423- There Is A Cost To Know Things w/Steve Goudreau

423-Steve Goudreau
Host: Phil Howard
Guest: Steve Goudreau
________________

Phil Howard: All right. Well, welcome everyone back to You've Been Heard. we are
talking with Steve Goudreau today. So Mr. Goudreau, I guess this is more advice
of how do you go about finding a job in it? Right? when you go to look for a
job, do you look for a place where you can go in and you're like, oh man, this
is going to be so easy to impress these guys and it's going to be really, really
awesome. And they're open to, technologies as a business force multiplier. And
we're really going to be able to make a big change or you're going to go
somewhere that's like super technology heavy, where like everyone in the
organization is kind of already an IT genius themselves, and the predecessor had
built everything. How do you go about doing that?

Steve Goudreau: Well, I mean, obviously there's, there's pros and cons to each,
right. and in my current position, I didn't come in, knowing what I knew. you'll
never know the complete state of the department until you're there for a couple
months anyways. But I go into looking for, a place to where I can have that
personal relationship with leadership. I think that's the most important. I
mean, as much as I'd like to come in and be that network hero who comes in and
and writes the ship. I want to be that person who can make that difference to
where, maybe the previous IT director, couldn't move certain projects forward,
couldn't articulate the need for, an MDR or couldn't articulate the need to
change how they're doing reporting or things of that nature. it's going to be
what the appetite of the organization is for change. and it is change. and as
long as that organization isn't resistant to change, I think, that's the biggest
things that, when I evaluate a prospective employer is, the difference you can
have is going to be proportional to the amount of resistance the organization
has to change.

Phil Howard: So the old school IT leader or the old school mentality, which
we've alluded to a bit, is maybe I've been in the IT role for ever since the
invention of the dot matrix printer. And I came in right after punch cards and
we were putting network cards in. That's how long I've been at the company.
Right. And I speak a level of nerd that makes people want not to get on the
elevator with me alone. And I only say that because my father in law, like when
he worked at ConAgra, like they used the IT guys used to come in and people
would joke around like, don't get on the elevator alone with him. And so you
have that person that is essentially trusted and maybe sitting at the executive
round table. And then you have and they've been there for so long. And, maybe
it's nice that they've made their career out of it and then you come along and I
guess the difference is, how much nicer is it to be heard and actually heard by
executive management and have that relationship versus just be the guy that
speaks and everything kind of goes over their head? And what do you do to be
heard? So if you're looking for a job that has that relationship, what do you do
to create that so that they actually listen to you and would approve? I don't
know, we need to put money in for managed detection and response or whatever
endpoint detection response, whatever it is, security.

Steve Goudreau: Yeah, that's a great question. because what works? And what I
found out what works at one organization is not going to work at another
organization.

Phil Howard: are you saying communication wise or.

Steve Goudreau: Yeah, communication wise. like where I'm currently at Ice, I
have a seat at the round table, if you will, at midway, even though I had five
times as many people reporting to me, I did not have a seat at that round table.
They had five directors and they would not have a director of it there. They had
an IT manager. I ran the largest department that wasn't headed by a director.
and, when we'd have our monthly, management meetings and ops calls, when I first
started there, the slides I was presenting from the previous, head of it was
basically helped us metrics. And I said, well, I don't think this really
encapsulates all that it is doing. And so they let me kind of freestyle. So I
took it from two slides to eight slides. And after about four months they're
like, yeah, that that's just too many slides. it wasn't the content. I was
taking up too much time in the meeting. So trying to find the level of
information that was germane to the people in that room was different than
giving them the level information time wise, that they wanted. So like I was
trying to make a big push on the OT security side, having them understand that,
but that's not something they necessarily want to report it out in the monthly
management meetings. Whereas where I'm at now, there's a bit of a, I think all
in it the fear of missing out. Right. Like with AI, people like, well, we have
to do something with AI. We don't want to be the last company to that dance. I'm
like, well, making a bad decision is worse than making no decision. nobody can
possibly know every AI company out there. And what would be helpful to your
organization? and you'd be crazy just to blindly be throwing darts at a board,
hoping you're finding the right solution. without asking those questions of the
organization. First what's our goal with AI? is everything just about ROI? Is it
not just about improving efficiencies? what are we trying to get out of that?
And I think some organizations are open to hearing those questions where I think
other organizations just want to see product on the board. And, you keeping up
with technology.

Phil Howard: two things that are really, really important here. The AI thing we
have to table for a second because that's deep actually. but what's also deep
is. What do you put on two PowerPoint deck slides in a management meeting? is it
like what we're paying now? What we will be paying tomorrow is that the two
slides or is it, how we got screwed by a ransomware attack, why we're not going
to get screwed tomorrow and why you should write this check. I mean, it's
actually like a pretty profound point, which is I used to think five slides was
the maximum, right? It should be two slides now. And should we use AI to write
those two slides? But it's like it presentations to the board should be two
slides. That's how you get heard. What's on them.

Steve Goudreau: Yeah. So, you want the information you're presenting to move the
company forward, right? if you're presenting, your regular KPIs of this is how
many tickets we open this, how many tickets we closed, here's our user awareness
training statistics and here's how many threats our MDR caught. I mean, that's
operational information. How do you keep that conversation moving forward? By
just presenting. I'm not going to say static metrics, but metrics that are just
point in time. I wanted them to understand, projects that everybody was working
on, so that they knew the things we were doing with the ERP system. They knew
what we were doing in OT security, they knew things we were looking at with
hollow lenses for engineer support and things of that nature. Because I think
sometimes if you expose a broader group of leadership to these concepts, they
start asking questions. And from those questions you can actually. That's how
you move the conversation forward.

Phil Howard: Did they care about your reporting on all those projects?

Steve Goudreau: Some yes, some no.

Phil Howard: It's like showing someone a Kanban board. Look what we did.

Steve Goudreau: Yeah.

Phil Howard: And it seems like they need to know that information. But what I've
found, and I've only found that because of what we've been doing with AI
ourselves behind the scenes and rebuilding a CRM and realizing we don't need
Salesforce anymore, we don't need HubSpot, we can just build our own over the
weekend. Which sounds crazy. And all my software dev friends laugh at me and
they say, you're an idiot. but then the other half of the software dev guys say
those guys are in denial. And you're right, that's like a whole nother thing.
what I've found is that I think the C suite really wants to see how is it making
our vision come to fruition? Faster, better, richer. and what we want to say as
it leaders to them is, We can do two projects at a time. We can't do twenty five
and which of these twenty five projects can we delete that will never get to
until twenty forty. And by then everything will have changed anyways. So we
might as well just delete them now. Do you think that that's a true statement or
am I out of line?

Steve Goudreau: No, no, I definitely think that's a big part of it. I mean,
again, every organization is going to be, a little bit different when I worked
for ArcelorMittal, I mean a fortune five hundred company. there was boilerplate
templates and things that they wanted to see information necessarily. but I'm
still good friends with, their director of it, who's now their vice president of
it there. So he got to sit back where the IT person should be sitting, having
that conversation with the board of directors, if you will. but they saw the
inherent value in information and business intelligence that they were doing
with the ERP system and with the MES's systems. I'm like, if you can become that
hero in there saying, look, our oes will go up by understanding the data that we
have or that we don't have the data to make those decisions. because that's one
of the biggest, driving forces to me behind AI is everybody's like, oh, I can do
all this great stuff. Do you have the data? Like I have a couple different
quality systems right now, disparate data around it. If we wanted to make better
quality driven decisions, I'm like, do I have the right information to make
those decisions? I mean, you can say that's a management leadership, trait all
the way around, but AI without any relevant data behind it, won't make any
decisions that make any sense to you. And that's our biggest drive right now. My
organization is, as we develop our strategy, it's good to say that there's all
these tools that do all these things, but if you don't have, your HR data and
your quality data and your production data and your shipping and materials data,
that can be ingested to help you make these decisions. I'm like, all the tools
in the world aren't going to make a difference.

Phil Howard: Now we have a good transition, the data cleaning side of the house
and having like a really good, I guess, single source of truth for where all
your data lies. the AI thing that's interesting to me it's what's interesting is
everybody in a, like you said, like every CEO basically saying, I need an AI
rollout plan on my desk by Monday. So we're not like behind the race, Right? but
I'm wondering where like, I was talking about this the other day and yes, it was
a data thing and like, how do we use data and how can we analyze that data to do
everything that you basically everything you just said and make actual decisions
that will make sense and move the company forward? But to me, and then like you
said, there's a thousand AI products. If you're even thinking AI product, I
think you're thinking wrong because I think that's the old mentality of someone,
hey, we can build an app for that. We can build software for that. But it's
really more, I think what would be more beneficial is AI training and training
end users, how to use AI, to do their jobs better. I think.

Steve Goudreau: Yeah, I've taken the initial strategy of, having people a
understand what, basic concepts like prompt engineering and things of that. But,
coming at somebody who's deeply embedded in security is having people understand
what happens when you put your data in a generative, platform, it writes a great
RFQ for me and I just throw it in chat and it spits it out. I'm like, are you
paying for that ChatGPT? Or is this, a personal one? because it's ingesting that
data and it's going to use that information you gave it to make other decisions.
And that makes your data public. And even if you're using a copilot or cloud or
something that it's even if it's not sharing that data with other organizations,
it's using that data to train its large language models. So understanding the
how you're interacting with all the free versions, and that little copilot on
your, on your desktop. I think people have to understand, the safeguards that
need to be put in place around the data you share to have AI make decisions for
you or create a presentation or, clean up, on an RFQ or an RFP. I've been
starting with security because I think that's important before, you start having
the bigger conversations so people just don't,

Phil Howard: Claude co work and now it's sending emails and reading emails on
your behalf. And, then you've got a whatever. It's not Claude, but now or
whatever we had to change it to running multiple agents for you and reaching out
to customers.

Steve Goudreau: Well, the amount of requests I get, in my. Admin three hundred
sixty five portal for people saying, hey, I'm requesting Monday dot com to have
access to our organization to be able to, read this and read that. And I'm like,
well, I'm going to pause that because now I have to take my own time out to look
exactly the permissions it's asking for. And what are you trying to get out of?
this connector into office three hundred sixty five into this third party
application that, a we're not paying for, it's that shadow AI that scares me the
most. I think that's been a problem throughout all of it is, you have cost
estimators who use a certain program to do all their cost estimating, right?
Hey, I wasn't part of I mean, it wasn't part of the setup. whatever information
there is, they create an account. It's totally separate from anything. It has
any purview over that person leaves the organization. I can't disable an account
for, a lot of third party applications that a, I don't know about or B have no
access to. I'm like, yeah, those are questions that, for years weren't, things
you were asking. But, now, especially with, AI's ability to, have as little
spider webs into everything is well, what other shadow AI is out there that our
organization's been using? and how do we make sure that the information, the
data governance policies that we have are enforced in these things that
everybody signs up for that you'll have no idea about.

Phil Howard: Well good question. How do you do that?

Steve Goudreau: You create a policy. Yeah. I can create a policy saying all
these things must be approved by it.

Phil Howard: I'm a big Alex Hormozi fan. For some reason. And he was talking
about it the other day and he was like, for all the people that are like super
paranoid, it's going to do this, it's going to do that. He's like, there's going
to be a few bad outliers. He's like, but for the most part, it's like any new
technology, it's, you got to use it and you got to get past like super paranoid
point. I'm thinking in my head right now, that's not going to fly with, a lot of
IT guys and their end users out there. But there is a certain inevitability of,
like you said, like you can't really see anything there's going to be out of, I
don't know how many end users do you guys have two hundred plus or something or
what?

Steve Goudreau: Yeah, about two fifty.

Phil Howard: I mean, out of two hundred and fifty people, it's just a straight
up eighty even. You get the eighty twenty rule, right? Maybe twenty percent of
the people like care about a policy. And remember what they signed in HR that it
changed or like, something like that. And then you've got the eighty percent,
then you've got the real bottom, like five percent where you've got some
disgruntled employee, you have out of two hundred employees, there's got to be
at least five. There's got to be at least five super red flags don't give an
absolute crap at all. We'll click on anything. Don't care. Do whatever they want
to get home. At the end of the day, what we need is a program for sifting those
guys out. How can we tell who's like the most dangerous, we got to use AI for
that. so there's a certain level of like inevitability. So yeah, what do you do?
I would love your answer on that. There's going to be some security tool, I
guess, and we have too many tools already. Arctic Wolf.

Steve Goudreau: The one thing I like about article user awareness training.

Phil Howard: Here we go. Okay.

Steve Goudreau: Yeah, it gives you like, your top, like employee threats, like
these are people failing quizzes, clicking on phishing tests. And, it's doing
its behavior algorithm saying, these are the people you should focus on the
most. and, sometimes you'll get the pushback like, well, that person's a press
operator only gets on that machine once a month. I'm like, but he's still
interacting with the computer system. He needs to have these basic fundamentals
down. I mean, the one phishing test that gets everybody, seventy percent of
everybody, almost every organization I've been at that, you may have regular
phishing tests.

Phil Howard: Can I guess?

Steve Goudreau: Yeah.

Phil Howard: Guess is it approve your vacation time?

Steve Goudreau: It's anything HR related. So yes. Yeah.

Phil Howard: do you know anything about statistics on how much ransomware people
make? Like, do you know who it was? Like, how many Russians?

Steve Goudreau: It was Russians. it was ransomware hub.

Phil Howard: Okay.

Steve Goudreau: Stryker is a medical device manufacturer, and, they had ten
petabytes of data stolen, ten petabytes. I'm like, how does that happen? what
systems do they not have in place that flag ten petabytes being expelled from,
their servers or their cloud or whatever.

Phil Howard: How long would that take, first of all?

Steve Goudreau: the hacker came in through their China subsidiary. It looks like

Phil Howard: Oh, wow. They actually have it's, it's so much healthcare. So much
healthcare.

Steve Goudreau: Yeah, there's usually, two or three times a year, I'll get an
email from one of my healthcare providers saying that we had a data breach back
in this date. the law says we have to let you know, but we don't think you're
personally affected. Yada yada.

Phil Howard: yeah, I got one the other day. So, it's back to the AI thing. So,
if there was one thing that you needed C level executives to understand in here,
one thing, what would that be loud and clear.

Steve Goudreau: it would be the same message that I think we all have is that,
treat it not as a cost center, but as a force multiplier, as a productivity
enhancer. I mean, depending on the organization, some see it better than others.
I'm lucky at some of the places I've worked where, if we didn't start off that
way, we ended that way. But I think that's the biggest message. I would have,
technical debt will cost you a lot more later than it will, by not doing
upgrades, not looking at the latest technology, things are going to; it costs to
have good security, it costs to have good productivity, it costs to stay ahead
of the curve.

Phil Howard: That's a good point. How does tech debt cost us more later than
now.

Steve Goudreau: Yeah. I guess making sure you're asking the right questions of
your IT leaders that they can prove that, you're not at risk simply because
we've overlooked things or have deferred upgrades or haven't looked at certain
technologies.

Phil Howard: That's actually a great question. We're going to use this from now
on. What are some questions CEOs should be asking their technology leaders?

Steve Goudreau: Yeah. Well I mean they should be asking, at a bare minimum of
where do we sit on our technology stack? and if you have the right, director c I
o v p who can put that in layman's terms of, like, yeah, we have to be at
windows eleven because windows ten support ends at this date, or we have to move
to this, newer version of the ERP. We're going to move from flex classic to
Plex, whatever their latest version is, because there's no support on the old
version. yep. There's going to be training that has to happen. making sure that
that CEO is getting the answers that they think they, that will help them make
those decisions. I mean, explain to me the tech stack, explain to me where we
are with our competitors, right? What is everybody else using? Why did we choose
the technology we're using? Like, I love having those conversations. there's
going to be times I'm like, well, it's what we could afford, but it all the bare
requirements, right? and there's going to be times like, well, we need to spend
more money to have this level of security. We need to have this, spend this more
money to have these business intelligence tools. we need to spend money in
training for our staff to make sure that we understand the tools we have or that
they're going to the right conferences, and attending the right webinars to make
sure that, we're being kept abreast of the latest technology. and then the CEO
should be asking like, well beyond, like, what is the benefit to the
organization? And they often overlook, in my opinion, a lot of employees enjoy
working with new technology. they want to be kept abreast of the latest things.
So, and employee happiness, especially in it, I think goes a long way. if not,
you end up with a stagnant workforce, working, just as well, no new laptops this
year. So we'll just make do. I've never had a problem being told no, but I'm
going to ask all the time. I've had my hand slapped over camera projects and
things like that in the past, but it's your job as an IT leader that the
organization know what the organization needs. If there's not an appetite for
it, that's fine. They will know where we stand on things. And I told, my
steering committee when I started, I formed an IT steering committee, with the
CFO, director of finance and the president. I said, we're going to, meet weekly
and you guys are going to know exactly where we stand on things. If there's not
an appetite to do A, B, or C, at least you're going to know, that A it should be
done or what the ramifications of not doing anything are.

Phil Howard: Yeah. It's good. what are some more things that we can do to get
away from being labeled, the department of it as if it's this separate entity
inside the company, do we say the Department of Marketing or the Department of
Sales? I'm just like, this is one of the things that comes up a lot. People are
like, we don't want to be referred to as the department of it anymore. When it
is the thing that touches every aspect of the business, and there's not a single
person that can do their job in any department at any level of the company, with
the exception without it touching it. Someone tried to argue one time that, oh,
like we repaved the parking lot. I t wasn't involved on that. I was like, you
better believe Someone cut a Po for that. So it did touch it at some point.

Steve Goudreau: Yeah.

Phil Howard: And they forgot to trench the extra like conduit underneath the
parking lot for the new fiber that needs to be put in in the future someday. So,
it should have touched it.

Steve Goudreau: Why? The phrases I like to use is especially when you're when
you're talking about researching new technologies, I'm like, there is a cost to
know things. I mean, we always say that there's a cost to doing something.
There's a cost to doing nothing. Right? if you take the stance that we're not
going to do something this year, it's still going to cost in more labor into the
IT department. having to have more interactions with the endpoints because of
the age of them. Right. and there's a cost to not investing in certain security
tools. You could get ransomware. That's a big cost, but there's a cost to know,
like we're going through our AI journey right now. I'm like, you have to engage
other parties to find out what you don't know. and there's going to be, cost to
training, webinars, seminars, engaging the right people. And like, if you're not
willing to ever pay that cost to, that cost of that knowledge or the cost to
know, then you're going to end up in a spot where, you have the right people,
but they might not have, they might not have exposure to everything out there
that, leads them in new direction, leads the organization a new direction. I
mean, AI is just the best example of that right now. I mean, I'm sure you've
seen that Wolf of Wall Street meme, where Jordan Belfort then goes, sell me this
pen and the guy and the new one is the guy who says it has AI. I'm like. I've
given you the buzzwords. Now I can sell you this pen.

Phil Howard: I think that, there's a cost to know things. yeah. That's golden.
because you're going to pay a cost if you remain stagnant, you're going to pay a
cost for not knowing things.

Steve Goudreau: Right? I mean, it's the old tautology. We don't know what we
don't know or we know what we don't know. It's probably a better one.

Phil Howard: If we know that we don't know, we know that we don't know. that was
great. is there anything that, we'll just end with this? Is there anything that
you think in your career has led you to be successful in the leadership position
that you're in? Is there anything that is there something that we'll leave this?
Is there something that someone should go? No, should go get the knowledge to
know that has brought you to where you're at?

Steve Goudreau: Yeah, but it's not technology. To me, it's those soft skills
that make all the difference. And the people you have around you as a mentor, I
wouldn't be where I'm at, without the Rob horwood's without the dick offs,
without the Jason Lamberts and the Steve Galloway's of the world and the Larry
Dragon people that you looked up to or people you had working relationships. I
mean, I've learned stuff, more stuff from bad leaders, to be honest with you.
I'm like, oh, that's not the way to handle it. I'm not going to do I don't want
to be like that. and good leader.

Phil Howard: I would love your best example,

Steve Goudreau: I've got a good one. I had a manager once, I am notorious for
coming into work early. That's my old military in me. and I would be in to work
usually about forty five minutes early. We had an employee, a coworker of mine
that struggled to show up to work on time. And, she didn't want me filling out
my time sheet saying that I got there at six fifteen if I wasn't supposed to be
there till seven, because this other person was. It just it looked. I said,
yeah, but I'm not charging for that time. But I'm here the next day, after she
got on me about that, I showed up at like six fifty five and she's like, is
everything alright? I'm like, what's the matter? She goes, well, I noticed you
were late today. I'm like late. I said, I'm still five minutes early. She goes,
well, yeah, you're only at six fifteen. I said, you just told me not to be here
that early because it looks bad. And she's like, well, no, just don't put it on
your time card. I'm like, well, I'm not doing that. I'm like, it's either one or
the other. I'm like, you're trying to fix the wrong problem here. And the people
who know, know exactly what I'm talking about. If we've all worked with, a
manager more concerned about the things that, make no difference in the world
than the ones that do. And, there's a great, phrase of nothing will frustrate a
good worker than watch you tolerate a bad one. And that's the lesson I've
learned, in leadership from bad leadership.

Phil Howard: Yeah. I learned you definitely don't want to waste time on all your
C players. You really want to spend time on your A players, because they're the
ones that are going to make the biggest difference and spending money on one
really good person rather than five average people makes a massive difference.

Steve Goudreau: Yeah it. Does.

Phil Howard: It really makes a huge difference. yeah, even paying like I also
noticed that hiring the absolute best in the industry, even though that price
might be. I can literally tell you, I used to try to do something for like the
one job I was trying to do for two thousand five hundred multiple times in a row
and five thousand dollars here and there, never got the job done for three
years. Then I decided, oh, I'll pay one hundred thousand dollars for that job as
very scary and very apprehensive as I was. I did. So what is that percentage
difference? That's a lot.

Steve Goudreau: Yeah.

Phil Howard: I mean, it's like, wow, what is that one hundred thousand divided
by? I should be able to do this math. Isn't it like a decimal point or something
like that? It's yeah, it's yeah, four thousand percent or four hundred percent
or whatever that is. Is that right? it's ridiculous. And what happened was I had
been going for three years trying to do the same project. Fail, fail, fail,
fail, fail. Two thousand five hundred here, five thousand there, six thousand
there. Fiverr guy, this guy because you're trying to do something and then pay
the hundred thousand guy took three months doing nothing as far as I could tell.
But what he was doing was listening to every podcast, digesting every episode,
taking all of the text, listening to all the IT guys, looking at all the
competition. Right? And then what he came back was what he came back with was
like, okay, I'm ready. Phil, are you ready for what we're going to do today?
Yeah, your podcast is going to be called You've Been Heard. Why? Because every
guy that's been in it has had a seat at the executive round table and worked for
years to get there. And being there is great and everything, but how much better
would it be if the IT guy could actually be heard and understood? And like I
think so many IT guys have been almost brought to tears when I say that to them.
They're like, that's it, man. They're like, that's it. They're like, that's it.
We know the firefights. We know the late nights. We know the servers. We know
the ransomware attacks. We know that when everything's on fire and everything's
breaking, it is the most valuable department in the industry. But when
everything's working like a well-oiled Tesla and everything's smooth and
nothing's going on and nothing's wrong, we're a cost center.

Steve Goudreau: Yeah.

Phil Howard: We were just like, whoa, man. Like, that's what someone that really
knows how to like break things down and is really a professional in there. I
don't know, whatever lane, whatever you want to call it. that's just a big
difference between A really good employee and five stale ones.

Steve Goudreau: I agree.

Phil Howard: Mr. Goudreau, it has been a pleasure talking with you today. Having
you on the podcast. And, you've been heard.

Steve Goudreau: Pleasure as always.

Phil Howard: have a great day.

Steve Goudreau: All right. We'll talk to you.

Phil Howard: Yeah, man. Take care.

Steve Goudreau: Bye.