Unencrypted Chatter Episode#10: Inside the Mind of a Cyber Entrepreneur with Cheri Hotman

0:01 [Music] Welcome to Unencrypted Chatter, the ISC2 New Jersey chapter podcast. I'm Joe Patty and I'm joined today by Serenity Smile. Hi Serenity. >> Hi Joe. Hi Sher. Sherry is from the Hotman Group and this is a company that she founded. We're here to ask her about that because this is part of our entrepreneurship series. >> Awesome. Thank you so much. I'm so honored and excited to be here with you guys. Really appreciate it. >> Jerry, we we're wondering what made you decide to start your own cyber security company. >> That's a great question. I was in corporate for most of my career and

0:49 enjoyed it. You don't know what you don't know. And then unfortunately corporate sometimes can run a little bit on the toxic side. was in a situation that was really kind of not ideal and taking toll on my health, taking toll on kind of how I thought about people in life. I talked to my husband and I was like, I got to do something different. The the reality is I'm a complete and total nerd and I love cyber security and I love helping companies be better and people and data be really protected. It was a great opportunity to kind of switch to the other side where now I don't just pour everything into one company, but I'm able to spread and help a lot of different companies and and a lot of different viewpoints and a lot of different problems and challenges to

1:35 solve. So, it's it's really awesome being on the other side quite frankly. But that was that was almost that's uh nine years ago. That's been a while. Well, I think you achieved everyone's dream, which is to say I'm dropping this job and being my own boss. >> Yeah, it's not without its ups and downs. So, well, it's funny you say that, Joe. So, someone would say to me, "Well, you don't have a boss." Oh, I do. I have 50 bosses, whatever number it is, because it's all of our clients and all of the staff and partners and everybody. So, I got bosses everywhere. >> You had said that um you know, you left because you were in a toxic situation. You start your own company. I guess you've got the chance to define uh the culture yourself.

2:22 >> That is so true. And we do at H Hotman Group. We are very intentional about our culture. We want to truly value people. What's really fun about being at this stage of my career. What's really awesome is there's so many of these young upand cominging young from my perspective upandcoming folks that are super smart and super excited and passionate about things. And it's really amazing to be able to bring them on the team and just watch them thrive and watch them grow and be able to kind of mold and shape them with my experience and kind of what I've done, but with their just tenacity and critical thinking and, you know, their perspective, which is different than mine because we're separated by time and and and that's really awesome to see. Sherry, you said that you do everything,

3:09 but you when you got started, did you have the intention of starting this as a oneperson company or did you always intend that you would hire people and grow it? How did you how did you figure out how to start it? Did you know anybody >> that ever did anything like that? >> That's a great question. I I think I would love to take full credit for everything, but that's not the way life is, right? So I think you know part of it is you just go after something and it unfolds and unpacks as you go. And did I ever intend to grow with team and staff? No, I don't think I really ever thought about that honestly. I really just thought about quality of life. Uh which is something we very much value is maintaining good quality of life, what

3:54 that would look like. And then I've done contracting in the past. So I'm like I'll just go work contract like that's really no big deal. have done it before. It kind of went to that and then one thing happens and you start to develop a network of partners and you start to to meet companies and then it all starts to kind of unfold and come together. There were days that I was like okay I don't know what just happened. Um, and then COVID was right in the middle of like all of that, which is crazy because you would think like that would be like a big deal breaker. But can I tell you the COVID year was like one of the busiest years honestly, which is crazy cuz people were working from home. Cyber security is really a big thing. We ended up doing a lot of that. So I I didn't really plan for this to happen. I think I probably would have been like, "Oh, that'd be cool if it got to that, but

4:40 it's not like I intentionally went after that." Um, and I was pretty much soloreneur in the beginning and I I was fairly content with that. But at some point it got more than I could handle. And so then it's a case of well, do you dial it back and just keep it at a level where you can handle it by yourself? I really didn't want to do that cuz I love what we do and I love the value that we're able to provide to companies. Then it was a case of, oh, well, let's do this thing and instead of just hiring the random subcontractor, let's really start to to grow the team and really start to groom the folks and pour into them and and do even more amazing things. And can I tell you that's exactly what's happened is now on the other side of this, like we do way more amazing things as a team than I could

5:27 ever have done by myself, quite frankly. >> Well, that's great to hear. And uh it sounds like you're in a very good place, but I have to think there were a few bumps along the way. A few surprises. >> A few. A few. A few. A few. A few. >> What was the biggest one? >> Or the one you expected the least maybe. Whichever. >> Well, the biggest one, and it's still the biggest one, quite frankly, and I knew it going into it that it's it's the whole sales cycle. I I'm a nerd. I just want to do the work. just give me your big give me your toughest challenge, your biggest problem, and I just want to solve that. And then building a company and outreach and marketing and sales and all that stuff. I knew that would be a problem from day one. The good news is there are great people out there that

6:12 are really, really good at that and we have folks on our team that are amazing at those functions. It's it it's something we just tackle every day. I think the thing that was surprising is, you know, I was raised in the era when we were told, "Oh, you can do anything. You could do everything." It's really not exactly true. You maybe can force yourself to do things. But the reality is when you align your work activities to who you are as a person, then you enjoy it. You're good at it. It just kind of flows. When you start trying to force yourself to do things in areas that you aren't really that great at necessarily, sure you can do it, becomes

6:57 very hard and burdensome and overwhelming and then the fun just goes away. That was really kind of the biggest thing is when I got over myself to realize, no, I don't need to be a marketing expert. I need to go find and partner with a marketing expert. No, I don't need to learn how to read legal documents. I need to have a GC who can do that for me. And once I realized that shift, my brain got a whole lot less burdened. So that that was a tad bit unexpected to be quite honest because I thought I could do everything. >> How long did you operate as a soloreneur then before you figured out that you needed help? >> Um, it's a process, Serenity. If you ask the team, they would probably say she's still in the cycle of figuring this out, getting better and better at it every

7:43 day. I think it's a process in life. Uh but it was a few years into it honestly and then when it started to get so big and operations and I I think really when it was growing the team is really when it starts starts to to change because then you now you have more things you have to deal with. Now you have HR that you need to deal with. And then when you you know start closing deals with very large companies, you've got their procurement and their legal staff. And it at some point I just realized I this is beyond me. I can't do this. And it's time for me to be a little humble here and realize I cannot do this. But the cool thing about it is, and this is where we're all better together than individually, any of us, there are

8:28 people out there that are really good at where I'm not good. And it's true of all of us. I think you just have to take a hard look at yourself to say, where am I really good? And that's where I'm going to press in and push in. And then where I'm not as great or where maybe it's stressful or burdensome to me, I'm gonna go find somebody else that they love doing that stuff and let them do that. >> Yeah, that makes your life so much easier when when you can do that. >> So, was there besides knowing you should get learning about the joys of getting uh getting help and not doing anything yourself? Um, was there anything um that you learned um along the way that you wish you had known uh before starting? >> Let's see. Anything I wish I had known before I

9:15 started? Well, I wish I had known that because then I would have just approached it in a in a different manner. All in all, I I think it's just your brain like the bad things in the moment are very overwhelming, but then but when you look back, you're like, it wasn't so bad. I really wasn't. Yeah, I'm I tend to be a very trusting person where definitely I expect the best of people and I think as an entrepreneur sometimes you have to balance having a love of people and trusting them with maybe sometimes people don't have our best interest at heart. That's some you know that you kind of unfortunately learn the hard way as you go through. So maybe it would have been nice to have a little heads up to say, "Hey,

10:01 sometimes people aren't exactly what they say or maybe they don't have your best interest in my heart." Things like insurance and legal documents and unfortunately those feel like very bureaucratic type things, but they have a very real mechanism and they help to kind of set things out. So that's just the reality, but I tend to kind of flow with it and go with the ups and downs. But yeah, any entrepreneur I would tell them I I actually talk to people who, oh, I just read my own documents or I send them through chat GBT. It's fine. And and any attorney will tell you like it's better to have that conversation up front than when you're in the middle of like a situation. being very mindful of the liability that you're taking on as an organization, the risk, and not that we've any really had any major issues along the way, but it's just it's just

10:48 kind of having that kind of healthy fear to, okay, we need to make sure things are in a good state and everything's on the up and up and we're all kind of marching towards the same goal. So, that's good advice for I think any business owner to think about that. >> Well, it's so funny because you say you're trusting and need a level of trust to be in business. Boy, most of the security people I know are are paranoid. I know I am. So, good for you. You know, >> trusting of people paranoid of how things are designed to protect companies. Yes, absolutely. That's funny. That's a good point. Jerry, is there anything else you wish you would have known like when you

11:34 started that would have made your life easier or advice to your advice to your younger, more inexperienced self starting out? >> As far as the business itself, it's good to have a plan. You asked me earlier, did you plan for it to be what it is? No, not really. It's good to have a plan. Maybe it would have been better to have a a plan earlier on and be a little bit more intentional, but things tend to kind of work out and you just keep pressing in. So, while being intentional and having a plan, I would probably say yes, that probably could have saved some angst probably could have been a little bit more intentional about some decisions. Uh, probably could have made some things happen a little quicker. But on the flip side, you know, if you're so rigid about a plan, then,

12:21 you know, maybe you lose the joy of it. So, I think it's a balance, honestly. So, so I I think there could have been better opportunities, and I think any business owner should should have a plan and should think about those things, but I don't think you can be so fixated and set on your plan that that you like miss the moment because there there are things that happen in the moment that we talk about it all the time. Like there are things that happen that we could not have planned is the reality. There's an element of just going and being hopeful and being expectant and just keep pressing in and digging in and making things happen. And then there is this very much a balance of being intentional, being a good steward of what's put in front of you, making good business decisions, not just for today, but for long term, and really balancing

13:08 all that together. So, I I would probably say to my younger self, you know, what do you want out of this thing? What really are you going for? I honestly didn't didn't really think that much about that back then. I just kind of lived in the moment. >> Wow. So, you didn't have a formal business plan when you first >> I did not. I know it's shame. >> Well, I'll say this and this will probably resonate with those. when you're in a corporate situation that's very personally stressful and that is very difficult and taxing when you come out of that like there needs to be time of healing for that. So really quite honestly when when I left corporate I just walked away like I was like I'm just done with this whole tech thing and

13:53 security and just go away. I actually went but I wanted to be I like people. I fundamentally like people. I wanted to be a better leader for whatever came next. I actually took time and did a coaching training and certification and really like really kind of invested in myself to just how I think about people, how I empathize, those types of things. Then when that was done, it kind of helped me and that was I think it was like nine months or something and then that kind of helped me to get over that. So then after that I was content with just being a soloreneur is the is the reality until it became clear that there was opportunity for for something different and then just just kind of

14:39 started walking that path. So, I feel like that resonates with people because when you're when you're coming out of those situations, some sometimes maybe that's not the best time to make a decision because maybe you just need to give yourself a little bit of time to heal and recover and then okay, what is my next move? But don't don't do nothing like do something. That's where you know in that inter room what can you do to make yourself more valuable, more able to step into whatever your next thing is. So, while yes, I did not have a plan. You are correct. That was my my kind of next move plan. >> Wow. How how many months did you give yourself? >> Um >> yeah, I think it was like nine months. I want to say I want to say the training was like eight or nine months and then maybe a few months after that and then I

15:25 then I then I started pursuing people that I knew in relationships and companies that needed help in this area. And then here here I was off. It didn't take long. I call it a vac. It's like a black hole. Like you try to get out and it just sucks you right in. Cyber security you try to get out sucks you right in. I try to get out suck back in. >> All right. >> Did you did Did you um get your first customers and then decide to start a business or did you start the business and then get customers because I've I've heard both, you know, as advice. >> Yeah. No, I started the business right actually right before I left corporate. I actually established the LLC, started the business, had that all ready to go,

16:11 and then I did my coaching training, and was just trying to figure out like, okay, what am I going to do? And that was all ready. So, that that was pretty easy, honestly. >> Okay, we've got time for one more, and let's uh let's talk about some security. One of the things I one of the things I I love about talking to consultants is they they see so much you know they see a much wider um you know broader set of things than people. When it comes to security these days with your clients um do you see areas that what are the areas of opportunities? Where do you think um you know customers right now are being underserved? >> Being on this side of the world in the consulting world, you definitely do see a lot. I we like to joke that we we live in dog years basically like one year is

16:58 equivalent to seven years because we're we're dealing with different industries, different size and scope of companies, different problems. They're very complex problems and so a lot of different people, personalities, just all of the different flavors and you're doing all of that simultaneously. Uh, so it's really fun. I enjoy it. It's very fast-paced, obviously. But yeah, uh, in all seriousness, there there's a lot going on out there in the world of cyber that that we deal with every day. Um most every client we have is underst staffed when it comes to what they they need to get done. And then we we do a lot of well we do a lot of building and implementing and running the cyber

17:44 program which the urgency of that comes a lot of times through compliance because companies are getting pounded up one side and down the other for how do you do this and how do you do this and answer this thousand questionnaire and what certifications do you have and why is the certification two days late and all of these different things. So we step into that space to really help them, but we do it in a way of integrity that actually builds right security that ultimately protects the business, data, and people, which is the intent of why we do all of this. I literally said this today multiple times with a client to be clear, compliance, compliance's intent is to protect the organization. It's to mitigate risk. Like let's be real clear, that is what compliance in is. That's what the intent is. Now, what people

18:32 have done to it is is not not the intent. That's a big problem I see as well out there is, you know, oh, check. I've got this. We're good. No, you're not necessarily good. Again, compliance is intended to help a company to give them a baseline to measure them, but also to help a company with how what does right protection look like? What are the elements of that? And every framework and every regulatory has different flavors of that, but there's tremendous overlap. But the bottom line is build a security program that identifies and mitigates risk and run it well, monitor it, continuously improve it, and keep going. Like this is not hard. But unfortunately, I I see a ton of that. We see a ton of that where

19:18 people are just they're they're over they're overallocated in their jobs. The teams are probably really small or non-existent. A lot of times heads of security or your top security people just get tasked with, hey, do this too. Even though they're already doing one and two jobs, they're just trying to survive on any given day and just get stuff done. And I get it. I get it. But that's not really the the best way to protect companies and data. So that's a huge problem out there. And it all starts with that that customer pressure. And it definitely is a resourcing problem, you know, at its at its core. And then unfortunately, you know, I talk about this a lot. Human nature kicks in. And, you know, if if I want to be more healthy, what do people do? They take

20:04 pills and they, you know, go to the gym one time and expect that everything's going to it's just that's human nature. The reality is, if you want to make real lasting change, if you want to protect companies and data and people, it's hard work. You got to go to the gym every day. You got to change the way you eat. You got to change the quality of the food you eat. like you got to watch your stress level. Like there's a lot of different components to this thing. And it's no different in cyber security. There is no I keep my Oh, somebody Oh, no. Here it is. I keep my my easy button. >> That was easy >> because it's not easy. It's it's really hard work. A lot of executives just don't know what they don't know quite frankly. And then there's a lot of unfortunately sales noise out there. you know, oh, push do this and it's easy and do this and it's

20:50 done. And that's not reality either. Um, the reality is these are these are programs. These are whole practices and disciplines and you have to build them well to mitigate the right risk for the organization. Run them and keep running them. That that's the main thing that I see. That's huge. >> Wow. Reality, human nature, all those annoying little things we have to deal with. That's the that's the real heart of security. Those are the tough parts. >> It's all about people. I say that on a regular basis. Like AI is not taking over the world tomorrow. It's just, you know, you can buy all the technology you want to buy. Tech technology is great. I'm a tech nerd. I love technology. But the reality is this is people process game as well. Just what you said, it's a people game. You know, so much of what

21:36 we do in cyber, we have to get people to change. We have to get people to do things a different way. Well, that's a pe that's a people game. That's not buy the next technology. That's really take that's that's where the coaching comes, you know, that I did all those years ago. That's where the coaching comes in is really helping people to understand what their role is, why it's important, what they need to do, and then then you get your stick and you hold them accountable in a nice way, and you help to keep them where they need to be. And that's a big piece of what we do in cyber. >> Okay. >> Thank you, Sher. >> Thank you, Sure. I really appreciate you taking the time to let me join your show. Thank you. >> Thank you so much for coming. We really enjoyed learning from your experiences and your wonderful analogies and really hope to speak to you again because I

22:23 know that we could talk for hours all three of us about >> I think we could and I would I would appreciate that. Thank you both so very much. >> Okay. Thank you audience for taking the time to listen. >> That's right. Thank you Serenity. Great doing this with you. Thank you Sherry for joining us and thanks to everyone for listening. [Music]