- [Narrator] You made it. Wow!
I assume that if you're watching this video,
the last video in this course,
I've either convinced you to consider making room
for entry level cybersecurity talent on your team,
or at the very least,
I've kept you moderately entertained up to this point.
(chuckles) I'm actually hoping it's a bit of both.
All right, now, assuming you've decided
to charge down the path of creating opportunities
for the newcomers to the industry,
you may need to convince other leaders in your organization
that this is the right approach.
You could, of course,
(chuckles) send them the link to this course,
but my guess is that's not very high on your list
of potential options for creating a business case.
Even if you have full autonomy
when it comes to staffing your team,
I imagine you'll still need to communicate
the overall effectiveness of the security program
or the area of the program you're responsible for
to the appropriate stakeholders.
Security program effectiveness is often measured
in terms of how secure the organization
believes itself to be.
Effectiveness can also be measured, however,
based on the stability and maturity capabilities
of the program, both of which are directly linked
to the teams responsible
for the day-to-day security operations.
Let's unpack that a bit.
Regardless of which of the two situations
you find yourself in, part of your business justification
should include the security program's ROI.
When you calculate the program's return on investment,
however, it's important to think beyond dollars and cents.
Consider the volatility of the program as well.
An example of a highly volatile security program
is one with high employee turnover,
several open roles that need to be filled,
and a handful of disgruntled mid to senior level resources
handling all of the day-to-day operations.
At any moment, this program,
(chuckles) which is currently hanging on by a thread,
could take a rapid and unpredictable turn for the worst,
leaving the company exposed to a dangerous amount of risk.
On the opposite end of the spectrum,
an example of a low volatility security program
is one that's supported by a fully staffed team
with a healthy mix of employees
having varying levels of skills.
And the average tenure with the company,
let's say, it's about five years.
Employee morale and retention is trending up,
internal promotions are at an all time high,
and external candidates are waiting in line
for an opportunity to interview for open roles.
This program appears to be stable,
and therefore presents very little, if any, inherent risk
to the company.
Now I know these examples are extreme.
But the fact of the matter is your security program's
level of volatility lies somewhere between the two.
I'm even going to push my luck a bit
and guess that your program's volatility level
is not quite as low as you'd like.
Building an external pool of entry level talent
that you can feed into your pipeline
as you promote internal resources
can drastically reduce your program's volatility
by increasing its stability and maturity capabilities.
Your return on investment becomes clear
when you're able to directly correlate the effectiveness
of your security program
to the effectiveness of your security team.
And with that, we've reached the end of the course.
I wish you much success in your future hiring endeavors,
and I hope you've enjoyed your time with me
as much as I've enjoyed my time with you.