Channel Security Secrets

CSS - Quincey Collins
===

Quincey: [00:00:00] you have to bring value. Whatever that value is that the client is looking for. Um, you know, I think. You have to find it.

Lou: Hi everyone. I'm really inspired to chat with our guest today. He's a seasoned global Keynote speaker and United States Air Force veteran. With 25 years of experience in technology [00:01:00] and over a decade in cybersecurity leadership, he's helped organizations navigate complex security challenges on a global scale.

Previously, he worked for the US Air Force in nato, in Germany, Italy, and England, and the Department of Defense in Europe, a sought after speaker discussing the future of cyber at events like the Apex assembly and the cyber risk. Los Angeles Leadership Exchange. Today, he leads the development and execution of security strategy at an AM Law 100 Global Law firm.

He's the Chief Security Officer at Shepherd Mullin, Quincy Collins, welcome to the show.

Quincey: Lou, thank you so much for having me and, and thank you for the wonderful introduction.

Lou: Yeah. Well, I'm, it's always, uh, a great pleasure to speak to you, so I, I'm just gonna jump right into it. Uh, Quincy, you've had a great storied career. What, what's the biggest secret to your success, uh, throughout your career in security?

Quincey: Secret to success. I mean, that, that I'm, I'm always successful. But you know, I think, uh, [00:02:00] moving past the small things and looking, you know, in a strategic fashion, um, for your life, for your career. For your team. Um, and, you know, really just trying to bring value, uh, in all of the small and big interactions that I have with people has, has really helped me, one, connect with people. Um, two have a good time, and three, maybe kind of avoid the pitfalls that, you know, uh, one might have when, you know, dealing with technology. Dealing with, uh, uh, people dealing with, uh, different situations. It's uh, it's, it's tough out there and, you know, if you're unprepared, the world is not kind.

Lou: That's for sure. And, uh, I think that's good advice. But, you know, you've also, um, you know, navigated different environments. You know, when you're talking about. Living in Europe, you know, working for government work, you know, and then coming over to the commercial side, like, uh, you know, how how did that, those [00:03:00] transitions, uh, do you find like a through line?

Does that advice kind of sit with everywhere you go? Or are there different ways that, that you operate depending on, you know, uh, which environment you're.

Quincey: So I was 17, um, fresh outta high school when I joined the Air Force. Um, I actually had to have my mother sign for me. Because I was a minor at the

Lou: That's right.

Quincey: uh, maybe was kind of a, a running joke. I spent my 18th birthday, um, in basic training, uh, at Lackland Air Force Base in Texas. Um, and then I moved on to, uh, Ramstein Air Force Base, um, after finishing, um, tech school, I think. One of the really great things, um, that I've, uh, been able to experience in my career is the many mentors, um, that I had in Air Force personnel and NATO personnel. One of my mentors was actually a, um, [00:04:00] warrant officer, uh, named Francesco. And I, I really owe him a lot as he, you know, kind of guided me, um, during, during that time, uh, in my life professionally.

And I, you know, appreciate it to this day. Um, so I had a number of different, uh, mentors, both, uh, American and international, and it was, uh, kind of a, I would say a special experience. Um, for me just to have all of those different, uh, opinions, different, uh, ways of, of, of, of doing things and, um, just understanding that, you know, there's more than one way, um, to solve a problem. Uh, and then moving over to the, um, to contractor consulting in the Department of Defense after I left the military. You know, that's kind of when. The, the, the, the parachute was taken off. It's just, it's just you and you've gotta, you know, provide for your family. You've got to, um, do a, a, the best job that you can.

And I [00:05:00] learned so much, um, there as well with, you know, folks with 20, 30, uh, and, and, and more years of experience in, in government service, um, and international service as well. Um, it was, uh, just wonderful to get to know everyone and, and learn from them.

Lou: Yeah, so mentors, mentors are the key as well. And being open to that, uh, being someone that can be mentored, um, you know, and at that ripe young age, I think you were, you were ready for that as well. So that's, that's good advice. You know, you're, um, rare on the podcast because this is a podcast that's normally, uh, you know, uh, we have these trusted advisors come in and discuss what it's like to, to sell and, and how they sell cybersecurity and stuff.

And you're on the other side of that. You're, you're on the, the, the other side of the desk and you're, you're definitely a target for, for everyone because they wanna speak to you. I mean, you know, and, and we'll talk about a little bit about that, but you know. Essentially, [00:06:00] can you give anyone advice that is a salesperson that's listening on, you know, what works for you?

Like what, what, what makes a what? What gets your attention when someone's kind of coming to you for cold outreach? Or do you ignore all cold outreach?

Quincey: I think first off, I'd like to say that I, I have a high degree of respect for all of the salespeople, all of the consultants, and, um, all of the, uh, engineers, um, that are behind, um, these wonderful products, um, that are out there today because, you know, uh, CISOs, uh, chief Privacy Officers, um, uh, information technology folks, CIOs, they wouldn't be able to do what they do without. Um, these products and, uh, the salespeople, um, that are out there are a valuable piece of that whole ecosystem, right? They're introducing us to exactly what we need, when we need it, and hopefully providing value, um, uh, throughout those, uh, those interactions. So, um, with that [00:07:00] said, um, you know, let's start with the cold. Outreach, uh, you know, sometimes, uh, you know, numbers get out there. Uh, and you know, and, and I made this mistake early in my career and putting, actually putting my phone number, uh, in the, uh, the contact form. 'cause I, I was like, well, what if, uh, you know, such and such organization needs to contact me?

But what ended up happening was I had a flood of, uh, of calls, uh, uh, coming in and I sometimes would have five or six calls a day. I think it's important though, uh, to, to recognize that everyone has a job and you know, I've noticed, you know, on some LinkedIn posts that, you know, some individuals in, in high profile positions will make this big post about how they, you know, hate business development people calling them and, and all of that.

But, you know, everyone has a role to play in this, including the CISOs,

including the CIOs, Right? So we're on the receiving [00:08:00] end of these calls. And you know, my approach is that, you know, if someone does actually have my phone number, I'll go ahead and take the call. I'll listen to their, you know, their 30 sec.

Typically it's about a 32nd pitch. Um, and you know, you definitely should be cordial. Obviously, you know, you're not gonna commit to anything on that particular call, but, you know, recognizing the fact that everyone has a job to do, um, and everyone deserves, uh, uh, the requisite amount of respect with, you know, what it is that they're doing, no matter if they're a first year business development person or a seasoned chief revenue officer giving you a call to, um, you know, essentially give you an idea of what exactly. You know, they want to, you know, share with

you.

Lou: Yeah. So,

what works though, man? It's great. I mean, first,

thank you. Not that I'm thankfully not, you know, a full-time salesperson, but I am as the CEO, but not really, you know, I haven't done the [00:09:00] hard yards that a lot of these, uh, business development, um, people have and, you know, the, the. Outreach, cold outreach.

That's tough. So it's nice to hear, you know, someone who's on that, the receiving side. Uh, not be completely mean to those people, but obviously there, there are things that might work or things that might not work. So what, what works, what, you know, when they are going to, you know, coming to you, let's say it's a call.

They, they, they get past the goalie somehow. Um, you know, what are you, what keeps you on the phone? Or what keeps what? What gets you to respond to the email?

Quincey: You know, I do extensive, uh, on the market to understand who the players are. And who fits the use cases that, uh, that I'm looking to, to, to fit. And I don't think that I've ever purchased technology services [00:10:00] from a cold call.

Lou: Yep.

Quincey: Uh, it's just, uh, it's never happened. Um, uh, to, to my recollection. Um, now. I have, uh, purchased, uh, technology. Um, after attending a CISO gathering, uh, and, you know, some of my peers were talking about X technology or xve and how they're so great, right? Um, and then that spurs me to look into them, right? So that that means that they have to have, uh, you know, a good enough web presence so that I can, and hopefully they don't have all of their documentation behind a, a paywall with

your

Lou: exactly. Yep.

Quincey: Please just give us, give us the documentation that, you know, we're looking, uh, to have so that we can understand your tech. Um, but typically that's how, um, know, I might find something, either a recommendation or just my searching or me working through, uh, my value added resellers, um, to, [00:11:00] you know, give me an idea of what's happening, um, in the market. There are a number of different, um. Organizations that do, uh, you know, benchmarking, um, that that can help as well. Um, but you know, I think CISOs, and, CIOs know who the players are in the market. I think what's valuable is not dropping the ball, from a, you know, personality standpoint, being too pushy. Really just focusing on providing value. It might not be a fit right now, but maybe in six months or in a year. So it's all about relationships and building, you know, a long-term relationship rather than a short-term transactional relationship. What I found is that. You know, the, folks who I do business with over and over again, they're focused on the long term. you know, if I have a, bad interaction, which is very, very rare, [00:12:00] but if, I have an interaction that I'm, you know, not really pleased with. typically the next cycle and, let's say I did purchase the next cycle, I'm, probably making a change, whether it's the account manager or the

technology So those two kind of things, are hand in hand because, you know, culture at an organization is, paramount. And that will show, I think, in the bottom line.

Lou: Big time. So, so it's interesting what I'm hearing you say is actually where the Target, uh, podcast audience resides, which is in this trusted advisor. Community and the trusted advisors are kind of like VARs, but this is a different model and I'm not sure that you're totally familiar with it. Have, have you ever used one of these trusted advisors?

Quincey: I have

not.

Lou: Okay, so this is basically the, the model is that these are people that will kind of guide you when you say, Hey, listen, I need, often they were bandwidth or, um, you know, uh, [00:13:00] uni unified, uh, voice or unified, uh, communications, customer experience, things like that, that they might need to. Outsource that, but they don't know the vendor.

Like you don't know the vendors and you don't have time to, you know, run your own RFP, let's say, or so, so you need some help. That's where this trusted advisor community comes in. And so it's very similar to what you're talking about when you reach out to your trusted, you know, partners or trusted vendors or trusted VARs, same thing.

So, um, they will run the whole process for you and they'll bring you three quotes and typically in those three quotes. You're gonna find one, if not two of the vendors that you like and the good, trusted advisors, they know your business, they get to know you really well. They get to know your style. They get to know, you know what, what the best fit is for what you're trying to accomplish.

And so that, those are the, the vendors that they recommend because they might have hundreds or thousands of vendors for different things. In security, you know, we're part of [00:14:00] this as one of the vendors or suppliers, um, as we're called to. And in that, what we're doing is we're saying, Hey, um, you know, we, this is what we do when something comes and obviously we're doing security programs.

We do projects like, like, um, you know, like pen tests and stuff like that. But ultimately we are. Really mostly about security programs and doing it on a, a recurring basis. So you know, when something comes along that's like a managed detection response. We, we pass that along, we say, yeah, that's not, that's not our fit.

And there's a ton of vendors that do that. Some really good ones in, in that channel. When they need someone to do the people and process part, not just the technology, that's when they reach out to us. And so, you know, you would say, Hey, I need someone to come in and run GRC For me, governance risk and compliance for those that don't know what that acronym means that are listening.

And so, um, you know, for the GRC program, you might just say, Hey, I don't wanna hire someone for this. I want to do that. Um, I need a, somebody that does that. They would bring us [00:15:00] in, you know, one or two other firms and we would all. Bid and they don't care. It's kind of like a, um, a house broker, right? Or a, um, you know, someone looking for apartments or homes.

It's like, Hey, here's, I'm gonna get you all the people that fit your criteria, but, um, it's up to you, the buyer or the seller in that circumstance who you wanna, um, you know, take. So that's, um, that's what this channel is about. And now that you know that I, I don't know, I guess they'll have to, they're, you're, they're definitely gonna try to come at you now, now that you're on this.

But, but, uh, you know, you might find some, some value in that. Um, but, uh, it is interesting to know like what, what exactly with these trusted partners that you've worked with in the past, what do you find to be, you know, the, the best, the, the ones that you have the best relationships with? Or, or like, what are the qualities of those?

Quincey: You know. once you get to the point where there's, there's a good amount [00:16:00] of trust and that took years to build

Lou: Yeah.

Quincey: And it started small and it grew right? So, you know, the more points of contact that you have, um, you know, from a, a contracting perspective, um, is, is, is very, very helpful. Um. Honestly, I can't put my finger on it, obviously.

Well, they're timely. Um, they have a great engineering team behind them. They can actually bring solutions that, um, that I may have seen before, but they rack and stack and actually compare the, um, the, the, the functionality. Uh, and then they. You know, obviously can, can help on, on price as well. Um, and you know, that's just the first part, right?

Because then there's the contracting, uh, portion behind that, um, where, you know, you gotta get past, uh, legal, you gotta get past, uh, risk, um, procurement, all of that, right? It's, it's a vendor, vendor management, uh, one, L

Lou: [00:17:00] Yeah,

Quincey: And, you know, uh, unfortunately or fortunately, I'm the guy that owns the policy. So if, if it takes too long, it's uh, it's my fault, right?

Lou: well, depends, I mean, you get a lot of hands in that, in that pie, right? So, um, you ultimately have the decision process, but I think there's probably other steps there that you're not, you know, doing for, on a day-to-day basis. So, good.

Quincey: lemme just kind, uh, Go a little bit deeper in, in, in what makes, uh, a great vendor. Um, I think trust is number one. Um, they have to, to, to, to tru the, the client has to trust you. Um, two, you have to bring value. Whatever that value is that the client is looking for. Um, you know, I think. You have to find it. Uh, number three, and this is maybe kind of, kind of off the wall. You've gotta have that thing about you or that thing about your company, the thing about your product that, wow, this is, uh, this is impressive. Let [00:18:00] me look into it more. Uh, let me hang out with this person a little bit. You know, let, let me say yes to that lunch meeting. Um, right, because, you know, it's difficult, uh, to get. Um, senior leaders out to

Lou: Picked.

Quincey: just because, you know, the, the schedules are so, um, so busy and so condensed and, you know, if I've found that if I like the person on the other side of the table. much easier for me to do business with them, but it's not necessarily a prerequisite. I have a vendor who I've been doing business with for a, a technology vendor, uh, that I've been doing business with for the last, uh, three years, and I, I only met their account manager last, my account manager last week. you know, it just, it just worked. The, the technology was great. Um, and, uh, there was a, an opportunity to, to meet and, and, and we met.

And, and that strengthened the relationship. Um, so, you know, [00:19:00] trust, bringing value and, and, you know, being likable if you ask 10, uh, top tier salespeople, um, and, and this is, you know me kind of guessing here, but if you ask, uh, the top 10 salespeople, Hey, what makes you great? gonna have all kinds of different, um, uh, answers, right?

So I think you have to lean into who you are and then also lean into the needs of the customer, figure that out. Do some, uh, do a little bit of research, but don't stalk anybody.

Lou: Yeah.

Quincey: you know, what you wanna do is just, you know, get familiar and understand that it's gonna take time. Um, you know, nothing is worse than sending, you know, from a salesperson perspective, sending a, uh, LinkedIn request. Then the person on the other end accepts it and then all of a sudden you get a, a a thousand page essay about their value

Lou: Yeah.

Yeah. With no.

Quincey: tool. That, that makes it very difficult for me to understand if this is a genuine [00:20:00] interaction or if it isn't.

Lou: Right. Yeah. That's like, uh, you know, um, asking for the first date and then, uh, trying to get to the altar, uh, you know, and before even having that first date. So I, I think that's definitely, uh, a, a big mistake. We, we've spoken a lot on the podcast about, um, you know, transactional sellers versus, uh. More of solution selling.

And um, you know, what I'm hearing from you is, uh, very, I think it's codified in the, the, the phrase people buy from people. They don't buy from companies or vendors, right? So you want someone that's genuine. They have to bring their genuine self, and if they're genuinely a good person that's selling a good product or service, then you know, there's a, there's a, a connection there.

But I want to hear more about the frustration. Like what are some of the worst stories you have about kind of vendor outreach, more, you know, obviously there's the annoying bots and stuff like that, but do you have any like. A [00:21:00] good, uh, well, when I say good, interesting, bad experiences or just any frustration with the, uh, kind of salesperson vendor outreach,

Quincey: Yes. So, um, I'm, I'm just trying to pick on which, uh, which, which

Lou: right.

Quincey: Um.

Lou: I.

Quincey: I had a account manager, uh, for a technology that didn't seem to care about anything that I said, uh, on, on the phone or during video teleconferences and. Um, you know, it shows, um, now, you know, you don't have to go along with everything that I say if I'm saying something that's incorrect.

But, um, you know, we've all heard the, uh, the, the, the saying that the, the customer is always right. And in this case, I was the customer and I didn't feel, I didn't feel like I was being heard. Um, so, you know, those types of interactions, um, especially if somebody, you know, chose [00:22:00] that, you know, they really don't care about what you're saying. Um, makes it very difficult for me as a, as a customer, uh, to be on the other end, you know, thinking, you know, that I might have an ally in this person. Right. You know, who knows what happens when they have to go, you know, speak to their, uh, VP of sales to, you know, work on price or, or, or what have you. But, um, you know, I ended up requesting that this person be removed, uh, from my account. Um. The person was removed and then, um, then things went better. Who knows if you know where we landed, um, with regard to the solution, the price, the terms, and all of that would've been the same or different, but at least I felt better about the interaction. Now, you know, my feelings, uh, don't necessarily matter in the grand scheme of things, but if, if I can have a good interaction, I would rather have that than a bad interaction.

Lou: Yeah. Makes sense. And, uh. You know, the aggression [00:23:00] part too. Ha. Have you ever had like a vendor try to, um, jump over your head and, I don't know, go right to the co or, or do some kind of weird stuff where they get a no from you and then they try to get a yes from someone else?

Quincey: You know Is very rare. Uh, but it does happen. But I think it's, it's deeply rooted in, um, the sales cycle that some, uh, organizations have. It might be near quarter end, and this person is, is trying to, uh, grab at straws and doing everything and every single thing that they can do to, um, to, to get that one last sale that, you know, might keep them at the

Lou: Right.

Quincey: Um, you know, uh. The, the times that I see, um, sales folks, uh, reach out in a very aggressive manner. And then at the very end, if you haven't responded to them, they'll type, you know, this is the final email that I'm sending you. [00:24:00] Um, you know, I'm like, well, what am I supposed to do

with

Lou: Yeah.

Quincey: Um, you know, uh, and, and additionally, okay, so, so let's talk about that.

Let's, let's actually peel that back. with the, uh, the, the integration of AI in the sales, uh, arena, these emails that are going out to me. Um, or take no time from a human to, to get sent into my

Lou: Yeah.

Quincey: Me as a human, I take, you know, five seconds, six seconds, 10 seconds just to see exactly what's, what's happening. Um, as long as it's not a phishing email, um, right. Uh, but, you know, I take my time as a human to look at that and there's, there's kind of an imbalance, right? So right now with AI and sales. And, and in marketing you don't know who's who and, um, you don't know if it's a genuine interaction or, or, or not.

Lou: Yeah.

Quincey: And, you know, sometimes it's, [00:25:00] it's difficult for me to, uh, say, oh, okay, I'm either gonna respond to this or I'm not. Um, I do read my emails, um, but I think since AI has, has kind of, uh, uh, taken over, let's say, and I can, lot of times I can tell these, you know,

Lou: Oh, it's obvious. It's like,

Quincey: isn't.

Lou: Hey, I see that you did this and that and hey, you're doing this. Yeah.

Quincey: The, the funniest ones are the ones that, uh, are formatted incorrectly, like, uh, in brackets

customer,

Lou: Yeah. Yeah. Oh, those are the ones that are just like some marketing person or sales person's getting their, their butt chewed for that one.

Quincey: Yeah. Yeah.

Lou: Yeah. I mean, ai, it's funny with the bots and they, they're, many people are saying the Internet's dead now because of all the, uh, which is, we obviously know is not true, but there's definitely a lot of garbage out there, and that's low, low effort.

Um, how, how about like, let's say let's talk post-sale. Um, you know, you've got the vendors signed up, they're doing the [00:26:00] work, and then inevitably something goes wrong because, you know. There's no, we don't live in a perfect world. You know what, what do you think? Like, how, how do you prefer vendors to handle mistakes and, you know, um, you know, how do you deal with kind of the projects, um, you know, exceptions and stuff like that.

We hate that. That's why we do the, the flat rate model. 'cause we're like, you know, we're just gonna get the work done. So, you know. What's been your experience with that?

Quincey: there are two camps, um, uh, and I I find that, uh, medium sized companies. Uh, do better or, or boutique outfits will do better at recovering from, um, issues and mistakes, uh, that, uh, are inevitably made. I mean, if you're dealing with technology, you're dealing with security, you know, some things gonna go sideways and it really just matters how you deal with

it.

So I don't,

Lou: Yeah.

Quincey: raise my eyebrows at, at problems that occur. With, uh, [00:27:00] vendors, unless it's something, then it, unless it's an actual problem. Um, but you know, I think. The, the, the bad part about this is, you know, when a vendor, uh, just says, you know, or your salesperson will just, uh, kick it over to support and then, you know, you maybe never hear from them again.

They don't check in on you. They don't try to escalate on your behalf. They don't use back channels. Um, you know, the good service that you know, that I've received whenever a problem has occurred is, you know, somebody gives me a call and gives me the, uh, the understanding that somebody has the ball on the other side. And, you know, it's being, you know, pushed through even if, um, it takes a little while to complete or, or resolve or what have you, at least I know it's being handled and I don't have to go every four hours, six hours or whatever, check in, uh, or my director, uh, of information security has to check in or something like that.

It's, you know, good customer service is [00:28:00] simple. It's not easy, but it's simple.

Lou: Yeah, communications keep, keep everyone informed. Meet the. Deadlines that you, you put for yourself. Make the deadlines realistic. And if they slip, you know, again, go back to step one communication. So I think that makes a lot of sense. Uh, what about, um, you know, let, let's talk about the, we, we haven't mentioned AI yet, so we gotta mention ai.

We did talk about AI sending you emails, but like, how is AI affecting, or how do you see AI affecting, uh, security in general?

Quincey: I think AI is already here.

Lou: Yeah.

Quincey: in, uh, endpoint. uh, being utilized in, uh, uh, firewall technology. Uh, it's being utilized in, um, network access control solutions, uh, and SOAR technologies. It's, it's being used, uh, across the board already. Um, I think in the future though, uh, we're going to see a agentic AI take over, uh, where they can [00:29:00] really handle. a lot of the, uh, first tier analyst, uh, type things. So, you know, when you look at a SOAR technology security automation, uh, orchestration and response technology, that is almost automating things, but there's still a lot of human interaction. Um, that, you know, has to happen. Uh, additionally there's a lot of, uh, uh, python, uh, uh, programming that needs to occur to make sure that everything is, um, uh, configured appropriately. But I think on the AG agentic AI side, you're gonna see the, use the wide use of, uh, large language models and, uh, APIs in order to perform specific actions, whether it's triage, whether it's blocking something, whether it's, um. Pulling together a number of different tools to provide the desired. Outcome from a security perspective.

So that's gonna be pretty, um, pretty exciting. So I, I feel like AG agentic AI is gonna be like SOAR 2.0. [00:30:00] Um, I know that there are a number of providers out there, um, that are, uh, working on this and have early stage, uh, uh, AG agentic ai. But I think in the next 18 months we're gonna see, uh, we're gonna see that kind of, kind of explode in a good way, in a

Lou: Yeah. Yeah. And what are your thoughts on these? These new vendors that don't necessarily have security teams that are pumping out, you know, um, they're basically taking your data, you know, you, you know, that they've got, uh, they might have a hundred mil in the bank because they just got funded, but they're, you know, they're not really there yet.

From a security program perspective, um, do you, do you ignore those vendors completely or is there some way to kind of mitigate or transfer that risk?

Quincey: I think you gotta, you gotta take a look at vendors one by one. Um, you know, if you look at, uh, maybe some of the largest vendors that, uh, uh, exist today and most ones they've gone through, um, [00:31:00] breaches, big breaches that are, uh, publicized. They, the software that they, uh, right, uh, sometimes has, or oftentimes you could probably, uh, uh, look at it on a, on a, on a calendar. On whichever day of the week. Um, but, uh, you're, you're gonna see that these vendors are, uh, writing code that, uh, is exploitable. Um, so these are the really big vendors. Now, the small vendors, um, you know, they're, they're kind of, let's say at a disadvantage when, um, looking at, um, organizations or big organizations that are mature. Uh, in their ve vendor management process, but it's not impossible to get in. Uh, I think what you have to do as a vendor is make a good, honest effort at information security, privacy compliance, best practices, uh, and be able to demonstrate that. So, you know, if you have an ISO 27,001, SOC two, type two A, uh, you know, a sig, [00:32:00] um, you know, whatever it is, you've gotta be able to speak to that.

You've gotta have a security team. And you know, the, the, the wrong time to get a security team is after you've had a

Lou: Oh yeah.

Quincey: Because, you know, a lot of, um, a lot of incident response happens before the incident. So we've gotta be preventative. Um, and you know, what that looks like is having a fully built out security team, fully built out security program. Um, you know, get privacy, uh, uh, handled, you know, get a, get a great attorney, wink, um, and uh, you know, just make sure. Um, that you have your bases covered. Um, because, you know, if you're able to demonstrate that you know, you've, you've done your due diligence, you've made your, uh, security program and your protections to protect your customer data, your client data, um, and your company data, um, more often than not we'll say, you know, that, uh, that, that looks fine. Um, and, you know, you've just gotta put your [00:33:00] best foot forward. What that looks like is different for every company. Um, but if, if, you know, if the board has, you know, decided that cyber is a, an important thing, um, they will have that full security team built out early on in the

process.

Lou: Yeah, Yeah, I mean the, that's, that's huge. The prep phase for, uh, preparation for, for, for incident response. Um, but yeah, there's, there's a lot of good stuff happening, I think with the ai, um, uh, you know, as a, as a force multiplier for security defense. Offense on the other hand, you know, they're, they're, you know, the bad guys are getting it and they're using it to great advantage, unfortunately, but it's gonna be a cat and mouse game, just like security's been a cat and mouse game since its inception.

So, um, so yeah, that's, it's, it's interesting to see the trends. What, what excites you about kind of the future, the next five years in tech? Not just security, but kind of any technology from a business or even personal [00:34:00] standpoint.

Quincey: I think AI technology that, that works and, and fits the use case. And is, uh, I, I, I would say. AI in instead of general ai, narrow AI for security implementations is what really, um, truly excites me. Um, as I was talking about, uh, agentic ai, uh, uh, previously, that's just gonna be huge. Um, and, you know, we'll see what happens there.

I. Um, you know, it's gonna take over, uh, uh, sim as well, uh, and really reduce the amount of time that, um, it takes for an analyst to, uh, understand, you know, what's happening, uh, and right after action reports, things like that. Um, you know, what, uh, excites me moving forward, you know, on a personal, uh, perspective, travel.

Uh, you know, uh, going to different countries. Um, you know, as I was saying before, uh, you know, [00:35:00] I was working for, uh, for nato, uh, in Italy. I was working for United States Air Force in Germany and in England. Um, you know, spent, uh, some time traveling around all over Europe, hit Sweden, hit um, uh, Belgium, hit, uh, all kinds of places and, you know, I'm looking forward to traveling, uh, a little bit, um, in the next, uh, year or two.

Um, and then aside from that. Um, would love to hit the, uh, hit the racetrack, uh, again, hit Willow Springs. I heard they just, uh, paved, uh, uh, uh, the track, uh, again, and they're now under new ownership. So, uh, I'm excited to, uh, to take the race car, uh, over there.

Lou: Yeah, that's, I mean, let's pivot to personal now. Yeah. You are, um, a Renaissance man. Uh, you've, you just are, you know, whatever you choose to do, you're really, really good at it. One of the things that you've chosen to do is, uh, you're a car guy and you have a, you have a race car. Is that what I understand?

Quincey: Oh yeah, [00:36:00] so it's a 2005, uh, BMWM three and it's uh, uh, fully track prepped. So it's got a, a six point cage. It's got, uh, no interior aside from a race seat and, uh, the dash, which has been hollowed out. Uh, and it is just a blast to drive around the track. Um, it sounds like, uh. A race car essentially. And, uh, uh, you know, I, it took, uh, it was a pandemic project.

So, um, during the pandemic, uh, I actually, uh, purchased the, the vehicle and then did, um, a good amount of the work, uh, myself. Uh, and then I sent it out to, uh, get the cage built, uh, from a guy in NorCal. Um, and, uh, and yeah, so it's, uh, it's, it's a pretty fast vehicle. It's pretty light too. Uh, I replaced a number of different parts, a lot of carbon fiber. Um, but, uh, but yeah, you know, I've been into, um, cars since I've, uh, since I was, uh, a teenager or even before, [00:37:00] um, you know, driving around. Uh, my first car was, uh, Toyota Tercel. Um, I, I, I blew up the engine. Uh uh, actually, um, my mom was not happy about it. Um, but uh, but you know, that's a story for another day.

Sorry, mom.

Lou: Yeah, well, with two teenagers, I can tell you I'm, I'm, uh, you know, having some of those experiences myself with the car, so it happens to all of us. But maybe the blowing up of the engine made you wanna appreciate a little bit better how the car operates and here we are now you've built your own car and you're racing it.

That's pretty cool. What, what other. Yeah. Yeah. Well that, that's really, that, that's, that's great that you're gonna get that out too. Um, what other, uh, you know, well actually before that, what, you took a journey, right? Like, you were talking about nato, you were talking about, um, the Air Force and then being a contractor.

Um, you, you speak a couple languages, uh, [00:38:00] which goes with the Renaissance men, you know, moniker. what's up? It's true though. This is all true. All, all facts. So, um, what, how'd you get to doing, you know, what you were doing, uh, with the Air Force and you were working in tech a a bit? Uh, uh, you know what got you here?

Quincey: You know, when I was 17, um, I spent most of my time on a computer, uh, as most 17 year olds, uh, uh, in, uh, 1999. Uh, do, uh, or did. Um, now it's, uh, now it's mobile phones. And, and what I knew at that point in time is that I just wanted to get into computers. Right. Um, and I was like, oh, you know, this is gonna be a great industry.

I'm on a computer all day anyway, so I might as well work in the industry. Um, and, um, you know, my mom, she took me to, uh, the Air Force recruiter and, uh, we had a family friend who was actually in the Air Force. [00:39:00] who actually, uh, said, yeah, uh, getting into, uh, the computer operations. He, he was a bit more formal.

He was like, getting into the computer operations field, uh, is gonna be good for you son. Um, so, uh, so I ended up, uh, signing up and, and you know, the rest is, is kind of history. My path, um, to, uh, where I'm at today, uh, is, you know, essentially just. know, doing the best that I could, uh, exactly where I was.

So, you know, I went to college when I was in the military. Uh, got my Master's, uh, got my bachelor's in cybersecurity, and then my, uh, master's in Information Technology, um, after I was out. Um, so luckily the GI bill, um, the post nine 11 GI bill really supported me and allowed me to do that. Right. Um, because, you know, if it weren't for that. I don't know if I would've, uh, uh, uh, gone as far, uh, as I, uh, would have, um, educationally. Um, and then from a, um, you [00:40:00] know, uh, a certification, um, standpoint, you know, I saw your C-I-S-S-P book in, in the background. Uh, and you know, I spent, I spent many a nights, um, studying. I think it took me. Back in 20 I, I think 2013, it was six months of straight study.

And this was after, uh, I had my bachelor's in cybersecurity. So it was like, you know, it was a lot of information. It's uh, it's a mile wide and an

Lou: Oh yeah, I.

Quincey: And I

think, um, you know, as an executive. A security executive, you have to, you know, know a little bit about everything, um, in order to, you know, decide if you need to dig further or your team needs, needs to dig further. And, you know, it's all about asking, um, the right questions. Um, so, you know, when I transitioned from the public sector to, uh, to where I'm at today, um, it's, you know, it was. It's definitely more [00:41:00] linear, uh, uh, the reporting structure in a, um, uh, in the government, right? Kind of, you know, there you do, do as you're told. Uh, but here, you know, there's a lot of, uh, negotiation that has to happen. There's a lot of communication. There's a lot of, um, there's a lot more paperwork. Absolutely. Um, and you know, I think. Uh, the, the, the private sector, um, you know, it's, it's important, um, to be, um, I think more meticulous because you can kind of do more, you can go anywhere.

Um, and that in of itself, uh, uh, you know, pro a bit of risk.

Lou: You think too much choice.

Quincey: in the risk reduction

business.

Lou: Yeah, you, you mean by having too much choice?

Quincey: Yeah, you know, you can pick, uh, a vendor that's bad if you want to. Um, if you're in the, um, if you're in the, the government, you, you can select from the

Lou: [00:42:00] Right? Right.

Quincey: now your result isn't always gonna be great. Um, but, um, you know, at least they're, uh, pre-vetted when you're in the, uh, uh. Private sector, um, you're the one doing the vetting.

So it's, it's really about, you know, what matters to your business and, um, you know, uh, what is your risk appetite.

So, you know, to just kind of put a bow on it, um, what got me here today, um, I think a series of, of fortunate events. Um, you know, looking back, I've had a, a, as I was saying before, a lot of great mentors, a lot of great friends. Um, and a lot of great managers and, and, and people who have helped me along the way. No one, um, does anything by themselves. There's always a, a group of people behind them that kind of, kind of push them in a certain direction. Um, you know, I owe a lot to, uh, to my parents. To my family for, you know, setting me up [00:43:00] for I think success. Um, and, you know, it's, it's just, uh, making sure that you don't drop the ball, um, you know, uh, during your ascent, let's

Lou: Yeah. Well if there's anyone that I know that's not gonna drop the ball, it's you, Quincy. 'cause even if you bobble it a bit

Quincey: it.

Lou: Yeah, you're, you're, uh, you're a true professional and that's what I've always liked about, uh, working with you and, uh,

Quincey: Likewise.

Lou: Yeah. Yeah. So, so, um, where can people connect with you?

Quincey: Uh, people can connect with me on LinkedIn. Um, just look up Quincy Collins, uh, on LinkedIn, Q-U-I-M-C-E-Y. and, uh, and yeah, would love to connect with people, um, looking for genuine connections, genuine professional connections. And, um, looking forward to, uh, to, to, to meeting up again. Maybe you and I can have another podcast

Lou: Oh.

Quincey: Uh, it'll be, it's, it's, it's an amazing chat, amazing discussion.

Thank you.

Lou: Yeah. Yeah. Quincy Collins, it has been really great to hear about [00:44:00] your journey, hear about, you know, your secret. We're, we're gonna say really mentors and being genuine, um, yourself and expecting that from other people. That's really important. Thank you for being on the show.

Quincey: Thanks Lou. Really appreciate

it.

Lou: Yeah. And thanks to everyone else, uh, that's out there listening and or watching.

Uh, if you learned something today, uh, had had a good experience, please tell someone about this podcast. Thanks again, Quincy, and this has been another exciting episode of Channel Security Secrets. See you next time,