So we’re midway through cybersecurity awareness month. Yay! Are you aware yet? Good for you.
This morning, I came across an article on the marketing-focused publication “adage” (see what they did there? It’s clever because it’s both “Ad Age” and also “adage” as in short proverb) entitled “Why CMOs Need to Become Cybersecurity Experts.” I don’t typically read “AdAge” — this one showed up in my feedly filter because of their liberal use of the term “cybersecurity”.
Now, you might sense that I’m winding up to complain about it, having adroitly noticed me crawling forth from my “internet hole” this article in hand. You’re right of course, but let me start with the fact that I don’t hate the content here. It’s basically a thought piece from Carbonite’s chief marketing guru about why Equifax is a wake up call for marketing professionals. It goes on to cite the brand implications of a breach using Equifax as an example, cite the role of crisis management for marketers, and explain why marketing professionals should support security goals for the organizations they work in. For the record, I love that message. And it’s expressed in a lucid, articulate way without relying on FUD. Also fantastic. So gogo that guy.
What irritates me about this is the title. Because “giving a crap” != “expert.” Saying they are equivalent is dangerous. For example, I “give a crap” about climate change; I am not an expert in it. I can tell you why I think climate change is important to society generally, and to me specifically (living, as I do, close to the ocean.) Likewise, I have a layman’s understanding of the forces involved in climate change: the trends at work, the general contours of the research, policy considerations, and the like. But am I a “climate change expert”? No. I am not a geologist, meteorologist, hydrodynamics engineer, physicist, etc. etc. I’m likewise not a policy expert. See? Interested, not an expert.
Why does this matter? It’s just a title, right? But stay with me on this. There are a few things here. First, people listen to experts. They listen to them in a way that they don’t to the average Joe. We know (for example, from the Milgram experiment) that people are more likely to comply with authority figures. If someone is perceived as an “expert”, others will tend to give them more credence, defer to their judgement, even to the extent that doing so causes injury or harm. Scary, right? I think so too. To the extent that we reinforce the message that “being an expert” means “caring about the topic”, we set up the situation where some people – maybe intending no harm to others – can cause damage because their definition of expert doesn’t include actually understanding the topic in detail. They can cause that damage because others perceiving them as an expert will tend to defer to their judgement. When the person they are deferring to is someone who is equipped to help, that’s great – when it’s someone who is a specialist in something else (but has decided they really care about the topic but don’t really know anything about it), that’s not so good.
The second thing has to do with something called the Dunning-Kruger effect. If you haven’t heard of it, it’s (per Wikipedia), “…a cognitive bias wherein people of low ability suffer from illusory superiority, mistakenly assessing their cognitive ability as greater than it is. The cognitive bias of illusory superiority derives from the metacognitive inability of low-ability persons to recognize their own ineptitude.” Paraphrased, a fancy way of describing why people who don’t understand a topic think it’s easy — it arises because they are unable to recognize what they don’t know, and therefore have no ability to plumb the depths of their own ignorance. Truth. So, it’s not unreasonable envision a situation where someone, reading this, might actually believe they are an expert in security, despite having woken up a lifelong marketing dude. That too is dangerous.
So what makes someone an expert? I’d argue that it takes a depth of understanding of a given field that puts them in the upper tier of practitioners – for a given specialization – based on their ability, knowledge, and skill. I’d love that to be true… it’s the definition I hold myself to and use to evaluate others. But as a practical matter, that’s not how it works. Instead, what makes a person an “expert” is, in large degree, that they say they are with sufficient chutzpah for people to believe them. It helps if they are well versed in message-crafting and they believe it themselves. I’ll leave it to you to draw the conclusion to the article title.
So, just a title? Maybe. But to the extent that titles can be dangerous, this one is top tier.