I was in an old warehouse the first time I ever saw the wing commander. I had joined the Air National Guard a few months prior, and the commander of our 800-person wing wanted to thank us for our service and highlight his priorities. We opened a bay door to let in the Los Angeles sun and outside fresh air. At the time, changes in the US Space Force were a hot topic, and he received many questions about how it would affect our future. As usually happens in the military, he did not know and simply asked us to wait and see.

Something else he said, however, sticks out to me more today. This Colonel, who had taken on squadron command before I started high school, wanted to talk about the Air Force core values. In particular, he highlighted the core value “service before self.” He told us that sometimes he struggles with that core value, especially once he started a family. He felt he could not always put his service above his family. I really appreciated this moment of vulnerability and realism from this decorated officer. Rather than spewing platitudes void of nuance, he was willing to acknowledge the challenging trade-offs service members must make between their priorities.

Military service requires sacrifices. Service members must sacrifice our own comforts, and, at times, our families must make sacrifices for our service. General Daniel Hokanson, former Chief of the National Guard Bureau, once said, “…our National Guard exists to fight and win our nation’s wars.” In the words of famed 49ers coach Bill Walsh, “We can win if we put the good of the group ahead of our own personal interests.” Recently, I have run across multiple military leaders who deny the importance of self-sacrifice and assume military members are merely self-serving actors seeking individual benefits or prestige. This perspective drives their management methods and undermines the commitment to service that the military should encourage. I consider this belief harmful and assert that we must reinforce a culture of service and sacrifice rather than assuming military members place self above service.

I recently witnessed this assumption firsthand in a presentation of an military unit's organizational transformation plan based on the concept of mechanism design. Mechanism design is an economic framework built on game theory that organizations can use to achieve desired outcomes. In this application, the framework assumed the organization consisted of self-interested actors who were unmotivated to provide accurate information due to that self-interest. At the beginning of the presentation, the presenter stated that their goal was to motivate self-interested individuals to act in the best interest of the organization. Because this plan was for a military unit, its premise was that service members are self-interested parties prioritizing their own advancement above their service and the service members they are charged to lead.

In my favorite book on leadership, Multipliers, Liz Wiseman frequently highlights how the assumptions leaders have of other people affect their ability to lead. When leaders assume others are smart and dedicated, they can delegate and empower. They can focus on removing obstacles rather than making threats. When leaders assume others lack intelligence or dedication, they must resort to additional control and centralized decision-making. The assumptions of mechanism design lean towards the latter. The framework assumes individuals act on self-interest and intentionally withhold information despite potential harms to their brothers-in-arms.

Note that mechanism design, by definition, must have a designer. The individual or individuals who design the system must align people’s self-interest with what is best for the organization. Notice what this implies: the designers are presumed capable of prioritizing the organization’s interests, while the individuals subjected to the system are presumed to require incentives to do the same. Those individuals require incentives and threats which pressure them to act within the best interest of the organization. This assumption has two significant flaws. First, it assumes those with the power are uniquely capable and dedicated to service. General James Mattis recommends the opposite as he points out, “I never thought, as a general, that I had more commitment than my nineteen-year-old lance corporals…” Mattis believed his people were as dedicated as he was, not that he needed to design a system to force their dedication. Mattis also highlights the second flaw in this assumption: that leadership alone owns the mission. He states, “…everyone owns the unit mission. If you as the commander define the mission as your responsibility, you have already failed.” Mechanism design assumes the designers own the mission while those operating within the system only own their self-interest.

After I received the presentation, I began to think deeply about my own service and self-interest. Am I self-interested? Of course. I am no selfless saint, and I often make decisions biasing my own benefit. However, I consider sacrifice and service core virtues which I aim for daily, even while acknowledging I often fall short of their demands. Some argue selflessness does not even exist. In the book The Antidote, Oliver Burkeman points out “…if you take on a weekly volunteering assignment, say, with the aim of becoming happier, are you being selfless at all?” While that philosophical debate interests me, it misses the forest for the trees. Regardless of people’s deeply held motivations, actions of service still exist. Soldiers still jump on grenades to save the lives of their comrades.

When this team presented the idea of mechanism design, everyone in the meeting accepted the assumption of self-interest. This saddened me at the time. It made me feel like the larger US Air Force has established self-interest as a norm or even expectation. Of course, the people doing this care deeply about their service. I can tell by all the work they put in to make their organization better! Yet, I found it disappointing that we all seemed just accept that Airmen within our ranks do not actually follow “service before self.” I felt like we were choosing to just abandon the core value altogether.

While this saddens me, it does not surprise me. One of my least favorite phrases commonly stated in the Air Force is, “you are your number one career advocate.” I am less concerned with the reality of this statement in the modern Air Force and more concerned with how engrained this idea has become in the Air Force culture. I have heard many leaders recite the phrase as both a matter of fact and an expectation. Because they repeatedly utter these words, it becomes the norm and starts to underpin the culture itself. As a result, supervisors abandon their responsibility to grow and advocate for the careers of their subordinates. The environment becomes a Machiavellian, cutthroat snake pit, and people must abandon a prioritization of service if they want to get ahead.

How then, should leaders address extreme self-interest within their organizations? First, I believe this is the wrong question. If an organization’s leadership believes its members’ actions do not align with the objectives of the larger team, it must find the sources of this misalignment. Psychologist Daniel Kahneman, referencing research from Kurt Lewin, stated, “if you want people to behave in a particular way, make it easy for them.” Leaders who fundamentally believe in the dedication of the individuals within their organization will focus on removing roadblocks to achieving the organization’s mission because these leaders assume those individuals are just as dedicated as they are. I plan to significantly expand upon this idea in a future article.

More importantly, military organizations need to build a culture of service. While this matters in all organizations, it carries special weight in the military. As the Air Force points out in its official guide to the core values, “Selfless service places demands upon us which are not levied upon the American public or those who choose other professions.” This idea of service rather than self-interest as the guiding light of the military goes back to George Washington, who wrote, “…every Citizen who enjoys the protection of a free Government, owes not only a proportion of his property, but even of his personal services to the defence of it…” in his letter “Sentiments on a Peace Establishment.” Bill Walsh tells us, “The culture precedes positive results.” US military organizations must reinvigorate this culture of service given from our first commander-in-chief rather than attempting to engineer the resulting behaviors.

I do not claim to embody service before self perfectly, nor does any great leader I know. The Air Force itself points out, “Airmen must practice self-care first to be able to serve others…” and “…it does not mean we let go of all that we hold dear — our family, loved ones, and sincerely held beliefs.” However, we must not abandon the ideal entirely solely because we struggle to live up to it. We should not doubt that we, all Airmen, seek to make personal sacrifices for our service despite inevitable faltering in upholding this ideal.

During my decade in the Air Force, I have watched self-interest and relentless careerism become not merely accepted, but expected. When leaders assume Airmen are motivated primarily by personal gain, they build systems around that assumption. As Wiseman warns, leaders’ negative assumptions of others are proven to be true through the very culture those leaders create. Rather than reinforcing Airmen’s commitment to service, the resulting environment teaches them to look out for themselves first. Instead of building a culture around self-interest, leaders should trust in their Airmen’s commitment to service before self and empower them to live up to it.

In July, I organized a joint team in the California National Guard to attend the Cyber Fortress exercise. The Army team did most of the work preparing and just needed me to offer the training to any of the Air Guard members who might want to attend. I have a list of all of the participating organizations in the California National Guard’s cyber program — as I plan most of our joint cyber events — so I just blasted out an email to addresses from that list.

Many Air units were excited to attend. The exercise we normally attend was unavailable, so this was a good opportunity to practice cyber defense skills. Additionally, Cyber Fortress focused on critical infrastructure and operational technology, so we had the opportunity to learn something unique.

The Army point of contact I was working with told me barracks on base were available for us at no cost. He mentioned the Air members might want to stay off base but that this was available. I told him to put all the Air members in for barracks as well and blasted out to the participating organizations to not book hotels because we had barracks for everyone. I did not think much of it.

I found out later that some other officers disagreed with my decision. Apparently Air units had stayed off base in hotels when barracks were provided on base in the past. I could not believe that would be allowed. Well, it is not.

US military travel policy is governed by the Joint Travel Regulations (JTR). Section 020303 of this document states, “A DoD Service member ordered to a U.S. installation must use adequate and available Government quarters.” The Defense Travel Management Office’s official travel guidance is equally explicit: “If the traveler stays at another lodging facility for personal reasons, the traveler is responsible for paying all costs that exceed the cost of Government quarters.” The current Integrated Lodging Program (ILP) guidance likewise states, “If ILP facilities are available and a traveler chooses to stay in other commercial lodging, reimbursement is limited to the amount the Government would have paid if directed lodging were used.” The JTR does provide exceptions when Government lodging is impractical or would adversely affect the mission, such as when it is excessively distant from the duty location. That was not the case here as the barracks were on the installation and even within walking distance of our operating location.

This article is not about regulations. To be honest, I often find military regulations too rigid and lacking in common sense. I certainly read, understand, and (try) to apply all applicable regulations. I also have had more Exceptions to Policy (ETPs) signed than I can recall at this point in my career.

I personally try to make decisions based on whom I am serving and why. When I was in the regular Air Force before joining the National Guard, I was once chewed out by Lieutenant General JT Thompson. I was not alone. He chewed out the entire base. General Thompson was tired of the lack of discipline and pride in our work we showed at Los Angeles Air Force Base. It became a joke that we were the “Hollywood Air Force.” We were actors, not Airmen. While chewing us out, I remember him saying: “you have two customers here to serve: the warfighter and the American taxpayer. Not yourself or your friends.”

Around that time, the Lieutenant Colonel in charge of my team was constantly traveling. He almost never joined our team meetings. It felt like he was at every cybersecurity conference known to man. He never sent us to any of these conferences. We always learned the commitments he made from other people since he never took the time to be present for us. At some point, he was quickly removed from his position and another person put in place. They never told me, a Lieutenant, what happened, but I heard rumors about his travel getting audited and him being fired. It did not seem he was serving the warfighter or the American taxpayer with his extensive travel.

I remember those words of General Thompson to this day. In my decision to have Airmen stay in barracks, I believe it was the sole decision in best service of the warfighter and American taxpayer. As I serve in leadership positions, I now realize that sometimes I need to sacrifice the comfort of others. In the words of legendary football coach Bill Walsh in his book The Score Takes Care of Itself, the leadership tendency to “promote an organizational environment that is comfortable” is something we can “pound into [our] professional coffin.”

Of course, this barracks versus hotel question highlights another problem in the military, especially in the Air Force. Dr. Bill DeMarco, the Director of Strategic Initiatives and Research at Air University addresses this problem in his article. “Crucibles, Not Comfort, Shape Future Military Leaders.” In the article, Dr. DeMarco says his answer to the question “Do you think we’re getting too soft?” is yes. This article really effectively highlights the important progress “in rooting out toxic environments and improving the mental well-being of servicemembers” while also pointing out the need for struggle to build leaders. The crucibles he mentions are deeper than “staying in barracks,” but the basic idea applies.

Towards the end of the article, Dr. DeMarco explains why we cannot prioritize comfort:

The demands of great power competition, strategic ambiguity, and cognitive warfare are already redefining what it means to lead. If the American military does not recover the crucible, it risks fielding leaders who are compassionate but unformed, intelligent but brittle, inclusive but untested.

Perfect conditions don’t build character. The tree without wind may look healthy — until the storm comes. To lead in that storm, leaders must be formed in challenge, not protected from it.

America needs the wind back.

I had the opportunity to meet Dr. DeMarco last week on a Teams call. He was as artful in his verbal speech as he is in his writing. I am a bit less sophisticated, so I will state the reason plainly: Conflict will not be comfortable. Preparing for it will not be either.

In his book Call Sign Chaos, General Jim Mattis talks about his decision to remove all “creature comforts” to deal with fuel requirements. “We carried only a few cots; these were for the sick or wounded. Everyone else slept on the ground, regardless of rank.” Mattis’s description is the reality of conflict. This fact may make some uncomfortable, but we train our Airmen, according to US law, for the “effective prosecution of war.” Source.

More recently, we have seen the realities of war contrasted against modern military comforts. The Ukrainian Armed Forces recently participated in the Aurora 2026 exercises with NATO in Sweden. Ibrahim Naber of the German newspaper WELT published an article on their participation last month with an already damning title of “Constant Coffee Breaks.” Naber interviewed Lieutenant Colonel Vadym Krykun, the commander of Ukraine’s Lyubart Brigade for that article. Krykun concluded, “I’m not sure if citizens of other European countries would be prepared to make such a sacrifice.” American Airmen need to be prepared for real combat sacrifices.

My own views on this changed working with the Ukrainian Armed Forces and the National Guard of Ukraine. The California National Guard partners with Ukraine in the State Partnership Program (SPP). I plan the SPP events involving cyber with all three of our partners, but I am also a Ukrainian interpreter. I was assigned as an interpreter for a training event with Ukrainian military forces in 2023 and got to know many soldiers personally. They loved hanging out in large groups often with dozens of people in a single hotel room to socialize in the evenings. I remember being at one of these gatherings and asking the soldiers what they slept on. They told me they slept on cots and were quite grateful for them. I was slightly shocked. Grateful for cots!? What did you sleep on before you got them? They slept on the ground — just like Mattis’s troops.

I laughed to myself a bit when I saw the “Constant Coffee Breaks” headline. When I planned Cyber Dawn the first time, in 2024, I remember one senior enlisted member freaking out about the lack of a snack bar at the event. My planning had focused on the technical, operational, and logistical parts of the exercise. As it took place in a large urban center, I expected the participants, all adults, to attend to their own needs for food, drinks, or snacks. Bill Walsh calls this, “sweat[ing] the right small stuff.” I have a lot more thoughts on these “trivialities” as Walsh calls them and their prevalence in the the military, but that will be a future article.

I brought up this recent barracks situation last week to my leaders in the 195th Wing, they mentioned “Airmen care is not coddling.” I will probably use this phrase in the future, but it has flaws. Namely, one can arbitrarily define an action as care or coddling based on their own values. I find the same challenge with the word “respect.” Some of my neighbors, as evidenced by the signs in their yard, find it disrespectful for my dog to pee in their yard. Others, usually who have dogs, do not mind. Maybe Aretha Franklin asked us to “find out what it means to [her]” because R-E-S-P-E-C-T means different things to different people.

Rather than rely on coddling versus care, I prefer to address the term “care” directly. Sometimes we cannot care for our Airmen. Certainly we can and should care deeply inside, but we often cannot treat them in caring ways. This is especially true in the military. In this profession, military leaders must send others into harm’s way. Mattis tells us: “I also understood how difficult it is to order men you’ve come to love into a fight that some won’t survive. But the mission must come first.” Leaders must constantly consider the tradeoffs between Airman care, Airman growth, and operational demands. Airman care will not always win.

When we got to the barracks, the beds were all laid out in a single bay. There were a few private rooms where one could shut the door to have privacy and peace. The senior officer who invited me to Cyber Fortress told me to stay in one of those rooms. I chose not to. For me, it was important to show everyone I would sacrifice my own comfort as well. In the words of British Field Marshal William Slim, “As officers, you will neither eat, nor drink, nor sleep, nor smoke, nor even sit down until you have personally seen that your men have done those things.” Some Airmen with sleeping issues ended up moving into those private rooms. I stayed right in the middle of the bay with everyone else.

I certainly struggled. Many of the men snored, and I failed to fully block out these sounds with the earplugs I brought. Interestingly, though, the Soldiers seemed more than comfortable in the barracks. They had no issue with the accommodations and even felt positively about them. They seemed to enjoy the camaraderie of all staying together. They also knew the “right” way to prepare their quarters.

I often hear people mention recruiting and retention as a reason to maintain certain comforts. People may not want to serve their country if the sacrifice is too high. I am personally skeptical of this view. We assume people are searching for comfort, but maybe people want to sacrifice for something greater. In his book One Bullet Away, Nathaniel Fick says, “Whereas the other services listed their benefits, the Corps asked, ‘Do you have what it takes?’ If I was going to serve in the military, I would be a Marine.” Fick went on to serve for four and a half years before becoming a successful businessman and the CEO of cybersecurity company Endgame.

Certainly, military recruiting and retention must align with modern American culture and adapt as needed. The American way of life, however, is not guaranteed. In the words of George Washington, “every Citizen who enjoys the protection of a free Government, owes not only a proportion of his property, but even of his personal services to the defence of it.” Washington wrote this in May 2, 1783 in an article titled “Sentiments on a Peace Establishment.” He foresaw these future troops as, “zealous to be employed whenever it may become necessary in the service of their Country.” In other words, he dreamed of an America with citizens ready to sacrifice their own personal comforts in the name of service. As Airmen, it is our responsibility to set that example for young people who will serve our military in the next generation. As Washington wrote, “Such sentiments, indeed, ought to be instilled into our Youth, with their earliest years, to be cherished and inculcated as frequently and forcibly as possible.”

I personally consider a “belief in others” the most important leadership trait. I choose to believe in Airmen. I believe they can stay in the same military quarters as Soldiers — quarters that are likely still better than what we will have during wartime. I believe they can grow from the experience and gain the sense of camaraderie I saw in the Soldiers. It starts with leaders. We ourselves must actually practice Service Before Self, and stay in the barracks ourselves. We must stop using the term “Airman care” to justify constant comforts for ourselves and other Airmen.

I finally finished my demonstration video at 9:34pm last night. I still had not packed, and I needed to wake up at 4am the next day. I have four black boxes with yellow lids in the closet in my office stacked two by two. The one on the top-right has my military uniform items. I lifted the box out of the closet and opened it to start putting these items and my other clothes in my hard, glossy-black, carryon suitcase. I have a mental list of the items that I need, and I went through it as I packed. Although I have done this more times than I can remember, I went to bed with the nagging fear that I forgot something important.

I could not fall right asleep. I normally never use my phone in bed, but I did last night. I responded to a few texts and played a few chess games. I realized I was tired and should at least try to sleep. I pushed the two awards, one evaluation, and one after-action report that I have not yet written and need to finish out of my mind. I likely will need to finish these on my own time (if such a thing exists) because this weekend's drill will be very busy. I closed my eyes.

It was dark when I opened them. I had no clue what time it was. I hit the button on my G-shock that lights up the screen. 3:51am. This has happened before. I know if I turn off my alarm and stay in bed for "just a few minutes," bad things will happen. I get out of bed instead. My early wakeup gives me some time to shower. After my shower, all of my things are ready. I prepare everything the night before to avoid making noise which might annoy my wife.

Some influencers like to brag about how disciplined they think they are. They act like waking up at 4am is some kind of virtue. This morning, for me, it just feels like a pain. I would rather be in bed. I would rather stay home. This trip will likely make me less productive next week. I will be tired for a few days as I recover. I'm throwing a wrench in my quite pleasant and effective routine for my health, work, and family.

People always ask me why I do not find a military unit closer to home. I pay for my travel to and from my National Guard unit with my own money. I still have to work on my travel day. To make this all work, I often take extremely early flights. I often return home on a redeye flight. I am lucky to have a career, between pay and flexibility, that lets me do this.

People always ask me about promotions. I have never asked to promote. I have met Colonels I despised and Airman I greatly admired. Rank means almost nothing to me. I love a good promotion ceremony and party. I try to judge people on the content of their character not the emblem on their chest or shoulders.

People always ask me about retirement. I have no clue what my retirement check would be or when I would get it. I do not understand how the National Guard points system works. I have never once worried about having a "good year." I am close to crossing 10 years of service. Will I stay in another 10 years? I don't know. I haven't planned it out that far.

People always ask me about cool trips overseas. My last two "deployments" took place in Warner Robins, Georgia and Knoxville, Tennessee. When I deployed to Guantanamo Bay, Cuba, I went to the beach four times in six months. I have enjoyed trips to Germany. People seem to assume I want to go to Germany on military orders all the time. I would rather stay home. I can go to Germany on vacation and would much prefer to do so. I have, multiple times, planned trips to Europe and Mexico. When offered to go myself, I asked if we could send someone else instead. People assumed I was uncomfortable staying in a bay of barracks with Soldiers during my last training and would have preferred being in a hotel. I consider staying in barracks or tents normal and expected for members of the military.

Nobody ever asks me about comraderie with fellow Guardsmen and our other partners. I am super excited to see them. I plan to drive from the airport straight to one of our offices to see some and invite them to my promotion ceremony. One of them shoots me a photo of a group of them every few weeks, asking me when I will be in town to join them. With others, I text daily and call weekly. One was just selected to be our first in-country officer for our new partnership with Mexico. I want to congratulate her in person.

Nobody ever asks me about my pride in being a Guardsman. It's like that joke: "How can you tell if someone is a pilot? Don't worry, they'll tell you!" I tell people I am a Guardsman soon after meeting them. I plaster it all over my LinkedIn and YouTube. It's part of my identity and how I see myself. I do it boastfully and arrogantly because I think it's an honor and a privilege to be a Guardsman.

Nobody ever asks me about network analysis. I spend my free time digging into US Cyber Command's required skills and knowledge for network analysts. I always feel intimidated and underprepared. Even the basic level of knowledge feels unattatinable, but I try any way. I literally text friends, some fellow Guardsmen, about network protocols. We're a bunch of nerds.

I am no saint. I am not a hero. I have never served in combat. I have shown up to work unshaven or late. I have let myself get in worse shape than I should have, requiring serious dedication to score well on my physical fitness test. I have said unprofessional things at work. I have slacked off instead of working or studying. But, I try to improve.

I think many military members don’t really believe in "Service before self." They assume other members are in it for their own advancement, and we just need to align incentives with that advancement. I find the service versus self to be a false dichotomy. I take pride in my service. I don’t do it for comfort or a career goal. I find service intrinsically rewarding, so I do it for myself. I did not join to serve. I joined for free college. That’s not why I stay. I want to be useful.

The National Guard motto is "always ready, always there." We are ready, when called upon, to fight wars, build partnerships with allies, and defend the homeland. Twenty-five years ago today, we had the deadliest attack on the US homeland ever. I was a child. At the time, my dad worked two miles from the Pentagon, where American Airlines Flight 77 crashed, resulting in 184 victims. That day had almost 3,000 total victims. Our homeland needs defending in the air, in the sea, on the ground, and in cyberspace.

I often don't feel ready. It's a perfection project that I'll never achieve but that will drive me to constantly improve. But, I will always be there. Speaking of which, I have a flight to catch.

I was once having a beer with a mentor of mine at Yard House, and I started referencing some story from my deployment to Guantanamo Bay. I realized it might have been my fifth reference to that deployment that evening, and probably my hundredth over the course of knowing him. I became self conscious and apologized. I remember he said to me, “don’t apologize. It sounds like it was a great experience for you, and I’m glad it excites you. I never hear you talk about your Space Force job.”

I have never said this publicly before, but I despised my job at the US Space Force. My position was completely unnecessary, and nothing I did affected the actual mission. All of my tasks were busy work. The leaders there often said we were, “admiring the problem,” and it was true. My day was filled with 1) meetings where nobody had the needed information to make a decision and 2) creation of documents or PowerPoints that nobody would read. That job worked out really well for my personal situation at the time, but it stank. It really has made me grateful for the jobs I have had since.

Since the job stank, the highlight for me might surprise you. Our operational customer needed to unbox received equipment, ensure we received the purchased amount, and organize the equipment into the groupings for assembly. They needed hands for the manual labor, and our director, knowing our paper-pushing work had little real value, sent another lieutenant and me to help. I finally was out of the office to get my hands dirty.

Looking back, that work was extremely valuable for my growth. I had only seen physical IT equipment in presentations or simulation software. Working there, I got to learn all of the pieces involved in assembling a physical IT system. I was so ignorant at the time, that warehouse work was where I learned what an SFP is.

Since we were in town, our operational customer scheduled a meeting with us to talk about the product plan. Given my previous description of my job, you might be unsurprised to hear I complained a lot in that meeting. Of course, I was also an annoying lieutenant who complained a lot. I often complained because it was cathartic, but I never expected any change. I remember in the meeting, one of the leaders of the operational organization asked me many questions. As always, I had no answers and had no clue how to get them. So I continued complaining instead.

One of their senior leaders was a government civilian. He was a big guy. He had been a defensive lineman for the US Air Force Academy, and he still had the physique to prove it. He was not directly part of the meeting, but he was listening in as I rattled off my complaints. Eventually I paused to breathe. “What would you do to fix it?” he asked me. The question knocked me back. The way he asked it seemed so genuine, like he really wanted to know my opinion. I mumbled some incoherent, vague thing in response. Maybe that was his intent, but he seemed sincerely interested in my view.

I remember that interaction to this day, eight years later, because I felt motivated. Of course, one person’s belief in me could not cause me to overcome an immovable bureaucracy and a job position with no real tasks. It did, however, help me think more about identifying the specific problems causing my predicament and how to improve them. It was all because one person believed in me.

Now, I have almost 10 years of military experience, and I will likely promote to Major this year. I have worked for several leaders, led teams myself, and, just recently, had the opportunity to supervise leaders. Throughout this time, I have observed many leaders, seeing what worked well and what did not. Over the past year, I had the opportunity to work in a second-level manager role. This means I supervised other leaders within the Cyber Protection Team (CPT) construct. Before this experience, I had a dim notion on important personal traits for great leaders like humility, a growth mindset, and patience. One trait in particular has now crystallized in my mind as the clear winner and something I have not always understood or believed.

Before I state the specific trait, let us explore a definition of leadership. In John Maxwell’s The 21 Irrefutable Laws of Leadership, he states “the true measure of leadership is influence nothing more, nothing less.” Why is leadership influence? If you think about it, leadership has very little to do with your own work performance, especially if you work in a management role. Instead, an effective leader has a high performing team where that team does much more work than that one leader could do alone. Certainly, hard work will garner the respect of subordinates and lead to this team outcome, but it is not the goal itself. General Jim Mattis outlines this need for influence in his book Call Sign Chaos, where he states, “As an officer, you need to win only one battle — for the hearts of your troops.” A good leader can influence team members to work together and achieve more on their own.

Liz Wiseman, a leadership researcher who grew up leading teams in the tech industry, has a framework to describe this type of leadership. If leaders aim to get the most out of their teams as possible, their team must be greater than them. For this reason, Wiseman uses the term Multipliers to describe leaders who successfully drive performance of the entire team. As she describes it, Multipliers ensure their teams “…break through challenges no single leader, however intelligent, could have done alone.”

In her book, also called Multipliers, Wiseman defines a scale of leaders. Leaders who get the most out of their teams are Multipliers while those who get very little out of their teams are Diminishers. She clarifies that this scale is continuous: leaders can be more of a Multiplier or more of a Diminisher. It is not one or the other, and we all can improve. Diminishers, unlike Multipliers, get less out of their team members. Their leadership behaviors cause people to achieve less than they would otherwise.

Wiseman chose to understand the importance of Multipliers based on an assumption that, “There is more intelligence inside our organizations than we are using.” Therefore, Multipliers are people who have learned to be “genius makers” rather than just, “geniuses.” They figure out how to make others better and shift the focus from their own performance to that of their team members. In this article, I assert that one single trait, more than any other, allows people to become Multipliers and therefore good leaders. The number one leadership trait is a belief in others.

To truly believe in others, leaders must shift their focus away from themselves. Wiseman clarifies: “As a manager, my job was no longer about me.” This problem is even worse in the military. As I point out in my article “Removing Commanders as the Center of Military Operations,” military doctrine puts commanders as the central figure of military operations. While modern military operational leaders and theorists like General Stanley McChrystal have tried shifting the military away from this traditional hierarchical model, the culture stays largely inert. The military rank system makes this worse, where many people equate rank to worth and value. Mattis emphasizes the importance of rejecting this notion: “I never thought, as a general, that I had more commitment than my nineteen-year-old lance corporals…” Great military leaders truly believe in the frontline warfighters they command, but many military leaders erroneously believe in themselves more.

I will, therefore, depart from the popular advice to believe in yourself. Much of this advice, claiming that “being confident” will lead you to competence is just plain wrong. In his book Confidence, psychologist Tomas Chamorro-Premuzic walks through many studies which highlight how competence — becoming knowledgeable and skilled in a field — will lead to confidence but not the other way around. Additionally, believing slightly less in your own skills and abilities will probably bring you closer to the truth. Famously, 93% of American drivers consider themselves above average. Spoiler alert: at least 43% of them are wrong.

Ironically, the leaders who believe most in themselves are most likely to profess a belief in others. They already consider themselves good leaders and fail to honestly assess their own weaknesses. I often wonder if most of the 7% of drivers who considered themselves average or below average are actually great drivers. They are self-aware enough to acknowledge their own failings and likely care enough to improve their driving. If you, reading this, think you already believe in others, I challenge you to consider this more deeply. The less you think you need to work on this, the more you probably need to work on it. Additionally, Diminishers often create a self-fulfilling prophecy in their belief of themselves over others. As Wiseman tells it, Diminishers “are often proven true because people become disabled and dependent on the Diminisher for answers, for approval.” Diminishers answer everything, so the team members stop solving problems on their own. This just further “proves” the Diminisher’s own self-importance.

People selected for leadership positions might, on average, believe in themselves even MORE than average. Usually they achieve their position through strong individual performance which will enhance their belief in their own intelligence and ability to perform tasks. When Wiseman was working with organizations, she noticed this challenge and saw that most managers, “moved up the management ranks on the account of personal — and often intellectual — merit.” Mattis made the same observation: “Each of us had been promoted based upon a mastery of tactical and operational skills.”

In some cases, this creates a bad incentive structure. People become leaders because of their individual output. I once had a boss who was the perfect individual contributor. He was smart and outworked everyone else. I consider him a poor leader, and my memory of him has motivated my continued reading in this area. I remember one time, I told him I was developing web applications with JavaScript. He corrected me, “you mean Java?” I told him no and clarified JavaScript was the programming language generally used in browsers for dynamic content within the page. He said, “well they are the same thing, that’s why they’re named that way.” I myself am no expert, but the creator of JavaScript agreed that “…it actually has nothing to do with Java…” He believed too much in his own knowledge rather than believing that I, his subordinate, may have had useful knowledge to share. As is common in the Air Force, this officer was on a promotion “fast track” and was hand-selected for command positions following being our boss. Retired Colonel Jason Lamb talks about this problem in his famous article “A Call for Senior Officer Reform in the Air Force: An Insider’s Perspective.”

In contrast, one of the best bosses I ever had truly believed in everyone on her team. In meetings, she would regularly ask the people who worked for her about technical details. She not only assumed we knew things she did not; she expected us to know more than she did. Her belief in others showed itself most clearly in my final one-on-one with her, when she told me she might end up working for me someday. She genuinely believed the people who worked for her could someday surpass her, and she seemed to view that possibility as a success rather than a threat.

Of course, some belief in yourself matters too. You have to believe that you can surmount obstacles and overcome challenges. You have to trust yourself to grow and improve over time. If, however, your self-confidence demands you are the most skilled and capable person on your team, it will limit your ability to lead. Wiseman noticed of Diminishers she studied: “their resolve to be the smartest person in the room had a diminishing effect on everyone else.” This extends beyond even displays of intelligence. While that leader cared more about seeming knowledgeable rather than being knowledgeable, even trying to hard to be knowledgeable can pull a leader astray. Wiseman says of Diminishers: “Because they are overly focused on what they know, they limit what their organization can achieve to what they themselves know how to do.” When leaders try too hard to know everything, they significantly limit their teams. The team members should know things the leader does not. They should have skills the leader will never have.

Part of this transfer of belief in yourself to belief in others requires leaders to build independent teams. Mattis points out that a key test of leaders is “how well the unit functioned without us.” Retired Navy Captain L. David Marquet, author of Turn the Ship Around, uses more drastic language, stating leaders should emancipate their teams. He explains how to know you have an emancipated team: “You know you have an emancipated team when you no longer need to empower them.” In other words, you seek to make your team not need you. Wiseman says good leaders “create organizations that can win without them on the field.” Diminishers, she says, believe things like, “People will never be able to figure it out without me.” They fail to fully emancipate teams due to their own hubris.

Shifting the focus from yourself to others presents only half of “belief in others.” We can easily miss the importance of the word belief. Let us take, for example, the Golden Rule. Many know the Golden Rule from the Bible as, “Do to others as you would have them do to you.” Jesus states this in Matthew 7:12 and Luke 6:31. However, Jesus makes a slightly different claim when he lists the two most important commandments. He states, “Love your neighbor as yourself.” (Mark 12:31, Matthew 19:19, Matthew 22:39, Luke 10:27) Note the focus on love is the actual commandment from Leviticus 19:18 where the Hebrew word ve’ahavta (וְאָהַבְתָּ) signifies a deep commitment. (See note 1)

Loving your neighbor means seriously wanting the best for them. You must have profound desire for them to experience joy and success. That extends well beyond just your actions and requires you to change your own attitudes. Belief, similarly, means the conviction you actually hold deep down. Just trying to act like you believe in others will not suffice; you must actually believe. As Wiseman clarifies: “If someone wants to lead like a Multiplier, he or she can’t simply mimic the practices of a Multiplier.”

I did not notice this difference until I began to work at a more senior leadership level. Many of the leaders I worked with would say all the right things about their teams and praise them in public. When doors closed however, and we entered more private conversations, I saw the real beliefs of many of these leaders. They would criticize the intellect and capabilities of their subordinates. I have heard things like, “it’s not that hard,” “I don’t know why they can’t do anything,” or even, “I could do this way better.” Deep down, these leaders really only believed in themselves.

These underlying beliefs, although masked at work, showed themselves in the way these leaders led. Shawn Achor covers this topic thoroughly in his book The Power of Beliefs. As he states simply: “Our actions are shaped by our beliefs…” Achor highlights how beliefs change the way we see the world and interact with it. He highlights one study which showed how people’s perceptions of reality actually change depending on their beliefs. The study showed that people would literally see the steepness of a hill differently depending on their belief in their ability to climb it.

…if a participant is looking at a hill by themselves and is then told by the researchers that they will be climbing the hill alone, the hill looks 15 to 20 percent steeper to their visual cortex than it does if the participant is standing next to someone and is told the other person will climb the hill with them. When you believe that you are alone your brain warps the world so that you will not take actions for which you do not have adequate resources.

Since beliefs control how we see the world, we cannot just try to change our actions. We will not escape how beliefs affect these actions, and we will fail to mask our true beliefs. Wiseman points out that beliefs are a key part of being a multiplier: “Multipliers have a core belief that people are smart and will figure things out.”

Wiseman also often talks about assumptions. Our assumptions, I think, are how our beliefs affect our actions. Because we have a core belief, those beliefs affect what we assume in a particular situation. If leaders believe other people are smart, they will assume team members are capable and can solve problems. If a leader’s beliefs instead center around their own intelligence, they will assume they have better than their own team. Wiseman points out that a key assumption of Diminishers is: “I need to have all the answers.” She adds, “their base assumptions are inaccurate and are limiting themselves and others.” They likely fall within the 43% of drivers who erroneously believe their driving to be above average.

“A leader’s ability to garner the full intelligence of the organization depends on some of his or her most deeply held assumptions.” Wiseman tells us, and becoming a Multiplier, “requires more than just adding some new leadership practices. It often requires a fundamental shift in the assumptions of the leader.” So, we cannot just attack the leadership behaviors. We must, instead, attack the belief itself.

You may think trying to change our beliefs themselves makes no sense. Many think beliefs are personal, unchanging traits that cannot change. Achor himself points this out: “…in our society many people think that belief change is not possible.” However, this assumption is wrong.

Belief change is possible. Achor dedicates the third part of his three-part book to belief change. But, as with most valuable things in life, it ain’t easy. Achor tells us creating and sustaining these core beliefs “requires conscious effort, repetition, and brain training.” Wiseman similarly states that it “comes only through persistence and resilience.” Leaders have to constantly assess their own actions and assumptions. While working to change our core beliefs, we will likely backslide. These moments are opportunities to remember the importance of belief in others to course-correct and build a more engrained belief.

I recently backslid myself, and it was a great opportunity for reflection and growth. A few weeks ago, I had the opportunity to lead a 25-person joint cyber team. I fell into many Diminisher traps. It really hit me on the day we left. I went to breakfast with one of our Warrant Officers because his flight was significantly delayed. As we discussed how the previous week went, I mentioned my struggle with some of the members’ inability to listen. They missed many key details about the exercise scenario because their eagerness to get to work prevented them from fully digesting all of the information first. While commenting on this, I said, “I just need them to listen to me.” The Warrant Officer called me out, “why is it about you?” He was right. My focus was on myself and my need to be listened to instead of on their need to absorb the information for mission success. It is a crucial difference.

To become better leaders, we need to focus less on ourselves. We need to care less about believing in ourselves and care more about believing in others. We also must work to change our deeply held beliefs and acknowledge this takes time and effort. We will backslide, but persistence and commitment to a belief in others will make us better leaders. Maybe someday, by believing in others, we can all inspire a lieutenant who despises his job.

Note 1: Not all Biblical scholars agree here. Some interpret “love your neighbor as yourself” to be equivalent to “treat your neighbor as yourself.” See the article “Love Your Neighbor: How It Became the Golden Rule” by Professor John J. Collins for that perspective. Medieval Jewish scholars Ibn Ezra and Nachmanides take the word love literally. Nachmanides describes this love as true wanting in the heart. You can see his full commentary on Leviticus 19:18 here.

In 2023, my Air National Guard squadron selected me as the top junior officer in the unit. I had never been selected for any such type of award before. They asked me questions to help put together a document highlighting my accomplishments and impact to our mission. I remember actually feeling quite annoyed that I had to spend a bunch of my free time helping assemble this because my boss needed it quickly, and I had work in my private sector job to do. I got over myself, and they submitted my information on time. I thought I was done with that task.

Little did I know, squadron selectees were asked to attend a leadership symposium and awards banquet. This meant a comfortable trip to Naval Air Station North Island in Coronado, California to meet other members of our diverse organization that supports various non-kinetic military operations. During the leadership symposium, we heard from speakers who gave us advice, inspiration, and gratitude for our service. I don’t recall all of the speakers, but one in particular was unforgettable.

Ricardo Campos is a Brazilian-American soccer executive who leads club operations for the San Diego Football Club. He walked to the front of the large lecture hall with a full dress shirt and slacks. He stood sligtly left of center-stage from my perspective, turning everyone’s heads pleasantly towards the large windows which exposed a beautiful and sunny day in Southern California. Campos told us that he always wanted to lead football teams, and he walked through his career to get there.

I remember he mentioned one of his early career successes at the New York Red Bulls, and he described himself as lucky. This caught me off guard at the time. Did he really just call himself lucky? He said it again, not once or twice, but several times. Describing each accomplishment, each mentor, and each setback, he kept using this word.

Others noticed as well. That year, a friend of mine was selected as his squadron’s top Airman in the junior enlisted category. This Airman went on to win that category across all of the squadrons during the banquet and later commissioned as an officer in my own squadron. When Campos asked if we had any questions, this Airman raised his hand and stood up. “I noticed you called yourself lucky,” he pointed out, “but I believe luck is what happens when preparation meets opportunity. Is that what happened to you?”

I fully expected Campos to agree with this sentiment. We were at a symposium for top performers, so emphasizing the value of hard work and forward-thinking would be apropos. After a brief pause to think of an answer, Campos surprised everyone in the room. “Not always,” he told us, “for example, some people...” I saw the top enlisted member start to giggle, but I, and others, hadn’t heard him. He repeated himself, “some people fail up.” More of us started to laugh. Potentially encouraged by our amusement, he continued, “I won’t give any specific examples, but I am sure you can think of some people you’ve seen in the news.” Our laughter got louder.

Campos went on to say many things outside his control contributed to his success, and he was very grateful for them. I found this message both needed and refreshing at the time. The internet inundates me with repeated motivational tropes about people mastering their own destiny and working towards what they want. At best, this motivation porn is boring and overdone, but in this article, I will argue it is both wrong and harmful.

My friend’s quote, often misattributed to Seneca, about luck being the result of preparation meeting opportunity, is one of the most common quotes I see from online motivational influencers. I actually agree with preparing for unexpected opportunities and that this leads to fruitful outcomes. However, many have conflated SOME luck resulting from preparation with ALL luck resulting from preparation.

In April of this year, business influencer Brad Lea posted a short video about luck where he actually encouraged people to consider themselves lucky. Many in the comments disagreed with him, highlighting their strong belief that all luck and good fortune purely results from their own hard work or preparation.

The most heated and liked comment on this post was from AI Adviser Jen García. She wrote:

“This is one of the most ridiculous and shortsighted pieces of advice I’ve heard on LinkedIn. Seneca is quoted as saying, “Luck is what happens when preparation meets opportunity.”
I prepare; I don’t expect luck. If you assign luck to situations, you will always be at the mercy of fate, believing that because you succeeded, you were lucky; you get a gift, you’re lucky; etc.
Kobe wasn’t lucky, I’m not lucky, this poster wasn’t lucky — we PREPARED.”

— Jen Garcia

I suspect people like Jen are trying to advocate for what’s called an “internal locus of control.” In his book The Power of Beliefs, Shawn Achor describes this concept: “Having an internal locus of control means you generally believe your actions are the key influence on your outcomes.” He then tells us how it predicts success, “…having an internal locus of control is highly correlated with higher graduation rates, income, likelihood of promotion, SAT scores, longevity, productivity, and sales.”

I remember learning a similar lesson early in my military career. As a second lieutenant, I was the typical annoying, whiny officer. I worked with a contractor named Gerard. He was tall, like me, and I ran into him a few times on the basketball court. Unlike me, he actually played quite well. He also supported our defensive cyber team on some of our finance and administrative tasks. I was once complaining to him about an outdated financial system and process, and he told me, “let’s just focus on what we can control.” He was right: I needed to just shut up and do the work.

I regularly recall Gerard’s advice. His advice does not require pretending like outside influence such as luck or misfortune do not exist. Instead, it is a recentering of attention on the things in our life that we can control to drive the outcomes we want. As Oliver Burkeman states in his book, The Antidote, “… it is rarely wise to struggle to change the weather.” Unrigorous motivational slogans online fail to acknowledge that we can control some things but not all things.

Jesus teaches us the existence of luck and gifts from God. In Matthew 10:8, he sends his disciples out to, “Cure the sick; raise the dead; cleanse those with a skin disease; cast out demons.” Importantly, he reminds them not to seek compensation for their work, “You received without payment; give without payment.” He reminds his disciples, and the rest of us, that God has freely blessed us, despite us having given him nothing in return.

He drives the point home even harder in a reference to birds in Matthew 6:26 and Luke 12:24. In Luke, Jesus tells us, "Consider the ravens: they neither sow nor reap, they have neither storehouse nor barn, and yet God feeds them. Of how much more value are you than the birds!" Interestingly, many people reference, “you reap whatever you sow” from Galatians 6:7 as justification for an internal locus of control. As I mentioned before, both can be true. Just as the ravens have not sowed anything and still receive God’s gifts, we receive many things in life we did not prepare for or earn.

You may not believe in a higher power who grants you things you did not earn. Even then, the evidence of luck is undeniable. Atheist writer Sam Harris points out in his book Free Will, “You did not pick your parents or the time and place of your birth. You didn’t choose your gender or most of your life experiences. You had no control whatsoever over your genome or the development of your brain.” Harris exhaustively lists many of the external factors contributing to life success. He very clearly calls out this delusion that our current situation purely results from our own deeds:

“Many seem to have absolutely no awareness of how fortunate one must be to succeed at anything in life, no matter how hard one works. One must be lucky to be able to work. One must be lucky to be intelligent, physically healthy, and not bankrupted in middle age by the illness of a spouse. Consider the biography of any “self-made” man, and you will find that his success was entirely dependent on background conditions that he did not make and of which he was merely the beneficiary.” — Sam Harris

Harris later points out that his acknowledgement of these facts allowed him to diminish his, “sense of entitlement to the fruits of [his] own good luck.” I cannot overstate this point. The moral implications of believing in no luck whatsoever are absolutely bad. Those who have some success have justification to develop their own smugness and preach about their superior character. When they believe they earned everything they have, they have no need to give back to those of “inferior character” who didn’t “earn it.” Jesus teaches the opposite. In Luke 12:48, he tells us, "From everyone to whom much has been given, much will be required, and from the one to whom much has been entrusted, even more will be demanded."

Jesus’s advice aligns with a modern understanding on the importance of gratitude. The author and psychologist I previously mentioned, Shawn Achor, lists, “I am grateful” as one of his seven core beliefs to improve your life. He explains, “Gratitude has been shown in studies to improve the immune system, increase pain tolerance, and even decrease the risk of all causes of mortality by 9 percent.” This gratitude requires you to acknowledge that you have not earned everything good in your life.

This gratitude extends beyond gratitude for God or the universe. Just as Jesus teaches us that God gives even when we do not sow or reap, we often reap what others have sown: “I sent you to reap that for which you did not labor. Others have labored, and you have entered into their labor.” John 4:38. Funnily enough, Kobe Bryant regularly mentioned his own gratitude for others. On December 18, 2017, the Lakers retired both his 8 and 24 numbers which was the only time in history a team has retired two numbers for one player. Kobe humbly thanked his predecessors, “It’s not about the jerseys hanging up there for me, it’s about jerseys hanging up there before, without them I couldn’t be here today.”

Many athletes, especially those with humble upbringings, highlight the importance others had on their success. In his essay, “A Letter to the Young Kylians,” Kylian Mbappé tells the story of the lessons he learned growing up in the poor Parisian suburb of Bondy. He highlights how his family and his community made him successful: "There is no Kylian Mbappé without my mother, my father, my community, my friends."

One of the most famous expressions of gratitude appears in Kevin Durant’s acceptance speech for the Most Valuable Player award for the 2014 NBA season. In the speech, he famously tells his mom, “You the real MVP.” Earlier in the speech, he recounts how he originally dreamed to become a coach in a recreational league for kids. He never expected to play professionally, much less win MVP. When describing this unexpected journey, he begins, “I had so much help. So many people believed in me when I didn’t believe in myself.” When Durant turns his attention to his mom, he reflects, “When something good happens to you — I don’t know about you guys — but I tend to look back to what brought me here.” Instead of proceeding to highlight his own hard work, he focuses on everything his mom did for him and his brother:

“You made us believe. You kept us off the street. You put clothes on our backs, food on the table. When you didn’t eat, you made sure we ate. You went to sleep hungry. You sacrificed for us.” — Kevin Durant

This part of the video still makes me shiver and tear up a bit, even though I have seen it several times now.

Mbappé and Durant could easily attribute their success exclusively to their own efforts. They grew up in underprivileged environments and mastered their craft to outperform others even in the highest levels of the sport. Unlike businesspeople or politicians, athletes require real, demonstrable ability. Yet, Mbappé and Durant choose to acknowledge what they were given. Durant knows he did not “prepare for an opportunity” to avoid hunger as a child. He got to eat because his mom sacrificed for him, and he was lucky to have her.

Why does self-help literature often try to pretend like luck does not exist? I asked a friend of mine this, and he suggested they might fear the alternative. He pointed out that if luck exists, we do not fully control our destiny. We and others might end up with things we do not “deserve.” While that topic requires a longer discussion, I think he is right. People want to believe that we live in a fair world with understandable actions, incentives, and consequences. Some people go so far to invent completely nonsensical philosophies that turn all external effects on our lives into individual choices. Burkeman notes, “… we habitually act as if our control over the world were much greater than it really is.” However, our discomfort with luck does not make it any less real. It exists whether we like it or not.

I personally draw great personal motivation from my awareness of luck. I take Jesus’s call seriously: I have been given much, so much is expected from me. I will not arrogantly list my life’s achievements, but I have had many successes and live a great life. My ego would benefit greatly if I took credit for all my successes and believed my prosperity is a sign of superior character.

That belief would have made me feel much better about my own life and the world when I saw a homeless couple bickering on the street of Gran Via while living in Madrid. The couple lived out of two large, black plastic trash bags. They slept on top of one thick blanket on top of the wide sidewalk with another blanket covering them. Their skin and clothes were dirty, and I am certain they did not shower for weeks or more. Any night I found myself walking on that street, I saw them sleeping side-by-side in the long row of homeless people right next to the overpriced shopping centers.

I could believe that those people deserve their lives or chose to live like that before being born. Instead, I accept the pain and discomfort of knowing that human beings, just like me, live like that. I feel gratitude that my wife and I can bicker in the privacy of our own home, and we can sleep in a clean, warm bed without thousands of people watching us every night. Most importantly, I recognize that my fortune calls me not to shame the less fortunate. Instead, it calls me to serve my fellow humans in the best way possible.

My mom reminded me of my luck many times when I was young. When I was three years old, my dad took our family to an American Chemical Society exposition in Orlando. He was just starting his career as a chemistry teacher and ended up working for ACS for four years before getting a teaching job with the Department of Defense. After the expo, we went to meet my dad in the hall as everyone was taking down their exhibits. One exhibit included a large wooden display, over 10 feet tall, with a hole in the middle for a TV placed around eye-view height. I lagged behind my mom walking past the exhibit, and, somehow, the large display fell down right on top of me. My mom, initially thinking I had knocked something over, turned around to chew me out. Instead, she saw her 3-year-old son standing in the large wooden slab’s TV hole.

Thankfully, we will never know what that fallen display could have done to me. My mom has told that story dozens of times, usually adding that my guardian angel saved me that day. Guardian angel or not, I myself was lucky. I did nothing to prepare for that moment. I know luck exists. It can be a painful fact, but I live with it. I use the fact to feel grateful, work hard, and give back.

Last year, I met with the California State CISO, Vitaliy Panych. I had recently served on a panel interviewing future officers in my cyber operations squadron, and one of the interview questions was fresh in my mind. I was very curious what Panych's answer would be, so I asked him. “What is the biggest challenge in cybersecurity today?” I asked him. He gave an answer that I have been thinking about for the last year.

Panych told me that organizations struggle to establish sustainable processes to maintain security long term. They focus on security temporarily to meet a provided requirement and show compliance, but security leaves consideration once the organization resumes normal operations. In other words, organizations can meet a clear requirement when they know what is coming. When things change, however, they struggle to adapt. He clearly drew his answer from deep experience in the field. I have witnessed this challenge specifically in the military. In fact, I think this particular challenge is worse in the military than anywhere else.

To illustrate why we struggle with this in the military, let us take a look at a modern military operation. On January 2nd, 2026 at 10:46pm the United States launched 150 aircraft from 20 bases and warships towards Venezuela to initiate the capture of Nicolas Maduro. Helicopters touched down at Maduro’s palace at 2:01am, and he was detained onboard an American naval vessel less than 90 minutes later. The United States lost no personnel or aircraft in this operation, known as Absolute Resolve. Source.

Operation Absolute Resolve resulted from months of planning. The team gathered intelligence, planned each part of the operation, and was ready to execute the plan on the order. Military schools teach operational planning with this particular type of operation in mind. I would describe Operation Absolute Resolve as a straightforward operation. The end state and goals are clear and the situation changed minimally during the operation.

Joint Publication (JP) 5–0, Joint Planning, is the key document that outlines military operational planning, known as the Joint Planning Process. The first principle of Joint Planning, according to JP 5–0 is, “Focuses on the End State.” The document defines the end state as, “the set of required conditions that defines achievement of all military objectives.” The Joint Planning Process consists of seven nice-sounding steps to allow military planners to turn the end state into detailed execution plans, each an option. The person making the decision could be a commander or maybe even the President, but they select the option that they prefer. The detailed execution plan becomes a set of military orders that military units execute exactly to achieve the end state.

This might sound like common sense. Of course you should define the end state, make a detailed plan, and execute it. This straightforward view of planning and conducting military operations, however, doesn’t actually work in many real-world scenarios. In the case of Maduro’s capture, the entire operation lasted a matter of hours. The United States military had an overwhelming force. Additionally, the operational planners had months to gather intelligence and consider contingencies. In many cases, these nearly ideal conditions do not exist. Military leaders need to operate with limited information, time pressure, and considerable resistance. Fortunately, military doctrine already has a concept to meet these requirements: campaigns.

As defined in JP 5–0, “campaigns do not end with the achievement of military objectives and do not have end states to help determine termination criteria.” This is because “campaign objectives and US interests may change as the OE [operational environment] evolves and policies change.” While of course military leaders perform campaign planning, this planning acknowledges the existence of unknowns and the likelihood of changing priorities and objectives. Campaigns, unlike traditional operations, can adapt even if planners did not account for a specific contingencies. One situation in which a campaign was needed instead of a traditional military operation was the American fight against Al-Qaeda in Iraq. One of the key leaders of this fight, General Stanley McChrystal, has written extensively on the challenges traditional military planning and operations in his book, Team of Teams.

McChrystal divides military operations into two types: complex or complicated. A complicated operation might have many moving parts, but it can be known in its entirety. At the very least, the unknowns are minor enough to not affect the overall thrust of planning, and you can account for them with contingency plans. A complex operation, according to McChrystal, has “so many interactions that one cannot reasonably forecast the outputs based on the inputs.” McChrystal clarifies that complexity depends on the duration of the military operation (or other activity) in question. For example, weather would be complex over the time span of a month but complicated over the time span of a day (see note 1). How do we know what’s complicated versus complex? While we lack a perfect dividing line, McChrystal tells us that “the ability to predict is the most relevant criterion…”

Personally, I think many military leaders overestimate their ability to predict outcomes and contingencies. McChrystal himself calls it, “predictive hubris.” Cyber operations, in particular, require a departure from this predictability mindset and a shift towards campaigning in an uncertain environment. Multiple military cyber operations leaders have already called for this shift towards campaigning.

Major General Oleksandr Potii, head of the State Service of Special Communications and Information Protection of Ukraine, tells us, "the domain is campaigning not attacks." Potii's article, "Exhaust, Don't Deter," tells us to engage in persistent campaigning which can change shape as the environment and facts change. He explains why, after combating the Russian Federation in the cyber domain, he has learned not to rely on a hypothetical future of no successful cyberspace attacks. Major General Ryan Janovic, Commanding General of the U.S. Army Cyber Center of Excellence, has also called for a move towards campaigning. He writes in his article, Seven Insights from a Cyber Operations Maneuverist, "The future of cyber operations lies less in isolated actions and more in campaigning."

Private sector cybersecurity professionals have called for a similar shift. Phil Venables, former Chief Information Security Officer of Google, describes the need most clearly in his article, "Everyone Has A Plan Until They Get Punched In The Face." Venables highlights the problem with cybersecurity leaders "writing down comprehensive plans and procedures on what to do and how to respond to specific events." One of the main problems with this method, he tells us, is "significant events are unique and even if you consulted the plans it would be a lot of effort to contort them to the specific situation you are facing." I will cover Venables's recommendations a bit later, but he clearly recommends persistent, adaptable activities over exhaustive planning for hypothetical futures. His recommendations clearly align with a shift to a campaigning mindset.

United States Cyber Command (USCYBERCOM), however, still operates largely under the model of traditional operations and uses tools meant for complicated problems. I have seen this in particular in my work on a Cyber Protection Team (CPT). CPTs are USCYBERCOM’s tool “to defend the Department of Defense Information Network (DODIN), critical infrastructure, and key resources…” These teams, however, operate in a serial, scripted fashion. The teams plan for months, “defend” for a few weeks, and analyze for another month or two. From a monitoring perspective, this limits these teams only to proactive threat hunting rather than any persistent detection capabilities, a known bad practice in cybersecurity operations. The US Air Force has attempted to fill this gap with Mission Defense Teams. CPTs, however, still serve as the foundation of the US military's internal defensive measures because of, in my opinion, an inability to campaign in the cyberspace domain.

Therefore both military practitioners like General McChrystal, General Janovic, and General Potii as well as non-military cybersecurity professionals like Vitaliy Panych and Phil Venables advocate for adaptive, resilient operations over pre-planned operations based on the end-state model. Some military strategists and leaders, however, still want cybersecurity to look like a clean activity which we can solve with a proper end state and plan. Let us look at an example from a cybersecurity strategist and well known voice in the military sphere, Gentry Lane. Lane advocates for the end-state model in an article titled “Major Cyber Attacks Not the ‘New Normal’.” Her article concludes: “Perpetual cyber conflict engagement is futile, expensive and does not yield a secure end-state. And further pursuance of misaligned, Sisyphean efforts is not in the best interest of the country.” Sisyphean refers to a character in Greek mythology, Sisyphus who made the mistake of upsetting Zeus. As a result, Zeus forced Sisyphus to push a boulder up a hill for eternity. As soon as the boulder nears the top of the hill, it rolls back down, restarting his pain.

I sympathize with Lane’s desire to get the boulder to the top of the hill and achieve a risk-free domain. However, as I have argued before, I do not think this goal is realistic. Lane more explicitly calls out the goal in her article, "Operationalizing Deterrence by Denial in the Cyber Domain," where she defines the desired end state as, "The cyber domain is no longer a theater of active conflict." This utopian ideal will not work in the cyber domain nor in other areas of military conflict or risk. As General Potii recommends, we must "…accept that cyberspace is a continuous competition…"

End-states and predictive hubris limit effectiveness of military operations, but that leaves us with only the identification of a problem. Even if you agree with my conclusion, I have not outlined any straightforward solutions. While the works of General McChrystal, General Janovic, General Potii, and Phil Venables outline extensive solutions, here are three focus areas and themes that underpin all of these works and provide actual solutions.

1. Build capabilities, not plans. I stole this directly from Venables's article. Venables tells us that capabilities, unlike plans, "are combined / utilized at a time of need by a trained work-force to deal with whatever event is thrown at them." The military already employs this methodology in most training mechanisms. Individuals and teams learn a basic set of skills and drill them to death — wax on, wax off. Then these teams combine these skills in more dynamic and unpredictable training events known as exercises. Afterwards, evaluators identify gaps which allow the improvement of training or designation of new skills to be trained. What does NOT happen, is the development of a new plan to deal with the specific problem that occurred during the exercise.
2. Design and rehearse adaptive processes. Capabilities solve the tactical challenges that might confront a campaign. For individual challenges within the campaign, we need processes. Processes, unlike plans, apply broadly to many types of unpredictable challenges. These processes should consist of simple rules which identify things like who to contact or when to escalate. Processes help teams deconflict priorities and communicate with one another to build what General McChrystal calls "shared consciousness." Processes will have some level of organizational specificity but should apply broadly enough to work regardless of the challenge thrown at your team.
3. Stop demonizing reactivity. We often see the word "reactive" used to criticize any lack of prediction. Many people, including me, intuitively see "reactive" as a negative word and allow those who use it as an easy dunk on advocates for adaptive processes. However, imagine a military team that can learn new information as it happens, react quickly, and take decisive action in response. This type of reactivity is not only good in modern military operations, it is an operational necessity. In the words of Panych, "the ability to solve problems as they fly at you is one of the most valuable attributes a human can have." Of course, that does not mean organizations should not prepare. It means preparation should align with, in the words of Phil Venables, building a "trained work-force to deal with whatever event is thrown at them" instead of "comprehensive plans and procedures on what to do and how to respond to specific events."

Military strategists try to apply an idealistic view of the world to military doctrine and guidance, but this view does not align with the real-world experience of operators and operational leaders. In their view, operations are built on end-states and plans. However, cyber operations in both the military and private sectors show us this view's limitations and failure to align with the practical reality. In my own career, I have seen multiple military leaders focus on detailed planning even when we clearly lacked the information for these plans to provide any value. We cannot plan our way to perfect cybersecurity. We cannot rely on end states. We must campaign.

Note 1: Team of Teams actually states, "weather would be complex over the time span of a day but not a month." This is an error in the book, and McChrystal meant it the other way around.

I remember the day I received my first mission in the Air National Guard. A freshly promoted Captain, I walked over to my team and told them everything I knew. After walking them through the details, I asked, “ok, what do you all think we should do?” One ornery Staff Sergeant said, with a slightly frustrated tone, “what do you want from us? You need to tell us what you want before we can do anything.”

I honestly did not really understand the reasoning for this comment at the time. Only later did I learn that most of the team actually expected me to write down all their tasks in detail, and they would go do them. This seemed absurd to me. The whole team had received extensive training at great cost to the Air Force. Many had successful civilian careers working in cybersecurity. Why wouldn’t I ask them for their guidance?

Later, after our mission took an unexpected turn, we had a new task given to us from headquarters. Basically, we were asked to “prove” something given log data. I asked them to present the best evidence they could find to answer this question. The team came back to me with a completely unacceptable answer. The information they provided was clearly insufficient evidence of what we were looking for. I asked, “if you were the one asking for this, would you accept it?”

This was the inflection point. I received many comments from the team about how unexpected this was. They realized, I wasn’t a dumb junior officer. Instead, I was truly empowering them to make decisions, but also ready to hold them accountable when needed. They realized I could figure out how to write all these individual tasks down, but I chose not to. To this day, many of the members of that team remember that moment and still mention it to me when I see them.

Why was my management style so unexpected for the members of this team? I believe it’s because the military culture still drives leaders to a very directive style. In military culture, commanders are the central figures and heroes who, as the name implies, give commands to their team to achieve the mission. The commanders are the brains of military operations, directing their team to success.

Military doctrine reinforces this overemphasis on commanders in the decision making process. The United States military’s guidance for conducting operations, Joint Publication 3–0 states, “The commander is the central figure… due to education and experience, but also because the commander’s judgment and decisions guide the staff throughout joint planning and execution.”

I find this framing of leaders most egregious in the military’s view of intelligence. Joint Publication 2–01, Joint and National Intelligence Support to Military Operations is the de facto standard for how intelligence should be used in military operations. The document wastes no time in stating the official objective of intelligence: “provide accurate and timely intelligence to commanders.” These are the very first words in both the executive summary and the introduction of chapter 1. The overarching guidance on Joint Intelligence, Joint Publication 2–0, makes a similar claim: “Information is of greatest value when it contributes to the commander’s decision-making process by providing reasoned insight into future conditions or situations.”

In other words, military doctrine sees commanders as chess masters who painstakingly assess the situation, define the specific tasks, and push out orders. The non-commissioned officers and junior enlisted members await these orders like chess pieces, then move where told upon command. Intelligence is for commanders because commanders need the information, and commanders make decisions. Commanders have superior “experience and intuition” (JP 3–0) and therefore must have superior contributions to the decision making process.

General (Retired) Stanley McChrystal describes this model in his book Team of Teams as, “subordinates provided information, and leaders disseminated commands.” McChrystal is actually one of the foremost thinkers who rejected the traditional “chess master” leadership and regularly advocates for a new approach. His work has influenced government and business leaders alike to develop adaptive, resilient organizations. His research in Team of Teams and elsewhere has also helped drive the emergence of Mission Command as a new set of principles in military leadership. I believe Mission Command does not go far enough in combating the overly directive culture of the military, but that’s a discussion for a future article.

McChrystal specifically rejects the idea of intelligence’s primary utility for commanders. Instead he reversed the model, “we had our leaders provide information so that subordinates…could take initiative and make decisions.” McChrystal acknowledges that sharing information (and intelligence) is the first step in getting individual contributors to drive their own operations in line with the commander’s intent. If people are uninformed, they can’t make or at least drive decisions.

McChrystal also rejects the outsized impact of a commander’s education, experience, and judgment which are emphasized in Joint Publication 3–0. In fact, he originally held “the belief that the 70 percent solution today would be better than the 90 percent solution tomorrow” when he decided to decentralize authority. However, he discovered that when “we pushed authority down, the quality of decisions actually went up… we found out estimates were backward — we were getting the 90 percent solution today instead of the 70 percent solution tomorrow.”

McChrystal is not the first military leader to highlight the flaws in the military leadership framework. In his book Turn the Ship Around, Captain (Retired) L. David Marquet calls this traditional leadership model “leader-follower.” He describes leader-follower as, “the image that comes to mind when we think of the confident, resolute commanding officer boldly leading his crew into battle. We think this is good leadership.” Marquet instead advocates for a “leader-leader” model, which he describes as “giving employees control over what they work on and how they work.”

Much like McChrystal’s rejection of information and intelligence being of “greatest value” for commanders, Marquet also rejects the “information up, orders down” paradigm. He specifically advises, “don’t move information to authority, move authority to the information.” Marquet’s book is one of the best leadership books ever for both military and non-military organizations. He tells the story of replacing leader-follower with leader-leader and the great successes his organization achieved. Marquet describes the leader-leader culture he created as: “instead of one captain giving orders to 134 men, we would have 135 independent, energetic, emotionally committed and engaged men thinking about what we needed to do and ways to do it right.”

Just as McChrystal and Marquet reversed their models to achieve success, the entire military needs to reverse its model. The model must center not on commanders, but on operators. Joint Publication 2–0 currently defines the collection of intelligence requirements for military operations as “commander’s critical information requirements” (CCIRs). Why not operator’s critical information requirements? Instead of asking, “what does the commander need to know to direct this operation?” we should ask, “what does the operator need to know to execute?”

Many military leaders are starting to recognize this challenge, but military culture and doctrine still lag behind in truly implementing the concept across the force. We must work together as a military to remove the commander as the central figure of military operations. Instead, the operator, the one actually executing the mission, must be that central figure.

Exactly one month ago, unknown threat actors began pummeling Palo Alto Networks GlobalProtect portals and gateways with malicious traffic and brute force logon attempts. Between 14 and 20 November, these threat actors unleashed 2.3 million malicious sessions against exposed GlobalProtect access points.

VPNs have long served as a primary target of threat actors online. VPNs are often one of the few publicly exposed services on an enterprise network. Threat actors must first access the VPN and pivot into private servers in datacenters or the cloud to reach an organization’s sensitive resources. VPNs have also presented vulnerabilities notably from Fortinet, Ivanti, and Palo Alto. Just like GlobalProtect, Fortinet’s VPN also saw a large brute-force wave this year.

Many customers I have worked with use geoblocking to protect their VPN portals and gateways. Since I mostly work with customers based in the United States, these customers limit accesses to IP addresses from the United States. The Palo Alto firewall makes this easy with "Region" as an option when selecting the source of a security policy rule.

I decided in September to test the effectiveness of geoblocking. I exposed a GlobalProtect VPN portal and gateway up to the worldwide internet and monitored failed logins. I originally planned to observe the source regions in failed login attempts for 60 days, then to provide geoblocking (only allow US source IP addresses) and observe source regions another 60 days. I hypothesized that the number of brute force attempts from the US region would increase because logon scripts would adjust based on my policy. In other words, I suspected these systems might intelligently increase traffic from US sources once they discovered my geoblocking policy. The results of the first 60 days showed something even more interesting.

During the first 60 days, I observed 122,932 failed login attempts to GlobalProtect. That is over 2,000 per day. Astonishingly, 122,133 of these attempts came from within the US region. Over 99% of the attempts on my VPN access points came from IP addresses within the US. In other words, even WITHOUT geoblocking, scanners already targeted my VPN portal and gateway from within the US. This observation aligns with research from the New Zealand National Cyber Security Centre which stated that threat actors use the "same country as their intended victim to bypass geoblocking." Source.

The European Union Agency for Cybersecurity, ENISA, states threat actors have access to "Operational Relay Box (ORB) networks" from which they can obfuscate their activities and use a source IP address of their choice. Source. This statement also aligns with my observations. During the same 60 day period, I wanted to observe the nature of source IP addresses with failed login attempts to GlobalProtect. I had the plan to start blocking IP addresses after multiple failed attempts to see if the scanners would start to change their source IP addresses as well. I have seen organizations use this as another method to protect their VPNs from brute force, and I myself even made a YouTube video that explains how to build such an autoblock in the Palo Alto firewall. Much like the source region results, my data surprised me.

Failed logins to GlobalProtect came from a wide array of unpredictable IP addresses. Over the 60 day period, 7,303 different IP addresses performed failed login attempts. That comes to a mean of about 17 failed login attempts over the two months and a median of 18 failed login attempts. I also pulled a single 24 hour period to observe the failed login attempts. With 7,773 failed login attempts from 2,587 IP addresses, threat actors performed a mean of 3 failed login attempts per IP address and a median of 2. In one day, 2–3 failed login attempts is completely within the bounds of normal activity. I would also argue 17–18 failed login attempts over 60 days does not reach the threshold of suspicious brute force logon attempts.

It turns out that many of the most common ways of protecting your VPN portals and gateways may provide little actual protection. A geoblock would have prevented less than 1% of the observed traffic. Even blocking a source IP address after 2 failed login attempts would have only prevented about 33% of the observed traffic, and such a restrictive policy would certainly create friction with users. I recently found a new, innovative way to protect VPN portals and gateways from these types of attacks, but I must save that explanation for another day.

If you like this kind of material and research, please follow me here on Medium and also subscribe to my YouTube channel. I will continue to cover this topic over the coming months. I published all the results of my experiment here for your viewing pleasure.

Last Monday, I went with my neighbor to see Jen Easterly speak here in Jacksonville, Florida. The Jacksonville World Affairs Council brought Easterly to Jacksonville to talk to local professionals about AI and cybersecurity. I was super stoked to see her. She and I both started our cybersecurity careers in the military, and I heard amazing things about her leadership in CISA. I often cited her when talking about the threat of Chinese intrusions in critical infrastructure during my planning and execution of the Cyber Dawn exercise.

Jen Easterly is famous in the circles I inhabit, but many in the field told me they do not know about her. Let’s just say, she held one of the two highest cybersecurity posts available in the United States. She was the Director of the Cybersecurity and Infrastructure Security Agency, CISA, known colloquially as “America’s cybersecurity agency.” I would argue the Director of the NSA who is also the Commander of US Cyber Command is co-equal with the CISA director. Easterly, as a matter of fact, helped establish US Cyber Command. She also served on the staffs of Secretary Condoleezza Rice and President Barack Obama. Between government service in the Obama administration and assuming the directorship of CISA, she even worked in the private sector as a cybersecurity director at Morgan Stanley. She had quite an impressive career to say the least.

Easterly gave an extremely engaging talk. Her talk included fantastic videos and sound effects. When she introduced characters in cybersecurity like the “attackers” or the “victims” she had quick intro scenes with music. She entertained and targeted the mostly non-technical audience. My neighbor and I both work for cybersecurity vendors, so we were not really the target audience, but we both enjoyed the infotainment nonetheless.

Easterly focused her talk on the area of Software Development Security, one of the eight domains defined by ISC2. She said, “we don’t have a cybersecurity problem, we have a software quality problem.” She leveraged her education in economics to explain the source of the issue. Easterly explained how cybersecurity is a “credence good” which means a consumer struggles to assess quality even after purchase. Those of us in the cybersecurity world often struggle with this phenomenon. The cybersecurity industry seeks to ensure compromises do not occur, and organizations therefore struggle to measure their effectiveness.

In addition to attackers and victims, Easterly also introduced “vendors” with one of her exciting video clips. She referred to all vendors of software which have vulnerabilities. In other words the “software quality problem” comes from these vendors — more on that later. She did not demonize the vendors, but instead focused on how the vendors will deprioritize the credence good of security. They will instead favor new features for their customers because these features provide a tangible (search or experience good) benefit to the customer rather than the unseen benefit of cybersecurity. Easterly therefore concluded that we require economic pressure through both regulation and consumer pressure to prioritize cybersecurity and hold vendors accountable.

I totally agree with her. We do struggle in the technology sphere to prioritize cybersecurity properly, and we do need economic pressures as a forcing function in cybersecurity. I also agree that vendors should take on more responsibility to own their own errors and the response when their software puts customers at risk. Easterly’s framing of this issue, however, pushed the argument to its extreme, and I disagree with the absoluteness of many of her conclusions. She is a big believer in “secure by design” and has been for some time, but I believe some nuance to her statements is warranted.

Honestly, I felt some of Easterly’s boldest claims misled the audience about the current state of cybersecurity. First, I do not agree with the aforementioned statement that “we don’t have a cybersecurity problem, we have a software quality problem.” If this were true, most, if not all, breaches would result from software vulnerabilities. Last year, Mandiant reported 33% of incidents it responded to resulted from initial access via a vulnerability exploit. Don’t get me wrong, that’s a lot, but 16% resulted from stolen credentials on valid accounts. Unit42 actually reported a higher number of incidents from stolen credentials at 41% for last year. Their number for software exploits last year was 31%. I would therefore amend Easterly’s statement to say, “software quality presents one of the most significant cyber risks and demands serious attention.”

As part of Easterly’s focus on the problem of vulnerabilities, she asked, “in what other industry would we accept this?” I am not sure what “this” refers to. If she means “manufacturing flaws” or “security risk,” then my answer is, we accept this in every industry. Do you know one industry that accepts zero risk? I doubt it. Yes, vendors make vulnerable software permitting attacks, but also Boeing’s quality control issues have led to the death of over 300 people. Yes, criminals are breaking into digital systems and stealing customer data, but they are also breaking into museums and stealing priceless artifacts. I have heard others make the charge “in what other industry…” Some now accept it as conventional wisdom, but it crumbles under scrutiny.

Easterly’s hinted that AI might resolve the software quality challenge. She talked both about AI-written code and AI tools to identify and fix vulnerabilities in software. I love the shift-left security strategy and agree that AI holds much promise in addressing this challenge. Easterly, however, went to the logical extreme that AI generated and evaluated code will lead to “the end of cybersecurity.” She even referenced Francis Fukuyama’s The End of History as inspiration for this claim.

Many have this desire to “achieve security” and arrive to a cyber secure end-state. As I mentioned before, we have not achieved a secure end-state outside of the digital realm, but many still feel any amount of risk in information technology is unwarranted. Even if you accept that postulate, it’s unclear right now that AI generated or evaluated code brings us closer to that state. As someone who writes code both manually and with AI copilots, I can tell you it still makes plenty of mistakes and has its own quality control issues. This makes sense because these copilots have algorithms which learn from human-written code. If code has vulnerabilities and quality issues, which Easterly regularly repeated that it does, then of course AI generated code will also have these issues. Of course, we can train AI to write more secure code over time.

I personally subscribe to Anton Chuvakin’s thesis of “pessimistic in the short term and optimistic in the long term” concerning AI in cybersecurity. Could AI lead to the end of cybersecurity as we know it? Maybe. I think making that claim now, ironically, is just as premature as Fukuyama’s 1992 claim that no serious ideological competitors will challenge liberal democracy. Fukuyama himself walked back his claims 26 years later, and various scholars have continuously observed that liberal democracy has not become the uncontested final form he foresaw (reference 1, reference 2). I expect Easterly’s ambitious “end of cybersecurity” prediction will, like Fukuyama’s, appear premature and overstated in the coming years and decades.

I really enjoyed Jen Easterly’s talk and am grateful to have had the opportunity to hear her speak. I also thank the Jacksonville World Affairs Council for bringing her to our city to speak with us. I appreciate her work to advocate a prioritization of cybersecurity and creating the needed economic pressures to increase our security in the digital world. I did, however, disagree with some of her overstated claims and conclusions. Cybersecurity supports more than just software flaws. The field of AI will certainly continue to make a great impact on our digital world, but I see no reason to announce the impending end of cybersecurity, or history for that matter.

I recently served on a selection board to hire a new officer in the Air National Guard. I volunteered to support this effort hoping to help shape the future force. I did not feel particularly qualified to select future officers, and this imposter syndrome only worsened when I saw the high quality of candidates applying. In many ways, a lot of them should have been evaluating and interviewing me, not the other way around.

I have, however, learned about specific qualities of officers that I want to work with. I used my eight years of experience in the military and my four years in the private sector to evaluate the skills and potential of each candidate. I learned a ton from this process and wanted to share my observations for those who might want to apply to become officers one day. While each board differs, I hope my perspective can help aspiring military officers with their applications and interviews for future commissioning opportunities.

The selection process. We divided the selection process into two phases. The first phase included a “paper board,” so we only considered information in the written application. After down-selecting members in the first phase, we interviewed the top candidates. Each of us decided who we wanted to recommend shortly after all the interviews completed, and we each provided that recommendation to the Commander. The Commander had the final say in our selection.

The officer position, like my own in the Air National Guard, was for Cyberspace Effects Operations. We help defend the digital domain for federal agencies and the domestic agencies we support in the state of California. As officers, we lead teams. Therefore, we primarily considered the candidates’ relevant cybersecurity and leadership experience.

The applications. The applications consisted of various mandatory paperwork like transcripts and military records. The applicants also had to include more “free-form” documents like a cover letter, a resume, and recommendation letters. I personally started my review of each application with the resume. It provides the comprehensive, high level view of the person’s experience and background. I then cross referenced the other documents while going through the resume. I made sure to read everyone’s cover letter and recommendation letters as well to get the full context. I felt the resumes and recommendation letters were the most impactful, so I will provide some specific observations on each.

The quality of the resumes surprised me. As I mentioned, the applicants all had lots of experience. Most had worked in both the government and private sector and had promoted into senior level positions. With that in mind, I would have expected their resumes to be better than they were. Part of me questioned whether I was going crazy, but posts like this one reminded me that I do understand resumes correctly.

Many of the resumes just included job descriptions. They did not add their actual accomplishments or achievements from working in those jobs. Someone reading your resume should understand exactly what you did and achieved in that role. For example, my previous job description says: “align how we best serve our customers in understanding their environment, providing solution guidance and ensuring value realization.” Pretty vague, right? My resume says “Completed 5 proof of concept demonstrations to show customers how products benefit them in their own environment. Proof of concept activities resulted in $5M of new business.” With the use of metrics and specific activities, I make it clear what I did. I also add the outcome for the business.

The resumes also included lots of details irrelevant to the posting. Adding a resume item with something like hiking Mt Whitney can help your resume stand out, but I would generally recommend keeping your resume on subject. I especially recommend this if your resume is more than one page long. People start to lose track of the key items you want to highlight when your resume is too long. You might take pride in the dog sitting you did to pay the bills in college, but it might just add unnecessary fluff to your resume. You must tailor it.

Applicants with good recommendation letters had much stronger applications. Several applicants did not include any recommendation letters which significantly weakened their applications. In contrast, one candidate had recommendation letters highlighting their leadership experience, which helped compensate for a lack of leadership experience elsewhere in the application. Those who did not add recommendation letters missed this opportunity.

I also experienced something I had never seen before: bad recommendation letters. Of course, the recommenders still wrote positively about the candidate, but their advocacy was weak at best. Some recommenders even wrote they did not know the candidate very well. A recommendation letter like that could hurt the candidate more than help them. A recommendation letter should contain glowing reviews of the individual. Like the resume, it should contain specific achievements and highlight qualities relevant to the position. For officers, this means leadership.

The interviews. We had short interviews of 30 minutes. We asked all the interviewees the same questions and had pre-written follow up questions that we could ask if needed. Scripting the interviews this way ensured fairness, but this structured interview differed significantly from what I have seen in the private sector. We evaluated both the content and style of the answers. Some members of the board had more of a focus on style while others cared more about content. I believe in function over form, but both matter.

The level of style varied significantly between members. There were a few outstanding speakers who provided beautiful sounding answers to each question. Others struggled. I myself struggle with this, but I have recently improved with activities like improv classes, Toastmasters, and my YouTube channel. Most people have heard the standard advice: avoid verbal crutches, stay on topic, and tell a story, but doing all this requires effort and practice. We also agreed as a group that we supported people who wanted to pause for a moment at the beginning to think about their answer. We would rather wait on a well thought out and excellently delivered answer than hear a less stellar answer without the initial pause.

I will comment briefly on the content without giving away the questions. The best answers we heard were unique. I did not realize this before this board, but people with unique answers really stood out. For example, a common interview question is “what are your strengths?” A candidate might want to say something like “hard work,” but most people feel they work hard and might say that. To stand out, you could instead say something like, “I can stay calm in stressful situations,” then provide an example of that happening.

On that note, the better answers included personal experiences. Tying past events from your working life to your answers shows that you really do have the experience for the job. If you just provide hypothetical answers, you miss the opportunity to demonstrate credibility and give the interviewer a reason to trust that you can perform under real-world conditions. You also improve your style with personal experiences because you start to tell a story rather than just deliver cold facts.

That being said, interview answers, just like the resume, should stay on topic and answer the question. One of our questions had two parts, and only one of the candidates answered both parts. That really helped that candidate stand out. In some cases, the candidates would get off topic or answer a different question. Those who fully understand the question before answering it display a crucial skill: listening. While we often focus on speaking ability during interviews, listening abilities are generally much more important in almost any line of work.

The interviews closed with an opportunity for the candidates to ask questions. This part of the interview gave us a surprisingly large amount of information on the candidate’s attitude and desires. It reminded me of a quote from former Navy SEAL Coleman Ruiz, “We could tell from interviews who would drop. It was the ones who were in it for themselves.” — from Team of Teams by Stanley McChrystal. Some of the candidates asked questions about our mission and how they could contribute. This really showed us their dedication to the mission first and improved my impression of those candidates. After all, someone who plans to come in and do good work probably wants to understand the job and goal of the organization.

What I learned. I learned a ton from this experience and will definitely adapt my own job-application style based on what I learned. If you ever have the opportunity to review job applications or interview candidates, I strongly recommend doing it. Although others have interviewed me many times, sitting on the other side of the table opens your eyes to what works and what doesn’t. In particular, I learned:
1. The free form parts of your application like the resume and recommendation letters give you the most opportunity to stand out.
2. Recommendation letters should have a glowing review with examples. Otherwise, they could even hurt your application.
3. It is okay, good even, to pause before answering an interview question.
4. Unique answers that others would not say help make a stronger impression.
5. Personal experiences add credibility to your answers.
6. Listening well during the interview is just as if not more important than speaking well.
7. Show you care about the work and the mission.

For those of you planning to commission into the military some day, I wish you the best. Feel free to reach out to me on LinkedIn if you have additional questions or want more specific advice.