This Is How All CISOs Should Build a Business Case

Stagehand: Origins

Jack Sullivan

I’m sitting at a table in one of the offices of my private security firm in a tense, but now familiar, setting. No matter who the client is, there’s always a strange energy when extremely wealthy and powerful people are asking you to accomplish the seemingly impossible, discreetly. Today’s client, Lincoln Palmer, runs a hedge fund that thought it made the low risk choice by selecting the top cybersecurity firm in the country to protect its data—low risk until last week, when its CISO was kidnapped.

The only thing all billionaires have in common is that when they need something to not be done—they call the government, and when they need something done–they call people like me.

I’ve heard about the case. I knew the FBI was on it. But I’ve learned by now that the only thing all billionaires have in common is that when they need something to not be done—they call the government, and when they need something done–they call people like me. Lincoln Palmer said none of this, of course. He said almost nothing, as his attorney explained that there’s reason to believe that the kidnappers are specifically looking to steal data from Lincoln’s firm and that this kidnapped CISO was most likely taken for just that reason.

Who is them? I asked, knowing full well it was going to be…

The Chinese Government, his attorney said as he passed the file across the table. I thought about a similar file, passed across the table to me almost four years ago, by the man that funded this business. The file ultimately that started Stagehand.

Nantucket ~ 2014

I’d driven my 2006 Nissan with 230, 000 miles on it from my South Boston place to Nantucket for David (don’t call him Dave) Steele’s annual Fourth of July BBQ. David was a Harvard classmate and good friend that hit it big when the company he’d built from the ground up was acquired for $6BN by a financial services leviathan. I parked alongside the Porsches, Range Rovers and Bentleys crowded outside his charming beach mansion, and walked around the back entrance overlooking the beach. Over the years, I’d met members of David’s small billionaire club and as I looked out onto the partygoers, noting every familiar face, it took everything I had not to sink a knife into the necks of some of these colossally patronizing pricks. I was only 40 years old but I felt like the oldest man among them.

I was already thinking of an exit strategy when David intercepted me. It was the first time he’d ever greeted me without a hug. For an instant, I thought he was coming to tell me that this wasn’t a party for me and to go home, back with the other knuckle draggers. It took one look at David’s face to know that this was something else. He was reticent and nervous, and he couldn’t look me in the eye when he asked if I would join him inside the house.

It took everything I had not to sink a knife into the necks of some of these colossally patronizing pricks

David led me into his library that overlooked Nantucket Sound, where a former Republican candidate for President was tucked sheepishly into the red Chesterfield couch, his eyes bloodshot and his nerves wracked. I’d seen this man speak in front of millions of people and knew him to be a confident, shrewd leader. But this afternoon, he was a broken, despondent man. Mike Pennington, CEO and Chairman of Ex Nihilo Ventures informed me that his daughter had run away with a religious cult or was brainwashed by a sex cult that was actually a front for a human trafficking ring or something adjacent which I couldn’t quite figure out through his weeping. I sat across from the two men, their combined value more than most countrys’ GDPs, when Mike Pennington slid a file across the live edge walnut table that cost more than most people make in a year. On top of the file was a black cell phone.

“Sully, I’m sure you realize that I am a man with a tremendous amount of resources at my disposal. Nothing matters more to me than family. You need anything, cash, jets, helicopters, whatever… you just call me on this phone.”

I looked down at the file. The phone.

This man, who had so much power that his family drama could shift the global economy, was trusting me, a stranger, to get his daughter back home. Any port in a storm, I guess.

Of course, I knew that David had probably shared my specific set of skills with Mike. My time in the Marines. My time in black ops. My time in a small, elite, nameless unit in which I applied highly trained skills allowing me to track, locate and contain a target. This unit took its orders directly from the President.

The things I did for this country took my youth, my innocence, my body and most likely, my mind—the jury is still out. David didn’t mention this.

Once docked in Boston, I adjourned to JJ Foleys for a Guinness and to review the file on Pennington’s daughter. Sophia was on the fast track to Harvard. Like her father, she was a brilliant student and a stud athlete at an elite private school in Massachusetts. I scanned the stories in her school paper that chronologized both her scholastic and athletic successes and the photos of her smiling with friends and family in happier times. The file contained video stills that showed Sophia Pennington meeting an elderly woman at Logan Airport, then others of her getting on a direct flight to Dallas.

As I finished my pint, I made a quick call to a former Marines buddy who now worked as a TSA agent at Dallas Fort Worth Airport. He was able to obtain surveillance photos of Sophia and the elderly woman exiting the airport and getting into a white windowless van. Video from the parking garage pay booth gave me a grimy visual of a Texas license plate. I ran it through the databases I’d bought when I serviced my MIT classmates with similar situations. When I cross referenced the credit card on the dark web, I confirmed a match.


I called Sophia Pennington’s father and told him what I needed. The following morning, a black suburban appeared in my driveway and I knew the jet I requested was ready to take me to Dallas.

By the time I arrived at the house Pennington provided, the large Pelican cases I had requested containing weapons, ammunition, communications gear, and specialized laptops were already there. So was my old teammate Dan, a former SEAL Team Six guy who skipped undergrad and went straight for a Ph.D. in computer science at MIT. Dan made good money as a cybersecurity pentester, but if you saw the way he looked at the assault rifles, you’d understand that Dan wasn’t here for the money.

Intel on Grace Perron revealed that she wasn’t the leader of a cult or the cover for a human trafficking ring. She was instead a grieving mother who’d lost her child a couple years back and found a willing follower and surrogate daughter in Sophia Pennington. We knew this meant that Grace had nothing to live for and if she learned we were taking Sophia away from her, she might do something desperate to Sophia or herself. Dan was able to hack into Sophia’s router, giving us access to Grace’s computer and online activity.

After a week of surveillance, it appeared that the two were never apart. We concluded Sophia had already sustained some level of psychological damage; waiting until she was alone would only exacerbate the situation. So, we chose our window for the job. Every day, around eleven thirty in the morning, Perron and Sophia went to the local convenience store for lottery tickets and cigarettes. Sophia always accompanied her so our hopes of simply hitting the house weren’t going to fly. The risks seemed minimal. Still, whether it’s a sixteen-year-old girl in nowhere, Texas or a CIA operative in Beirut’s Hezbollah territory, I’m always nervous until the action starts.

If you saw the way he looked at the assault rifles, you’d understand that Dan wasn’t here for the money.

Dan and I waited down the road until we saw Grace and Sophia drive past us in her white van. We held for a moment, then followed. As we drove and neared the action we’d been deprived of in our civilian lives, I could see the hint of a smile creeping across Dan’s face. A mile later, as Grace and Sophia slowed to stop at an intersection, we swiftly pulled alongside Perron’s van and rammed directly into her driver’s door. Dan and I moved quickly. He smashed out Perron’s driver’s side window before she’d realized what had hit her and as he secured her, I opened the unlocked passenger door and grabbed Sophia.

Dan had a MP5 shoved into Perron’s agape mouth, “you move and whatever remnants of a brain you have left will be splattered all over your windshield.”

I carried a shocked and terrified Sophia to our car. Once Dan saw she was secure, he returned to the driver’s seat, leaving Grace Perron catatonic but unharmed in her totaled white van. We needed to ditch our vehicle quickly because in a town where a tornado is the only major activity, an apparent kidnapping at gunpoint would surely cause a stir. As we drove to meet the helicopter, I looked over at Sophia and saw a very pissed off and traumatized teenager. I didn’t know what the hell she was running from but I definitely knew what she was feeling right now.

I phoned Pennington from the jet heading to Boston and told him he would be reunited with Sophia in two and half hours. I also told him that if he didn’t get her professional help, she’d be out the front door the next chance she got. I knew from experience that the mind has got to be reprogrammed or it will seek out the same experiences again and again. I don’t know if he got the message, but I knew we got the job done.

Present Day

Months later, I was settling into my new home in Vermont, courtesy of Mike Pennington. He didn’t technically buy me the house but I could afford it after rescuing his daughter. The phone rang as I finished eating dinner. It was Mike Pennington

“Sully. Jack… I don’t know what to call you, but do you know who this is?”I said, “yes, sir, I do.”

And then he said, “I’ve been speaking with some friends of mine and we think that the type of service you and your team offer could be a lucrative business opportunity.”

I had considered this before but was surprised to hear someone else say it. I never had the capital to start an operation like this. Mike Pennington and his buddies however did not have this problem. With an initial seed funding of twelve million dollars, my team and I could build a business aimed at helping extremely wealthy and powerful people accomplish the impossible, discreetly.

And that’s exactly what we did. We started Stagehand.

I look at the file from Lincoln Palmer’s attorney. It’s just like the file I received from Mike Pennington and countless other clients who rely on me and my team to get things done. We’ve got to find a CISO that has access to Lincoln’s data before the Chinese Government gets it out of him. It’s not the same as taking out a terrorist cell, but it pays the bills.

I grab the file. We’ll get started right away.


Five Best Practices to do Supply Chain Security Right

Five Best Practices to do Supply Chain Security Right

Supply chain attacks aren’t new. In fact, The National Institute of Standards and Technology (NIST) published their initial report on supply chain risk back in 2015. One of the most well-known supply chain attacks happened shortly after in 2017. NotPetya corrupted...

Stagehand: Episode 2

Stagehand: Episode 2

Carl Timmons: CISO of Illuminating Solutions, a data analytics firm, forty-seven years old, never been married. Last Thursday, Carl arrived in San Jose on business. He was picked up by a company car and driven to The Manifeld Hotel. He was last seen leaving the hotel...

The Dark at the Top of the Stairs

The Dark at the Top of the Stairs

Let’s say you need to apply a critical patch across the organization, and the patch requires a reboot. While forcing a reboot to apply a critical patch is important, it creates business disruption that ripples out to your customers. Sooner or later, someone in the...

The Risk of Banking

The Risk of Banking

I just came off a big Zoom call with traditional bankers where they discussed changes in client behaviors, and the impact which new technologies bring, that fundamentally challenge today’s traditional European banking models. At the end of 2019, Boston...

Effective Board Communication for CISOs

Effective Board Communication for CISOs

Know Your Board If you’re a CISO, your Board generally knows who you are and what you do. But do you know who they are? No Board is monolithic. Each Board member brings unique value to the Board. Each is selected for what they add to the Board’s perspective, vision,...

Cyber Ops Must Evolve Towards Fusion Centres. Here is Why.

Cyber Ops Must Evolve Towards Fusion Centres. Here is Why.

Since the advent of space exploration in the 1960s, every child understands that the success of the space mission is dependent not only on the astronauts, but also on the engineers in the mission operation center. All complex missions or operations are high risk and...

Cyber Trends and Predictions for 2021
Share This