Introduction
In this episode, I’m joined by Patricia Hatter. Patricia has served as the CIO of McAfee, on the boards of two publicly traded companies and is an advisor to a number of other companies.
We discuss Patricia’s perspective on the evolving Chief Information Officer (CIO) role and boards. During our discussion, we cover several of the challenges facing executive teams and her take on where cybersecurity plays a role.
Speaker Profiles
Patricia Hatter LinkedIn: https://www.linkedin.com/in/patricia-hatter-5473873/
Patricia Hatter Twitter: https://twitter.com/PattyHatter
Qualys: https://www.qualys.com
Barrick Gold: https://barrick.com
McAfee: https://www.mcafee.com/
Audio File
Featured Hashtags
#CIO, #Board, #CEO, #DigitalTransformation, #CyberSecurity, #CIOitk
Podcast Transcript
Tim Crawford 0:04
Tim, hello, and welcome to the CIO in the Know podcast, where I take a provocative but pragmatic look at the intersection of business and technology. I’m your host, Tim Crawford, a CIO analyst and strategic advisor at Avoa. Welcome to episode number one this week I’m joined by Patricia Hatter, who is the former CIO for McAfee, serves on the boards of two publicly traded companies, and is an advisor to a number of other companies. In this inaugural episode, we talk about the evolving role of the CIO, the CIO engaging with the board of directors and cybersecurity.
So, thanks again for joining us for another episode of CIO in the Know. I’m Tim Crawford, and today I’m joined by Patty Hatter. Welcome, Patty.
Patty Hatter 0:52
Thank you, Tim. Great to be here.
Tim Crawford 0:53
So, Patty, you are the former CIO for McAfee, served on a couple of public boards, and an advisor to a number of groups and startups, that’s quite a background.
Patty Hatter 1:07
I’ve been very fortunate, very fortunate.
Tim Crawford 1:11
Well, I’m glad that you’re taking the time to join me today as part of the discussion. Let’s just jump right into it. You’ve had the fortune to work with a number of great companies from the CIO role and other roles. What’s different about the CIO role today?
Patty Hatter 1:28
You know, it’s interesting, because my view is when you look at IT organizations, a few years ago there was much more of an ability for CIOs to be in more of a command and control roles, you know, they were the center point for the technology that the enterprise would be using, people had to, all the other functions had to come to it, and it, it allowed it, in a way, to be a bit lazy in how they were developing relationships across the organizations, how they were figuring out models to really draw collaboration and partnership, and in a team with the different functions, and I think my view is with so many SaaS and cloud options today, you see it so much in organizations where if, if one part of a company feels like they’re not getting supported by it, they literally are able to go off with a vendor or two and and drive their own technologies, and then it’s left kind of holding the bag if something doesn’t work well, they have to jump in and sort, help sort it out, but that leaves a bad taste in people’s mouth, or they’re not getting engaged until there’s a problem. So it really, with the with the speed of the technologies now, and how much other parts of the business want to be driving and really focusing on new capabilities getting enabled as quickly as possible. It really makes it incumbent on the CIO to drive an organization that is centered around being flexible and how it works with the rest of the business, centered on a collaboration model, and, and, and centered on really taking risks with some of the new technologies and teaming with different parts of business to find ways to make them successful, you know, whether it’s other business functions like sales or finance or support or on the product development side, but that collaboration level flexibility really has to start with the CIO, and I see that is such a difference with where organizations were a few years ago. Do
Tim Crawford 4:01
you think that those outside of the CIO see it that way today?
Patty Hatter 4:07
Usually no, usually no. And that’s part of the problem, and you know, maybe this goes in the category of life isn’t always fair, but you have to deal with what you have, so in that spirit, I think the bulk of the responsibility of building those relationships and building that collaboration and building that flexibility between it and the rest of the business is on the shoulders of the CIO, and it, that the CIO has to be the one really setting the stage of, hey, it’s our responsibility to reach out to understand the rest of, you know, what sales is. Doing what the product teams are doing, what supports trying to do, what finance is trying to do, and meet people for further than in the middle, you know, it’s really it’s responsibility to get that understanding, build those relationships, and that that might not seem 100% fair, because maybe everything should be 5050 but it’s just not the case, and if, if the CIO isn’t setting the table in that way, and really setting that tone, the rest of it isn’t going to do that, and the rest of the organization isn’t going to take the time to try to, and if you don’t have that trust and willingness to work together, it’s, it’s, it’s that’s always going to be bad news for the CIO.
Tim Crawford 5:47
So, if we, if we kind of look beyond the CIO role itself and look toward the rest of the C suite, how should, from your perspective, how should the rest of the C suite look at the CIO role. What’s the opportunity for the CIO as they start to build those relationships with the rest of the C suite?
Patty Hatter 6:12
Well, I think that there’s well, a couple things. Maybe stepping back a second, I think for CIOs to really be able to do this, and Tim, I know you and I have chatted about this a bit in the past. I personally feel it’s super helpful for CIOs to have more experience than just NIT. I think having a broader, a broader set of experiences in roles across the company in different companies really helps CIOs, and then CIOs help the rest of their IT team to figure out how to best relate with their peers across the company, so one thing I always advocate for folks that are growing up in it or for for sitting CIOs is to look at opportunities across across the company. How can you even take even lateral positions to build your breadth of experience? Because that in the end, that’s going to make you better in doing your a variety of it roles, but also give you a way to progress to other roles outside of it as you continue to progress your career, because you know, I’ll use myself as an example, I had, I mean, my career is anything but a straight, a straight line. I started off in Bell Labs, started, you know, moved to Europe, started a new business unit, ran a PNL, ran services and sales, then moved to one I left AT&T, then moved to Cisco, and ran large transformation programs across the company. Came to came to McAfee in a head of operations role, then had the CIO title added, then the CIO of Intel security, plus a bunch of other intel responsibilities, and then moved back to a P&L role after my, my CIO stint, where I headed up services, and you know that was a great connection, because I was able to show how using my skill sets and understanding of what’s what really makes CIOs and IT organizations tick. Why are they buying what they’re buying? How to best, how to best create a unique value proposition. You know, I brought my CIO skills to that, to that different role, so I always advocate both in, you know, being the best CIO that you can, having those other skills, and then also once you have those other complimentary roles and experiences outside of just it that allows you to continue into other, into other roles after, after it as well,
Tim Crawford 9:28
so kind of looking beyond that kind of throw a sideways question to you, you know, there’s there’s been talk about which, which makes a better CIO, a CIO that has come up through the rank and file of the IT organization, and then, as you mentioned, starts to get experience from beyond the IT organization, or someone that comes from outside of IT that comes into lead IT. Which of those two do you think you. You know, as you kind of look forward and think about the future, I, the future CIO, which of those two kind of directions do you think, or maybe neither, serves the company best?
Patty Hatter 10:12
Well, and I think there’s there’s never just one path, and you know, each individual is a little different and brings a different personality, even if they have the same skill sets, brings a different personality to the table. I’d hate.. I just wouldn’t.. I wouldn’t say that if you didn’t have anything but it experience, you’re destined to be a bad CIO. You can, you can build up those muscles in different ways, those different skill sets, but I think you, you give yourself the best option, the best opportunity, the best skill sets, the biggest breadth of understanding how the company really works. If you have skills that you’ve honed in roles outside of just it, and maybe I’d put another qualifier on that. If, if a company’s really focused on using their CIO and an IT organization to drive bigger transformational changes, because that’s not always the case, you know, a company can’t always be in the mode of, hey, I’m turning things upside down, you know, I’m, you know, we’re in a different, desperate situation, we need to make big, bold changes. Organizations just don’t year over year live in that, it kind of ebbs and flows, I would say, especially when a company’s really in need of large changes, that’s when you want somebody who’s either inherently has the personality and the connections and the synthesis of how to draw that collaboration prioritizations for flexibility and working model with the rest of the business, if then that would work, but the bigger, the bigger the transformation a company has to go through. I’d really say the more important it is for the CIO to have a broad set of skills, not just it. If, if the company is more focused on, hey, we’re, you know, we need to go through a couple years of just managing the cost down, absorbing the changes that we’ve already made. We’re focused on, on sort of other product changes right now, not so much internal business changes, then you know, so more straight up it experience is going to be very helpful in situations like that, so there’s never just one way, but maybe different characteristics that would bode better depending on the situation that the company’s in,
Tim Crawford 13:06
you know, you highlighted a couple of other things too, which I want to bring up, which has to do with the individual and the importance of the individual and where they are and what they’re capable of, but it also talks to their understanding of the other roles, you know, when you think about the C suite,
Patty Hatter 13:26
completely think about
Tim Crawford 13:27
this, the role of the CEO, the role of the CMO, the role of the COO, kind of getting not getting in their head but head, and and understanding, okay, so what is it that my CEO is concerned with, and how do I start to kind of play along those lines, so that I can be more valuable to the rest of the C suite.
Patty Hatter 13:50
I personally think that’s so important, because a CIO will never have all their peers and their CEO boss give them a list of, here are my priorities. Here’s exactly what I’m thinking. Here’s how I prefer we work together. This is, you know, this is all thought out and completely organized. It just doesn’t happen that way. So I feel very strongly that the more the CIO, and this gets to CIOs, have to meet people more than halfway down the road. The more the CIO is able to understand what’s really driving the worries of the head of sales, of the head of support, of the head of the product teams, what’s what are they really concerned about in the next quarter, in the next two quarters, also in the next fiscal year, the more you can relate to that, the more you’re able to really add value in. Hey, okay, if this is, if this is where the worry is, if this is the, the risk for, for your. Organization or the company unfolding over the next few quarters. Here’s what it can do from our perspective. Here’s how we can help speed up these capabilities. Here’s how we can, you know, drive more cost down in this area. You know, maybe it would ramp up or down the risk, but then that’s a conversation to have, but I personally feel the more the CIO is able to really relate to what their peers are dealing with, what they’re worried about, what they’re afraid of going forward, what they’re worried for their own organizations or themselves, that’s what gives the CIO really a lot of credibility, power, ability to drive change, and ability to put their organization in a position to be much more of a supporting collaboration partner, and not just somebody. Where, hey, I need to, I need you guys to deploy X, Y, or Z. Tell me when it’s done, kind of thing.
Tim Crawford 16:08
Yeah, you’re, you’re really talking about an IT organization that is a proactive and be speaking in business terms, as opposed to technology terms,
Patty Hatter 16:17
right? And I know we’ve, you know, are the CIO community has been talking about that for a number of years. I personally, you know, in the tough love segment of our podcast here, I don’t think we’ve made as much progress on that as we should as a CIO community, and that
Tim Crawford 16:39
sounds like a call to action, right there,
Patty Hatter 16:42
completely, completely, and what does it take to do that? Like I said, I think it takes an understanding of the reality of CIOs, really have to be proactive in reaching out and have developing the skills, the understanding of the broader set of the business, and not just, you know, staying in the four walls of it, and waiting for a set of pre-baked priorities to come in from the rest of the business. You’ll be waiting a very long time for that. So, you know, how do you get out of that conundrum? It’s, it’s more on the shoulders of, of it, and specifically the CIO to say, okay, how, what, what skill sets, what can we learn, what can we upscale our, our IT professionals in that are going to make them even better at this.
Tim Crawford 17:39
Yeah, you know, I want to, I want to kind of take our conversation even beyond the C suite a bit, and I know you and I both have been privy to a number of conversations of late that have really kind of caused this uptick in the number of conversations about CIOs serving on boards, and you have that unique perspective, which many folks that are serving as a CIO don’t have, or don’t have yet, which is that you have served on a couple of publicly traded companies’ boards, including Qualis, so a technology company, and Bear Gold, which is a gold mining company, which you know, kind of seems very unique. Can you talk about the value that someone with your background, with that CIO background, brings to the board of directors?
Patty Hatter 18:38
Yeah, it’s very interesting, and I think we’re, we are still at our industry, and our group of CIO peers are just at the early stages of this wave. First, let me talk about how necessary I think it is, and then let’s pivot to the challenges, so every type of company needs technology, needs technology to drive speed out to their customers, improved operations, better cost, better employee experience, better customer experience more and more, even non-tech, non-technology companies are really repeating that mantra. We’re only going to get better if we figure out how to use technology, so that’s that’s a good thing. Now then, that leaves the question of how do they do that, how does that work, and my experience, because I’ve talked to, I’ve been on to public public company boards, I’ve spoken with a bunch of many, many board members in many. Many industries, and you know, there are a couple of things that are very frequently true. So, one of the things that’s very frequently true in all the public company boards that I’ve had an opportunity to deal with, there is very little technology experience on those boards, so most board members are made up of CEOs and CFOs, and those CEOs and CFOs are, you know, most frequently not from tech companies, so they’re, you know, really not in the in the technology space, so what they’re hearing just in all the all the information out in industry is there’s so much new technology you’re going to, your company is going to be left behind if you don’t figure out how to use it, and that’s really important, and what I typically see across industries is CEOs and boards really struggling with how do they even talk to or relate to their CIO, and where is the value given all the spend that that the IT organization is spending, because that that is pretty much a common truth. It varies by industry somewhat, but it tends to be one of the biggest, biggest functional spends that a company has after sales and product and support. Then you know, third or fourth on the list is is it, and since a lot of CIOs don’t spend my view enough time really getting immersed in the language of that company, that industry, the challenges that that that company and industry have, it leaves the CIO talking even more at a weird language level than the rest of the C suite, and I see so many times just a huge chasm, and it’s not that either side is wrong, but the one side speaking French and the other side is speaking, you know, Japanese, just good people, right, intense inability to communicate, and that can cause some really bad things, and what one of the bad things that it causes is really up and down cycle ticks in the spending of IT organization, so I, I’ve personally gone through this multiple times in multiple companies. Tim, I know you’ve seen this, but when there’s not that sort of consistency of long-term vision between the CIO, the COO, the CFO, and where the money is going, and the value you tend to get the CEO being worried about, hey, I’m hearing so much about the need for technology, I every other sentence I hear AI, so we’re going to have to invest, so they put more spending in it, but without a clear common view between the CIO and the CEO and the CFO and the rest of the company of how do we really get value out of that, that’s not just about spending more money in it, that’s to get value each of the different parts of the business are going to have to do something differently enabled by new technology to drive the value, and I consistently see companies really struggle with that, you know. Hey, if I put more money in it, then it should just, autumn, the magic should automatically happen, and that’s, you know, that’s always great.
More money is great, but, but more money doesn’t always help if that just, well, doesn’t definitely doesn’t help if that just ratchets up expectations, but there’s no other fundamental business operational changes that are partnered with that new technology, because then you’re just adding, you know, you’re painting your old car really, really pretty color, but it’s still an old car, so I really see many, many, many, many CEOs and boards struggle with that, because there, there’s not that there aren’t that many boards with that technology grounding that grounding, and how do you really drive transformation? And I think that’s a huge opportunity for CIOs that aren’t just traditional, hey, I’ve lived in it all my life kind of CIOs, but ones that have crossed the what we’ll use across the county. Chasm analogy here, but really have crossed the chasm of being able to speak in multiple languages, you know, speak in the technology language, so your IT organization feels comfortable in relating to you, but also very well steeped in being able to talk to the rest of the business in their language about your industry.
Tim Crawford 25:27
This seems like, you know, kind of going back to what you were saying earlier about the gap in conversation between the CIO and the rest of the C suite. This seems like an even bigger gap, but there’s so much more at risk, and at the same time, the board is desperately trying to figure out how do we infuse technology into our strategic initiatives.
Patty Hatter 25:52
Yes, is
Tim Crawford 25:52
this a situation where we potentially run into kind of a mismatch of personalities, a mismatch of capabilities. I guess where I’m going with this is, is this really a foregone conclusion that the CIO should serve on the board? Is it for every CIO, or is there really kind of a criteria or a path that that makes more sense to kind of bridge that gap.
Patty Hatter 26:26
It’s not a foregone conclusion. I would, I would, I would position it a bit of a different way. Instead of saying it’s CIOs, it’s people, whether they’re, you know, they come with the title of CIO or have been in C-suite functions in other parts of the business, but what I see boards really struggling with that the essence of what they’re trying to do is how do you be more successful in driving technology enabled change. Now that’s a real opportunity for CIOs that that are able to sit on both sides of the both sides of that ledger, so to speak, you know, on the technology side with IT and on the business side, but what boards really need is somebody who can help be that translator for both, and I think maybe as we wrap up here, I think that’s such an opportunity for for CIOs, but CIOs need to be exercising other muscles to get there,
Tim Crawford 27:42
so before we wrap, I want to ask you about at least one other topic, and I would be remiss not to ask you about this, and it’s a topic that comes up amongst boards, amongst the C suite. It seems like a daily issue that we have to contend with at this stage, and that’s cybersecurity. What
is
your perspective in terms of where cybersecurity should sit in the conversation amongst boards, amongst the C suite, amongst the CIO? How should we be thinking about it? How should we be engaging in that conversation?
Patty Hatter 28:21
Well, if maybe I’ll use this analogy. If boards don’t understand CIOs very well, they really do not understand, cannot relate to CSOs, and you know it gets back to what, what common background, what common experiences do people have that they can figure out? Okay, I understand what you’re talking about. This makes sense to me, because I had this experience. I can relate that. If you haven’t had, say, you’re a CEO, you’re on a board, and you’re, you’re operating role as the CEO of a retail company, and, and you grew up on the retail side, not on the technology side. You’re just not going to have a lot of experience of what is this cyber security thing, what does it really mean? How does it relate to my overall organization? Can’t, can’t it just fix this, you know? Can’t they just buy one more cybersecurity product and fix this? And so, getting everybody to have a shared set of experiences that they can relate to what the others saying is tough, and especially in cybersecurity, I see, I see that very frequently, because it is – it’s one of the toughest areas for people to deal with, because it’s not just about the technology you use. Yes, but it’s the ongoing education for all your employees of of what they’re clicking on, being aware of phishing attacks. What about insider threats? It’s, it’s a personnel issue, it’s a training issue, and a pretty complex technology issue, and what I’ve seen at boards, and you know, from my McAfee days, I spoke to a lot of boards about this. You literally would see people’s eyes roll up in the back of their heads, because they just couldn’t, couldn’t, nor did they want to, you know, deal with this, because they just didn’t have anything to relate it to in their prior experiences, so that you know, again, that’s an opportunity. Every challenge is an opportunity in here, that’s an opportunity for the CIOs and CISOs to kind of calmly, in language that relates to those board members over time build that muscle of, okay, what does this mean? What do these threats mean? You know, how is it the combination of employee training, insider threats, technology, and, you know, all the. you know, there’s a new interesting cybersecurity startup that starts every five minutes. How does that really fit in? Because the board members see that, you know, all these pushes from all these new technology companies, but just don’t know how, don’t have a good framework of how to relate that, so you know, using using the committee structures in the board, like the risk committee, is a great place for CIOs and CSOs to, you know, start working with their board members to help build up that, that common base of understanding, because that’ll be the thing that a connects them on, hey, we’re all looking at this problem in the same way, and also helps the board make better decisions.
Tim Crawford 32:06
There’s
Patty Hatter 32:08
over time,
Tim Crawford 32:08
there is so much to unpack right there, and the one thing I would underscore is it’s complicated. All of this is complicated, and it’s getting more complicated as we go through time. One of the things I often hear from executive teams is that they’re just completely overwhelmed, kind of, you’re to your point, there’s a new security startup every five minutes. This is a rhetorical question, not a question to be answered, but how do you keep on top of that? And that’s cybersecurity is just one of many aspects that you have to contend with, right.
Patty Hatter 32:44
Well, and that that relates a bit to what I’m doing now, because I’m working with, and I’m an advisor to multiple tech startups, and a number of those are in the cyber security space. So, I feel like I, you know, a certain way, I’m talking out of both sides of my mouth, like there are too many companies, too many pieces, but some of this technology is very cool, and what I think, again, this is a huge role for CIOs and CISOs, is to parse through all the chatter and help build kind of this high level mental architecture that you can keep yourself and your IT team on glued together on a page, so you’re not just chasing a bunch of silver bullets, but you really have a have a have a sense of what’s going to be most important for your organization, but then on the on the other sort of startup side there there are so many new interesting technologies out there and that’s the opportunity for for CIOs to figure out where is the value be willing to take some risks understand where the, where the value is that you can drive for your organization, both in the near term and in the longer term, but don’t forget about the near term, because nobody you know, no CEO has patience for something that you know they’ll see benefit for two years out if they’re not seeing any benefit along the way, and really embrace some of the early stage companies that are out there, don’t spend 100% of your time there, but consciously balance out keeping your finger on the pulse of some of these new new organizations that are coming out, and the more you think about the technology landscape that you’ve built that that it manages as well as you know what’s out there managed by other other organizations in your company, and you’re more able to plug things in because you are you’re coming to the table with a clear view of your. Architecture, and what would be easy to do, what would be a little harder to do. That’s the unique value add that it can bring to the table, but it means you’ve got to do the hard work on the architecture, you’ve got to have a longer term view, you’ve got to be driving near term benefits, and you have to be able to speak the language of every function and product team in your company, and it’s, it’s a lot to ask for one person sitting at the, as the CIO, and for them to try to build that DNA into their, into their teams, but that’s really the, the opportunity going forward, and I personally think it’s, it’s, it’s really exciting, and the pace is only going to pick up, so I think there’s a real opportunity for, for CIOs to add even more value and help show the way in an increasingly complex technology landscape.
Tim Crawford 36:02
Yeah, this is, you know, many have said it before me, but I still strongly believe this is the best time to be a CIO.
Patty Hatter 36:12
I completely agree. Completely agree.
Tim Crawford 36:15
Yeah, Patty, thank you so much. This has been an incredible conversation. I always value the time that I get with you, and I always learn something new from our conversations, and I very much appreciate the time that you’ve, you’ve given to the podcast. Thank you.
Patty Hatter 36:34
My pleasure. My pleasure. Thank you.
Tim Crawford 36:36
Well, I’m going to close it up here, and thank you again, and hopefully you’ll come back and join us, and maybe we can unpack a couple of these aspects that that we just kind of glanced over in this short period of time.
Patty Hatter 36:50
Sounds good.
Tim Crawford 36:52
All right, thank you again.
Patty Hatter 36:54
Thanks
Tim Crawford 36:56
for more information on the CIO In The Know podcast series. Visit us online at CIOitk.com or you can find us on iTunes, Google Play, Stitcher, and SoundCloud. Don’t forget to subscribe, and thank you for listening.
Unknown Speaker 37:10
Thank.
Discover more from AVOA
Subscribe to get the latest posts sent to your email.