WWHF 2020 (Virtual): Labours Of Hercules - Be Like Phil

## Overview Kevin Johnson, CEO of Secure Ideas, presents 'Labours of Hercules—Be Like Phil,' using Disney's Hercules movie and its mentor character Phil as a framework for addressing the cybersecurity industry's real problems: not a talent shortage, but high training costs, unclear career paths, misinformation, and inadequate ethics education. Johnson advocates reframing cybersecurity as a skilled trade with formal mentorship pathways rather than an exclusive high-level profession.

## Key Problems Identified Johnson highlights critical barriers: (1) training costs of $6,000–$7,000+ per course exclude many learners; (2) people lack understanding of career progression and where to focus learning; (3) incorrect technical information spreads online (citing a YouTube 'next-gen hacker 101' video that misinterprets traceroute output); (4) ethical and legal boundaries of security work aren't consistently taught—he describes a company scanning internet hosts without permission and questions how to teach people when and when not to apply penetration testing skills.

## The Apprentice-Journeyman-Mentor Model Johnson proposes a three-stage progression: Apprentice (entry-level with defined foundational skills), Journeyman (competent practitioner capable of leading projects and consulting), and Mentor (guide for the next generation). Mentorship is bidirectional; mentors learn from mentees, and everyone at every level should mentor others. Johnson explicitly rejects the term 'master' due to negative connotations, emphasizing instead that reaching mentor status is only the beginning of responsibility, not an endpoint.

## Building Formal Mentorship Programs Johnson outlines five implementation steps:

1. **Formalize the program:** Define goals, structure, communication plan, and schedule before launch. Clearly communicate expectations to all participants. Avoid ad-hoc mentoring ('we'll figure it out when we have time').

2. **Identify mentors actively:** Don't post open calls; actively recruit and engage potential mentors. Drag them into the program and work with them on adjusting plans.

3. **Provide multiple learning paths:** People learn differently. Some learn through reading, others via video, audio podcasts, hands-on practice, or group discussion. Secure Ideas uses written materials, recorded videos, live webcasts, Slack workspaces, and consultants available for real-time questions.

4. **Set clear SLAs:** Establish and communicate response time expectations (e.g., 30-minute response time during business hours). This is critical because mentees feel hesitant to ask questions and need assurance they won't be ignored.

5. **Ensure active engagement:** Reach out to all participants regularly. Track progress through assignments, quizzes, and practice exams. Pay attention to subtle feedback—if mentees say 'you haven't checked on me in weeks,' you're failing. When students say 'yeah yeah, I got it' without genuine understanding, probe deeper.

## Example Programs Secure Ideas offers a CISSP mentorship program structured as recurring 9-week cycles with fixed start and end dates. Students can retake the program multiple times. Between cycles, previous participants naturally become mentors to new cohorts, creating sustainable community growth. Additionally, Johnson released Professional Evil Fundamentals—a free YouTube playlist of 2–4 minute definition videos covering foundational concepts.

## Guiding Philosophy Johnson emphasizes that security professionals' primary responsibility is knowledge-sharing. He draws parallels to woodworking YouTubers like Steve Ramsey, who share crafts with genuine passion. Key principles: - Everyone needs a mentor or hero; no one succeeds alone. - Don't pursue applause or recognition; do the work because it matters. - Follow ethical and legal rules; this distinguishes practitioners from those they oppose. - Develop agility and broad competency, not isolated specialization. - Aim with a flexible plan rather than rigid lists that guarantee imposter syndrome.

## Takeaways The industry's real crisis is not talent shortage but accessibility and ethical education. Formalized, structured, bidirectional mentorship with multiple learning paths and active engagement prevents overwhelm and dropout. As practitioners gain expertise, mentoring the next generation becomes their primary responsibility.