Making Intel Fun Again: Why Play Belongs in Serious Work

Cat Self: Like, the moment I went and deployed, like in a war, I was like, “This sucks. I actually hate the people I’m working for.” 

AJ Nash: Oh, God.

Hello, and welcome to another episode of NeedleStack. Super excited to be here today. Again, my name’s AJ Nash, one of the co-hosts here. What’s my background? Intel guy for a couple of decades, and I’m very excited. We’re gonna have a very cool conversation with a very cool guest today. And as you guys might have noticed, not in the normal location, right?

Not in the studio. It’s Vegas, so you know, it’s… We’re at Hacker Summer Camp. It’s Vegas this week, so on the road, lucky enough to have a cool guest. But first joined by the co-host, Kacper. You wanna give everybody your background and, and get them excited before we jump in? 

Kacper Piwowar: Yeah. So hey, everybody. Joining AJ.

So I’m the co-host of NeedleStack. So my name is Kacper. I work at Authentic8. Tech guy as well, but more of a product sales guy. Now I’m kind of in marketing. Excited here to be joined by Kat. Have a really interesting discussion between the three of us. I hope you enjoy it as well. And yeah, AJ, let’s just dive in.

Let’s get right to it. 

AJ Nash: Well, hold on. We gotta have Kat introduce herself. We’ve talked about her- Oh, yeah … but let’s let her introduce using Kat Self, you wanna give us your intro? Oh. Whoops. You’re the best part of the show. 

Cat Self: I am the best part of the show. I’m not arrogant at all. I’m being humblest of the humble.

But my name is Kat Self. I started my career in military intelligence, which it was not intentional for this to happen to Kat. That’s all of 

AJ Nash: us. 

Cat Self: Right? And then I had my first job out of college at Target, where I was a start out as a software developer, then went to become a red team operator, and then I became a threat hunter.

And I wanna say, that was probably the best, what I like to call baking. Like, you know how sometimes we need, like, just time in the oven to bake? Mm-hmm. Mm-hmm. Mm-hmm. Like, that was my baking time. 

AJ Nash: Nice. 

Cat Self: And then MITRE hired me- Nice … as I was a maintainer on MITRE ATT&CK, and I also did a lot of malware building and enumeration and development for macOS and Linux for tech evaluations And so, and also build their CTIA intelligence team and then pass that off, which is what I do.

I’ll build teams, solve the problem, and then move on so I can go solve a different problem. 

AJ Nash: So, nice. It’s like the Johnny Appleseed of intel, sort of. Yeah. For lack of… I don’t have a better reference than that. 

Cat Self: But then I took a job recently. So all my… The guy that hired me on, Frank Duff, at MITRE- 

AJ Nash: Yeah

Cat Self: actually wound up leaving with a whole bunch of his, like, co- co-sellers, and they went and started Tidal Cyber, which is a startup that’s now been there four years. And then he invited me to come over- 

Kacper Piwowar: Nice … 

Cat Self: and become their senior director of adversary research. So now I left MITRE to go work for the same people-

that I worked for when I went to MITRE. ‘Cause it’s like, we’re just like this, like, nonprofit mindset, little family, you know? Which is kinda nice. 

AJ Nash: Yeah, very 

Cat Self: cool. Like, honestly. I don’t- A lot 

AJ Nash: of smart people, too. A 

Cat Self: lot of smart people. Yeah. I don’t, I don’t know about that one. We’re questionable. We’re questionable.

AJ Nash: I’m sure Tidal Cyber’s excited to hear that. That was- 

Cat Self: Our heart is in the right place. 

AJ Nash: Yes. 

Cat Self: Right? All right. We’re… Like, as long as none of us are stupid at the same time. 

AJ Nash: There you go. 

Cat Self: You know, have you, you ever heard that saying? All the time. It’s like, as long as us are not sick on the same day- Yes … we’ll be fine.

AJ Nash: Yeah. Yeah. 

Cat Self: Kind of those same kinds of… Like, we’re, we can’t all be brilliant all the time, but as long as, like, one of us is brilliant while the other ones are not, we’re good to go. And I feel like our crew does that really well. 

AJ Nash: All right. I love it. So today is gonna be a really exciting conversation. So intel is a hard field.

For anybody who’s listening and watching, you probably know that. You’re probably in the industry. Intel, research, cybersecurity, they’re all really, really difficult. And there’s a lot of pain to it, and there’s a lot of stress to it. It used to be a lot more fun though, quite frankly. And so Kat had a great idea to talk about that, like how do we make intel fun again?

So that’s what we’re gonna talk about today. It’s not just a touchy feely, you know, a, “Gosh, I wish people were nicer to me” kind of a conversation. She’s actually got good research and data on the subject as well, so I’m really excited to get into this conversation. And so let’s just start with that, Kat.

When was intel fun? 

Cat Self: I’ll be honest- 

Kacper Piwowar: Was it ever fun? 

Cat Self: Was it ever fun? Yeah. I think that’s, for a lot of the people out there, I think that’s gonna really depend on the way in which you were exposed to intel. 

AJ Nash: Okay. 

Cat Self: So I was exposed to intel through the military. That was, like, the moment I got out of training, it was no longer fun.

AJ Nash: Right. 

Cat Self: Yeah. Like, the moment I went and deployed, like, in a war, I was like, “This sucks. I actually hate the people I’m working for.” Oh, God. 

Kacper Piwowar: Wow. 

Cat Self: Then I do, like, 

Kacper Piwowar: right? Interesting. They, they always make it seem so exciting in the movies, right? Like, you’re all- Oh, it’s exciting, exciting … like, control room. Fun.

We’re out there- You got, like, these, like, neon dots and, like, boats and airplane images, and then stuff is always connecting and you’re like, “Wow, I wish I had this guy’s job,” right? 

AJ Nash: Exciting and fun are not always the same thing, unfortunately. We’ll stick to that. For everybody listening along too, by the way, as I mentioned, we’re on the road.

Kinda doing this with some mobile Wi-Fi, so if it’s a little choppy, forgive me. It’s Vegas, what can I say? But yeah, it’s, it’s always exciting, Kacper, but definitely not always fun, right? 

Cat Self: Mm. Yeah, we used to have a joke in my, like, training corps and most of the industry that 25% of the work, if you’re lucky, is fun.

Mm. That’s, like, the real spy novel stuff you read about, right? 

AJ Nash: Yeah. 

Cat Self: Like, the rest of it is pure paperwork. 

AJ Nash: Mundane. 

Cat Self: Pure paperwork. You’re in the office. Like, I would go out on missions and, like, we’d be outside in the wire, right? And we’d, we’d go through all these places. And then I’d get back and I literally would stay up for over 24 hours writing reports.

Oh, yeah. And it was brutal. So at that point, you’d been on, like, high alert- Mm … and, like, with guns pointed at you, right? And then you come back, have the adrenaline crash, you can’t sleep, so you just, like, take seven Rip Its, right? You’re just rocking through the night. Just rocking. Which by the way, you’re only allowed, like, two Rip Its per day.

And they’re, like, half- Ooh … the size of a Red Bull- Oh … when Red Bull first came out. So that tells you how potent they are. We’re literally going through cases in, like, two days. And so the so we’re going through these Rip, and, like, and you’re up for, like, over 24 hours, and then you finally crash, and then you get back up and do it all over again.

Mm-hmm. And it’s, like, so not glamorous. You get scaly teeth from the amount of coffee you drink. Like, you’re ugly- Yeah … and disgusting, and you don’t eat. So- … just FYI, the books are not nearly as glamorous as you think they are. 

AJ Nash: Right. Well, 

Kacper Piwowar: I think- So what is, what is the longevity there? Like, if you’re, if you’re doing that for these prolonged periods, how long can you really last like that, right?

And it’s, and I think there’s, there’s kind of two distinctions here, right? I think there’s, there’s obviously the mental fatigue, but then there’s the physical burnout. Mm. Which I think is, like, if you sustain yourself on energy drinks and adrenaline, generally that’s only gonna last for so long until everything starts to, you know, deprecate the quality of your work, your attention span, et cetera, just like human nature.

So how did you deal with the physical aspect of that? ‘Cause I think that’s kinda interesting. 

Cat Self: Well, I’ll tell you, fun fact, our culture does not support healthy living in any way but ironic. 

AJ Nash: Go on. 

Cat Self: So if you think about it, like, when we see someone eating a salad we’re like, “Oh, they’re really vain.” 

AJ Nash: Right.

Cat Self: Right? Like, seriously. As opposed to just they wanted 

AJ Nash: vegetables. 

Cat Self: However, like, so we’re in Vegas, right? Yeah. This is literally the, like, one of the best cities for indulgent living. 

AJ Nash: Oh, yeah. Oh. 

Cat Self: You know how many vegetables you have- Yeah … to order in order to be able to have them present on your plate? 

AJ Nash: A lot.

Cat Self: A lot. 

AJ Nash: Yeah. Exactly. Because 

Cat Self: everything’s meat, carbs, potato- Yeah … cream, butter, sugar, deliciousness. 

AJ Nash: Listen, you don’t have to sell me on Vegas. It’s so good. I’m already here. I love it. 

Cat Self: But it’s like, literally we had to, like, s- we ordered all the vegetables off the menu and it was, like, three. 

AJ Nash: Oh, yeah. 

Cat Self: You only get three options of vegetables.

And it’s because it was a Chinese restaurant, my personal favorite cuisine. And like, and that’s because they’re a veggie forward- Mm-hmm … culture. 

AJ Nash: Yeah. 

Cat Self: And there was only three, which is crazy. Oh, 

AJ Nash: boy. Like, 

Cat Self: you have to filter down 

AJ Nash: to- Yeah. But, I, I mean, he does make a good point. How did you manage the physical strains?

Like, deployment’s hard, right? It’s hard on everybody- Mm-hmm … emotionally, physically, et cetera. And then you still have to keep a clear head. I mean, what we do is really important. It’s, you know, bodies make it or don’t sometimes based on what the intel work is. So like, how, how did you guys find a way to do that?

I know there’s a gym on base for what it’s worth, but- 

Cat Self: Yeah. Running in 120 degree heat is brutal. When, like, the coldest it gets is, like, 90 at night. It’s funny, I don’t know why we’re talking about deployment. Didn’t it rain for us to go down there? ‘Cause that was, like, a long time ago ’cause I’m old now, so we’re clear.

AJ Nash: Mm-hmm. 

Cat Self: But anyways so here’s how we dealt ungracefully with it We, no, there, I didn’t deal with it well. I was in my 20s. That’s how I know- Right. That’s exactly the answer … it’s called youth. Like, that’s why soldiers are young. 

Kacper Piwowar: Yes. 

Cat Self: And then we get a little, a little time underneath us, and then like, “Why am I doing this to myself?”

And then we get disability when we finally get out, and then realize that was stupid. Mm-hmm. ‘Cause, like, FYI, jumping out of planes does not leave you without injuries. 

AJ Nash: Oh, no. Yeah. 

Cat Self: Fun fact. Yeah. I have had so many concussions. Oh, gosh. It’s like I can just collect them like, like little mil- like those little, like, medallions that we all collect, right?

AJ Nash: Sure. 

Cat Self: It’s like, ooh, another one. 

AJ Nash: Yes. 

Cat Self: I don’t think, the answer to your question is I don’t think I actually handled it well. I think I got out, and then I realized, like, self-care is very important. Oh. If you’re physically drained, the odds are that is just a physical manifestation of what your mental state really is.

Kacper Piwowar: Yeah. 

Cat Self: That is what you get to address first, right? Is the actual mental state of why did I think it was okay to be in this physical situation and that this was my acceptable, like, my acceptable standard. 

AJ Nash: Yeah, I mean, it, it’s not a healthy lifestyle, right? That’s what it comes down to when you’re in the military, when you’re deployed, when you’re in intel, you work all the time, and that’s why 20-somethings do it and 40-somethings don’t very often, or 50-somethings, you don’t deploy, right?

I was in the rear with the gear for the most part, so it was a little bit easier, but still a lot of crazy hours. And I think, you know, I relate to what you’d said about, you know, what’s exciting or interesting and isn’t. I always told people, like, “Yeah, 10% of the work is very, very cool, exciting stuff I can’t tell you anything about, and then 90% is pretty mundane.”

You know, working long hours and nights in a building that feels like your old junior high school. Like, it’s just, it’s not what the movies say, like you said. But I think the question, I guess, is, you know, where was the fun? Was there fun in intel before? Like, doing the work. And not the deployment part.

That’s pretty hard. You know, but I remember having some fun at work, right? It’s hard and it’s, it’s, we all understand it’s important. But I remember having a lot of fun, too. Like, I remember being able to, you know, have that camaraderie with the team and to be able to have, you know, maybe some inappropriate jokes if you’re really thinking about it.

I mean, we’re dealing with dead bodies. But, but we were able to find a way to, to have fun- frankly enough, haven’t in the commercial world. So I mean, what are your thoughts about, 

Cat Self: you know, 

AJ Nash: what was the fun stuff and how, you know- 

Kacper Piwowar: And just to, just to add to that, as someone who hasn’t worked in federal or any of those capacities, there’s a general perception, I think, of the work being very serious, obviously very meaningful, but there is a perception of fun, right?

And I think that’s fun, but it’s fun not through like your traditional sense of, you know, high-fiving each other and like, you know, throwing paper balls at each other. It’s more fun in a, in the challenge sense, where it’s like, oh, that looks really fun because it’s challenging, right? Not because I’m gonna be relaxing and doing nothing all day.

So that’s where, you know, just kinda wanted to put that out there, ’cause I think with some of our listeners is not everybody’s had that exposure, and there is like this kind of conception of what it is. But, you know, what, to what Cat’s gonna answer is what was that fun element? Was it there? What were the components kind of of that?

And yeah, how, when did that change, do you think? 

Cat Self: To me, the problem solving is what’s fun. It’s exactly what you were saying, the challenge. Mm-hmm. Like, I love solving really complicated problems. Mm-hmm. And I think analysts have that weird quirk where we just like to take in the data and understand it. 

AJ Nash: Mm.

Yeah. 

Cat Self: And I think like that’s fun. And- 

AJ Nash: Yeah … 

Cat Self: yeah. It’s- 

AJ Nash: Yeah, I agr- I agree. I think hard is fun for a lot of us. Yes. Right? That’s, I mean, that’s the thing I think people sometimes don’t get. Like, hard is fun. 

Cat Self: So much fun. 

AJ Nash: Yeah. I- if you, if you’re gonna be in the intel space or you’re not, if you don’t do intel or research work now and you’re thinking about it, hard is fun.

If that’s who you… If you’re like, “Oh, I get it,” yeah, you should probably be doing this kind of work. Like, I don’t want the 300-piece puzzle. I want the 5,000-piece puzzle and the whole thing’s just black. Like, hard is fun. 

Cat Self: That’s, that’s all you. 

AJ Nash: Yeah. That’s not me. Yeah, that’s not, that’s not- Okay … a great idea necessarily.

But, but the other thing I remember, I mean, I, I’m curious your thoughts, like to me, part of it was fun because I knew what I was doing was meaningful. 

Cat Self: Mm-hmm. 

AJ Nash: Right? I mean, the connection to mission mattered. Now, I will say, Kacper, to your point, we did throw ball- balls of paper at each other and a lot of things.

If you guys ever done live collection missions in the military, I won’t tell all of our secrets, but there’s a lot of things you can’t do in a professional environment that we would do. Some were more fun than others. Throwing throwing paper balls might have been the least of that, actually. But, you know, it was, it was hard, but you knew it mattered. It wasn’t… You know, no offense to anybody now in the world we live in, it wasn’t about money. I felt like we were doing something important for good purpose. Mm-hmm. To me, that’s why it was, yeah, fun. I mean, it was hard, but I always thought it was fun back then, too.

Well, not always. I, let’s, let’s be honest. Sometimes it isn’t. But I thought most times it was at least. So what do you think? 

Cat Self: So there’s a lot of studies done on this, so I will bring this in now ’cause you- Ah, here we- You’ve all hit it at lengths, which I love. So there’s a lot of studies done on this, and I’m like, where is my little, where is my reference paper?

‘Cause I am a firm believer in research, so- Of course you are. You’re a professional. Sorry, not sorry. You guys are gonna get some research on me. Okay. So there’s a lot of studies that’s been done on this fun concept, right? So, but they hit it from different angles So one study, and it, I, I say that because the different angles, and I think this is very important, is the idea of when was this fun is what’s much more complicated than insert a timeline.

AJ Nash: Mm. 

Cat Self: It’s in the way in which we process, right? Like Kacper, you’ve already mentioned it’s the challenge that’s fun. Like you also- Yeah … mentioned it’s the meaningfulness that’s fun. Mm-hmm. Right? Those are actually two really impactful elements. So Lego actually did a study on the Lego Foundation. Mm. And their study was specifically, and here’s what it’s called for those that want to look it up.

It was back in 2017, and it was called Learning Through Play, and it was a review of the evidence, and it came up with some core concepts, and there were identified really five key characteristics of this, this journey of learning. It was joyful, meaningful, actively engaging, iterative, and socially interactive.

Mm. For us to be able to like learn and for that increase to happen, like we needed those different components. Yeah. Which you both have also just mentioned, right? Yeah. The things that… Like there was this great South African professor, and I forgot his name at the moment, I apologize, but he said that it’s only after reflection of an experience do we gain wisdom.

Hm. So even like- Beautiful … while we’re talking about this, it’s like realizing, oh, I needed it to be challenging mentally. Or oh, I need it to be meaningful. Mm. Like that is that wisdom gained. Mm. Where it’s like oh, okay, ’cause I didn’t know the same thing. I, when I got out of the military, I was like, “What do I do with myself now?”

And I was like, “I want something that has purpose. I wanna protect people. I wanna continue down that route-” Mm-hmm … “’cause I love protecting people.” Mm-hmm. Yeah. But I’m really an offensive hacker. Like that’s not a protection. 

Kacper Piwowar: Those don’t go together you’re 

Cat Self: saying. Those don’t go together. When you break into things, that is not helpful.

And I was like, “How do I make this helpful?” And that was when the play came, and I was like, “Wait a minute, I could do adversary research. I could do emulations.” Oh. Where it’s like wait a minute, let me go pretend to be Russia, let me go pretend to be North Korea so I can do all these fun things that I love and I think is interesting, and then let me present it in a way that will actually be helpful, right?

And then that entire field was, you know, well it was born before me. 

AJ Nash: Yeah. 

Cat Self: But I, but I discovered it and I was like, “Dits.” 

AJ Nash: Yeah. Well, and that’s, I mean that, that brings it all together, like you said, the five elements. It’s great to know there’s actually scientific research bes- behind this. They make sense, right?

Those are all things that matter, and most teams I’ve worked with or, or led, I, I guess in some cases or worked on, had those elements, right? If I sit and think about it, yeah, the places that I didn’t enjoy working But we’re missing pieces to those, you know, as, as you mentioned. Now, Castro, I’m curious.

You know, we’re sitting here talking about, you know, we’re reminiscing about old school intel stuff. But I mean, you’ve been doing this a long time. You’re, you’re on the other side. Like you said, you’re not an intel pro, but you are in this space and you work with all of us and, and you know all, all, all the folks doing this kind of work, and, you know- 

Kacper Piwowar: Yeah

AJ Nash: you’re building products and, and services that make us all, you know, make our lives better. So have you seen some of this on your side too, all this, how this all relates? 

Kacper Piwowar: Yeah. I mean, there’s become almost like a delineation between… And I think it’s, it’s something that we started to see in the workforce of, you know, you have fun, and generally that’s what’s preached oftentimes in these workplaces because they believe that that unlocks a degree of creativity and productivity that otherwise you wouldn’t be able to if somebody was miserable.

But where I think they’ve kind of done an interesting psychological play is there’s this emphasis on, like, get work done, but have fun, right? Right. I think when you put in the but, what you’re saying is ultimately you’re trying to drive people towards a particular objective. But throwing in the but is not, I wouldn’t say like a cop-out, but it’s like, “Oh, but we still care about this other aspect,” right?

That’s why we threw it in as a but. And I think that’s kind of this interesting, like, mental model where a lot a lot of people don’t, don’t kind of understand it until you think about it, because all these words are picked in a very specific order and a be- in a very specific tonality. And I think that, you know, when you start to reflect personally on kinda what you do, whether it’s intelligence work or, you know, or other aspects of, of, of our industry or whatever role you have, is that’s when you start to kinda read between the lines of the environment that you work in.

Because without that kind of personal reflection of what is it that I do day to day, what is it that I’m contributing to, and does that ultimately bring happiness to myself? If you don’t have that level of thought, then that thought is es- is essentially placated by whatever you’re fed from the company, right?

Mm-hmm. And that’s why you come across people sometimes that are drinking the Kool-Aid hardcore. It’s because they’ve taken that corporate thought or that, whatever the mantras are, and they haven’t replaced their personal thought, but they’ve let it become the dominant way of thinking. And that’s why, you know, I find that they’re not like robots by nature, but ultimately they’ve kind of become that because they’ve just agreed to side with the communication they’re given as opposed to challenging, you know, what they do on a day-to-day basis and being uncomfortable with that.

AJ Nash: Well, yeah, and, and you’re gonna end up with either people on teams who just coast because they kind of, you know, they’re not gonna have as much fun, but they’re gonna go along with the story or, or people who are gonna move, right? They’re, they’re… You can only spend so much time in a place where you’re unhappy before you either- Yeah

it allows your productivity or you, or you look for something else to do. And I think that’s, that’s a key piece that might be missing. As Jenny mentioned, a lot of organizations, you know, do things, get stuff done, efficiency, you know, all these kind of things. It’s like, “Oh yeah, by the way, have fun.” They just tack it on the end.

Listen, they don’t, they’re not sincere. And they’re saying it because they think they think that’s the thing they’re supposed to say. But they clearly don’t mean it. It’s not a core principle. It’s a secondary thought, and people pick up on that. And then it’s like, “All right, I’ll be here as long as I’m here, but, you know, I, I just, this is as fun as it’s gonna get, I guess.”

And you can’t get that kind of de- commitment that a lot of companies want. So there is a business value to making a workplace and a mission fun, right? Get the work done. Yeah. All matters. But there’s a business value to this that I think a lot of leaders- Yeah … miss. You know, I… Listen, I grew up in a n- you know, an era, my father used to say, you know, “Work isn’t fun.

If it was fun, they w- they would call it, they wouldn’t call it work, they’d call it play. Like, just go do it.” You know, I… Old school and generations before were the same way of like, “This isn’t supposed to be fun. It’s work for a reason.” But you’re just not as effective that way, and we also have a different environment now where people work 10, 12, 14 hours a day.

Like, such a huge chunk of our lives are tied to this, and you want people to be committed and effective. You gotta find a way to put more work into it. Other… or work into being fun, otherwise you get into these discussions of like burnout and quiet quitting, which is a BS term I don’t really believe in.

But, but all these, all these other things come into play. Like, I’m curious, what do you got in your research or in your own, in your own brain, Mara, of when we talk about like burnout and, and some of these things and how that’s played into this? Is there, is there any sort of research to tell us that this improves on that?

Please say so. I don’t know, by the way. I’m not teeing this up with any knowledge. 

Cat Self: So fun facts. I love what you said, Kacper, about This, this, this, like 

Kacper Piwowar: Yeah 

Cat Self: Because if you think about our colloquial sayings, “I love you, but…” 

Kacper Piwowar: Yeah. Oh, yeah. 

Cat Self: Right? Like, you’re like- Yeah. Oh … preparing myself. Friend zone. Like, I have a friend that told me, they were like, “Anything…”

‘Cause I would be like, “I mean, I wanna do it, but…” Mm. And she like, “Kat, any time you throw but in a sentence, you’ve erased the entire first part.” Uh-huh. Yes. “Just so you’re aware, the only honest part of your statement is everything after the but.” Uh-huh. And I was like, “Oof. Okay, fine.” So I, like, started, like, paying attention to my own casual conversation, which by the way, the truth comes out not in the formal ca- like, conversation, but usually in the casual conversation.

Those- Yeah … offhand comments. And that was when I was like, “Oh, this is how you really feel.” Which from what you guys are describing, sounds like organizational belonging. It’s like we wanna foster- Yeah … organizational belonging, but we don’t have the priority to create the atmosphere that would fo- like, cultivate that.

AJ Nash: Mm-hmm. 

Cat Self: So- 

AJ Nash: Yeah … 

Cat Self: but to answer your quest- like, there’s this, this- 

AJ Nash: Yeah … 

Cat Self: this conversation reminded me of one specific study, and that was the Batman study. 

AJ Nash: Uh-oh. 

Cat Self: Are you ready for this? 

AJ Nash: I love Batman, so this- I freaking love- Yes … is gonna be great. It’s 

Kacper Piwowar: so 

AJ Nash: great. It’s well-named. 

Cat Self: It’s so well-named. So, all right.

Let me actually pull up the real paper, because I can’t pronounce half of these names. And so, 

Kacper Piwowar: and I’m like, let me just look at the real paper here. 

AJ Nash: This is when you know you got a true intel pro. She has just pages and pages of documentation here. Yeah. She’s preparing. 

Kacper Piwowar: Boss CS on both of us too, AJ. Right.

AJ Nash: Oh, yeah. 

Cat Self: Oh, yeah. Well, it was a podcast, like, I’ve noticed like, some dude was telling me, he was like, “Oh, yeah, this conspiracy theory, blah, blah, blah.” I mean, he didn’t announce it as a conspiracy theory- Yeah … but it was. And I was like, “Wait a minute. Where’s your sources?” And he was like, “Oh, it was a podcast.

Everyone knows this.” Oh. And I was like, “Whoa. Whoa. Whoa, partner.” Like- … what is your cited research on this? Do you have the… Do they mention white papers? Not a personal blog post of my opinion that I’ve literally strapped together all of these other people’s opinions- Mm-hmm … to be able to, like, create my own little echo chamber.

No. I wanna know what your real research is that was objective, that has studies, that has years of backup. So I’m a big firm believer that I don’t care what platform you’re using, whether it’s podcasts or whether it is a presentation, you should always have valid peer-reviewed research to back your opinions.

Mm-hmm. So, and I throw that out there ’cause there’s just a lot of information out there today, and AI can gather this information so much more effectively. Mm-hmm. I feel like the excuse is now gone. Mm-hmm. And so that’s why I’m bringing this up, is because I just heard a lot of opinions without- Factual representation behind it.

Yes. Does that make sense? So- 

AJ Nash: Absolutely … 

Cat Self: that’s, like, I’m happy to supply all these links, but I wanted to preface that. That’s why this is so important to me, is because I think our, our industry is thirsty for citations. 

AJ Nash: Mm-hmm. 100%. 

Cat Self: So the Batman effect, that actually is titled Improving Perseverance in Young Children.

Mm. It was a study done on four and six-year-olds. And what they found in these subsets was they gave the children a boring task. 

AJ Nash: Mm. 

Cat Self: And now I’m summarizing this very- Mm. Sure … quickly, so real quick. But they gave these children a boring task, and they’re like, “Go do this boring task.” Okay. Well, the children obviously didn’t wanna do anything boring, right?

Like, it’s like attention span. Like, you tell a six-year-old to go, like, sort their toys. That’s gonna be a long time. Right. However, they’re like, “Now, what if you pretended to be Batman, and Batman is sorting their toys?” You know? So it was this fantastical- Really? … idea, yeah. Go pretend to be Batman, and then do this task that’s tedious as Batman would do the task.

AJ Nash: Hmm. 

Cat Self: That’s interesting. So if you think about it in terms of a, like, a CTI analyst, I’m not gonna just do this task. What are… Like, for example, we do this in adversary situational all the time. I’m a CTI analyst, right? Now I’m gonna sit down and I’m gonna do a tabletop exercise, but I’m going to be this adversary.

Mm-hmm. What would this adversary respond? How would I… Like, what would be my witty response to your blocking? Be like, “Oh, ha ha ha.” 

AJ Nash: Yeah. “

Kacper Piwowar: Well, I have my CT on a blockchain server. See there.” 

Cat Self: You know? Like- I’m done. … assigning this tedious task of research and understanding how to respond is, like, hilarious. 

AJ Nash: Oh, yeah.

Cat Self: And it’s different. Yeah. And they had a 65% increase in productivity from these kids four and six years old. Wow. Huge difference. Yes. 

AJ Nash: Yes. 

Cat Self: Just from being able to suspend reality to how would you conduct this if you were in the mindset of another? Hmm. 

AJ Nash: Well, and it, it is. I mean, it’s, it’s innate then. I mean, they’re talking about kids, this is how…

Yeah, we’re all still kids at some point. We grow up and learn a lot of stuff, some of the core- Correct. Yeah … experience on top of all of it, but we’re all kids at some point. And I mean, I, I find that fascinating. I mean, there is a reason, I guess, that we call it wargaming, we don’t call it warworking. 

Cat Self: Hmm.

Yeah, yeah, yeah. 

AJ Nash: You’re right. So yeah, somebody take that one as a quote. I like that one. I wanna use that. So yeah, wargaming. That’s what… I mean, you’ve made the point, right? It is a lot more fun when, you know, red teams versus blue teams and, and, you know, when you’re doing tabletop exercise and when you’re, when you’re, your imagination runs wild in there, you know?

And of course, we validate, we come back, we do course- you know, you- you’re kind of, you know, courses of action, analysis meant, and then we come back and kinda, you know, cool it down from there. But that’s a really interesting study that it shows it’s, it’s innate. It’s going when we’re kids, and that’s all inside of us.

So again, 65%. If you told an executive, “Hey, how… I, I got a, I got a strategy and your teams will be 65 more percent more productive-” I bet they’d listen. And I think anybody who’s in leadership, especially in the intel space, should be listening to this. This is, this, this, again, there’s a business case. It, I, I can talk about this ’cause I believe in it, and you, you do too, and I know you do too, Kacper.

But, but, you know, listen, nobody cares unless there’s a business case. Like, we can tell people all the things we want about how the world should work, and how things should be better, and how teams should be more productive and happy, but I’ve never seen anybody at the top care about that until you give them a business case.

This is the business case. 65% more productivity is a business case. 

Kacper Piwowar: Yeah. I would… And I would say for us, actually, to your point, this Batman effect, it’s kind of, it’s powered by imagination, right? The ability to imagine mentally, like, if you’re, you know, somebody else or if you’re in a different situation.

And the reason that I think it’s rather interesting what you bring up, Kat, is because I’ll use, I’ll use a very completely unrelated anecdote. But, you know, when I go to the gym sometimes and I train, I literally think I’m training for, like, the Seals or something like that. And when I do that, like mentally, I actually start lifting more, and I feel like I can do more.

And it’s crazy, and it’s because I’m just literally just imagining. I’m using the the power of the imagination to be like, “I’m gonna do this.” You know, if you have music playing on top of it, if you empower yourself like that, suddenly you notice you’re not that tired. You can go longer and whatnot.

And I think it’s, like, maybe a subset kind of of what you were saying, Kat, but when you imagine yourself in a, you know, whether as a character or a better version of yourself or whatever it is that can drive you forward, as long as you harness the ability to do that, then I think that 100% will, you know, increase things like productivity, creativity.

That’s why they say in these startup schools, right? Like, they don’t tell these kids, “Hey, you’re broke. You live in an apartment. You have no money, but make an idea.” They always tell them, “Imagine you’re gonna be able to have this type of freedom. Imagine you develop this new type of technology that’s gonna change the world.”

And I think it’s, like, putting themselves in a position where they almost imagine that that’s what they’re 

AJ Nash: working 

Kacper Piwowar: on 

AJ Nash: is what drives it. I really appreciate that. I mean, it’s… You g- give that perspective, and it really, you know, kinda kicks us into the, the big question that I wanted to ask, which is, listen, we can’t forget that this is an important, serious business of intel.

Whether you’re doing cybersecurity, whether you’re doing physical security, whether you’re in the military, government, civilian, whatever it is, it’s a, it’s a difficult job, and it is meaningful, and it has impact. So how do we How do we remain serious but do more fun things? We talked a little bit about it, right?

The Batman effect, you know, and being able to do like absurd emulation. But what other thoughts do you have on how do we put more fun into this work as, as, as a core function, a core value as opposed to a bolt-on like Kacper was saying? And so that we can, we can have people have less burnout and more enjoyment and, you know, more fulfillment while they do amazing work.

Cat Self: There was a conversation I had with a leader once, and brilliant woman, and she’s actually the introvert that was leading a bunch of extroverts. Cool. Which tells you, like, the har- like, for those of you that know how we work- Hmm … it’s very easy to get bulldozed by those that speak very loud. And she- Yes

was able to herd us cats, and she would be in a meeting, and they would all be yelling at each other, right? Especially on budget meetings, ’cause, like- Yeah … she was leading all of these departments. And her name is Jodi Colt. And she’s actually, I think, the VP of cybersecurity at Target right now. And she would, she would, during this meeting, when, when tensions were high and people were like, “Well, why would this,” you know, and y- you know, ’cause you’re fighting over the same budget.

Sure. Right? Like, it’s tense. Mm-hmm. And so she’d be like, “Okay, just take a step back. We all care. Know every single person right now in this room cares. Okay, now let’s resume this discussion.” And I would never forget that, because I realize a lot of times I assume people don’t realize that I care, and like, that that I’m- Hmm

trying to accomplish this really meaningful goal. Mm-hmm. And I think with the seriousness, I think this really goes along with what our industry is now really talking about, and influencers, and think what you want, but I mean, like, within all of the fluff and fodder out there, there is a string of truth that is good.

AJ Nash: Mm-hmm. 

Cat Self: And I think on this one, it’s assume positivity. Mm. So it’s like assume your workers are working hard, assume your intel analysts are not slacking, assume your intel analysts genuinely care about producing something good, you know, and want to be timely, want to be good workers, good employees. Mm.

Right? Like, assume that- 

Kacper Piwowar: No … 

Cat Self: and then act accordingly. And I think that’s probably the first step, is we just need to stop assuming we’re a bunch of lazy people that are taking advantage of the system. 

AJ Nash: I, I think that’s a really good point. I mean, that’s a good point about remote work, right? That’s been, that’s been the argument since COVID and, and remote work, and I’ve, I’ve been in environments, people say, “No, people are, they’re just staying home.

They’re not working hard. They’re doing laundry,” et cetera, et cetera. And, and I would show ’em any study that I’ve shown people and said, “Actually, productivity is up when people work at home.” There’s this emotional feel from some people that, “No, they, they couldn’t possibly be doing the work they would be doing,” ’cause, you know, better they’d be strapped to a desk in an office where they could pretend to work but won’t.

You know, I think it, sorta similar to what you had said, I, I’ve always… Somebody long ago told me something I’ve stuck with, which is assume noble intent, which is really the same concept, right? But also helps when somebody says something that’s offensive to me, or more often when I say something offensive, hopefully people assume my noble intent, and remember, hey, this- Yeah

doesn’t need to be a jerk. You know, so let’s, let’s have a moment to have that conversation, have better communication. But I think it’s the same with what you’re talking about, is we assume that noble intent, we assume positivity, that everybody’s going to try to do their best. It makes it easier to go, “Okay, now how do we get there?”

And it doesn’t have to be the most arduous, difficult task. It’s okay to have fun. It’s okay to have conversations where you get on a call for an hour and just kinda kick ideas around that don’t necessarily know what the conclusion’s gonna be. Everything doesn’t have to be- Of course … 

Kacper Piwowar: symmetric. You 

AJ Nash: know, I sometimes it’s very frustrating, especially when you get into the for-profit industry part that we’re in, of, you know, “I need so many reports a month.”

Well, that’s not a quality assessment, that’s a quantity assessment. Yeah, yeah, but we need that any- it, it doesn’t tell me if I’m doing good work. Now I’m just generating stuff to fill a, a spot on a calendar someplace. And I know a lot of really brilliant minds that have kinda gotten dragged into that because what the brilliant work they wanted to do would take longer and may not have ROI right away, or obvious ROI, but it’s the best work they could do.

And instead they’re doing a bunch of tiny little chunks to fill some calendar someplace which doesn’t seem to offer a lot of meaning. But I think, I think to your point again, if you assume positivity and- Right … good intent on this, and let people do great things and bring good ideas, I feel like that might open a door for more fun things that happen that are still meaningful.

Kacper, from, from your perspective, like how does that play into, like how products are built, how services are built, how, you know, what do you hear from people? You talk to more people in the field than I do, frankly. You know, what do you hear from them on some of these challenges and, and how there are ways to make these things better?

Kacper Piwowar: Well, I think that if you look at… So the mundane work or, or not exciting work, like it has to get done irrespectively, right? Because oftentimes that’s like the lubricant of the machine, right? Like, you just have to kinda get those done. But, you know, what you were touching on in terms of, you know, let’s say common assumptions of not believing that people bel- you know, love their work or believing that they’re not giving 100% effort.

I, I think that a common way of thought that I’ve seen, at least in my experience with different managers, is, you know, I believe it until proven otherwise. Mm. And I think that that mindset is quite nice because you lead with the best of intent until, like I said, you’re proven otherwise that, you know, that wasn’t the case.

But it also de-stresses a lot of situations too because if everyone kind of gathers around that mindset, then everyone pushes forward with good intent. Right? People don’t push forward with hesitation. They push forward with, “Okay, like I’m gonna automatically assume we’re all in this as one team and we all have to deliver on XYZ.”

Has that changed a little bit? I would say perhaps. You know, with the advent of, of a lot of these AI tools and the ability to, you know, automate mundane work away, has that had mental ramifications? 1000%. Most of which actually I would argue we don’t understand yet. It’s too early, right? I think we’re able to gauge economic benefit from it.

We’re able to gauge efficiency gains from it. But I don’t think we’ll really understand the mental shift until a decent amount of time has changed, and then we’ll start to see. Like, in order to know if something’s changed, you need to have something to contrast against. So it’s very difficult just to say like, “Oh, well, things have changed,” and people are like this, or people think like, you know, XYZ, especially as it comes to this topic, without knowing like what it was before.

Like we don’t know what it really was before because we’re in this transitory period, right? We can’t compare ourselves to like pre-Industrial Revolution because then we’re not comparing like apples with apples, right? So, you know, I think that that’s gonna be an interesting shift. I think that there is a degree of ambiguity that’s been developed now, especially around, you know, people doing their jobs and what they actively produce.

And what I mean by that is right now in marketing Marketing’s becoming somewhat commodified, right? Like, you’re seeing a lot of commoditization there, and the reason being is because things like copy, things like blog posts, things like product descriptions, things like campaigns, all of it can be iterated with AI very quickly in a standardized format that actually makes sense.

It’s good enough, right? Don’t think about it as perfection, right? Not everybody’s trying to be the next Apple. People are very content with being, you know, I don’t know, some regular company, right? And as long as that produces economic results, I don’t care about being Apple, right? I don’t care about having the s- most creative, smartest person there.

Just standardize on a process and get it going. And, you know, I don’t mean to be, like, ranting on this, and I’m not trying to, like, obfuscate, like, the meaning that I’m trying to get to here, but when content and intelligence, intelligence as defined as knowing things, not applying things. When content and intelligence become a commodity, and it becomes so prevalent, and it takes very little effort to create, and it becomes heavily standardized, I think that’s gonna start to change the way that people not only think about, like, how they interact with our, you know, everyday services and products, but I also go- I also think it’s gonna start to change our mentality of how we interact with each other and understanding if what somebody says is genuine, if it’s not, what somebody– the work they produce is genuine again, or is it not?

It’s difficult right now to delineate that, but I think in the future you’ll start to be able to delineate that, you know, a lot easier as a human being. And then what it means to be a human being is gonna be different. Anyways, 

AJ Nash: way 

Kacper Piwowar: off. But you know, I think we can get really deep with this. 

AJ Nash: I, I think, I mean, it’s interesting a couple pieces you put in there, right?

So, and one that concerns me I suppose, content and intelligence, which are not the same thing, right? And I, and I- Explain … worry about that, that we are conflating that as an industry and, and people are starting to believe that these are the same. I, I’ve had this issue, I’ve been in the private sector now for, I don’t know, 10, 11 years, and it’s always been a challenge is trying to explain to people the difference between data and information and intelligence.

The news is not intelligence, right? I don’t love the, the citizen journalist concept. There’s no such thing, all right? You don’t have journalism. You didn’t go to school, you don’t have journalistic integrity. You’re, somebody with a camera is not a journalist, and somebody who does research is not an intel analyst.

But we are getting to that point. You talked about commoditization and how AI can replicate a lot of these things, and it can certainly, and it can do some good content work. But that’s a far cry still from the intel space and the validation that goes with it and the process that goes with it, and I’m actually pretty concerned about where we’re going with that because I think you’re exactly right, that a lot of times it’s, “Hey, it’s good enough,” right?

“AI can give me copy, you know, marketing copy that is good enough. It’s 80% as good as a person. It’s in 10% of the time.” That’s a good value equation for a company. But when they translate that over to intel and say, “Hey- It’s good enough. By the way, the person saying it’s good enough has no intel background, and has decided this is 80% as good as an intel report when it’s probably not.

It’s probably 40% or less. But it’s really fast, and they put it out, and we start losing what we’re supposed to have as intel organizations, the impact of intel. I will tell you as an intel person, I won’t be alone I’m sure when I say this, that that’s the opposite of fun for me. But I think it’s an interesting point and a challenge you bring up, that we’ve got to figure out a way to make sure that we still value what intel is and, and the training and the professionalism of it, and allow those people to have the fun experiences that get them to be more productive.

And recognize that that may take longer than AI. Efficiency is not the number one or two or three, for that matter, most important measurement of the value of intel, and I really worry that that’s where we’re gonna head is this conflation between content and intel and, and the evaluation of, of speed over everything else.

Now, Scott, I’m gonna tee you up an easy question on that. If all of that were to come together, are intel people gonna have more or less fun, and how many of them are gonna stick around? 

Cat Self: I don’t think we’re gonna have a problem with this. 

AJ Nash: No? No. Oh, now I wanna hear this. I love this- No … ’cause I do think I’m curious.

Why? 

Cat Self: Because I think our definition of good enough is gonna change. 

AJ Nash: Ooh, 

Cat Self: interesting. Period. Like, I’m in this position right now. I run all the content that goes into Title VI language. I am constantly being pressured for more. In fact, we had, as a result of me onboarding, a period of time that we weren’t pushing new information into the platform.

AJ Nash: Mm-hmm. 

Cat Self: And data engineers, you know what ha- well, here’s insight into what really happens in a startup, right? We probably sh- we’ll see if I get in trouble for this podcast later. It becomes this thing where heroic efforts are no longer enough. Mm-hmm. And everyone wants everything automated. Everyone wants- Yeah

like, big ROI. They all want minimal human hours and maximum automation. However, that means that I now cherish, cherish my data engineers. 

Kacper Piwowar: Mm-hmm. Yeah. 

Cat Self: I cherish my principal architects. I like, I do… Like, what do you need? How do I guardrail this? Because I vibe coded an entire production pipeline, and guys, I will tell you debugging an AI coded pipeline- Oh, man.

So good … is 

AJ Nash: disgusting. So 

Cat Self: hard. I now know how to do it in a much less disgusting way, but it’s still- Yeah … like putting your hand in a cesspool looking for something solid. So I do not recommend it, but we can do amazing proof of concepts now on our own. 

AJ Nash: Mm-hmm. 

Cat Self: However- Yeah … that means that good enough just got raised.

My proof of concept for how I wanna visualize my threat data has now elevated beyond what a company normally would have produced. 

AJ Nash: Hmm. 

Cat Self: A company normally would have produced my vibe coded AI pipeline. Mm-hmm. I don’t need them to do that anymore. So now my good enough is actually my new POC standard. And now when I transfer this over to my engineer, who ha- knows actually what the code is really doing, now suddenly it’s like clean data is the real push.

Like making sure something is truly scalable to the point that I don’t have to have AI interpreting other AI issues incorrectly. ‘Cause that’s the thing is AI uses what’s already in existence to create what it’s going to do next. Yep. And that’s its failure. It cannot create, but we can. So our definition of what good enough is will be created to a new standard because it doesn’t have that current standard, and we’ll be able to refine what we really want to care about now.

AJ Nash: Wow. That’s really 

Kacper Piwowar: interesting. 

AJ Nash: Yeah, ’cause AI is derivative. It’s not creative in any way. It’s all derivative. And I’m somewhat convinced just by your, your conversation here, I hadn’t thought of it from that standpoint. If, if the, if the standard of good enough is raised, then I, then I think you are right.

Then I think that’s the answer. I hope that’s true. I always worry about the combination of doing things well, doing important things well, matched against these pressures for economic success. So it’s- generally speaking, tend to win it seems like. But then I guess there’s gotta be a terminal point. You still have to do good work or nobody’s gonna want your product or service.

So there’s that threshold there. I hope, I hope you’re right. I mean, that’s a, that’s a more optimistic opinion than I had coming into this conversation. So now, and again, if that happens, it’ll be more fun. You know? It, it’s, it does open more opportunity for that. I think teams that are able to tackle the topic we had here of, you know, how do we make intel fun, they’re gonna have the best talent, right?

Long term, people will not, going back to the deployment conversation from the beginning, people won’t endure terrible for forever. They’ll do it as long as they have to, and they’ll do the minimum amount of work to get by. But people who are truly enjoy where they are and the work, and they know it’s meaningful and connected and all the things you said in that Lego study, and they feel like people care about them, they’re gonna stick around and do great things.

And it sounds like those great things are gonna be greater than before because the standard’s being raised, which is pretty cool. 

Cat Self: Yeah. There’s actually one qualifier for… So you had mentioned earlier about how, like, well, how do we bring fun into it now? 

AJ Nash: Mm-hmm. 

Cat Self: I’ll give you g- you all a couple of examples.

All right, so because you brought up employment, so we can come full circle. 

AJ Nash: Yeah. Yeah. 

Cat Self: We were little baby Joes. You had little baby Joe cat, and her little pajama-like, you know, uniform. ‘Cause that’s what we called them. We called them pajamas, but as they were completely not form-fitting and they were lovely.

In fact, we made jokes that you could blend into a couch, and that was it, ’cause they were, like, this weird green. So 

AJ Nash: true. Yeah. 

Cat Self: You’re lucky, for those of you that are currently serving, that you actually have truly nature camouflaged colors. 

AJ Nash: Yeah. 

Cat Self: But we were, we were practicing drills on how to move in close quarters, right?

AJ Nash: Mm-hmm. 

Cat Self: What they did, you didn’t need any arms or anything. We literally just lined up and we went through halls, and we were just clearing rooms. And the main sergeant at the time that was leading us, he was like, he threw out his hand and he was like, “You know, grenade.” And then- … we all just stood there, like- Oh, no.

“And what?” 

AJ Nash: Boom. 

Cat Self: And then, like, just boom. You’re dead, you’re dead, you’re dead, and you’re dead. Oh, no. And we were like, “Okay.” Then we just continued, right? And he’s like, “No.” 

AJ Nash: No, you’re 

Cat Self: dead. “That’s the wrong answer. You’re gone.” “That was not acceptable.” Like, “We do not leave a man behind. Now your body has to be- Well, how are you, how are 

AJ Nash: we gonna carry him?

Cat Self: dragged by somebody else,” right? Oh. Yeah. Like, oh, oh, now you get to suffer through human carrying exercises. Oh. You’re welcome. You’re like, “Oh my God, good thing you not have eaten heavy last night.” You know? Like that’s a whole thing. And so, ’cause then you’re now making fun of a cadence. Sure. Yeah. There was, like, a fun little culture there.

But- 

AJ Nash: Authentic8 diets … 

Cat Self: then he was like, “Listen, what is the bla…” Like, he went through the dynamics of this. What’s the blast radius? Like where is the main point of damage of a grenade, right? Mm-hmm. Yeah. Like understand the weapon in which you just had thrown at you. Mm-hmm. Right? First. Now, how do you block that?

Like if you have nothing else, you have a body. And then, like, we did that round again. 

AJ Nash: Uh-huh. 

Cat Self: Like three different people lobbed themselves on top of that grenade. And now mind you, he still would’ve die- had four die, but we still had, like, the point is our survival rate was a lot higher. 

AJ Nash: Sure. Yeah. So 

Cat Self: it became fun.

It was a low stakes. There was… No one died, you know? It was more just yelling and we’d laugh about it later and make fun of each other for not being the one to hit the target first. But the point is, like, that scenario mapped in my mind, I now know exactly what to do if I’m on a mission and that happens.

Mm-hmm. Yeah. Like it’s a very different mindset, right? Which is really what we’re trying to talk about, is how do we cultivate the mindset of a security professional, whether in CTRI, adversary emulation, red team, defensive. How do we cultivate that in a way in which it sticks? Mm-hmm. And so this is a fun fact.

No, not a fun fact. So Marsh, which is an insurance agency. 

AJ Nash: Oh, yeah. Like- I know Marsh. 

Cat Self: Yep. So they have been doing a study since about 2025. 

AJ Nash: They’re a client of ours, I believe. Oh, okay. Maybe. 

Cat Self: So they’ve been doing this study since 2025, and they found back in… Well, they published in, like, August 27th, 2025.

They have an announcement, and they did a summary. Basically, they found that people that did tabletop exercises for preparedness and incident response, they were 13% less likely to have that, like, I’m gonna really… Not trying to misquote this, but I’m trying to summarize it to not mean, like, a material cyber event.

So basically, like, they had a 13% less chance of a, a breach actually happening against them. Okay. 

Kacper Piwowar: Mm. 

Cat Self: Out of all of the different controls that they measured via data, in the top five, the fourth one was actually practicing these exercises. And you notice there’s no technical implementation there. There’s no implement- Yeah.

Yeah … like configuration firewalls using MFA was, like, two and three, right? 

AJ Nash: Mm. 

Cat Self: But four was practicing scenario-based events. What do you do when? 

AJ Nash: Uh-huh. 

Cat Self: It’s the same thing. Like, we use it in military strategies, we use it in enterprise, right? We use it even in personal. Like- Mm-hmm … like, what do I do when someone says this really nasty comment to me on social media?

Let me practice how to be gracious and kind and forgiving. You know, like- Yeah … walk through all the emotions. I’m now better prepared for what happens in that scenario, right? Mm. So the point of that is There’s an actual, to something you said earlier, Gosh, that there’s an actual business impact- Mm … of just bringing in a scenario.

Mm. And then you, but you have to cultivate an environment that it’s safe to fail, that it’s play, that it’s, that psychological safety is there. 

AJ Nash: Well, and, and- Yeah … so it’s interesting because where are the areas where organizations cut costs? Mm. Often, right, training. Training is usually a checkbox scenario.

Mm-hmm. And that includes things like tabletops and wargaming, right? So you just said 13% reduction in that study, right? So that’s, that’s significant risk reduction that actually doesn’t cost a lot. It costs a little bit of time. It doesn’t… You can sit down and do red teaming and wargaming, maybe one facilitator if you don’t have somebody in-house that does it, and that’s about it, and then some time.

You don’t have to buy millions of dollars of technology and feeds and all these things, and you can have that reduction. But you have to change the mindset of the organization to say, “Hey, listen, this is what we should be doing.” The engagement matters, and there’s, like you said, there’s a business case to this.

Because that’s a hard one. I know people in that, in that field, you know, to do security training, it’s very hard to sell those services to people. It’s very hard to, to get them to repeat it. It always seems to get dropped down into a checkbox scenario whenever there’s a budget issue because it’s so hard to say, “No, this really matters,” ’cause it doesn’t give you the kind of metrics that did.

That’s nice. Because a lot of times in a day-to-day it doesn’t. Right. So technology will show you all sorts of metrics even if they’re garbage, but it just blocked a billion things. Well, how do you know they were dangerous? I don’t know that part. But I blocked a billion, so give me more money. But that’s, I mean, that’s a good point.

And again, those people were having fun doing it. Those scenarios, you know, they’re, they’re engaging. They have, you know, better retention, as you said. There’s more memory. There’s more impact. It’s longer lasting. We gotta get people just to understand the value of that, and it’s fun. People will wanna do it.

Not all the time, I’m sure, not everybody, but a lot of people enjoy some of this role-playing and, and, you know, exercising and tabletops. And dragons. Exactly. Every geek, and that’s most of our industry, loves doing that kind of stuff. So I, I think that’s a great study. I’m glad that’s out there because I think, I think it’s important.

Yeah. So listen, I, I know we’re running out of time here, so I, I think we should probably get towards a wrap-up for those who are still paying attention to what’s going on here. I think, Kacper, what have you taken away from this? Like, what’s, what are the two or three big things that you take away from this that you want the audience to gather out of this conversation about, you know, making intel fun again?

Kacper Piwowar: Yeah. I would say one is do your best to create the environment as best as you can to have that fun factor included, right? And I, and the reason I’m putting that onus more on an individual than I would on a company is because the priorities are different, right? A company’s priority is out there to build a business, become profitable.

If you become public, you ultimately satisfy shareholders. Whereas the priority of the individual is that sort of environment, right? So relying on a company entirely to create that for you is somewhat naive in my opinion. I think that you have to also figure out how do you generate your portion of that.

On the other front, I would say You know, when you do things, do things with the right intent and the right mindset for success. And what I mean by that is not just, you know, I think positivity is a component of it, but doing something with, you know, the automatic kind of mental assurance that you’re out there to achieve it, and not going in with the thinking that this isn’t gonna work, then shoot yourself in the foot right from the beginning is, is, is critical, right?

And when you’re talking, when you’re looking at people in this industry especially, you know, I think that there could be a good, a strong degree of sentiment around, like, you know, why somebody does something, or how is it part of the bigger picture? Like, what role am I playing? Having the mentality of knowing that you have a role to play and it is important, and that’s your mindset until, like I said, proven otherwise, will probably just make you happier, right, as we were talking about, and more successful, so.

That’s, that’s my two cents on that. 

AJ Nash: And I appreciate that. I think, I think those are all true. I don’t know, I, I was gonna ask you the same question, Kat. I, I imagine you have some agreements here, but you may have some things you wanna add, too. What, what are the big takeaways that you think from this and, and from the research you’ve, you’ve done and from what you’re doing right now leading a team for that matter?

Cat Self: So really what I’ve been doing in my team is, like, how do we get transparency and visibility into the work that we’re actually doing? 

Kacper Piwowar: Mm. 

Cat Self: So when you asked that question, that’s not what I was gonna answer, by the way. But that’s really what we’re doing right now. And so we’re, we’re… Because I’m a software developer background, I am using Agile and story pointing, and I’m having them walk through, like, how long does this actually take?

What does your context switching actually look like? ‘Cause you have to kind of know what you’re really doing, and, like, how much customer service support takes. Yeah. How much, like, debugging takes, like, how much is actual capability development. Mm. So we’re kind of walking through that, and we’re coming up, which I love this because I have a director underneath me, and so I’m having him actually come up with some of the pointing structure.

And so we’ve decided to make a reward system where if you get this many points by the end of the year, you get a PlayStation 5, right? ‘Cause we wanna- Nice … cater it to, like- Oh, nice … what our interest is, and we have a- Nice … gamer on our team. 

AJ Nash: Nice. 

Cat Self: And, like, most of us are dorks, so it’s like, okay, well, how do I put, like, big, like, end items that if you- Oh

accomplish this many points, and then that way it’s like, I really don’t care how many points you put. Yeah. Honestly, I just- Yeah … wanna be honest. So that way- Yeah … we can track, like, okay, you’re an average of 20 pointer a week. Cool. You’re an averager of three pointer a week. Cool. Don’t really care. It’s about are you, like, are you staying within the margins of your own assessment of how much work you can get done within that week, right?

So that’s kind of where we’re at in our stage, so it’s less about the tabletops. But 

AJ Nash: it’s still gamification, right? 

Cat Self: But it’s still gamification. Yeah. That’s still 

AJ Nash: gamification. Yeah. Yeah. 

Cat Self: And it’s an encouraging, ’cause it’s also I want my team to feel seen. 

AJ Nash: Yep. 

Cat Self: I want them to feel celebrated as they’re an individuals, not as they are because of their workforce.

AJ Nash: Yeah. Yeah. 

Cat Self: So that- that’s the atmosphere that I’m trying to create right now. But to answer the other question, which I really wanna answer- 

AJ Nash: Mm-hmm … 

Cat Self: is- I think everyone can kind of take home this. Take 15 minutes. It does not have to be this big ordeal. It can be a 15-minute exercise, grab an intel report, and then if you wanna play the game of attribution, be like, don’t tell them who this report is.

Kacper Piwowar: Mm. 

Cat Self: You know, be like, “Hey, what actor does this sound like?” You know? Like- Yeah. Mm-hmm … have a game, and then let them have a discussion. How well do you know this actor? Can you identify what region they’re operating from based on this target set? Like, you know, just a way to be able to start connecting dots, right?

And patterns, ’cause pattern analysis is the bread and butter of an analyst. 

Kacper Piwowar: Yeah. 

Cat Self: And then, like, for a red teamer, and I cannot tell you how much I wish my old red team manager would’ve done this with me, what happens if you don’t get a call back? Well, crap. What could you have put in place to test out your troubleshooting?

Mm. Oh, I could’ve Google to make sure that it would’ve, like, okay, I know that there was network traffic, I probably got blocked from something else. Or, ’cause I know that the post call would’ve made it out, even if the get does- You know, like stuff like that. Yeah. So, it would’ve been so much more helpful to be like, okay, well if your Payload didn’t detonate.

How do you know the reason why? Was it because of the user permissions? Was it becau- Like, but walking through that and then the countermeasures for that, of like how do you know the logs are legit and the blue team’s not deceiving you? Or how do you- Yeah … deceive the blue team based on the logs, right?

The blue team can do it. You just got this alert. What… Do you go forward or you go backwards? Like, what do you think the actor’s next thing is if they’ve just done this thing, right? Like, those are 15-minute exercises that we can do. That would just be a fun discussion. There’s- Yeah … no, like, there’s no penalty to it, but suddenly I’m now asking questions like, “Oh, wait, where are the logs spit out?

What vendor tools do I have that would actually be where I would look this information up at?” And it changes our mindset, which is the whole point. That’s really what we wanna teach. 

AJ Nash: I, I love that. I think usually I would add something. I don’t know that I have anything to add to what both of you just said, right?

I, I think- 

Kacper Piwowar: But what are your thoughts, AJ? 

AJ Nash: Yeah, yeah, it’s really rare that I, I, I don’t have anything to add, but everybody knows that, right? Like, oh my God. I 

Kacper Piwowar: really- He’s like, “Just wait. He’s gonna take out a piece of paper. I’ve been waiting for this moment.” I got a minute. He’s 

AJ Nash: gonna take his notepad out.

No, I don’t. No, I do. I mean, I… Dude, just like an excellent point, like the ability for people to, you know, just take a few minutes like you a- like you said, just grab a report and, you know, turn it into a game, a quiz, turn it around a little bit. It just opens your mind and it gives you the freedom to think differently and, and it’s a break from your pattern.

A lot of times you’re doing the same stuff over and over again in intel. I got the same target sets, I got the same groups. Like, it does become mechanical sometimes. And that also can lead to you missing things, because y- you start filling in the gaps yourself. You, you start thinking ahead and being more predictive than you should be.

You become AI sort of in a sense, as opposed to having that moment. And what you’re talking about, we’re breaking that pattern and being able to step back from it and kind of change your thought process and work with the other person while doing that and collaborate and, and, and kind of reset brain a little bit on some of that, which is also really interesting.

And, and like you said, then you start thinking about things you wouldn’t otherwise. “Well, how would I do that or this?” ‘Cause you don’t think about that. It’s every day you’re just moving through the things that have to get done, right? No, I think that’s great. I, I don’t have anything significant to add to either of you guys’ observations.

I, I hope this is what everyone else takes away from the show. I, I can’t thank you enough for being on, Kat. I really appreciate you doing this. 

Kacper Piwowar: Yes. Thank you, Kat. For 

AJ Nash: those who don’t know- 

Kacper Piwowar: Thank 

AJ Nash: you … the Wi-Fi here stinks, Kat’s actually the one providing it with her phone. That’s how great this is. So without her, I don’t think we’d have gotten anything done.

You know, and Kacper, I mean, obviously, you know, thank you for, for being the co-host on this. Well, 

Kacper Piwowar: it was easy for me. I’m just in my home office. It’s harder for you, so thank you. That’s 

AJ Nash: true. And for everybody else, like, I wanna thank everybody who listens and watches and tunes in, you know, and subscribes.

If you haven’t subscribed yet, please do. There, there’s a lot of great content coming out. We got a lot of great guests that are coming up. Cas is the beginning of a whole new slew of amazing guests. So please, you know, recommend us to others if you haven’t already subscribed. If you don’t like the show, you know, write in.

Kacper will be happy to read all of those comments and get back to you and, and, and we’ll work on trying to make the show better, ’cause it’s about the guests and it’s about the audience. You can go to, to the website, of course. It’s, let’s see with that. Authentic8.com. It’s authentic with the number eight .com/needlestack.

You can find the podcast on wherever podcasts are. Obviously, you found us here today, or on YouTube. Like I said, please subscribe, let people know about it. We wanna be able to do more with the community, and we wanna hear more, so give us that feedback. So with that, I’m gonna go ahead and wrap it up for today.

Thanks again, Kat, for being here. Thank you, Cas. We look forward to another episode coming up soon. Yeah. Until then, this has been NeedleStack.