406- Perfection Is the Enemy of Progress w/Michael Murray

406-Michael Murray
Host: Phil Howard
Guest: Michael Murray
________________


Phil Howard: Everybody listening to You've Been Heard we're talking with Michael Murray today, and we're supposed to be talking about scaling IT in highly regulated industries without disrupting operations or compliance. Okay. What gets you so excited about IT? What do you really love about it? Let's just start with that. I mean, what's, like the thing that fires you up most about your role? And then we'll get to something important.
Michael Murray: Me up. I, I've worked in a lot of industries. So I came out of college, I did civil engineering in Cork in Ireland, came out of college and worked for a small, IT startup, small consultancy, software development. Worked for two absolutely fantastic guys, the founders, Seamus and Teddy, who really gave me a great grounding, like I was employee number four, okay. And I gave me a huge insight into the sort of stresses and successes from a small IT company. They're still in business. Both. Still very well respected and successful.
Phil Howard: Please tell me what that was.
Michael Murray: So the name of the company was Client Solutions.
Phil Howard: No, I mean, like, what was. So you said it was really, like, your employee number four. You really got some great insight. Mentoring. Yeah. What's like the first thing that comes to mind that was like the big learnings.
Michael Murray: The big learnings, really understand your problem, right? And understand the solutions that you're offering. Back then it was like Sybase. Powerbuilder was the development language that we used initially. And really getting under the hood and understanding the tools. Right? So not just, using the tools, but fully understanding how the tool could be leveraged. What it was doing under the hood when you gave it instructions. And I think that sort of stood to me going forward. The other thing was the importance, it was a small company. We had great relationships with, big banks in Ireland, Bank of Ireland, Allied Irish Banks, Ulster Bank, as well as folks like Pepsi and Intel. Elan Pharmaceuticals was one of our early customers. And really understanding the sort of trust and relationship basis that these, larger organizations were taking by, giving work to a small startup at the time. And then just understanding, that, IT is an enabler, right? The purpose of IT in an organization is to drive success in the company, not just to provide laptops and physical hardware. I think, there are a lot of people in IT who are somewhat blinkered, particularly in larger organisations, to deliver their function, and they don't tie what they're doing to the greater organisation. And I think those folks sort of, miss out on something in terms of purpose.
Phil Howard: I'm intrigued by the understanding the real problem question, because it's so simple and sometimes the most simplest, it sounds simple on the outside, right, right. But the thing that IT does very, very well is complicate the crap out of everything. And even though we're known as the Department of No, we're really the Department of Yes and trying to do every thousands of projects all at one time. So if there was like a saying in IT that I kind of go against which is like it this is the department of No. I don't agree with that. I think it is the Department of being afraid to say no and actually trying to do thousands of projects all at one time and kind of secretly hiding in the, corner, and trying to do it all.
Michael Murray: So I would say we're the department of why. So I've seen the department.
Phil Howard: Should be we should be.
Michael Murray: The department of why.
Phil Howard: That's back to your really good mentoring and from day one. But. Okay, so talk to me.
Michael Murray: So, as the head of IT in three different organizations. We get requests. I probably have a list of, one hundred and twenty project candidates, right now. And, I need to understand why each of them is important, who it's important to, and whether that sort of elevates itself to be in the top three, four, or five, however many concurrent projects we can manage for the organization as a whole. Like why is this important? And one of the caveats I think is these are all project candidates. They're not projects. We may never do them. And I think understanding and publicizing that just because it's on a list doesn't mean we're ever going to get to it is an important piece of communication that's missed.
Phil Howard: Very, very important. And so how do we differentiate who gets, their, AI app approved?
Michael Murray: So for me, it's relatively easy. You get your steer from the CEO, CFO as to what the organizational priorities are for the year. And, sometimes it's growth, sometimes it's stabilization, sometimes it's automation, sometimes it's revenue, profit, EBITDA, whatever.
Phil Howard: You said something very simple. You said something that to me, from the way that you said. It sounds like common sense to you.
Michael Murray: Yeah, I think so. I mean, it's important that it is aligned with the organizational goals. And if you know what they are transparently and they're clearly articulated, then you just sort of apply that scoring rubric to.
Phil Howard: Rubric.
Michael Murray: Stack of IT projects you have in front of you.
Phil Howard: I'm afraid that you might not give yourself enough credit, but I don't know you yet enough to know that if you don't give yourself enough credit. I mean, you're saying this like, it's like, well, yeah, of course, you just align yourself with the C-level. But how many IT leaders out there probably have no clue what the actual, goals, real problems, challenges of the C-suite are even if.
Michael Murray: I would suggest then that they're not really IT leaders. Right. They're maybe IT managers and delivering IT infrastructure and networking and comms and whatever other tools. Yeah, but if you start asking why pretty quickly, the conversation changes. I think why is the probably most powerful, way to surface, underlying desires and priorities.
Phil Howard: I love it. Exactly. It's like when people are stumped and they don't really know what to do, and they get tongue tied. I just ask why? It's easy. Just go. Why?
Michael Murray: It's the iterative Why? It's understanding It gets you down. There's several models, the five whys and the seven whys. But, you really get to a root understanding of who's asking for what and why they need it. And what they're anticipating out of it. It gives you your success criteria. It gives you your definition of done. It really just gives you so much information.
Phil Howard: That's another deep thought. The definition of done. Oh, I love this. Go talk to me. What's the definition of done?
Michael Murray: So it's very, very easy for an IT function to deliver a marvelous set of tools that nobody wants or are. Understanding the why leads to understanding what the And I hate the minimum viable product, right? Because you don't want to be delivering.
Phil Howard: Isn't that everything in IT?
Michael Murray: No, you don't want to be delivering the minimum product. You want to be delivering the value product, right?
Phil Howard: Like of course. But why does that happen? Why do we deliver the minimum value? Why does that happen? Because we're checking the box off. Done.
Michael Murray: Well, it's partly checking the box off done. It's partly because it is often financially constrained. Right?
Phil Howard: Yeah. I was going to say that I was going to say the cost center. Right. So we get the minimal amount approved for this project. It's done. It's the minimum viable thing. And then we don't do the upgrades. We don't do the bolt ons, we don't do the APIs, we don't do anything. And then they're like, oh, this ERP sucks.
Michael Murray: Right? Whereas if you start with understanding what success looks like from your customer's perspective. Ask them why is this important? I need an API to connect system one to system two. It's like, well, why do you need that? Well, because I don't want to be typing this. How many times a day does it run? How frequently does it run? What are the data volumes involved? It's like, well, it's cheaper and easier to have a human do it. Or it's vastly superior to to automate, understanding why people need stuff and the value behind it.
Phil Howard: Okay, so we have why. Then we have the definition of done. But you solve so many people's problems just there after hundreds of episodes. You know how many people we've talked to. I mean, we've dealt with issues or people have had problems in the past, or if we talk about like nightmare stories from the past and people learning from failing forward and all of that. Sounds like you had a great mentor from day one. And you were the fourth employee and you never had to deal with any problems. So that sounds great for you. But for everybody else in the world they learn through failure and trial by fire and all kinds of stuff like that. Right. Whereas if they had just really, really defined for their executive team, got buy in and kind of had like a form that's like this. Once we check all these things off, we will be done with this project and they create buy in around what that project is, then they might not be dealing with the struggles that they might have to deal with for, I don't know, asking for more money or asking for bolt on products. Or by the way, this project, like every project, is not going to go what people say is in quotes, seamless. Every now and then it does happen. And we need to be ready for plus or minus ten percent, contingency factor of x, y, z. But at the end of the day, this is what done looks like. I love it. So not the Department of No. The Department of Why and what is done look like. This is all underneath the bolding of understanding the real problem. If we were to write an I and you said, sometimes humans, it's cheaper to use humans, or it makes more sense to use humans, because why would we automate something that's very, very expensive and time intensive? To do something that, just requires someone to, I don't know, write an email and hit send.
Michael Murray: Exactly.
Phil Howard: Can we write a prompt for that? The irony is that if we were to write a prompt, about understanding the real problem and knowing what done looks like. From like a point solution or from an IT iterative process and thinking process. Because I'm really into this right now. Right. How would you write that prompt? This is going to be a new section of the show. I love it. So how would you write that prompt?
Michael Murray: I think that, understanding that the Done is perceived by your users or by perceived by your project champion. And it's a personal thing. Right? So I would suggest that, and this may be very unpopular opinion, but I would suggest that, asking AI, which is largely based on whatever free information was available on the internet as of about twelve months ago. Do you really want the answer to that question to be provided by Sort of the theory of Facebook and Reddit.
Phil Howard: No no no I do not want the answers. I'm the exact opposite. Right. So I think we're saying the same thing just differently.
Michael Murray: Yeah, possibly.
Phil Howard: I believe that AI should never be used with, kind of like the information. First, I think we should flip it. It's always about human process or human ingenuity first, and then use AI to kind of like, organize it and just help.
Michael Murray: To deliver it. Right. But I don't think you can have it scoped.
Phil Howard: But can you have it use your process or a system of questions to help? Break down or understand a real problem.
Michael Murray: I guess I probably once the problem is defined, but I feel like the definition of the problem, the pain is perceived by humans, right? And so I think for it to successfully deliver the solution, they need to understand the problem that the humans are feeling. And the humans might be the CEO, the CFO, or it might be head of operations. It might be someone on the loading dock. Right? But I think AI can help frame and deliver the solution. But I don't think it can define the problem. And it can't. Yet at least, design the solution. It can certainly help with the automation and the delivery and, some of the, the sort of vibe coding technologies are coming on in leaps and bounds almost on a daily basis. But, it brings a testing and delivery headache of its own.
Phil Howard: We have a third quote from the show that's it's not the Department of No, it's the Department of Hard No. It's hard. Hard. No. Yeah, yeah, because I just acted like an ignorant, sea level is like, hey, can't we just use AI for that? That's a hard no, Phil. Yeah, but, I think I'm going to push. Back and find a reason here. I'm going to say like. Yeah, but can't it can't AI say first, go ask these people and then fill in this information here and after talking with your end users and then do this as the next step and then do this, I'm trying to find a project that I used it on the other day. It was like for example. Taking information from a human iterative process where we're doing maybe a needs assessment or something like that, like, so you take a doctor who does a needs assessment, okay. Then you've got to kind of like organize like all kinds of information and data into a process. I'm going to think about it. But let's, forget that we're just going to take it as the hard no for now.
Michael Murray: Well, I think, if you have a senior leader who comes to you and says, hey, I want you to use AI. Why? Why do you want to use AI? Why do you believe AI is the best solution for this problem that you're facing?
Phil Howard: Yeah. I want to basically use AI this. I'm just going to role play this with you right now. Well I just, I want to use AI to stop my insane life and all this extra work that I'm doing that I'm pretty sure I don't need to be doing for, I don't know, research. I want to use AI for, I guess, general research and sifting and sorting.
Michael Murray: So I think I think that's one of the few use cases that I've seen AI be used successfully. Right? It absolutely can digest.
Phil Howard: Congratulations. Congratulations. But,
Michael Murray: We've moved from I want to use AI as a blanket statement to I want to use AI to take large swathes of textual information, do research and compress it into a usable answer. And I feel like that's progress, right?
Phil Howard: Yeah. I want to use well, that's one thing that's like the general stuff for all of our users. I want our all of our entire staff to I want to have an AI rollout plan so that our entire staff knows how to use AI, securely without linking our company data to everywhere in the world. That's probably another thing that would be concerned. But, if you're a manufacturer. So we have to think more, deeply because I think there's people that are thinking we're going to have like agents that replace humans. I don't know if people get that. Do you think people get that request a lot? Can't we use AI to replace, a third of our staff? Do you think they get that?
Michael Murray: I would again go back to. Why? Right. So I think, there will definitely be functions and areas of sort of professional life where AI replaces, I think, at the moment it's largely limited to interpreting textual documents.
Phil Howard: But I got a recruiter one this morning. I got someone trying to recruit me. I know it was AI.
Michael Murray: The error rate, I think, is still sufficiently high that the human sort of supervision, is still high. So it's like, when we started using steam engines, right, instead of horses? Yeah. The stable boys lost their jobs, but mechanical engineers came to the fore. And I feel like we're on another sort of tipping point of an industry change, and maybe we don't quite know where it's going to lead. I think some traditional positions will be eliminated. But, there'll be different opportunities.
Phil Howard: You really snuffed me as the make believe CEO, by the way. Because that's exactly probably what's happening. Why? We just need it. I just know everyone else is. I'm worried about it. Right?
Michael Murray: And there is a sort of fear of missing out, thing. But I think, a degree of caution is required. There's that famous, MIT report from a few months ago that ninety five percent of investment in AI return zero value. Right.
Phil Howard: And yeah. But what I want to know, the five percent that did, were they actually using were they actually using agentic agents in AI or was it more like so the tips like the the point solutions, or was it more the point solutions and everything?
Michael Murray: Seventy percent of the five percent, as from my reading of it, at least seventy percent of the five percent, got their successes by leveraging AI tools within their existing vendor stack, right?
Phil Howard: Yes, exactly. Okay. So isn't it amazing how many people read that article? What's more amazing to me is every single like, who wrote that article? Is it just because MIT stamped it like everyone's quoting that article? Everyone's rewriting that article.
Michael Murray: Yeah, I mean, PwC published one a couple of weeks ago that isn't getting near as much sort of media traction, and that one was slightly more optimistic. I think the MIT one, it was very timely. And I think a lot of people sort of latched on to it as a crutch. Almost. Right. This supports my belief that agentic AI or AI generally is, potentially a bubble. And so people latched on to it as kind of this supports my theory that AI maybe isn't as mature and as worthy of investment in my time as,
Phil Howard: Gartner said their in Gartner Magic Quadrant. They're in Frost. So why should I question that even though they paid them a bunch of money to be somewhere? And if I didn't pay, I'm not in the quadrant. I'm not saying that Gartner has its place. It really does. I mean, I don't think people are going to argue Sentinel one in the Gartner, Magic Quadrant, or Microsoft.
Michael Murray: Well. The Europeans might argue both of those these days, but I think that's another interesting conversation.
Phil Howard: Well, it actually is because the why does the majority of the world or maybe a dozen this is very, very, typical Westerner, kind of, self-centered point of view. Why does the rest of the world kind of revolve around the United States technology stack? And what would the option be? Google. What is your abuse? Lotus notes. What are we doing?
Michael Murray: Yeah, no, not since. I mean, I have used Lotus Notes, but not recently. No. It's interesting. I think, everybody, as far as I'm aware, at least everyone in Europe is still largely using Microsoft products. They're using zoom, they're using teams, they're using outlook. But there is certainly a degree of caution being expressed, about the dependency on us. Right. I think it's safe to say that the dependency exists, but I think it was the French government announced, Recently that.
Phil Howard: They were the French.
Michael Murray: It is often the French. Yeah, they certainly do know how to strike. But, I think they've said that, they're going to, for example, eliminate zoom was the one I read, I think, over the last couple of days.
Phil Howard: Why.
Michael Murray: It's a perceived external dependency.
Phil Howard: Conversation. Much more, deeper conversation. Yeah. Really. I mean, what other simple quotes and, mantras or things that you have that you go by? I think what the definition of done is that's it's already make a big impact on my team in meetings tomorrow. So get ready for it, guys.
Michael Murray: So I mean, I think, one of the things, that I hadn't anticipated when I moved to Boston was just what a hub of innovation it was in terms of process design and thinking so there's a, agile and scrum, like the Agile Manifesto. Ken Schwaber and Jeff Sutherland built up scrum. Those two I guess thought leaders, And, having been aware of Agile and Scrum and Kanban and Lean and various other sort of, philosophies, I guess it was amazing to have an opportunity to, basically meet them. Right. So that was one big benefit, I think, of moving to Boston that I hadn't anticipated. And that's where my exposure to definition of done comes from. I think other than that, there's a degree of, just do it, like they're situations where, you could sit around and spend six months discussing, or reading the manuals. Or you could just throw the CD in and, showing my age now, but, throw the CD in next, next, next and see what happens. Right. And, the server or whatever it is you're configuring, the service comes up and you realize that, oh, actually on the third next I should have selected something different. You go back and you start again. Right.
Phil Howard: And You figure out things as you go that you've learned.
Michael Murray: As you go. And you know what? It's not perfect, but perfection is the enemy of progress, right?
Phil Howard: Yeah. Done is better than perfect. That's Exactly. And just the act of doing sometimes is really what creates so much learning or aha moments.
Michael Murray: Right, exactly. It gives you the knowledge and it gives you the understanding of the sort of alternate paths as well. Right. This is configured and this is why. Right.
Phil Howard: Cybersecurity is a business enabler. I want to talk about it. I've kind of caught the cybersecurity bug lately. I've for years, cybersecurity for me has been kind of this, like, depressing, entity where you can only fail, meaning it's just a matter of when. And I didn't quite really hit me until recently because I just feel like it's like, how do you measure success in cybersecurity? By never having an incident.
Michael Murray: Interesting.
Phil Howard: No, but that's how I thought about it for years. So I thought about the CISO as this job that's like. Like I literally like I was thinking about it the other day, like, how do we measure your I woke up in my sleep score was really, really bad. And I've got seven hours of sleep debt. I wear an aura ring or a ring is the best, right? So it just dawned on me, like all of a sudden I was like, oh, what's your cyber security sleep score? Like, I'm going to do that. I want to know what everyone's cybersecurity sleep score is. But just that idea of that thought to me was, I used to think, well, the CISO job's just so unforgiving. It's like, when do they ever get a pat on the back? And just like, hey, thanks for not getting, allowing any ransomware attacks this month. And I just had a paradigm shift the last, couple weeks. And it came from having to evaluate, like, a dozen mssps. Right. And when I started looking at the difference in abilities to not only just alert someone of a cyber event, but actually remediate it. Right. I started to realize that there's a lot of people that just love to talk security and love to map out security and love to say that. Well, here's all your holes and you guys are really bad. But when push comes to shove, it's like, well, I mean, we'll alert you, but.
Michael Murray: But then you're on your own.
Phil Howard: Yeah. You know what I mean? It was like and I and I was like, just amazed at how many people showed up to the table, so to speak, looking really, really well, shining up really, really well. But then at the end of the day, when you kind of get down into the nitty gritty and lurk and look at fine print and stuff, you're like, oh, wow, you're not doing really anything right.
Michael Murray: So I mean, cyber security is really interesting. I kind of got into it a few years ago. So I did, CISSP and Ccsp. And to me, it goes back to risk. Right. And why. Right. So, as the IT leader, your responsibility is to protect the organization. And the way you protect the organization is by balancing investment in IT, security and investment in systems against the threat and the risk of loss. Right. So it's a trade off. And it's interesting because just last week I was having a conversation around the fact that, my goals for twenty twenty six don't include having zero cybersecurity events. Because while that is, a simple aspirational goal, it's shockingly expensive. Right. And that's not necessarily in the best interest of most organizations. Most organizations the balance of value, ensures a focus on recovery as much as prevention. Right? Every audit you've ever sat through, there's, where are your controls? Where are your preventative controls? Your detective controls, your controls. And so I feel it's the same in cybersecurity. I feel it's the same in everything that it does. Right. You don't want to build a five nines network and a five nines data infrastructure. If you have, an organization that can function perfectly adequately with two nines or three nines. And so to me cybersecurity sits in the same boat. Right. It's why do we want like what's the goal? The goal is to protect the organization and to deliver value to the organization. Everyone is focusing on the preventative controls. Um, and it's easy to pass an audit. It's easy to say everything's encrypted and everything's protected. And we have the firewall and we have, at the bottom of our list is, deny all. But if you get a capable pentester, and they've always been able to breach a network within minutes.
Phil Howard: In what way?
Michael Murray: Mostly.
Phil Howard: Minutes. Minutes?
Michael Murray: Yeah, minutes. So I feel like the greatest value in Pentesting or in cyber security testing is starting on a kind of gray box. Right? I think you should start from the assumption that your users have terrible passwords.
Phil Howard: You should start with. We're absolutely screwed, right?
Michael Murray: Credential stuffing is a real thing. Everyone's sharing credentials. Everyone's reusing credentials. So start from the assumption that your base users are compromised and then try and protect against elevation of privilege attacks.
Phil Howard: Just out of curiosity, how are the Pentesters getting in? I mean, was it like, oh, we've got this off the dark web. We already know this. We already know that. Is it like a bunch of just similar tools and it's like, oh, this is just easy.
Michael Murray: So for the highest value I've gained from Pentesters has always been this sort of like grey box. So we give them a base account, a standard user account, and within minutes they've managed to elevate that to a domain admin account.
Phil Howard: Hmm.
Michael Murray: Yeah, fantastic.
Phil Howard: I mean, I had a statistic that sixty five percent of its like sixty five or sixty four. Whatever it is, it's it's between sixty and seventy percent of all hospitals or health care healthcare industry experienced a ransomware attack in twenty twenty four. Do you believe that. Sixty percent. Not ransomware a security breach? Security breach. That's high.
Michael Murray: That's very high.
Phil Howard: It's believable because hospitals are just such big entities with so many holes and really, really old infrastructure, I would imagine. There's something everywhere for everyone. There's something for everyone.
Michael Murray: Such diversity of devices as well, right? They probably have stuff that's still, running old Wi-Fi protocols and all kinds of stuff.
Phil Howard: Ten, one hundred switches. I've seen it. The same argument can be made for AI as well. On the opposite end is like, well, we don't really care that it's failing miserably as long as it's working sixty percent of the time, then it's a win for us if we're making money on it.
Michael Murray: Yeah. I think one of the things that's interesting, if you say AI has a, ten percent hallucination rate or even a five percent hallucination rate. Once you start tying, sequential steps together. Right. So let's say you have some sort of an agentic process that, takes a customers call, converts it to text, puts the text into a text field, adds it to a database, does some manipulation, if it has a ninety percent success rate on each iteration. Right. If there are six steps, you're down to probably thirty percent success, right? I don't know what point nine to the power of six is off the top of my head, but, it's going to be less than fifty percent, right? And so your hallucination rate grows very, very rapidly as you add complexity, and I think people underestimate that too.
Phil Howard: For sure. Round two maybe. Yeah, I don't know. Ringer up, do an automated phone call, something like that. So. Finish this. In which we can finish this anytime, match this together as well. It's no problem. We edit things, but, real quick, under pressure. You've only got three minutes anyways because you got to go to another meeting. How do you make a decision? Under risk? Under pressure. Accountability.
Michael Murray: Accountability. So, one of the sort of, eye opening books I've read, I think, is, Daniel Pink's Drive. This is a fantastic, summary of it on, on YouTube by RSA animate, which talks about autonomy, mastery, and purpose. And one of the things I've always tried to do in the IT teams that I'm leading is trust people to do their jobs with the information they have available to them at the time. So, empower people to make decisions. That's why you gave them the position in the first place. Support their decisions after the event. And commit to supporting their decisions. And that way you get people who are free to make mistakes without fear of repercussion. They'll react quickly and responsibly to events that are in front of them. And I think that's how you that's how you build successful teams.
Phil Howard: Autonomy, mastery and purpose. It was a great last soundbite. Just one little quick follow up. We've got one minute. What about when, you give them all that trust and everything, And they do it their way, and it's awesome and everything, but it's got to be tweaked. Is that okay? Or do you support them the way that it was or we need to make the changes, or how do we iterate as we make these changes.
Michael Murray: You can always improve, right? You can always iterate, but there's a way of doing it without sort of apportioning blame or coming down heavy handedly. Right. So if you trust someone to do the job, often it's because the requirements weren't specified correctly or the why wasn't clear or the definition of done wasn't clear. Right? So if they completed the task, Why do you need to modify it in the future? Do you really need to modify it in the future? And if so, let's make progress goes back to the perfection. Perfection is the enemy of progress as well, right?
Phil Howard: Understanding the real problem, the definition of done and getting busy doing work, those are like your three things to, recipe for success. Uh, Michael Murray, you've been heard. Thank you very much for being on the show today. It's been a pleasure and very eye opening for me.