EP 28 — National Bank's Andre Boucher on Managing AI without Shadow IT Friction

Hey,

everyone, and thank you for listening to another episode of The Future of Data Security. Today, we're lucky to have André Boucher, CISO at the National Bank of Canada. André, thank you so much for joining me today. Thanks, Jean, for having me. It's a pleasure to be here. And we've been talking about this interview for a while. You are CISO at National Bank, soon to be CTO, starting in January.

Absolutely. It's a great honor to have the trust of the company. National Bank is a very dynamic organization, so happy to do another transformation.

Very exciting. You have a rich background in the Canadian Forces, NORAD, the Canadian Security Establishment. And I was really curious about that transition from this militaristic intelligence world into the world of financial services and national bank. What can you tell us about your background and how that transition happened?

I

see my career as having really three big parts. I was a technology officer for the first third of my career.

Technology

officer means understanding the technical environment and being able to communicate it, to shape it, to be an actor in that space. Then my middle third career was really about people, leadership, increasingly larger organizations, leadership of larger teams in different contexts. And I was still in the military, so different national contexts, international contexts, seeing the strength of working with allies and the challenges of working with allies. I think this prepared me well for the third chapter. And about 20 years ago, I became the commanding officer of the

cyber

forces, the Canadian forces, cyber forces, which was called something else. And it was, for me, the realization that this was the junction of technology and humans,

and

I fell in love with the idea of being a cyber person and made it my career focus. So the next 20 years is me making coherent decisions about my future

to

be a leader in technology, in cyber security. And when it came time to leave the military, I did this in national security of the government of Canada, did that for a few years, helped create the Canadian Centre for Cyber Security.

And

from there,

it was

a natural path for me to go to private sector and where the cyber centre was trying to help private sector to be at the receiving end of that conversation, which brought me to National Bank.

So

it's almost like you were part of a transition in both

the

CST with its vision to do more outreach with industry and ultimately yourself

being

cast in a key role. I

am really

eating

my own pudding, but it creates this relationship where you can actually provide feedback on what and how we could actually work better together, because we all know that cyber security is something that you do hand in hand, not once against the other.

And as you went through that transition,

was

it actually coming from one side of the equation, you know, intelligence, security, cyber command type of affair to the private sector? Was it hand on heart how you thought it was going to be?

I

certainly had no idea of the complexity of private sector. There's a naive perspective when you're in government, at least I had a naive perspective in government, maybe,

of

how private sector is all about

the

bottom line, quick decision making. We understand what we have precisely and we can make investments over investments because it's sharp, it's quick.

But

I joined the bank, a bank is tens of thousands of employees, it has governance, it has regulatory requirements, it's a fairly complex environment. And I quickly realized that it was perhaps my knowledge in governance that would be, and of course, you know, threat actors and the whole threat landscape.

But

my most important two muscles, probably strategy and governance became the key differentiators in that space.

And talking about that, would you say these were,

you

know, the top lessons or skills that you brought from your military career

to

the private sector?

And it was by accident. It wasn't by design. I didn't know when I left the public sector that the private sector would be looking for this kind of knowledge and experience. But

as

you enter the dynamics of the private sector, you realize,

you

know, the relationship to strategy, the window of strategy is different. We're talking five years, 10 years, two years, one year. Is it really still a strategy? So these conversations are, and they're different from business to business, I believe. Size matters. Regulatory environment matters. So being able to navigate in that, if I go all the way back to my military career, working in NATO, where you have a consensus-based organization versus NORAD, where two partners actually work together to a very clear mandate and mission, totally different governance dynamics. Those are good learnings that can reapply later in private sector.

And what would you say in that transition were the biggest differences and perhaps the most surprising?

The

accountability that I, or the freedom that I get to have as a decision maker in the organization. There's a lot of trust given in the position of chief information security officer. I am absolutely responsible and accountable for the strategy and its execution. And those words sound pretty simple to announce you. But when you're trying to move 31,000 employees in their own behavior and cyber security, suddenly the execution of your strategy takes a whole new direction.

Absolutely. And from the bank's perspective, then, what do you think

is

the strength that you brought to the table that was most surprising to them?

Perhaps the fact that I understand the other side of the conversation, the public sector side of the conversation. We spend a fair amount of time talking to regulators in multiple jurisdictions in Canada and elsewhere. So that ability to see both sides and perhaps have a stronger conversation and be able to start from a point of

closer

to understanding it's never perfect. But I think that

this

was something that perhaps was unexpected at the bank itself. And I think it's become a strength and it's helped us build

the

financial sector works in a concept of three lines of defense. So, you

know,

the actors, the first line of risk with a risk focus and your internal audit, the third line, being able to have a conversation with your external viewers, your regulatory,

and

make these three lines of defense speak a common language to this external body is quite important.

And

maybe a double-clicking on that point

a

little bit, do you have a lot of communications with the communication security establishment, other partners, which are the ones you work most closely with?

The

communication security establishment's baby organization, the Canadian Centre for Cybersecurity, is a key, and I still believe it's a key organization in our ecosystem. But their mandate, of course, is all infrastructures in Canada, not only the financial sector.

So we

don't speak a lot about other bodies, but the Bank of Canada and the Canadian Financial Sector Resiliency Group under Bank of Canada, which is a partnership that is done with private sector, is quite important and probably my second most important organization

when

it comes to managing the bigger IT and cyber risks.

Now,

switching gear to talk about data security and the future of data security,

I'm

really interested to learn what are the hardest data security risks, data privacy risks that you contend with,

and

how is the landscape evolving?

Data

security and data protection is

a big topic. It's one that we talk about very regularly, very often.

It

is not one where we have a lot of

ecosystem

maturity. We approach it in different ways. In recent years, we've had a lot of conversations about privacy. Privacy is one aspect of data security in a subset of data, the private identifiers and key information. Super important, but I think those were the baby steps to understanding the landscape of data and data protection, data discovery, data classification, and all the aspects of data management that are crucial for the overall ecosystem of data management.

I

think as an ecosystem, not only the financial sector, but all large and medium enterprises,

that

is

still

a significant challenge because we don't have a common taxonomy, a common way of talking about it, a common way of structuring it. We go back to reference model, to the NIST model, to other similar models, and we look for these common behaviors, but it is

probably

still at its infancy as far as domain

of

security.

And

how do you balance the need for innovation, momentum, and the AI super cycle we're in

with

risk management and

different

frameworks and demands like OSFI, DORA? Yeah.

Great, complex question. I'll try to tackle it in a couple of ways. So it obviously touches to data and data protection. Data protection data is my new oil, right? It's my source of value. AI is

to

the risk of being a bit controversial. It's just another technology innovation leap forward. Now it's significant. I'm not underestimating how significant it is,

but

when you take a longer term view of the last 30 years, we've been through these major transformations. So I'm choosing to look at AI that way. So I have my data and I need to protect my data. I have this new tool. What does the tool bring that's different from what I had before its arrival? Speed, mass movements,

it's

more autonomous than any tools. It's not a macro. It's more autonomous than any tools we've had before. So you're going to understand what this tool does as different and see what the impact is on your security posture for your data. AI brings

more

of what we've tackled in the past, but at a different speed, at a different, it's an order of magnitude different than what we had before. So we have to react at the same speed.

Of

course, I would be remiss if I didn't speak of that. There's a threat aspect of that, but there's the opportunity aspect of that as well. So we have to understand both sides, find the right balance and make the boast of what's in front of us.

So in other words, it's not a major departure

of

how risk has been handled and

all

the different super cycle is what you're saying. I don't think

so.

I

think where AI

is

new

is

it's the relation of the tool with humans. So everything else is yet another technology. It's in fact a SaaS. So my data is going in and spending a few days of vacation in somebody else's environment. What does that mean? Do I know which data is migrating? What am I doing to protect that data? How am I tackling that? That's something we know how to do, right? What's new about AI is when Jean looks at his tablet and suddenly he's presented with information from an AI tool. If that AI is a visual interface or a voice interface, that we're now unsure which one is human and which one is not.

That

dimension we've never tackled before. Impersonations, but to a point where humans

are

challenged and maybe it's impossible for humans to differentiate. That's a new dimension that we haven't tackled in the past.

And

what do you see as the new risks that Generative AI have introduced specifically?

Well,

that one exactly. So where we used to do a lot of awareness and training and education and making people aware,

it

will only take us so far. At some point, humans, and we're at that point, humans can't differentiate between a synthetic person or a real person on a call. We've had instances now that are published of people participating in a meeting where synthetic actors are around and the only real human is the one that's being defrauded.

When

that starts happening for real and millions of dollars are getting lost in a transaction, you're facing something different.

So

we need to just take a step back and look at, okay, what can we do about this problem? If humans can differentiate,

what

are the tools that are at our disposal that we can put to this environment? And there are a number of tools. It's easy to say, well, we'll use the AI and find a tool that detects the tool. That's one aspect. There are the tools. You can use regulatory frameworks. You can use collaborative ways. I mean, there are other methods of tackling the problem, but it's a problem.

Yeah, it

seems to be like today, AI is introducing a lot of new risks or existing risks that are bigger, higher velocity. I hear a lot of people say, well,

you

know, AI is going to solve that. We'll use AI to monitor AI. That's an interesting thought. We have to jump on it.

I

think

it's true. And maybe the advantage will shift over to the blue team, to the good guys, if we manage to do this, hopefully. But at the end of the day, even if you do this, it's going to take a while because, you

know,

if you've played with AI models, but you can do adversarial AI models and see which one is going to win in the end.

And

when both AI's are learning and getting better and stronger, humans get lost in that battle. We have no chance. I've seen one in the past make a cat and differentiate between a real cat and a false cat in pictures. And both, you know, quickly became so good at what they were

doing

at each other, the two AIs at each other. The human watching the match, no idea. It all looked like cats. They were all cats. So will AI be the tool to do this? Or, for instance, should we mandate that anything that's generated by LLMs or AIs has to have a watermark of some sort or some sort of digital code that is detectable by a detection tool? Maybe. Maybe it becomes a regulatory answer to a problem.

I don't

know yet.

What's your view on shadow AI? And obviously every consumer nowadays has access to

amazing

top shelf systems on their phone, on their computers. Obviously, that's going to breed an expectation at work,

which

if tools are not there, people might use whatever they

have, right? Shadow IT, as you know so well. Shadow IT has been

a

challenge forever.

We just changed the letter?

Well, this

is a nicer, more attractive, more appealing tool, more difficult to resist, but it's the same problem. So if my organizations, key players, understand the risks of doing it, that it would be an AI or any other tool. Shadow tool is a bad idea. It creates blind spots to the organization's defense. So you need to tackle it. Now, do you tackle it only with detection and prevention or do you tackle it by making people aware and accountable and then making sure your team is part of your solution, team is part of your security team?

What

would be sort of the top three

pieces

of advice to think about, tackle shadow AI, maybe for other CISOs listening?

For

CISOs, get out there, talk to your business lines, talk to the people that are actually doing, making your business successful. Make them aware that those decisions they make on the ground will have a direct impact or potential disastrous impact on the business that they want to grow. I think it starts there. You cannot, in a world that changes so fast, I often say at the bank that there are 31,000 participants in the security team and it has to become that. People on the ground, people in our branches, the local decisions, it is so tempting to just go on your phone

and,

you know,

buy

a service for a few pennies or a few dollars a month.

And

that service now is, you know, perhaps

looks

like what you used to, will I be able to deploy detection and protection across all our devices as fast as people can pivot and move around? That's the challenge of the day. And depending, for a bank with larger means, perhaps that's achievable. For a smaller organization or more nimble organizations, imagine the challenge.

I've

heard from a lot of CISOs and different people in the industry that one of the best ways to tackle shadow AI is to make sure your organization is at the forefront with offering

the

latest and greatest. Do you share that opinion?

I

share that

with

you. We

took a very forward-leaning approach at the very beginning. We wanted people to be able to experiment. You want to enable that experimentation, that quick learning,

so

that you can take advantage of the actual tools as to be an early adopter. But you have to do this with eyes wide open. You're back to training education for sure. Perhaps if you can afford, and your technology allows it to have an area, a space, a lab where they can actually experiment and do, or an environment where they can experiment.

And

if you don't, then you put more emphasis on

enabling

early some learnings.

We

found, at least that's our experience, we gave folks, you know, allowed tools. People experimented a lot on that. And, yes, there's still always a few rogue experimenters out there.

But

if they have what you're proposing, a platform where they can play and learn and get ahead of the curve,

it's

authorized. They know they're not going to get a headache. A lot

of

large enterprises in various sectors are doing

the

sandbox, pilots, and some have very good results in specific areas. And I think it's a good approach to try different use cases, see which ones we want to double down on.

But

when it's time to scale these pilots to large-scale enterprise deployment, often the data security is not mature, won't scale. There's lots of doubt when it comes to, okay, what sensitive data will be found in a prompt, in a file upload.

What

about agentic systems that have continuous unfettered access to a variety

of

data sources?

What's

your view on that seminal moment

where,

okay, this is a great use case, but now we need to scale this from two guys in a basement to

30

,000 employees?

Well, for me, I'm

a big fan of being pragmatic.

There is no perfect world out there.

As

a CISO, I will not close the gates. Well, I guess I could have perfect security if we had no clients

and

no employees.

That

doesn't work so well. If you need to move quickly and adapt quickly, you will have to live with a healthy tension between

what's

allowed and what's available and what's just outside that line.

It's

preparing my team, my platform teams to be there. In fact, internally,

you

have to look at your own

business

lines as clients. So we're enabling through platforms with built-in security and quality, and you are selling to your own business. Consume these products because then you don't need to worry about security. There's a better return of investment right here. If you use other products, you might get early short-term wins, but eventually we will find you. We will lock you down, or we will force you back in this other environment. And that's going to cost you time, pains, and change in client experience. So adopt this one. And maybe that's going to cost you a few cycles of patience, and it will require of us a few accelerated cycles of investments.

But

in the end, the business wins. But it's not going to be magic. It's

going to be hard work.

You

were making me think about something funny.

You

know, the innovators that are trying to skirt controls are like, we will find a way. And you're saying, we will find you. We will find you. Eventually, the funny thing about

shadow anything. Yeah, yeah. It finds that we will find you. It finds, even if you're not looking for it, at some point it pops up. Either something unfortunate happens, or someone brings it up, glorifies, but somehow they always get discovered. Not because you're looking for them. They just

show

themselves up. It's a risky business. It's a risky business to be outside the business.

What

would you say is the sort of top-down appetite and desire for AI in the banking sector? You could use the bank as an example, but

how

much pressure do you feel for AI adoption and the efficiencies that it could mean for the banking sector?

I

don't know that I would call it

pressure.

I think that's such a huge opportunity

for

significant transformations that will bring

higher

quality, return of investment, quicker to market, customization for client experience. Like, there's so many good use cases.

It's

not a top-down pressure. It's more of a holding back the generated appetite for getting there as fast as possible. So I think back to my providing a platform that provides, by design, the right elements for security and the right experience. It's more about holding back the business than pushing the business. It will be pressure on the platform teams. It will be pressure on everyone. But I don't think it's a pressure. I don't think it's a top-down

pressure. Maybe a better question to ask is, is there like a board-down strategic imperative on the AI that's like driving top-down? I'm sure there is. But is it more that these technologies are so powerful on their own that there's a groundswell of bottom-up usage and

both

at the same time?

It's both.

So,

of course, your board, all boards, they're concerned about,

do

you have the right strategy, is the strategy pertinent,

and

are you executing on that strategy? So today, any board is probably asking, how is AI

part

of our strategy, and do we have enough AI in our strategy, or is there too much AI in our strategy? So that's probably a board conversation for all serious big businesses out there. At the same time,

you

have your teams who just want to use and adopt it as fast as possible. So you're a little bit sandwiched between the two because you want to control the upswell of interest, and you want to control that top-down and feed the strategy with the right elements. And like everything in life, you have to make a compromise somewhere as to what makes sense,

what's

an investment, what's

a

potential expenditure that's not really an investment. Differentiate the two and give the best advice you can.

Talking

about the board, can you explain when you present to the board

about

cyber risks, but in particular,

data

security, data privacy, maybe AI governance, how do you go about that, and what type of updates do you provide? Do you have specific KPIs that you could share? The usual

conversations historically have been about data loss prevention, having

a

perimeter, a multidimensional perimeter, and those conversations are still ongoing. I think what's most important now, at least what I prioritize,

you

have to know where your data is.

That

sounds so trivial, but data inventory, where it exists, in what form, is the very first and very beginning of a conversation. And you and I have talked about data in unstructured environment, often a huge blind spot for many organizations.

We

spend a lot of time thinking about our structured data and the shaping of that, and that's a challenge on its own, because it needs to now migrate into tools that will add more value to that data. So that would keep people busy, but you need to look at the entire spectrum of data through its life cycle and make sure that data through life cycle is protected,

and

if not, that you can detect and react quickly.

Yeah,

it's so interesting, because we were talking for many years, and when we started our business,

we

knew for a fact that unstructured data was the lifeblood of the everyday working man, right? Yeah. It's what people use, but

very

hard to track, and a lot of organizations I've seen in the early days have tried to create data jails.

Like,

hey, we'll put all the data in a jail,

but,

man, data wants to be free.

It

wants to roll around. Absolutely.

It wants

to

rule

the world. Yeah, and you can't stop it. I don't think you can stop it. So you're going to harness it. You've got to give it a place to live that you're comfortable with,

but

data will go, and the human in the loop will create those connectivities that you didn't really want to have, but they will happen, because people are people, and they want to create more value, create more business, and they'll, under pressure, will probably make decisions you wish they would make differently.

Switching gears and talking about AI use cases in cybersecurity,

I

hear a lot about, you know, the autonomous suck, and people have different visions for AI suck analysts. Obviously, many tools are now including AI features that are making things easier from a filtering analysis perspective. What are the real AI use cases that you've seen are delivering

a

punch, an impact

in

the cybersecurity tool set? I think you almost answered the

question.

AI

is appearing in many of our usual tools. So, so far, the bigger benefit is there. A little bit here, a little bit there adds up to quite a bit. The low-hanging fruit is probably in triage and being more effective at finding

those

one-of events. I've always had a dream that's going to sound a little bit like I'm still in

a

monitoring space, but if we could just have a good understanding of what normal looks like, normal behavior, normal behavior of individuals, normal behaviors of data, and keep an eye on it, and then you would probably see what's happening that's not normal, that's unusual. This was a too difficult problem with our historical tools.

Perhaps

with AI, it's something that we can tackle once again and have a look at what can we model, can we actually paint the picture of what good looks like, and find the outliers in that space. And that's likely possible. Now it's a question of getting the data in a space where you can actually look at all your data and do something with it.

I've

seen many dimensions where AI can be useful, like in tools, in our own tools. It could be that

it's

more dynamic. You can inject dynamism in a set of features where perhaps before,

you

know, an interface was like drop-down menus, things like that. Now you can make it dynamic by having natural language queries, like,

hey,

I lost the laptop. Here's the MAC address. What can you tell me about it? I think that's very interesting. It makes it more dynamic to leverage existing data sets. I've seen it with speed also, like managing large volumes of data quicker, distill it into what's relevant.

Maybe

even, Jean, closing

the distance between your threat models, your risk models, and what you're monitoring, and having the tool, not you quarrying the tool, but the tool proposing to you,

I

think these models are appearing in this space in your organization, and put the human in reaction to the tool proposing,

and

as a tool learns, this is a false positive, this is real, this is false, the tool will keep on learning, assisted by humans. So, again, this might be controversial, but human-assisted AI instead of the other way around.

And

all of these are leading to, quote-unquote, the agentic AI.

Are

you seeing real use cases now of, like, an actual agent querying multiple tools to affect the...

We're

taking

baby steps.

We're taking baby steps. It's not a space we fully master yet. I don't think anybody does.

It

certainly sounds like there's a lot of potential there, but at the same time, being a regulated body, we need to be mindful about

the

models, the principles around what you're doing, being able to demonstrate

that

your decision-making is repeatable and follows the due diligence principles.

So,

for regulatory entities, maybe that's a little more tricky.

If

I had free reigns, there's a lot of potential there.

I

would probably try to go faster and discover what I can do.

Because, honestly, it's talked about a lot, but I haven't seen,

besides

the cool medium article, the lab, you know, the YouTube video, I haven't seen someone really do something large-scale in that space. I think it sounds like true

automation and true autonomous automation. But then if it's autonomous, how is it making decisions? Can you demonstrate, will it make the same decision over and over and over, given the exact same conditions?

Maybe that's a challenge for 2026 and your new role as CTO.

I

will take that on.

Third

-party risk. We had something very interesting happen to us this year at Coash where

we

used Google Workspace and all of a sudden, one day I woke up and it's like AI in the emails, AI everywhere,

to

summarize email, to summarize your documents. No opt-in whatsoever, just appeared across the board. And there are many other examples of solutions that you bought as a SaaS of the shelf. And now, oh, there's a magic update and we have LLMs all over. You don't know which models. You don't know where the inference is happening. A lot of hyperscalers don't even have hardware in Canada as it relates to our sovereignty. So, you have to do a global inference zone and all that stuff's happening. I'd love to hear your view on that long chain of third-party risk now that's growing. And what do you feel generally about that? What should be done about it? I'll answer

maybe in two ways.

So,

I think the third-party risk management was a challenge, is still a challenge. It's an implied challenge.

I

think all of our businesses are untangling different portions of our business. And so, we're going to become an ecosystem of

smaller

entities kind of highly connected together. That's fantastic.

But

it does amplify the third-party or

the

third, fourth, fifth,

fifth,

seventh, eighth-party risk management

challenge. But

as I was listening to the question and the way you're assembling it,

I

was thinking, Asia is making the case for

we

have a lack of regulations in certain areas of our ecosystem.

The

fact that I can wake up one day and someone has embedded tools and those tools, don't know anything about them.

Should

I be concerned about that? I probably, normally you would announce to me, you would announce to me your upcoming features. I would get a chance to ask you about those features. We would have a conversation about, do I want that feature? Do I want that feature? Which is a little different from waking up one morning and finding co-pilot looking at your email. Just to pick on one supplier. Because you picked on Google, I picked. But it's happening. It's happening. Totally happening. Yes, absolutely. But these are unregulated suppliers, right? So will my regulator now ask me to show due diligence on my supplier and have more explainability perhaps in those tools?

Maybe.

But I'm going to need some levers if I'm to make it. Will contracting be enough to get the transparency that I need? Probably not. So I don't know. I think we're baby-stepping to that

right now. Have you seen an evolution already of the contracts, different forms where normally, you know, say in a SaaS contract, you'd have to report your subprocessor, your partners, things like that. A whole new section on AI is going to be... We're trying, but we're lagging.

I think the whole industry is lagging. This is happening much faster than we can change our legal language. It's almost like an Uber moment, you know,

let's just do it and we'll deal with this data.

Except I sit in a systemically important organization, so just do it doesn't quite...

No, I mean, those that are doing that, it's almost like they're adopting the Uber, you know, the hell with what the government says or what could happen. Let's just do it because competitively we'll be the first, we'll be the best, right?

I think, I know the analogy you're making, but would you rely on Uber to go to emergency if you got sick at home? There's, which is my analogy for, if there's a regulatory requirement, a real pressing need, maybe Uber is not the right model for what we need to get done. I don't

know.

It makes me a bit nervous. We

were talking about the leadership and some of the qualities that you brought from your service in uniform, your service for

the

CST. I'd love to learn more about your style and when you pick your team, what are some of the attributes you're looking for in your lieutenants? What are some of the key cultural elements that you demand from that team? Great question.

Without

getting too philosophical,

there

are many, many things we look for as we build a team.

Every

team is different because you have to surround yourself and you have to know yourself a little bit.

I

have strengths and many weaknesses, so I have to complement myself to make sure myself, who I'm surrounded with, and my team amongst itself has the right

portfolio

of skills and strengths put together. The things that I really do value, I believe we work in technology, but everything we do is about humans. So I will certainly have a sharp focus on the person that's being considered in that person's own makeup, ethics, dynamics, style of leadership, experience, what have you. So the individual is very important for me. The technical skills, definitely you look at,

but

most important is the person and what you

anticipate

that person will do in a difficult moment in a difficult problem. And then you have to look at the sum of your people and will they be able to gel together. There's a leadership role in that, but you have to put the right elements together.

Of

all the things I look at, the other thing I would point out is I value experience.

I

value people that don't have a linear career in one thing, but took the time to actually experiment and diversify themselves. I think diversification, taking your time to build yourself, build who you bring to the table is immensely important.

A

little bit to go back to what you said,

the

fact that I spent time in different countries, that I worked in different alliances or in country, outside country. I was an Air Force officer, you were an Army officer, flying things. Those cultures are important. The fact that you learn to work these cultures together, you're learning something as you're doing so within the military, between militaries, between military and government. Then you make that plural. When we work in the U.S., we faced different U.S. cultures, a country of 50 states, probably 50 cultures blended together. So, every one of these experiences enriches who you are as a leader, enriches who you are as a manager.

I think that's a key component of the people you put around in your team.

And are there specific core values that you think are essential, especially in a high-performing cyber team? You know, accountability would be an example, but

are

there others that maybe are part of your signature management system? A strong sense of ethics

and mission. A strong sense of ethics and mission. I think we're the good guys.

I

strongly believe we are the good guys. We're doing something noble for society in a fast-changing world. So, that you do it in private sector or in public sector, that you do it in uniform, outside uniform. I think we're all in this together. We are transforming society at a pace that's never been experienced before. So, for me, that's why the individuals on my team have tremendous ethics, tremendous sense of purpose and mission. And then, as you said, then accountable, good leaders, personable, humans, all key components. But it's people first.

I

really find that those leaders that put the mission first and everybody sees and believes that decisions they make are always in the best interest of getting the mission done.

And

then,

they

put their team second and themselves last, really in that

time

-tested military leadership model. I really think that works well beyond the world of defense and security.

Absolutely.

And I've seen the best leaders always adhere to that simple approach

with

great results. You're kind of saying the same

thing. Absolutely the same thing. And I'm really impressed to see it in private sector. When I first came to private sector, I was under that

myth

that in private sector, me, me, me, a dog,

a

dog. But it isn't that. There's a sense of cooperation. There's a culture. We have a very strong president with a very strong sense of mission, a very strong vision for the organization. And every one in the 31,000 employees are really well aligned behind that mission and vision. That is what we did in the military. That is what we did in government for national security reasons. And that's what we do in a business, at least, that I'm privileged to work in.

Now,

I know you wouldn't change anything in your career. But if you had to give some advice maybe to someone that's new, starting in cyber, what would be the top three pieces of advice you'd give a young, switched on, motivated person?

Patience,

curiosity,

and

trust yourself.

I

think that would be the first three that come to mind. Patience, because I find in many of my conversations, people want to get to the finish line, and they're focused on the finish line. Enjoy the journey. The journey is important. Be curious. Goes with that, right? What should I do next? What's open? Is it interesting to you? Get passionate about it. I give this speech about being lazy. It's not about being lazy. It's about being lazy to do things you don't like.

Be

lazy in a way that you do things that wake you up in the morning that you want to do, and it'll get you there. So I think, to me, those things are super important.

You

just made me think about something. When I was a young pilot, one of my instructors said to me one day, you know, Jean, there's only one way you're going to end

as

a burning hole in a mountain. You're either lazy, stupid, or arrogant. And I think if you stay away from these three, you're going to be all right. You'll

have

no problems. You'll be all right. Great. I mean, that's about all the time we have, and thank you for being on the podcast. If people want to follow you and your work, what's the best place to follow you, André? Besides taking employment at National

Bank, you mean? Yeah, besides that. Okay, all right. If you're not already an employee at National Bank, I do have a LinkedIn profile, so you're welcome to join me there. I'd be happy to connect with as many people as possible. We don't compete in security. We work together. So if you're interested in this domain, please, by all means, it's all connect.

Well

said. All right. It was great fun to have you. I learned a lot. And hopefully, we'll do a version, too, maybe with a CTO angle in the future. Thank you for having me. Thank you.

Thank you. Thank you.