[00:00:03:15–00:00:30:09]

Navroop Mitter:
Hello, this is Navroop Mitter, founder of ArmorText. I’m delighted to welcome you to this episode of The Lock & Key Lounge, where we bring you the smartest minds from legal, government, tech, and critical infrastructure to talk about groundbreaking ideas that you can apply now to strengthen your cybersecurity program and collectively keep us all safer. You can find all of our podcasts on our site, armortext.com, and listen to them on your favorite streaming channels. Be sure to give us feedback.

[00:00:40:04–00:01:01:01]

Matt Calligan:
Hey, and welcome to The Lock & Key Lounge podcast. I am Matt Calligan, your host for today’s show, and I am delighted to welcome Brian Layer and Erik Oksala to the podcast. Brian and Erik, welcome to the show. 

Brian Layer:
Thank you.

[00:00:54:00–00:00:55:20]

Erik Oksala:
Thanks for having us. Thanks, Matt.

Matt:
Absolutely, absolutely. And Brian, did I say your last name right?

Brian:
Yep. Just like a cake.

[00:01:01:03–00:02:12:18]

Matt:
Alright. Nice. I always tell people when we’re like in—I’m in a loud room, and they ask me what my name is. I say, “Matt, like a skinny rug,” so I get you. So, for folks listening, today’s topic is about reinvigorating tabletop exercises. Traditional tabletops have a reputation for being kind of box-check exercises, a little dry, stale slides, and predictable scripted injects that we’ve done a million times, facilitators who maybe really aren’t engaging.

What if we could change that? That’s today’s question. What if tabletop exercises felt like actual high-stakes crisis simulations, where things are dynamic and unfolding in a story-like format and engaging folks in ways that actually is—create something that’s memorable and actionable? 

And that’s really what we want to explore with Erik and Brian at RL leaders today. Erik and Brian work for a company named RL leaders, which brings Hollywood-style, immersive storytelling to national security exercises. And they’ve been doing this for over two decades now or close to it as—if I’m right there.

Erik:
Absolutely.

[00:02:13:00–00:04:10:04]

Matt:
Now, they’re bringing that expertise to the private sector. And we’re going to talk about why Hollywood-style production value and narrative arcs actually matter to the real world—how—and how they’ve successfully used these techniques in the Intelligence Community and DoD, and what’s next for executive tabletop exercises and this unique approach that they have. 

And actually, to prove that, we’re going to put our money where our mouth is. Here, we are going to take a real tabletop module from our Cyber Resilience guides that we published with Crowell & Moring every couple—I think it’s biannually right now. And we’re going to ask Brian and Erik to reimagine this and really show us firsthand how better storytelling can make that difference. 

First, let me introduce our guests very quickly. Brian Layer is a partner and CEO at RL Leaders. He is an advisor in national security, executive leadership, organizational excellence, and innovation.

He’s a retired Army Brigadier General, served in a variety of leadership assignments culminating as the Army Chief of Transportation. He commanded organizations in the 5th Special Forces Group (Airborne), 101st Airborne Division—which is Air Assault—and the 3rd Infantry Division. Brian graduated from the United States Military Academy at West Point and has advanced degrees from Michigan State University, the Army School of Advanced Military Service, and the Eisenhower School at the National Defense University.

Erik Oksala is Partner and President of RL Leaders, and in more—in his more than 20 years in and around Washington, DC, Erik has been involved in federal government contracting, campaigns, state government issues, nonprofit coalition building, and government affairs client representation. As the President of RL Leaders, Erik  leads an organization that serves as the nexus between US national security community and the entertainment industry.

[00:04:10:05–00:04:54:11]

Matt:
So, let’s go ahead and start here with segment one, and that is why storytelling and production value matter in tabletop exercises. So, the question I will pose to both of you—and however you guys want to answer this, tag team or insert your own thoughts—traditional tabletop exercises. They often focus on technical and procedural accuracy. We always joke that it’s the geeks in the basement, and it seem like that a lot of times from executive leadership. It’s just, “Oh, let them have their little war game.” 

From your perspective, and with the years you’ve been doing this, why do you believe narrative arc and immersion are just as important for executive-focused exercises?

[00:04:54:11–00:06:42:22]

Erik:

I’ll take that, Brian. Matt, that—first of all—that—thanks for having us on. This is—it’s great—

Matt:

—Yeah.

Erik:

—to share a little bit about the work that we do and the—we’ve brought to the national security world and may—how it may be applicable to some of the work that you guys do. For us, everything that we do starts with narrative and storytelling, and how you communicate ideas and coming up with emotionally compelling content reinforces learning objectives.

And you talk about—you think and—think about your favorite piece of music, piece of art. It’s stuck with you because it created that emotional connection. And having narrative and scenarios that were really underpinned by compelling storylines will make the learning more effective. And so, for us, we—whether it’s—whether we’re building simulators or hard custom hardware or software or doing some deep blue sky thinking for DARPA—everything we do starts with creating that narrative.

And if you can get people emotionally engaged in the content, it’s going to stick with them better.

Matt:
Yeah. Yeah, it’s—what I found from my side in—is—it’s been almost a decade in cybersecurity, the ability to engage with that emotional side. And we all have that. It’s not that some humans don’t and others do, it’s just that some are more comfortable communicating in technical aspects and the more analytical side versus that emotional side.

But we all, as humans, connect emotionally with things. And those are the things that are most memorable to us—smells, sounds, whatever. And there’s always a story, even we—stories we tell ourselves about these experiences. And that’s what makes them memorable.

[00:06:42:22–00:07:09:06]

Erik:
Absolutely. And in a crisis environment, being able to—something you’ve rehearsed before—if it—if your muscle memory is, “Let’s do—let’s go right to this solution,” having that compelling narrative that you—that you’ve trained on will help you get right to that solution set.

Matt:
Yeah. Yeah— 

Brian:

—It…

Matt:

—absolutely. Go ahead, Brian.

[00:07:09:10–00:08:09:00]

Brian:

If I could—could I add a—another thought that there’s a lot of competition for the focus of an executive. And chances are, when they walk into the tabletop exercise, they’ve got other things that are more important to them that are taking their mental energy—

Matt:

—On fire.

Brian:

‘Cause if you can do something that jumps straight to their amygdala—

Matt:

—Yeah.

Brian:

—it gets them emotionally interested and focused on the exercise at hand. You get better performance out of them and better thinking, and that’s certainly not a dig at executives. It’s just a description of the demands for their time and their—

Matt:

—Right. 

Brian:

—and their focus. So, what we always do is we try to respect that by giving them something that they can’t step away from.

Matt:

Yeah.

Brian:

We’re going to have their time. Let’s make the most of it.

[00:08:09:01–00:10:35:14]

Matt:
Absolutely. What are some of these lessons you all have learned? As you’ve worked with DoD and the Intelligence Community and in crafting these immersive crisis scenarios, I would imagine—you’re from the government side—the folks that come into these rooms are pretty cut-and-dry folks. So how—what are some experiences and lessons you’ve learned from how to bring those kinds of folks in?

Erik:
Well, it’s—and you’re right, there’s always a little bit of healthy skepticism on how we—our secret sauces. We have this network of hundreds of creative arts professionals—writers, producers, directors, actors, people in video games, costuming, hair, and makeup—all aspects of the entertainment industry. We can bring to bear to a variety of different national security projects.

And there’s always a little bit of skepticism from the government side, saying, “I’m not quite sure how these creative folks are going to help me in my day job,” and maybe even a little bit of uncertainty from the creatives on how their skill sets will sort of translate into these real-world national security challenges that are very much outside their daily life of creating various pieces of arts and entertainment.

And so, what we do is we look to bring those two perspectives together and structure in the engagements in a way that leans into sort of both of their skill sets in the subject matter expertise. They can really bring the realism to these scenarios. But then, also, we bring in the creatives to sort of challenge assumptions and find ways to think about problems from a different perspective.

So much of what we do is bring this alternative creative perspective to these challenges and really try to set up ways for the subject matter experts to be sort of taken out of their environments. And that’s one of our lessons learned is if you can get people out of their routines, ideally on a TDY to some not—area that’s not where they normally work.

Matt:

Right.

Erik:

Get them in a spot where they can really focus on the scenario. It’ll unlocks that creative sort of area in their workflow. 

[00:10:35:14–00:11:46:12]

Brian:
Yeah. And ultimately, what we try to do is kind of create a social movement, if you will. So, rather than them thinking about, “Okay, I’ve gotta use my time now to think through this intellectual process,” what you try to do is connect it to where they’re trying to get to. 

Matt:
Right. 

Brian:
So it’s a part of their pursuit of excellence. And you’ve got to make the case that this time that you’re spending doing this thing is the most important thing you could do right now to get better. And so, you make that case. It starts out with kind of understanding why we’re doing it, but then it moves into, “Now I understand it so well. The story is so tight that I can tell it to others, and they’ll be moved to action.”

Brian:

And that’s what we—

Matt:
—Which is critical.

Brian:
—that’s what we try to do. And that’s why we try to build around narrative so strongly, because it is wired in us to follow a story, to remember a story, and then to retell it. 

[00:11:46:14–00:12:20:01]

Matt:
Yeah. When—Brian, I remember you made an interesting comment the other day when we were talking about not just dive, again, not just diving into the details, but also, who are the actors in this? And you talked about making the villains real and making the good guys real. 

Give me some more examples of that. I thought that was such a fascinating topic or concept that—and nobody ever thinks about making the adversaries real. It’s always Salt Typhoon or APT29. Talk a little bit about that.

[00:12:20:04–00:15:12:02]

Brian:
Yeah. Thanks. Most exercises start with an inciting incident. Something happens, and you’ve got to work from that. But the truth is that your adversary, whether they’re trying to disrupt your network or whether they’re trying to attack you in a military sense, they’re thinking in parallel about how to defeat you. They have motivations and goals and emotions just like you do.

And so, one of the things that our writers in particular are great at in their stories is bringing life to the villain. And so, you all of a sudden, you don’t think of this as just a problem, but you think of it as a competition. And again, in competition, we’re driven as humans to compete and to win.

And so, that’s the energy. It brings a different level of energy to the room that you want to somehow bring to your exercise, because that energy is what moves you to get better. And so, we try to build on that—the story of the villain. So, you’d maybe can understand their thinking. But the other thing they do is that their stories are not point-counterpoint, the dialectic. Their stories are complex mixes of individual actions and stories and events.

And so, when we try to put this all together, we try to put that whole tapestry together, if you will. So, you recognize that if I solve this next problem, I’m not done forever. There’s a chance that this adversary—because they’re smart, or because they’re evil, or because they’re motivated by something that we maybe understand better because we’ve built that into the story—they’re going to try to act to beat me. And so, getting to the next step is not enough. I’ve got to keep climbing because this adversary, if I don’t put them down or put them away, they’re going to keep competing with me. 

So, that’s why we almost always start with the bad guy when we’re building a story, because if they—if they’re not a fully developed character, then there’s no reason for us to give our full effort against them. 

[00:15:12:02–00:16:05:05]

Matt:

Right.

Brian:

So, that’s the—that’s one of the big lessons that we’ve learned from the writers in the entertainment industry is that they recognize that if a villain isn’t worth defeating, people are not going to be excited—

Matt:

—Nobody cares. 

Brian: 

Exactly.

Matt:
This reminds me of—oh, no, never mind. I’m not going to go down that rabbit hole. So with this—these kind of Hollywood-style tabletop exercises, when you’re doing something for government agencies and providing a value, it’s a different model than in the private sector.

There’s different motivations, right? Government is—the primary motivation is to demonstrate they’ve done everything they could for a certain thing. Whereas private industry, a lot of times, it—there’s the balance of profitability. It’s like, “Well, we could have done that, but then we would have blown through our budget.” So, as you all look to expand from the government and federal into private sector, how do you envision adapting this approach for these executives and other industries and stuff?

[00:16:05:07–00:17:31:15]

Erik:
Yeah. So, what I think we can bring is—and it doesn’t have to scale at the same way that we do it for government—but be able to bring a targeted group of creatives to address the scenario. And really, if you can make a compelling scenario and then it becomes a repeatable exercise, I think that with a little bit of additional perspectives from external facilitation, you can get to costs savings versus when we’re doing things for government.

There’s a little bit of a different structure in that sometimes we’re having to do training alongside of demonstrating a capability. 

Matt:

Right.

Erik:

And so, being able to bring in sort of a smaller team focused around a very specific topic—often within government—we’re looking at a whole host of possibilities, kind of to your point of “We looked at everything.”

Well, I think some of the things that we’ve talked about and some of the scenarios that you guys have have worked on, that you were able to share with us, have a very specific focus. And so, we can bring a smaller team to that effort. I know, Brian, you were thinking a little bit about the sort of technology and ways that we can leverage different opportunities that are emerging. Do you want to expand on that?

[00:17:31:17–00:18:34:22]

Brian:
Yeah, sure. Ten years ago, it would have been—it wouldn’t have been cost-effective to try to bring Hollywood-like tools to an exercise unless somebody had just a lot of money to make the greatest exercise ever. Which—the point is not to do that. The point is to compress learning. Time is the most valuable resource for any organization.

And leadership is probably the most demanded skill in any organization. So, if you can compress leadership learning and use your exercise as a tool, then you’re ahead of the game. But the Hollywood-like tools that make you learn faster, remember stronger—just like you can’t be un—you can’t unread a book you’ve read.

There’s things you’ve seen and felt that you can’t unsee and unfeel.

Matt:
Just always remember. Yeah.

[00:18:35:00–00:20:31:16]

Brian:
And so, some of these Hollywood tools are—they’re cheat codes to get to your emotions, and sound and video are two of those cheat codes that they use. And those tools would have been very expensive ten years ago. But with the fast advance in technology—and this is a $3 trillion industry annually, the global entertainment industry—there’s a lot of innovation that’s going on there.

And so, these tools are getting cheaper and cheaper to make convincing video, sound. So, you can bring those to an exercise at a cost point that would have been unthinkable just a decade ago. 

Matt:

Yeah.

Brian:

And the tools aren’t that hard to use. They don’t take a tremendous amount of expertise. But certainly, our network—we can help teach people how to use them in such a way that they can apply them to an exercise and just give it some power it didn’t have otherwise. And that—we always talk to our clients about, “Our goal is not just to teach you in the time that we’re with you. Our goal is to give you lessons that will apply to your next set of problems that come along.” And so, these are—again, you can’t unlearn what you’ve learned.

The point is to make the exercise valuable enough and interesting enough that it’s not just discarded when you walk out of the room. And that’s what we would try to do by adding those visual, sound, and narrative construction that just makes it a much more powerful event to be a part of.

[00:20:31:16–00:22:33:18]

Matt:
Something more immersive. Yeah. With—from your perspective, coming into this—what are you seeing so for the private sector organizations get wrong when they’re doing tabletop exercises?

Erik:
I think, a little bit, we’ve touched on the narrative—having a scenario that grabs you and really gets to the emotional, compelling, emotionally compelling beats of the scenario. I think that’s definitely an area that can be improved upon. Also, the lack of complexity when it comes to—it seems like some of these scenarios that we’ve seen are very sort of linear. And maybe being able to bring in a little more variability and complexity, and maybe there’s—without giving away sort of how we might look at something here shortly—different aspects. Whether, while you’re handling a sort of primary scenario, what are other things that would be happening in real life—

Matt:

—Yeah.

Erik:

—that would complicate things, and not in a melodramatic “suddenly you have to deal with aliens and dinosaurs.” It’s not that, but just—someone’s car breaks down, or they have to go pick up their wife and take her to the doctor’s app—so someone’s out of comms during a crisis. For a— 

Matt:

—Yeah.

Erik:

—completely normal reason, and having to deal with that. Or even something more complex where the—like a couple of years ago when the AT&T network went down—so those people that you’re—a part of your team that are on that sort of backup plan—are not reachable. And so, you’re having to scramble. Those sort of things that are not extra Hollywood dramatic, but just mundane enough, but still a very much a complicating factor being able— 

Matt:

—Plausible. 

Erik:

—to work those in. Yeah.

[00:22:33:20–00:23:48:19]

Matt:
Yeah. Well, and even—I know that a lot of cy—obviously, with ArmorText, a lot of our clients are cyber professionals of various stripes. And one of their biggest concerns is the fact that the— they’re not—the exercises they run aren’t anticipating or integrating physical events. It’s all just technology and the IT side of the house, and they’re the—maybe the OT guys or the physical security folks are doing their own thing.

But there isn’t an integration, and there isn’t a recognition of how easy it would be to time a physical—I mean, you’re talking about just life-gets-in-the-way kind of stuff. But there’s also a real-world and growing likelihood—and not even likelihood—but reality where adversaries on the cyber side are timing attacks with either physical events themselves, like a hurricane or an earthquake, or they’re even simu—generating a physical event, like pot shots at a substation with a gun or something.

So, talk a little bit about some of those—the—from your experience, how have you brought those two dynamics together in these kinds of events?

[00:23:48:21–00:25:06:04]

Erik:
Absolutely. It’s leaning on our creative team, or generally, as Brian mentioned, writers who do this for a living within the entertainment world. But think about something where you’ve got an ice storm that’s knocking down power lines. Well, if that happens and an adversary uses that to then decide to launch an attack? And they’ve been part—they’ve been—they’ve exposed the vulnerability previously, and it’s waiting for the right time.

Well, now you’ve got something like that where it’s going to be difficult to restore the connectivity of power, but also, it’ll complicate getting physically—just getting people together to try to address the scenario and the—

Matt:
—Or executing or whatever. Yeah.

Erik:
Because everyone—you’re dealing with—you’re slow to get to where you need to be ‘cause of the ice storm, and/or you’re stuck in a remote area, and everyone has to then figure out how to convene through different channels.

Matt:
Yeah, yeah. And if this is an actual reportable event, you’ve got a shot clock running in the background.

Erik:

Right.

[00:25:06:08–00:29:15:19]

Brian:
Yeah, and I think you want to—your tabletop exercise to be of the sort that it’s tougher and full of more obstacles than you’d ever expect to get in real life, because it’s difficult to imagine what you might get in real life and how it would affect you. You get an attack on the day that the IT department’s getting new carpeting, and everybody is spread all over the place, and they’re not together, and they can’t coordinate a response.

And it’s just harder. So then, the next time when it really happens and they’re not getting new carpet, it feels easier. 

Matt:

Yeah. 

Brian:

And that’s one of the things that I think that I’ve learned in the military—is that every exercise is part of this continuum of improvement. No exercise is kind of left behind saying, “Okay, we’ve checked that block, what’s the next thing?”

They look at it, they see, “What did we learn that’s going to change a plan, a policy, or a procedure?” And they make those changes. And so they—again—they’re one step closer to better than when they came in. And so, I think that’s what you want to you do on the corporate side.

But you also want that scenario. There’s an old writing saying that you never put a weapon on the mantle unless somebody is going to shoot it. And so, everything that you write into your scenario, you want to somehow have to affect the environment, or the obstacles, or the story of how do we get back to normal and come out better on the other end.

And that’s a very difficult thing to do. And that’s why the development of that narrative on the front end of the scenario is so important, because then it gives you options to throw in new obstacles, to hurl a couple grenades, and to throw in a hurricane, to have somebody’s car break down, or somebody getting married that day, or whatever it might be that happens in real life that affects your ability to respond to true threats.

We did an exercise a couple of years ago where we were working with a nonprofit, and it rolled into a look at how you would destroy a brand. And they were concerned that their clients would have their brand destroyed. And what we learned is—they’ve put some writers in a room and asked them to figure out a way to do it. It’s not hard. 

Matt:

Wow. 

Brian:

And so, we—that shaped our thinking about how we approach these exercises moving forward because we learned that reputations are fragile things. 

Matt:

Right.

Brian:

And so, while you’re dealing with this ransomware attack, there may be that evil villain that we’ve described—may be trying to do something more nefarious, like destroy your brand.

And the ransomware attack is just a diversion. And so, that—we try to put as much pressure as we can into the scenario and give as many options. You don’t want to overwhelm the training audience, but on the other hand, you don’t want to miss an opportunity for learning if they’re capable of taking it.

Matt:

Yeah.

Brian:

And so, you try to create all of that on the front end so you have options in—inside the exercise.

[00:29:15:21–00:29:45:06]

Matt:
Yeah. Yeah.

You’ve reached the end of the episode, but not the end of the conversation we had with Brian and Eric at RL leaders. Next episode, we take the conversation into the real world, where we do a live tabletop inject and let Brian and Eric take it apart to show us how they make their exercises more realistic and effective. Using Hollywood style techniques, you could use tomorrow to keep your organization better prepared for the next incident.

[00:52:53:05–00:53:14:19]

Matt:
We really hope you enjoyed this episode of The Lock & Key Lounge. 

If you’re a cybersecurity expert or you have a unique insight or point of view on the topic—and we know you do—we’d love to hear from you. Please email us at lounge@armortext.com or our website, armortext.com/podcast. I’m Matt Calligan, Director of Revenue Operations here at ArmorText, inviting you back here next time, where you’ll get live, unenciphered, unfiltered, stirred—never shaken—insights into the latest cybersecurity concepts.