?
One plays cyber games and onedoesn't.
(17:51):
Um, what you're looking at isthe person who plays cyber
games, they're coming with theireyes open.
Um, so they are looking forpatterns, they're looking for
where do I need help from?
They see things.
Um, they aren't just a young uhprofessional that's I'm here, I
showed up on time.
Do I get a star?
What work do you want me to do?
Um, they've already scanned yournetwork.
(18:13):
They're like, okay, this is whatI think we need to do, right?
There's that different level ofconfidence, that level of um,
sure, you want to do this today?
We can do this.
They're comfortable, right?
On changing and switchingaround.
Um, and they they have that.
It's funny, I talk to many ofthem.
And again, we're dealing withear early career professionals
for the most part for theprogram.
(18:34):
And um because of that, I getsome pushback from them because
brilliant minds, right?
Never been in sports.
Um, so they're like, Jess, I'mnot a leader.
Okay, okay.
I know you're a leader.
No, don't, I'm not, I'm not aleader.
I'm you're not the definition ofa leader.
What you are is you're aninfluencer, right?
They are influencing the peoplearound them because the people
(18:56):
around them know how brilliantthey are.
And so it's important that weteach them liter leadership
skills because with greatresponsibility, right?
With great power comes greatresponsibility.
And to have the power of beingthe person who's the smartest in
the room means you have a lot ofresponsibility on you to be able
to um lead, right, and serve atthe same time.
(19:17):
And so we work a lot with thestudents in terms of um trying
to teach them some of thosehoning those professional
skills, because mentally, umfrom a um from a technical
standpoint, they are at the midto senior level when they work
with us on the team.
But professionally, in terms ofthe soft skills, they are at, I
(19:38):
would say at the junior level,right?
You're at that intern um level.
Um, but again, the cognitiveskills are there, and that's the
difference.
So it's really the power ofthree.
Um, it's the technical skills,the workplace skills, and the
cognitive skills that we'relooking to hone um to get the
best of the best uh to representthe United States.
SPEAKER_01 (19:57):
So what kind of are there any specific candidates
that would normally beoverlooked that you see that
that thrive in US cyber games?
SPEAKER_02 (20:07):
Um the quiet ones.
The quiet ones.
Um, whether they're neurodiverseor they're an introvert.
Um many times in school theywere forgotten about or quiet or
they just did their own thing.
Uh, but in our community, um,they're almost heroes, right?
Uh, because they see the worlddifferently um and they open up.
(20:29):
Um, you get down to a meeting,uh one of our trainings, our
virtual camps, et cetera, andthere's very little being spoken
to at all.
They don't talk a lot.
But the chat over on the right,you've got to be continuously
scanning because they're havingwonderful conversations on chat.
They live on chat on typing.
(20:49):
That is how they they work.
Um, how they associate with eachother is different.
Um, we're still trying to learnthat.
How do you build teaming, youknow, bonding, um, belonging in
that environment?
You compete together, but beforeyou actually compete together,
how do you train that in?
And we play a lot of games.
Um, we tell people we are notabout um training you with the
(21:13):
skills on how to do your job.
You do that on your own, right?
You do that through youreducation.
The United States' universityprograms are amazing with that.
We don't come in and bringteachers to do that.
We bring in coaches andfacilitators to help unlock the
abilities within the people.
That's not teaching them this ishow you do it.
Um, that is getting them to doit again and again and again.
(21:36):
Hey, can we pivot on that?
Let's watch that play backagain.
Okay, you did this.
What if you did this?
You know, that's coaching.
Um, that's not teaching, uh, notin the traditional sense.
Um, so many times if you havesomebody quiet or very
dedicated, they start to bloomin our program.
Um, and there's alwayschallenges with that because
they find themselves indifferent situations, talking to
(21:58):
people around the world.
And it's fascinating to me.
We have a lot of conversations.
The world is a very scary placein many ways right now, with all
the action that's going on inthe world.
And our program isinternational.
We take students abroad andcompete.
They need to be able to competeand network and represent.
(22:19):
So we talk a lot about how, youknow, how you deal with other
people's opinions that you don'tshare, right?
Is this a place to get into theargument or is this a place to
just listen and you guys be you,we'll be us.
We're going to play the game.
We can, you know, have uh a Cokeof beer or whatever, depending
on the age afterwards and get toknow each other and network.
And many of them, um, uh, whentheir first years to the team,
(22:42):
they've never even traveledoutside their state, much less
the country.
Uh, so it's always eye-opening.
Um, and again, it we get themright at the age point where
they are blossoming.
They really are um uh startingto learn about who they are as
an adult, and it's fun.
But those kind of individuals, Iwould say, are usually quite um
(23:03):
and and not as appreciated um inschool.
SPEAKER_01 (23:08):
Yeah, I could see that.
Um, so we we're talking a lotabout students now, and one of
the things that you that yousaid is, you know, this is this
is not just about students.
So uh would you like to expoundon that a bit?
SPEAKER_02 (23:22):
We um we borrow the saying from the esports world
that to learn to play, play tolearn.
So if you learn how to playcyber and tech games, you can
play for the rest of your life.
Um, and that really opens youup.
So we have a program calledWicked Six, which is our women's
program primarily open now toboth uh gender, to all vent
genders.
Um, but it is all about um usinggames to help sharpen your
(23:47):
skills.
And it there is a differentlevel of um learning that
happens in competition.
Whether you're shoulder surfingand learning from somebody else,
um you're watching this outcastand the broadcast, and they're
using different tools and you'relike, I didn't know that.
But there's also this umrealization and um coming to
(24:09):
grips with your internal umimposture syndrome, right?
Seeing somebody else take over achallenge and try to figure it
out.
They're like, okay, they Googlesurfed, I can do that too.
You know, um, I don't have tohave all the answers.
Um, but it it's it's just it'shumanity, right?
You're just relating to otherpeople and you're learning from
them and you're able to do thisin a fun environment.
(24:31):
It's it's funny.
I ran a competition back in theday, gosh, a couple of decades
ago, and it was for adults.
Um, and it was actually um theMaryland Cyber Challenge, uh,
MDC3 up in Baltimore.
And we did multi-generation.
And the, and it was interestingbecause many of the small
businesses were coming out andsaying, so I can take my one-hit
(24:52):
wonder security person and joinup with, you know, five others
from different small companiesand they can work together.
And now they have a group thatthey can um learn from.
That kind of networking is huge,right?
Uh, particularly if you are theonly security person, only tech
person in your company to beable to um train or game with
(25:12):
other people.
Um, it's um eye-opening.
It's also confidence building.
Uh, so if you're a boomerang, aswe call it, coming back into the
community, um, starting to playsome of these games allow you to
experiment um and to uh learn,you know, what you're good at
and you know, what is the rolethat you play on the team and
see how these tools are inaction, right?
(25:34):
To be able to learn about thosetools.
SPEAKER_01 (25:38):
Nice.
How do you uh respond to criticswho still see gaming as a guilty
pleasure instead of preparation?
SPEAKER_02 (25:46):
I would say that um they're missing out.
Games are an amazing way tobuild team and to build your
mental capability.
You're they are cognitivelytraining, they're essentially
going to the gym when they playthe game.
Um, sure it's a guilty pleasure,uh, but they're using their mind
um and keeping it sharp.
(26:07):
What are you doing?
Are you binging TV?
Um, I mean, it's it's a guiltypleasure, sure, but they're
learning how to get pastbarriers in front of them,
right?
It also helps with a lot ofattention um discipline, if you
will, for ADHD.
It helps with memory umcognition training, if you know.
(26:30):
Um, you're using your mind uhand you're working as a team and
you're socializing, it can helpthem in many ways.
It's not a guilty pleasure, itis training in many ways.
Um, it's a like I said, it's asvaluable as going to the gym.
SPEAKER_01 (26:47):
Yeah, and that's so important.
There's I think you and I talkedabout this, uh Marshall.
I've had this strong beliefthat, you know, having this
around all the time is making itwhere we are losing the ability
to have short-term, long-termmemory.
Because if we have all of thisdata at our fingertips, why
should we remember things?
(27:09):
And so I force myselfspecifically as just kind of my
own little um private thing toif I'm having a hard time
remembering something, I willrefuse to Google it.
I will try to activate andsearch my brain to find the
information because I thinkthat's important and trying to,
like you say, that's exercisethat's trying to like train your
(27:31):
brain to try and pull thosememories and to remember how to
do that.
So um how closely dointernational cyber competitions
resemble real-world cyberconflict?
SPEAKER_02 (27:47):
I'd say cyber conflict or cyber cooperation um
is really the question.
The games themselves, um, whenyou look at a Jeopardy game, a
Jeopardy game is not it's notconstructed to to mimic
workplace skills.
Attack and defense is in manyways, but Jeopardy is more
puzzling.
(28:08):
Um, however, when you move itfrom being just a CTF to being
more of a sport, we havecoaches, we have timeouts, we
have some um um substitutions,alternate um alternates.
Uh there's strategy in it.
Um you are in some ways uhworking with international jury.
Uh, so international judges havedifferent rule takes and
(28:30):
different perspective.
What is fair play?
Um in the United States, we canhave a really interesting
conversation about what fairplay is.
Imagine having that with 50other nations.
That's pretty intricate.
Um, but at the same time, havingthat kind of international
perspective uh is also veryimportant from a business
standpoint.
(28:51):
Uh, we were talking about theuse of AI and gaming right now,
that's huge.
We spend more hours talkingabout AI policy than we do any
other aspect of the game.
And um I think that what we havefigured out is that AI use is
not just a technology use in thegame, it's a business use in the
game.
Um, so as uh for this next gamethat we have in Australia, uh
(29:15):
what we've done is kind of thehuman resistance for the first
seven hours and then the robotuprising for the last two hours.
So AI use is allowed primarilyin the last two hours of the
game, and they're given a budgetover two days.
So the team has to make businessdecisions on how to utilize
them.
Um, that is very interesting.
You know, that that hassimilarities with the workplace.
(29:38):
From a Jeopardy standpoint, I Igotta take a step back and say,
in terms of strategy, it's verysimilar uh to businesses because
it has a Jeopardy board, and youknow, there's 500 points, 300
points, et cetera.
Um, and you have multipledifferent topics.
Well, think about it from astandpoint of your vulnerability
list.
What are you prioritizing, high,medium, or lows?
(29:59):
Which department do youprioritize first?
Um, where do you spend your timeand your resources?
Where are you most at risk?
Um, and it flips for the gameinstead of being at risk.
Um, it's really where's yourbest opportunity to make points,
right?
We use dynamic scoring.
So you want to go for the moreintricate ones that will hold
your points the more uh thelongest, if you will.
(30:22):
Um so it's the decision makingis very similar to the
workplace.
When we go to camp and we'retraining, we're looking at
different aspects of how doesthe um captains lead during the
game?
Where do the people sit?
How are they spending theirtime?
How do they triage the problems?
(30:43):
How do you love your passes,right?
How do I pass you a challenge sothat you can pick up from where
I left, not start over?
Um, you know, all these kinds ofthings are very similar in terms
of workplace um simulations.
And then you get back to theinternational piece.
And when there's a major issue,I remember the first year um
(31:04):
there was a uh someone did adenial of service attack, which
was against the rules to ourteam.
And um, in order to work thatissue with the jury, we had to
work internationally and workwith the other team coaches to
say, these are the indicatorsthat we saw that tells us this
(31:24):
is what happened.
This is against the rules, andhave that kind of collaboration,
if you will, to be able topresent and say, all the coaches
agree this is against the rules,right?
That's collaboration acrossinternational lines, um, which
is kind of interesting.
Uh, so it's it's um fun from astrategy standpoint, and there's
a lot of decision making andpressure that is very similar.
(31:48):
Um, but the skills, again, arerelated, correlated, I would
say, um, in the Jeopardy side.
But you get to attack anddefense, and you're running
exploits, you're runningdefense, doing patch management,
vulnerability identification, etcetera.
These are, you know, straightoff the um the sock floor.
Uh those skills uh are veryrelatable.
In fact, many of thecorporations that support us,
(32:10):
they come in looking for talentfor reverse engineering, malware
research, um, you know, thingsto that degree.
SPEAKER_01 (32:17):
So speaking of the SOC floor, so um what lessons
from esports coaching do mostsecurity leaders in the industry
struggle to adopt?
SPEAKER_02 (32:29):
I'd say team management.
Um it's it's fascinating.
I I um I listen to a lot ofbooks now on esport coaching uh
because of the similarities ofesport coaching.
I remember the days um backbefore I was doing this, I was
leading a team of cybersecurityuh folks that was doing an array
of uh things from forensics topenetration penetration testing
(32:53):
to a policy for the federalgovernment.
Um I would say from a coachingstandpoint, there's a lot of
similarities that they should befollowing in terms of
communication, roles, andresponsibilities, understanding
um what is your area ofexpertise and what's mine and
how do we work together.
Uh, I would say how you loveyour passes, in other words, how
(33:13):
you pass work um is is critical.
Decision making, uh again, thecoaching from a coaching
standpoint, uh decision makingis key.
Uh, this is an area, it's funny.
I talk with a lot of peoplearound um the similarities.
And I think the coaching is thenumber one area where I can make
the most progress in the nextcouple of years.
(33:37):
Like the cyber athletesthemselves, they are doing a
wonderful job.
They've got education you we'recut, we're getting them at the
right age from a drill, um, umhelping them with drills, et
cetera.
But the coaching is where ourcommunity really needs to take a
look at.
And I think that it could reallyunleash some people because they
(33:57):
go into these uh jobs, theseprofessional jobs, at least
hackers I know, right?
Um, they go into theseprofessional jobs and let's just
say the suit's a little tootight, right?
Um, but if they just embracetheir job as being a coach
rather than a manager, theymight actually feel way more
comfortable making decisions andleading the people and um
(34:18):
understanding what the peopleare capable of, you know,
understanding your team'sstrengths and weaknesses and
then putting them in positionswhat focus on their strength.
Um, we did a lot of talkingagain at one of the camps um
that because of the age groupthat we're dealing with, they
look at what they have to dotheir primary and their
secondary areas, just like ifyou're a wide receiver, right?
(34:39):
Or a quarterback, what are theareas you're gonna train in?
Ours is like web security,cryptography, tooling, um, AI,
you name it.
Um, but when they look at it,they're like, okay, the primary
one's my strength, the secondaryone's what I want to learn.
And I'm like, no, no, no, no.
We're at the apex, baby.
This is semi-pro team.
All I care about is yourstrengths.
(35:00):
I am not here to train yourweaknesses.
You do that on your own time.
Do that in academia, right?
Um, what we need you to do is bethe best that you can be in the
area that you're the bestalready.
Um, and really push yourself.
And I think that is what a coachdoes on a sports team, right?
That we don't do enough in umteams at work.
(35:22):
We look at our team and we'relike, okay, I need everybody to
have this and this and this andbe nice and balanced.
And this person has a weaknesshere.
So we're gonna shore up theirweakness.
I don't care about yourweakness.
I know about it.
That's critical number one.
What I need to do is make a teamthat can support your weakness
so that you can be the best thatyou can be on your strength.
And I think that's where sportscomes into um cybersecurity.
(35:45):
And if we um embrace more ofthat coaching uh in our socks,
um in our um hunt teams, and inour cybersecurity special ops
teams, etc., what you'll see isa um a drastic change in morale,
right?
Uh because of confidence um andbecause of trust.
(36:08):
When you understand whateverybody's role is and
everybody's allowed to be whothey are to their fullest
ability, you're building trust.
And that kind of trust, it canchange worlds.
And I think that's what I'mexcited about.
But again, it's it's it'scommunicating that out.
Um, I have a lot of folks, we'realways looking for good coaches.
(36:30):
And for season six, we have openapplications right now for
coaching.
And many of the coaches come inand they're like, These folks
are brilliant.
I I can't teach them anything.
I don't need you to teach them.
I need you to coach them.
And coaching is different,right?
It's being there for them.
Yes, you're nurturing them,you're pushing them, you're
(36:50):
saying, What if you did this?
Um, you're showing them whattheir skills are, um, you're
helping them from a professionalstandpoint.
That's the kind of coach weneed.
But we also need somebody whoknows how to play the game.
Um, because uh one of the thingswe changed in the past year with
our coaching and mentorinterviews is I always ask, Do
you play the game?
Are you willing to roll up yoursleeves and actually get into an
(37:12):
attack and defense game?
Um, that's what the playerswant.
They want a coach that's willingto be in the trenches with them.
Funny, isn't that what asecurity operator wants out of a
manager?
Somebody who's willing to be inthe trenches when things really
hit the fan.
You know, be there for them,know what their life is like so
that you have an appreciation,but still be a coach, still be a
(37:35):
manager.
SPEAKER_01 (37:36):
Absolutely.
Well, I can't think of a betterplace to kind of start wrapping
it up.
Um, that that's I agreewholeheartedly.
It goes back to thatconversation we talk all about
all the time in leadership aboutyou know, what's the difference
between a leader and a boss?
You know, and I always I alwayssee that visual of the giant
rock, and people are pulling therock, and the boss is standing
(38:00):
on top of the rock, tellingpeople to pull harder, and the
leader is at the front of theline with the rope, leading by
example, pulling everyone behindthem.
And exactly that's where that'swhat coaches should be.
That's what our leadership incybersecurity should be.
Um, we have a we're blessed tohave a great team that that
nurtures us here at alias.
(38:22):
Um, but yeah, so um just to wrapup, if you're you're looking for
coaches, you're also looking forsponsors.
Um, so where can people go forsome more information if they
want a sponsor, if they want tosign up to coach, where can they
find the information?
SPEAKER_02 (38:39):
Absolutely.
Go to uscybergames.com.
Uh if you're interested in theUS Cyber team, uscybergames.com.
If you're interested in hostinga game, um, looking at a league,
or doing somethinginternational, um, uh visit
playsyber.com.
SPEAKER_01 (38:55):
Awesome.
And you also have your ownpodcast, PlayCyber.
Um that's that's on Spotify.
Um, and I encourage if you'reinterested in cognitive
behavior, if you're interestedin cyber games, if you're
interested in anything we'vetalked about today, also tune
into that podcast as well.
Um, but uh thank you.
This has been another episode ofSecure AF Podcast with our
(39:17):
special guest, Jessica Golak,um, commissioner, founder of
U.S.
Cyber Games.
Um, thank you, Jessica, forbeing on the show.
SPEAKER_02 (39:25):
Thank you so much, Will.
I really appreciate it.
SPEAKER_01 (39:27):
Absolutely.
SPEAKER_00 (39:35):
The Secure AF Podcast is a production of Aliot
Cybersecurity.
Visit us online at aliotcybersecurity.com.
All rights reserved.
Cybersecurity is one of the only fields, I think
technology fields, where thereis a declared us versus them,
right?
There is a mission.
We're here to defend.
Some of us are there to exploit,but for the most part, we're
here to defend.
And so there is that great umsimilarity with sports that
really helps.
SPEAKER_00 (00:23):
You are now listening to the Secure AF
Podcast.
SPEAKER_01 (00:32):
Welcome back to another episode of the Secure AF
Podcast.
I'm your host, Will Arnett.
I'm here today with a specialguest, Jessica Guleck, the
founder and commissioner of U.S.
Cyber Games.
U.S.
Cyber Games develops elite cybertalent through hands-on
competition, advanced training,and global collaboration.
(00:55):
It connects emerging andexperienced defenders, preparing
them to solve real worldchallenges while representing
the United States ininternational cyber
competitions.
But and as we'll talk about,it's not just a student thing.
That's one of themisconceptions, Jessica, that
you like to point out.
So we met at MU CyberCon atMarshall University, and you
(01:18):
gave a presentation that Iunfortunately missed because I
had to catch a flight.
But you gave a presentation thatargues that the biggest untapped
advantage in cybersecurity isnot technology, but trained
human cognition.
So let's talk about that for alittle bit.
SPEAKER_02 (01:39):
Absolutely.
I think that for years we'veheard that the human is the
weakest link.
There's been a ton of investmentin the evolution of technology,
in automating processes, in AI,in quantum, et cetera,
throughout our marketplace.
But we haven't investednecessarily in sharpening the
(02:01):
abilities of the human to beable to leverage these tools to
their highest point.
And that's where I think oursociety really needs to take a
moment and pause and look backat the entire pathway, if you
will, from education to trainingto careers, and say, what can we
do differently that willposition the human in a
(02:25):
successful way to be able toleverage these technologies to
really achieve the dreams andthe goals that we set out for
them?
And I believe part of that isthere's a ton of focus on
intelligence and education.
I think that it's it's time welook back at the basics and
(02:45):
realize that the human mind is amuscle and start training it and
building it so that it can takeon more information, make
quicker decisions to be able tounderstand and do analysis so
that we get uh to that pointwhere uh we are um actively
leveraging the machine, um, butwe're also in control and not
(03:08):
being controlled by.
SPEAKER_01 (03:10):
Right.
And that that that came up, theconference we were at CyberCon,
that just came up constantly,this element of this
misconception of what is AI.
And, you know, we hear peopletalking all the time about AI,
it's going to take jobs and youknow, everything's being
replaced by AI.
But, you know, we preach overand over and over, no, no, no,
no, no.
AI is just the tool, you know,it's not the solution to
(03:33):
everything, and we need to makesure that we're keeping humans
at the end of that.
And I think that's a lot of whatwe're talking about, especially
in the cyber games, andespecially with like this human
cognition, is the fact that howcan we train people, people to
be looking at these and to bealert and and to be stronger in
that.
Um, so talking about technology,so talking about AI, um, how
(03:56):
does AI change the importance ofhuman cognition rather than
replace it?
SPEAKER_02 (04:02):
You know, I think that our world is changing.
Um we have also uh our world ischanging because of AI.
It's going faster, as you said,it's replacing different uh
capabilities and staff.
It makes us want to think whatdo we need to do differently?
(04:23):
Uh and when we look at educationand preparing the workforce, for
example, we had a we had a talkum just a few weeks ago, and it
was all about AI and theworkforce.
And the reality is when you area business manager and you're
looking at leveraging AI forefficiency, right?
To start automating things, uh,to replace some of the tasks
(04:44):
that you have your staff doing,you still have your team and
they still have value.
So you have to re-look at how doI teach my team how to speak
with technology?
It's literally a language.
And I'm not talking aboutcoding, but thinking differently
about how you communicate sothat you can have AI do what you
need it to do and do itproperly, right?
(05:06):
Uh, and to be able to trust inthe results and the outcomes
that you get.
That takes a change in how youapproach your project.
It takes more leadership, uh,pushing leadership and decision
making down the chain, which isa lot different.
Before, traditionally, um, inthe last couple of decades, uh,
(05:26):
you have your traditionalmanager, if you will, and they
have their team and they do thetasks and they present the
information up.
The manager makes the decisionand takes the action.
Um, now we're pushing all thatdown, and AI is becoming their
teams.
And so we basically are turningour team into little managers.
Does that make sense?
I know that's simplification.
(05:47):
Oh, yeah.
They need to have the same skillsets.
They need to have the theability to know what the
strategy is, what is the realoutcome that I'm trying to
achieve, what are the trustedinputs that I need to um rely
on, and how do I get AI to dowhat I need to do properly?
Those are skill sets we haven'tnecessarily trained our
workforce on.
(06:07):
We didn't hire based on patternmatching.
We didn't hire based on umstrategic thinking.
We hired to do a task, and nowthe task is being done by the
machine.
Um, so how can we prepare ourworkforce and train them
differently?
And when we talk about training,it's not just training, this is
how I use AI.
It's re it's it's transformingtheir roles and their
(06:29):
responsibilities to a higherlevel, which has a lot of
competitive advantage andopportunity for companies that
are willing to embrace it.
Um, but there is no doubt thatthis is digital transformation
at its peak with the evolutionof AI.
So it's about looking at thehuman again and saying, what are
the skill sets and what is thetraining that my team needs to
(06:52):
be successful?
SPEAKER_01 (06:54):
Absolutely.
So speaking of that, so theseskills, um, how do you explain
the difference between cognitiveskills and workplace skills to
skeptical executives atcompanies?
SPEAKER_02 (07:08):
Absolutely.
Um, we've all talked about softskills or power skills,
workplace skills.
Um, they all have to do withyour typical teamwork,
leadership, communication, um,which are vital.
But cognitive skills areslightly different.
They're more of the operatingsystem versus the application,
right?
So it's more about readinessversus intelligence.
(07:29):
You go to school to educate,right?
You learn, you become moreintelligent on a topic.
With cognitive skills, you trainthem, right?
This is your this is liketraining your mind to have
better memory, um, to be able touh see different tactics um that
are going on around you, uh, tobe able to uh find the patterns.
(07:54):
So if you look at sports, forexample, let's say your
quarterback, if you're afootball player, or if not, take
a look at um NASCAR and um thespeed at which they are driving,
they have to be able to seecertain indicators and clues
incredibly quickly.
I mean, you're talkingmicroseconds to make decisions
and have confidence.
They aren't thinking in thosemicroseconds, they're reacting.
(08:18):
And reacting takes training anddrills.
So you go to school to learn thebody of knowledge, right?
To understand the tasks.
This is how I do spaghetti.
But what you do is you train forsports, or let's say a
quarterback again, um, so thatin the seconds where you have
the ball and you're trying toget into the touchdown, that you
(08:41):
can see you know where peopleare going to be, right?
You can see certain indicatorsof where the um competitors are.
Um, and you're able to make thatsplit moment decision.
You aren't thinking, you'redoing.
And the only way that you can dothat is by training again and
again and again.
Um, and your body just starts tounderstand and you're training
(09:03):
it like a muscle.
Um, you're working it out justlike you would go to a gym, but
you're working it out um in yourfield in order to be the best
that you can be.
Does that make more sense?
SPEAKER_01 (09:14):
Oh, yeah, absolutely.
Um, so yeah, it's funny becauseI was making this correlation.
I was thinking in my mind, it'sprobably the first time that
we've had a sports metaphor onthis uh podcast, and we've done
over a hundred episodes.
unknown (09:26):
Wow.
SPEAKER_01 (09:26):
So um, but yeah, it's it's as in as quarterback,
you're also you're looking atthat defense, you're looking at
the eyeballs of the defenders,the secondary, the linebackers,
and trying to read whereeveryone's coming from.
So it's almost like those arelike your alerts that are coming
in.
So there's this alert, there'sthat alert, there's that alert,
and trying to read and see,like, all right, what's what's
(09:49):
real?
And and there is that realsecurity fatigue.
And I think that's what you'regetting at with the cognition
with this training.
You're trying to fight againstthat fatigue that a lot of SOC
analysts um run up against.
So, what are some of the waysthat you train um specifically
for this?
Like, what are some examples ofthe training?
SPEAKER_02 (10:10):
Absolutely.
So there um, well, first off, itI find that interesting that
this is the first time you guyshave talked about sports.
Cybersecurity is one of the onlyfields, I think, technology
fields, where there is adeclared us versus them, right?
There is a mission we're here todefend.
Some of us are there to exploit,but for the most part, we're
(10:31):
here to defend.
And so there is that great umsimilarity with sports that
really helps.
Um, it's also that sense ofbelonging.
Our community is very strong inthe sense of belonging.
And that's what sports really uhcultivates.
And it again, it has to do withthat team expect uh perspective.
Um, and ultimately, what you'redoing in sports, whether again,
(10:52):
it's you know, fast driving orthrowing a ball, is you are
building instinct and intuition.
And that's what helps us startto predict moves of um our
opponents, right?
And so if you can build theinstinct and intuition into a
security operator inside a SOCthat perhaps is supporting a
(11:15):
global corporation and dealingwith attacks all the time, you
are now stronger from a defensestandpoint, right?
Because they know the tools thatthey have in front of them and
what the indicators are, andthey're very familiar with the
context, with the environmentthat they're in as well.
So it's fascinating to me.
Um, what we scout for and doevaluations for is really can be
(11:39):
simplified into three mainthings currency, proficiency,
and flow.
So how current are the cyberathletes, as we call them?
Um, are they in their field,right?
Are they educated?
Are they out there speaking?
Are they um actively looking forCVEs?
(12:00):
Are they playing capture theflag uh games on a weekly,
monthly basis?
How proficient are they incertain areas?
Um, are they um the best in thenation for their age range in
web security?
Are they known for their abilityto do deep digital forensics,
right?
(12:20):
Um are they uh very good atcryptography, pattern matching,
verse engineering?
So, what is their proficiencylevel on these skills?
So if you're looking at the NICEframework, if you will,
workforce framework, um, youhave the skills and the
knowledge areas, but howproficient can we see that they
are based on how quickly theycan do something, um, uh the
(12:42):
decisions they make to try tofigure a problem out, uh what
tools do they rely on?
Do they know?
Um, these are all indicators ofa strong candidate for a cyber
athlete.
And last is the flow.
And the flow is what we get fromum esports, at least the term,
but the concept we all know.
So in esports, they call theflow is that state in which
(13:05):
you're at at your highest peak.
Right.
I don't know about you, butgrowing up in our field, I
always called it as I'm in thezone.
Leave me alone, I'm in the zone,right?
Um, I am fully in, focused onwhat I'm doing.
There, it's that sweet spotwhere you can um really take it
this way or that way.
(13:25):
You're just you're in that flow.
And to have somebody who is incybersecurity, um in gaming, to
be able to get into that flowand stay in that flow,
regardless of the environmentaround them, regardless of it,
they're extremely tired becausethey've been traveling all night
and now they're in Australia andit's a different hour, and um,
(13:45):
they're not frustrated by thefact they've got a lot of noise
around them.
They were supposed to have theircomputer, their computer is
busted, so they had to borrowsomebody else's computer.
That ability to work through umsome of the issues and pressures
that you have and stay in thatflow, that high peak of
performance, that is veryimportant to us too.
(14:06):
That is something that you learnwith experience.
It comes with a little bit ofkind of how you grew up or you
know, who you are.
Um, but it's it's also somethingthat you can train, believe it
or not.
This is what athletes do all thetime.
We talk about it when it's aSuper Bowl, right?
We're always talking about therookies, who's never been to the
Super Bowl before.
Are they going to crash underthe pressure of the Super Bowl?
(14:27):
Um, it's the same thing in oursport when we travel
internationally.
Are they going to be able tohandle themselves as a
professional, be able to getfood and go to bed and wake up
and be ready to be in the gameon that day when the stress is
on them?
It's very actually difficult.
Um, people say that it's not asport, Jess.
Is they're sitting at computers,they're not running.
(14:50):
Mentally, it's exhausting,exhausting for a nine-hour
competition to be highly focusedon one particular area.
And that takes training andtakes techniques.
Um, and so we do scout for uh,we leverage attack and defense
competitions and just watchingthem interact with each other on
Discord and kind of thatimmersion over the combine,
(15:11):
which is our scouting andevaluate uh virtual camp, which
is about eight weeks long.
We get to know the students alot and their abilities to
withstand some of thecompetition around them.
Um, do they cheer each other on?
Are they cutthroat?
What decisions do they make?
How do they, how do they reactwhen we tell them, hey, the
meeting's not happening today?
(15:31):
If you're flipping out and youcan't take, you know, a change
in the tool, I know we weregoing to play this game, but
we're gonna play this game now,then you're probably not gonna
do well in competition.
Um, if your heart's in the rightplace and you, you know, you're
mentally stable, you'reemotionally stable, having that
ability to get to flow, that iswhere you get points on the
board.
SPEAKER_01 (15:51):
Right.
That and that translates to reallife scenarios as well, that
ability to be flexible becausewhen you're sitting in the sock,
you're not going to know the theattackers aren't going to
announce what game plan they'regoing to use today.
You know, you have to be awareof what can possibly happen and
things can happen, multiplethings can happen all at once.
(16:13):
Um, and so there's there's notreally a plan necessarily for
how the day is going to go.
You have to be quick on yourfeet.
And I found that interesting,what you were saying about, you
know, eating, sleeping, thoughvery important.
One of the things that our CISOdoes, whenever we have an
incident response and our teamgoes out, the first thing that
we ask the team at the businessis, hey, when was the last time
(16:36):
you slept?
When was the last time you ate?
Okay, we're ordering food, gofind a dark room and sleep.
We got this, we're taking youover this.
And that's very important tomake sure that if you're gonna
be able to survive in thisindustry in this field, you've
got to take care of yourselffirst so you can take care of
everyone else.
SPEAKER_02 (16:55):
Absolutely.
Absolutely.
SPEAKER_01 (16:58):
So, what cognitive traits would you say separate a
good analyst from an elite cyberathlete?
SPEAKER_02 (17:06):
Separate or in common.
Let's do let's do both.
It's funny.
What we um we started callingthem athletes, I want to say
five years ago, and we got a lotof pushback from the community,
um, mainly the cybersecuritycommunity.
They're like, they're notathletes.
Um, but when you look at theamount of time and energy that
these players, if you will, areputting into the game, you're
(17:28):
talking eight to ten hours aweek.
Um, that is on par with Olympictraining.
It just is.
Um, so they are um dedicated toa higher level of performance.
Uh, your normal analyst might becoming in um if you're hiring,
for example, and you have twopeople in front of you.
One is from our team, one isnot, right?
One plays cyber games and onedoesn't.
(17:51):
Um, what you're looking at isthe person who plays cyber
games, they're coming with theireyes open.
Um, so they are looking forpatterns, they're looking for
where do I need help from?
They see things.
Um, they aren't just a young uhprofessional that's I'm here, I
showed up on time.
Do I get a star?
What work do you want me to do?
Um, they've already scanned yournetwork.
(18:13):
They're like, okay, this is whatI think we need to do, right?
There's that different level ofconfidence, that level of um,
sure, you want to do this today?
We can do this.
They're comfortable, right?
On changing and switchingaround.
Um, and they they have that.
It's funny, I talk to many ofthem.
And again, we're dealing withear early career professionals
for the most part for theprogram.
(18:34):
And um because of that, I getsome pushback from them because
brilliant minds, right?
Never been in sports.
Um, so they're like, Jess, I'mnot a leader.
Okay, okay.
I know you're a leader.
No, don't, I'm not, I'm not aleader.
I'm you're not the definition ofa leader.
What you are is you're aninfluencer, right?
They are influencing the peoplearound them because the people
(18:56):
around them know how brilliantthey are.
And so it's important that weteach them liter leadership
skills because with greatresponsibility, right?
With great power comes greatresponsibility.
And to have the power of beingthe person who's the smartest in
the room means you have a lot ofresponsibility on you to be able
to um lead, right, and serve atthe same time.
(19:17):
And so we work a lot with thestudents in terms of um trying
to teach them some of thosehoning those professional
skills, because mentally, umfrom a um from a technical
standpoint, they are at the midto senior level when they work
with us on the team.
But professionally, in terms ofthe soft skills, they are at, I
(19:38):
would say at the junior level,right?
You're at that intern um level.
Um, but again, the cognitiveskills are there, and that's the
difference.
So it's really the power ofthree.
Um, it's the technical skills,the workplace skills, and the
cognitive skills that we'relooking to hone um to get the
best of the best uh to representthe United States.
SPEAKER_01 (19:57):
So what kind of are there any specific candidates
that would normally beoverlooked that you see that
that thrive in US cyber games?
SPEAKER_02 (20:07):
Um the quiet ones.
The quiet ones.
Um, whether they're neurodiverseor they're an introvert.
Um many times in school theywere forgotten about or quiet or
they just did their own thing.
Uh, but in our community, um,they're almost heroes, right?
Uh, because they see the worlddifferently um and they open up.
(20:29):
Um, you get down to a meeting,uh one of our trainings, our
virtual camps, et cetera, andthere's very little being spoken
to at all.
They don't talk a lot.
But the chat over on the right,you've got to be continuously
scanning because they're havingwonderful conversations on chat.
They live on chat on typing.
(20:49):
That is how they they work.
Um, how they associate with eachother is different.
Um, we're still trying to learnthat.
How do you build teaming, youknow, bonding, um, belonging in
that environment?
You compete together, but beforeyou actually compete together,
how do you train that in?
And we play a lot of games.
Um, we tell people we are notabout um training you with the
(21:13):
skills on how to do your job.
You do that on your own, right?
You do that through youreducation.
The United States' universityprograms are amazing with that.
We don't come in and bringteachers to do that.
We bring in coaches andfacilitators to help unlock the
abilities within the people.
That's not teaching them this ishow you do it.
Um, that is getting them to doit again and again and again.
(21:36):
Hey, can we pivot on that?
Let's watch that play backagain.
Okay, you did this.
What if you did this?
You know, that's coaching.
Um, that's not teaching, uh, notin the traditional sense.
Um, so many times if you havesomebody quiet or very
dedicated, they start to bloomin our program.
Um, and there's alwayschallenges with that because
they find themselves indifferent situations, talking to
(21:58):
people around the world.
And it's fascinating to me.
We have a lot of conversations.
The world is a very scary placein many ways right now, with all
the action that's going on inthe world.
And our program isinternational.
We take students abroad andcompete.
They need to be able to competeand network and represent.
(22:19):
So we talk a lot about how, youknow, how you deal with other
people's opinions that you don'tshare, right?
Is this a place to get into theargument or is this a place to
just listen and you guys be you,we'll be us.
We're going to play the game.
We can, you know, have uh a Cokeof beer or whatever, depending
on the age afterwards and get toknow each other and network.
And many of them, um, uh, whentheir first years to the team,
(22:42):
they've never even traveledoutside their state, much less
the country.
Uh, so it's always eye-opening.
Um, and again, it we get themright at the age point where
they are blossoming.
They really are um uh startingto learn about who they are as
an adult, and it's fun.
But those kind of individuals, Iwould say, are usually quite um
(23:03):
and and not as appreciated um inschool.
SPEAKER_01 (23:08):
Yeah, I could see that.
Um, so we we're talking a lotabout students now, and one of
the things that you that yousaid is, you know, this is this
is not just about students.
So uh would you like to expoundon that a bit?
SPEAKER_02 (23:22):
We um we borrow the saying from the esports world
that to learn to play, play tolearn.
So if you learn how to playcyber and tech games, you can
play for the rest of your life.
Um, and that really opens youup.
So we have a program calledWicked Six, which is our women's
program primarily open now toboth uh gender, to all vent
genders.
Um, but it is all about um usinggames to help sharpen your
(23:47):
skills.
And it there is a differentlevel of um learning that
happens in competition.
Whether you're shoulder surfingand learning from somebody else,
um you're watching this outcastand the broadcast, and they're
using different tools and you'relike, I didn't know that.
But there's also this umrealization and um coming to
(24:09):
grips with your internal umimposture syndrome, right?
Seeing somebody else take over achallenge and try to figure it
out.
They're like, okay, they Googlesurfed, I can do that too.
You know, um, I don't have tohave all the answers.
Um, but it it's it's just it'shumanity, right?
You're just relating to otherpeople and you're learning from
them and you're able to do thisin a fun environment.
(24:31):
It's it's funny.
I ran a competition back in theday, gosh, a couple of decades
ago, and it was for adults.
Um, and it was actually um theMaryland Cyber Challenge, uh,
MDC3 up in Baltimore.
And we did multi-generation.
And the, and it was interestingbecause many of the small
businesses were coming out andsaying, so I can take my one-hit
(24:52):
wonder security person and joinup with, you know, five others
from different small companiesand they can work together.
And now they have a group thatthey can um learn from.
That kind of networking is huge,right?
Uh, particularly if you are theonly security person, only tech
person in your company to beable to um train or game with
(25:12):
other people.
Um, it's um eye-opening.
It's also confidence building.
Uh, so if you're a boomerang, aswe call it, coming back into the
community, um, starting to playsome of these games allow you to
experiment um and to uh learn,you know, what you're good at
and you know, what is the rolethat you play on the team and
see how these tools are inaction, right?
(25:34):
To be able to learn about thosetools.
SPEAKER_01 (25:38):
Nice.
How do you uh respond to criticswho still see gaming as a guilty
pleasure instead of preparation?
SPEAKER_02 (25:46):
I would say that um they're missing out.
Games are an amazing way tobuild team and to build your
mental capability.
You're they are cognitivelytraining, they're essentially
going to the gym when they playthe game.
Um, sure it's a guilty pleasure,uh, but they're using their mind
um and keeping it sharp.
(26:07):
What are you doing?
Are you binging TV?
Um, I mean, it's it's a guiltypleasure, sure, but they're
learning how to get pastbarriers in front of them,
right?
It also helps with a lot ofattention um discipline, if you
will, for ADHD.
It helps with memory umcognition training, if you know.
(26:30):
Um, you're using your mind uhand you're working as a team and
you're socializing, it can helpthem in many ways.
It's not a guilty pleasure, itis training in many ways.
Um, it's a like I said, it's asvaluable as going to the gym.
SPEAKER_01 (26:47):
Yeah, and that's so important.
There's I think you and I talkedabout this, uh Marshall.
I've had this strong beliefthat, you know, having this
around all the time is making itwhere we are losing the ability
to have short-term, long-termmemory.
Because if we have all of thisdata at our fingertips, why
should we remember things?
(27:09):
And so I force myselfspecifically as just kind of my
own little um private thing toif I'm having a hard time
remembering something, I willrefuse to Google it.
I will try to activate andsearch my brain to find the
information because I thinkthat's important and trying to,
like you say, that's exercisethat's trying to like train your
(27:31):
brain to try and pull thosememories and to remember how to
do that.
So um how closely dointernational cyber competitions
resemble real-world cyberconflict?
SPEAKER_02 (27:47):
I'd say cyber conflict or cyber cooperation um
is really the question.
The games themselves, um, whenyou look at a Jeopardy game, a
Jeopardy game is not it's notconstructed to to mimic
workplace skills.
Attack and defense is in manyways, but Jeopardy is more
puzzling.
(28:08):
Um, however, when you move itfrom being just a CTF to being
more of a sport, we havecoaches, we have timeouts, we
have some um um substitutions,alternate um alternates.
Uh there's strategy in it.
Um you are in some ways uhworking with international jury.
Uh, so international judges havedifferent rule takes and
(28:30):
different perspective.
What is fair play?
Um in the United States, we canhave a really interesting
conversation about what fairplay is.
Imagine having that with 50other nations.
That's pretty intricate.
Um, but at the same time, havingthat kind of international
perspective uh is also veryimportant from a business
standpoint.
(28:51):
Uh, we were talking about theuse of AI and gaming right now,
that's huge.
We spend more hours talkingabout AI policy than we do any
other aspect of the game.
And um I think that what we havefigured out is that AI use is
not just a technology use in thegame, it's a business use in the
game.
Um, so as uh for this next gamethat we have in Australia, uh
(29:15):
what we've done is kind of thehuman resistance for the first
seven hours and then the robotuprising for the last two hours.
So AI use is allowed primarilyin the last two hours of the
game, and they're given a budgetover two days.
So the team has to make businessdecisions on how to utilize
them.
Um, that is very interesting.
You know, that that hassimilarities with the workplace.
(29:38):
From a Jeopardy standpoint, I Igotta take a step back and say,
in terms of strategy, it's verysimilar uh to businesses because
it has a Jeopardy board, and youknow, there's 500 points, 300
points, et cetera.
Um, and you have multipledifferent topics.
Well, think about it from astandpoint of your vulnerability
list.
What are you prioritizing, high,medium, or lows?
(29:59):
Which department do youprioritize first?
Um, where do you spend your timeand your resources?
Where are you most at risk?
Um, and it flips for the gameinstead of being at risk.
Um, it's really where's yourbest opportunity to make points,
right?
We use dynamic scoring.
So you want to go for the moreintricate ones that will hold
your points the more uh thelongest, if you will.
(30:22):
Um so it's the decision makingis very similar to the
workplace.
When we go to camp and we'retraining, we're looking at
different aspects of how doesthe um captains lead during the
game?
Where do the people sit?
How are they spending theirtime?
How do they triage the problems?
(30:43):
How do you love your passes,right?
How do I pass you a challenge sothat you can pick up from where
I left, not start over?
Um, you know, all these kinds ofthings are very similar in terms
of workplace um simulations.
And then you get back to theinternational piece.
And when there's a major issue,I remember the first year um
(31:04):
there was a uh someone did adenial of service attack, which
was against the rules to ourteam.
And um, in order to work thatissue with the jury, we had to
work internationally and workwith the other team coaches to
say, these are the indicatorsthat we saw that tells us this
(31:24):
is what happened.
This is against the rules, andhave that kind of collaboration,
if you will, to be able topresent and say, all the coaches
agree this is against the rules,right?
That's collaboration acrossinternational lines, um, which
is kind of interesting.
Uh, so it's it's um fun from astrategy standpoint, and there's
a lot of decision making andpressure that is very similar.
(31:48):
Um, but the skills, again, arerelated, correlated, I would
say, um, in the Jeopardy side.
But you get to attack anddefense, and you're running
exploits, you're runningdefense, doing patch management,
vulnerability identification, etcetera.
These are, you know, straightoff the um the sock floor.
Uh those skills uh are veryrelatable.
In fact, many of thecorporations that support us,
(32:10):
they come in looking for talentfor reverse engineering, malware
research, um, you know, thingsto that degree.
SPEAKER_01 (32:17):
So speaking of the SOC floor, so um what lessons
from esports coaching do mostsecurity leaders in the industry
struggle to adopt?
SPEAKER_02 (32:29):
I'd say team management.
Um it's it's fascinating.
I I um I listen to a lot ofbooks now on esport coaching uh
because of the similarities ofesport coaching.
I remember the days um backbefore I was doing this, I was
leading a team of cybersecurityuh folks that was doing an array
of uh things from forensics topenetration penetration testing
(32:53):
to a policy for the federalgovernment.
Um I would say from a coachingstandpoint, there's a lot of
similarities that they should befollowing in terms of
communication, roles, andresponsibilities, understanding
um what is your area ofexpertise and what's mine and
how do we work together.
Uh, I would say how you loveyour passes, in other words, how
(33:13):
you pass work um is is critical.
Decision making, uh again, thecoaching from a coaching
standpoint, uh decision makingis key.
Uh, this is an area, it's funny.
I talk with a lot of peoplearound um the similarities.
And I think the coaching is thenumber one area where I can make
the most progress in the nextcouple of years.
(33:37):
Like the cyber athletesthemselves, they are doing a
wonderful job.
They've got education you we'recut, we're getting them at the
right age from a drill, um, umhelping them with drills, et
cetera.
But the coaching is where ourcommunity really needs to take a
look at.
And I think that it could reallyunleash some people because they
(33:57):
go into these uh jobs, theseprofessional jobs, at least
hackers I know, right?
Um, they go into theseprofessional jobs and let's just
say the suit's a little tootight, right?
Um, but if they just embracetheir job as being a coach
rather than a manager, theymight actually feel way more
comfortable making decisions andleading the people and um
(34:18):
understanding what the peopleare capable of, you know,
understanding your team'sstrengths and weaknesses and
then putting them in positionswhat focus on their strength.
Um, we did a lot of talkingagain at one of the camps um
that because of the age groupthat we're dealing with, they
look at what they have to dotheir primary and their
secondary areas, just like ifyou're a wide receiver, right?
(34:39):
Or a quarterback, what are theareas you're gonna train in?
Ours is like web security,cryptography, tooling, um, AI,
you name it.
Um, but when they look at it,they're like, okay, the primary
one's my strength, the secondaryone's what I want to learn.
And I'm like, no, no, no, no.
We're at the apex, baby.
This is semi-pro team.
All I care about is yourstrengths.
(35:00):
I am not here to train yourweaknesses.
You do that on your own time.
Do that in academia, right?
Um, what we need you to do is bethe best that you can be in the
area that you're the bestalready.
Um, and really push yourself.
And I think that is what a coachdoes on a sports team, right?
That we don't do enough in umteams at work.
(35:22):
We look at our team and we'relike, okay, I need everybody to
have this and this and this andbe nice and balanced.
And this person has a weaknesshere.
So we're gonna shore up theirweakness.
I don't care about yourweakness.
I know about it.
That's critical number one.
What I need to do is make a teamthat can support your weakness
so that you can be the best thatyou can be on your strength.
And I think that's where sportscomes into um cybersecurity.
(35:45):
And if we um embrace more ofthat coaching uh in our socks,
um in our um hunt teams, and inour cybersecurity special ops
teams, etc., what you'll see isa um a drastic change in morale,
right?
Uh because of confidence um andbecause of trust.
(36:08):
When you understand whateverybody's role is and
everybody's allowed to be whothey are to their fullest
ability, you're building trust.
And that kind of trust, it canchange worlds.
And I think that's what I'mexcited about.
But again, it's it's it'scommunicating that out.
Um, I have a lot of folks, we'realways looking for good coaches.
(36:30):
And for season six, we have openapplications right now for
coaching.
And many of the coaches come inand they're like, These folks
are brilliant.
I I can't teach them anything.
I don't need you to teach them.
I need you to coach them.
And coaching is different,right?
It's being there for them.
Yes, you're nurturing them,you're pushing them, you're
(36:50):
saying, What if you did this?
Um, you're showing them whattheir skills are, um, you're
helping them from a professionalstandpoint.
That's the kind of coach weneed.
But we also need somebody whoknows how to play the game.
Um, because uh one of the thingswe changed in the past year with
our coaching and mentorinterviews is I always ask, Do
you play the game?
Are you willing to roll up yoursleeves and actually get into an
(37:12):
attack and defense game?
Um, that's what the playerswant.
They want a coach that's willingto be in the trenches with them.
Funny, isn't that what asecurity operator wants out of a
manager?
Somebody who's willing to be inthe trenches when things really
hit the fan.
You know, be there for them,know what their life is like so
that you have an appreciation,but still be a coach, still be a
(37:35):
manager.
SPEAKER_01 (37:36):
Absolutely.
Well, I can't think of a betterplace to kind of start wrapping
it up.
Um, that that's I agreewholeheartedly.
It goes back to thatconversation we talk all about
all the time in leadership aboutyou know, what's the difference
between a leader and a boss?
You know, and I always I alwayssee that visual of the giant
rock, and people are pulling therock, and the boss is standing
(38:00):
on top of the rock, tellingpeople to pull harder, and the
leader is at the front of theline with the rope, leading by
example, pulling everyone behindthem.
And exactly that's where that'swhat coaches should be.
That's what our leadership incybersecurity should be.
Um, we have a we're blessed tohave a great team that that
nurtures us here at alias.
(38:22):
Um, but yeah, so um just to wrapup, if you're you're looking for
coaches, you're also looking forsponsors.
Um, so where can people go forsome more information if they
want a sponsor, if they want tosign up to coach, where can they
find the information?
SPEAKER_02 (38:39):
Absolutely.
Go to uscybergames.com.
Uh if you're interested in theUS Cyber team, uscybergames.com.
If you're interested in hostinga game, um, looking at a league,
or doing somethinginternational, um, uh visit
playsyber.com.
SPEAKER_01 (38:55):
Awesome.
And you also have your ownpodcast, PlayCyber.
Um that's that's on Spotify.
Um, and I encourage if you'reinterested in cognitive
behavior, if you're interestedin cyber games, if you're
interested in anything we'vetalked about today, also tune
into that podcast as well.
Um, but uh thank you.
This has been another episode ofSecure AF Podcast with our
(39:17):
special guest, Jessica Golak,um, commissioner, founder of
U.S.
Cyber Games.
Um, thank you, Jessica, forbeing on the show.
SPEAKER_02 (39:25):
Thank you so much, Will.
I really appreciate it.
SPEAKER_01 (39:27):
Absolutely.
SPEAKER_00 (39:35):
The Secure AF Podcast is a production of Aliot
Cybersecurity.
Visit us online at aliotcybersecurity.com.
All rights reserved.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Crime Junkie
Does hearing about a true crime case always leave you scouring the internet for the truth behind the story? Dive into your next mystery with Crime Junkie. Every Monday, join your host Ashley Flowers as she unravels all the details of infamous and underreported true crime cases with her best friend Brit Prawat. From cold cases to missing persons and heroes in our community who seek justice, Crime Junkie is your destination for theories and stories you won’t hear anywhere else. Whether you're a seasoned true crime enthusiast or new to the genre, you'll find yourself on the edge of your seat awaiting a new episode every Monday. If you can never get enough true crime... Congratulations, you’ve found your people. Follow to join a community of Crime Junkies! Crime Junkie is presented by Audiochuck Media Company.
The Clay Travis and Buck Sexton Show
The Clay Travis and Buck Sexton Show. Clay Travis and Buck Sexton tackle the biggest stories in news, politics and current events with intelligence and humor. From the border crisis, to the madness of cancel culture and far-left missteps, Clay and Buck guide listeners through the latest headlines and hot topics with fun and entertaining conversations and opinions.