A Purpose Beyond Profits

In the last 12 months, if you have turned on the TV, visited a news website, or opened a newspaper, you undoubtedly will have noticed the seemingly endless array of organisations being dragged through the mud for poor ethical decision-making as a result of choosing profits above all else.

Rio Tinto blew up Juukan Gorge, a 46,000-year-old Aboriginal heritage site of immeasurable cultural and archaeological significance. They allegedly followed this up by blaming of indigenous landowners for not warning Rio of the cave’s significance (despite doing so on multiple occasions) and then telling employees they were not sorry for destroying the sites, just for the anguish caused.

AMP promoted Boe Pahari to Chief Executive Officer despite allegedly knowing he was recently penalised for sexually harassing a female colleague. Likewise, Alex Wade, the head of AMP’s wealth business, was hit with allegations he sent indecent images to female colleagues.

Westpac allegedly charged ongoing fees to people who were dead and breached anti-money laundering laws 23 million times, with many transactions going towards the child sex trade in South East Asia.

Facebook allegedly allowed the harvesting of over 50 million users’ personal data by Cambridge Analytica.

There is a common thread linking all of these companies. In every case, they clearly communicated that their purpose is the sole pursuit of profits, which lead to an overriding of any concern for ethics or consequences to stakeholders.

What do I mean by “purpose”?

Put simply, purpose is the reason for your organisation’s existence.

Take that Friedman.

Until recently, since 1970, it has been believed that the sole purpose of an organisation is to increase its profits and return value to its shareholders. This economic theory is thanks to the influential leader of the Chicago School of Economics, Mr Milton Friedman. (Friedman, 1970b) Friedman asserted that corporate social responsibility rested on the shoulders of shareholders, and any corporate leaders who pursued a purpose beyond profitability were “unwitting puppets of the intellectual forces that have been undermining the basis of a free society”.

However, Mr Friedman was wrong. Dead wrong. Since organisations started adopting Friedman’s theory, the rate of return on assets and on invested capital declined from 1970 to 2015 by three-quarters. Forty-nine years later, in 2019, the Business Roundtable (a group that represents the leaders of the world’s largest organisations) decided that the purpose of an organisation is NOT to maximise returns for its shareholders but to provide benefits to all “stakeholders”, including the community, employees, and customers.

The Egg in One’s Beer

The data supports the decision of the Business Roundtable. Jim Collins’ best-selling book Built to Last found that companies whose purpose went beyond making money paid six times more dividends to their shareholders than their profit-driven competitors. (Collins, 2005)

According to a study by Baylor University, leaders driven by profits could be damaging their profitability by losing their employees’ respect, who react by withholding performance.

Companies whose employees recognise the importance of purpose have been shown to deliver superior shareholder dividends. As a result, shareholders and the public increasingly are expecting organisations to have a purpose beyond profits. Often purpose statements have been PR exercises, highfalutin terms geared towards recruiting wet-behind-the-ears interns and grads, rather than driving strategy and performance. As reported in an opinion piece on the Environmental Social and Governance (ESG) issues, a generic ill-thought purpose creates neither social nor shareholder value. However, when an organisation develops a purpose aligned with its business, it builds and reinforces that company’s value proposition and competitive advantage.

A report from Harvard Business Review Analytics surveyed 474 global executives and found that organisations with a solid understanding of purpose can innovate and transform more effectively. The surveyed executives who used purpose as a central lever of strategy and decision-making reported an enhanced ability to drive transformational change and innovation and achieve constant financial growth.

The evidence supporting a purpose beyond profitability and serving stakeholder needs, not just shareholder needs, is overwhelming. 87% of business leaders maintain that their organisations optimise staff performance if their purpose goes beyond profitability. Nine out of ten people are willing to earn less money in return for the chance to perform more meaningful work, and staff who find their workplace and role more meaningful are 69% less likely to make plans to resign from their jobs within the next six months.


On the other side of the coin, let’s look at how our earlier examples fared with their focus on profits at the expense of all else.

Rio Tinto – A group of superannuation funds with investments in Rio Tinto and The Australian Council of Superannuation Investors admonished the board for its woeful response to the catastrophe, slammed Rio Tinto and questioned its licence to operate, and called for assurances that this would never be repeated. After the coruscating joint standing committee investigation and report into the actions taken by Rio Tinto, the three executives deemed responsible were summarily fired by the board, albeit with rather lucrative golden parachutes for their troubles. The report said it best: “Collectively, these deficiencies represent more than just a series of ‘unfortunate mistakes’ or mere ineptitude by individuals. Rio Tinto’s conduct reflects a corporate culture which prioritised commercial gain over the kind of meaningful engagement with Traditional Owners that should form a critical part of their social licence to operate.”

AMP – AMP’s shares remain depressed after collapsing from a high of $5.50 pre-scandal to a low of $1.445. Alex Wade resigned after less than a year in his role as head of AMP’s wealth business. Allegations of sexual harassment complaints against Boe Pahari and the mishandling of such claims by the company and the board of directors caused Chairman David Murray to resign, with immediate effect, and the short-lived CEO be demoted back to his old role. For some, it was unsurprising that the Murray departed. Brynn O’Brien, the Chair of the Australasian Centre for Corporate Responsibility, had the following to say, “ACCR has always questioned the suitability of David Murray for chair of a modern ASX50 company. Murray is a well-known climate sceptic. He waged war against the ASX’s inclusion of ‘social licence’ in its Corporate Governance Principles. It is quite ironic that AMP’s catastrophic social licence issues ultimately brought him down. His views on risk and governance frameworks are stuck in the ’80s and do not meet shareholder expectations of modern boards.”

Westpac – The Federal Court ordered Westpac to pay a $1.3 billion penalty for breaching anti-money laundering laws, the largest fine in Australian history. Westpac’s chief executive Brian Hartzer resigned, and chairman Lindsay Maxsted will step down earlier than planned. (AUSTRAC, 2020)

Facebook – After the Cambridge Analytica data harvesting scandal came to light, Facebook’s shares plunged 18%, wiping out almost $18 billion from their market value. Facebook CEO Mark Zuckerburg’s personal wealth fell by approximately $14 billion. The Federal Trade Commission fined Facebook $5 billion (Commission, 2019a), and Facebook paid another $500 million to settle with the U.S. Securities and Exchange Commission. (Commission, 2019b) According to the annual trust report by Morgan Stanley, Facebook is Australia’s MOST distrusted brand.

The Denouement

Purpose beyond profits is not “soft” or “wishy-washy”. It is a critical piece of a company’s long-term strategy that influences both competitive advantage and profitability. Committing to a purpose beyond profits encourages employees to utilise their discretionary energy and ensures the long-term trust of the company’s stakeholders. As I have demonstrated, the results of an unerring pursuit of profits and a disregard of potential negative impacts can negatively and significantly impact growth and profitability. The final word on purpose? It’s intrinsically tied to profitability and success. If your company wants to claim true success, a purpose beyond profits must be prioritised, communicated, and underpin your strategy.

“Profit at any price is not commerce, it’s exploitation.” – Labor Senator Deborah O’Neill

“The sense of being part of something greater than yourself can lead to high levels of engagement, high levels of creativity, and the willingness to partner across functional and product boundaries within a company, which are hugely powerful.” – Rebecca Henderson, the John and Natty McArthur University Professor at Harvard Business School.

Purpose is not the sole pursuit of profits but the animating force for achieving them. Profits are in no way inconsistent with purpose — in fact, profits and purpose are inextricably linked.” – Larry Fink – CEO of Blackrock

Author – Shannon Sedgwick

*This is an opinion piece and does not reflect the opinions of my employer. The information provided within is publicly available.


ACHOR, S. 2018. 9 Out of 10 People Are Willing to Earn Less Money to Do More-Meaningful Work. Harvard Business Review.

ACSI 2020. Rio Tinto Statement 130820.

ASTON, J. 2020a. Ancient cave scandal deepens for Rio Tinto. Australian Financial Review.

ASTON, J. 2020b. Secret recording: Rio Tinto ‘not sorry’ for cave blast. Australian Financial Review.

AUSTRAC 2020. Westpac ordered to pay $1.3 billion penalty. Australian Government.

COLLINS, J. 2005. Built to Last, Random House Business.

COMMISSION, F. T. 2019a. FTC’s $5 billion Facebook settlement: Record-breaking and history-making.

COMMISSION, U. S. S. A. E. 2019b. Facebook to Pay $100 Million for Misleading Investors About the Risks It Faced From Misuse of User Data.

COMMITTEE, J. S. 2020. Inquiry into the destruction of 46,000 year old caves at the Juukan Gorge in the Pilbara region of Western Australia.

DELOITTE 2016. Millennials want business to shift its purpose. The Deloitte Millennial Survey 2016.

FARGHER, I. 2019. How Westpac is alleged to have broken anti-money laundering laws 23 million times. Sydney Business School – Faculty of Business: University of Wollongong.

FRIEDMAN, M. 1970a. A Friedman doctrine‐- The Social Responsibility Of Business Is to Increase Its Profits. The New York Times.

FRIEDMAN, M. 1970b. The Social Responsibility of Business is to Increase its Profits The New York Times.

HBR, H. B. R. 2016. The Business Case for Purpose.

JANDA, M. 2020. AMP chairman, director resign amid shareholder revolt over board’s handling of sexual harassment allegations. ABC News.

KOZLOWSKA, I. 2018. Facebook and Data Privacy in the Age of Cambridge Analytica. The Henry M. Jackson School of Internatipn Studies: University of Washington.

MORGAN, R. 2021. It’s official: Supermarkets are the most trusted brands in Australia.

PORTER, M. 2019. Where ESG Fails. Institutional Investor.

PRESS, D. U. 2015. Shift Index. Deloitte.

QUADE, M. 2019. The influence of supervisor bottom-line mentality and employee bottom-line mentality on leader-member exchange and subsequent employee performance. Human Relations. Baylor University.

RODDAN, M. 2020. New AMP Capital boss accused of harassment. Australian Financial Review.

ROUNDTABLE, B. 2019. Statement on the Purpose of a Corporation. Business Roundtable.

ROUNDTABLE, B. 2021. Available: https://www.businessroundtable.org/ [Accessed].

Why your business is at risk from cybersecurity threats

Business Australia’s conversation with Shannon Sedgwick, Senior Managing Director at Ankura, on how to protect your business from cybersecurity threats.

Q: We are encouraged to broaden our business horizons and develop a global footprint if we want to remain competitive. However, having an international presence and an ever-evolving digital business landscape, will organisations be faced with cyber risks? And will cyber security threats apply no matter what part of the world they operate?

A: The threat from cybercrime is pervasive throughout the world. Indeed, as businesses expand their global reach through more advanced technology and improved transactional relationships and communication, the risk from cyber threats grows. Statistically, less than 10% of cybercrime occurs in the same geographic location as their target. Cyber security is a rapidly evolving landscape for both industry and government, and no matter where you are conducting business in the world cybercrime remains a significant issue.

Q: What types of cyber security threats are present now and what can we expect in the future?

A: I will limit this to three main cyber security threats businesses face presently. The first is socially engineered malware where the user is fooled into installing a malicious program sent from a source or website that they either trust or frequently use, which then compromises their data.

The second is insider threats where there is a threat to the organisation from employees, former employees, or third-party suppliers. They have access to company data, IP, and systems. Those who pose the threat can be either untrained and unknowingly make common mistakes with their cyber hygiene, or malicious in their intent by stealing or compromising sensitive data.

The third risk is outdated and unpatched software. The software used by an organisation has not been upgraded with the most up-to-date security patches, therefore, creating vulnerabilities in their network. Up-to-date cyber security protection and strong risk management are key to avoiding this threat. 

Q: What can we expect from future information security and emerging cyber threats?

A: One of the main threats we will face in the future will stem from the rapidly increasing use of IoT devices* in the workplace and the lack of security architecture in place from the start of the product’s manufacturing roadmap. The addition of IoT within the business can aid in the optimisation of processes, however if it is not secured to the same standard as the rest of the network, cybercriminals can use it as a ‘stepping stone’ to scan for vulnerabilities in more critical systems in the network.

There has also been an exponential increase in the use of business email compromise, where a malicious person sends a team member an email appearing to be sent from senior management requesting or authorising a transfer of funds or sensitive information to a ‘vendor’.

*The Internet of Things (IoT) is a network of physical devices, vehicles, home appliances and other items embedded with electronics, software, sensors, actuators, and connectivity which enables these objects to connect and exchange data.

Q: Does it matter how big or small the business, what industry or sector it is in, or whether the internet only plays a small role in their operations?

A: Certain industries such as banking and the financial sector are frequently targeted, which requires them to have high-security standards. Cybercriminals will often target easier prey such as SMEs who are often aware of their vulnerabilities and unprepared for the threat. Less than 25% of Australian SMEs have a dedicated IT security staff member or provider, and despite facing as many threats as the larger end of town, do not have the resources or training to address and mitigate the risks adequately.

The damage caused by a breach to an SME cannot be understated, with 80% of SMEs that suffer a breach going bankrupt within 12 months.

Q: What cyber security and computer security practices should businesses implement to help protect their data, assets, and network?

A: Cyber security policies, procedures, and frameworks should be implemented throughout the organisation’s structure. From cyber hygiene and employee training to implementing a breach response plan and delegating roles and responsibilities, cyber security should be a top priority. When a company conducts a business impact analysis as part of its business continuity planning, it’s critical that they identify the most significant cyber risks and triage the treatment and mitigation of these risks.

Q: What is intelligence sharing and how important is it?

A: Intelligence sharing is the communication between companies, industry, and government that enhances a greater overall security posture for all concerned parties. 

Sharing of intelligence can benefit an organisation by informing them of new threats and practical strategies. However, it can be difficult to convince organisations of the benefits of security intelligence sharing due to the reputational and financial consequences of admitting a breach or vulnerability. Collaborative efforts against cybercrime should be encouraged, including between competitors, and the sharing of valuable insights that can protect their shared industries.

Q: Do businesses require a cyber insurance policy?

A: Cyber security insurance is an essential aspect of an overall risk management strategy. The insurance should cover liability, costs of cyber investigations, public relations, legal, compensation and regulatory fines. 

However, cyber security insurance does not have 100% coverage. It is difficult to quantify the complete financial loss incurred by an organisation when their customers and the public become aware of the breach. Loss of trust in products and services can cause immeasurable damage to a company’s bottom line for extended periods of time. Insurance providers can aid in encouraging the adoption of cyber security policies and procedures by lowering premiums when an organisation meets specific standards in their cyber security.

Q: Is there an international policy or technology underway to protect businesses from cyber threats?

A: There has been a recent push by government and industry to develop policies and regulatory standards that ensure a baseline of security across the Australian business landscape. 

The introduction of the mandatory data breach notifications laws in February 2018 is one such policy, which provides the accurate and timely reporting of breaches to those who could be harmed by the data breach. 

With the formation of the Australian Cyber Security Centre (ACSC) and the Australian Cyber Security Institute (ACSRI), the Australian government is placing greater emphasis on nationwide resilience against cyber threats by promoting innovation and enhancing cooperation between private industry and government.

Six pieces of gold to protect your business against the risk of cyber security threats

1. Train and educate employees.

2. Create and adhere to a company-wide cyber security policy.

3. Update and patch software regularly.

4. Establish access control measures for employees and vendors.

5. Create an incident response plan.

6. Use strong passwords and multi-factor authentication.

Why your incentive scheme is (most likely) wrong

If you have been reading my content and following me on LinkedIn or on my website ssedgwick.com, you will be aware that I am an active proponent of organisations committing to a purpose beyond profits and living by their values, rather than using them as surface-level marketing buzzwords. I strongly believe that this approach harnesses the discretionary energy of employees and leads to a successful, high-performing, and enjoyable organisational culture.

However, the culture and supporting values of a company are only one part of the puzzle. The structure and processes of an organisation must also be engineered to maximise that culture and achieve their strategic intent.

There is no more damaging structure to an organisation’s success than a poorly considered and implemented incentive scheme. If you, like some others, disagree with me and believe that “culture” is an intangible wishy-washy notion or perhaps you struggle to define exactly what culture means, then perhaps this will pique your interest.

When you boil it down, incentives are what motivates staff to produce the effort to achieve an outcome. There are extrinsic motivators such as compensation incentives (bonus, stock options, raises, profit-sharing etc.) and then there are more intrinsic motivators such as recognition incentives (certificates of achievement, awards, accomplishment announcements etc.). My focus in this argument is compensation incentives, particularly performance bonuses.

If you ask any typical CEO or business leader what the purpose of their organisation is, they will likely state a phrase containing one or more of the following: “innovation”, “customer success”, “value creation”, “growth”, “social impact”, “passion”, “sustainable”, “positive outcomes” etc.

Herein lies the problem. Performance bonuses, particularly in sales teams, are customarily geared towards monthly, quarterly, and annual revenue targets. The compensation incentives and associated key performance indicators (KPIs) are in no way geared towards any of their lofty purpose statement catchwords. Nor are they geared towards doing what is best for the organisation in the long-term.

For a particularly poignant example of incentives-gone-wrong, consider the most devastating cyber-attack in history, NotPetya, and its effect on the shipping giant Maersk. This statement is from an anonymous insider in the organisation, “the security revamp was green-lighted and budgeted. But its success was never made a so-called key performance indicator for Maersk’s most senior IT overseers, so implementing it wouldn’t contribute to their bonuses. They never carried the security makeover forward”. The aforementioned “security revamp” was scheduled to be completed before NotPetya destroyed their IT infrastructure and cost them close to half a billion dollars…. Ouch.

Could you imagine if an organisation’s stated purpose actually reflected what their employees were incentivised to do? “Company A is committed to growing our revenue, at the expense of all else.” I think it might be difficult to win customers and motivate or even retain employees with a purpose such as that. But that is EXACTLY the message that is being sent when you engineer your incentive structures for short-term revenue goals.

Speak to any project (whether product or service-based) delivery team and they will freely admit (perhaps after a couple of drinks) that their internal sales team promise customers the world, lower prices to win work to such a degree that the delivery team’s profit margins are in the toilet, and then expect the delivery team to, well, deliver on those promises. This perverse incentivisation leads to communication breakdown and siloing of effort because both teams have different and oft-competing incentives. If your organisation is actually committed to “customer growth” and “positive outcomes” then why aren’t your staff incentivised to achieve that very aim.

Ineffective incentive structures are evident in a company’s relationships with its customers and staff. You will find such companies often have to revert to the contract in its dealings with customers and the persistent arguments about who is living up to their part of the bargain is a never-ending quagmire of pervasive negative consumer sentiment. Staff are typically unmotivated for anything that does not benefit them personally and are so inwards-facing that they are unwilling to accept any risk to the warm little cocoon of bare-minimum effort and complacency they have built for themselves. Monthly and quarterly revenue targets are their sole concern. You will see things such as rounds of applause being given during meetings when sales targets are met, yet there is silence regarding their ever-worsening customer Net Promoter Scores (NPS) and subsequent blown-out budgets and timelines. You will hear statements from staff, behind closed doors, such as “I am just waiting until I reach ten years so I can get my long-term bonus and long service leave, then I am out of here”.

Another real-life example of perverse incentives is from Safi Bahcall’s new book Loonshots, “In the 1960s, the Ford Motor Company was desperate to compete with smaller, cheaper cars from Japan. So, the CEO announced an exciting stretch goal: the company would produce a new car that would cost less than $2,000 and weigh less than 2,000 pounds—the Ford Pinto. The goal and tight deadline, unfortunately, did not leave much time for safety checks. The fuel tank was placed just behind the rear axle with only 10 inches of crush space. The design flaw, as lawsuits later showed, led to a less-than-desirable new feature: on impact, the car could blow up.”

Is this type of environment or behaviour striking some chords with those reading? I am sure some of it is familiar to you.

No alt text provided for this image

Now for the denouement! I promise it is not all doom and gloom and coruscating attacks on a deficient commitment to values. I have the medicine! Although, to implement the solution will take significant structural changes to compensation and incentive schemes, and those who are most comfortable with the status quo will likely lash out and rail against these changes. That is a sure sign you are making the right changes.

I submit that an organisation’s sales, delivery, marketing, and other business units should ALL be incentivised by project success. What do I mean by project success? I define project success as a concinnity of the following measurable outcomes:

·     Customer satisfaction pre, during, and post-project (NPS)

·     Employee engagement and morale

·     Profit margins

·     Customer success (what this means should be pre-agreed prior to project commencement)

·     Delivery within scheduled timeframes

·     Quality assurance

·     Maintenance of scope (don’t draw outside the lines!)

When all staff are incentivised to achieve the above outcomes, an increase in new customer wins and increased revenue will follow. Except, with this approach, you will also enhance customer satisfaction, elevate teamwork and collaboration, create a positive impact, and all without sacrificing profit margins. You will be, in fact, living up to your stated values and purpose.

There is no such thing as a flawless incentive scheme and despite most incentive structures being well-intentioned, you can see how they can motivate the wrong type of behaviour. Consider what your company’s incentives are promoting and what the most likely adopted behaviour of your staff will be. Adjust accordingly.

Put simply, you can’t motivate your staff solely by revenue targets. Making money for someone else will not engage them beyond bare-minimum effort and it will erode relationships with employees and customers. It also sends a clear message that your purported values and purpose are embellished misrepresentations and that inevitably destroys trust. Look beyond revenue. You might find you like what you see.

Purpose is not the sole pursuit of profits but the animating force for achieving them. Profits are in no way inconsistent with purpose — in fact, profits and purpose are inextricably linked.” – Larry Fink – CEO of Blackrock

Consultants ≠ Nihilists

In the spirit of Festivus, I will now commence with the Airing of Grievances. In the wise words of Frank Costanza, “I got a lotta problems with you people, and now you’re going to hear about it!”

Over the holidays, I mostly spent my time reading; Marc Benioff’s Trailblazer, Malcolm Gladwell’s Talking to Strangers, Clayton M. Christensen’s The Innovators Dilemma, Jules Verne’s Twenty Thousand Leagues Under The Sea, Safi Bahcall’s Loonshots, and Marc Randolph’s That Will Never Work. The final book I read over the break, and the subject of my ire, is Peter Thiel’s Zero to One.

Peter is a well-known doyen of the technology industry and rightly so. He co-founded Paypal, Palantir, Founders Fund, and Mithril Capital. He was an early investor in Facebook and Linkedin and is worth approx $2.5 billion. While I give him points for his LOTR-named VC funds and I do agree with his points about capitalism vs competition, I found some of his statements in his book about consultants vs product engineers/designers to be almost an inchoate comparison of the “Proletariat vs. Bourgeoisie”.

On a scale between Nihilism and Dogmatism, he places consultants squarely in the Nihilism range and makes reference to consultants “dropping in and out of companies to which they have no long-term connection whatsoever”. He denigrates professional services businesses and consulting firms in a way that suggests they have zero purpose beyond short-term goals and increasing minor efficiencies in their customer’s organisations. He also aligns consultants solely with low-growth environments.

I find this type of one-sided coruscating analysis to be completely unhelpful. His grandiose image of himself and his up-turned nose at the services industry smacks of naivety. In my experience, product-based technology companies, particularly startups, often desperately need the assistance of strategy/management consultants to help founder/CEOs with little-to-no business experience navigate long-term strategy, finance, risk management, and the tying together of disparate business units while scaling. Not every company can achieve a monopoly and those who face competition often differentiate through more efficient processes, risk reduction, enhanced branding, and competitive pricing models. This is exactly what consultants can provide to businesses, both low and HIGH growth. For Thiel to suggest that consultants are nihilists who care little for the long-term success of their customers is utter nonsense.

While I do agree that some large professional services firms and consultancies do have a surface-level commitment to values and a lack of a purpose that goes beyond profits, I do not believe the entire consulting industry can be painted with that brush. Despite a public “fatigue” with certain large players of the consulting industry and their opaque business practices, there are consulting service providers who provide specialist advice that add a great deal of value to their customers in the long-term and give back to their community along the way. In fact, many consultants go on to start their own successful businesses, using the lessons they learned during their time working with clients. Innovation in technology may change the way we live and work but consultants help make those changes sustainable for the long-term. Whether your career is in services or products, you can build or help build a high-growth successful business and be a respected leader in your industry.

When choosing a career direction or pivoting from your current role, I often suggest to people The Hedgehog Concept from Jim Collin’s book Good to Great. The Hedgehog Concept is based upon an ancient Greek parable: “The fox knows many things, but the hedgehog knows one big thing.” Ask yourself the three questions in the diagram below and if one of your responses overlaps with all three circles, you have your direction.

No alt text provided for this image

In my opinion, specificity is the key to success in a landscape flooded with companies attempting to be everything to everyone, and thus, are nothing to no-one.

Ignore Peter Thiel’s gallimaufry of Blue Ocean Strategy rip-offs and biased rants. Do what you love and what you could be the best at, even if that path is consulting, you Nihilist, you.

Shannon Sedgwick GAICD – ssedgwick.com

Dumb and Dumber: A Study of Management and Decision-Making Structures

Anyone born before the early 1990s is likely familiar with the comedy film Dumb and Dumber, starring the geniuses that are Jim Carrey and Jeff Daniels. If you have not seen the movie or need a refresh, I will give a brief synopsis. Lloyd Christmas (Jim Carrey) and Harry Dunne (Jeff Daniels) are best friends who discover a suitcase full of money after Mary (Lloyd’s eventual love interest) leaves it in Harry’s limo. They decide to travel to Aspen, Colorado to return the briefcase, unaware their lives are in danger because the money is connected to a kidnapping. Harry and Lloyd travel across the country while pursued by assassins and police, to return the money and find love. Hilarity ensures from start to finish. Caught up now? Good.

Arguably one of the funniest scenes in the film is when Lloyd goes to get “the bare essentials” with the last of their money and is subsequently robbed by a “sweet old lady on a motorised cart”. Watch below for the full scene.

Let’s consider Harry and Lloyd’s situation from a management point of view.

Their mission (the WHAT) is to return the money and find Mary. Their strategy (the HOW) is to travel cross-country using the money they are supposed to be returning to cover the necessary travel expenses. Their Purpose (the WHY) is to make us laugh.

Through careful analysis of the above case study (watching it while eating a bag of Kettle chips), it is evident that Harry and Lloyd employ decentralised management and decision-making structures. They operate in a flattened hierarchy where each is trusted with making decisions that are made towards their common goal or mission.

The benefits of decentralisation include flexibility, increased morale, development of expertise, resilience, individualisation, and the ability to process information faster and more accurately. By employing a decentralised management structure, Harry and Lloyd promote recurring values of “success through trusted friendship” and “stupidity”.

Another benefit of a decentralised organisational structure is the granting of greater autonomy and trust. Harry and Lloyd are empowered to use their knowledge (limited as it may be) and experience to innovate and implement their own ideas into their workflows.

However, like all decentralised organisational structures, there needs to be a clear understanding of the mission and a framework/structure for effective and timely decision-making, ensuring it is aligned with the overarching mission, and not exceeding the capacity of the individuals or teams. Here is where Lloyd and Harry come unstuck. It is clear from the above scene that Lloyd’s and Harry’s definition of the strategy and “bare essentials” is not aligned. Lloyd, if he were not robbed by the sweet old lady would have returned with an oversized cowboy hat, a ball and paddle, sparkly paper pinwheels, and a box full of assorted accoutrement (likely booze). This evidently would have contributed little to their mission. There was a breakdown in communication due to a lack of an agreed-upon decision-making process.

If there is a clear understanding of the team’s (or organisation’s) mission, this allows leaders to delegate decision-making to individuals and teams with the implicit trust that the decisions made will be with the intent of achieving the mission. Studies have proven that the more complex an organisation is, the more they must employ a decentralised organisational chain of command, to aid in rapid decision-making and easing the burden of their leadership. Quite clearly, Lloyd and Harry are in a complicated situation. The negative consequences incurred from their lack of an effective decision-making process could have been avoided had they agreed upon what defined “bare essentials”. Additionally, had a policy been implemented that gave clear boundaries for decision-making in unforeseen circumstances (i.e. locking your wallet in a newspaper vending machine), the negative outcome (robbery) could have been avoided.

Harry and Lloyd, through the employment of strict data-driven evaluation of new environments and ideas, could have created an effective blend of both centralisation and decentralisation. Centralisation of mission and purpose, and decentralisation of management and decision-making. As research has proven, individuals given the trust and tools to make decisions and innovate, are far more likely to be successful if the mission and purpose are clearly communicated and understood, and a strict decision-making structure is implemented, allowing for rapid and accurate decision-making in what is an increasingly evolving and uncertain world.

The trust placed in each other through a decentralised management structure and the reliance on rapid and accurate decision-making via a structured framework would give Harry and Lloyd the ability to move with speed, accuracy, and surprise to maintain their competitive advantage. We can learn a lot from Harry and Lloyd.

Are conferences as good as they could be?

It seems every week there is a conference purporting to be the biggest and best industry event of the calendar year. Event sponsors have varying sized booths and banners, and ads littered throughout event collateral, and are sized dependant on their financial commitment to the event. These conferences are not inexpensive! Thousands of dollars and multiple staff over 2-3 days are committed to running their company’s booth. It is a significant financial investment. Vendor staff wear their branded shirts and spend their time trying to gain eye contact with you while not-so-subtly checking your name tag to ascertain whether you are someone worth speaking to. Rinse and repeat hundreds of times per day. It’s almost a kind of awkward dance where each party knows what the other is trying to do but aren’t willing to have a direct conversation about it. A strained conversation is had where the vendor representative asks the attendee where they work and what they do, and when answered is usually proceeded by a sales spin of that vendor’s “market-leading” capabilities.

We all have attended these conferences. I often speak at these conferences. I know the environment well. Some people prefer to attend conferences just for the networking opportunities. Others state they are there just to hear certain people speak. However, I don’t know of anyone that attends conferences to be sold to. Attendees often are not interested in the booths unless they are getting a pen, webcam cover, or are able to test-drive a unique bit of kit like VR.

I admit I am not a professional speaker. I don’t even think I am a good speaker. However, I do understand that stories and an interesting narrative are essential for the audience to engage with your content. If you are a speaker and you attempt to sell your company or it’s products/services, you will lose the audience immediately. Yet it happens constantly. I wonder, would it be better for conference organisers to institute a strict “no selling” policy during presentations?

Are conferences stale? Does the recipe need to be changed in order to give attendees and sponsoring vendors more bang for their buck? I would be extremely surprised to hear of a vendor recouping their investment from a conference. I am sure it happens but not often. Are there more cost-effective ways to market your brand and capabilities at a conference while differentiating yourself from the competitors? You can’t do the same thing as everyone else and expect different results.

What it boils down to is, nobody wants to be sold to. People want to be recognised for their hard work and their achievements and empathised with for their hardships. Relationships and understanding human nature is the key to successful brand awareness and marketing. Are you discussing something that benefits them or does it just benefit you?

I have my own thoughts about how to improve conferences for all involved parties but I would be interested in hearing your opinion on how to tackle the issues I have raised. Or perhaps you disagree with me. If so, I would like still like to hear your opinion. I don’t have all the answers!

Save ‘crown jewels’ from cyber crims

Cybersecurity is, and will continue to be, the hot topic this year, with global cybersecurity spending expected to reach $US124 billion, according to research company Gartner.

Recent cyber attacks against Toyota and LandMark White serve as a stark reminder of the pervasive threat of cyber criminals. The issue becomes dispiriting when you delve into the statistics of data breaches.

An IBM-Ponemon study last year, Cost of a Data Breach, concluded the average cost of a data breach was $US3.86 million and the likelihood of a recurring breach in the following two years was 27.9 per cent. A data breach of more than one million records will cost about $US40m, and a loss of more than 50 million records will cost a staggering $US350m.

Australian small and medium business owners have long had a delusion that they “fly under the radar” of cyber criminals because they deem themselves “too small to bother with”. Recent statistics from Verizon show this is no longer the case, with 43 per cent of data breaches involving small business victims. Unfortunately, more than 500,000 Australian small businesses fell victim to cyber crime in 2017, and research shows that more than 60 per cent of SMBs go bankrupt within six months of a data breach. It is no longer an option for Australian businesses, regardless of size, to do nothing and hope for the best.

So, what can be done? At the outset, every organisation should consider the data and assets they own and identify what is critical to their business operations and their consumers/customers. It is impossible to protect everything at all times, and there is a limit to the capital available for cybersecurity budgets. The identification of your critical data and assets, your “crown jewels”, will enable you to implement appropriate security.

Invest in cybersecurity awareness training for staff. Most data breaches occur because of human error, such as clicking on phishing emails or sending information to the wrong recipient. Promoting a risk-aware culture and ensuring your employees are capable of responding to cyber threats is a cost-effective method of reducing your risk.

The theft of credentials can compromise an organisation’s entire network. Multi-factor authentication requires the user to enter a password, then another form of credentials, such as a PIN sent as a text to your phone, a fingerprint scan or universal second-factor security key. When multi-factor authentication is implemented, it is substantially harder for a cyber criminal to gain access to credentials and networks.

Last, and of equal importance, back up your data. Ransomware is a type of malware that blocks access to your data or systems until a financial payment is made. Many organisations choose to pay the ransom because they do not have their data backed up, and to retrieve it they must decide between making a payment with no guarantee their data will be returned or lose everything.

Australian companies need to make cybersecurity and data privacy a priority and demonstrate their commitment to the trust of their stakeholders, to remain competitive in the digital age

As published in The Weekend Australian on June 15th 2019. https://www.theaustralian.com.au/business/careers/save-jewels-from-cyber-crims/news-story/97bc6ec6b3df03a027849d140e2c7bde


Ethics in Technology and Cyber Security

Global connectivity is on a meteoric rise. Increasingly we see everyday items connected to the internet — connected refrigerators, baby monitors, washing machines, vehicles, medical devices, and even fish tanks. As innovative technology proliferates and evolves, it becomes increasingly embedded into our personal and working lives. However, this increased connectivity leads to increased risk for Australian citizens and businesses. It is no secret that cyber security is and will continue to be the hot topic in 2019, with global cyber security spending expected to reach USD 124 billion. (Gartner, 2018) The recent and highly-publicised cyber-attacks against Toyota and Landmark White serve as a stark reminder of the pervasive threat of cyber criminals. The issue becomes rather dispiriting when you delve into the statistics of data breaches.

However, data breaches are not the only concern arising from the proliferation of technology. Ethical issues, particularly concerning automation, artificial intelligence, and robotics, are now in front of mind for the public and media. Recent incidents have raised questions on ethics and responsibility, such as a death in March 2018 caused by an Uber self-driving car. Who is ultimately responsible? The manufacturers? The driver? The software programmers?

There is always a trade-off in technology. The trade-off by achieving a balance between accessibility and security, functionality and compliance, and convenience and privacy. It is essential to achieve a balance between these themes to establish trust and minimise any potentially harmful effect of the loss, theft, or destruction of sensitive data.

As we create and adopt technology, there needs to be ethically sound standards and regulations that govern the use of artificial intelligence and automation. This piece examines emerging innovative technology, ethical issues for the cyber security industry, the efficacy of current regulations and guidelines, and the options available for organisations who aim to embed ethical decision-making into their culture.

Ethical decision-making is about making the “right choice” and the reasoning behind those choices. The standard of ethics in an organisation is a direct reflection on the purpose of the organisation. Ethics forms the basis of the organisational purpose by asking “Why do we do what we do?”. Ethics in cyber security is about what decisions are aligned with our values and what is morally acceptable for both the data owner and the organisation. Ethical standards should also describe how to implement processes for ensuring ethical decision-making.

Ethical issues are a daily occurrence in cyber security. Every organisation that stores personal and sensitive data has a responsibility to ensure that ethics are interwoven throughout the company, from the boardroom to the interns and grads. Ethical decision-making promotes transparency and honesty, and as this piece concludes, the pursuit of such laudable values leads to both greater trust in the marketplace and greater profits.

The Australian public, consumers, and the media expect organisations to protect the data they store and use and have effective frameworks in place for guiding ethical decisions concerning the confidentiality, integrity, and availability of that data. They expect organisations to abide by legislation and regulations as a minimum, but as we have seen in recent times, “legally right” does not always equate to “morally right”. The oft-competing values of legislation vs morals means that the decision to abide by one or the other must take into account the organisation’s corporate social responsibilities and what is in line with both their organisational and personal moral values.

Emerging technology and risks

The IBM/Ponemon Cost of a Data Breach study concluded that the average cost of a data breach is $3.86 million, and the likelihood of a recurring breach in the following two years is 27.9%. A data breach of more than 1 million records will cost approximately $40 million, and a loss of more than 50 million records will cost a staggering $350 million.

Australian small to medium business (SMB) owners have long had a folie à deux that they “fly under the radar” of cyber criminals because they deem themselves too small to be a target. The recent statistics from Verizon show that this is no longer the case, with 43% of data breaches involving small business victims. Unfortunately, over 500,000 Australian small businesses fell victim to cyber crime in 2017, and research shows that over 60% of SMBs go bankrupt within six months of a data breach. It is no longer an option for Australian businesses, regardless of size, to do nothing and hope for the best.

Emerging technology, such as the Internet of Things (IoT) is designed to solve problems that affect us as humans and to make our lives easier and more enjoyable. However, that same cutting-edge technology can be used against us. While the employment of IoT yields many benefits across a vast range of industries, it is not without risks including privacy and security concerns, liability around automated equipment and self-driving cars, and a lack of global regulations and standards. There are numerous case studies of IoT use gone wrong, from hacked vehicles and baby monitors to the destruction of nuclear reactors and shutdown of the largest websites in the world via a D-DOS attack launched by the Mirai Botnet.

No alt text provided for this image

Artificial Intelligence (AI) has been used by cyber criminals to create something called a “deepfake”. A deepfake is a fake video, image, or audio message that looks incredibly realistic and fools the recipient into believing it to be a real person. This malicious use of AI takes phishing to a whole new level of sophistication and can be used to trick people into handing over passwords and sensitive data, or to pay fraudulent invoices, or possibly for “catfishing”. Malicious actors could also use “deepfakes” to manipulate elections by posting a fake video of a government leader discussing inflammatory topics or renouncing their campaign. This type of “fake news” could cause electoral disruption or cause conflict with foreign governments.

No alt text provided for this image

It has been argued that it is quantum computing, not AI, that will define our future. Classical computing systems are binary, which means they work on bits that exist as either 0 or 1. Quantum computers are not limited to binary bits. They use something called quantum bits, or “qubits”. Qubits stand for atoms, ions, electrons, and photons and control mechanisms working collaboratively as both memory and processor. Because a quantum computer is not limited to binary processing, it can contain multiple states at the same time which gives it the ability to be infinitely more powerful than even the most advanced computing systems available today. Cyber criminals could possibly harness the processing power of quantum computing to break advanced encryption algorithms.

No alt text provided for this image

Cloud computing is leading the transformation of where businesses and individuals store and use their data. As the volume of cloud usage grows, so does the amount of sensitive data stored in the cloud, which is potentially exposed to risk stemming from cloud-specific security issues:

  • Malware injections are malicious code that is injected into a cloud computing repository and enables malicious actors to gain access to any data that is uploaded to that repository. This type of malware is particularly challenging to identify without appropriate detection systems.
  • APIs (Application Programming Interfaces) assist organisations by enabling them to create customised cloud solutions that meet their data and operational requirements. Improperly secured APIs are a commonly-used entry point for cyber criminals, leading to lost or stolen data.
  • Just like physical servers, accessing cloud databases requires login details, which makes usernames and passwords a valuable target to cyber criminals. Similar to “deepfakes”, phishing emails is a common method criminals use to gain access to cloud login credentials.

Ethical issues and challenges for cybersecurity

The landscape of cyber evolves continuously. As does the threats that organisations and governments face. This required an evolving and equally-agile workforce. However, there is a widening gap between demand and supply of qualified cyber security professionals. This quite often leads to the rushed recruitment and onboarding of new cyber security staff, and potentially, a lack of guidance provided to the new recruit on ethical decision-making and expectations. When a recruit is forced to rely on their own standard of morality, this causes a rise in differing standards of right and wrong in the workplace, which ultimately leads to mistakes.

When an organisation sets and follows ethical standards or an industry abides by regulation that enforces ethical behaviour, it ensures that all relevant parties are held to the same standard and have a clear understanding of their ethical responsibilities. The C-Suite and the board must be seen to be leading by example and engendering a culture of high standards of ethical decision-making,

If a company’s data is compromised, it may face lawsuits, reputational damage, and questions about its ethical standards. Delaying a public announcement can compound these consequences. Those responsible for overseeing information security practices within organisations, such as CISOs and supporting management, must ensure a fit-for-purpose communications policy is implemented to guide incident response procedures.

There are a number of ethical considerations regarding the impact of technology and cyber security. One is the privacy of a user’s data. Organisations need to consider whether they have appropriate controls and processes in place to safeguard the integrity and privacy of their customers and their data. A key question to ask would be: what would the result to the customer be if this information was compromised?

Another consideration is the customer’s right to their information. This is particularly important when considering how long user data should be stored. Should it be deleted immediately after its use? If it is kept, how will it be secured? An even thornier question is what happens to the data when the user dies? Should their family be able to gain access to it?

A customer consenting to the use of their data is a critical consideration. It is now not sufficient to have a tiny script at the bottom of contracts and webpages detailing user’s rights to their data and the company’s privacy policy. Informed consent requires easy-to-access and easy-to-read language so the user can acquiesce without having to go to university to study law.

The consideration of bias in algorithms and AI is increasingly a topic of consternation for developers. Algorithms used in correctional facilities to determine the likelihood of recidivism, i.e. a prisoner’s likelihood to re-offend, has been used to decide the outcome of bail/release hearings in America. It was discovered that this algorithm, called COMPAS (Correctional Offender Management Profiling for Alternative Sanctions) contained biased data and was less likely to look favourably upon African Americans or people from low socioeconomic neighbourhoods.

There is currently at play, an Australia-specific example of an ethical issue concerning cyber security. The Assistance and Access Bill that was passed in 2018 allows Australian government law enforcement and intelligence agencies to demand technology manufacturers and providers to give access to encrypted communications. The law stipulates that a technology provider must create a “back door” or access point into their products so the government agencies can gain access to encrypted communications. This forced creation of a back door into technology created by Australian organisations leads to various ethical issues, not the least of which is the privacy of their user’s data. Technology companies, especially those who invest heavily in encryption products, may be forced to move their manufacturing operations internationally. The legislatively mandated “weakness” will likely undermine the trust of users in their products. This will have a profound effect on local research and development initiatives and manufacturing due to a reduction in jobs and revenue from the export of technology products.

Ethical case studies

Two (2) case studies come to mind that reflects the opposite ends of the spectrum of ethical decision-making in response to cyber security incidents and the effects the wrong decision can have on an organisation.

Yahoo was in the middle of being acquired by Verizon in 2017 when it disclosed it had discovered three data breaches in 2013 and 2014 that affected over one (1) billion users. Unfortunately, these data breaches were not disclosed until late 2016 after the original Verizon acquisition deal had been agreed to, but not yet paid for. The original deal between Verizon and Yahoo was worth USD 4.8 billion, and after the data breaches were disclosed, Yahoo’s worth was slashed by an incredible USD 352 million. The Security and Exchange Commission (SEC) also investigated Yahoo for waiting too long to notify victims of the data breach, and whether Yahoo violated SEC securities legislation by not providing documents to the SEC related to the data breaches. Yahoo continues to be liable for half (50 percent) of any debts incurred from third-party litigation and regulatory fines.

The Yahoo breaches and their lack of ethical behaviour concerning the notification of victims and regulatory bodies is an apt example of the damage that can occur when behaviours are not governed by ethical principles.

On the other end of the spectrum of ethical decision-making sits the Australian Red Cross. The Red Cross suffered a data breach of over 550,000 blood donor’s details, including name, address, date of birth, gender, and information regarding sexual history. The data was inadvertently published by a third-party contractor to an online public-facing application form.

The Red Cross immediately disclosed the data breach to affected donors and to the Australian Government CERT (Computer Emergency Response Team). Not only did the Red Cross avoid any fines for the data breach, but they also received an extraordinary commendation for their response efforts by the Commissioner of the Office of Australian Information Commission, Timothy Pilgrim. The assurance that the Red Cross provided donors served to increase their reputation for transparency and trust within the Australian community.

Both of the above examples highlight the importance of adequate incident response procedures that align with the values of the organisation. All organisations should seek to establish trust between themselves and their customers.

No alt text provided for this image


An organisation should implement a decision-making framework that aligns with the values and purpose of the company. The framework should balance organisational risk and best practice for cyber security in a well-defined and replicable manner which meets the needs of business along with regulatory and legislative obligations, and ensure that leaders have access to accurate information that is appropriate to ethical decision-making processes.

Ethics and cyber security go hand-in-hand. Organisations must establish its purpose and values and continuously monitor the behaviour of their staff in relation to those values. Customers expect honesty and transparency, and as detailed in the report, the results can be devastating when ethical behaviour is ignored. The protection of data and prevention of harm should be the primary focus in all ethical/cyber decision-making.

The following steps should be established as a minimum standard:

  • Every organisation should consider the data and assets they own and identify what is critical to their business operations and their consumers/customers. It is impossible to protect everything at all times, and there is a limit to the capital available for cyber security budgets. The identification of your critical data and assets, your “crown jewels”, will enable you to implement appropriate security controls where it matters most.
  • Invest in cyber security awareness training for staff. The majority of data breaches occur due to human error, such as clicking on phishing emails or sending information to the wrong recipient. Promoting a risk-aware culture and ensuring your employees are capable of responding to cyber threats is a cost-effective method of reducing your risk.
  • The theft of credentials can compromise an entire organisation’s network. Multi-factor authentication requires the user to enter a password, and then another form of credentials, such as a pin sent as a text to your phone, a fingerprint scan, or Universal 2nd Factor (U2F) security key. When multi-factor authentication is implemented, it is substantially harder for a cyber criminal to gain access to credentials and networks because they have to show they have access to the other authentication factor.
  • Next, and with equally great importance, backup your data. Ransomware is a type of malware that blocks access to your data or systems until a financial payment is made. Many organisations choose to pay the ransom because they do not have their data backed up, and to retrieve it they must decide between making a payment with no guarantee their data will be returned or lose everything.

It is not all “doom and gloom”. There is an “egg in one’s beer” to cyber security. Organisations that invest in cyber security and have high standards of ethical decision-making strengthen their resilience, decrease the likelihood of a successful attack, and subsequently have a higher level of trust with their consumers. The focus on consumer trust is now de rigueur in Australia, particularly after the Hayne Royal Commission. Research shows that over 50% of customers will pay more for a company’s services and products if they trust them.

Essential to determining whether a consumer trusts an organisation is transparency about their cyber security and data use. Through the timely disclosure of data breaches, the design of fit-for-purpose security controls, and the informed consent of the use of user’s data, organisations show they are transparent and therefore elicit a greater level of trust. Australian companies need to make cyber security, ethical decision-making, and data privacy a priority and demonstrate their commitment to the trust of their stakeholders, to remain competitive in the digital age.

Shannon Sedgwick GAICD

Diversity and Success in Cybersecurity

On April 4th I had the pleasure of speaking at an event hosted by Preacta Recruitment and Charlotte Osborne. The topic of the event was ‘Challenging the Status Quo in Cybersecurity’ and I spoke alongside the talented and loquacious Karissa Breen and Tulin Sevgin. This blog post outlines my speaking notes in full for those that are interested.

Gender Quotas

Now, I am going to say something potentially controversial. Staff gender quotas do not work in the long term.

Everyone would agree that the aim of a team or business is to be high-performing and successful. There is no business case for gender quotas. While research shows that a diverse team does increase performance, there is no data to suggest that gender quotas equate to a high-performing team. I recommend you google “golden skirts” and the study of gender quotas in Norway. https://papers.ssrn.com/sol3/cf_dev/AbsByAuth.cfm?per_id=248065

A Danish study examined 2,500 firms over eight years, finding that hiring women did indeed improve firms’ performance. Yet the conclusion was still that “the positive effects of women in management depends on the qualifications of female managers.” If quotas force hiring women, and as a result, the wrong women are chosen, there is a reason to be concerned that quotas will give the push for gender parity a bad reputation.

Instead, an organisation should have a gender quota for the pool of candidates! Then from that gender-balanced pool of candidates, you choose the best person for the role and your team. Nobody wants to be selected for a position based on their gender, cultural heritage, sexual orientation, or otherwise. People want to be chosen because they deserve it and they are the best person for the role.

Building a successful, diverse, and balanced team is not about pursuing gender quotas. It is about focussing on developing a supportive, high-performing, flexible, revenue-generating, kickass environment that people want to be a part of; where there is a culture built on the trust and respect that your colleague next to you in the trenches is there because they are the best person for the role. To choose someone based on their gender does disrespect to that person, whether they are the best person for the role or not.

A Golden Ticket

The cybersecurity industry is still a nascent and rapidly growing industry. Rapid innovation and extremely high uptake of cybersecurity services mean that opportunities are proliferating at a breakneck pace. Ladies and gentleman, this is your golden ticket. If you can establish yourself and your brand strongly within the market, you will rise rapidly. Whether building a start-up or climbing the ranks in the corporate world, the same principles apply.

In a world full of fish, be a shark.

I recently had a conversation with a good friend of mine, whom I respect deeply, and she said: “I am going to wait until I have established my credibility and gradually try and become a bigger fish in the market.”

I told her what I am going to tell you now….. Why wait? (repeat).

Don’t do what everyone else is trying to do and expect a different result. Be an outlier! Don’t ‘fit in’ and don’t be swayed by the consensus and the politically correct. You can not differentiate yourself if you try and do the same thing as everyone else, even if you can do it better. There are no rules! Forget being a bigger fish, be a fucking shark. You are the subject matter expert in your chosen field. You are an industry leader. It is the same principle as “dress for the job you want, not the one you have”. You need to act like the job you want. Demand credibility! Of course, you will have to back it up and earn that credibility every day but start now! This leads me to my next point….

No one ever built a statue of a critic.

There will be people during your journey who will attempt to rain on your parade. There will be haters. There is no avoiding them or the tall poppy syndrome they cultivate.

Let me tell you something: what they think about you, is none of your business.

In my experience, the only people saying negative things are those who have the time, and those who are too cowardly to put their neck on the line and hustle hard every waking minute of every day.

Truly successful people build each other up and are motivated by others’ success. They help and advise and guide the next generation of ‘hustlers’. They simply don’t have time to gossip and ‘hate’ on others success.

I’m a great believer in luck, and I find the harder I work the more I have of it.” – Thomas Jefferson

There is a common factor that ties everything I have said together. That common factor is hard work. Back-breaking, gritty-eyed, carpal tunnel-having hard work. There will always be someone smarter, better looking, or more talented than you. That is out of your control. But how hard you work IS within your control.

How many cyber or business-related books are you reading each week? What articles, podcasts, videos, TV shows are you ingesting to develop yourself? The only way to succeed far beyond the ‘consensus’ is to work harder than every person in the room. If you are curious and passionate about your chosen field, and you devote every spare moment of your time to your passion, there is no ceiling to your success. “Today I will do what others won’t, so tomorrow I can accomplish what others can’t.”

Now, let me add an “asterisk” to this. You need to rest. You need your “zen” time. For each person it is different. For me, it is exercise and reading heroic fantasy novels (cough. Nerd. cough). For you, it might be yoga or walking the dog or watching Game of Thrones. But if you love your chosen profession, then your work and your life will intertwine and you will love every minute of it.

One last point. Kindness is free. Help each other. Find a mentor, or mentor someone. Network and help people without any thought of reciprocation. You will find opportunities and happiness that you did not think possible. The law of reciprocity is ever-present. You only get back what you give.

Shannon Sedgwick


Legislation and Cyber Security

Data privacy and cyber security legislation have been a hot topic in Australia of late, with the implementation of the European GDPR, the Notifiable Data Breach Scheme under the Privacy Act 1988, and more recently, the Australian Government’s proposed Assistance and Access Bill (2018). The Assistance and Access Bill, in particular, is causing concern amongst the wider Australian public, privacy watchdogs, technology giants, and telecommunications providers about the level of government access to encrypted information. Aided by an international media “frenzy”, there is an increasing fear of over-regulation and unintended consequences for the privacy of individuals or organisations.

In our dealings with the public sector, it’s clear that there is a lack of legislation and regulation in Australia that is industry specific. Many within the Australian industry view cyber security as something they have to “put up with”, which means that it may not be allocated sufficient budget or regarded as the business enabler that it is. One of the most effective ways to encourage compliance with recognised standards (NIST, ISO27001, ISM, Essential 8 etc.) is to mandate it with legislation. Legislated compliance provides confidence to end-users and business stakeholders. (Greenwald, 2015)

Consider healthcare as an example. The industry is notoriously immature in cyber security maturity with more breaches suffered than any other sector (OAIC 2018). Statistically, over 50% of their data breaches occur due to human error (Verizon 2018), which speaks to a lack of training and enforced standards. By comparison, the US has healthcare-specific legislation in the form of the Health Insurance Portability and Accountability Act (HIPAA) that provides data privacy and security provisions for safeguarding medical information. Almost 1 million people have elected to opt out of the Australian Digital health Agency’s My Health Record due to a perceived lack of appropriate security measures. (ABC News, 2018) Australia’s adoption of a similar approach to the US’ HIPAA would go a long way towards improving the cyber maturity of Australian healthcare and the trust of the Australian public.

Another issue with the lack of industry-specific regulation and legislation is that organisations are not aware of their data privacy obligations. If an organisation suffers a data breach, non-compliance with their legal and regulatory obligations could equal large fines, greater financial loss, and potential loss of trust with their customers/stakeholders. For organisations and industries to thrive and grow they need to be digitally enabled and digitally driven to keep pace with competitors, both domestic and international. Organisations using cutting-edge technologies can create new products and services, and create better end-user experiences.

To innovate rapidly, cyber security must be prioritised and viewed as a business enabler rather than an expensive anchor. Legislation that has been drafted in cooperation with industry stakeholders will aid cybersecurity maturity and compliance in digital transformation and increase the resilience and performance of Australia on the world stage.

Do you think legislatively mandated compliance with cyber security standards is a good idea? Please feel free to comment your thoughts on this issue below. You can read more of my writing or discuss speaking requests at ssedgwick.com