The Moneyball Approach to Buying Down Risk, Not Superstars
summary
Uses the Moneyball analogy to argue for hiring and training that buys wins by focusing on one measurable first principle: Reduce the probability of material impact to your organization over the next three years. Cites concrete data points (≈200,000 Security+ holders, ≈90,000 CISSPs, ~60,000 CISSP job postings, LinkedIn’s 3.8% hiring dip in Apr 2024), shows many tools run at ~10% capability, and recommends role “fingerprints,” gap analysis against NICE, targeted training, and pipeline hiring (not just internships or unicorn recruits) to cheaply buy down risk.
AI-written summary · about
chapters (20)
- 0:00Moneyball in cybersecurity
- 1:02Why Moneyball fits infosec
- 5:16The 500k job gap myth
- 8:00Hiring superstars vs risk
- 10:27First principle for infosec
- 13:13Recovering from intangibles hiring
- 15:39People process tech imbalance
- 18:56Why risk quantification struggles
- 20:20Strategy vs tactics in security
- 24:36Workforce development as strategy
- 27:30Proving ROI on workforce
- 30:16Data-driven workforce programs
- 35:15Cybersecurity as a profession
- 37:41Closing workforce strategy
- 41:13Q&A on leadership hiring
- 43:21Process vs workforce growth
- 45:31Measuring EQ in cyber roles
- 47:38Try-before-buy contractors
- 49:23Gap analysis for roles
- 51:54Final Q&A resources
related talks
30mEffective security on a tight budget
33mSecurity on a Shoestring: A Low-Budget Security Revival Tour (Jared Casner)
48mSecuring Buy-In for Security Budgets
42mImperfect Security: Doing Less to Achieve Better Security
19mSo You’re the First Security Hire
27mSecurity Champions: The What, Why, and How
40mA Sustainable Security Workforce Starts at the Local Coffee Shop
30mCybersecurity Silver Linings