Episode 17
Mastering the Basics in a World of AI
Key Takeaways
Mastering the basics remains essential, regardless of how advanced technology becomes.
Military leadership principles, including preparation, teamwork and leading from the front, can translate into effective cybersecurity leadership.
Security teams must prioritise risks and make practical decisions when resources are limited.
Automating repetitive investigations, evidence collection and compliance activities can free teams to focus on more valuable work.
Cybersecurity leaders should avoid chasing perfection when a practical, risk-based approach can deliver better results.
AI initiatives need measurable outcomes, including improvements in efficiency, effectiveness and cost.
Organisations must balance the speed of AI adoption with appropriate governance and risk management.
Effective cybersecurity should protect the organisation without unnecessarily disrupting its ability to do business.
Mike’s Watershed Moments
For Michael Lyborg, there wasn’t just one watershed moment, but three defining decisions that shaped the direction of his personal and professional life. The first was leaving Sweden and moving to the United States as a young man. Arriving with little more than a backpack and a suitcase, he had to start from scratch, navigating a new culture, understanding how things worked and establishing himself in an unfamiliar country. It was a significant change that opened the door to opportunities he hadn’t necessarily planned for.
The second came following the September 11 attacks, when Mike faced a decision that would change the course of his career. He could return to Sweden and rejoin its defence forces or pursue military service in the United States. He chose the latter, joining the US Marine Corps. That decision led to years of military service, from infantry to more specialized operational roles, and helped develop the discipline, resilience and leadership principles he continues to draw on today.
But Mike considers his third watershed moment the most significant of all. While serving in North Africa, he met his future wife, Ashley, who was working with the US Department of State. Their relationship prompted him to reconsider the path he was on. Rather than continuing toward a full military career, they decided to build a life together in Colorado. It meant another fresh start, but one that ultimately brought him back into IT and network security and set him on the path toward becoming CISO at Swimlane.
Looking back, Mike recognises how each decision led naturally to the next. What began as a move across the Atlantic became a military career, which eventually gave way to a new chapter in technology and cybersecurity. Of all those turning points, meeting Ashley stands out as the decision that changed everything, both personally and professionally.
Full Transcript:
Declan Waters (00:01.000)
Hello everybody and welcome to the Watershed podcast. Everyone we have on the show has had a watershed moment, a point in their career or a career where something has changed and there's been no going back. The idea behind this podcast is really to get beyond the usual business story and to talk about those moments, the difficult decisions that came with them and what people learned along the way and the challenges they're dealing with today.
Today I am joined by Michael Lyborg, CISO at Swimlane. Michael is actually one of the more unusual backgrounds of anyone we've interviewed on the watershed so far. He grew up in Sweden, started his career in technology, served in the Swedish Army, and then after 9-11 made the decision to join the US Marine Corps.
He then went on to serve with MARSOC and graduated from the US Army Ranger School as an honor graduate of his class. Michael eventually returned to technology and cybersecurity and today is the CISO at Swimlane where he's thinking deeply about security, operations, AI, autonomy, and where humans still need to remain firmly in control. Michael, welcome to the Watershed.
Mike Lyborg (Swimlane) (01:14.000)
Thank you, Declan. Appreciate you having me today.
Declan Waters (01:17.000)
Absolute pleasure. So Michael, as I mentioned, I found your story while researching you really fascinating. And I think, correct me if I'm wrong, but apparently what I've seen is that this may have all started because you broke one of your dad's computers and he basically told you to, you broke it, so you have to fix it. Is that actually what happened?
Mike Lyborg (Swimlane) (01:39.000)
Yeah, that is a fact. What's strange to me is like, well, wait, where did I talk about this? So how would you have known? Like whatever kind of OSINT, you're doing on me, great job. I got to give you that much as well. So no, in the late 80s, I think the early days of 386 compute, Microsoft DOS, right around the cusp of Windows 3, and then obviously onward. I like to tinker.
I like to build games like Turbo Pascal, and I somehow managed to absolutely murder my dad's PC. And from there, I I basically got a task to go ahead and figure out what I did wrong. And there wasn't really internet and there weren't a lot of books. So it was trial by fire to restore and remediate whatever I had broken. So yeah, that is a fact.
Declan Waters (02:35.000)
Yeah, that's good. Well, I'm pleased I got that right. I wasn't I wasn't entirely sure. So I'm pleased with getting off on the right on the right foot. So maybe just dig a little bit deeper into that. So what was it about fixing the computer. Did it, was it at that point, Mike, that you started getting into technology? Did you start getting more hooked after that happened?
Mike Lyborg (Swimlane) (02:59.000)
Yeah, I mean, I was really a young teenager at the time and didn't know what I wanted to do in life, like most teenagers, right? So, and it was the early days of BBS as well. So like, you know, modems and everything else in the early 90s. So figuring out ways to communicate and doing research and it was just fascinating to me.
So I dove right in, but then there was school, there were sports, there were a million other things that were equally important. So I didn't know if that was the route I was going to go. But later on in the, I guess it was 96, yeah, 1996, I got an offer to come to the US and do an internship at a a computer networking shop. And that's when it really took off. Yeah.
Declan Waters (03:52.000)
How did you feel about moving to the US? Was that something that you were sort of actively thinking about at that stage? Or was it something that just came to you and you thought, I'll take the opportunity?
Mike Lyborg (Swimlane) (04:04.000)
Yeah, it was more of the latter. Obviously, in 97 to 98, I was in the Swedish Army. a light infantry air defense unit way above the Arctic Circle. It's horribly, miserably cold. And the company that interned at, they were in LA, lower Alabama. So close to the beach, like Gulf Shores, beautiful white sand beaches, warm water.
I was like, you know what? Let me take a stab at seeing what the US is like to live here and work here. And so crossed the pond, as you say, and then started continuing to work more on the network and security piece and then obviously doing what we had to do to grow the business.
Declan Waters (04:55.000)
Yeah. Before we hit record, we were talking about the fact we both moved to the US from Europe and it is very different. How would you characterize that? that move for you? How did you find it looking back on those days?
Mike Lyborg (Swimlane) (05:12.000)
Yeah, I mean, I came in pretty light with like a backpack and a suitcase and that was it. So to start fresh, I guess it's like anyone in any country or border that you cross, the biggest thing was that there was a big difference in culture between southern Alabama, right, and Sweden, like Gothenburg or Stockholm, wherever you kind of grow up in Sweden. And so getting used to verbiage and very different dialect as well.
That's why I probably sound like my English is completely butchered, right? Because there's been a bit of the Queen's English in there. And then going back to obviously Swinglish, as I like to call it, and then Southern accents and draws and everything else.
And just like, Football, like American football. That was a huge shift as well, like watching soccer growing up and heavy into ice hockey and thinking like, well, there were pads, right? Like how tough can they be? But then going to University of Alabama games, I was like, all right, this is freaking awesome.
Declan Waters (06:23.000)
Yeah, In terms of weighing up the, was it a difficult decision for you? Because we're getting to know each other. But I just, I feel like you come across as someone who is, incredibly composed. I would say like the word unflappable comes to my mind. Maybe that's your army training, but you seem very in control, very, in tune with what you want to do. How did you feel? Has that always been the case or?
Mike Lyborg (Swimlane) (06:59.000)
No, I was going to say there's two points there. One, my wife would beg to differ. And 2, yeah, I mean, I was in the Swedish Army and then I was in the United States Marine Corps. There's some leadership traits there and something that, you know, in the Marine Corps that's huge, she's like bearing. So back in the day, in like Paris Island, you'd get absolutely eaten up by different types of bugs. And you weren't allowed to show any kind of like you were affected at all.
Declan Waters (07:33.000)
Yeah.
Mike Lyborg (Swimlane) (07:34.000)
And some of that is probably continued on through life, but I'm certainly not unflappable. I'm flap a lot, I should say.
Declan Waters (07:44.000)
Well, we should get Mrs. Leiborg on for maybe the follow-up session. We can chat to her. I want to just kind of move on to the watershed moment. It is a fun question that I get to ask everybody on this podcast.
And it could be one moment, it could be two in your career, it could be business related, Mike, or it could be more personal. But is there anything that kind of like comes to mind in terms of, yeah, that was a really important part decision in my life that I took there?
Mike Lyborg (Swimlane) (08:18.000)
I think I could narrow it down to four or five. I know that we don't have hours to talk, so I'll be pretty brief. I hear all of them.
Declan Waters (08:26.000)
Yeah, absolutely.
Mike Lyborg (Swimlane) (08:27.000)
All right. Well, so the big one was obviously moving to the US. That was a big change, personally, professionally, starting completely new. You know, even the simple thing like building up a credit history here in the US wasn't necessarily easy as a, what was it? I was 2098. Yeah. But getting started with life and learning all the intricacies here in US policy and government and everything else.
9-11 was the second one because that's when I made the decision and it was kind of like a bifurcation. I could either go back to Sweden and rejoin the National Defense Force there or do what I ended up doing was join the Department of Defense at the time. And I was fortunate enough to be accepted by the United States Marine Corps.
And that set the path probably what I needed at that young age was pretty well like boxed in, right? Early days of infantry. And then that later changed to some other operational units. But that goes to then my third watershed moment. And that was I met my wife She was working with Department of State in Northern Africa and I was doing some other stuff in a country there.
And I met her there and that was really the big decisive change. The biggest one, personal and professional, because that's what then, I mean, I would have been retired right now from the Marine Corps and I don't know, just sitting at home watching TV every day. I don't know if I would have been that person, but could have been. Instead, we decided like, hey, let's try this out.
And moved to Colorado, which I'm where I'm at now, and then started completely new life here with Ashley. And that was very transformative, getting back into IT and network security, and then kind of setting the path up to where we're at today. So yeah, maybe those three watershed moments were key for me.
Declan Waters (10:32.000)
Yeah, that's lovely. Thank you for sharing that with us, Mike. You know, it's And then you went into the next chapter of your life. Life is a series of chapters, isn't it, at the end of the day? And you moved in. What I'd like to just touch on is this relationship between the military and leadership.
You know, you went from the Swedish Army to the Marines, MARSOC and then Ranger School. So when you When you did come back into civilian life and then into this next chapter in technology, what did you sort of discover you'd learned about leadership from your military career that you're able to take into corporate life? Very interested in hearing that.
Mike Lyborg (Swimlane) (11:20.000)
Yeah, I think some great takeaways is whether you have, like in MARSOC, we had pretty decent funding, right? But back in the infantry days in the Marine Corps, we had We didn't have great gear, we didn't have great weaponry, but what we did have were great, I guess, bodies and minds. Sounds weird, right? But we were young, we were extremely fit, and we didn't need all the special gear because we mastered the basics. So move, shoot, and communicate.
And I'll still talk about that today, even at work. I mean, we don't necessarily shooting stuff here, right? But it's still how do you approach a problem? and how you communicate deliberately and make sure that you have a plan in place, not just a primary, but an alternate contingency and emergency plan in place for all things. And leading from the front, I think, is a big That's difficult to do because that means you have to, A, been there and done that.
But when you lead like that, at least I would, that's what I try to do often. It means you've had to have done forensics. You have to know investigations. You have to know the stress that goes in and being under a time slot or hitting a target or a specific time and date. I know I'm kind of rambling right now, but there's so much there. But being good at the basics, mastering the basics and being a team player, I think goes really well with leading from the front. Yeah.
Declan Waters (12:59.000)
fantastic. That's great advice, Mike. Thank you. So take us through it. So after you left, you went back into corporate life. You're now the CISO at Swimlane. which I'll come on to in just a bit, but just catch us up on the story. How did you get to Swim Lane? What happened in between?
Mike Lyborg (Swimlane) (13:15.000)
Yeah, so between Morsoc and Swim Lane, did some contracting, which was good, because now you're paying taxes again and other things. I'm not saying we didn't pay taxes as service members, we certainly did, but taxes were pretty easy when you're living in a barracks or whatever, or you're deployed all the time. So getting acclimated, I guess, back to the private sector was healthy there through contracting.
And then that company that I was just telling you about, what a great, phenomenal opportunity. They had a pretty large IT team, not a big security program. So we had the ability to kind of build everything from the ground up. And that took a lot of the security mindset from the military with me. If you're in Afghanistan on a hilltop or on a ridgeline or whatever, you're setting up some sort of patrol base, you may not have perfect 360 degree security.
So you're going to have some gaps. And then you have to make assessments, a risk assessment and be like, if I was the enemy, where would I, what's the most likely course of action or where would I attack from? And all right, let's create some defense in depth there. Maybe we can cover it with some mortars, machine guns, some claymores, some more people, and then move into whatever it is that we're actually protecting. So looking at the company I was at, we took a similar approach and it just ended up working pretty well.
We didn't have unlimited budgets. So it had to be priority at work, figuring out what was the largest attack surface and then work our way back towards the crown jewels until we felt comfortable. So doing that was super fun. And I know you and I, we talked about Nutanix, right? So one of the great ways that I feel that helped us out through all of this was taking a very ordinary like laptops, PCs everywhere, and converting everybody to thin workers, like think clients, and then VDI.
And then seeing how easy it was to manage the workloads and secure them and turn and burn if something was needed to be, or something was compromised or something was wrong. That was pretty awesome. So from there, One thing that I learned was, whenever we were doing a security investigation, or maybe we were dealing with Sarbanes-Oxley or PCI DSS, like some sort of audit, right? Like it was so much manual work.
And I was like, this is such a waste of time for everybody involved. So we started building a bunch of PowerShell, like Bash and Bash scripts, Python scripts that would then go and automate this. Every year when it was audit season, we ran a bucket of scripts, if you may. They went and gathered all the evidence, we normalized it, so ETL on everything. And then when the auditors came in, they're like, oh, how long did it take for you guys to do this? And we're like, a couple of minutes.
But that was building that program from the ground up and identifying where the data was at, what the requirements were, and what the regulators and auditors, kind of what they wanted to see as part of evidence collection. And then that then is where I found Swimlane, because Swimlane does this really well. It's just an enterprise platform, right, but with a UI. So that's how I ended up here, yeah.
Declan Waters (16:48.000)
And that brings us nicely. back into swim lane, doesn't it? How would you characterize the problem that a company is trying to solve, Mike?
Mike Lyborg (Swimlane) (16:56.000)
Right, so my boss, co-founder, Cody, he was doing similar things for really large enterprises in the US government. And he's like, man, this is not sustainable. We're not fast enough. We can't really orchestrate or get all the evidence fast enough. So When he started this company in 2014, he was dealing with the same problem. And that was 2014 when I was doing the exact same thing for this public company.
So when we kind of married up and met up, that's when the fun started and we're like, okay, what did you see? And so then being kind of more of an advisor, that's what I did the first couple of years, was travel around the world and work with some of the largest companies. and kind of advise and assist, but then also listen and learn. Because whether you're in Australia or you're in Japan or you're in Europe versus here in the US, like they're very different compliance frameworks and requirements and technologies and also different cultures.
So to get basically jump straight into these enterprise companies and see how they're doing it and then also try to figure out like, well, how do we make the the infantrymen happy, right? Like the tier one, the tier 2 analysts. How do we make sure that they, when I leave in a week or two, that we deliver the outcomes, not only for the executive teams and the security and risk management leadership, but also to put smiles on those faces? That was the biggest takeaway.
Declan Waters (18:30.000)
Yes. So what do you think CISOs are spending too much time worrying about at the moment? And what are they not worrying about enough in this AI era, do you think?
Mike Lyborg (Swimlane) (18:40.000)
Man, that is a loaded question, but I'm going to give it a, so what do we spend too much time worrying about? I think perfection. And I know that's like one of those things you're probably not supposed to even tell anyone, but there's a lot of people that try to be perfect and that doesn't exist in this world. And trying to also figure out, like when a couple of years ago when we started building out our our AI, like we did a private LLM and we built our homegrown agents, right, and everything else.
We didn't see the value at first. I mean, it was not great two, three years ago. Last year it all kind of changed, and especially the last six months, it's been insane. So we have now, obviously everybody's worried about AI and governance and all the risks in general, but also focus on talking to the rest of the leadership team on here are the wins. So being able to not just qualify, but quantify the data. So gather all the data, I guess you have to have observability and telemetry in order to kind of baseline that and say, hey, this is what we were doing before AI. Here's what we're doing with AI. And if you can then tell that story, everybody loves stories.
Now you don't sound like a security practitioner that's talking about EDR alerts and phishing and all these boring things that nobody cares about. So talk to your audience and if that's a board, like do more of that and figure out what makes them tick. They're probably, you know, they care about money.
Are you saving money or burning money? Are we, are efficiency going up? accuracy, like efficacy, like all these things, if you can put a number on it, track and trend it, and then say, hey, since we started doing this, is how much better we are and this is how much money we are not spending or whatever that may be, then that's a really good win for everybody. So more of that, I guess. Yeah.
Declan Waters (20:53.000)
All right. That's a good way of answering it. was a loaded question. So thank you, Mike. You did a really good job with that. Do you think companies are moving towards autonomy faster than their governance can handle right now?
Mike Lyborg (Swimlane) (21:04.000)
Yeah, I mean, we used to have this beautiful phrase in the military called, you know, you'd be voluntold, right? You can volunteer or you can be voluntold. So I think we've all been voluntold to figure out what that is. Now there's a couple of, points of friction here too. So if you move too fast without the right direction and guidance and policies and everything else like governance in general, right?
Then you may introduce risk. But if you've been voluntold to do it, then do so, but keep everybody informed. I think six months ago, I would have had a very different answer. I think right now, at least for our company, we're moving at the pace. Like I was at a summit a week, a week and a half ago.
And they had a great analogy. It's like, are you driving the train? Are you on the train or are you chasing the train of AI? And I feel like we're on the train, but we're getting closer and closer to driving the train from a risk management perspective, right, and controls perspective. So maybe that's my answer there.
Declan Waters (22:14.000)
Very good, Mike. I've got a couple more questions for you. One that I wanted to ask you was, given your experience, Is there something that you believed about cybersecurity, say three to five years ago, that you've really changed your mind about now? Given where we are and how fast the technology is moving, is there anything that you've really changed your view on?
Mike Lyborg (Swimlane) (22:37.000)
Yeah, I'm actually reading a book and it's a hard, like it's paper, right? So it's going to be a shameless plug for a buddy of mine, but his name is Richard Byrd, phenomenal leader. I'd consider him a mentor and a friend as well. But one of the things that has changed by not just reading this book, but I guess maturing in the industry is we shouldn't forget that we're here to make money in the cybersecurity world, right?
And as a vendor CISO, it's what changed from A couple of years ago, it's really easy to secure any company. It really is. But when you do so, you're probably also going to wreck some relationships. So what has changed is realizing that, well, you know what? We're a business. We're all a business. Whether you're a largest of enterprises in the world, you're there to make money. So managing risk and not disrupting income to the business and not introducing too much friction so that you will get yourself voluntold out of there.
I think those are some of the lessons learned. And then, yeah, don't believe you can protect it all because that's impossible. But do believe or work with different circles of control. The things you can control, spend 90% of your time there. Then there's the circles of influence maybe spend 5 to 10 percent there. And then there's the stuff you're not going to change. Like, you know what? Don't try to change the world because you're probably not going to succeed.
Declan Waters (24:19.000)
Yeah, I think that's really good advice for corporate life and personal life as well, isn't it? Yeah, I can see where the crossover was there.
Mike Lyborg (Swimlane) (24:25.000)
It is.
Declan Waters (24:26.000)
Michael, I could really talk to you all morning. I really, really enjoyed this conversation. We're going to have to close it there, but I just wanted to say a big thank you for your time today. I've really enjoyed the conversation and the insights that you shared with us.
If I look back at all the podcast guests, you've really had an extraordinary journey. Very unique, very different to anybody that I've spoken to before. And what I particularly enjoyed hearing is how those experiences have shaped how you think about leadership, your judgment and accountability. And I really appreciate the wisdom that you've shared with me and with others.
Mike Lyborg (Swimlane) (25:03.000)
Well, those are some big words. Thank you, Declan. I really appreciate it.
Declan Waters (25:07.000)
Yes, thank you for being so open. And thank you for joining the Watershed.
Mike Lyborg (Swimlane) (25:11.000)
Cheers. Next time.
Declan Waters (25:13.000)
Cheers.
Mike Lyborg (Swimlane) (25:14.000)
Bye.