Not every speaker is an expert. Not every successful salesperson is a successful business owner. And not every cybersecurity expert has ever managed a real cybersecurity crisis.

By Keith J. Nelson, Ph.D.
CEO & CISO | Vistem Solutions, Inc.

As we head into another season of major technology, managed services, and cybersecurity conferences, thousands of business owners, executives, and technology professionals will spend considerable money and time traveling to learn from industry leaders.

We will attend keynote presentations, breakout sessions, workshops, and vendor-sponsored discussions. We will hear about the latest technologies, artificial intelligence, cybersecurity threats, mergers and acquisitions, recurring revenue, and the next great business model that supposedly promises to transform our companies.

But before selecting your conference sessions, I encourage you to ask a question that might make some people uncomfortable:

Who is giving the advice, and what qualifies them to give it?

A speaking invitation does not automatically establish expertise. A polished presentation does not demonstrate business success. A large social media following does not establish credibility.

And perhaps most importantly, someone else’s definition of success may have absolutely nothing to do with your own.

The Industry Has Plenty of Speakers. But How Many Have Actually Done What They Teach?

I have attended technology conferences for decades. Some speakers have provided extraordinary insight, shared hard-earned lessons, and challenged me to reconsider my approach to business.

Others have left me questioning why they were on the stage in the first place.

We have created an industry where visibility is too often confused with expertise.

Someone builds a personal brand, becomes active on social media, develops relationships with conference organizers or vendors, and suddenly becomes a recognized industry thought leader.

But thought leadership should require more than having thoughts and a microphone.

Before attending a business strategy session, I want to know something about the person delivering it.

• Have they built and operated a successful business?
• Is their company consistently profitable?
• Is their business more successful than mine in the areas they propose to teach?
• Have they managed employees, customers, vendors, and business crises?
• Have they experienced economic downturns and successfully navigated them?
• Can they demonstrate measurable outcomes from the strategies they advocate?
• Are their values and business objectives consistent with mine?
• Are they sharing proven experience, personal opinion, or a sales presentation?
  

These are legitimate questions.

Profitability alone does not make someone a good teacher, and a smaller company can certainly develop ideas that benefit a much larger organization. But when someone proposes to teach business owners how to improve profitability, scale operations, or create enterprise value, asking whether they have achieved those outcomes themselves is hardly unreasonable.

If someone is going to teach me how to operate a successful company, I want to understand the success of the company they operate.

Over the years, I have encountered conference speakers and recognized industry personalities who subsequently approached me about investing in their businesses because they needed additional funding.

There is nothing inherently wrong with raising capital. Successful companies raise money for many legitimate reasons.

However, these experiences reinforced an important lesson: a person’s conference reputation and their actual business performance are not necessarily the same thing.

Before treating someone as an authority on profitability, growth, or financial management, understand the business behind the presentation.

I Was Talking About Business Outcomes Before They Became Fashionable

Since approximately 2000, I have consistently advocated that technology companies should focus on delivering measurable business value rather than simply selling technology.

For years, that position often ran counter to prevailing industry advice.

We were repeatedly told that the path to success was standardization, packaging, and recurring revenue.

Build your stack.

Bundle your products.

Sell by the device.

Sell by the user.

Standardize your agreements.

Increase the number of licenses under management.

Create predictable monthly recurring revenue.

The industry embraced what I have often described as Kmart Blue Light Special pricing—reducing sophisticated technology and professional services to a commodity sold at a promotional price per user or per device.

Don’t misunderstand me. Standardization, automation, and recurring revenue can be essential elements of a well-managed technology services business. We use many of these principles at Vistem Solutions.

But somewhere along the way, too many providers confused the method of delivering a service with the value of that service.

Technology stacks became the product.

Licenses became the measure of success.

The number of endpoints became more important than the business outcomes delivered to the customer.

And the industry gradually trained customers to compare providers based on price per user, price per device, and which products were included in the bundle.

When every provider sells essentially the same stack, what makes one provider worth more than another?

That is the uncomfortable question our industry needs to confront.

If the only difference between two providers is the price of a nearly identical bundle, we have allowed ourselves to become interchangeable.

We have commoditized our own expertise.

And then we wonder why customers challenge our pricing.

Vendors Sell Products. Service Providers Must Deliver Business Outcomes.

This brings me to another distinction I believe conference attendees should recognize: the difference between vendor success and service-provider success.

Technology vendors develop and sell products.

Their business objectives generally involve increasing license adoption, expanding market share, improving retention, and generating recurring revenue.

There is nothing inherently wrong with those objectives. Vendors are businesses, and profitability is essential to their continued innovation.

But a managed services or cybersecurity provider has a fundamentally different responsibility.

Our obligation is to understand what the customer is trying to accomplish and determine how technology, cybersecurity, process improvement, and professional expertise can help achieve those objectives.

Our customers do not wake up in the morning wanting more licenses.

They want to:

• Increase productivity and operational efficiency.
• Reduce downtime and business interruptions.
• Protect revenue and critical business processes.
• Reduce cybersecurity exposure and financial risk.
• Improve regulatory compliance.
• Control operational costs.
• Improve the customer experience.
• Support growth without introducing unnecessary complexity.
  

A vendor may measure success by the number of licenses sold.

A service provider should measure success by what those licenses, combined with its expertise and service delivery, actually accomplish for the customer.

That distinction matters when choosing conference sessions.

A presentation about increasing average revenue per user may be useful. But does the speaker explain how the additional revenue corresponds to measurable improvements for customers?

A presentation about selling more cybersecurity products may help a vendor or reseller increase sales.

But does it teach us how to measurably reduce customer risk?

A session about improving margins through automation sounds attractive.

But what happens to customer satisfaction, service quality, response times, and actual business outcomes?

We should be asking those questions.

Because our industry’s future should not depend on finding increasingly creative ways to sell the same products at different prices.

It should depend on delivering expertise and outcomes that customers recognize as valuable.

Cybersecurity Expertise Deserves Even Greater Scrutiny

Nowhere is the distinction between presentation skills and actual experience more important than cybersecurity.

Cybersecurity conferences are filled with speakers discussing threat intelligence, incident response, ransomware, business continuity, zero trust, security operations, and executive leadership during a crisis.

Many are highly qualified professionals with extensive experience.

Others have impressive titles and polished presentations but limited practical experience with the situations they are discussing.

Before accepting cybersecurity advice, particularly about incident response and crisis management, I believe we should examine the speaker’s background carefully.

Have they actually provided cybersecurity services in complex, high-profile, or critical environments?

Have they worked in industries where system failures can interrupt essential operations?

Have they managed security programs where availability, confidentiality, and integrity are all critical business requirements?

Have they successfully led security operations, or have they primarily advised others about what they should do?

Professional certifications, formal education, and technical knowledge matter. I strongly support them.

But they are not substitutes for experience.

And experience is not automatically interchangeable.

Someone who has conducted security assessments may be highly qualified to discuss vulnerability management. That does not automatically qualify them to teach executive crisis leadership.

Someone who has analyzed malware may be an exceptional technical specialist. That does not necessarily mean they have managed the business consequences of a major breach.

We need to distinguish between technical expertise, operational experience, and executive leadership.

Knowing how an attack works is not the same as knowing how to lead an organization through one.

Incident Response: Have You Ever Actually Been in the Chair?

This is perhaps the area where I am most critical of industry presentations.

Everyone seems to have an incident response methodology.

We hear about playbooks, tabletop exercises, communication plans, escalation procedures, and recovery strategies.

All are important.

But when someone presents themselves as an incident response expert, I want to know:

What major incident have you personally managed?

Not merely observed.

Not simply studied.

Not attended a presentation about.

Managed.

Have you been responsible for coordinating a significant cybersecurity incident involving hundreds or thousands of employees or customers?

Have you dealt with an incident that attracted national or international media attention?

Have you personally been responsible for coordinating executive leadership, legal counsel, insurers, forensic investigators, law enforcement, vendors, customers, and employees?

Have you made decisions with incomplete information while operations were disrupted and the financial and reputational consequences continued to grow?

Have you managed recovery while maintaining employee confidence, customer relationships, regulatory obligations, and public communications?

And perhaps the most important question:

Can you demonstrate what happened after the headlines disappeared?

Was the organization restored to normal operations?

Were customers retained?

Were employees supported?

Were business relationships preserved?

Were meaningful improvements implemented to reduce future risk?

The technical containment of an incident is only one dimension of effective crisis management.

A serious incident can become a financial, operational, legal, reputational, and leadership crisis simultaneously.

The best technical incident responders bring essential expertise to that effort. But executive crisis leadership requires a different set of responsibilities and experiences.

That is why I want to know whether the person teaching incident response has actually been accountable for the decisions and consequences they are describing.

I am not suggesting that someone must have managed an internationally publicized breach to be a credible cybersecurity professional.

That would be absurd.

I am suggesting that the experience and credentials of the speaker should match the scope of the advice being offered.

A forensic investigator should teach forensic investigation.

A security architect should teach security architecture.

An experienced incident commander should teach incident command.

And someone teaching executive crisis leadership should have relevant experience managing the operational, financial, legal, and human consequences of a crisis.

The distinction is not an insult to anyone’s profession.

It is an acknowledgment that cybersecurity is a broad discipline requiring different forms of expertise.

Cybersecurity Should Be Measured by Business Resilience, Not the Number of Tools Deployed

The same philosophy applies to the cybersecurity products and services we deliver.

Too often, cybersecurity is presented as a shopping list:

Endpoint protection.

SIEM.

MDR.

SOC.

Vulnerability management.

Identity protection.

Email security.

Backup and disaster recovery.

These capabilities can be essential. At Vistem Solutions, we employ many of them.

But deploying products does not, by itself, establish that a customer is meaningfully more secure.

The real questions are:

• Have we reduced meaningful business risk?
• Have we improved our ability to detect and respond to threats?
• Have we reduced the potential duration and impact of interruptions?
• Have we improved recovery capabilities?
• Can executives understand the risks being managed and the results being achieved?
• Can we demonstrate that security investments support the organization’s actual business objectives?
  

This is consistent with the direction of the NIST Cybersecurity Framework 2.0, which emphasizes organizational mission, governance, risk management, and cybersecurity outcomes.

Security should be evaluated in the context of the business it protects.

A cybersecurity stack is a collection of tools.

Cyber resilience is a business capability.

The two should never be confused.

We Should Never Stop Learning—even From People We Disagree With

Let me be clear about something.

I am not suggesting that conference attendees should limit themselves to speakers who are wealthier, more educated, more experienced, or more successful than they are.

That would be intellectual arrogance.

One of the principles I have tried to follow throughout my career is that the person who refuses to learn from someone they consider less knowledgeable may be the least intelligent person in the room.

Some of the best ideas I have encountered came from people with less experience, smaller businesses, or entirely different perspectives.

A technician can teach a CEO something valuable.

A young entrepreneur can identify an opportunity that an experienced executive has overlooked.

A struggling business owner may share a mistake that saves someone else millions of dollars.

And someone whose philosophy differs significantly from mine may challenge an assumption that deserves reconsideration.

The willingness to learn is essential.

But so is the ability to exercise judgment.

Being open-minded does not mean being indiscriminate.

Listen to opposing ideas.

Question your assumptions.

Consider unfamiliar approaches.

But examine the evidence, the experience behind the advice, and the motivation for delivering it.

There is a substantial difference between learning from an unfamiliar perspective and blindly accepting advice because someone has been given a microphone.

My Conference Preparation Begins Before I Arrive

I do not simply arrive at a conference and select sessions based on their titles.

Before attending, I spend time reviewing the agenda and evaluating speakers.

I research their professional backgrounds, education, experience, business accomplishments, and areas of expertise.

I consider whether they have achieved results relevant to what they propose to teach.

I also ask whether their objectives align with mine.

A speaker whose primary motivation is selling consulting services, promoting a product, attracting investors, or developing a personal brand may still offer valuable information.

But understanding those motivations helps put the presentation into context.

My personal evaluation generally comes down to seven questions:

1. What has this person actually accomplished?

Can I verify their professional achievements, business experience, or technical expertise?

2. Is their experience relevant to the subject?

Success in sales does not automatically establish expertise in cybersecurity, operations, or financial management.

3. Can they demonstrate measurable outcomes?

I am more interested in documented results, including lessons from failures, than a collection of impressive claims.

4. Are they teaching principles or promoting products?

Both types of presentations can be useful, but they serve different purposes.

5. What is their motivation?

Are they educating the audience, developing professional relationships, selling services, or pursuing another objective?

6. Do their values and objectives align with mine?

A strategy designed to maximize short-term resale value may not align with a business owner focused on long-term customer relationships, employee development, and sustainable profitability.

7. What will I be able to implement when I return?

If I cannot identify a meaningful opportunity to improve my organization or deliver additional value to customers, I question the value of attending that session.

These questions do not guarantee a great presentation.

But they help make conference attendance a deliberate professional investment.

Stop Confusing Popularity With Authority

Our industry has developed an interesting ecosystem of conference speakers, influencers, consultants, vendors, analysts, and recognized personalities.

Many contribute tremendous value.

But we should be careful about allowing visibility to become a substitute for independent evaluation.

The number of times someone appears on stage does not necessarily establish how successful they are at the business they teach.

The number of social media followers they have does not establish technical competence.

An impressive title does not establish operational experience.

And an expensive presentation does not transform an opinion into a fact.

Conference organizers also have a responsibility to audiences.

Speaker selection should emphasize demonstrated expertise, relevant experience, and educational value.

Commercial sponsorship and genuine educational merit can coexist, but audiences deserve to understand the difference between sponsored content and independent professional instruction.

We should welcome new voices and emerging professionals while applying reasonable scrutiny to the claims speakers make.

The objective should be better education, not an exclusive club of established personalities.

The Real Conference ROI Begins When You Return Home

Conferences are expensive investments.

Registration fees, travel, hotels, meals, and several days away from your business all contribute to the cost.

The largest expense, however, may be the time spent away from customers, employees, and strategic priorities.

So I believe conference return on investment should be measured by more than the number of sessions attended, contacts collected, or vendor demonstrations completed.

What did you learn that changed your thinking?

What did you discover that will improve your organization?

What processes can you improve?

What risks can you reduce?

What measurable business outcomes can you deliver to customers?

What assumptions did you challenge?

And what advice did you consciously decide not to follow?

Sometimes the most valuable outcome from a conference is confirmation that your organization is already pursuing the right strategy.

Other times, it is discovering that an accepted industry practice is not appropriate for your customers or your business.

Either outcome can be valuable when supported by careful evaluation.

My Challenge to the MSP and Cybersecurity Industry

After more than 27 years operating Vistem Solutions, I remain convinced that our industry’s greatest opportunity is not selling additional licenses, expanding technology stacks, or finding new ways to package commodity services.

It is delivering measurable business outcomes through technology, cybersecurity, professional expertise, and meaningful customer relationships.

Technology vendors are important partners in that mission.

But they should not define our value proposition.

Our expertise should.

Our execution should.

Our results should.

And as we attend the next round of industry conferences, I encourage every MSP, MSSP, technology service provider, cybersecurity professional, and business owner to become a more discerning consumer of industry advice.

Evaluate the speakers.

Verify their experience.

Question their assumptions.

Understand their motivations.

Listen to perspectives that challenge your own.

And never confuse confidence with competence or popularity with proven success.

The best conference speakers should leave you better equipped to run your business—not simply better prepared to sell someone else’s products.

Most importantly, remember that your customers are not paying you to attend conferences, collect certifications, or build impressive technology stacks.

They are paying you to help their businesses succeed.

That is the outcome that matters.

Keith J. Nelson, Ph.D., is CEO and Chief Information Security Officer of Vistem Solutions, Inc., a technology and cybersecurity services company founded in 1999. Vistem provides managed IT, cybersecurity, strategic technology consulting, and operational support, including long-standing services supporting critical West Coast port operations. Nelson advocates for outcome-driven technology services, cybersecurity resilience, and measurable business value.