20MinuteLeaders

Michael Matias

20MinuteLeaders features the world's prominent leaders for short conversations about their journeys and insights.

  1. 5d ago

    The Psychology of Security: A Conversation with Gary S. Chan, CISO of SSM Health

    Most conversations about cybersecurity revolve around systems: networks, endpoints, vulnerabilities, the latest tool. My conversation with Gary S. Chan revolved around something harder to patch: the human mind. Chan is Chief Information Security Officer of SSM Health, a nonprofit healthcare organization with 50,000 team members. He is also a trained interrogator and performing mentalist. To him, these are the same discipline seen from different angles. Chan studied electrical engineering and computer science at MIT, worked in IT consulting, and moved into identity fraud prevention, where the adversary is often someone pretending to be someone else. Along the way, he trained as an interrogator. Today he leads security for a major health system, though he made clear he spoke with me personally, not on behalf of his employer. Each step reinforced his belief that security is ultimately about people. The name tying it all together came almost by accident. At his wife’s work dinner party, Chan introduced himself to some guests as a security specialist and to others as a mentalist. Neither description drew much interest. Later, two guests compared notes and asked which one he really was. Rather than choose, Chan combined the two on the spot: “Security Mentalist.” The mood changed instantly. Everyone wanted to know what a Security Mentalist did. Chan spent the next half hour telling hacker stories, and the lesson stayed with him: the same facts, framed differently, can move an audience from indifference to fascination. He now has a trademark pending on Security Mentalism®. That instinct for framing sits at the core of his philosophy. Chan argues that the human element is the most critical and overlooked layer in security. From interrogation, he draws on managing “headspace”: people have limited cognitive capacity, and how that capacity is loaded shapes what they reveal. Mentalism helps him understand how attention and suggestion guide decisions. Game theory provides a framework for anticipating others’ actions. Together, these ideas help him defend an organization and navigate it. As a Security Mentalist and keynote speaker, Chan shows audiences how social engineering and hidden influence can exploit even smart people and secure systems. The toolkit has real-world stakes. Chan described a job applicant with an impressive resume who passed a technical interview and convinced the hiring manager. Chan examined the resume and LinkedIn profile again. He wasn't scanning for keywords. He was looking for psychological and narrative inconsistencies, places where the story didn't hold together. He discovered the candidate was fake before the company made a bad hire. As polished credentials and confident interviews become easier to manufacture, reading the story behind a resume is a security skill in its own right. Partway through our conversation, Chan demonstrated his point with a deck of cards. He spread the cards across the table, placing a duplicate of one card face down to the side before asking me to choose any card. He even let me change my mind. I chose the Three of Spades. It matched the card that had been sitting face down in full view the entire time. The moment captured what he'd been describing: attention, framing, and influence can shape a decision someone believes is entirely their own. Listening to Chan makes one thing clear. The attack surface that matters most isn't purely technical. Fraudsters exploit narratives, employees resist change, and executives respond to stories more readily than specifications. Security leaders who understand psychology as deeply as technology can better protect their organizations and move them forward. Chan has built his career and stage persona around that idea. Learn more about Gary S. Chan and security mentalism at https://www.securitymentalist.com. Follow him on YouTube at https://www.youtube.com/@SecurityMentalist.

    The Psychology of Security: A Conversation with Gary S. Chan, CISO of SSM Health
  2. 09/14/2025

    AI & the Fifth Domain of Warfare: A Talk with Eyal Balicer, Cybersecurity Innovator & Thought Leader

    By Michael Matias, CEO of Clarity and Forbes 30 Under 30 alumCybersecurity has entered a new domain—literally. As Eyal Balicer put it in our recent conversation: “Cyberspace is now the fifth domain of warfare.” But in this domain, the battleground isn’t just code. It’s control.Eyal brings a rare vantage point to the AI-cyber nexus—he’s held senior cybersecurity roles in the Israeli government, Fortune 100 companies like Citi, and top-tier venture capital. Our discussion centered on a growing truth: with the rise of agentic systems—AI entities that can act, decide, and evolve—the mission of cybersecurity is changing.“We are shifting from a world where intelligence was a scarce resource to one where that is not necessarily the case; true agency is becoming the new elusive driver of prosperity and growth,” Eyal explained. “The systems we are now securing are not just automated—they are autonomous, highly competent, and opaque. Traditional defenses cannot keep up.”It’s a shift I’ve seen firsthand at Clarity, where we build proactive defenses against deepfakes and AI-generated phishing. Just like Shahar Peled told me about agentic AI revolutionizing offensive testing, Eyal sees these agents redefining global threat models. The challenge isn’t identifying known threats—it’s safeguarding systems that learn, adapt, and act independently.And that requires a new security architecture.“An AI agent can have fluid permissions, context-based roles, and evolving identity,” he told me. “Conventional IAM just does not cut it anymore.” In that sense, Balicer echoes voices like Ron Nissim and Alon Jackson, who both called for a redefinition of identity management in the AI age.But Eyal's view goes broader: geopolitical. He sees cybersecurity not just as a business enabler, but as a pillar of national resilience. From financial systems to defense infrastructure, the stakes have never been higher. “The future will require autonomous cybersecurity—not just automated, pre-defined playbooks, but real-time, adaptive agents who reason and defend at the edge, with varying degrees of human intervention.”We discussed how the regulatory map only adds to the complexity. “The fragmentation across jurisdictions makes cross-border cybersecurity brittle,” Eyal warned. His point was clear: the only viable strategy is proactive, agentic, adaptable security. Not static controls. Not red-alert dashboards.The recent acquisition of Wiz by Google, he said, is just the beginning. “This will eventually lead to an entrepreneurial Cambrian explosion in cybersecurity,” Eyal predicted. And much like Dorit Dor told me, the organizations that survive will be those that move fast—and let AI lead the charge.As we closed, his advice was blunt: “Ignoring this revolution is not an option. AI evolves daily. Your security safeguards and controls should not lag behind.”My takeaway? Eyal isn’t just talking about new tools—he’s laying out a new doctrine.Agentic AI isn’t coming. It’s here. And if we don’t secure it now, we risk losing control of the systems that already make decisions for us.The future of cyber isn’t just proactive. It’s autonomous. And it’s already reshaping the balance of power.

    AI & the Fifth Domain of Warfare: A Talk with Eyal Balicer, Cybersecurity Innovator & Thought Leader
5
out of 5
11 Ratings

About

20MinuteLeaders features the world's prominent leaders for short conversations about their journeys and insights.