00:00:02:01 - 00:00:32:14 Speaker 1 Hello and welcome to the latest Fraser of Allander podcast. This is the latest in the series that we've done in partnership with Deloitte, to explore Scotland's economic future. Throughout the series, we've been exploring the opportunities and challenges that we face and related to the energy transition and also digital adoption and diffusion in the Scottish economy. Really trying to focus in on what are the economic opportunities and challenges that these changes in our economy present. 00:00:32:16 - 00:01:11:18 Speaker 1 Today we're going to be talking cyber. Yes, cyber. And also the relationship between the cyber industry and the UK and Scotland and the adoption of AI. And I why I see this podcast being is a bit of a demystification of some of these terms for me, and I add to our understanding of the interaction between cyber security and the adoption of AI in an economy where at least in this for a m, alongside cyber Scotland Week, to coincide with lots of different events and activities that are going on to discuss cyber in Scotland. 00:01:11:20 - 00:01:25:12 Speaker 1 So I'm delighted to say that I've got two ladies here who know a lot more about cyber than me, who are going to join me in this discussion. Firstly, I've got Alex Brown from Deloitte who works in cyber resilience and transformation. Welcome, Alex. 00:01:25:14 - 00:01:26:11 Speaker 2 Thank you. 00:01:26:13 - 00:01:51:06 Speaker 1 And I've also got Karen Meakin, who's the CEO of Scotland s and also the chair of the Cyber Scotland Partnership. Now firstly ladies welcome and thank you for joining me today. And the first part of the Demystification always for my contributors from Deloitte, Alex I'm afraid is to understand and what I know. So you guys do what you do for your clients. 00:01:51:08 - 00:01:58:03 Speaker 1 So what does it mean to work in cyber resilience and transformation in Deloitte? What sort of support do you pray to your clients? 00:01:58:05 - 00:02:18:04 Speaker 2 Yeah, okay. This is a great question. And I think it does come up a lot of what is cyber and what does that mean? And I think fundamentally for me what I'm responsible for is helping our clients understand how cyber resilience can impact their business and help them grow and what that looks like on a day to day basis. 00:02:18:04 - 00:02:40:03 Speaker 2 For me, as what is the rest of those business and what is that business there to deliver, and how can we then help them be secure and ensure that whatever they need to do on their daily basis is done in a manner that aligns with security, best practice, or the ways of working that we should be should be covered in. 00:02:40:05 - 00:03:05:23 Speaker 2 My role is quite broad. I would say, I think people assume cyber is very technical, but actually I'm probably not overly technical, and a lot of my day to day is looking at people, process, technology, culture and change is a big thing that I do on a daily basis. Working with clients to help them adopt cyber and understand actually what that means and how that impacts them. 00:03:06:00 - 00:03:10:22 Speaker 2 So it's a very, very role. But it's exciting nonetheless. 00:03:10:24 - 00:03:19:24 Speaker 1 So that sort of bottom line, you're helping, businesses and other organizations think about their digital security. And this very, technologically advanced. 00:03:19:24 - 00:03:52:18 Speaker 2 World. Yeah, 100%. And I always think that sometimes cyber is forgotten about when you think of a business and it's running and its operations, sometimes the technical aspects, from the digital perspective and particularly cyber, it's not always at the forefront of people's minds. And most roles, particularly for organizations. So I think it's making sure that cyber, as our conversation and people are aware and actually is at the forefront of business planning when we then look at, budget and resource and priorities for the year. 00:03:52:20 - 00:04:07:04 Speaker 1 No, that's a really good point. And we're going to come back to that. And the way that this helps businesses sort of manage the risks, I suppose I a lot of that stuff that Karen, can you tell us a bit about, you know, what Scotland is, is and who you represent. 00:04:07:06 - 00:04:44:22 Speaker 3 So we are the trade body and cluster management organization. You look after all of Scotland's digital and tech sector and within that obviously includes cybersecurity, which underpins all of technology. All needs to be secure and resilient to access point. We've been around for 25 years. We represent over 1200 companies across Scotland's tech ecosystem and our role as their trade body and cluster manager is to advocate for them, for looking at that business growth. 00:04:44:24 - 00:04:58:04 Speaker 3 So everything from lobbying government to making connections to put them in the best position to meet customers, clients, collaborators, it's all about the support of the growth of those businesses. 00:04:58:06 - 00:05:14:18 Speaker 1 Excellent. And we'll talk a bit more about the sorts of businesses in Scotland who are in this kind of the cyber space. Ehm, through the podcast. But can you tell us a bit more about what the Cyber Scotland partnership is, because you're also the chair of that and that's very relevant to our conversation today. 00:05:14:20 - 00:05:55:03 Speaker 3 So Cyber Scotland Partnership is a group of organizations that include people like ourselves that Scotland is but it's the third sector, it's public sector, it's education and the whole ideas around the Cyber Scotland partnership is that as a community, we come together to ensure that Scotland's businesses and individuals, are cyber secure and resilient. So that is everything from understanding what a phishing email is for your elderly parent, to understanding what data your young people are sharing on social media, to making sure that businesses are secure and resilient. 00:05:55:03 - 00:06:16:13 Speaker 3 And it's not just about having the right cyber tools within your business as understanding if there is a breach and when that is a breach, how you bring that business back online and how you continue your operation. So it's not just I've been hacked, we plug in a new piece of software. It's how you recover from that as well. 00:06:16:15 - 00:06:24:01 Speaker 1 So not just the the tools or the kit you buy, but the governance around how you respond and. 00:06:24:03 - 00:06:55:17 Speaker 3 How you respond to how you respond. Best. So we've, you know, how quickly do you respond because you're looking at that trust for your customers, for your partners. And what Cyber Scotland Partnership does is as a group of people from SVR, young Scot and Police Scotland, we all come together as a collaborative group to ensure that we're sharing the right messaging, that AI information, the right upskilling, to everyone. 00:06:55:17 - 00:07:03:09 Speaker 3 And as I see that's from our young people and our citizens all the way up to our boards and our business founders and owners. 00:07:03:11 - 00:07:28:15 Speaker 1 Yeah, I mean, I think the upskilling seems to be really important, you know, you know, so people understand this language, understanding that a lot about to talk about different roles and cyber for example. But how important those are even more so in the world that we're moving into with AI. And a missing link that. So today we're interested in in the cyber industry more broadly and particularly come from your perspective in Scotland. 00:07:28:17 - 00:07:47:16 Speaker 1 The employment that's associated with it and how that's changing in the world, of, of of AI. So, Alex, really basically, for people who are wondering what an asset on about, you know, what the rules and cyber actually involve in different businesses and organizations. 00:07:47:22 - 00:08:16:09 Speaker 2 Yep. Okay. So I think it's a really large spectrum. I think people will hear cyber and assume that it's purely technical, that you need to code and be able to engineer systems. And whilst that is true, I think there's also so much more that cyber encompasses. And from my perspective, I think it's looking at things like strategy, it's looking at risk, understanding our business. 00:08:16:11 - 00:08:37:14 Speaker 2 We need to be able to work with clients or organizations or the community to understand what are the challenges that they're facing, and then how can we support them, whether that is through a new policy, through a process, or through a technical solution. So I think from a role perspective, it's so much broader than what people assume. And it's not just techies. 00:08:37:14 - 00:08:41:04 Speaker 2 It's also everything else that encompasses that. 00:08:41:06 - 00:09:06:21 Speaker 1 Yeah, that's that's really interesting. I because I think like you say, that would be what people generally think of as people who would need to code or engineer systems. But this wider spectrum around, yeah, those governance policies, you know, that the solution might not be about technical or that might be something different. Kind of thinking about your network and your, your members, you know, does that change with you? 00:09:06:22 - 00:09:11:13 Speaker 1 What sort of roles are your members, you know, looking to recruit, and are any of them struggling to recruit? 00:09:11:13 - 00:09:40:20 Speaker 3 So, absolutely, to Alex's point, the the opportunity in cyber as varied and vast, I think we we both agree with that when we do, an annual survey of Scotland's tech ecosystem, we will look it's almost like a health tech who's doing well for the challenges we do. The struggles skills has by far always been top of the challenges, for nigh on 20 years now. 00:09:40:20 - 00:10:07:03 Speaker 3 And there's good and bad in that. The good is that digital underpins every sector. So there are more requirements for the skill sets and sectors that maybe 10 or 15 years ago where we can, you know, are software engineers or cyber specialists. But when we look at our survey, cyber and I are absolutely top of that list. 00:10:07:03 - 00:10:36:13 Speaker 3 Cyber, the identity of tops e sales and marketing have historically always been a challenge. But the and we out with our survey. We're doing some analysis now for 2026. That hasn't changed. But then when we look at and 2018, we created our cyber cluster. And at that point we had 120 cyber companies in Scotland that were part of that cluster, because that's how many cyber companies were in Scotland at that point. 00:10:36:15 - 00:11:03:18 Speaker 3 Well, on to 2025. And that cluster has grown by well over 200%. And that just goes to show the importance of cyber security across every sector as technology changes. One of the things that we've advocated in our sector has for a number of years is that secure by design rather than a technology, it works. Now let's make sure that it's unbreakable. 00:11:03:18 - 00:11:17:19 Speaker 3 Audit secure. That's not how the industry works. So the relevance of cyber and the rules, as Alex said, are vast and varied and still required and required more given the developments and technology. 00:11:17:21 - 00:11:28:09 Speaker 1 As a membership organization. I'm curious, you know, what do you see as the benefits of creating that, that cluster, you know, that focal point? Yeah. How does it how does it help you as a membership organization? 00:11:28:09 - 00:11:55:11 Speaker 3 You sold for awesome, actually, for the members who the cluster is created for brings to light those challenges that are seen across that sector. So yeah, it's not for some of it. It's that opportunity for that peer to peer. You know, this is my challenge. How you doing it. We've got things like a seesaw safe space where we bring the CISOs together from across industry who can chat around some of the challenges that they're facing in their role. 00:11:55:16 - 00:12:21:14 Speaker 3 Very demanding role. So having someone who absolutely understands the pressures you're under, but for us, it allows us to go to governments and lobby on behalf of. We know that 300 of our 400 cyber companies in Scotland have this challenge, and that's where the Cyber Scotland partnership comes in as well. They've just released a new, strategy for 25 to 30. 00:12:21:14 - 00:12:43:04 Speaker 3 And that talks around making sure that we're ensuring the security and the resilience of the whole of Scotland. So that allows us to feed from an industry perspective, some of those challenges and to the strategies. So the policies and things, as Alex said, can be created to help solve or support some of those problems. 00:12:43:06 - 00:12:52:08 Speaker 1 And Alex, thinking about the organizations that you're working with, at the source of fame, you know, skills and roles that kind of talked about are the ones that you're seeing and demand from them. 00:12:52:10 - 00:13:13:06 Speaker 2 Yeah, definitely. I think everything that you've mentioned that it brings about, and I think we see that within, industry, not just specifically the industry that I work in, which is more focused around government and public sector. But I think when we look across all of our clients and all of our industries, there does seem to be similar trends and following a similar theme. 00:13:13:08 - 00:13:35:20 Speaker 2 And I think it's really interesting that you mention Secure by Design, because that's something that we have seen a growth and that area over the last couple of years. And when you look at Secure by Design again, it's it's a big topic. And actually it's not just one specific skill set that we're looking for. It's a combination and a combination of different types of people with different skills. 00:13:35:22 - 00:13:47:18 Speaker 2 And I think your point on collaboration is, is so key. You know, I think we look at the benefit that we can work across the industry and understand skills and what's needed and, and share that knowledge and share that learning. 00:13:47:20 - 00:14:06:12 Speaker 1 Yeah. I suppose from the point of view of someone like Deloitte, you create that, you create a different sort of cluster of of clients who are dealing with similar issues. And so it's interesting to bring your together today to talk about this. I think to see that sort of cross-industry and cross, like I said, you work with clients across the UK and across the world. 00:14:06:15 - 00:14:39:04 Speaker 1 Alex. Yeah. So that's really, really interesting to see the contrasts. So we've mentioned dialog a lot. And when I was speaking to some people who don't know anything about the cyber industry or ever, and this is probably back to our misconception that it's all about coding and system engineering. You know, a whole with all these rules or whatever, you know, will be replaced by, you know, there's there's lots of discussion about that, lots of rules and lots of industries at the moment. 00:14:39:06 - 00:14:52:12 Speaker 1 But, you know, we'll get into the extent to which that's true. But let's start with Alex, how you CIO? Or already changing the sort of the cyber landscape. How is that happening? 00:14:52:14 - 00:15:26:12 Speaker 2 Yeah. Okay. I think this is a really interesting question. And I can almost take it from different perspectives. I would say internally within, you know, consultancy firms and within my organization. I think there has been change recently. And I think it's how can we use AI and automation to streamline to make things more efficient? How can we use that to take maybe mundane level tasks off of people and actually then allow them to do something that's more rewarding or more beneficial? 00:15:26:14 - 00:15:50:13 Speaker 2 And then when I look at that from a client perspective, you know, what am I seeing an industry? I think it's similar in the sense of they're curious, what can I do for them? Is that the right choice? What's the risk behind that? And I think for me it makes it a really interesting conversation because whilst we are, you know, pushing the adoption, I say the next buzzword, it's what everyone's looking forward to. 00:15:50:15 - 00:16:10:21 Speaker 2 I think also does bring the challenge of what is the risk behind it, what are the controls, how do we govern it. So it makes it a really interesting landscape to play in from my perspective, because whilst we are adopting it and using it and it's beneficial, we also just need to be considerate so we're not running before we can walk. 00:16:10:23 - 00:16:31:15 Speaker 1 So thinking about people working and and cyber sim specifically, then you know, can you give examples or give us a feel for, where I might be used in a positive sense, I suppose, to make that job easier. Yeah. Or more efficient. And I guess where it introduces risks on the cyber side. 00:16:31:16 - 00:17:02:21 Speaker 2 Yeah. So 100%. So I guess my example, I would say so if we look at security operations and we're looking at a tool that can look at an organization's, they are and highlight risks or threats. There's so much we can automate and not where we can automate playbooks in the background, so that it will automatically tell us if they think there's a malicious behavior, or to something that doesn't feel quite right. 00:17:02:23 - 00:17:30:23 Speaker 2 To be able to automate that saves so much time. Someone doesn't need to sit and watch a screen and do that. Analysis of the two can do it for them. Great benefit. It saves time as a fashion, and it also means that our people are then free to do more technical analysis. So great benefit, great efficiencies. But then on the flip side of that, we're then reliant on that automation being correct. 00:17:31:00 - 00:17:57:23 Speaker 2 At some point someone has had to build that automation that's running in the background. It's analyzing data. It's taking data from different sources. And I think we just need to make sure that we're comfortable and confident that it's doing it as we expect it. So I think there's a positive because it saves time. It's efficient. But also from a more negative perspective, how do we know that it's doing its job right? 00:17:58:02 - 00:18:00:22 Speaker 2 If we've not got humans looking at it? 00:18:00:24 - 00:18:02:11 Speaker 3 Yeah. 00:18:02:13 - 00:18:13:14 Speaker 1 And Karen from from your members and you're talking to the industry, does this change with you? Is this, is this these are the sorts of opportunities that people are looking at, but also the risk that people are looking at. 00:18:13:14 - 00:18:40:20 Speaker 3 Oh, absolutely. I agree with everything that Alex says, although the AI tools are being used more. But then say before it was Alex says that can it that analysis that repetitive monitoring routine tasks it is but but cyber skills are still required because to Alex's point, we need someone who can interpret the information output from the AI. 00:18:40:20 - 00:19:01:24 Speaker 3 We need someone for that. A human in the loop who can make the decision, who can look at that, can a strategic outlook and look at that risk? I can't do all of that. So although they are being utilized in the sector, that is absolutely still a requirement for that knowledge and that human interaction. 00:19:02:01 - 00:19:25:16 Speaker 1 And how well, how much do you see? Your members are office across the digital landscape, you know, so I imagine will be at the frontier of looking at AI adoption and their, their businesses. You know, to what extent do you see them? I don't know, I suppose. Nervous about adoption due to some anxieties about security. You know, how much are they thinking about that risk? 00:19:25:16 - 00:19:27:03 Speaker 1 I suppose, as part of adoption. 00:19:27:03 - 00:19:50:08 Speaker 3 So I think for our sector in the tech sector, given that our members are the organizations who are creating the AI tools. And as we said at the beginning, everything is secure by design now from our sector. So that will be at the very top of their list. If they are looking at AI and creating AI tools to then sell or not. 00:19:50:08 - 00:20:13:17 Speaker 3 Other businesses to utilize security and governance will be the priorities, because that's where the scare comes from, from other organizations who are outside. You know, Alex's role in the company she's working with and certainly in Scotland as members is they don't quite understand. And I think some of the myths that we are trying to dispel as AI is not new. 00:20:13:19 - 00:20:14:10 Speaker 2 Yeah. 00:20:14:12 - 00:20:46:06 Speaker 3 Okay. It's a it's not a new technology has been around for decades. It's a new development. It's it's the next stage from when you had server rooms in here that were probably as big as this floor. That is now also in the cloud. And it's just that move what we because of the landscape that we run just now when we're looking at fear actors who utilize AI tools that can be damaging to businesses if they're not aware of their own cyber resilience and cyber landscape. 00:20:46:08 - 00:21:09:08 Speaker 3 And so that's that's the scary part. What we are trying to see to businesses outside our sector is understand what you want to use. The AI for it, what's the problem you're trying to solve. And in and sure, to Alex's point, whatever data sets in the back of that is the right data. So there's giving you the right output to solve the challenge or the problem that you're looking for the AI to solve. 00:21:09:08 - 00:21:16:05 Speaker 3 It's it's not you know, it's not the silver bullet, but understanding it can be. 00:21:16:07 - 00:21:36:20 Speaker 1 I mean, that advice has got to be so useful at the moment. Because to me, when when you talk, I think maybe especially to the politicians or people who are sort of crossing their fingers that this will solve all our productivity problems, you know, that it will be the silver bullet, essentially. So that sort of advice, ehm, I guess that was you were nodding, Alex. 00:21:36:20 - 00:21:42:16 Speaker 1 That was take with you when you're speaking to clients. I mean, especially in the public sector, probably not 100%. 00:21:42:18 - 00:22:01:11 Speaker 2 And I think it's really interesting. I think you raise such a good point around what is a problem and what is the challenge. And I think nine times out of ten, that's how my conversations start, because sometimes we get clients who are really keen to use AI and they're like, give me a call, I'll take whatever you can do. 00:22:01:13 - 00:22:21:16 Speaker 2 And for me, it boils down to but why? You know, what do you actually want from this? And then that helps the conversations where we can then advise and give guidance, and they can then get the best out of it without charge and ahead, or rushing into things where security might sort of fall down later down in the line. 00:22:21:18 - 00:22:40:11 Speaker 1 But I mean, it's I mean, I suppose and many things when the organizations are looking for help, that's that's the important question to ask. First you what's what's the probability hundred percent? But, I think that's really important advice from the kind of corporate point of view from Deloitte, but also for you for for the businesses outside your sector, people. 00:22:40:11 - 00:23:06:04 Speaker 3 Hear the great stories about how high has, you know, helped productivity. And it doesn't that are cases of where there are great AI tools doing great things. But you hear snippets of that and think, well, that that will work for my business without really understanding what it is that you're trying to solve. So yeah, the conversations that Alex is having with hard businesses, as much the same as but all having when it comes to I know. 00:23:06:09 - 00:23:29:10 Speaker 1 Absolutely. So think it a bit about, what we've been talking about, on a, you know, the security concerns, thinking about what problem you're trying to solve and all of this, a how how important would you say a Karen, is is ethics and governance and all of this. 00:23:29:16 - 00:23:52:00 Speaker 3 And I think it's key. It's got to be key. It's got to underpin all of it. Because actually, whatever it is that you've got underpinned that cyber resilience piece needs to underpin your business. And that's part of what we do. The Cyber Scotland partnership and with the cluster absolutely has to. You could have the best tools there could be wonderful. 00:23:52:02 - 00:24:21:14 Speaker 3 But actually if your business is breached, if you lose lots of data, there's no I think we spoke about the same earlier. There's a new, we've been speaking to a number of companies around the new class action case, that may be coming down the track in Scotland. So when it comes to governance, on any of your tools, whether the RBI or any other tool, it is absolutely a fundamental must know. 00:24:21:14 - 00:24:29:09 Speaker 1 Absolutely. And Alex, how how much of your conversations with clients just does that sort of take up compared to the technical solutions? 00:24:29:11 - 00:24:55:12 Speaker 2 I think it's a conversation. I think people are aware that governance is important, and I think a lot of those conversations and lead to what does that then mean? I think we can say governance. And some people understand to what extent or what does that look like. So I think for me, a lot of the conversation is how can we make sure we're building really robust governance and and that covers what it needs to be covered. 00:24:55:14 - 00:25:08:11 Speaker 2 And I think it is so important, I think we can throw tools at any problem and it might solve it, but if it isn't backed by strong, robust governance, then it's bound to fail in one way or another. 00:25:08:13 - 00:25:32:03 Speaker 1 And do you see that as any different for, you know, data, AI tools or other AI tools as opposed to other, you know, the previous versions or previous iterations of of digital adoption, I suppose, comes with the point that, you know, he he's been around for decades, but do you think this is just an evolution of the same problem, or does I, you know, bring in a new, fresh problem? 00:25:32:05 - 00:25:54:19 Speaker 2 I do think I think governance has always been something that's been discussed and considered. But I do think with the AI, it has become more important. And I think that's a good thing. I think when we look at AI or we talk about AI, I do think now a lot of people are considering governance, whereas maybe before it would have been a we could do it, we could not do it and everything would be fine. 00:25:54:19 - 00:26:02:14 Speaker 2 But I do think now, rightfully so, there is much more of a lens and a push to focus on that governance piece. 00:26:02:16 - 00:26:23:10 Speaker 1 Yeah. Absolutely. And this may link to, to that question around ethics, governance, and the amount of your time that might be spent on these sorts of issues with clients. Because if we think about cyber rules in the future and say, five, ten years time, 00:26:23:12 - 00:26:24:06 Speaker 3 What can you. 00:26:24:06 - 00:26:32:04 Speaker 1 Both see are new or maybe more important rules as, as AI is adopted, more widely across the economy. 00:26:32:06 - 00:26:53:23 Speaker 3 So, would there will certainly be AI specific cyber rules. That has to be. But then if you look at that transition of analysts to data scientists, it will just be a a different version of the same rule, if you see what I mean. It's just new tools because I think that's the point they have to make AI as a tool. 00:26:53:23 - 00:27:29:01 Speaker 3 It's just a new developed tool as all as so so the cyber risks will still be there, the governance will still be there, the ethics will still need to be. We can't look to that. The resilience will still have to be a focus. So we will see things like, AI product managers or AI cyber specialists or, and part of that will just be understanding the tool and how that works and understanding the output and the risk within that tool. 00:27:29:01 - 00:27:51:01 Speaker 3 So I suppose it won't be any different to taking on a new API when API's kicked off, you know, understanding where that links were. That leaves you open to risk. So I think we'll have a new a few new job titles. I don't know that the very fundamental elements of that all will change. 00:27:51:03 - 00:28:08:00 Speaker 1 And I think that point, as someone who is an analyst, that sort of evolution into the language or in data science and the tools, you know, that we used before and how they've developed, I think is a really good analogy for perhaps what's going to happen. What about you, Alex? What can you see as new rules in the future? 00:28:08:02 - 00:28:28:04 Speaker 2 I completely agree, I think when we seen the move to cloud a few years ago, all these rules started popping up. It was cloud architect or a cloud engineer, and I think you're right, Karen. It's I think it's just a different flavor of very similar rules and similar skill sets. I think we will see it become a specialism. 00:28:28:10 - 00:28:46:21 Speaker 2 AI there will be people that that is their bread and butter and they understand it. And I do think that is so key, so that we can ensure that would adopt an AI securely. But I do think fundamentally, a lot of the types of rules and types of skills will be very similar. People will just have that AI flavor weaved through it. 00:28:46:23 - 00:29:09:24 Speaker 1 Yeah. And I suppose you mentioned the two really key phrases secure by design and human in the loop as well. So I suppose like you were saying earlier, Alex, there is a potential obviously for AI to streamline particular processes in the cybersecurity landscape. But, you know, always human in the loop. You know, this is not these rules aren't going to become automated in any way because because of the nature of them. 00:29:09:24 - 00:29:32:07 Speaker 2 Yeah, not at all. And I actually think there is a benefit to the automation because actually it will free up our junior analysts to actually do, work. That's probably more interesting. Doesn't take as much time, and they will be able to develop themselves quicker because they're not having to do these basic tasks that we can now do through AI. 00:29:32:09 - 00:29:46:00 Speaker 2 So I actually think that it's a great benefit when we think about educating our workforce and growing their skills and developing them. I think it will actually make it a quicker, all around more enjoyable experience for them. 00:29:46:02 - 00:30:16:21 Speaker 3 And it helps with the skills gap that we have, because now we're not looking at, I mean, our sector alone creates over 15,000 jobs a year, and we don't have the people to fill them. So if we can automate some of this stuff and take some of the people who are already in our businesses and in our sector and upskill them or move them sideways to give them something more exciting or demanding to to work with, that can only be a good thing. 00:30:16:24 - 00:30:18:05 Speaker 3 Surely? 00:30:18:07 - 00:30:41:02 Speaker 1 Well, to me, that brings me all nicely to the next topic I wanted to discuss, because I'm thinking about a about skills. And you know what we need from people that we want to work in the cyber industry in the future. What sort of skills do we need? So who does the skill system respond? You know, what are the skills that they need? 00:30:41:04 - 00:30:46:01 Speaker 1 And how is that changing? Given the sort of AI adoption. 00:30:46:03 - 00:31:08:16 Speaker 3 So I think certainly, we do a lot of work with the education sector, obviously, because we are trying to plug the skills gap that I feel we just oh, it's just never ending done. But I see the positive to that as because actually the demand for the skills that were typically on the tech sector are now required to be, right. 00:31:08:16 - 00:31:36:24 Speaker 3 So, so it's that growth of that need, and the growth of the sector, which is good, that is always good. But we work with across all the education sector around how we encourage that pipeline of new technologists or, you know, new quarters or whatever it is, end to the sector. So currently we Scotland is run, Scotland does scholarship. 00:31:36:24 - 00:32:02:08 Speaker 3 We were working with S4 kids to help them through not five maths because that's a fundamental requirement for any Stem career we're taking into them. People like Alex and others who are at the coalface of this to show them what a career in the tech sector looks like, and dispel some of those myths of being stuck in a corner in a dark room, commuting all day on your own. 00:32:02:08 - 00:32:50:06 Speaker 3 That's not what I couldn't be further from. The truth of what our sectors like. We've got, a Placement Scotland program which brings students from college and university into industry to get paid placements. So that they're getting that work experience when they graduate, come into the sector. It's not all new to them. And we created in partnership with Scottish Government, and I should have called Cyber Drive with West Lothian College and ultimately Porter, as is a transit van packed full of equipment that goes round schools and community groups and West Lothian and sets up, on site cyber labs for the kids to, you know, to capture the flag, just double and cyber security, 00:32:50:08 - 00:33:14:22 Speaker 3 and just see what a career in that could be. So there's lots happening within the education space. Our schools are looking I mean, we've got the cyber first schools in Scotland now, I think was more in Scotland than there is down south. Thanks to education Scotland and the team there. So there's lots happening. We've got an addition to the, the Political Friends program. 00:33:14:22 - 00:33:33:02 Speaker 3 We were taken in district practitioners and to schools in Scotland to show them the tech sector, to show them what it's like, because we know that the first couple of years of our curriculum and it goes to computer science is not exciting. And it's not. And that's some of the challenges we have when we're looking at diversity into the sector, which I know. 00:33:33:04 - 00:33:50:18 Speaker 1 Yeah. Oh come on, I'll come back to that. So it sounds like I mean, it's a huge different a variety of activity that you've got going on visually all to target different problems that you see. You know, some of it's about the perception of these roles, some of it's about the wee subject. The subjects are taught. Yeah. 00:33:50:20 - 00:34:04:07 Speaker 1 Which, you know, perhaps something could be done about maybe in the future. But you're, you're, you're doing different sorts of activity to raise awareness, support where necessary. Yep. And yeah, dispel some of these myths. 00:34:04:07 - 00:34:29:14 Speaker 3 Absolutely. And thankfully, the whole education sector is on board. You know, that our universities looking at, you know, what their curriculum looks like now, based on the developments and technology of what is a computer science degree look like, we've got the reform for Education Scotland. Now they're looking at their curriculum and how that all works. And you know, so there's lots happening. 00:34:29:14 - 00:34:47:15 Speaker 3 There's lots of activity at education sector as aware of the challenges that our sector and the economy sees. And they are working with us to find new ways to make sure that we've got the skill set for our young people who are coming into the sector. 00:34:47:17 - 00:34:59:09 Speaker 1 And, Alex, I know that you I think you do some careers fairs and this sort of thing, you know. So what's your experience of interacting with young people who are considering a career like yours? 00:34:59:11 - 00:35:31:06 Speaker 2 It's interesting. I think sometimes when I go to careers fair, you, you can tell that people are surprised at cyber as a career and they maybe don't know a lot about it. And I turn up and try to talk about cyber, and I spend a lot of time answering the question of what is cyber? But I do think over the last couple of years it's been really nice to see, like that slight change that now people are aware of, that you're all in cyber careers and they maybe know a little bit more about it because they've been educated either through university or through schooling. 00:35:31:08 - 00:35:51:23 Speaker 2 So they are more open to having conversations with me about a career in cyber. And I think it's so beneficial that we are creating that awareness and sharing that knowledge that that has roles. And as all different types of skill sets, you don't need to be a coder with a hoodie in a dark room. It's actually much more fast than that. 00:35:51:23 - 00:36:01:08 Speaker 2 So I do think there is much more opportunity, and I think we're seeing that in a really positive light when we are looking to bring in our graduates on our bright stars. 00:36:01:10 - 00:36:19:03 Speaker 1 So, Karen, if there was one, I don't know if there was one thing you could, you know, get the government or, you know, an education Scotland or someone to change about, the way people come in through the skill system at the moment. I mean, it's a there are a couple of things that you would love to have and. 00:36:19:04 - 00:36:49:08 Speaker 3 Just make it more exciting because the sector as exciting. So like Cassie, but and primary schools, Stem education is really quite good. Kids are young that, you know, they love it. They love to do we go out with art, you know, with tech equipment. I help them cool things and they're really encouraged. And then we get them into secondary school and it's not great first and second year. 00:36:49:13 - 00:37:20:11 Speaker 3 Also there's I think that last check, 30% of our schools in Scotland don't have computer science teachers. So that in itself is a challenge, which is why digital critical frames are in there. But what we've been trying to do as expose our sector to not just the young people themselves, but to their parents and to their carers, because we can expect, could use advisors to know the route and every, you know, every career possibility. 00:37:20:11 - 00:37:54:03 Speaker 3 So, so as a sector, we have to take some of that control and some of the responsibility there. So for me it's about showcasing Scotland's tech sector and its truest form. I feel like and all the excitement is about teaching for our young people are passionate about. So anything from psychology is the one that use right? So what's best I call it just that's, that's what like so how do we implement that passion that you have and to the tech sector will come in and do UX. 00:37:54:04 - 00:38:17:15 Speaker 3 I want to know why it's a red button not a green button. I'm really nosy. I'm really nosy. Cyber should have been the career icon. And to come and do that, there's lots that I can. There's lots of things you've got to find out. There's lots of reverse engineering. How does that work? Inquisitive. We need to be marrying up those passions with and our young people with careers in our sector. 00:38:17:17 - 00:38:41:11 Speaker 3 And that makes it, I suppose that just changes that from that hoodie and a dark corner on your own coding. I mean, you look at the police officers, they're stunned. And we don't want to be here every day. This is the kind offices that are safe, that it's not dark basements. And but as I see, we work very closely with education sectors who are working really hard to try and change that perception. 00:38:41:11 - 00:38:44:23 Speaker 3 But it takes us an industry to back that as well. 00:38:45:00 - 00:39:03:14 Speaker 1 I think that's a really great point because like, you see, you know, careers advisors can possibly know what's happened at the front of all of these industries. You know, why? Why would they, so, you know, the industry taken responsibility to make sure that they are, despite all of the mess and then make them clear what the pathways are. 00:39:03:16 - 00:39:11:12 Speaker 1 I think that Alex, how did how did what was your route? And so that all you have. I'm just curious given we're talking about it. 00:39:11:13 - 00:39:34:20 Speaker 2 Yeah. Okay, so this is an interesting story. I guess you could say I fell into it, as most people probably do. My, my dad worked for British Telecom, and there was posters around the office around their first ever cybersecurity apprenticeship program. And he came home one day and I had just left school, and he said, maybe you should apply for that. 00:39:34:22 - 00:39:53:07 Speaker 2 Don't know anything about it. I didn't he didn't. I applied, interviewed, got the job, probably still didn't know anything about cyber at all. And then I done my four year apprenticeship and cyber, and yeah, I've never looked back. 00:39:53:09 - 00:39:57:19 Speaker 1 Oh, wow. That's just brilliant. Well, there you go. There you go. Yeah. 00:39:57:21 - 00:40:25:09 Speaker 3 Well, Mengs was probably not unlike, but many decades earlier. So I left school and had started at all and, Edinburgh as, Whyte's, which was a youth training scheme, which was I think is probably the equivalent to modern apprenticeship. Yeah. No. Yeah. And looking back, I've always been in technology in one way or another, whether it was semiconductors, whether it was nanotechnology. 00:40:25:11 - 00:40:40:08 Speaker 3 And I commend Scotland as 22 years ago, looking after the membership and the events. And then just as the business has evolved, I've obviously grown within Scotland as into the can I see it overall five. 00:40:40:08 - 00:40:42:11 Speaker 1 Years ago now. Right. 00:40:42:13 - 00:40:45:16 Speaker 3 So Beverly for yes. 00:40:45:18 - 00:41:05:13 Speaker 1 Well, see, this is very relevant to the last thing I want to talk about a little bit, which is about the diversity of, I suppose, not just the suppose there's a digital and technology sector more broadly about the cybersecurity profession in particular. Well, essentially it's not very diverse. Is it? It's quite, quite male dominated perhaps. 00:41:05:13 - 00:41:11:04 Speaker 1 And, and maybe dominated from people from particular backgrounds. So what are your reflections on that first? Alex. 00:41:11:06 - 00:41:50:14 Speaker 2 I would agree that the diversity is maybe where isn't what it should be. I think that's just of it's natural. I think as an we've just not managed to get ourself into a situation where we're promoting cyber careers and encouraging people from different backgrounds or, different, areas into this career. But I do think from my perspective and my view as can better, I think when I been an A and our graduates to bring in this year, in the year previous, it's it's feeling like a little bit of a more even split. 00:41:50:16 - 00:42:06:09 Speaker 2 I think we've still got a long way to go of inclusion and education, and making it feel like it's an environment where anyone can come and work. It's not just a male dominated area. But I think it's it's getting better. But I think we still have a lot to do. 00:42:06:11 - 00:42:07:05 Speaker 1 Yeah. What about you? 00:42:07:05 - 00:42:42:01 Speaker 3 Can I absolutely agree, but, probably if we look, we back to cyber, historically, it would have been a male dominated sector because the sector would have been military personnel that's come into industry, which typically tend to be men. But as Alex said, I mean, we to Deloitte Scotland as various other organizations have worked really, really hard to make sure that the tech sector and cyber is open to everyone. 00:42:42:03 - 00:43:10:21 Speaker 3 It's that sharing that knowledge with people that, you know, we do want that diverse, landscape and those skills and knowledge and not different thought. And there's lots of things we've done women in cyber groups where we've looked at key the those role models and how to be encourage young girls. And that was for the whole cyber drive piece again, was to showcase that to young girls and how they can see themselves in a role. 00:43:10:21 - 00:43:35:22 Speaker 3 Here. We've got the Empowering Youth Program, which takes people who are doing cyber roles just now who want to be cyber leaders, and then we're teaching them or empowering youth team of putting them back out as mentors and, out into the sector. So there's lots of activity going on and lots of men and women supporting that diversity, goal that that we all have. 00:43:36:03 - 00:44:00:01 Speaker 3 We just need to make sure that the young people who are coming out and into our talent pipeline are aware that this is a sector for them, and that as a sector, we've here waiting to bring them and embrace them and then, you know, help them create the next cyber tools and cyber company, whatever it is. But that's all about exposing them to the sector. 00:44:00:01 - 00:44:02:00 Speaker 3 And as a sector, that's what we're doing. 00:44:02:02 - 00:44:21:07 Speaker 1 I suppose them the development of role models, you know, girls and women in the sector is very important. And I think, so, so with, with a somewhat from both of you then is there's work to do, but it's getting better. Is that fair? 00:44:21:09 - 00:44:49:08 Speaker 3 There is absolutely work to do. But then there's work to do across the whole of the tech sector, not just in cyber. You know, historically we've had a very male dominated talent pipeline. Yeah. Right. And and that that's just it. And that that takes time. Yeah. Exactly. It just takes time to but all the things that Deloitte's and everyone else is doing around exposing our young people and their carers and their parents about an opportunity of careers and cyber, will help. 00:44:49:08 - 00:44:57:02 Speaker 3 We it won't help, won't change overnight, but it is definitely we do see the difference. We see the needle moving. 00:44:57:04 - 00:45:20:08 Speaker 1 That's great. What a positive note on on which to finish. So thank you ladies for such an interesting conversation. I certainly know more about cyber when I did before we started this podcast. And and hopefully our listeners will feel the same. As Karen mentioned, we're recording this for those who are, just listening to this and Deloitte's offices in Edinburgh. 00:45:20:10 - 00:45:33:17 Speaker 1 And it's been a brilliant conversation today. So, you can catch up with all of our outputs, Fraser of allander.org, and we'll see you again soon for the next Fraser of Allander podcast.