Don't Get Tangled up in Your Cape: Hero Culture as Negative Cyber Security Force

The speaker, who has led security teams for many years, starts from a practical question: how do you build strong practitioners and teams when the field has so many open roles? He says the problem is not heroic action itself but a culture that makes heroic, round-the-clock effort the expected norm. He compares common superhero traits, such as unchecked action, limited accountability and being celebrated for saving the day, with how security work is often rewarded through bonuses, praise for weekend firefighting and crisis-driven recognition.

The middle of the talk covers the harm this culture causes. Staff who are cast as heroes often treat users and management as the villains, which encourages knowledge silos and a habit of holding onto control. Interview processes and internship postings that expect advanced skills can screen out newcomers and people who do not resemble the current team. The speaker also describes "brilliant jerks" who are protected despite damaging their colleagues, and how poor sleep, heavy drinking and burnout are treated as normal. He points to survey data on stress, turnover and staff shortages.

The talk closes with suggestions for practitioners. Hiring can favor curiosity and integrity, with technical skills taught later. Each crisis can be used to fix root causes such as segmentation and patching instead of repeating the same fire drills. Recognition can reward collaboration and community work rather than long hours, and teams with varied backgrounds and thinking are easier to defend. Bystander intervention and clear codes of conduct are also offered as ways to challenge toxic behaviour.