On Location With Sean Martin And Marco Ciappelli

“These Aren’t Soft Skills — They’re Human Skills” A Post–Infosecurity Europe 2025 Conversation with Rob Black and Anthony D'Alton

Episode Summary

Episode Notes

Title: “These Aren’t Soft Skills — They’re Human Skills”

A Post–Infosecurity Europe 2025 Conversation with Rob Black and Anthony D'Alton

Hosts

Sean Martin, Co-Founder at ITSPmagazine
Website: https://www.seanmartin.com

Marco Ciappelli, Co-Founder, CMO, and Creative Director at ITSPmagazine
Website: https://www.marcociappelli.com

___________

Episode Sponsors

ThreatLocker: https://itspm.ag/threatlocker-r974

___________

Yes, Infosecurity Europe 2025 may be over, but the most important conversations are just getting started — and they’re far from over. In this post-event follow-up, Marco Ciappelli reconnects from Florence with Rob Black and brings in Anthony D’Alton for a deep-dive into something we all talk about but rarely define clearly: so-called soft skills — or, as we prefer to call them… human skills.

From storytelling to structured exercises, team communication to burnout prevention, this episode explores how communication, collaboration, and trust aren’t just “nice to have” in cybersecurity — they’re critical, measurable capabilities. Rob and Anthony share their experience designing real-world training environments where people — not just tools — are the difference-makers in effective incident response and security leadership.

Whether you’re a CISO, a SOC leader, or just tired of seeing tech get all the credit while humans carry the weight, this is a practical, honest conversation about building better teams — and redefining what really matters in cybersecurity today.

If you still think “soft skills” are soft… you haven’t been paying attention.

⸻

Keywords: Cybersecurity, Infosecurity Europe 2025, Soft Skills, Human Skills, Cyber Resilience, Cyber Training, Security Leadership, Incident Response, Teamwork, Storytelling in Cyber, Marco Ciappelli, Rob Black, Anthony Dalton, On Location, ITSPmagazine, Communication Skills, Cyber Crisis Simulation, RangeForce, Trust in Teams, Post Event Podcast, Security Culture

___________

Resources

Learn more and catch more stories from Infosecurity Europe 2025 London coverage: https://www.itspmagazine.com/infosec25

Catch all of our event coverage: https://www.itspmagazine.com/technology-and-cybersecurity-conference-coverage

Want to tell your Brand Story Briefing as part of our event coverage? Learn More 👉 https://itspm.ag/evtcovbrf

Want Sean and Marco to be part of your event or conference? Let Us Know 👉 https://www.itspmagazine.com/contact-us

___________

Episode Transcription

“These Aren’t Soft Skills — They’re Human Skills” A Post–Infosecurity Europe 2025 Conversation with Rob Black and Anthony D'Alton

Rob Anthony and Marco

Marco Ciappelli: [00:00:00] There we go. Welcome, everybody. We are still in London. No, I’m lying — I’m not in London. These guys are. But this is a follow-up conversation from our On Location coverage. It was less than a week ago — actually, a week ago — in London, at the Excel during Infosecurity Europe 2025. Now I’m in Florence, and I’m reconnected with London again and…

…with this guy, Rob. He won’t leave me alone. I had to interview him twice On Location — bringing really cool people. Just kidding. I really enjoyed our conversation. I enjoyed it so much, Rob, that I kicked out Sean, and now you’re my co-host. So hey—

Rob Black: I feel honored. I hope Sean knows about this. I hope we’re not cheating on him. I hope that’s how it works there.

Marco Ciappelli: Oh, he knows. He’s very happy about it. So, OK.

Rob Black: Good.

Marco Ciappelli: Yeah, you’re good. You’re good. Oh no, good to—oh, absolutely Rob. Always good — and always good to talk about a different angle of cybersecurity. It’s not too much IT — and people who know me, know that’s what I’m about: society and technology.

So I love to talk about these kinds of things. And for people watching, there’s Anthony there, which — Rob, you brought him. So you know, you do the honors.

Anthony Dalton: It’s your fault, Rob.

Marco Ciappelli: It’s your fault. You deal with it.

Rob Black: Bring-your-friends-to-work day, isn’t it? No, well — so following up from what we were talking about, perhaps to tee it up a little bit — and then I’ll allow Anthony to introduce himself:

We were talking very much about needing to work effectively across teams and get the best out of people. And I thought, when we were having that conversation — there’s so much more we could be talking about in that space.

And I’ve been excited in overlapping with Anthony, and the company he’s been working with — or working for — and what they’ve been producing and focusing on, because I think this is something we really need to see more of.

So that was why I said, “Anthony, what are you up to? Are you free? Can we wrestle you away for a little while?” And he checked his diary and realized he didn’t have anything in his calendar. So we arranged this.

Anthony, perhaps now I’ll let you do the proper introduction — rather than my explanation of how we ended up dragging you onto a call.

Anthony Dalton: Yeah, thanks. I think I’ve got nothing on my calendar because I’m really no one interesting, I guess. I suppose — usually for a podcast guest — I’m not ex-intelligence agency, or ex–big company CISO, or superstar researcher or anything.

I suppose me — I’m basically a story nerd. That’s what I am. So as a one-time national newspaper journalist, I kind of fell into cybersecurity in the early days — you know, when ransomware was a consumer problem, not an enterprise problem.

And I took my love of stories from being a journalist into cybersecurity because cybersecurity is a fascinating space — it’s all about spies and criminals and dystopia, the sort of thing journalists latch onto.

And now I sort of apply that love of stories to cybersecurity. So it’s a healthy dose of marketing things. I also create and run cyber crisis exercises. I’ve done that previously. But largely what I do is help cybersecurity startups figure out what they should look like and how they take themselves to market — all that kind of interesting stuff.

And I’m currently working with a company called RangeForce, which has a platform that does team exercising and cyber skills development for defensive teams — SOC teams, blue teams.

I’ve been in cyber skills for a bunch of years now, working with platforms. I find it the most fascinating and interesting space, because technology is largely quite predictable and dry — but humans are a bit crazy, and you can’t tell them what to do. They turn up to work hungover, and they’re stubborn, and stuff like that.

So that’s where there are far more colorful points and interesting things going on — in cyber skills. That’s where I spend my time focusing now.

And we’ve just done some interesting work in kind of soft skills, and I think that’s where Rob and I have crossed over a fair bit recently.

Marco Ciappelli: Yeah. And Rob, you brought part of this into the conversation when we were there in the press room. That was about bringing different teams in — so we can probably start with that, right?

Rob Black: Yeah, absolutely. So I’ll perhaps give you my reason for focusing on it as well. I run a university student competition focusing on leadership skills and soft skills in cybersecurity — empowering students who wouldn’t otherwise have necessarily seen themselves having a career in cyber, because they’re not deep technical specialists.

To realize that there is such a breadth of careers in cyber. And that soft skills — or complementary skills, as they’re often called — are so critical and necessary, particularly as you progress up the ranks in cyber.

You can do your deep technical work, but if you’re going to be shaping an organization, you need to go out and influence. If you’re going to be managing a team — or working in a team — you need to work and communicate effectively. You might be working on a complex problem together.

So how do you understand the uncertainty you are sharing across different points, and how do you get someone else to appreciate that perspective?

For me, I spend a lot of time encouraging students to practice these soft skills and to see the value of them in the industry.

Through conversations with Ant, we were looking at this going, “This is quite cool,” because it’s not just about improving the individual. It’s not just about a solo person’s technical capability.

I want to understand how I can get the best out of my team. I think CISOs, heads of cyber threat intelligence, or heads of SOCs — they really need to bring the best out of their teams. And that brings in a range of additional features and considerations that so easily get overlooked when we get distracted by the shiny, snazzy, technology-focused side of cyber.

And that was what I thought was really cool.

Anthony Dalton: Yeah, I couldn’t agree more on that. I once spoke to a CISO who told me that cybersecurity defense, in their perspective, is made up of capabilities. A capability is basically your ability to address a risk. He said each capability is made up of people, processes, and technology — which, you know, we’ve heard before in cybersecurity.

I think in our industry we tend to over-index — like, heavily — on the technology side of things, and so much less on people and probably processes, in my opinion. I think the challenge that we all have is getting people to see this. And crucially, it comes down to money — fund it. Fund skills development, team development, etc., rather than just throwing money at technical panaceas.

To me, that’s the challenge we currently have. I think we’re in a position now where you can only really make incremental gains with tools. For 20 years we’ve been tweaking tools as threats change — it’s kind of a game of who’s slightly ahead the whole time. That’s great, but it means you can only get slightly better each time.

Soft skills — in particular — we’ve never really done this. So to me, that says there’s a huge latent opportunity for massive positive change. It’s kind of a weapon sitting in the corner of a warehouse under a canvas, just waiting to be deployed. I think the more conversations like this we can have — about how we can understand soft skills better, how we can measure them, how we can write them down, name them, and figure out what they are and how they’re used in incident response — the better. The more we can use them as the weapon they can be.

Marco Ciappelli: Yeah. And I think that when I talk about educating the general public — kids, parents, grandparents, people who are not in the cybersecurity industry — it’s kind of the same thing.

I know we’re talking about training corporate teams here, but we’re still human. We all react to those DNA-level, instinctual behaviors — prehistoric instincts. That’s how social engineering is so successful: we’re still reacting to fear, to alerts, to the heartbeat going up, and we kind of freak out. Then we’re more vulnerable.

Technology can help a lot — alerting us that something may be going on — but ultimately, we’re the ones that have to make the final decision. And I remember years ago when I started in cybersecurity — coming from a completely different field — I was kind of thrown off by the idea that cybersecurity’s ultimate goal was to be invisible. That people shouldn’t even notice cybersecurity exists. And I thought that was a bad thing — really trusting technology a little too much.

Now we’re back to saying: maybe we need the trained human first — and then use the freaking tool. Otherwise, it’s like a self-driving car. If we’re still driving the car, we need to pay attention.

Rob Black: I think that to me is absolutely critical. We’re ultimately talking about human-machine teaming — and yeah, that’s the buzzword today — but fundamentally, if you’re going to trust and rely on technology in any capacity, then you’ve also got to be able to trust and rely on that technology to help you with your decision-making.

One of the things I also want to highlight is what Anthony said about storytelling and how he brings that into cyber. I’m hearing that so much more now — the narrative. I love that. I think it’s so powerful.

Any situation you’re in — you need to understand your own biases. You need to understand when you’re looking at data, and you’re not looking at it neutrally. What are you missing? Are you leaning too much on one data point?

That bias can also come from a preference in technology. You might say, “I only like this type of tech,” so you look there and nowhere else. One of the areas I’ve found really interesting is looking at how you upskill people, and how you transfer knowledge from an expert to a beginner. That’s a really challenging thing.

The military has spent years trying to crack this — even focusing on language. If you can upskill someone to become a native or fluent speaker quickly, you can save millions. Now apply that to a fighter jet pilot, or a cyber operator: how do you convey knowledge and expertise to someone who isn’t an expert?

Often, that’s done through narrative and story. That’s one of the best ways we learn — as social animals. Storytelling has always been at the core of humanity. Now, we can apply that to how teams work together — how they communicate, what they share, how they share — and turn it from something anecdotal into something rigorous and scientific that enhances skills.

That’s the future to me. There’s been some amazing work in other fields — and now it’s starting to move into cyber. And that’s exciting.

Anthony Dalton: I couldn’t agree more about communication. A big part of my early work at RangeForce was to figure out what problem people were having, because that helps define the narrative you take to market — which is essentially my job.

We spent a lot of time sitting down with SOC leaders, teams, CISOs, etc. We asked what they were struggling with — particularly when it came to skills and people. And we heard a lot about the need for technical skills, which is clear — and totally correct. But the thing that kept cropping up was soft skills.

And when we pushed a little further — asking, “What exactly is a soft skill?” — they always said: communication. Communication was the one thing top of mind. Especially in incident response: how do you string your team together, set objectives clearly, allocate tasks clearly, reconfigure mid-incident, and so on?

The other thing we found interesting was that, once you dig down, another great soft skill is asking the right questions. We’d ask them fundamental things like: “What are soft skills?” “How do you build them?” “How do you measure them?”

No one had a strong answer.

That was when we thought, “Right — there’s really something here.” There’s a deep, misunderstood, or undefined problem that no one has really figured out how to address.

They didn’t talk about soft skills as a tactical thing — something they occasionally need. They talked about soft skills as something strategic — something that could bring real, long-term benefit to their teams. And that was really interesting.

Marco Ciappelli: I’d like to start by just saying: let’s stop calling them soft skills.

Rob Black: Yeah. I hate that term.

Marco Ciappelli: Right? It’s already dismissive. “Soft” — no, dude. No. That’s how Homo sapiens evolved beyond everything else — because communication isn’t “soft.” It’s foundational. Technology didn’t evolve society alone — it was scenario planning, reacting as a team, storytelling.

These aren’t soft skills — they’re our best skills. They’re what make us human.

Rob Black: We run that student competition I mentioned, and we’ve called them leadership skills and soft skills — because no one gets what we mean if we say “human-centric skills.” But that’s what they are. Human-centric skills.

If you look at the latest cybersecurity workforce report from the UK Department for Science, Innovation, and Technology — they call them complementary skills.

They are complementary — but they’re also core. These are critical skills, not “nice to have.” The problem is, we don’t label them that way. We don’t associate them as core components of a role. They’re universal skills. Maybe we should start calling them universal skills instead.

Anthony Dalton: Totally agree. Another term we’ve tried is “teamwork,” but that’s too vague and all-encompassing. In cybersecurity, people trust what they can measure. Tools generate reports. You can track performance. It feels concrete.

With soft skills, you can’t see them. You can’t easily score them. They’re intangible. That makes it hard for people to wrap their heads around — let alone improve or measure them.

That’s why we started building this new framework — to give people something tangible. We worked on it with a brilliant woman, Becca McKeown — a military and cyber psychologist. It sounds a bit tabloidy, which I like.

She works with special forces and infantry teams — looking at how they operate in high-pressure environments and how they can become better teams. Largely through exercising.

We dumped all of this on her desk and said, “We know this is a thing. Help us define it.” And she did — creating a framework that breaks down these skills, names them, helps people see them, score them, and use them. It’s just the beginning, but we think it helps people touch soft skills for the first time.

Rob Black: That’s one of the reasons I really loved the conversation we were having. For me, it comes down to the philosophy of marginal gains — popularized by the British Olympic teams.

They improved everything holistically: nutrition, training, psychology, recovery — every area, not just tech. And it paid off.

That’s what I’m encouraging in cyber: yes, buy the latest tech. But also focus on team effectiveness. Build resilience. Prevent burnout.

Just yesterday, I was talking with a cyber threat intel team leader who rotates his SOC analysts through different roles. He wants them to understand what they’re defending against — to see it from both sides.

Where’d he learn that? Law enforcement. Now he’s bringing that into cyber. That kind of thinking — tweaking processes to get better teamwork — is what moves us forward.

Soft skills — communication, critical thinking, understanding problems as a team — that’s what will make a difference in both incident response and broader security culture.

If we get this right, we’ll unlock massive potential.

Marco Ciappelli: Yeah. And Anthony, before we started talking — I mean, recording — we were talking about how the approach of practice is important. Like, you don’t want to find yourself dealing with an emergency without training and preparation.

But I also think that, when it applies to the team, it’s about how the team functions. I’m thinking of a soccer team — or any sport team, Rob, you’d know this — not everyone plays defense, or no one scores. And if everyone plays offense, no one defends. You’ve got to know how you work together as a team.

Knowing that something isn’t your best skill, but understanding what to expect from the other person when they step in — that’s teamwork. So I imagine, Anthony, when people practice and simulate, they also gain a vision of what others are doing. You’re not alone facing the threat.

Anthony Dalton: Yeah. And the beauty of exercises is that it happens in a safe environment. It’s de-risked. It’s not a problem if you mess up or do something wrong — you’re not going to take down your company’s operations, or crash the share price. You just learn from the thing you did.

That’s the absolute beauty of exercising. We always say: the first time your team runs through an incident shouldn’t be when it’s real — when it’s live — when everything is on the line.

Let’s be honest: businesses have been dragged onto the front lines of a far bigger conflict. More of them are getting hit. And the attacks now have greater significance than before.

So why put your team under that pressure when you can — to use Rebecca, our psychologist’s, words — inoculate them in advance?

There are a few things you can do beforehand. And during an incident, she talks about why it’s good to take a break — take a step back, recalibrate, check that what you’re doing is right, learn from it, share information, refocus tasks, clarify roles.

There’s also a neurochemical element. There’s a lot of adrenaline flooding your brain, and that can actually be unhelpful. It’s called cognitive narrowing — she’s talked about it. Your brain zeroes in and blocks out everything else.

That can be useful in some situations, but it’s dangerous in cybersecurity, where the environment is broad and granular. You can’t afford to get tunnel vision — especially when threat hunting. If you go deep into just one or two areas, where you expect to find IOCs, you might miss everything else.

Marco Ciappelli: Tunnel vision.

Anthony Dalton: Right — exactly. You’ve hit it on the head. Tunnel vision.

So again, simple things: take a step back, reduce the adrenaline, talk to each other, help each other manage stress — and then go again.

Resilience is a big part of the framework we put together — we call it the CREW framework. Resilience includes stress management, conflict resolution, and recovery — meaning, how you move forward from a stressful situation.

I find all this stuff absolutely fascinating, and I hope it’s not just a pet project. I truly believe it can bring huge value in terms of risk reduction more broadly.

That’s why we worked to start categorizing some of it.

Marco Ciappelli: Yeah, I think so too. And as we’re wrapping up — I mean, I could talk about this for a long time, and maybe we will come back — but Rob, one thing I keep thinking about is the gaming approach.

Tabletop exercises — simulations — they’re all kind of “games.” And I like to apply this not just to cybersecurity professionals, but to everyday users too.

Anthony, as you apply this to teams working in cyber, I think we can also apply that to train people not in cybersecurity — just regular people. Prepare them to be more aware.

I’m thinking: what about a video game where kids — or anyone — can practice reacting to a phishing attempt? Or a deepfake video? Or a social engineering message?

Because when that thing happens for the first time — and you’ve never seen it before — you freak out. You have no idea what it is. And that’s when you’re vulnerable. That’s what social engineers want — they want you to freak out.

But if you’ve seen it before — even just in a simulation — you’re a little more prepared. That’s pretty cool.

Rob Black: Yeah. And one word we haven’t mentioned yet — but I think is critical for resilience — is trust.

Trust in a team. Knowing what you’re getting from each person. You only get that through communication, working together, having experience in a safe environment — where the stakes aren’t so high.

When the pressure is on and you’re dealing with millions in potential losses, it’s not the time to be learning. That’s why we train — no judgment, just practice. That’s how we learn.

There’s so much we can borrow from aviation. Pilot training, airline safety — there’s been loads of research into how they work, how they train decision-making and teamwork.

There’s a professor — Gary Klein — who studied how firefighters make decisions in burning buildings. He looked at how teams share knowledge, make fast collective decisions, and transfer expertise.

It’s all about how they train together before it’s life-or-death. And we can do the same with cyber.

With immersive technology, we can now do even more. And I’ll end with an old military saying — the six Ps of planning:

Prior Preparation Prevents Piss Poor Performance.

The more we can invest in this — team-based, trust-driven, skills-enhancing training — the better we’ll be. Not just relying on tech to do the job for us, which is where we started this conversation.

Marco Ciappelli: Yeah. And I just want to end with the storytelling part. Anthony, when you said you come from journalism and stories — that’s key. Even in gaming simulations, we use storytelling to build those scenarios.

Rob, now we have the tech to really do it — with VR, immersive simulation, and more. But even before that, we learned through stories. Stories taught us morals, survival, how to live.

“Don’t go into the woods,” “Watch out for the wolf” — that was education through story. And that’s still how we learn as a society.

Unfortunately, now we don’t even know if the stories are real — but hey, that’s a topic for another podcast.

Anthony Dalton: Yep, I’d love to talk about that one too.

Marco Ciappelli: I’m glad, Rob, that you joined me for this. Anthony, I hope you’ll come back again and keep chatting with us about this or other topics. Even just storytelling. I’d love to dig into that too.

And to everybody listening — this is still a leftover On Location conversation from Infosecurity Europe 2025. But we’re getting ready for Black Hat!

I don’t know who’s going to be there — but I will be in Las Vegas in August. That’s our next On Location event with me and Sean.

I think I’ll let Sean come back for that… unless, Rob, you want to join us in Las Vegas?

Rob Black: I don’t get the Vegas ticket. Yet.

Marco Ciappelli: All right.

Anthony Dalton: That’s probably wise, knowing you, Rob — to be honest.

Marco Ciappelli: Uh-oh, let’s not go there. Anthony, thank you so much. Rob, see you later.

Everybody, stay tuned. Subscribe. Stay with us — ITSPmagazine. See ya.