Welcome back to Networking Unleashed, where we
explore the real power of relationships and how
they drive business success. I'm your host, Michael
Foreman, and today we're diving into a conversation
that bridges behavior, communication, and cybersecurity
in a way you've probably never heard before.
My guest is an expert in using positive reinforcement
training method. positive reinforcement training
methods to teach cyber literacy, challenging
the fear -based tactics we often see in fake
phishing tests. He believes that how we train
people to protect data is deeply connected to
how we build trust, communicate, and network
in the digital world. If you've ever wondered
how human behavior impacts everything from password
habits to professional partnerships, this is
the episode for you. So let's explore how a more
positive, connected approach could be the future
of both cybersecurity and networking. I would
like to welcome Craig onto the podcast today,
and he is the expert that I was so diligently
speaking about. Craig. How are you? Welcome to
the show. And give us a little bit about your
background. Michael, that is a wonderful introduction.
Thank you for having me today. I'm really excited
to be here. And I do agree with you in that introduction
how positive reinforcement and experiences between
professionals, between IT departments and employees,
between partnerships. really has the ability
to solidify, strengthen, and enhance relationships.
So it makes a perfect fit in my mind for being
on Networking Unleashed. This is exactly the
kind of thing we need more of. And so thank you
for that. My background, just a brief introduction.
I've been doing cybersecurity after I got a psychology
degree in the early 90s. Before there was a World
Wide Web, I got into cybersecurity. My first
job out of college after a psychology degree
was for a firewall vendor. And I must have bought
a stack of books that would go up about three,
four feet off the floor. They were all the O
'Reilly books. I don't know if anyone would remember
those, but they had an animal on each cover.
So there was Sendmail and there was DNS and Bind
and all these different internet protocols. I
had to read and learn because I didn't have a
computer science degree. But I'd been on the
internet since the early days, since before modems,
when you had fixed connections and we had to
convince companies to when they're networking
into the internet to change the sense of that.
to put a firewall in place. Since that time,
I've worked at many Fortune 5000 companies like
CSC, Computer Sciences Corporation is what that
is, and Vistaprint, JPMorgan Chase. And then
I've really branched out 10 years ago. I founded
CyberHoop to bring cyber literacy to the masses.
And we have this big, hairy, audacious goal or
a BHAG of training a billion people with a B
on cyber literacy skills. We'll see how far we
get. That's me in a nutshell, though. Now, I
want to tell you that I remember the Internet
when it was strictly for military and teachers.
The hard wire for those, it was really incredible
to see where it's come and where it's going to
go. But you're going to help us with that. So
let me hit the first question. You approach cyber
literacy using positive reinforcement. How do
those same principles apply to how we build and
maintain professional networks? Positive reinforcement
theory is defined. It might help to explain that
a little bit. When you're trying to affect human
behavior, you can use negative reinforcement
or positive reinforcement. Negative reinforcement,
by its very definition, is designed to reduce
some behavior. thing you don't like. If you put
a shock collar on a dog and it zaps the dog when
they bark or when they get too close to the edge
of your property, that's reducing those behaviors.
But it doesn't teach the dog anything positive
or valuable. So to do that, you would need to
have treat -based approach with that dog. You
take it to the dog park and you give it treats
when it does the behaviors you want to see. And
so when you're talking about relationships, and
this is right out of Stephen Covey and some of
the other great books that have been written
you want to reinforce in the other person or
in the relationship the good things that you
want to see it makes no sense to me to try to
control another person with negative reinforcement
by cajoling them by embarrassing them by shaming
them and so if you wouldn't do that in a personal
relationship or in a partnership or a friendship
why would you do it in a business to try to affect
behaviors of your employees it doesn't make sense
so applying the any of the best practices that
you and i have both read about right listen first
to understand your friend your partner your colleague
and then to be understood if you apply that principle
you're going to be very successful in business
and networking and all of the all the good things
that come from that because other people just
want to be heard And so you need to do that in
the same sense with your employees. And that's
what we've taken a strategic approach towards
in my company. Does that answer your question?
Yeah, it does. Being a former business owner
in pizzerias, restaurants and things like that.
And really the relationship you have with your
employees is that positive reinforcement. There's
a big difference between a boss and a leader.
Yes. If you're a boss, you're just shouting whatever
that the upper management is doing. And negatively,
however it affects, it doesn't really matter
to you. You just go on your way. But being a
leader helps you with that positive reinforcement.
It teaches those people under you to be leaders.
Right. And that's really the major difference.
But okay. So why do you believe negative reinforcement
like... fake phishing emails does more harm than
good in cybersecurity training, and how might
that mindset also impact business relationships?
Okay, great. So that's a two -part question.
The first part is very simple. When you send
fake email messages to your employees to test
their cyber literacy skills, a bunch of different
negative outcomes occur. First, for anyone that
hasn't been trained previously and that's anyone
that's come out of an educational institution
whether it's high school or university they have
zero cyber literacy training they may have computer
literacy so they can read the email they can
respond to these emails they can click on things
but they don't know anything about why they shouldn't
click on links they probably know There are links
out there that I shouldn't click on, but they
don't know how to identify them. And so they're
full of anxiety and fear. And when you send these
messages, it just increases those negative affects,
the feelings of inadequacy, insecurity, anxiety,
and shame if they were to make a mistake. Some
companies go so far as to say you have a three
strikes rule. If you click on three fake emails,
you're fired. And that's common in banking industry
where they have zero tolerance for risk. That
just alienates the employee from their IT department
or their managed service provider. It's eroding
that relationship every single time they get
an email. And it's not always because they clicked
on it. Sometimes the emails are so simple minded
that the employees enraged at how stupid. The
IT department thinks I am that I would click
on that. It's too easy to identify as a fake
email and it's of questionable value, right?
Why are they wasting my time with these things?
On the other hand, there are IT departments who've
had a mandate to catch as many people as possible
to boost our false. click rates on fake emails
so that we can justify our budget and they make
things like holiday bonus emails and everybody
clicks everybody fails and everybody's irate
chaos ensues you don't have to believe me you
can go to reddit and search phishing p -h -i
-s -h email chaos and you'll see dozens of reddit
threads where people are like Who does this?
Why would they do this to us right around Christmas
or the holidays or this time of year or that
time of year? So it's causing this negative affect.
But the second problem with it is the technology
itself is broken. You cannot send a phishing
email to the inbox of a user as a fake email
test with any resemblance to the vendor you're
impersonating for the simple reason that one
spam report will. lead that email to the owner
of the correct domain. So if it was a Microsoft
impersonation attempt to see if someone would
click on a reset your password for Microsoft,
and it had anything related to Microsoft in the
domain name of the fake email sent to the inbox,
Microsoft lawyers will contact the vendor of
that technology and say, cease and desist. You
cannot impersonate us. And I know this from personal
firsthand experience. We've had three companies
sue us or threatened to sue us if we didn't stop
using a domain name that had some minor resemblance
to their company name in it. Zoom, I don't have
any problems telling you this because some companies
won't bother with you, others will. Zoom, the
IRS, and Facebook, Meta, all threatened us with
lawsuits if we didn't stop impersonating them.
Now, why does that matter, Michael? In the grand
scheme of things, realism matters. And if you
can't impersonate a domain name as a hacker would,
the end users are going to be dumbed down. By
that, I mean they'll learn that an obviously
wrong domain name from Microsoft email is all
I need to know. And so when a hacker sends a
Microsoft domain name that they managed to register
for a short period of time, maybe a week or two,
and they've taken the M. And now visualize this
if you're listening to this. Take that M in Microsoft
and change it into an R and an N. Leave the iCrosoft
in there and put on an account reset or something
in the middle so that people see Microsoft .com
in there. And suddenly you've got everyone clicking
because they haven't been trained to look for
typosquatted domain names or for a domain that
is off by a single letter. So that also flaws
the... traditional fake email testing. We're
getting into the weeds here. But suffice it to
say this, I'll conclude this point with the following.
A study by the University of Zurich in 2020 of
14 ,000 people over 15 months concluded that
unexpectedly, fake email phish testing leads
employees to click more, not less. Full stop.
So it doesn't work. And it's a $6 billion exercise.
And it leads to negative experiences for your
employees. and for your clients. So why are we
doing this? It doesn't make any sense. So the
opposite is also true. If you were to do, as
we do at CyberHoot, a fake email phishing simulation
that doesn't send the email to the inbox, but
brings you to a website where we can impersonate
the rnicrosoft .com. And in the moment, if you
don't know what to look for, we have a help you
guide that gives you the answer. in sort of an
open book test, ensuring that the stimulus is
this domain safe and the response, here's the
answer, are paired closely together. That's the
best of operant conditioning or human behavior
modification, giving you the answer and the information
in a realistic setting that allows you to learn
how to fish. So all of that's to say that. The
employees actually appreciate being taught how
to fish instead of being tricked with realistic
examples. And best of all, it's 100 % automated.
You don't have to punch holes in your infrastructure.
Secondly, you get metrics on every last person
doing this because we track the delivery. You're
providing every employee a positive experience,
an educational experience, and a reward system.
we haven't even talked about rewards, but gamification,
certificates of completion, continuing education
credits, and an avatar that grows in ferocity
that you can compare yourself with your peers,
your colleagues, your employees, and you can
show growth and improvement in cyber literacy
maturity. All of those things are positive reinforcements,
no different than taking a dog to the dog park
to have fun and teach them skills with treats
instead of throwing a shock collar on. And when
they bark, boom, zap them. Or when they get too
close to the property edge, zap them. That's
great. That's great. And there are so many things
that I wanted to ask you, but because of time,
I'm going to have to go to the next question.
You always answer. In the entirety of the question,
and that I really appreciate. From your experience,
how can business leaders create a culture of
trust, both in networking and cybersecurity,
without relying on fear -based tactics? It's
communication. we started out this conversation
today michael with communication and making it
listening to understand and being good leaders
to communicate the goals and objectives of your
company and if you do that in the goals and objectives
of cyber literacy you're going to reward the
relationships that you have with your employees
If instead you send no notice fake email phishing
tests and people get caught up in that and then
they're punished or shamed or even fired for
multiple offenses, you're creating a culture
of fear, anxiety, and deceit. And no one wants
to work in those places. If you go deep into
those Reddit threads I mentioned, you'll see
people who threaten to quit. They said, this
is the last straw. I can't believe they're doing
this to us. I'm going to start looking for work
elsewhere. Is that the kind of culture a leader
wants to have in their company or in their networked
French, the networking that they establish? It's
anathema to great relationships. And so when
you focus on good communication, education before
testing. I'm not suggesting you never send a
fake email test to verify. There was an old saying
in the 80s, Reagan, about, I forget what it was
in context of, maybe Star Wars at the time, but
trust but verify. Yes, you can send a fake email
at some point in the future to measure that they've
learned how to fish, but that's after you've
taught them the skill set. Then it's perfectly
fair to ask them to prove that they know. But
in the beginning, before anyone's received training,
that's not good leadership or good relationship
building. Training is the key amongst everything
else, even more so in what we're talking about.
But if you have a properly trained employee,
you'll get far better results. But going along
the communication thread, you've said cyber breaches
haven't changed much in 25 years. What do you
think about the communication gaps in organizations
today? There's been a study that a company called
Verizon, you probably heard of them. They do
a report every year on the breaches that have
occurred in the previous year. They do it every
year for 25 years now. And they did a longitudinal
study that said in 2003, the number one way companies
were breached was social engineering delivered
via email. That's called phishing. And in 2023,
the same thing is true. The breaches we see are
sourced from phishing attacks, caused by phishing
attacks and people that are unaware of it. And
yet businesses are still focused on this communication
style of gotcha. Let's send those gotcha emails
to see if people click because we've got to tamp
down clicks. We got to stop the bad behaviors.
But in anything, if you don't communicate the
good behaviors that you're looking for, people
are going to be fearful, anxious, and disillusioned
with the leadership in this company, in your
company. And so you're doing your company a disservice
by not communicating the behaviors you want to
see. And we can go back into it, but I've described
it. Looking through the email indicators of a
phishing attack. teaching those skills and saying
we want to see more of the knowledge that protects
our company and if you see something say something
on other events as well so communication all
boils back down to communication michael and
the problem with the industry of cyber security
is it's so immature it doesn't recognize this
yet it's almost like growing pains where that
you know seven -year -old who doesn't want to
go to bed in cybersecurity, I'm not tired, but
they are tired. And it's clear. The industry
doesn't realize, I don't want to stop. I want
to stop the clicks without recognizing there's
a positive way to go about that, that everyone
will actually pay attention to. One final point
on this. Psychology is my background. Psychologists
have studied human behavior and they've concluded
that positive reinforcement methods are the most
powerful behavior modification methods on the
planet. Put in real terms, a slot machine has
a variable rate positive reinforcement schedule
that really encourages people to keep pulling
that slot machine lever to see if they're going
to win something, even as paltry as 50 cents,
10 nickels. And that reinforces that behavior.
Gambling is a very powerful reinforcement structure
because it's variable rate. Negative reinforcement
only works when the negative outcome is a certainty
and just doesn't change behaviors. And we know
this from psychology. So apply that to the way
you operate your business, the way you network,
the way you communicate with people. And you'll
see that if you want people to really value your
relationship, you need to treat them with positive,
good communication, listening skills, and that
sort of thing. Okay. All right. Great. In what
ways are our digital behaviors, like how we handle
emails and passwords, reflections of our professional
communication habits? Let me think about this.
So professional communication habits. Sorry,
Michael, can we repeat that question? And I'm
trying to wrap my mind around it. Okay. In what
ways are our digital behaviors? like how we handle
emails and passwords reflections of our professional
communication habits so for that i'm going to
say that if you comport yourself or behave in
a way that is a win -win scenario for the person
on the other end of the communication you're
following up in what in my books is the best
leadership style available i see a lot of this
and i don't think we want to get into politics
but i see a lot of win -lose in our politics
today in order for one side to win the other
has to lose and in communications in a corporate
environment or on a business to business environment
you can never win with a win -lose communication
style You have to find common ground. You have
to find the overlapping concentric circles that
say, hey, if we do it this way, you're going
to win and we're going to win. And together,
the result is more than the sum of the parts.
So I think if you follow the approach of trying
to find win -win scenarios with your colleagues,
with your communication style, you're going to
be successful in business. You're going to be
successful in life as opposed to any sort of
a win -lose scenario. Does that? Yeah, that explains
it just a little bit. But if, let's say, a company
who did not hire CyberHoot and all of their employees
go on their emails and everything else and they're
getting into bad habits and they continually
do everything they're not supposed to do, but
they're doing it habitually. So they can do it
by getting negative results and say, ah. So what?
And they go on forth and do it again until Cyberhood
comes in and says, you're doing this all the
wrong way. And you get them to correct their
habits. So the difference between having a company
like Cyberhood and a company just not having
anybody is a huge difference. And you're really
putting the company at risk by just having all
the employees just go willy -nilly. by themselves.
So the habits are very important. Sure, absolutely.
I'll just add on to that. I think I agree completely
with you. The reality is people don't know what
they don't know with regards to cybersecurity.
And so they may worry to some extent about it,
but without knowledge of what the consequences
are, they have no reinforcement. positive or
negative to change their habits but if you give
them the why if you explain to your staff with
a tool like cyberhood or with any sort of cyber
literacy training why you don't want to use passwords
everywhere you go the same password why you need
to adopt a password manager why you need to learn
how to fish because these are clear and present
dangers we all face the third largest economy
in the world last year was cyber crime in terms
of revenue generated by email compromise, ransomware,
extortion, wire fraud. That's after only the
United States and China's economies, and they're
in the multiple trillions. Cybercrime was in
the trillion dollars of benefit to the hackers,
which is attracting more hackers to that profession.
And so people don't know this. It's good to hear
this on our podcast today and to learn that because
it provides the necessary reinforcement that
you have to do something. An ounce of prevention
on cyber literacy training with your employees
is going to be worth and solve a pound of cure
down the road with an incident. You want to avoid
those incidents if at all possible. The operative
word that I keep hearing is training. You have
to be trained. And again, that's where CyberHoot
comes in. It's to train your employees for these
types of things, but training is the key. Now,
can you share a real world example of where a
more empathetic or positive approach led to both
cyber hygiene and stronger workplace or client
relationships? Certainly. I have a minor study
that we did a few years back with one of our
IT providers. They had about 50 clients and they
put 40 of them into CyberHoot, 10 refused. And
then we monitored what happened over the subsequent
three -year period. Now, keep in mind, this is
an MSP, a managed service provider who provides
IT support to 50 companies around New England.
After three years, 40 of the companies remained
clients. The 40 that were in CyberHoot receiving
positive reinforcement, receiving... training,
educational training that was gamified, rewarding,
and all of that good stuff, they remained clients
of the MSP. Of the 10 who refused that positive
relationship and the benefits that came with
it, with training and with positive reinforcement,
of the 10, two canceled their MSP agreements
in that three -year period. It's a small study,
but what does that mean? it means there was real
value being delivered to each and every individual
receiving training from the tool each month potentially
perhaps there were other reasons here's the other
statistic that was really eye -opening for the
business owners of the 40 that were in cyber
who there wasn't one major security incident
in the 10 that refused cyber who there were two
major security incidents that led to downtime
and costly recovery efforts and the loss of clients
from a lack of protection of data. If you have
a ransomware event today, it's a double extortion
conundrum, right? The hackers are going to encrypt
your data, which you can hopefully restore from
backup, but they're going to exfiltrate it or
take it out of your company and publish it to
the internet to embarrass you or threaten to
embarrass you unless you pay that ransom. And
so the loss of I just this year went through
it with a client who had a ransomware event.
The data was being threatened to be released.
They had to notify all their clients that they
had been breached and explain how they were going
to prevent that from happening again. And I guess
the moral of this story or the lesson learned
is that through positive reinforcement, but through
positive interactions with your clients, you
can both increase retention. reduce the threat
of a breach, a costly breach, either as your
own company or at the companies you support,
and build those relationships and those networks
where people actually talk to other companies
in the area. And we got new business because
of this positive reinforcement training that
we delivered at that MSP to other businesses.
So it helped you win new business. Okay, so let's
move to the leaders and the professionals in
whatever environment. How can leaders and professionals
train themselves and their teams to be more cyber
aware and more relationally intelligent at the
same time? When you understand this coin that
I like to call negative and positive reinforcement,
you understand that. there are so many benefits
to creating relationships based on positive experiences
right there's an old sales strategy i'm sure
you're aware of it you want to give your client
something three times three different ways maybe
even three different methods an email or a phone
call or some other benefit that you can extend
to them before you make your first request for
something on your side and in building that relationship
through those positive give give scenarios you're
going to be heard and perhaps reciprocated on
that request let's do business together why don't
you buy our service our product and if you've
done a great job of providing value to that relationship
ahead of time through positive interactions you're
going to be successful in business and if on
the other hand you don't follow that approach
and your first thing the first request out of
your relationship is an ask give me something
that's viewed as a negative or a negative reinforcement
to that relationship and people won't pay attention
to it they won't respond to your email they won't
engage and so i think it's a common psychological
phenomenon that for the world to work effectively
together You have to be asking yourself and as
a leader in your company, showing your employees
and your partners, your clients, that you're
out looking out for them and demonstrate that
over and over again, probably before you make
your first request for assistance or for a purchase
or for some relationship building connection.
In the networking world, going to networking
events or meeting with people. You should always
think to give and not receive. That's if you
have a servant's heart. Zig Ziglar really said
this the best, but when you are looking to give,
it takes all the stress, all the anxiety, all
the negative feelings out whenever you're going
to a networking event or something else like
that, because you're just saying, look, when
I sit down with somebody, when I'm interested
in creating that relationship, My question to
him or her is, how can I make you more successful?
How can I be a good referral source for you?
And I usually blows them away. Like, I don't
even know what you do yet. It doesn't matter.
So after he goes or she goes through the entire
process, we exchange business cards and everything
else, but they walk away. They're going to remember
me, but you have to follow through with. helping
them, referring them or something else. But that
line of how can I make you more successful? If
you have that as a mindset, really have it, not
just like blowing smoke, then it'll change your
world. And it will really change the way that
people view you as well. Okay. May I just comment
on that? Absolutely. Look at what you're doing
for us today at CyberHoot. Michael, you've invited
me onto your podcast. You've asked for nothing.
You've offered to highlight my company. You've
highlighted some of the high points and the benefits
of my company, all without ever asking me for
anything other than to be a guest on your show.
You're living and breathing the Zig Ziglar approach.
to networking. And that's why your podcast called
Networking Unleashed. This is very empathetic
or a great example of that comment. Thank you.
And thank you. I try to live that way. If it
lands on people, that's fine. If not, that's
fine too. But let's bring this whole podcast
full circle. Okay. What's your vision for the
future? where networking, communication, and
cybersecurity are all aligned to build safer,
smarter, and more connected organizations. I
would really love if the cybersecurity industry
as a whole grew up past its tantrum years and
said, we're going to embrace positivity. We're
going to follow Zig Ziglar's give before asking
approach. zero in on the positive behaviors we
want to see in the world of employees, email
processing, password hygiene, all the cybersecurity
skills. Because by adopting the positive measures
that we're talking about, by reinforcing through
benefits and giving employees kudos for accomplishing
things and certificates of completion, all the
things that we've tried to focus in on within
cyber who to teach cyber literacy skills and
then some that we haven't think thought of i'd
love to expand into other areas we're going to
be a model to the industry to help course correct
from this negative reinforcement approach of
reducing bad behaviors which leads to poor relationships
which leads to broken partnerships And instead,
course correct to a positive experience, to a
win -win scenario, to building and strengthening
client retention through all of these good things
that make people feel good. Learning and protecting
themselves and understanding the whys, why all
of cybersecurity matters so much, which is still
a vacuum for most people. I think that would
be my heart's goal of... cyber hoot. And if I
had a legacy, it would be to move us from negative
to positive. And I think that would be a really
good approach for most companies to embrace,
to really reward and benefit their employees.
Thank you so much. This was all very insightful
for those people that didn't have this in mind
for their employees, or even for them just working
by themselves. It gave them food for thought.
So if you wanted to have somebody contact you,
either just to talk to you about cybersecurity
or to hire you, what's the best way to do it?
There's three things I'll share with you. One
is we give Cyberhood away to any individual for
free for life. So if you're sitting out there
and you don't have a company or even if you do,
but you're not sure about things, sign up for
free to learn about cyber literacy. We'll give
you our... positive reinforcement, HootFish and
our awareness training videos for free, go to
cyberhoot .com slash individuals with an S on
the end, and you'll get everything we do for
free. The second thing I'll say is that as a
thank you for being on your show, anyone that
registers for a trial, a free trial, 30 days,
and we're month to month after that, we'll get
a 20 % discount on their rates. whether it's
a reseller or a direct, if they use the code
NETWORKINGUNLEASHED in honor of Michael Foreman,
we'll give you a 20 % discount code for life.
It won't go away. It'll be there forever. And
then thirdly, if you really just want to find
out more, email sales at cyberhoot .com and we'll
reach out to you. We can do a demo. We can share
whatever information you're after. So thank you
for the opportunity to give you those things
as a listener of this wonderful podcast. Craig,
thank you very much. Thank you for coming on
the show. And you've been a great guest. My pleasure.
Thank you, Michael. Well, hold on, folks. Don't
go anywhere. Let me just read a few of our sponsors
that we have. Struggling to read success? Maybe
it's time to quit. In Quit Your Way to Success
by Rodney Davis. This reveals 27 steps to breaking
bad habits that hold you back. This powerful
book helps you rewire your mindset, take control
of your actions, and turn setbacks into stepping
stones. With real -life examples. motivational
quotes, and actionable lessons, especially for
sales professionals. You'll gain the tools to
quit, what's stopping you, and start winning.
Transform your future today. So Quit Your Way
to Success by Rodney Davis, available now on
Amazon. And this is a non -profit called Revved
Up Kids. This is something I believe in wholeheartedly.
Revved Up Kids is on a mission to protect children
and teens from sexual abuse, exploitation, and
trafficking. They provide prevention training
programs for children, teens, and adults. To
learn more, go to revvedupkids .org. That's R
-E -V -V -E -D -U -P -K -I -D -S dot org. A huge
thank you to our guests for sharing such incredible
insights today. And of course, a big shout out
to you, our amazing listeners, for tuning in
and spending your time with us. If you're interested
in my digital courses, being coached, or having
me come and talk to your company, just go to
Michael and fill out the request form. Remember,
networking isn't about being perfect. It's about
being present. So take what you've learned today,
get out there, and make some meaningful connections.
If you've enjoyed this episode, please don't
forget to subscribe, leave us a review, and share
it with someone who could use a little networking
inspiration. Let's keep the conversation going.
You can find me on Apple, Spotify, Pandora, YouTube,
or my website, foreman .com slash podcasts.