Cybersecurity Success in 2026: Why Planning Early and Investing in People Wins

Aaron Crow (0:0.856): Hey everyone, welcome to the first episode of 2026 for Protect It All podcast. All right. So many companies, not everyone, but many companies set up your fiscal if you're following a fiscal calendar, you just you just started at square one. Right. So it's today I'm recording on January 3rd, but everybody's coming back to the office on Monday and the fifth and everybody you've got your

Aaron Crow (0:30.338): your full year ahead of you. You've got your full year ahead of you. You've got all this time to get things done, but if you wait, you'll lose the year. I don't know about you guys, but when I was in college, when I was in high school, anytime I had an assignment, even when my wife asked me to do something, if I needed it done in a week, I usually wait until the end to get it done. And then rush, rush, rush, rush, rush to...

Aaron Crow (0:57.826): to focus and get it done and at the last minute, right? So don't do that. Cause it's super simple, know, Q1, we know things take time. So if you're working with vendors, if you're working with supply chain, if you're working with, but you know, get it, yes, budgets are approved, but getting those things pushed through with POs and SOWs and onboarding, you know, new vendors or whatever that may look like, it's very easy to.

Aaron Crow (1:23.406): You know, Q1 turns into planning and then you're doing pilots in Q2 and you know, any delay pushes you into Q3 and then Q4 you're sitting around and you haven't gotten the things done that you're looking for. And that's where people panic at the end of the year where they've got budget that they have to spend. They can't get the things that they want. What are they going to use it for? It it it just becomes panic year after year. Unfortunately, I've seen it way too many times.

Aaron Crow (1:53.262): And not saying that it's 100 % avoidable because a lot of these things, as much as you plan, as much as you push, doesn't mean you're just procrastinating. Sometimes those things happen, right? But the better that you start now engaging with your vendors, engaging with your products, engaging with your staff, onboarding, starting HR if you're hiring people, if you're working with contractors, whatever that looks like, like the sooner that you get this thing started, hit the ground running and keep that momentum going, right? Really plan out those things.

Aaron Crow (2:24.022): And then the next thing is, is, you know, the difference of good to great. You know, what got you here won't get you there. Start planning now for 2027. That's where real leaders, you know, separate. That's where real strong programs that don't strong does not mean well funded necessarily strong programs that I'm planning for a year out, three years out, five years out. If you're only planning for this year, you're already late.

Aaron Crow (2:54.918): We know that this is a never-ending cyclical process. And we already know that I don't have enough budget probably in this year because there's gonna be things that come up that I didn't consider. There's no way you can. It's no different than car maintenance. You put money aside to replace your tires or your roof on your house or whatever that may look like, and then some X factor happens and you just didn't plan for those things. Maybe you've got a big emergency fund, that's awesome.

Aaron Crow (3:23.878): But maybe it doesn't cover it. But the point is is that there's no way you can you can plan for every contingency Or it's really difficult to plan for every contingency So if you're What are you going to do in the next 18 months? Where where do you need? people that you don't have where do you need Where are you going to of those people? Are you going to?

Aaron Crow (3:50.146): hire them internally? Is it just a short term thing? So you need to work with consultants or contractors, or vendors that can come in and outsource that capability. What tech, technology and applications and products do you need? Do you wish that you'd already started getting onboarded, getting tested, get a proof of concepts done? What about looking at your inset response plans, your disaster recovery plans? Have you incorporated all of the things?

Aaron Crow (4:19.148): tabletop exercises, like these are just all those questions that, know, obviously end of year, new year is new beginnings. You know, people start to work out routines, the gyms are always full, but don't be like most people in most gyms. know, January and sometimes February, the gyms are packed. By March, they're empty again. In March through the end of the year, they're normal. But January and February, everybody's gung ho, everybody's going, and then everybody loses, so many, not everyone, so many people lose that momentum.

Aaron Crow (4:49.702): Right, so so really think about you're at this space now. It doesn't matter what's happened in the past What can you do this year to be different? How can you make sure that you're planning? You're doing the things that need to be done into the future to be able to have the successful program the successful things that you're looking to do that your team needs that your organization needs over those things, right the other thing and this is a as a former product

Aaron Crow (5:18.966): owner, know, CTO of a software company. You know, it's sometimes hard to say this, but I'll say choose people over tools. It's really easy to get excited about. And again, I'm a nerd. I have all this technology behind me. I love new gadgets and tools and technology and all the things. But technology doesn't fix capacity gaps, right? People do. Technology can help.

Aaron Crow (5:48.303): It can fill a lot of gaps. a product is, know, the analogy I use all the time is I can buy the best woodworking tools in the world and have them all sitting in my garage. But if nobody's picking up those tools and doing something, they're not going to build the furniture for me. They're not going to build the house for me, right? I can have the best mechanic tools. They're not going to fix the car for me. I still have to have the people that can wield the tools.

Aaron Crow (6:14.886): And I can't just take any person. can have the best tools in the world. I can't take a plumber and turning him into a mechanic overnight just because I bought him tools, right? There's a level of training. There's a level of understanding. There's a level of experience. You need those people, right? So AI, everybody talks about AI. I've had many, many, many episodes. I just released my review of 2025. And I think every episode I said the word AI or somebody did, right? But AI is not going to replace a skilled,

Aaron Crow (6:44.448): individual that has experience in these spaces, whether it's IT, OT, systems, it doesn't matter. Like you're still going to need that expertise to be able to architect, to pull all of the things together. So think about where are you then in your people? And that doesn't necessarily mean that you have to hire, but if you've got a person and you have a gap, which person can you fill? Which person can you invest in to go do training?

Aaron Crow (7:11.256): to send them to training, to get them hands-on experience. That way they can become and fill that gap for you. It doesn't always mean that you have to go hire a new person. It doesn't always mean that you're having to go bring in a consultant or a contractor or a vendor. Sometimes it's putting the effort and investment into your people. Which one person is your single point of failure? And that doesn't mean that that person is a problem, meaning like they're your low performer. It can be your best, your highest performer.

Aaron Crow (7:41.423): Because if that person is close to retirement or gets another, because if they're that good, they could get offered and recruited by another company. Who knows what could happen? So if that person left, where would you be? How could you backfill them? How could you replicate or replace that? Nobody is irreplaceable. We all know that. I've left companies and in your mind, you're like, they'll never replace me in the next week. They've they've replaced you. Right. It's not that it's but there is going to be some pain.

Aaron Crow (8:9.162): If you lose that person that has those inherent understanding of your environment, they know where the bodies are buried. They built all the systems. They know all the systems and processes and all that type of stuff. It's hard to replace those things. It's not impossible. It just takes time and investment and the right person to fill in that void. And then really, where are you and how are you hoping to use automation and AI to really help in some of those places? Are you expecting it to

Aaron Crow (8:39.032): Take over? My OT folks are probably not looking for AI to really replace people. My IT people, are you? How much are you expecting that AI is going to be able to automate and take over? Or is it going to be looking at all of your alerts coming from your sock? I've got some great vendors, it's got some great automation tools coming out of the sock stuff. How much are you expecting that it's going to replace a body? All of those are great things, but hope is not a strategy.

Aaron Crow (9:9.330): You know, the Yoda, do or do not, there is no try. Right, so we need to be thinking about people, process, technology. The process things are not always sexy. know, sending somebody to training isn't always the fastest, most effective way. It's a lot easier to bring in a high-power consultant and just get it done. Which if it's a short-term, one-time thing, sure, that's a great idea, but who's gonna maintain that thing after somebody like me, somebody like, you know, any number one of the really talented people in this world?

Aaron Crow (9:38.498): come in and can help with who's gonna manage it after that fact.

Aaron Crow (9:46.733): We talk about budgets and budgets are really hard. And as you grow in your career and you get to that place where you're building budgets and you're responsible for budgets beyond just building it, but also maintaining it and following it and delivering upon it, it's really important to have a buffer. And I've gotten a lot of pushback in my career from building budgets and managing budgets from leadership because they don't like buffers.

Aaron Crow (10:15.821): buffer to them, many can see a buffer as a waste. I don't see it as a waste. It can be if it's not done well, but you have to have a buffer because we all know that there's going to be unforeseen things that come in. Now you can't buffer, you know, to act your cost or to act your estimation just because if you have that budget and you get a pass, good for you. But at the end of the year, we also know that if I budgeted 100 grand and I only spent 50,

Aaron Crow (10:45.357): I'm not getting that 50 back in next year and I can't roll it over so I'm losing it. Right. So and then that took away from other people's money. Right. So there was another organization or group within your organization that could have used that and you took it and put it in yours when you didn't actually need it. So it isn't it is important and imperative to be intentional about setting up that buffer. But I absolutely believe that you need a buffer. If you have no buffer if you think you know it's going to be

Aaron Crow (11:17.183): 105,278 and 48 cents. Man, I really hope that you're really good at math and that you're really lucky. And if you are that lucky, you should go to Vegas and play on black or red or whichever color you prefer, because you're very fortunate. Very few are going to hit, very, very, very, very few are going to hit that specific on their budget and either not go over or not go under. Scope changes, threats shift.

Aaron Crow (11:44.729): things break, leave, regulations changed, all sorts of things happen that are going to shift your budget that you have absolutely no control over and absolutely no visibility into or ability to predict. Now, of course you have some level of percentage of, yeah, I'm probably gonna lose this many people and one and a half of this and two X of that and four X of this or whatever. But again, buffer isn't slop.

Aaron Crow (12:13.523): It's really humility knowing that I there's no way I can know it all I have to put a little bit of a buffer in here because I know I am NOT God I am NOT able to see the future and predict it all because if you are Man, you've got a really good opportunity ahead of you. Give me a call and we'll do something

Aaron Crow (12:35.384): As a consultant, I say this and I don't say this because I'm, hey, come hire me. Although you absolutely should and could get outside with your blind spots. It's really easy to not see the forest for the trees, to be in your space and be so intimately aware of all of the things and not see the inherent risks that you have around you. And it's you're sitting right next to it all day long. So

Aaron Crow (13:3.763): Think about bringing out, bringing in somebody come in, do an assessment, have an advisor, bring in an operator. It's not just a consultant. Like if you're a power utility, bring in an operator from another power utility. Like there's all these opportunities with with workshops and conferences. Sit down and have coffee with somebody. How are you doing this? These are what we're doing. What are we missing? How are you doing things differently? Talk to other people in your space. Listen to podcasts. There's so many great podcasts out there now. Like again, this one I try to have people on.

Aaron Crow (13:32.527): that are talking about things. It's one of the things I love about this thing that I do here is to have these really awesome conversations so that you can potentially learn something like, oh, I didn't think about that. I've never done it that way. I've never considered that before, right? Those can be the aha moments. They can make a huge impact in your world, right? So make sure that you're buffering your budgeting time in your year to do those things. Be intentional. Go to the networking event. Go to the conference.

Aaron Crow (14:0.813): The fact that you have to budget for conference or get approval to send a person to a conference, if they're doing it right, it's a huge value, right? It's not about ROI, especially as an asset owner. It's really about making connections, meeting those vendors. Like everybody's got a product. I'm not just buying the product. I'm buying the company. I'm buying the people that I'm interacting with. I'm buying, you're building a trust. You're building a relationship. And it's the same thing with, you know, other competitors and things like that, right? It's the people.

Aaron Crow (14:30.307): I say this all the time and one of my mentors told me and I use it a lot. All business is a people business. I'm not selling a product. I'm not selling a widget. I'm selling me. I'm selling my connection. You have to trust me. We do business at the speed of trust. The faster somebody's going to trust you, the faster we're going to do business. And that works in everything. So how can you build trust? By being together, by breaking bread, by having a beer, by having a coffee, by being in the conference together.

Aaron Crow (14:59.821): by all of those types of things, right? That leads to...

Aaron Crow (15:7.215): People, people are hard. Hiring is hard. Work with people who think differently. If you are the smartest person in the room, you're in the wrong room. If you don't have people and your staff, your boss, your peers are not challenging you, there's a problem. Like you need to be willing and able to listen and be challenged.

Aaron Crow (15:36.929): without being defensive and it's hard. You're really good at what you do. You've been doing this a long time and now this person is coming in and they're challenging. Maybe they're just right out of college and they've got all these ideas and like, who the hell are you? Right?

Aaron Crow (15:50.809): But people that think differently, this is the true diversity, right? Diversity is not what you look like or what, obviously those are some things that go into diversity, but that's not what I'm talking about here. The diversity I'm talking about here is how you approach a problem. And many times the reason that you approach things differently is because of your experiences, what you've done, where you've worked, how you've approached problems, how you were taught something, how you've troubleshot something, right? Think about that differently.

Aaron Crow (16:18.115): Who challenges your assumptions? Who is asking annoying questions? Who isn't impressed by your slide deck? Like those are the people that you really wanna bring in closer and make up closer relationship with. As hard as that is sometimes to do. Those are the people you don't want just everyone around you to agree with you. You don't wanna have yes men around you, yes women. You want people that...

Aaron Crow (16:45.447): That doesn't mean they're being disrespectful. There's a difference from being disrespectful and just challenging you. I always tell people you should challenge, but I've also seen it firsthand in a room where leaders are standing up front and they say, hey, does anybody have questions? And I just heard somebody at my table saying, man, this is ridiculous. This is stupid. I think this X, Y, and Z, Y. And then when the leader gets up front and asks, everybody's quiet. Why is that? It's because they don't trust. They don't trust that the leader

Aaron Crow (17:12.771): will really want to listen to them without repercussions. They're afraid, they're fear of repercussions. They're afraid of standing up and that they're going to be negatively impacted by standing up and saying something, right? So there's a culture that goes there. And it starts with you being able to reach across to the person that asked you the annoying question and double down with them, right? And really want them to dive in. Why do you not like this?

Aaron Crow (17:38.989): Why are you asking this? Why do you think this? Why do you think that? Like, why do you disagree with this? Like really understanding, not from a, I'm trying to prove I'm right, but from a, wanna understand your perspective because that's valuable to me. Doesn't mean that they're right either, just means that the better you can understand their perception and their view on it, the better you can be. The better your perception can be on other ideas, right? So what are you,

Aaron Crow (18:8.907): excited to build this year. What are you really actually excited to build? What is 2026? What's on the calendar on May 5th or whatever date that is in the future that you're super excited. Maybe there's a implementation, a new product, a new team, expanding teams, training. What are you really excited for? Is it people? Is it processes? Technology? Is it a little bit of all of those things?

Aaron Crow (18:37.935): Not what you inherited, not what you're stuck with. What are you proud to be building, proud to be rolling out, proud to be onboarding people, process, technology? On the inverse of that, what are you dreading? That's the real question. Like, what are you dreading? What are you not looking forward to doing? Is it an audit, is it an assessment, is it a decommissioning of things, is it turning things off, is it firing someone?

Aaron Crow (19:6.465): Is it hiring someone? Like what, what are those things that you're dreading? Cause the thing that you're dreading is probably usually the thing that matters most. It's the thing that we put aside. It's easy to eat the ice cream. It's, it's not always fun to eat the broccoli.

Aaron Crow (19:24.995): So call to action, years along, 365 days, we're at day three, this is January 3rd, so there's quite a few days left in 2026, but don't waste it. It's a gift that we have this much time, don't waste it waiting, planning a well-executed plan.

Aaron Crow (19:51.699): You don't have to have a perfect plan. It's better to implement and take a step. Action defeats sitting on the sidelines every time. I'd rather you take action today. That doesn't mean you just, you know, fire, aim, shoot. You want to think about, you want to plan, you want to build. But that doesn't mean you sit on the sideline. You don't have to be a perfect plan. It's better to start taking actions now. So plan forward, build deliberately, and protect it all.

Aaron Crow (20:20.591): All right, looking forward to 2026. Reach out if you want to be on the podcast. If you have an episode idea, if you have a topic you want to cover that we haven't covered, there's somebody you'd love to see on the podcast. Definitely reach out. Please definitely like and subscribe. Go to YouTube and all the places that you listen to podcasts because it absolutely helps. Please comment, reach out. I definitely read them. Love, love hearing from everyone when we're at conferences. S4 is coming up. If you're going to be at S4 in Miami, definitely come by.

Aaron Crow (20:50.268): I Morgan Franklin will have a booth there as well as I'll be with the... Well, I'm drawing a blank here.

Aaron Crow (21:7.885): village village this is a break here showvick i need to cut this out

Aaron Crow (21:22.095): I can't think of what I was trying to say.

Aaron Crow (21:26.497): ICS Village Take two I'll be at s4 this year Morgan Franklin will have a booth there I'll also be around with ICS Village So definitely come by to Miami see come by say hi Get a sticker We're gonna have swag for ICS Village for Morgan Franklin may even have some podcast swag. So definitely come by and say hi until then Thanks again for listening

Transcript lightly edited for readability.