20MinuteLeaders

Most conversations about cybersecurity revolve around systems: networks, endpoints, vulnerabilities, the latest tool. My conversation with Gary S. Chan revolved around something harder to patch: the human mind. Chan is Chief Information Security Officer of SSM Health, a nonprofit healthcare organization with 50,000 team members. He is also a trained interrogator and performing mentalist. To him, these are the same discipline seen from different angles.Chan studied electrical engineering and computer science at MIT, worked in IT consulting, and moved into identity fraud prevention, where the adversary is often someone pretending to be someone else. Along the way, he trained as an interrogator. Today he leads security for a major health system, though he made clear he spoke with me personally, not on behalf of his employer. Each step reinforced his belief that security is ultimately about people.The name tying it all together came almost by accident. At his wife’s work dinner party, Chan introduced himself to some guests as a security specialist and to others as a mentalist. Neither description drew much interest. Later, two guests compared notes and asked which one he really was. Rather than choose, Chan combined the two on the spot: “Security Mentalist.”The mood changed instantly. Everyone wanted to know what a Security Mentalist did. Chan spent the next half hour telling hacker stories, and the lesson stayed with him: the same facts, framed differently, can move an audience from indifference to fascination. He now has a trademark pending on Security Mentalism®.That instinct for framing sits at the core of his philosophy. Chan argues that the human element is the most critical and overlooked layer in security. From interrogation, he draws on managing “headspace”: people have limited cognitive capacity, and how that capacity is loaded shapes what they reveal. Mentalism helps him understand how attention and suggestion guide decisions. Game theory provides a framework for anticipating others’ actions. Together, these ideas help him defend an organization and navigate it.As a Security Mentalist and keynote speaker, Chan shows audiences how social engineering and hidden influence can exploit even smart people and secure systems.The toolkit has real-world stakes. Chan described a job applicant with an impressive resume who passed a technical interview and convinced the hiring manager. Chan examined the resume and LinkedIn profile again. He wasn't scanning for keywords. He was looking for psychological and narrative inconsistencies, places where the story didn't hold together. He discovered the candidate was fake before the company made a bad hire. As polished credentials and confident interviews become easier to manufacture, reading the story behind a resume is a security skill in its own right.Partway through our conversation, Chan demonstrated his point with a deck of cards. He spread the cards across the table, placing a duplicate of one card face down to the side before asking me to choose any card. He even let me change my mind. I chose the Three of Spades. It matched the card that had been sitting face down in full view the entire time. The moment captured what he'd been describing: attention, framing, and influence can shape a decision someone believes is entirely their own.Listening to Chan makes one thing clear. The attack surface that matters most isn't purely technical. Fraudsters exploit narratives, employees resist change, and executives respond to stories more readily than specifications. Security leaders who understand psychology as deeply as technology can better protect their organizations and move them forward. Chan has built his career and stage persona around that idea.Learn more about Gary S. Chan and security mentalism at https://www.securitymentalist.com. Follow him on YouTube at https://www.youtube.com/@SecurityMentalist.

Fernando Dominguez Pinuaga shares his journey from energy systems to Google X, where he learned to think in true moonshot scale before joining SandboxAQ. At the crossroads of AI and quantum physics, he leads initiatives that are redefining cybersecurity and scientific computing.He explains how adversaries are already stealing encrypted information today through store-now, decrypt-later attacks — making quantum-era risk a current problem, not a future one. Fernando outlines the path toward crypto-agility, encryption inventorying, and modernization strategies that governments, banks, and enterprises must now adopt.Beyond security, he highlights the rise of physics-based AI models capable of accelerating breakthroughs in drug discovery, materials science, energy systems, and financial modeling — areas where classical AI struggles. Fernando frames this moment as the beginning of a new computational era, where quantum principles and AI jointly shape the next industrial wave.

Lauren Freund has spent the last few years inside her dream company, leading social media and influencer marketing at Canva. She describes why traditional influencer playbooks—optimizing for follower counts and reach—are increasingly outdated, and why she now screens creators for deep engagement, relevance, and the ability to truly carry Canva’s message. For her, the messenger is as important as the message, and influencer feedback is anchored in objectives and CTAs, not rewriting their voice. On the brand side, she runs every idea through a simple but demanding filter: why share and why care—why the company should post it, and why the audience would genuinely care. From there, she uses each platform’s “success signals,” like shares/saves or time-on-post, to decide when to use video and when carousels outperform. Lauren closes by reflecting on working at a product she genuinely loves and how the ever-changing worlds of social and AI keep the work exciting and experimental.#20MinuteLeaders #SocialMediaStrategy #InfluencerMarketing #CreatorEconomy

Coming from years of manual social monitoring in marketing roles, Anya Law saw how expensive and ineffective traditional social listening was for startups. Meeting her co-founder at Atlanta Tech Village, she joined PitchGhost to transform a simple Twitter scraper into a full prompt-based, actionable social listening platform. The team discovered their ICP through trial and error—moving from solo founders to multi-person GTM teams who needed context-aware posts, sentiment filters, and response automation. With LinkedIn support as a major differentiator, PitchGhost is now expanding integrations, APIs, and CRM workflows to become a core part of the modern RevOps stack. Anya’s story is one of solving her own pain, refining personas, and building a tool that helps teams act—not just monitor. #SocialListening #GTMStrategy #MarketingAutomation

Growing up in Wisconsin’s drinking culture, Daniel Adix launched LiQure to help people “feel good the next day.” After discovering DHM and developing a gummy-based recovery supplement, he navigated taste issues, manufacturing resets, FDA compliance, and the realities of CPG distribution. Rather than chasing ads, he built LiQure through festivals, bars, and targeted retail—landing Foxtrot Chicago as an early anchor. Daniel frames LiQure not as a party hack but as a performance-enhancing recovery brand that supports real-world consumers and modern wellness routines.

Matan Kadim’s path into fitness began with a personal struggle and grew into a career of coaching and international learning. He argues that real change comes not from short-term resolutions but from identity-level shifts: who you see yourself as. Training, he explains, is not just against comfort zones but against evolutionary programming for ease and safety. By reframing workouts as daily battles with comfort, Matan helps clients develop resilience, discipline, and joy in the process. His “simple but not easy” philosophy cuts through misinformation and fad culture, emphasizing consistency, sleep, nutrition, and growth mindset. For Matan, the gym is a microcosm of life—identity, habits, and resilience all align to shape who you become.

Neta Bresler’s journey began with a childhood magic kit and evolved into a 1,500-student academy and global recognition as a top mentalist. Today, he reframes mentalism as “mind art”—a discipline that maps human blind spots and leverages them to teach, not just entertain. With stories like the “magic wand” blind spot and his red-to-purple team analogy, Neta explains how illusions translate into enterprise strategy. For him, certainty is the ultimate illusion, and breaking assumptions creates presence. He now works with tech companies on deception, perception, and product design, showing that the art of magic is really the science of human cognition.#20MinuteLeaders #MindArtInBusiness #CognitiveLeadership #TechTeamInnovation

By Michael Matias, CEO of Clarity and Forbes 30 Under 30 alumCybersecurity has entered a new domain—literally. As Eyal Balicer put it in our recent conversation: “Cyberspace is now the fifth domain of warfare.” But in this domain, the battleground isn’t just code. It’s control.Eyal brings a rare vantage point to the AI-cyber nexus—he’s held senior cybersecurity roles in the Israeli government, Fortune 100 companies like Citi, and top-tier venture capital. Our discussion centered on a growing truth: with the rise of agentic systems—AI entities that can act, decide, and evolve—the mission of cybersecurity is changing.“We are shifting from a world where intelligence was a scarce resource to one where that is not necessarily the case; true agency is becoming the new elusive driver of prosperity and growth,” Eyal explained. “The systems we are now securing are not just automated—they are autonomous, highly competent, and opaque. Traditional defenses cannot keep up.”It’s a shift I’ve seen firsthand at Clarity, where we build proactive defenses against deepfakes and AI-generated phishing. Just like Shahar Peled told me about agentic AI revolutionizing offensive testing, Eyal sees these agents redefining global threat models. The challenge isn’t identifying known threats—it’s safeguarding systems that learn, adapt, and act independently.And that requires a new security architecture.“An AI agent can have fluid permissions, context-based roles, and evolving identity,” he told me. “Conventional IAM just does not cut it anymore.” In that sense, Balicer echoes voices like Ron Nissim and Alon Jackson, who both called for a redefinition of identity management in the AI age.But Eyal's view goes broader: geopolitical. He sees cybersecurity not just as a business enabler, but as a pillar of national resilience. From financial systems to defense infrastructure, the stakes have never been higher. “The future will require autonomous cybersecurity—not just automated, pre-defined playbooks, but real-time, adaptive agents who reason and defend at the edge, with varying degrees of human intervention.”We discussed how the regulatory map only adds to the complexity. “The fragmentation across jurisdictions makes cross-border cybersecurity brittle,” Eyal warned. His point was clear: the only viable strategy is proactive, agentic, adaptable security. Not static controls. Not red-alert dashboards.The recent acquisition of Wiz by Google, he said, is just the beginning. “This will eventually lead to an entrepreneurial Cambrian explosion in cybersecurity,” Eyal predicted. And much like Dorit Dor told me, the organizations that survive will be those that move fast—and let AI lead the charge.As we closed, his advice was blunt: “Ignoring this revolution is not an option. AI evolves daily. Your security safeguards and controls should not lag behind.”My takeaway? Eyal isn’t just talking about new tools—he’s laying out a new doctrine.Agentic AI isn’t coming. It’s here. And if we don’t secure it now, we risk losing control of the systems that already make decisions for us.The future of cyber isn’t just proactive. It’s autonomous. And it’s already reshaping the balance of power.

By Michael Matias, CEO of Clarity and Forbes 30 Under 30 alumThe intersection of Governance, Risk, and Compliance (GRC) and artificial intelligence (AI) marks one of today’s most significant business transformations. In my recent conversation with Yair Kuznitsov, an expert in AI and GRC, it became clear that GRC’s role within enterprises has fundamentally shifted, driven by rapid AI adoption.Kuznitsov, whose team spent the past year on rigorous AI research in the GRC domain, highlighted the critical role of proprietary data in achieving enterprise-grade accuracy. “It’s very difficult to create AI that addresses specific use cases with high accuracy without training it on highly specific and vertical datasets,” he explained. Proprietary data isn’t just helpful—it’s essential for the trust enterprises demand.Historically, GRC was seen as a gatekeeper—slowing innovation with rigid compliance requirements. Today, however, modern GRC teams are becoming enablers of innovation. As Kuznitsov put it: “Historically, GRC was a gatekeeper slowing innovation. Today, modern GRC teams enable innovation, ensuring trust remains intact.” This shift reflects the rising complexity created by global expansion, cloud adoption, and the proliferation of SaaS tools.The scale of risk is staggering. Gartner projects that by 2025, 85% of enterprises will operate mainly in the cloud, challenging traditional compliance frameworks. GRC functions must now assess regulations rapidly while supporting swift, secure market entry. AI is uniquely positioned to meet this demand—but only if accuracy reaches the 80–90% confidence enterprises require. That confidence, Kuznitsov emphasized, depends on training AI with proprietary, vertical datasets.At Clarity, we’ve seen firsthand how tailored AI models dramatically strengthen cybersecurity. AI doesn’t just upgrade compliance workflows—it transforms GRC from a reactive bottleneck into a proactive driver of innovation.Kuznitsov also underscored how traditional compliance, rooted in static documents, has become chaotic in the face of globalization and fast-paced tech adoption. AI addresses this chaos, automating assessments, policy checks, and risk monitoring at speeds previously unimaginable. Here again, the differentiator is proprietary data. By grounding AI in enterprise-specific datasets, organizations secure the accuracy needed to maintain trust. As Kuznitsov noted, “Vertical AI solutions achieve high value by providing tailored accuracy for specific enterprise use cases.”The lesson is clear: enterprises that embrace AI-driven GRC today will not just adapt, they’ll thrive. The evolution from passive gatekeeping to active enabling is no longer optional—it’s essential. Those that ignore this transformation risk being left behind in an increasingly complex regulatory landscape.Enterprises must urgently rethink their approach to GRC. The AI era demands dynamic, proactive, and precise compliance strategies, rooted in proprietary data and vertical AI solutions. The choice is stark: adopt AI-driven GRC to accelerate innovation and maintain trust, or remain stuck in outdated practices and growing risk.

By Michael Matias, CEO of Clarity and Forbes 30 Under 30 alumWe’re not easing into the AI era—we’ve been thrown into it. That’s how Ron Peled, founder of Sola and former CISO at LivePerson, described the current moment: “The Big Bang already happened. Now we’re just trying to contain the blast.”Ron’s clarity around AI’s impact on cybersecurity is jarring—and refreshing. He doesn’t talk about threat vectors or dashboards. He talks about control. About complexity. About what breaks when the world adopts generative AI faster than the security stack can respond.Like many of the leaders I’ve spoken with—Dorit Dor at Check Point, Tsion Gonen at Protego, Elik Etzion at Elron—Ron sees AI as both threat and tool. But what makes his voice unique is his insistence on simplicity. “The era of bloated, ‘luxury’ cybersecurity products is over,” he said. “What teams need now is focus. Precision. Clean UX. Solutions that don’t overwhelm—just work.”That perspective echoes something Tom Mes told me about CISOs today: they don’t have the luxury of managing theoretical risk. Their job is to enable the business without drowning in alerts or friction. In that sense, Sola’s approach reflects a growing pattern—cybersecurity as a minimalist, embedded experience.But Ron takes it further. He doesn’t just want cleaner tools. He wants community-based security. “Everyone talks about shared defense,” he said. “Almost no one builds for it.” He sees this as the next evolution—not more tech, but more collective action. A model that looks more like a neighborhood watch and less like a gated compound.It’s a mindset I’ve come to share at Clarity. Whether we’re tackling deepfakes or phishing automation, the organizations moving fastest are the ones who build for people, not just systems. The ones who remember that cybersecurity is, at its core, a coordination challenge.Ron also spoke to the evolving role of the CISO. No longer just a gatekeeper, the modern security leader needs to be what he calls “a productively paranoid operator”—someone who sees what’s coming and builds guardrails without becoming the roadblock.That term stuck with me: productively paranoid.Because that’s exactly what AI requires. The attacks are faster. The tools are more accessible. And the stakes—for privacy, for resilience, for trust—have never been higher.As our conversation wrapped, Ron returned to the urgency. “Organizations don’t want partial solutions,” he said. “They want defenses that move at the speed of the threats.”In that sense, the mission is simple: Build security tools that scale with AI, not lag behind it. Architect for clarity, not complexity. And never forget—the Big Bang already happened.The question now is: who’s ready to build the shield?About Michael Matias:Michael Matias is the CEO and Co-Founder of Clarity, an AI-powered cybersecurity startup backed by venture capital firms including Bessemer Venture Partners and Walden Catalyst. Clarity develops advanced AI technologies protecting organizations from sophisticated phishing attacks and AI-generated social engineering threats, including deepfakes. Before founding Clarity, Matias studied Computer Science with a specialization in AI at Stanford University and led cybersecurity teams in Unit 8200 of the Israel Defense Forces. Forbes Israel recognized him early on, naming him to the exclusive 18Under18 list in 2013 and the Forbes 30Under30 list thereafter. Matias authored the book Age is Only an Int and hosts the podcast 20MinuteLeaders.