0:07 I click her? I click with it? Hi, everyone. Good afternoon. So, I'm in a bad spot. I am standing between you and break. I will take bribes. If anybody wants. Also, a little bit of a bad spot because Damon took my best stuff. Alrighty, so you'll hear a lot of repeats. I think that's actually good. I think these are themes that we generally see in this space. If I had had more time, I would have made bingo cards for this time, just to kind of, you know, as I repeat something, you could mark it off and have a prize, but… I did not get to that point. So, again, yep, Jennifer Miller, I am from Bayer. A little bit about myself. quickly. I, have a pretty long time in IT. I've been in this role with security culture for about 10 years. Prior to, I was, working in the commercial space, supply chain space.
1:04 infrastructure, a lot of areas, actually. And what's been consistent across my career is I've spent a lot of time systematizing processes that are typically manual, which is a lot of what we're doing here today with our Living Security implementation. also want to tell you a little bit about Bayer. Large company, 3 divisions, we're global, we have a footprint in 80 countries, I should check. We, have a lot of, requirements from a regulatory standpoint, from a data privacy, we have lots of workers' council, considerations. We are a European-based company, so a very complicated environment. We are early in our implementation, just to be clear. We are gaining momentum, but we are, like I said, anything in the company of this size, in this complexity.
2:00 There's a lot of things to be done in advance of getting anything. Kind of up and running. So what we'll talk about today is the trap of waiting for the perfect data or the perfect situation before we begin a project like this. We'll talk about signals that we already had, information we already had, knowledge of our workforce that we already were pretty intimate with. how we can act on it and expand that into… kind of into more additional war wins and momentum, and then, what you can do Monday to get started as well. So, there's a trap that I think we're often stuck in, Have we ever sat in a room, and we've got, we're looking at… we're evaluating a system for, implementation, and you've got, in that room, you've got the vendor who will tell you that they can do everything and anything and things that you never even imagined you'd want to do, but now you want to do them.
3:00 badly. You've got your visionaries, kind of the people who are in leadership, or in kind of those visionary roles, who also want to now do those things quickly, now, yesterday. And then you've got the folks that are maybe a little bit more closer to the details, who are going, that'll never work, that's not gonna work here. Or, it's gonna be really hard. You've got to marry all this together to somehow figure out how we're going to bring this to life. And this is where we started as well. So, and I think everybody thinks that we can't start until we have everything. We need all of the information. Damon talked about this, I think, right? We want to be able to see everything, and we're going to let the data tell us what to do. And that's gonna… and then we're gonna know things we never knew before. In most organizations, and particularly in a large organization, that's going to take a long time. And in that time, what have you lost? And what opportunities have you lost? So let's look at what happens when you go ahead and just start moving forward.
4:00 So for us, we started with a pretty roadmap, planning for a bunch of integrations and a bunch of regional rollouts over a very nice measured timeline, and like I said earlier, we thought the visibility would give us all the answers, and then we would… everything would be perfect, and the world would be great, and… Yes, and then we would have the most mature program in the world. But what happened when we started is we realized that that, was even more complicated than we had thought, and we knew it would be complicated. I mentioned some of this earlier about the complex environment with regulatory, data privacy, things like that. Our data owners were… you know, sometimes a little resistant, or really wanted to understand our intention, what we were going to do with their data. So, there was, yeah, a lot of things that… made us want to look at this a little differently, and this is what we did. So we re… we reordered the program, or we looked at where we could get things going quickly, and that was, I think on my next slide.
5:09 Finding our first wins. We looked at data that was available. Most awareness teams, risk teams, culture, call it what you will, they have their fishing data. We have our fishing data. We have training data. We probably have some level of understanding who has elevated access in the environment, those sorts of things. So we looked at what we already had, and then we understood, and we also understood, kind of, the motivations behind some results in that area. To, to, to utilize those insights to kind of start to make, to make forward momentum or forward movement. And we also looked at what was relevant. What is really going to help us, you know, begin the trend towards, really changing the culture in the organization. So what would help us, and what's just nice to know, fun to have, that sort of thing, and really tried to focus on the relevant. And what could we take action on? So, if it really didn't result in an action that altered behavior, or helped modify or address behavior, then does this information or data that we actually needed, is this something we needed to put effort into? Is this something we really needed to spend cycles on?
6:21 And then I'm going to take a little shift and talk about stakeholder management, because I think we've heard a lot about this today, and this concept of trust. So, in order to continue to build that momentum, to move forward, to grow, we need, then, good partnerships, we need to build trust within the organization, and also with our employees, as we start to expose them to something they've never seen before. And I think this is where it becomes very important to be very purposeful about what you're doing, and what you intend to do. So look at the signals. And then what decisions will those signals drive? What will we do with those signals? And then what's the action that finally comes from that, right? So just really being clear about our intentions, I think has helped to build… to begin early in our process, trust. But I think overall, when you're looking at working with your internal stakeholders. Whoever it might be, that transparency, that openness, that willingness to have the conversation and build the trust goes a long way towards driving your program forward as a partnership.
7:24 As opposed to just, hey, we want this, give us this information, trust us, it's gonna be fine. The humans are all gonna do what we want them to do, right? Because… The goal isn't better dashboards, and don't get me wrong, I love a good dashboard. I love, love, love a good dashboard. Beautiful, nice, shows all the things. However, a beautiful dashboard won't get you where you need to go. We really need to be able to make better decisions. So have information in those dashboards, or whatever repository of information that derives better decisions overall from your program, and then ultimately better decisions from your employee base. So I talked a little bit about how you get those early wins. So once you start to get that, you can act, and then you can expand. So, leverage the partnerships, the partnerships you've built with your stakeholders, with your partner teams, with the teams that support your efforts from, like, a legal perspective, data privacy I keep talking about, or your internal cybersecurity teams. So look for the people who really want to.
8:32 Get behind what you're doing, who understand the importance of managing human risk. And then work with you on it. And with them, find the proof points. Like, with the wins. Where are we going to prove that this is actually valuable, that collecting this information, that implementing a tool that essentially automating what was manual processes before brings value into the organization. And it's just not another effort to kind of consolidate information and, you know, kind of just make dashboards and those sorts of things. And then scale. So use the credibility that you've built and the lessons that you've learned to grow, to accelerate implementations, and to drive adoption elsewhere. Was I fast? Because I thought I'd be slow. I really think this brake thing was really weighing on me, because I just blew through everything! Okay, four things you can do Monday. You could do them later today if you wanted, however, I really wish you'd wait for Monday. Focus on what you already own. So, look at… 1 to 3. Nothing complicated. Take the data you own, the data you understand, and, bring the source of that data into the room, and then build your plan on what you're going to do with it.
9:48 Name one risk you can point at, so be very, very, very specific about the risk that you're looking to manage with that data, and then what you intend to do with it. And then pick one use case you could finish. We had quite a few use cases earlier. We actually have a pool of use cases that we can kind of bring forward or, deprioritize based on either what's happening in the organization or, or the needs of the project. So, pick one you can finish, but then also have some others in backup if something doesn't go according to plan. And make your plan repeatable, or make your process repeatable, and then simply copy it. So, you know, get the one thing that you can do well going in your implementation, and continue to grow, expand, and take that out into the world. More and more.
10:43 Thank you. Big questions? Thank you, Jennifer, for those insights. Yeah, we do have a few questions for you. So, how did you prove the program was reducing risk while your visibility was still incomplete? That's a really, really good question. Pass. I pass. Do we allow for that? I just started pass at 2.30 in the afternoon. No, so, a couple things. So, we have had our ongoing, kind of, regular activities in the culture space, and then we looked at how we could those were influencing behavior change, and then how we could use the living security tool to make that better, to make it faster, to, I guess, yeah, improve how we did that and make it more measurable, ultimately. So, that was… like I said, this is emerging for us. We're early on in the process, but this is the approach we've taken so far. So far, it's just working.
11:49 That's great. Do you have a process for continuous improvement? Now I use my past. Yeah, of course, yeah, we have it, we do, we do, we do. So luckily, we're, we're all very, accustomed to working very agile, I call it modified agile, where we, you know, we work in short sprints. We do a lot really, really… what did I do? Okay, I moved it around. They'll fix it. Yeah, yeah. And then, so what we do is we gotta do something very quickly, we take learnings from that, and we implement the changes and the learnings from you know, that cycle into the next one very, very quickly. So this allows us, to, you know, really quickly identify where things aren't working and shift. So we do have an overall plan, roadmap. Tension, but we would make shifts in that, or we'll make adjustments based on learnings from… from prior experiences.
12:48 Very cool. And for the last question, if you were standing up here one year from today, what is… would you have hoped to have accomplished? Everything. It would all be done. And I'd be getting an award. That is a very submitted thing. And they wouldn't put me right before break. No, I'm kidding, I'm kidding, I'm kidding. So, in one year, I really hope that we have We have gotten… gotten our… we've kind of expanded into two regions. Ideally, probably the entire… I'm sorry, I'm thinking and talking at the same time, because this is… I'm like, I want everything, right? It's that earlier conversation. It's like, yeah, everything's organ, we know everything, but… That we have the visibility, the complete visibility into the organization to understand where the risks are that we maybe aren't as familiar with, that we have implemented in, and I would say, like, a full intervention, or what we call the nudging.
13:50 With the toll in… Let's say, at least 75%. Yeah, that would… I would be pretty happy with that. We would still have a long way to go, but that would have… that would have… proven that the approach is working, that we picked up some pretty good momentum, and I think we would be pretty well positioned to continue to grow the program. The work never ends, right? That's why we all got jobs. Oh, yeah, that's right. If it ended, we'd be sad. Alright, well, a last name that I can pronounce, please say, Jennifer Miller. Thank you.
