Interviews 23.01.2024

Getting to Know: Lisa Forte

There’s @LisaForteUK. And then there’s Lisa Forte. Most people only know the former, but Eleanor Dallaway met the ‘real Lisa Forte’ for a walls down heart-to-heart.

Lisa Forte: A persona known to many, but a person known by far less. Eleanor Dallaway decided to dig beneath the surface of the woman who has taken the cybersecurity industry by storm…

I bet that you think you know who Lisa Forte is. I bet that you perhaps even feel like you know her well. You know she’s passionate about climbing and travel; you’re probably even aware that she hates pineapple on pizza and pledged allegiance to her Italian heritage in the Euros final in 2021. But until you’ve sat face to face, having the ultimate heart-to-heart (over pizza, of course), you don’t know Lisa Forte. Not at all. But take it from me, you wish you did.

Given we’re both in the cybersecurity industry, using the word ‘enigma’ to describe Lisa is probably very fitting. The Lisa who shot to infosec fame (that might sound over the top, but I stand by it) thanks to her very active, somewhat transparent and often idolised (again, might sound over the top, but I stand by it) social media profile is a million miles from the woman who sits across from me in this artisan café that sells pizzas good enough to earn the seal of approval from a half-Italian. “Ugh, the pineapple on pizza thing,” she sighs, rolling her eyes, suggesting the relentless online references to her hatred for it have finally grown tired. I don’t blame her; barely a day passes when someone doesn’t tag her in a reference to pineapple on pizza.

Lisa and I in ‘hippy land’

“You could come for lunch in hippy-land,” Lisa had said a month ago when she agreed to this interview, so I jumped on a train (or three) to Bristol. I always prefer to interview someone in their natural habitat, and given I hate the cold and can barely climb a modestly-sized tree, interviewing Lisa atop an ice-clad mountain (her actual natural habitat) had to be ruled out. So travelling to her home city was the next best thing. Much less hippy was the Porsche Lisa picked me up from the station in: roof off, enormous sunglasses on and a somewhat shy grin on her face.

That girl

Lisa and I have met multiple times before today, but I think it’s fair to conclude that today is the first time I’ve met the real Lisa. That’s not to say she has been fake, just that she had her walls up. “I have a bit of a reputation for being an ice queen; even my friends say it,” she confesses. “I’m a bit cold, brutal and tough. That’s a protective mechanism for me because I find it very difficult to be open about things, so I’ll tend to say something and then joke about it.” She throws back her head and laughs. She laughs a lot. Sometimes, it’s apparent that it’s to mask awkwardness or emotion. But more often than not, it’s because Lisa has an incredible sense of humour and finds hilarity easily. It’s one of my favourite things about her.

When I question whether she’s always been an “ice queen” (albeit one that laughs a lot), she nods. “I’ve been like this since I was young. I was a nerd, the kind of kid who lined up all my ornaments in perfect height order and sorted all my books alphabetically. I was that kid,” she nods, explaining that her love of science, space and fascination with how things operate began in childhood and never subsided.

“I’ve always been a bit of a loner. If you spend a lot of time in your own company, you get lost in your thoughts, and that’s why I’m an overthinker.” She speculates that it’s also why she found climbing. “The climbing community is a bunch of lunatic misfits who are on the periphery of society doing strange things,” she says with nothing but endearment.

 

Lisa in Mongolia: If this is what being a ‘lunatic misfit’ looks like, then sign us up!

“Do you really consider yourself an outsider?” I ask. “Yeah. I’ve had people come up to me at conferences and later call me ‘cold’ and ‘odd’. I’m just shy, though,” she says, almost sadly. “I struggle with those interactions. I’m not really a talker. But I struggle less on social media, which is true of most of our community.”

There’s something about Lisa

Her social media is at the top of my agenda for this interview. Very active across many social network platforms, Lisa erupted onto the scene sometime before COVID, very quickly acquiring a very large (and active) following. And the rest, as they say, is history.

“When I was in the police, we were discouraged from having social media, so I was off the grid. I look back on that as a golden time,” she says sincerely. “What you don’t realise is that [social media] takes you very quickly down a path you don’t want to go down. I’m introverted. I like to be out in the mountains, but [social media] has catapulted me into a trap.”

Self-proclaimed ‘ice-queen’ (pun intended)

For all her disdain for social media, is there an element of gratitude also? A nod to its role in the growth of her business, Red Goat Cyber? “I think that’s an illusion,” she argues. “People think that if I have loads of followers and I get loads of likes and attention on social media, I will be successful. But that’s not success, and it doesn’t equate to success. Most of my business comes from word of mouth,” she counters.

I present an observation to her: “You’re magnetic to many people on social media. Why do you think that people are so obsessed with you?” She pauses. “I don’t know. I’m not the most talented, I’m not the most attractive, and I’m not the smartest,” she trails off. Considering the ‘romantic’ poetry she’d been DM’d by a follower that morning, I would argue that she is, however, almost certainly one of the ‘most adored’.

“They don’t find me fascinating; they find my profile fascinating, and that’s not the same thing,” she states. “I hate being in the spotlight. The interest in me is far removed from who I want to be as a person, and I find that so immensely uncomfortable.”

Given the way she talks about the downfalls of social media, her contempt for the attention she receives, and that she doesn’t believe there’s a correlation between her online profile and business success, I put an obvious and blunt question to her: So why do you stay on it?

“I am contemplating how I can move away from social media. I’m not on it as much, but I know I would be happier with less. I’m trying to reform my career to be more suitable to who I am as a person, as opposed to who the industry tells me I have to be.” In reality, this looks like less speaking gigs and less of “feeling like a performer. Some people do it really well, like Jessica Barker and Rachel Tobac. They are fabulous, but my personality does not suit it, and it causes me a great deal of stress and discomfort that I don’t want to live with anymore.” She recalls pacing hotel rooms and talking herself into even walking into any conference or event.

Her distress is visible. Off the record, we dive deeper into the many reasons she feels this way, and I can co-sign on her reasoning being more than justified. I respect that she has had the strength to persevere. In my last role, I dug deep into the harassment that Lisa received. You can read about that here, but for now, I don’t feel the need to revisit that in writing. There’s more than enough new material to share.

Stronger than an ox

If I had to choose three adjectives to describe Lisa, ‘strong’ would make the cut. And I don’t mean physically strong, although her ability to do aerial circus and her penchant for hardcore mountaineering (a passion that originated in her early teens) qualify her for that category, too.

She’s emotionally strong too. She has embarked on incredibly ambitious travel missions alone, visiting places like Kazakhstan, Peru, China and Mongolia, more often than not to take on treacherous mountaineering challenges. “I do get really nervous before trips,” she admits. “On the plane to Kazakhstan, I thought ‘why the hell am I doing this?’ But as the Warren Buffett quote goes, no success comes from being in your comfort zone. I grow as a person on those trips.

‘Overcoming adversity’ in the Peruvian Andes

“There’s a part of my brain that enjoys overcoming adversity, proving to myself that I’m tougher and more capable than I give myself credit for…but my God, that time in Japan, climbing Mount Fuji in the winter…fuck, no! Holy shit!” She throws her head back once again and practically cackles with laughter. I join in – it’s infectious.

I respect that, as a business owner, Lisa makes the time for extended travel. “I love my job and want to do it well. If I work continuously without a break, I have no energy or enthusiasm, so I’ll get burnt out.” This epiphany came thanks (and I say that ironically) to a serious accident Lisa had seven or eight years ago. “I split my head open. The doctor told me that people don’t survive that type of head injury, but I got lucky. After that, I ensured I lived my life knowing I’d have peace if it ended at any given time. I need to know I’ve done life right.”And for Lisa, ‘right’ means travelling the world whenever she can, hanging upside down from beams in her own home, and facing death on the verge of an ice-clad mountain. It’s not everyone’s idea of doing life ‘right’, but it works for her.

That ox-like strength has served her well in past roles where that characteristic was a prerequisite. Despite studying Law (Southampton Uni) and earning a Master in Laws (Bristol Uni), “I never practised law. I’m sure my parents were like ‘Yay, we spent all that money for nothing!’” she laughs. “That said, it gave me some excellent skills.” Skills that she put to work in very diverse ways

“I once worked for an organisation that put armed guards on boats. Fuck my life!” she laughs. “They were protecting ships from pirates, and I ended up pivoting into the security operations side. That’s how I got into security,” she says as if that’s a perfectly normal thing to have on your CV.

She then worked for the police, first in counter-terrorism and later in the cybercrime unit in southwest England as a cyber protection officer. Past dressing downs for ‘saying too much’ have left Lisa weary about disclosing too much about these roles on the record. Off the record was a different story. But that, sadly, must remain between Lisa and I.

From boats to goats

In 2017, Lisa co-founded Red Goat Cyber Security, a cybersecurity consultancy and training provider. It was her first time self-employed, which she describes as a “sharp learning curve. To start a business, you need to be good at finance, business planning and strategising; these are skill sets that I had never trained in or honed in any way before. That first year was absolute hell. There were moments when I thought, ‘What have I done? This is probably going to kill me’”.

Still dabbling in boats whilst running Red Goat!

You’d be forgiven for being surprised to learn that Lisa has a business partner. On the surface, Red Goat and Lisa are synonymous. “My business partner hates any attention. He isn’t on social media at all,” she pauses. “Which is exactly where I wish I were,” she says regretfully. “If I could talk to the Lisa of six years ago, I’d tell her not to get caught up in the social media game; I regret that. I’m hoping I can step back a little bit from an outward-facing role now that the company’s got a bit of a reputation and can carry itself.”

During the interview, she tells me that two of the people she has the most respect for in the industry are Rik Ferguson and Troy Hunt, and it strikes me as interesting that they both have significant social media profiles. “It’s not that I necessarily want to follow their career trajectory, more that I feel like they handle themselves with such integrity online.” Perhaps this respect subconsciously inspired the creation of @LisaForteUK.

Six years down the line, I ask whether she has acclimatised to the self-employed life.  “Yes. But it’s never smooth sailing; I’ve just got better at managing it and understanding what is required,” she reflects. “I wouldn’t change it for the world now.” But let’s be real, she adds, life isn’t “an advert for Prozac like many people portray to the world. Why do people need to pretend that they’re constantly successful, happy and joyous and that nothing is hard? It’s just weird.”

I ask her if she’s conscious of the parallels between her day job and her extracurricular passions. “Of course,” she nods. “It’s about risk management, planning, and preparation. On a mountain, of course, if you fuck it up, you die,” she laughs again, but I can tell that she’s had moments where she temporarily lost faith in her invincibility. When I ask her where she sees herself in ten years, she answers “a crevasse,” with a grin.

“I hope that the level of maturity in incident response and preparedness has matured somewhat in ten years and that I’m not doing quite the same thing as I’m doing now,” she considers. “That said, I hope I am still running Red Goat and doing things that engage me and help people.”

Misunderstood

In terms of where she’ll be geographically, that’s anyone’s guess. She grew up in Bournemouth with an Italian father and a British mother. Do you feel Italian, I ask? “Definitely, and my exes would agree,” she laughs. “If I’m hungry, you don’t want tickets to that show, let me tell you!”

Right now, she’s content in Bristol. “It’s a great community, a nice vibe, and I’m grateful to be outside the London bubble. Bristol is spicy, cool, and anarchistic. That feeling that you don’t belong is why you do belong,” she reflects. In an ideal world, Lisa would live in the mountains. A summer spent in Snowdonia two years ago cemented this desire, but the problem was that it “was just too remote. There was no phone signal, the internet was shit, and it took five and a half hours to get into London,” she sighs, frustrated.

Lisa’s dream is to live in the mountains

I get the feeling that for Lisa, travelling alone with a backpack full of climbing gear and ice tools is where she’s most at home. What she lacks in height (you and me both, Lis!), she more than makes up for with bravery and a true passion for life.

I’m going to be entirely candid now. I never knew quite what to make of Lisa before today. I knew she was quirky, funny, intelligent, brave, witty and ambitious. I knew she was followed (and often adored) by so many in our industry. And I knew she’d been to hell and back as a result of this. I got the impression that while she was brave, she was also fragile. And while I’d certainly never considered her an ice queen, I could never quite work out whether she liked me or not.

What I know now is that she’s misunderstood by so many. An extrovert online, an introvert in real life. Tough on the outside, but not on the inside. Ice queen to many, but raw, vulnerable and funny sat before me today. During lunch, not only did Lisa open up to me, but I also opened up to her. So much of our conversation hasn’t made it onto page, and that’s out of respect for Lisa (and modest word counts!), not because she enforced any censorship whatsoever.

At the beginning of this piece, I wrote that I considered Lisa an enigma, and this part remains true. That said, I do feel like I know the ‘real Lisa’ now, and I’m really and genuinely glad that I do. As we jump back into her car, top-down, sunglasses on, we laugh the whole way back to the station. ‘Let’s do this again,’ Lisa says, and I nod and smile, knowing that we will.

Lisa on cyber insurance

We don’t often ask our interviewees about cyber insurance. But when they volunteer their opinion, who are we to keep that to ourselves? Here’s what Lisa had to say about cyber insurance and the industry’s perception of it:

“Unlike many people in the industry, I’m a big proponent of cyber insurance, and the people who work in incident response understand the utility and necessity of it. In this industry, we deploy an attitude of absolutism for everything, which drives me nuts. You will read the comments on a cyber insurance poll, and people will say, ‘Insurance won’t cover you for this, and insurance is a waste of time because of that.’ They have no data; they’re not sharing data points; they’re just imparting opinion and masquerading it as fact in an absolutist style devoid of context. It’s not helpful to our community at all.

Cyber insurance is helpful, and I’ve seen well-written policies in recent years. I tell all my customers to check their insurance coverage, and I do that with them without fail. So it drives me nuts when people talk about how insurance is crap.

The great cyber insurance policies I’ve looked at for my clients have included PR coaching, breach coaching, call centre support and resourcing in the event of a cyber incident. So even if you forget about payouts for ransoms, cyber insurance assistance will be a make-or-break for you in an incident. The one thing I see repeatedly is that clients lack the resources to handle the incident. That’s why you need cyber insurance.

There are a lot of very clever people who are doing a lot of stuff in cyber, but if they’re not seeing the incidents play out, it’s easy for them to have the view of, ‘don’t pay the ransom, cyber insurance is shit.’ But they’re wrong.

If I hear anyone say, ‘never pay a ransom’, I know they’ve never been involved in an incident because that’s not how it goes down.”

Latest articles

Be an insider. Sign up now!