Data and Cybersecurity in the Automotive Industry, with John Sotello

strategy and more. Now let's get into today's discussion on what matters in it.

And my name is Keith Hawkey, Technology Advisor with Opkalla, and I'm joined by my colleague and esteemed technology advisor, Michael Coloma, during this episode, we sit down with John Sotello, the CIO of Cloyes Gear and Products whose career defies convention, starting in sales and rising into IT leadership. We'll explore the pivotal moments and decisions and mindset shifts to help bridge the gap between business

outcomes and technology execution. And we'll also unpack the future of IT infrastructure and operations, including how AI and data are poised to transform the automotive industry. He shares his bold vision for innovation, along with some personal projects, like a VIN based initiative that could reshape how we understand vehicle data. John Sotello, welcome to the IT Matters podcast.

social interactions. Number three, a startup introduced a smart toaster that analyzes facial expressions each morning to determine your mood and adjust the toast crispiness level accordingly.

anxiety, with talking with folks and breaking the ice. And I can totally see a smart toaster in terms of, how do I predict your mood? Do I give you another cup of coffee? Do you do the cold brew today because it looks like you need one? So I'm going to go and then I'll make my give us your yes first, and then I'll one false, two, true, three, true. Cat for 500 Yeah, for 500

people in demand for a toaster. So that is my guess. I think first two are true, and the third one is the lie, all right.

about your role as CIO of Cloyes, and what do you guys do at Cloyes? What's the high level here?

tool, which is ERP up and running. But also we get to dabble in some of the things that help drive business right so connecting transactions from our customers into our internal systems, managing some of the data lakes and some of the dashboards that we really put some effort into over the last year, and providing insights to our internal teams to help drive business decisions. But more importantly, I think we've kind of become a little bit of the glue that binds when things come

in. From a technology perspective. For example, our operations team is looking at a transportation management system. We're kind of that gap between, hey, operationally, here's how it works technically, here's how we integrate it. And similar story to things like, hey, the scan guns aren't

working. What can we do to go look at them? And you know, some of those things are easy fixes, and some of them turn out to be that break fix that you should have found out about two years ago, if you will, also on the forefront of some of our acquisitions and integrations that we've done over the last couple of years.

and really improve the overall health of the organization, from a infrastructure standpoint, a security standpoint, and making all their employees lives a lot better. So I know it's a fancy way of saying that these are all solutions that I think will help drive business in the right direction for a lot of our customers. And so the unique thing for for me and my role is I get to work alongside people like John. John is who I met

through a family friend. And again, the way that our paths have aligned has obviously been really unique and and I would say it's been such a refreshing pleasure to work with somebody who has taken a new approach to a traditional CIO role. And I'll let John kind of highlight a little bit more of that. But you know John, I'd love to hear more of your background on how you ended up in this leadership role, and talk about your career path as it's advanced to where it is today.

from sales over to it, and who did you have to woo very carefully,

timing tensioners and other front of engine parts. Is the best way to put it. So we're in that critical path to what's in the mechanical side of the space. And with vehicles in operation getting older, obviously, we become a little bit more critical to what's going on with the car. My world, my journey, my destiny, however you want to put it, has been a has been an interesting one. I actually started off in sort of sales cashier land at Toys R Us in 1997 and sold video games in

what was called our zone at that time. And decided, Hey, let's go to college. And I lasted for like, a semester and decided this is not going to work for me. And I spent about a year remodeling Toys R USS in the Dallas Fort Worth area. And decided, Hey, maybe I should go back to school, right? Let's go

try this again. And spent my college career basically issuing parts at an aviation company on Love Field, working second and third shift, arguably one of the coolest jobs ever had, because I could sell what they call VIP aircraft, which you haven't seen, is one of the coolest things ever. And I had a friend through my wife, that said, Hey, you should come work the help desk or the knock at a credit card processor. And I think I

pushed back for four or five months. And mind you, I was commuting 110 came a month later for that same person, saying, I think I found the perfect job for you, and it's the job I have today, and it's all because I just took a random call from her and just talked and just like a normal person, right? And, you know, I went through four or five weeks of interviews and ended up

accepting the role for Cloyes as a CIO. And it for me, it was a, I hate to say cheesy, but it was a dream for me, because my goal was to hit CIO by the time I was 40, and when I got this job, my daughter's like, oh my gosh, Dad, you made it. You made it. My wife too. And I'm like, Yeah, but I was three years late, neither here nor there. But that's to be long winded. That's the short and the run of it. It's a long story.

some of the staffing and consulting as well. So it was a really, really cool project to be a part of. So it was a Cisco solution at the time, UCS, with EMC in the background, anything you could talk technically, right? I mean, that was a cool thing. We had nine reps at the time in the office, and I had been working with a lot of these folks for years because they were, you know, other companies that I done business with. And so it was like working a little bit with, like your with your

family. And so I held the record for the most visits in a given week with customers, and I think it was like 18, just because I got. Drug along to all the meetings, which I'm very thankful for, because that experience is something you just can't live again. Kudos to that.

you've done a lot of work, you know, particularly in the cybersecurity area, with Cloyes. In your career, what are cybersecurity has always been an important topic, but in your tenure, what are some of the things that IT leaders typically overlook when it comes to assessing risk and attaching value to cybersecurity investments and the overall posture like, what are you you interchange with CIOs and CISOs

that are having to develop these plans for the company. What are some of the things that you find that are easily overlooked?

the right public cloud? It's not things like that. It's like, what is your business continuity plan? What happens when the lights go out? What happens if we get hit with the inevitable ransomware attack, those are things that you can prepare for, and so that when you do hit the heat of the moment, you can react accordingly to maintain the continuity of your

organization. But also, no one wants to be on the news right now, especially in cyber and no one wants to end up on some, you know, dark web portal where your information is getting pushed out there. So really, it's not necessarily looking at it technically. Sometimes it's looking about it. How do we make sure that we continue to make money as an organization and aligning not only your solution but your mindset with the two? Because in some cases, some of the things we do don't really

cost anything. You know, in a previous life, we use the term, use what you have and when you have a lot of the technologies that Microsoft gives you, or even if you subscribe to the things that a Meraki or Apollo gets you, sometimes we don't use that even 80% of that solution. So before we go back to our internal executive teams and finance teams and ask, Hey, we need a product X, we really need to make sure we're consuming as

much of the existing baseline that we already have. The last thing anyone wants to do is to go buy a product, half deploy it, and then it becomes the entryway for an issue, whether that's a continuity issue or cyber event.

issues here. Or, Hey, we just haven't really run into this instance that would provoke us to look at a solution or a tool that would shore up our security measures. So what are some of the things that you look at for cloys, when you look at, how do you stay on the forefront, or, I guess, at the forefront, of the cybersecurity space, right? Like, how do you predict? Well,

hey, this is something we should look at. If it's not currently an issue, how do you be more proactive versus reactive when it comes to the cybersecurity space?

gets shared out there from the cyberspace. There's a morning newsletter that comes out every day. There's websites like dark web, bleeping computer things like that. That'll give you good insight. Now, that insight sometimes is what the pain of somebody else already feeling right? Someone's already bit it. So now you're out there, we've used those tools to mitigate issues proactively for our side of the house, I hate to say one

person's issue becomes our positive change. We work with a group and subscribe to a group called automotive information sharing, and so we get a daily report out that says, here's what's going on in the automotive industry. We have a really good partner that we work with in our MSP land right now that we get good insight from them and what's going on in the market. And you know, how do we protect our tools? How do we

protect our base? And I'll tell you, one of the greatest things I think we have going for us right now is security in our world, a top down thing. It's not just me preaching it. Our CEO preaches it too. Is something we talk about every town hall. We have a we have something that goes up in every town hall about why it's important to watch what you click on, and you know why we do what we do to protect the

organization, because that's what matters most. So I think one of the other things that we do proactively is we talk to our employees about security. You. We have security as a mandate for training, and we grade you on it, and we make sure that we're watching it. So we have a group in an it that is assigned different organ, different organizations in our company, in different locations, that watches how many points you get on score, so that we can keep

track of how are you doing from a cyber posture perspective. But all of those things are proactively helping prevent what could happen. The tools are great, but we've got to start also making sure that we're minding our employees as well.

it. There's been a ton of advance in terms of, you know, at the car technology and cybersecurity that can be done.

But when you start getting into service providers and things like that. We have information, right? We have data on cars. You have data, you know, consumers, whatever. So data becomes the real big one, right? And I don't know if you follow some of this stuff, but there's been some big OEMs say, well, the data is ours. You're on the road. Well, data is the new goal, and it's consumer information. It could be location information, I think, as we continue to see the next decade as the connected car

evolves, as infotainments evolve. I mean, if you look at I have a 2019 truck, right? And my infotainment is about a six by six screen that I hardly pay attention to, because it's, well, it's old. It doesn't look that cool. You get into something right now, like a 25 GMC, and it's like you're in

your home entertainment system. All of those things connect back to something, whether that's in the car outside the car, and they coexist in the background, along with the same things that drive critical components, like your ados, which helps drive safety, your can modules drive some of your braking systems. I

jokingly said this on a call recently. It's like a rolling data center right now with a vehicle, in terms of not only what happens with Compute and Storage for everyone's fun things on premise data centers, but also what happens with the data and the cyber side, data is king. I know that our vehicles are taking all they're gathering all kinds of data on the drivers. And I don't know how much cloise is involved in this. It's probably more of a manufacturer, but I always

wonder where that data is going. We, fortunately are not on that component. We're more on the mechanical repair side, right in terms of what we do. If you look at where these things are, it's your sensors, right? So if you look on the front of a bumper, it's a little circle dot that helps drive how far you can get to a car. Or if you're in assisted cruise control, you know, how far does it start? You know, a lot of it's going to go to your OEMs. A lot of it's going to go to on starts going

back to GM, stuff like that. Mileage may vary, and I think it's one of the things, as we get through, you know, 2025, 2030, and we start talking about personal information, CCPA and all these different privacy acts, I think we're going to start to see, hopefully, some legislation around how that looks and how we handle it, how we manage it. There's tons of good information that you can glean off this stuff, right? And I think you mentioned one of my personal pet projects I want to

do is around bins. But there's a ton of like, proactive information that you can use with the data that comes off this car. But as everyone knows, there's always going to be a person, an entity, whatever, that doesn't want to use it for the greater good, but instead wants to use it to do something nefarious, or whatever you want to call it.

consumed, right? So where do you think Cloyes fits into this in the next 510, 15 years, as it relates to the automotive industry, specifically around the the the electric vehicle standpoint, because what you shared earlier about cloyds and how they work on a lot of these traditional fossil fuel burning engines, right? What does that look like for cloys? And it's just something you brought up that I wanted to ask about, because GMC has, for example, put an emphasis that by 2035 or

whatever they're going to have. The majority of their vehicle offerings are all going to be electric, right? So I just want to get your perspective on that. Since you mentioned the data standpoint, what the future of the automotive industry looks like,

we're still selling ice up until that point. And the runway, I think, for you. Evolution for what's coming. You're going to see still a combination of reducing your traditional v8 motors down to your v6 with the Turbo, which is good for us, right in terms of turbo, but EV, full EV, there's still components that kind of are complementary to what we do in the background. But I'm

really anxious to see what happens with hybrid. If you guys look back to what you know, Toyota took on a lot of heat years ago because they wouldn't put a full blown EV strategy out. They postured a little bit and said, Hey, let's see what happens. And their gamble paid off, because hybrid is one of

the better ones out there right now. Don't get me wrong, what Tesla does and what BYD is doing great strides, but I think hybrid strikes that nice balance between what is a full EV and that whole I'm going to run out of charge mentality versus, I want to go full bore, you know, gas. Give me my super unleaded. Let me see how fast this thing can go. It's going to be right down the middle. And, you know, for me personally, not not associating with anything business wise, but I think

there's going to be a right down the middle approach. And you can, you can read about. It's nothing that I'm going to say that's not already out there. Most people, if we're going to go Eevee, will always have an ice vehicle in their driveway. It's like a comfort level, right? What do they call it range anxiety, in terms of making sure, you know, I can go on a road trip from, you know, Plano, Texas to Gulf Shores

Alabama, of all places. And if I take my Ice Vehicle, I got two stops, but if I took a full blown EV, I'm probably talking four or five. So I think it's going to be somewhere in between, is my guess.

story here. Have to do with the data around v i n numbers. V i n is vehicle identification number, I'm pretty sure, right?

the possibilities endless. So if you talk about a VIN for a second to everyone else, it's like, a cool it's like, you know, 18 characters, whatever, but it tells and if you go back to the people that car chase like old vehicles and stuff like that, and they're like, Hey, that's a blue car VA motor like it used to tell those stories a lot better, probably, than what they do today. But VINs have evolved so much. And I think this comes from me being in collision too long and paying

way too much. As we move from collision to mechanical, they tell a story about what the vehicle is. But if you break it down, you get down into what's called your make model trim, which Keith, if you see it somewhere, it'll say Y, m, t, and it took me a bit to figure out, what does all that mean.

But as we've evolved the vehicle, and we've gone from hey, here's a Toyota, just regular Toyota truck now to here's a Toyota Tacoma Limited model with a TRD badge, all that stuff now rolls up into event, and it tells you, you know, the engine, what trim it had on it, you know, all these different safety components that may be on the vehicle, right? Well, then you take that and you can go to Toyota's website, or whoever, and you can figure out, hey, this is a 2025 Toyota Tacoma.

Here's your maintenance schedule, right? Oh, and by the way, you're at 25,000 miles. You really should have changed your cabin filter, right? So it's telling you all these things. Oh, and by the way, NHS says you have a recall. You need to go get that taken care of. So if you take this idea that, then you can figure out how to self serve, to support your your

vehicle in the long term. But if you're, you know, if you're looking at from a service provider, I'm coming in, I'm going to get my car worked on, whatever the case may be, it's the same thing. Hey, you're at 50,000 you know, when you get your oil change and the person comes up, hey, it's time for the $60 air filter. You could have already answered that question

and stopped off and saved half the money. But I think that power, that I've been and how you can bring it in and help complement, call it, add on feature sets, and helping make the consumer make better decisions about what they do with their car is for the better. And if you look at it in terms of like the fleets and things like that, we're talking money when you're paying attention to your maintenance schedules and not.

Just the one that says on your top left your windshield, it's time to change your oil, but we still have to grease bearings. We still have to change spark plugs. You still have to change things in an EV like the list is limited, just sometimes we don't always remember that the owner's manual is sitting on the right

side of your glove box, and you don't think about it. And wouldn't it be nice if it was just a push notification to your phone says, Hey, your car says it needs to go to discount tire, because that really not cool thing called TPMS just said you need to go to, you know, Discount Tire because you're,

you know, five pounds under pressure. So I think the VIN piece outside of just what you know, we did internally in in talks of, how can we take you to help structure, into getting deeper into providing mechanical feedback, but taking outside of that and just going to the everyday consumer is incredibly, or could be incredibly powerful.

sales background, right? And as I mentioned earlier on when we were discussing this, is it has normally always been a cost center, 100% for most organizations, where they just look at it as you're just a line item that literally just takes

away from our net profits. And so, can you share an example of something in your either your current role or in a previous role, where you have been in a position of leadership, made a recommendation for a solution or a product that has positively impacted the rest of the organization from a revenue standpoint and really helped to change the way that it leaders are viewed in the overall portion of the organization to more of a an assistant or support model of generating revenue for a company.

with it. We've now morphed it into something where we update the business on it every week, where we're at what we're doing with it. How we're going to move from, you know, a manual system to more of an automation system for certain parts of it. How can we board customers faster? Because the faster you can board your customers, the faster they're placing orders, right?

So your ROI hits up quicker, and then, honestly, it's just providing information and feedback as you go along, in terms of, Hey, we gotta, we gotta reach out from, you know, five customers. Which one of these do you want to prioritize? And it's having that, that conversation back and forth with your sales and operations leaders that really helps one you as an IT person to better learn the business and what's coming in there. Here's your pipelines and forecasts and see

what's coming to help drive revenue in the company. But also your kind of information sharing with the other side too. We historically, kind of get viewed as a black box, right? Partially because we use buzzwords and three letter words like, you know, sand and RAM. But, you know, giving folks a little bit of a non it feedback of, hey, we need contact information with demographics, et cetera. This is why, because it drives into a

four week timeline on our side. And here's where you slot in. I think giving that feedback without being we chatted earlier, the perception of just opening a ticket goes a long ways right. And in a previous life, we were built on inbound volume, so the more vehicles we service, the more capacity we had to have. On the other side, the challenge is the first two or three times when people are like, hey, we need you to go increase capacity, and then you show up with a bill of $250,000

and you get the shock and awe. No one talks to you for about a week. That's a thing, by the way, and until you can create that value engine that says, hey, we've done some analysis. And for every, you know, 100 vehicles you add, here's what we need to do to keep up with you and finding ways to, kind of, I say, Insert, but insert your way into conversations when we're about to go talk to, you know, big customers, and not just going into, oh, we just don't have enough capacity. We can't

do that. We can't we as IT folks can't just take that approach anymore. We have to be able to come back with factual numbers that resonate with people. Hey, we've got 1000 vehicles a month coming inbound. Great. What's the mix of the car park? Is it going to be domestic? Is it going to be European, like individually? Which OEM is it going to be? Because it matters

downstream to here. And when people start taking in that volume and really understanding what it means to get to the capacity and the pieces and parts to it, you don't become just a cost center anymore. You become a key to go score the business, because as soon as someone scores that business, regardless, same with EDI and some of the other things, you become the long pole because we're longer in the supply chain. In terms of, I need to go buy capacity. And Michael, you

know, is better than me. It could take 30 days. It could take 60 days, depending on what you're sourcing from and where you're sourcing from. If people aren't aware of that before they Cycle. We become the, I hate to say it roadblock, but we become

to be willing to take your lump sometimes. And you know, I think I mentioned this to a friend of mine, sometimes you gotta be willing and okay, just to figure out that today you're just gonna clean the bathroom. And I mean that as a as a kind of a a pleasure having you on the IT Matters podcast. You know, your descriptor of you may just be working on setting up accounts today, because that's what needs to be done. And that's okay. You're still adding some type of value, but you've almost still

gotta earn that keep right? It's like in sales, you can, you can go out and fish for new customers all day long, but you still got to maintain your internal base at the same time. last message really stuck out to me. I typically ask kind of a parting statement or parting message to deliver, like, imagine you were delivering the keynote at the 2025 Ford CIO Summit. And one thing that really stuck out is, like you said, you know, some days you just have to clean the bathroom,

simple things, yep. And metaphorically in the CIOs role, I think that's that's incredibly applicable and a lot of times overlooked with the rule, some days it's not fun, but you take the days that are not as fun for that day that you get a big win, and remember the big wins. It takes a lot of small wins to get to a big win, and unfortunately, it doesn't take a whole lot to lose that big win too. So we've got to be mindful as we maintain

the easy things, right? And keep the hygiene going. John, how can our listeners get a hold of you?