Building the Cybersecurity Community: From 120 People to 3,000 at CYBR.SEC.CON

Cold Open: Two Guests, One Community

Aaron Crow (0:01) Awesome. Super excited today. I've got two people with me today. And we were just talking old technology and all the things that we probably remember, and many of the people listening to this podcast may not know we're talking about. Everything from Trash-80s to old Macintoshes and all that entails. So with that said, Sam, Michael, thank you for joining me today. Michael, why don't you start out? Tell us who you are, background, all that kind of fun jazz.

Michael Farnum: A Kaypro II, a Tank, and the Plants at Texas City

Michael Farnum (0:25) Yeah, man. Thanks for having us. Really appreciate it, Aaron. Michael Farnum, CEO of CYBR.SEC.Community. Background is old Mississippi boy who got exposed to computers and stuff like a lot of people did not. So, yeah, what we were talking about before, I had a Kaypro II portable computer that weighed probably 50 pounds, made out of stainless steel, I think. Back in the day.

Michael Farnum (0:52) It just got me interested in doing computers and stuff. So went to the Army, did not do computers in the Army, drove a tank. But you know, still it was fun, had a good time, and then got out in about ninety-four, I think, is when I started my IT career anyway. So I was going to a local community college and started working for a PC building, networking, you know, desk technician, LAN.

Michael Farnum (1:21) Like building, running cables and all that stuff and just kind of went from there. Have done pretty much everything you can do under the sun when it comes to IT and cyber. I mean, I was a practitioner for multiple years. I was security manager, did two stints in healthcare. My big OT connection back in the day anyway was when I, before I got into IT, I worked down in the plants down in Texas City and all of that area.

Michael Farnum (1:51) Doing surveying work and stuff down there. Wore my hard hat, my safety glasses, and my steel toe boots and all of that stuff back in the day. And then made my transition into the dark side of the force as a pre-sales SE with Accuvant, if people remember them before they became Optiv, them and FishNet gathered up. So worked on that side, then went.

Sam Van Ryder (2:11) Yeah.

Aaron Crow (2:12) Mm-hmm.

Twenty Years Together, and the Company They Built So They Could Work Together

Michael Farnum (2:17) Did vendor stuff. Sam and I had a brief stint, I think, like about five minutes at HP together. Sam was my sales guy at Menninger Clinic when I was a security manager. And then we always wanted to work together, so we created a company so we could work together. But yeah, did all that, worked in vendors, worked in resellers, worked as a practitioner, been kind of on all sides of the.

Sam Van Ryder (2:25) Might have been ten.

Aaron Crow (2:37) Ha ha.

Michael Farnum (2:47) The coin from an IT and cyber perspective. And now we started this. Obviously we started what was called HOU.SEC.CON way back in 2010 and ran that conference here in Houston as a small regional conference for years and years and years, and then it kind of blew up on us after COVID. And now it's called CYBR.SEC.CON and we've got the CYBR.SEC.Community. We've got multiple events and all that. So that's what I'm doing full time now. I finally.

Michael Farnum (3:17) Got to pull out of the whole reseller and practitioner world and now I get to run this thing. I'm not sure I made the right choice or not because this is not an easy job, but it's also, it's fun though. I get to do what I want to do and get to play Switzerland with the vendors. I don't have to pick sides and try to figure out margins and figure out what's the best tech and all of that stuff. So that's what I'm doing today. And I'm running as president for CYBR.SEC.Careers, which is our nonprofit that does workforce development.

Aaron Crow (3:26) It is not.

Aaron Crow (3:38) That's awesome.

Michael Farnum (3:46) For getting people into cyber, for veterans and students. So yeah.

Aaron Crow (3:50) Outstanding. Awesome. I mean, just a few things, just one or two things.

Michael Farnum (3:53) Yeah, just a couple. I mean, also do advisory work and we have some venture stuff that we're doing. So there's a lot in there. But.

Aaron Crow (4:00) Yeah. That's the fun thing that I, you know, I get that conversation all the time. They're like, when do you sleep? Because I've got a podcast and I do consulting and I wrote a book and like all the things, just like when do you sleep? I'm like, I enjoy this. Like, you know, these are the conversations that keep me motivated and hanging out with people like you guys are what drive me to do more. Like, you know, well, Michael's doing all these things. I'm.

Michael Farnum (4:08) Yeah, yeah.

Aaron Crow (4:27) I'm lazy. I need to pick up something else and start doing something else, right?

Michael Farnum (4:30) Vice versa, Aaron. I look at what you're doing and do the same things. Like, I'm not doing enough.

Aaron Crow (4:35) That's right. That's right. All right, Sam. You're up, man.

Sam Van Ryder: Switzerland, CAD, and the Alfa Romeo

Sam Van Ryder (4:38) Yep. For the record, Michael and I have been talking about him doing this full time for a while now, for a few years. And when it finally hit, it was supposed to be one job. So that's on him because he's CEO. So it's all on him now. Yeah. So the buck stops right there. So anyway. Yeah. So I, speaking of Switzerland that was mentioned earlier, that's where I grew up.

Aaron Crow (4:48) Right.

Michael Farnum (4:48) Yeah. I did add a little more than I was supposed to, but that's all right.

Aaron Crow (4:57) That's right. That's right.

Sam Van Ryder (5:05) And I got an engineering degree there, practiced as an engineer for several years, and fell into a sales role as an SE because it was a computer-aided design software company that my engineering office was representing, and ended up falling into sales. And you know, once, driving around a rusty old bucket of a car, an Alfa Romeo back then, and called my dad, who was back in the States, going, you know what? We have a thing called commissions here. I think you need to come back and try it out.

Sam Van Ryder (5:34) So I did. And through that, got into cybersecurity through a friend that moved over to that space from the CAD engineering world. And it was kind of cool, but it was kind of weird. I'm learning the cyber stuff, which is interesting, but it's not really my strong point. But quickly into it, started working with customers that had OT environments. And the conversations for me were like, you know.

Shouting Into the Void for Twenty Years

Sam Van Ryder (6:01) Blew my mind. Like, flat networks, open architecture, like all this stuff. I'm like, you're blowing my mind right here. And so probably a good 18 years ago or so, I started really more earnest in the space. And of course, as you know, Aaron, we've all been shouting into the void for years until probably the past 10 years where it's really started to pick up. But yeah, so I'm an engineer turned sales guy and I'm a co-founder of CYBR.SEC.Community.

Sam Van Ryder (6:31) You know, formerly HOU.SEC.CON, the conference. And that's why I'm here with Michael today, because he and I have been tied to the hip for a good 20 years now, probably, I wanna say. So yeah, and that's what I do. And I have a day job with Dragos. But Dragos has always had that, you know, socially mission oriented attitude. So it's always been fully supportive for me to do the stuff I do with the CYBR.SEC.Community, because I'm also big on growing the community.

Michael Farnum (6:40) Feels like it. Getting close, yeah.

Sam Van Ryder (7:01) Recruiting new people. You know, we need more people in the OT space. We don't have enough, near enough. And so, you know, that opportunity to grow what we're doing with CYBR.SEC, to do OT.SEC.CON, which is in the springtime, to do more to kind of educate people and get more people excited about the whole aspect of being in cyber.

Aaron Crow (7:06) Absolutely.

Why Aaron Says Yes to Conference People

Aaron Crow (7:23) Yeah. Yeah. I mean, so as you guys know, that's why when you guys asked, could you come on? I'm like, absolutely. Like this is part of the mission of me doing this podcast, is to get more awareness, people to go to conferences. And it's not to pick a conference over another. I've had other folks on here that are running events and doing things. I think there's, as we know, there's more than enough knowledge needed and there's more than enough needs across the country, across different capabilities, across different price points.

Aaron Crow (7:51) All of those things are needed. And what I love about what you guys are doing is there's more to OT than just, you know, the stereotypical critical infrastructure thing. And there that we need hacking. We need tools. We need training. We need all of those things together. And they all fit together. We know that in an OT world, it's not just PLCs, it's switches and firewalls and servers and all the things that come with that to put all those things together.

Aaron Crow (8:19) So we have to understand all those things. And that's why I love this type of model. And obviously you guys being close in Houston and all that for me is obviously an easy one. But you know, how, why did you guys get started on this? How did you start with wanting to run an event? Cause I've ran events and I do run events and they're not easy. They're fun. I love them, but they're also, when I'm done with it, I have zero energy and I sleep for a week because there's so much effort that goes into doing an event, even at the level I'm doing with.

Aaron Crow (8:48) Fifty to a hundred. I can't imagine the exponentially how much more it is as you start adding into the thousands of people that show up.

It Started as a Desire to Build Community

Michael Farnum (8:57) Yeah, I mean, honestly, Aaron, and I think Sam will back me up on this. It's exactly what he said. It was a desire to build community. I mean, before we started the conference, when I moved into that SE role, I just looked at it like, well, I already connect with people. I was already doing podcasting. I was already doing a lot of blogging before that. And I connected people at large conferences.

Michael Farnum (9:26) You know, national conferences, RSA, Black Hat, stuff like that. And it was just like, when I come to Houston, I'm looking for a conference that I can just go to here and not, you know, make my employer spend thousands of dollars to send me, even though they were perfectly willing. I was in healthcare at the time and they were perfectly willing to do it because they knew doctors needed continuing education and they were fine with anybody else who needed that. So I was like, okay, I'm gonna take advantage of that. But here in Houston there really were.

Michael Farnum (9:54) The only conferences that existed were like vendor cons, just straight vendor cons, right? And nothing against vendors. Like they're out there trying to sell. I've worked for them. Sam works for one. Like, I mean, that's just part of it. But there was no true value because it was just pitches and stuff that they were doing. And it was just very annoying to have that in a local.

Aaron Crow (10:02) Yep.

Michael Farnum (10:22) At the local realm, if you will, of Houston and in Texas, that there just wasn't anything really valuable. And this was really before all the regional conferences were popping up. So I started a user group. There was this little group out of the East Coast called the National Information Security Group, or NAISG. So they were kind of like an ISSA, but they were free, the membership was free and all that stuff. So started that.

Michael Farnum (10:48) Sam came out to a lot of those and helped me with those. So did another buddy of ours, David Nestor. We did a lot of stuff there. And we probably, I don't know, Sam, probably had what, 30, 40 people every time or something. Not anything great. But it was continuous, like the same people. And there's a CISO here locally in Houston, Peter Hill, that used to go to those user groups. So the people who came to the first HOU.SEC.CON I call OGs, he's an OG OG because he was going to the user group too.

Sam Van Ryder (10:57) Yeah.

Aaron Crow (11:15) Right.

"We Need to Start a Conference." Four Months Later, 120 People.

Michael Farnum (11:18) So we started that and then we just kind of got, it was kind of like this one day I was just like, we need to start a conference. And I think most people were like, you're out of your mind, because that was like in June that I thought about doing that. And I think we did it in like October, Sam, or something like that. So just a few months later, but it was 120 people. So but the.

Sam Van Ryder (11:32) Yeah, yeah. It was a few months later.

Sam Van Ryder (11:39) Yeah, a hundred and twenty people, but the lineup of speakers was incredible. And like you. Yeah.

Michael Farnum (11:43) I mean, Jeremiah Grossman, RSnake, Dan Kirkendahl, like just, it was phenomenal. It was in the Microsoft offices and we literally served Jason's Deli for lunch, right? It was just not super sophisticated. But it.

Michael Farnum (12:04) It started a community and it was something where some of those people worked for vendors, but they were people who were known to give good talks. And that was really the reason behind it, was to build out that community. And we just never expected it to do what it did. It was very much organic growth over the years. We had the advantages of Sam being a salesperson, me being an SE. Like anybody we knew, we would go see customers constantly, we would let them know.

The Marketing Slick He Made Himself in Word

Michael Farnum (12:34) If I can find that original marketing slick, I'll show it to you. It was peak marketing, like just chef's kiss beautiful. Like it was a horrible, horrible piece of work, but I did it myself, right? In like Word or something. I don't know. So yeah, it was just all trying to build a community. I don't know. Hey, Sam, I don't know what your take is on it, but that's how I came.

Aaron Crow (12:52) Yeah.

Sam Van Ryder (12:54) No, I mean, that's the path, right? And I think to your point, Aaron, like does it take a lot of energy? Yeah. I mean, we're in a better position though, because we do have a great staff full time that works on this day to day, and that helps. But even for what we do, you know, yes, it takes a lot of energy. But the fun thing is, you'd think the day after we crash, but you're actually on a euphoria of sorts for the next few days. Then you crash the next week. That's when you start to crash.

Aaron Crow (13:19) Yeah.

Aaron Crow (13:23) That's right.

Full Circle: College Volunteers, Then Speakers

Sam Van Ryder (13:25) But yeah, I mean it's very rewarding because we have stories of people. Like I always talk about, you know, that we have college kids that come and help out with the conference. They come back the next year, they present, you know, they find a new job and then they come and present. And it's this full circle, right, of people getting into this and becoming part of the community. And last year we started this thing with YOUTH.SEC.CON, which was really cool. And we brought 75 high schoolers in, gave them their own little track.

Seventy Five High Schoolers, Then a Hundred and Fifty

Sam Van Ryder (13:54) Had them do things like escape rooms and had their own little, kind of like lightning talks and things from folks, had them walk through the exhibit hall, like give them the real experience of what it means to be in cyber. And we had a lot of those kids walk out going, wow, you know, I think I want to pursue cyber as my career. And we've doubled that this year. We're having 150 coming this year, right? And we have more schools trying to sign up, but we didn't have enough capacity to do it. I mean, we only can do so much. So seeing, you know, filling that funnel with new talent.

Aaron Crow (14:15) Wow.

The Thing That Keeps Sam Up at Night

Sam Van Ryder (14:23) Because we're not going to be around forever. And I'll tell you what, if there's something that keeps me up at night and I cannot think about this one before I go to bed, is thinking we do not have enough people. Because I start getting paranoid at that point, right? It really bothers me. And so that's what drives me getting up and doing it again every single year and continuing and then spinning off these other conferences. We have CYBR.HAK.CON, which is more.

Sam Van Ryder (14:48) That we just started, which is very technical in nature. And then we've got OT.SEC.CON, which is all around critical infrastructure, OT, that kind of thing, the usual suspects that are there. And that's growing. That's growing like 30% year over year. So, you know, that's really cool. And of course, we're in Houston, right? So we're gonna have a lot of ICS in Houston naturally. But you know, we're seeing more people come from out of state, out of town, those places too, to participate, you know. So it's really, really exciting.

Michael Farnum (15:00) Yeah.

Vendors Belong Here

Aaron Crow (15:17) No, that's awesome. And that, you know, we kind of hit on that earlier, right? Is we need all of these different avenues. And I've been a vendor, I'm a vendor now, and there's a need for those vendors. Vendors help subsidize the cost of these things. They're our sponsors, they're our partners. We know that they need to be there. Exactly. Absolutely. Yeah. No, no.

Sam Van Ryder (15:34) You have good talent to talk. You have great people knowledge. Like there's great knowledge at those things to share. So there's no shunning vendors at all. It's important.

Aaron Crow (15:44) For sure. And the bigger piece to that is, right, is we need to understand what's the bleeding capabilities, what's the new things that's coming out, what are the new tools that I can put in my tool belt to help defend, to help react, to help, you know, left of bang, right of bang. All of those things are up and coming, whether it's, you know, Dragos and a new capability, a new sensor, a new protocol that we're detecting, you know, whatever those things are, we have to understand those things and.

Sam Van Ryder (15:53) Yeah.

Aaron Crow (16:10) The other piece to that is the community being able to directly talk with those things and give that feedback beyond just being a user's group. Obviously, we have those types of things. But those connections that we make in these conferences are priceless. Right. And it's because we're all at the same table, right? It doesn't matter if you're, you know, Rob or you're a high school kid. Like you can be sitting at a table with people that have 30 years experience and you're still at the same table having a.

Michael Farnum (16:14) Yeah.

Aaron Crow (16:40) The same conversation and getting value both directions potentially.

Innovation: The Launch Pad and the Pitch Competition

Michael Farnum (16:43) Yeah. Yeah, that's the innovation side of it is really big for us too. What's funny is we still do run a user group. It's not monthly like it used to be, it's quarterly now, but we still have that on our nonprofit side. And I was talking to them last night about the, excuse me, hold on. Sorry, didn't want to have your listeners hear that.

Michael Farnum (17:10) The place where we are in downtown Houston's called the Innovation Hub. And they're big about trying to bring in, you know, startups, and not just cyber, like technical AI startups, healthcare, all kinds of stuff. But we've partnered with a couple of CISOs here in the Houston area and they run a thing called Launch Point Collective, and it's John Barrow and David Sledge, and they have helped us. We started it last year.

Michael Farnum (17:38) By ourselves and now we're doing it in partnership with them too, to bring all of these startups to the show and do a pitch competition. And that's one of our pillars at CYBR.SEC.Community, is innovation. And we want to have those innovative companies. And that discussion we were having last night was, they were specifically asking, I won't say their names here, but it was two very large vendors. And they were like, do you still see them in.

Michael Farnum (18:04) And sorry, I have to use the term, the AI realm, or the era of AI, do you still see them as being effective against those attacks? And it's a really good question because they've gotten so big that it's hard for them to innovate by themselves. You have to have innovative companies that are going to bring a whole new approach. Like it's one thing to detect a new protocol, like you were saying. It's another thing to have a whole new approach of how you go up against modern day attacks.

Michael Farnum (18:33) And these companies, these innovative companies, are doing that. And that's a really big thing for us, is to bring them in and to show them off. So if you've got somebody that's like, I can't solve this problem with anything that exists. And my line card of vendors, I don't have anybody in here that does this because they're all really big vendors and they haven't attacked this yet. They're probably gonna buy somebody to attack it. And it might be one of these innovative vendors, but they don't have that yet. And it's like, well, we've got.

Michael Farnum (19:03) Thirty of them showing up to CYBR.SEC.CON. Come get a look, go to the launch pad, listen to the pitch competition and see if one of them fills a slot for you that you, you know, you don't have anything in that gap. So that's really big for us.

Hard Hats Need the Same Toolkit

Aaron Crow (19:19) Yeah. No, that's so huge. And that's where this is value add. And you know, there's obviously lots of conferences, there's lots of opportunity. But as we know, even with all the things that are out there, we still have a giant gap. And we have people that have been wearing hard hats and steel toe boots that need more and more knowledge to be able to transition, not away from the things that they've been doing, but add on.

Aaron Crow (19:45) More capabilities and understanding to that toolkit they already have. So they came from engineering, they came from an operations background. Everything is getting meshed in with this technology and they have to understand it, at least at a basic level. And these are very capable people, but they don't know what they don't know. Like they didn't teach this at their, you know, electrical, mechanical, chemical engineering environments or courses, but this is the thing that supports what they're doing, right? So this all matters and it's all.

Sam Van Ryder (20:08) Yep.

Aaron Crow (20:15) We're on the same team. Just because I'm talking firewalls and IP addresses, it still impacts the engineer that's configuring the PLC to run the process that does the thing that it needs to do, right?

Michael Farnum (20:27) Agreed.

Sam Van Ryder (20:30) Yeah. And I think.

Aaron Crow (20:30) So how do we continue to grow this, right? Go ahead, Sam.

It Takes a Village

Sam Van Ryder (20:33) Mm-hmm. No, no, you're good. That's a good thing. That's kind of where I was about to launch into. I think it takes a village, right? It takes a community. And I think one of the things that we tend to miss out on is connecting with each other, not just at the conferences, but outside, right? And so it's really interesting how we've been doing this now. This is our sixteenth year of doing this. We still walk into people that have never heard of us in Houston.

Sam Van Ryder (21:03) In Houston, like in the Houston community, cyber community. I mean, InfraGard at one point was like four and a half thousand members, right? And there's a large community there. So why would you not? Like, we need people talking to each other about sharing these resources, encouraging each other to share what they know. I know it's not for everybody to speak. I get it. Not everybody can get up and do that. But if you want to try, we're a great place to do it. Like, cause.

Sam Van Ryder (21:29) We're nurturing, right? We're not there to judge you or anything. We're happier there and happier sharing your knowledge. And we need more, you know, as more and more people step into that, because we are seeing more people do that. We just need more people reaching out to their peers and saying, hey, look, here's some resources you should, you know, that I use that you should also use, whether that's a conference or sites or tools or whatever they are. You know, some of that's happening. But the point is, it's usually what I see. It's usually like, I have this problem. What do you do?

Sam Van Ryder (21:55) Versus here's all the things I'm doing and here are the things that have helped me. Right. And you know, the conference is a great place to do it, but the conference also should be one of those things, right? Hey, I'd really like to do these things at this conference or that conference. Doesn't matter whether it's us or somebody else. But if it's something that you know can help somebody else grow in their career, understanding that we need to grow, you shouldn't feel threatened by, you know, the young up and comer that wants to do it. You know, we all know the threat of burnout.

Aaron Crow (22:25) Yeah.

Sam Van Ryder (22:25) So let's try and prevent it by encouraging those folks to get into it, right?

AI Is a Tool. It Is Not a Junior Analyst.

Aaron Crow (22:30) Hundred percent. Hundred percent. I mean, again, all of this is for, I'm not gonna do this forever. You're not, none of us are going to, nobody's gonna do this forever, right? And you know, that's one of the things I talk about a lot here lately because of AI, and everybody's like, well, I can train AI to be my junior analyst, I can train AI to do these things, and all those things are great, and I think we need to use tools. I don't see AI any different than automation or anything else in that way. It's a tool.

Michael Farnum (22:38) Yeah.

Aaron Crow (22:58) But I still have to train and have people to replace me. Because if I don't, if I'm taking those roles and giving it to AI to be my junior analyst, then what happens when your senior analyst needs to retire, quit, whatever? How are you going to train the next version to take his place, his or her place? Right. So we have to have some kind of process that we're giving people the training, the knowledge, the skill sets to get to that senior level. And how do you get to the senior level if you were never a junior?

Master's Degrees and No Job

Michael Farnum (23:28) Well, I mean that's part of what we're trying to figure out with the CYBR.SEC.Careers on the nonprofit side of it, is, and I mean honestly what we run into is talking about all these colleges and kids getting trained up and everything else and they still come out with, some of them come out with a master's degree that can't find a job. And it's really frustrating. But it is changing. Like, you know.

Michael Farnum (23:54) AI has a big part to do with it, but the job market is changing dramatically. And the ones that I see that are going out there and actually getting opportunities are those young people, and not just young people, but they're seeking opportunities with a passion, like really, really looking for stuff. Because again, we had this discussion last night at our user group. It was like, how is this affecting the.

The Analyst Door Is Closing

Michael Farnum (24:23) The career funnel into cybersecurity, when for the last 10 years the primary way people got into cybersecurity was by being an analyst. And that was where you earned your stripes, where you figured out what, you know, what everything was. And what young people are coming out there are just people that are entering the industry and they don't know basics of IT. They don't know how.

Michael Farnum (24:51) How a packet gets from, they see a packet cross the screen as an analyst, but they don't necessarily know how it got from one point to the next. Like with any real concreteness, if that is. They may have learned it in, like when I took my Certified Novell Engineer classes way back in the day. Like I didn't have, I passed all seven tests and that was back when you had to pass seven tests to get a certification. I passed all seven tests. I came out of that with a paper cert. I will fully admit that. Like I knew how to.

Aaron Crow (24:58) Right. Yeah.

Aaron Crow (25:14) Mm-hmm.

Michael Farnum (25:20) Build a Novell server. I knew some of that stuff, but I didn't go to college for cybersecurity, wasn't cybersecurity. I didn't go to college for IT. I took one computer class in college. Like it was not, it's, so I did IT and I learned it. And it's changed a lot. So we've just got to figure out, to Sam's point earlier, we like how do we get that filling into that role? It's like there's no true entry level jobs anymore.

Michael Farnum (25:48) And sorry, there is, but they're going away.

Internships and Volunteer Work Are Everything

Sam Van Ryder (25:50) I think it gets compounded with the fact that, you know, and I have this experience having two boys that are up and out on their own, internships are everything, right? Or volunteer opportunities. And oftentimes, you know, there's missed opportunities there for these folks, the college kids that are in college and they're not seeking those opportunities out. Because if you can put, you know, an internship, you may not have earned much, if anything, right? But.

Aaron Crow (26:00) Sure. Yep.

Sam Van Ryder (26:15) Yeah, like volunteer positions, you're not gonna earn anything there either, but you're gonna make connections that are gonna help you find that job because they know you and they know how you work. And I don't know that we're pushing them the right direction, or maybe we're not giving them enough opportunities. Maybe there's just not enough internships to go around. That may be the other issue. I don't know. Yeah.

The Devon Energy Internship Program

Michael Farnum (26:31) I think it's a combo. I think it's a combo. I'm actually talking to a big CISO here about trying to potentially bring some form of more internships. There's a few companies that do it extremely well. Devon Energy, I know you know them, Sam. They've got one of the coolest internship programs, and they regularly hire their interns. And their interns, when they come in.

Michael Farnum (26:59) They have to go to every department and learn that for like two weeks, work in that department. And then they literally have to write a paper on what they learned and what their projects was. And I've met at least one, if not two, of their previous interns that now have full-time jobs up in Oklahoma with Devon Energy. And it's an amazing program. Not everybody wants to, to Sam, to your point, not everybody wants to invest in that as a company. They just want to go have HR.

Aaron Crow (27:03) Yeah.

Aaron Crow (27:07) Sure.

What Happens When You Hand Hiring to HR

Michael Farnum (27:28) Find somebody to fill this role and it's like they're looking for the perfect person to fit this role instead of looking for somebody they can grow into that role. And that's a problem too, because we've handed this off to HR and that's the way modern companies work. It's the same thing with purchasing. Like I need a firewall. I go through purchasing and get 15 quotes and find the best one and, you know, hold my mouth just right before I can get the damn firewall that I want. It's the same thing with HR. We've.

Aaron Crow (27:51) Right.

Michael Farnum (27:55) Delegated this responsibility over, or allowed them to take it from us as hiring managers. And like that's something like we can't, that it just doesn't work. That way of hiring does not work.

The Five Dollar Bookstore in Plano

Aaron Crow (28:08) Well, you know, a couple of things you hit there. Novell, I was also Novell NetWare certified. I did MCSE, I did all, you know, CCNA. I was Certified Ethical Hacker, all of those things, right? And because I went to college for electrical engineering. I did not go to college for technology or IT. Like so nothing in my career path or my education.

Michael Farnum (28:23) Yeah.

Michael Farnum (28:30) Yeah.

Aaron Crow (28:35) Was pointed towards this, but back in that day, these things didn't exist. So I remember going to, there was a bookstore in Plano, Texas, outside of Dallas, and it was an everything's five dollar bookstore. So it was all like last year's versions of books. So it was the MCSE version X, whatever last year's version was of the book. And I would just read that because, yeah, there's maybe one or two chapters that have changed to update.

Aaron Crow (29:02) But most of the knowledge was in there. So I had a bookshelf of 200 books that I was reading and going through to take a test and study for. And I was building out labs and all this different type of stuff. But I came from that and I brought that to when I worked in the power company, right? When I got hired at the power company in 2010 to do, we didn't call it OT, but it became OT, and I built this OT program at a power utility when I started.

The Marine Mechanic and the Job Reqs Nobody Fit

Aaron Crow (29:31) Putting out job reqs. HR put a job req out there because I was hiring six people. Well, they put this requirements list that was a mile long and nobody fit. And so I was calling buddies and like, hey, I want you to apply for this, because they'd worked for me in the past. And one of the guys was a desktop admin and he grew up, he was a Motor T in the Marine Corps. So he worked on trucks and drove cars and things like that. He's like, I've never done these things. I'm like, no, but I know you can do it. Long story short.

Aaron Crow (30:01) He was a mechanic. He grew up working on, you know, rebuilding carburetors with his dad. He had the troubleshooting mindset. He could troubleshoot something. I can teach him the technology, but he had the understanding of, I could give him a problem and he's going to solve the problem. If I give him the understanding of how a carburetor works, he'll figure out, once I show him one time how to do it, the second time, the third time, and the fourth time. And that was huge. And as I built out teams.

Michael Farnum (30:09) Yeah.

Sam Van Ryder (30:10) Mm-hmm.

Aaron Crow (30:28) I let HR hire two people and I hired two people. We end up firing the two people HR hired and I hired all six people using my way instead of their way.

Michael Farnum (30:35) Yeah. Sounds about right. I mean, HR is just too broad, right? It's like you can get recruiters that are focused on IT and cyber and they can do a good job. But if it's HR, they've got everybody to hire for. They got everybody from the janitor all the way up to, you know, CEO. I mean, it's like that's just, you gotta give people the ability to figure out who they wanna hire, and when you've handed that over it.

Michael Farnum (31:03) It just messes things up, but I'll quit ranting on that.

Oren, and the Confidence That Launched a Speaker

Aaron Crow (31:07) No, I mean, I'm super passionate about that because again I think that's the place that we need to be. So how do you guys, obviously you talked about the nonprofit that you're doing training stuff. Obviously, you have opportunities and I push people all the time. And you guys mentioned Oren before we talked about this. So Oren worked with me at EY and I had him on my podcast and he kind of thought the same way. He's like, well, I'm not ready to do a podcast. I'm like, yeah, sure you are. Just come on, like we'll have a conversation, like we are here.

Michael Farnum (31:27) Yeah.

Michael Farnum (31:35) Oren? Yeah.

Aaron Crow (31:37) And then he catapulted that. I think he did a speaking opportunity with you guys. He spoke at one of y'all's conferences next. And now he's got a YouTube channel and he's doing all these things. He's speaking again this year. Man, the dude's rocking it. But it's all because he had that confidence. I didn't do anything. He had the confidence because he had done it. I push more and more people to get up and share. Like in this podcast, I have people with, you know, a few years of experience, all the way up to, you know, people with gray in their beard like us.

Aaron Crow (32:06) That have been here doing this a number of years. Both sides have value to bring to this conversation, right? You don't have to be thirty years experience and the CEO of the company to be on my podcast. All you have to do is have a story and value to bring that somebody's going to learn from. Like that's the goal.

Michael Farnum (32:12) Absolutely.

Sam Van Ryder (32:23) There's value in fresh eyes and fresh brain cells, that's for sure, right? The more brain cells we lose and the new ones that are coming in, that's a good thing. But I also think, you know, to your point, things like this, this podcast that you do, the people need the opportunity to launch somehow, right? And you take Oren. Oren's been back several times. I love Oren. He speaks really well. He brings labs, he does such a great job. And, you know, once you see that, it's like as a conference organizer, like, yeah, I want those kinds of people, because I mean you can tell they're passionate about it. I want them there speaking.

Aaron Crow (32:27) Hundred percent.

Aaron Crow (32:49) Sure. Yeah.

Content Is King: Running the CFP

Sam Van Ryder (32:53) I run the CFP for our stuff and I organize the speakers and whatnot, right? And so for me, it's always been about content is king. If you have good content, good speakers, the people will come. And that's incredibly important because we serve the community at the end of the day. If the community is not showing up, we don't have anything to do. So, and our sponsors and all everything will be, you know, unhappy. But at the end of the day, it's having good people that are engaging and speaking and.

Aaron Crow (33:08) Sure. Yeah.

Sam Van Ryder (33:19) Like this year we have Mike Holcomb coming in a day early to do his class for, you know, at cost essentially, for folks, to try to get more people into OT as well. Yeah. The second he came in for OT said, [crosstalk] he spoke in there, right? And there's a lot of the usual suspects that you and I have run around in those circles for a long time, you know, that are regular speakers, but the new ones are great too. Like I just got an email from somebody that I've been pursuing for a while.

Michael Farnum (33:26) It's the second year we've had him come out, then.

Sam Van Ryder (33:47) To come and speak that's committed now to OT.SEC.CON, and she comes from a major oil and gas company. And just, I'm super excited to have her. Like those are the kinds of wins. That's a win for me. Right. And it's a win for the community once she comes and speaks, and for, you know, all women in the community and things like that that are part of it, that want to be part of it. So having opportunities like this, you know, that you're doing as well, this is great. This is a way to get people involved.

Aaron Crow (33:58) Yep, absolutely.

Aaron Crow (34:13) Absolutely. We need more of those voices out there, right?

How Michael Got Started, and the Lightning Talk Option

Michael Farnum (34:14) Yeah. I mean that's how I started in podcasting and blogging stuff back in the day and wanted to add my voice to it, is because I met somebody who was one of the earliest ones, a guy named Martin McKay. And I met him, he was writing for Computerworld and back when Computerworld was still, you know, the massive publication that it was back then, and like just.

Michael Farnum (34:39) People just said, yeah, let's encourage you, you got something to say. And it just kind of went from there. And that's the way to do it. Yeah, Oren's gonna be in the OT Village showing off a bunch of stuff. Like it's fantastic to see what he's doing. We've got the lightning talks that we do if people wanna come in and just say, look, I don't want to do a whole forty-five minute talk, but maybe I've got fifteen minutes I can put something together. Like we've always been really passionate about bringing new people.

Michael Farnum (35:06) I met with somebody again at the user group last night and she just got a, she's been coming to HOU.SEC.CON, now CYBR.SEC.CON, and the user group for a couple of years and she finally got her job. It's not pure cyber, but it's development stuff and she's really got a passion for cyber. She's like, I really think I'm gonna submit a talk next year. I'm like, do it. Get in there. And she was just giddy about the possibility of it. I was like.

Aaron Crow (35:30) Yeah.

Michael Farnum (35:35) If you're new, I can almost guarantee you you're gonna get in because we want that new blood, new voices, everything in there. So.

Thirteen Tracks and Over a Hundred Sessions

Sam Van Ryder (35:44) Or we broaden the tracks like we keep doing every year, right? So we've got, we're up to thirteen tracks now and over a hundred sessions over two days. That's a lot. Yeah, it might be. It might be. Hard to say no to good talent, right? You know, I mean not to the.

Aaron Crow (35:49) Ha ha.

Michael Farnum (35:51) Maybe a little too much, Sam, honestly.

Aaron Crow (35:52) That's awesome.

Michael Farnum (35:56) Might have done that. Yeah.

Vendors on the Podcast: Tell Me a Real Story

Aaron Crow (35:56) But it is, and to your point, right, is you know, everybody's heard Aaron talk, you know, you listen to the podcast, I'm constantly doing it. Not that I don't bring value, I try to bring value and bring new conversations and talk to new people. But to the same point, the same reason why, you know, I have people on my podcast multiple times, but I also want new people. I want to have new conversations and different conversations, which is why my podcast is open to vendors. Come on board.

Aaron Crow (36:23) I don't want this to be a marketing ploy where you're just talking about your product and how your product is better than whatever. Nobody wants to listen to that. Tell me a real story. Tell me real value you're bringing. Tell me a difference that you're bringing, not just your product, but the use cases, the value that it's coming. Those are conversations people want to have. And then they know that you work at Dragos, Sam. So if they want to reach out, they will, right? And that comes with it. And I believe if you bring that value, just like you guys are talking about with the speakers and the opportunities.

Aaron Crow (36:53) The vendors will want to be there, people will want to attend. Like all in all, it's leveling up the community, which is all of our goals.

The Pitch

Michael Farnum (37:00) Is this the part where we let Sam do the pitch? But, can't remember, yeah.

Aaron Crow (37:02) Yes, absolutely. Get it done.

Sam Van Ryder (37:05) CYBR.SEC.Community, George R. Brown Convention Center in Houston, Texas. There you go. Yeah, come on, man. That's the pitch here, right? So I don't know that I need to pitch Dragos these days, but yeah.

Michael Farnum (37:09) The pitch about the conference. Nice. I like that.

Aaron Crow (37:17) Ha ha ha.

Michael Farnum (37:17) Yeah. I don't know. Don't think so.

Aaron Crow (37:20) I mean, if you haven't heard of Dragos, then you probably been under a rock or you're new and that's okay. Check it out. Rob does some cool stuff. If you don't know Rob, go check him out as well. I know, man. That was disappointing for sure. Yeah, I keep mine fairly short. But yeah, I mean, ultimately, like, what do you guys see? What does the future look like? What does the future look like for the conferences you guys are bringing, for the trainings that you're bringing, the next 10 years? Where do you want to be? Like, where do.

Michael Farnum (37:30) He shaved his beard though, man. Come on. Come on, Rob.

Michael Farnum (37:35) He does look more mature.

Aaron Crow (37:49) How are we going to help? And I say we collectively as a community, going to help and you guys be part of that tip of the spear of driving the community and people coming in and the thought leadership that we're driving towards.

Ten Thousand People, Without Losing the Feel

Michael Farnum (38:04) Yeah, I can speak to specific goals and then long term goals. So I mean it's nothing new, like we've literally got a five year goal of having about ten thousand people. If we can achieve it before then, that's fantastic. But it's not for us just about the size of the conference. Like we've literally got, if you've been to Houston.

Michael Farnum (38:27) Have you ever seen the George R. Brown? And it's expanding, by the way. Like it's already got a capacity for 50,000 people. So we can do whatever we want to do there. But our real goal is inside of that growth, or alongside that growth, is to keep the community feel. We don't want to become, this is not me calling anybody out, but like I went to RSA really, really, really early. Like, and Black Hat not as early, but I've been to that for many, many, many years.

Michael Farnum (38:57) Like you just hear, like people, like you used to be able to know you go to this bar or you go to this place or this restaurant, all your friends are gonna be there. And part of that is just the maturing of the people in their careers. Like they're in meetings the whole time now. Every time I used to go see them, they were all, you know, practitioners. Now they're all executives and they've got to do all of this stuff. But it just doesn't have that same feel. And one of the things we've always wanted to stay.

Michael Farnum (39:24) Aligned with is the community and not lose that. And what we've consistently heard over the last three years, even though we've literally grown from 1400 to you know 2500 to over 3,000 and trying to move beyond that, is that it still has a community feel. We still have this like the fun. Like we do the villages in the conference. Like you don't go to RSA and Black Hat for the villages. You go to DEF CON for the villages, but we keep the villages.

Villages, Ham Radio, and Picking Locks

Michael Farnum (39:52) We keep all of that stuff, the OT Village, the AI Village, the ham radio, all of those things. That gives people something to do with their hands. Go pick a lock, like still have fun with it. So we try to keep that community feel. And that's really our biggest goal is to keep the community feel. CYBR.SEC.Community as a whole, though, is, because we've got three conferences and we have a media brand and all of this other stuff, is we want to be kind of a.

Michael Farnum (40:23) For lack of a better term, a one-stop shop for people to get all of that. Like it doesn't mean that we don't want people to go to Aaron's podcast or anybody. That's not what we mean, but because we've got multiple podcasts. Our goal is to be a spot where people can go discover all of these other things. Like we've got community podcast partners and media partners and all of that where we connect. We've got, I think we're up to like six or seven media partners that are all.

Michael Farnum (40:48) Podcasters and things like that. I think we probably need to get you in that list, Aaron, so we can share. I mean, and because that's, and we work with other conferences too. That's a really big, we've got BSides Houston is starting back up. We're working with them, helping them push their stuff, get, you know, a hundred plus people in their first year. That's just the what we always want to maintain. It is not about us growing. Now, do I need to make a salary and keep my wife in the lifestyle that she's accustomed to? Yes. Like I need to do that. Do we have.

A Hundred and Fifty Dollars, Not Twenty Five Hundred

Michael Farnum (41:17) Do we have employees that, you know, they're trying to feed their family and we want to maintain that? Yes. But we're also not going to go charge $2,500 for a ticket. We're going to keep it at a reasonable level. Like right now it's $150 unless you buy the day of and it's $200. Like that, you just can't get 13 tracks and all the villages and all this stuff, have a podcast alley where you could go record your podcast and.

Michael Farnum (41:43) Do all of these things for a hundred and fifty bucks. I mean, just like, where do you get that? And that's what our goal is to maintain.

Aaron Crow (41:51) Sure. I love it.

Sam Van Ryder (41:51) And I think the indicator of, you know, Michael's talking about 10,000 people, that's an indicator that we're doing our job of growing the community, right? And so, you know, there are all the business things that come behind it. Yes, we have to run it like a business too. But if we're doing the right things, the community thrives. And so, you know, the stuff that I ask is for folks to socialize it with other people, like let them know about CYBR.SEC.Community, right? Let them know about CYBR.SEC.CON and OT.SEC.CON and CYBR.HAK.CON.

Michael Farnum (42:14) Yeah.

Aaron Crow (42:15) Yeah.

Not a Local Conference Anymore

Sam Van Ryder (42:20) So that other folks know that this exists, because we're not a local conference anymore. This isn't just some small regional conference. We've got people coming from all over the nation. We've had people come over from other countries. And, you know, we hope in that when hitting, by hitting that ten thousand mark, that we can bring that community vibe across the entire nation. I think it's possible, right? And keep it together that way.

Aaron Crow (42:39) Yeah. Yeah.

Aaron Crow (42:44) Well, then we gotta extend to other nations and continents and things like that. Cause at the end of the day, we are one big organization. Not saying you guys have to launch a conference overseas or anything, but like that's the thing. Yeah. There we go.

Sam Van Ryder (42:59) I'm doing it for Switzerland. I'm okay with that. I've already volunteered.

Michael Farnum (43:03) CYBR.HAK.CON Europe or CYBR.SEC.CON Europe and I'll stay at Sam's place over there in Switzerland. I'm okay with.

DEF CON, the ICS Village, and Why Aaron Wrote a Book

Aaron Crow (43:09) There we go. But I mean, ultimately that's the thing, right? Is I'm very fortunate and I love the community that we're in. And I get the opportunity to talk to awesome folks like you guys all the time. And, you know, I go to these conferences, you know, I was at DEF CON Singapore and I spoke at DEF CON Singapore and I spoke at DEF CON in Vegas. And it's.

Aaron Crow (43:32) It's so awesome because after you speak, these people come up to you, they're asking questions. I'm working in the village and people are asking really, really amazing questions. And probably the probability is that one of those people is going to do something incredible and amazing and make a giant difference in that community. And every one person that we, you know, pour into, even just a little bit, answering a question, helping them connect with somebody else.

Aaron Crow (44:00) We're just part of that story to get them to be successful, to be helpful, whatever. Right. And that's how I see this. And that's why I volunteer with the ICS Village. That's why I do this podcast. That's why I wrote a book. It's why I do all these things. I'm not gonna make, I mean, I'm not giving the book away for free all the time. But do I think I'm gonna pay my mortgage on a book about cybersecurity? No. Like I think I've sold, you know, maybe a thousand copies. Awesome. That's really cool.

Sam Van Ryder (44:03) Absolutely.

Sam Van Ryder (44:06) Yep.

Aaron Crow (44:27) But the cool thing is the feedback that I get from people that have read it is like, wow, this actually helped me. And even people outside of cyber, which is the whole point, is getting more people at that level, understanding, et cetera. So definitely, guys, if you have not been to one of these conferences and you're in the area, definitely come. If you're not in the area, find a way to get in the area. It's affordable. The value is huge.

Get on Stage

Aaron Crow (44:54) Amazing talkers. And then lastly, my call to action for absolutely everyone is get on stage. You have something to share. Share something. And if you're scared, find somebody that'll go with you. Like knock on my door. I'll go, I'll do a talk with you. Like reach out to some other folks that makes you feel more comfortable. That way you don't have to own it all yourself, but get out there. Cause to Sam's point earlier, we need more.

Aaron Crow (45:21) We need fresh eyes and fresh perspectives on things, to make sure that we are able to hand that baton to someone else so that we can, us graybeards can retire at some point, right?

Michael Farnum (45:33) Yeah. Yeah. I do not want to do this until I'm ninety, right? I mean there's at some point that I, maybe ninety and a half, but not, yeah.

Aaron Crow (45:37) Right. Eighty seven, maybe. So what's y'all's call to action? What do you want people to know? Other than what we've already shared.

Call to Action: September 15 and 16, George R. Brown

Michael Farnum (45:47) Yeah, September 15th and 16th, 2026, George R. Brown Convention Center, cybrseccon.com. That's cyber without an E because we're cool like that. Because the domains are easier to register, all of those things. We reduce the attack surface, blah, blah, blah, blah. Yeah, go sign up for that. Come out to it. And then just.

Aaron Crow (46:00) Yeah.

Michael Farnum (46:10) Join CYBR.SEC.Community. We've got a newsletter at CYBR.SEC.Media that is free. We do not sell your information or give that away. Just come see what we have to say and be a part of this community, man. That's our big thing.

Sam Van Ryder (46:23) And come say hi. If you're at the conference, come up, introduce yourself. We love meeting new people, right? So.

Aaron Crow (46:24) Absolutely.

Aaron Crow (46:29) Absolutely. They'll be.

Michael Farnum (46:30) We do. We may be running really fast. We will stop and say hello and then we will take off again.

Aaron Crow (46:35) Well, I'll be there. I'll be speaking as well. So I'll be presenting there, doing some fun things. So definitely swing by, come say hi, all the things. So thanks for your time, guys. We'll put all the details in the show notes. We'll have this out before the conference goes. So hopefully you guys hear it. You guys get out there, you guys reach out, and I appreciate y'all's time today, guys.

Michael Farnum (46:57) Thanks, Aaron. Appreciate it.

Sam Van Ryder (46:58) Thanks, Aaron.

---

Publishing note

At 46:35 Aaron says he will be speaking at the conference. His confirmed session, from the conference site, is "OT Is Not Hard. It's Different. A Practical Guide for IT Practitioners," Wednesday, September 16, 2026, 1:30 PM to 2:15 PM, Room 310B, Track 1: OT.SEC.CON General Session. He does not name the talk, the room or the time on the recording, so any of that detail belongs in the show notes and the description, not in a caption over this moment.

Transcript lightly edited for readability.