Dmitri Alperovitch: Building CrowdStrike and defending against nation states

Welcome to Inside the Network. I'm Sid Trivedi.

I am Ross Halladuke.

And I am Mahendra Ramasinghani. We have spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators, and investors building the future of cyber.

We will talk about the hard parts of the founder journey, launching companies, getting to product-market fit, raising capital, and scaling to an exit.

And yes, we will also be talking about epic failures.

But Mahendra, we're here to make the founder journey easier.

That is correct, Sid. But we cannot make it too much easier because startups are hard. And of course, you already knew that.

All right, you two, enough. Let's get started with this week's episode.

Hey Dmitry, welcome to Inside the Network.

Great to be with you, Russet.

We're gonna talk about a couple of different things today. First, we're gonna talk a little bit about Dmitry the person, then we'll talk about Dmitry the founder, we'll talk a little bit about Dmitry the investor, and lastly, we'll talk about Dmitry the policymaker. So let's start with Dmitry the person, and maybe start by sharing with us, Dmitry, a little bit about your childhood, your background, where you grew up, and when did you migrate to the United States?

Yeah, thanks for having me on, Sid. I really appreciate it. I'm an immigrant to this country like many folks and grew up in the former Soviet Union in the 1980s in Moscow, in fact, and had the opportunity to come to this country with my parents when I was a teenager. And grew up in the South in Tennessee, and then later on went to Georgia Tech and studied cybersecurity in Atlanta. And what got me into cybersecurity is really a hobby of my dad. So my dad was a nuclear physicist in Russia, initially designing nuclear power plants, and then later after Chernobyl, helping to build simulators for the reactors to help train the workforce to avoid accidents like Chernobyl. And when we came over to the United States, he couldn't get a job in the nuclear industry. The nuclear industry was in a deep freeze, many ways like it is now, although we might see a revitalization of it with some of the new cutting-edge modular reactors that are being developed by some interesting startups. But at the time, he just got a job as a programmer, and it wasn't very intellectually stimulating. So he ended up getting really deep into cryptography, and particularly the study of elliptic curve cryptography. He had an applied mathematics background. Really interested in the math behind how the ECC elliptic curve cryptography worked. And that was a hobby for him. And I, even though I was in high school at the time, saw the opportunity, commercial opportunity. I sort of said, hey, this encryption thing is becoming hot. Maybe we should start a company together. And we did. It wasn't anywhere near as successful as CrowdStrike, as you can imagine, because no one's heard of it. But it was my first taste of entrepreneurship. And more importantly, it was— my first exposure really to cyber, and an early realization— gave me an early realization that encryption was not the end-all be-all, and that cyber was really much more of a cat and mouse game, that if someone could steal your keys, it didn't really matter how secure your algorithms were. And it got me really passionate about this. And I think in part I got so interested in it because I love playing chess, and I found cyber to be as intellectually stimulating and interesting as chess because the unique thing about this domain, it's one of the few applied sciences out there where you face a sentient opponent. You face a human being that is going to react to anything that you do, right? Whatever defenses you put up, guess what? The adversary has a move to play. They can find a way around it. And you've got to think multiple steps ahead to make sure that you're still able to protect your customers, protect your data, and what have you.

Were there any role models that you looked up to in those early years? Was it your dad? You spoke a lot about him.

It was my dad. Now, he ended up staying kind of in the crypto space, and I started focusing on other things. But at the time, this was still a very new industry. In fact, when I got my master's degree from Georgia Tech in cybersecurity, I was the first graduate out of that program. It had just been set up. I kind of had to work on my own curricular for it because they sort of didn't have their act together in terms of all the courses and everything else that they obviously do now. So it was still very, very early on in the industry.

Interesting. I have been an immigrant twice, once moving from Ukraine to Canada and then moving from Canada to the US. I'm curious, in your experience, what were some of the early challenges when moving to the US? What was the hardest or maybe the most surprising for you?

By the way, I kind of skipped a little bit, but I had the same path as you where I moved to Canada actually originally first very briefly, and then we immigrated to the United States from Canada. So I can totally relate to your story. Well, to be honest with you, I mean, there's always challenges that you face as an immigrant, sort of building your life together and new friends, new schools, et cetera. But I think I was pretty lucky that I did it when I was still fairly young, and I didn't have perhaps as many issues as others who are older that have problems learning the language. Adapt into the culture and so forth. So I don't know. It's a good question, but I can't think of the things that were really, really tough beyond just life and making it out in a new country.

You know, I'm curious, how did you think about your journey pre-CrowdStrike? Most folks know about your experience during your time building out CrowdStrike, and that was really the last, whatever, 15 years of your life. Very few people really think about Dmitry pre-CrowdStrike. And just give us a sense for the types of decisions you made.

Yeah, so right out of college, I joined this startup called CypherTrust, which was started by Jay Chaudhry, who now runs Zscaler. And it was an incredible experience. It was still fairly small and grew to a decent size. It wasn't, you know, unicorn, but it was still a pretty good success. And I was able to join it when it was still relatively small and gave me the first startup bug in terms of a real significant size company. Our family company that I was starting with my dad in high school never really went big, in part because both of us kind of were distracted, me with school and him with a full-time job. So we couldn't really dedicate as much time to it as it needed. But with CypherTrust, you join a startup early on, and you get to do everything, right? You get to do— development, product, sales, marketing. And it's just— I highly recommend it to anyone coming out of college. Don't go to a big company where you're going to be pigeonholed and do one thing for the next 10 years. In fact, that was the experience that a lot of my friends from college had, where a lot of them went to work for Microsoft and stayed in those same jobs for 10 years. And I moved around and had lots of different experiences. A career trajectory that was really fantastic. But the other thing that was great about CypherTrust is that it was in email security. And they hired me actually because of my crypto background. Because at the time when I was joining them in the early 2000s, email security meant encryption of email. And they had all kinds of policies to secure communications between different companies. And they had good Fortune 500 companies that were buying that stuff. And I remember I was interviewing with Jay.

And this is Jay being Jay Chaudhry, just to be clear.

Yeah, of course. And Jay, I don't know if he still does it, but at the time he would literally interview everyone that's coming in the company. He would always do it on Sundays because the rest of the week he was doing other work, right? So he's a workaholic. And I was interviewing with him and I was asking about sort of the future of the product, where the roadmap was going. He said, you know, we're going to take a pause right now on the policy development around encryption because we have this thing that is popping up, spam, that we've got to take care of. So we're going to take a couple of quarters on the roadmap to solve spam. And then we'll get back to the core issue and talk to me about how the product is going to evolve. And he's like, and we need you to solve it for us because you were starting on the research team that that is going to be tasked with that effort. So as you can imagine, I absolutely failed in that task because spam is still with us here today, 25 years, almost 25 years later. And CypherTrust also never went back to encryption because spam went from almost 0% of the world's emails to 98% in the course of literally a year and evolved very rapidly. And I tell you, it was such a great experience to enter the cybersecurity industry in that field because virtually everything I learned about the field and how to think strategically came out of that experience because nowhere else did you see that rapid evolution on the part of the adversary reacting quickly to what we were doing on the spam filter side, right? So the spam filtering business started with just keyword searching. You got a dictionary of keywords, like looking for things like Viagra and so forth. And blocking that. And very quickly, the attackers evolved where they would start putting spaces in and obfuscating those words. And I remember Paul Graham wrote a blog post— Paul Graham of the YC fame.

Founder of YC. That's right.

Yeah, founder of YC. And he wrote this blog post about using Bayes' theorem to block spam, where you would basically tokenize the emails and look at each token and look at the probability of that token appearing in spam versus the probability of appearing in email. And it was this brilliant, very simple mathematical model for how you could block spam that, when you tried it out, was incredibly effective for like 3 weeks. Because immediately what the attackers did is they said, oh, we're going to just dump a lot of keywords into our emails that are present in a lot of legitimate email, like at the bottom, and break the base filter. And then you would react to that, and then they would introduce image spam so you couldn't tokenize the words, and on and on and on. And literally, they were reacting so quickly that as soon as you put something out, within weeks there would be a countermeasure to it. And that was not happening in any part of security, right? In the vulnerability research, things take much longer to evolve. New attacks do not appear overnight in terms of new ways to exploit vulnerabilities or the like. In the malware space at the time— today things are very different— it was also very slow progress where it took like 12 to 24 hours to put out a signature for a piece of malware, and often on the weekends they wouldn't put out anything. So the spam industry is really what taught me that you got to be much faster than the adversary. It taught me also that attribution and intelligence collection on attackers matters a great deal because I quickly found out that a lot of the spam was originating from actors in Russia, and obviously I had Russian skills, so I was able to get into the forums where they were discussing the various ways to bypass different products. And I was— at the time, they weren't very much focused on operational security. They were thinking that, you know, if you use Russian, no one's going to be able to figure it out. So you could easily gain access to these forums. Much, much harder today, because you got to be vetted and so forth. But at the time, it was relatively easy, and you could just sit there and read what they were doing and try to react in advance, right, before they would even put anything out. So it gave me that appreciation for the value of threat intelligence, for the value of understanding who's attacking you, for the value of building systems that are able to rapidly collect and analyze intelligence. In fact, we built what you would now call the cloud. So initially, CypherTrust sold appliances. So it would be sitting in a customer's environment, and you would push out updates to it, like antivirus, where you would get a regular anti-spam update. And we said, that's, A, too slow when you have an adversary that's changing things on an almost minute-by-minute basis. And two, you don't actually know how successful you are and where the failures are. So we said, let's build— we called it a reputation system that would basically query the cloud with the data about the email. And we have to be careful that, you know, you don't expose for privacy reasons the content. So it would be various hashes that you would take out of body of email and headers and the like. And you would start aggregating this data and seeing what attacks are being launched against all of your customers now, so the kind of the network effect of the collected threat intelligence. And then we started saying, oh my God, we're starting to collect all this massive amounts of data. Again, this was like early 2000s, right? And why don't we apply machine learning, or as you would now call it, AI, to all this data to see if we can block it automatically? And a lot of the stuff that's coming up now, we were actually able to build back in those early days.

Dmitry, your background is indeed very fascinating about how you start with the, you know, ECC, you're a chess player, you adapt and move fast, ideally faster than the enemy. Talk to us about as you move into the CrowdStrike story of your journey, how you and George decided to work together and how do co-founders bond so well where they create an iconic company?

Yeah, so it was really opportunistic. So So just to wrap up the CypherTrust story, CypherTrust ended up getting sold to another company called Secure Computing, which was a public company. I ended up taking a bigger role in that company, because that company was also doing network security. They had a firewall business. They were also doing web security. They had one of the pretty significant market shares in web filtering at the time. And I ended up taking basically the research teams across those platforms under me, including email security. And I also, at that time, saw that what we did with the cloud with email security could be extended to other areas. And I proposed to our board to invest in a product that would do web-based cloud security. And the funny thing is that as I was doing that, Jay had sold the company at that point and was out. He was having the exact same revelation, and he started Zscaler with the exact same idea to do cloud security. So we ended up competing very briefly. It was very brief because Secure Computing ended up getting sold to McAfee a very short time later. So just as I launched that product and started selling it, we ended up getting absorbed by McAfee and McAfee decided to promptly kill that product. So Jay went on to an incredible success with Zscaler and my product, which I thought was very competitive and very good, ended up getting killed inside a big company, which was another valuable lesson, by the way, about big companies and the lack of innovations and sort of systemic challenges and friction that you face in trying to innovate inside a big company. But at McAfee, I ended up taking the role of running ultimately all the threat research and investigations. And in 2010, I get a call from this company called Google that you may have heard of., and they had just experienced the issue of China hacking into their networks, and a number of other companies were impacted in that same attack, and many of them were McAfee customers, so they called us to work on this together and to notify our customers and figure it out. And then I ended up running that investigation for us and named it Operation Aurora, which I felt at the time was going to be a very groundbreaking thing, because when I realized early on that this was a nation-state intrusion into all these different companies. The first time that you had seen in the public domain China or any nation-state breaking into companies and steal intellectual property, I realized instantly it was going to be a watershed moment, which by the way is why I named it Aurora, because Aurora was the name of the Russian battleship that fired the, the shot that was a signal to Lenin in 1917. To launch his Bolshevik Revolution. It's been called the shot heard around the world. It changed the course of the 20th century, obviously, with the creation of the Soviet Union and the Cold War. And I knew that this wasn't quite as significant as the Bolshevik Revolution, but it would be very significant, certainly, for the cybersecurity industry. It ended up being very significant for my own career. And the first thing I did is I asked myself, well, is this the only thing that's happening? A fluke where China just decided to hack into these two dozen companies and that was it? Or is there a trend to this where a lot more is going on than we realized? And I started looking at our data we're collecting at McAfee, obviously huge customer base, and realized that this was happening very frequently. Started putting out all these threat reports, Night Dragon, 10 Days of Rain, which was North Korean hacks into South Korean victims, and then Shady RAT, which was another major unveiling of a group that actually later became the APT-1 report. It was the same group that I had put out an early report on back in 2011. And as I was doing all these reports, part of that investigation was notifying companies that had been victimized. And in almost every case, when we would pick up the phone and call them and say, "Hey, we just discovered that the Chinese are in your networks," in almost every case, they had no idea. And usually the actors would be in their networks for years And it would be a complicated process to get them out. But I realized that this was a huge problem and that no one was really solving it. And I was trying to kind of solve it within McAfee because it wasn't necessarily my intention to go start a company right away. But I saw a problem, and a lot of our customers are getting breached. Let's figure out how to solve it. It was really, really hard to do at McAfee because it was a public company, very much focused on the next quarter, We would continuously have hiring freezes. Like, you would get a budget for the year. You start planning how you're going to allocate that budget. And then we miss a quarter, and suddenly all your recs go away, right? Very hard to plan, very hard to innovate. And a lot of legacy thinking as well, a lot of sort of the antivirus mindset from the 1980s that this is not really about intrusions. It's just about malware. And why do we need to think broader about this? So it was very frustrating, and then— clearly there was a problem. I realized that we had ideas how to solve it, but no one was actually willing to do anything about it. And that was sort of the light bulb went off that this is an opportunity here to start a company. And also McAfee at that point had also gotten sold to Intel. And Intel was an interesting company because it was a hardware company for the most part, and we were a software company. I remember sitting in a meeting with the Intel folks before the acquisition closed, and we were talking about all these great ideas of how we're going to put security in the silicon and what capabilities they could do. And I was amazed because they were so receptive. They said, like, literally all these ideas we're putting forward, they're like, yeah, we're going to do it all. I was like, wow, this is phenomenal, at 2011 timeframe. And then I said, well, when do you think you can ship it? And the answer was like 2020. I was like, what? Excuse me? All right. They're like, well, yeah, that's the first opportunity for us to really get a lot of this stuff out. And I'm like, yeah, I have no idea what the threat landscape is even going to look like in that time frame. I'm pretty sure I'm not even going to be at Intel at that point. That's just not going to work. The threat landscape, remember, back to the spam days, moves so quickly that you've got to iterate so quickly, like getting stuff in hardware over that long period of time. That's ridiculous. And that's when I knew, A, I had to leave. Two, there was this big problem. Three, that we are never going to solve this problem at McAfee. And yeah, that's when we got together and started pitching to various investors. We actually didn't pitch to that many investors.

And how did you pick George? Maybe just talk a little bit about how did you pick George?

Well, we were working together at McAfee. Working on some of these investigations together. And he appreciated this problem as well. And yeah, we got started working together. And on the investment side, we literally pitched to two firms. We got term sheets from both. And we ended up picking the better one.

And then how did you decide that you were only going to work with George? There were a whole bunch of amazing people at McAfee. Whether that's, you know, you had folks like Mike Fay, Mike DeCesar, Chris was there. How did you pick George specifically?

We were just working together. So we worked together on Aurora, some other reports and investigations. So we were spending a lot of time. I saw the problem and it was just natural.

Yeah, when looking back at successful companies, it often feels that their success was almost inevitable. And at the same time, we know that that is not really the case. So what were some of the tough decisions that CrowdStrike had to make for it to get where it is today?

Oh, there were tough decisions every day. Success is never a straight line, and there were existential threats to the company almost every day. It's amazing. You look on it now and it seems like, oh my God, you guys were just— it was inevitable you would succeed. That was certainly not the case, and it was a tough slog for a long time. And there are many decisions we made that were very forward-thinking. I'm a passionate believer in sort of the Steve Jobs philosophy of focus, that you got to really concentrate on what you're good at and get rid of all the distractions and say no, right? Focus is all about saying no. And, you know, we said no to a bunch of things. So when we were starting, obviously we were building an endpoint security product, and there was still a lot of Windows XP systems out there, And we realized early on that if we decided to support Windows XP, as virtually all of our— I think all of our, actually, competitors decided to do, that that would really limit dramatically our architecture, that we couldn't do all the advanced things that we wanted to do and support XP. There were just too many limitations on that platform. So we said, "You know what? We're not going to support XP. We're just going to start with Windows 7 and above, and obviously Mac and Linux platform later on." But— That was a tough decision, because many customers are like, I'm moving to Windows 7, but I still have XP, and I may not move to XP for a couple years. And we're like, well, I guess we're not right for you. Very tough decision, and we lost deals because of it, but it was the right decision, because it enabled us to build the right architecture that I think ultimately helped us win the market. Second, we knew from the get-go that we wanted to do the cloud. So the same idea that I had back 10 years earlier at CypherTrust to aggregate all the threat intel, for email and apply machine learning to it and so forth, we could replicate and we should replicate this in endpoint security. But right away, we hit customers in financial sector and elsewhere that were like, we'll never do cloud. And it would have been very easy to say, well, we'll build you kind of private on-prem solution. And many of our competitors went down that path. We said, no, that'll break our model. A, that will create a divergent A, sort of engineering track where you're spending resources on this and that, that will slow you down, and two, the whole model is sort of this network effect that everyone contributes their threat data to the cloud and you're able to protect everyone as a result. So we're not going to do that. And again, we lost customers, prospects, because we just chose to do that. In the end, we were believers that everyone would one day move to the cloud, which is what happened, but it required— strength and patience. And those were tough decisions. So there were just a slew of decisions like that that I think we made early on. I'll tell you, the best decision we made is raise as much money as we did. It doesn't sound like much today, but in 2011, we raised $25 million off a PowerPoint deck. That was a lot. I mean, today it's like an average seed round, I guess. But back then, it was quite a bit. And that really, I think, more than almost anything else, helped us win. Because we raised more than anyone else. What I see oftentimes in companies is they don't raise enough money. They build a prototype. They kind of demonstrate that it's somewhat successful. And then they raise another round, an A round, off that prototype. And then they're like, well, that was a prototype, so we have to throw it out. And we have to start from scratch and re-architect it, right? We never did that. We built it right from the get-go, and that gave us an opportunity to keep moving faster, right? And didn't slow us down with the architectures and the like.

Maybe talk a little bit about scaling and scaling CrowdStrike.

Yeah, so initially things were pretty tough because, A, cloud, 2, we don't support XP, 3, we're solving the problem that not many people even know they have, which is the quote-unquote APT problem. Right, because we weren't initially an antivirus. That was later in the plans. But we first thought, let's solve the hardest of the hardest problems, which is how do you defend yourself against a nation-state threat? And we were detection only at the time without any response options. So we were going to companies who were like, what's an APT? Nation-states? Do we even have that problem? 2, you're cloud. 3, you don't support all our devices. It was rough. It was sort of slow going initially, but we figured out that there was a litmus test that was very easy to determine whether a prospect early on in the process was going to be the right one, was going to get it. And that was when we would qualify them with 2 questions. The first question is, have you had an APT incident? And if they give you blank stares, you know that it's time to wrap up the meeting. And two, we would ask the CISO about their background, and if the answer was that they had just come out, as a number of them have, out of the government, out of the intelligence community, out of law enforcement, even if they hadn't had an incident, they were aware of incidents from the classified realm and would understand what we were trying to do, and we would have much better traction than with people that had no idea, right, about what the threat landscape looked like. So that kept going for a couple years, and then you ultimately kind of hit the inflection point where, you know, frankly, you know, I got to give credit to Kevin. The Mandiant report, the APT-1 report that was for the same group that I covered in my ShadyRAT report years earlier came out. It became— gave much more prominence to the threat landscape, and that helped. And then we got into a pretty tough competition with Silence, a competitor at the time that was focused on building an antivirus that was machine learning-based antivirus, and they started to see a lot of traction. And we've always had on our roadmap the idea that we had to do prevention and that we had to do not just detection for APT threats, but detection and prevention of malware. But to be honest with you, we felt like having come out of McAfee, we knew what it would take to replace McAfee or Symantec. That it's sort of like IBM. No one ever gets fired for buying it, right? So to have a startup come in and say, hey, we're going to replace your McAfee footprint seemed like it was going to take an enormous amount of effort. And we were kind of pushing it and pushing it until we got the APT thing really solved. And Silence, to their credit, spent enormous amounts of money on marketing, sort of convincing people that AV was broken, which is what you had to do to get people to start thinking about replacing their McAfee and Symantec. So when we saw that, when we saw them create that opportunity, we immediately said, okay, we gotta accelerate our efforts, get the AV product out the door, which we did in record time. And then we had kind of the full scope solution. We had the AV, we had the, what is now called EDR, endpoint detection response. At the time, there was no real name for that category., and that really just allowed us to take off.

So we go through this journey, you know, you go public on the NASDAQ, you go and build out one of the most valuable companies that's out there, and then the beginning of 2020, right before COVID you announce that you're effectively retiring. You're in some ways retiring, and then, you know, that's when I want to talk a little bit about Dmitry the investor and Dmitry the advisor. Which is our third section today. Today you're now, you know, this active angel investor. You're in a whole bunch of companies, including a few that I've invested in.

Not just angel, really every stage.

What do you— yeah, angel in that, like, you're investing for yourself. You're not in— you're absolutely right, you're investing at all stages, but you're investing for yourself. You don't have a— you're not trying to run an institutional venture firm, uh, and I know you don't want to do that. What traits do you think define successful founders? You have been, and we can absolutely say this, you've become a successful founder. What do you look for?

You know, that's such a great question. And, you know, one of the big lessons for me in the last, you know, 4 years where I've really been focused on this, including with you where we invest in some great companies together, is the importance of the person over the idea. You know, it's so easy to fall in love with an idea where you get a pitch and you're like, this is perfect. I know exactly that this is what the market needs. The solution is fantastic. You know, how quickly can I write this check? And you have to stop yourself and say, is the founder right here? Do they have the perseverance? Are they a learning founder or are they so focused on their own ego and reputation or whatever, that they're not willing to take advice, they're not willing to absorb data, autocorrect, and what have you. How do they deal with adversity? Because you're going to face it. You're going to face existential problems in your company, guaranteed. And are you going to have the backbone to be sort of a wartime CEO and do what's necessary, whether it's to cut, whether it's to pivot, whether it's to, you know, when things get desperate, you know, get on the phone yourself with customers and get those deals closed, make sure you get paid, make sure you make payroll, right? And we've seen that in the last couple of years with a lot of companies sort of experiencing that existential threat because it was kind of easy to start a company in the zero interest rate environment when there was an unlimited amount of money and virtually any idea was getting funded. And then suddenly all that dried up and companies couldn't raise anymore, and you had to figure out how to get to profitability. And many— for many, it took too long to recognize that the world has changed, and some of them went out of business, right? Or some of those CEOs got replaced. And for others, they adapted and were able to do the right thing. So looking for the person— it's really hard to figure out whether they've got what it takes to do this— is really, really important, more important even than the market, the idea, and that's been I think something that is not paid attention to as much. Experience matters as well, but actually less than the perseverance of the person, the learning capability that they have, to just the hunger to understand what needs to happen.

What is the one piece of advice you find yourself constantly sharing with the founders you end up investing in?

I don't know that there is one piece of advice. One thing that— What I do tell them to do is focus. So many want to do so many different things. And they need to, particularly in the early days, make sure that they become excellent at the niche that they're in, and then expand from there before they try 50 different things. Because if you're doing too much, you're likely not doing any of it well. The other thing is the importance of great hiring. Don't outsource hiring to recruiters. Don't outsource hiring to HR. In fact, you should be the best recruiter in the company. I hired almost the entire launch team myself at CrowdStrike and went after people that I thought I had 1% chance of getting, right? They were just the elite of the elite. One person I always cite is my friend Alex Ionescu that was our chief architect for many years, literally the guy who wrote the book, literally the book on Windows internals, and knew the inside out of operating system better than anyone else on the planet, like categorically. Like Microsoft would hire him to teach their developers about what's in the Windows kernel. And he worked at Apple where he was doing very well. And when I reached out to him, it was like, no. Like, how many times can I tell you no? And I didn't take no for an answer. I kept pushing. I kept pushing. I kept pushing. And ultimately, he joined. And he was an incredible part of— the reason for why we were successful and why we had an incredibly elegant product and highly capable product. So going after people like that is just so crucial. And people settle. I see founders that are like, oh, I've got to hire some engineers. And this guy is not as great as I want, but I just got to get him into a seat. And I'll up-level them or do something with it later. And that's always, always a mistake. My favorite phrase about hiring is, and frankly firing, is if you're not sure, you're sure.

And that's a great piece of advice, Dmitry, on people. As we look at investors, one of the questions that comes up is what attributes do you look at in other cybersecurity investors and what advice would you have for them? One text message that I just got a few minutes ago as we look at the investment landscape is that there are companies that are becoming successful, also companies that are failing. So Lacework, which is valued at over $8 billion, is now in talks to be acquired by Wiz for $200 million, $300 million. It's a company that has raised $1.3 billion. And so the markets have changed. The amount of capital that is flowing in has increased. The number of cybersecurity investors have also increased. So if you were to team up with some investors, what are the attributes that you look for and what advice do you have for the investment community?

Well, stop funding so many features as opposed to products or companies. I'm actually pretty negative on investing in cybersecurity. I invested in a few companies, but largely, I actually invest outside of cybersecurity because I just see so many companies not really building visionary products. They're building a tiny improvement on a particular feature. And the problem we've had is that over the last 5, 7 years, there's been so much money that virtually any of these ideas can get funded. But now a lot of these companies are going out of business because they're not products, they're not platforms, they're certainly not companies. And look for those big ideas that can really change the game as opposed to just improve things slightly. Look for ideas that people haven't done before or, or doing something that people have done before but radically different. In a way that's going to change the game, right? I mean, we did antivirus at the end of the day, but we reinvented what it meant to have an antivirus, right? And those are the types of big ideas that can ultimately get you to be very successful. I think it's been relatively easy to be an investor in the zero-interest rate environment, because virtually any company would get funding after your round. And there was a lot of M&A going on, because it was free money. And now you see so many of these funds struggling and realizing that, oh my God, actually, like, just even returning capital in a fund is really, really difficult, right? Much less, you know, having a 2x or 3x fund that you're returning. And you've got to be much more discerning about the opportunities and the checks that you write.

Dmitry, let's switch into the last section of our podcast. Which is, you know, Dmitry the policymaker. And, you know, I'm curious to get your thoughts on even that concept. But while you've been this investor and advisor post-CrowdStrike, you've also spent a lot of time thinking about geopolitics and what's happening in, you know, the world as a whole. And you did two things. One, right after leaving CrowdStrike, you co-founded this new policy think tank called Silverado Policy Accelerator. And the second piece was you wrote, you've been working on this book, which you've just launched. And by the time the listeners are listening to this podcast episode, it'll be out on the shelves and on Amazon to buy, which is called "World on the Brink." What motivated you to do both these things? 'Cause they're very different from the cybersecurity community that you've been part of for way over 2 decades.

Well, I guess I always straddled this area. And in college, as I was taking all these cyber courses, I was also taking a lot of international affairs courses. I've always been passionate about this. I've always been passionate about giving back and was actually an advisor to the Department of Defense while I was at CrowdStrike and did a number of other things to advance the national security interests of this country that has been so good to me. And I felt it was important to contribute back. And I really have always been passionate about trying to do more to figure out how do we make sure that this century remains an American century, the way that the 20th century was. And I've been, particularly since Aurora days, and even before then, but Aurora really put this front and center in my mind, been very concerned about China and what China was doing to rip off our intellectual property, to engage in all kinds of anti-competitive practices, to engage in their military buildups in the region. The concern that I had is that we weren't paying, A, attention to that, and B, not leveraging the strengths that we had here in America with our innovation engine, with our incredible military assets, the defense industrial base, the economy, to actually make sure that we defeat China in this new Cold War that we're unquestionably in. And I make the case in the book that we are in this Cold War, which is actually remarkably similar to the first one. I actually compare, go back through the Cold War One history, as I call it, and look at what was going on then, what is happening now, and how similar the two conflicts are. And, you know, I wrote this book, and really the work we do at Silverado is making sure that we can, A, define what winning means in this new Cold War, and how do we actually achieve that victory. And what winning means is actually not a trivial thing to understand because During Cold War I, it was kind of relatively easy because we had the benefit of this gentleman named George Kennan, one of the great international affairs thought leaders back in the first Cold War, who was actually stationed in Moscow on behalf of the US government, the State Department, and he wrote the telegram that was called the Long Telegram that was later published as an article in Foreign Affairs. That basically outlined the entire strategy for winning the Cold War. And his big revelation was that Soviet Union was this unnatural entity that would one day fall apart because of all of the challenges that they would face with the ethnic minorities and ethnic nations like Ukraine and Belarus and the Baltics and others that would one day want to be their own countries. And his revelation was that we just need to wait them out and avoid getting into— disastrous war and we would win. Well, with China, China's not going anywhere, right? It's been around for 5,000 years. It'll be around for another 5,000, 10,000 years, who knows? And even the leadership of China, there's a lot of people in DC that have these dreams of one day the CCP will fall. Well, maybe one day it will fall, but we can't count on that. And frankly, when you look at the case of Russia, the Communist Party did fall in Russia. Well, we're now facing Vladimir Putin. Is that really any better? So just counting on the regime change that you can't even affect in any way seems like a pipe dream. So, you know, I wrote the book looking at all aspects of this competition with China, the military dimension, the diplomatic, the economic, the technology one, the cyber one, and how do we systematically define what it means to win and how do we actually achieve that. And I think this is an incredibly important issue right now because most people, most Americans, I think, do not appreciate the precarious state that we're in today, that we're truly a world on the brink, that we're heading towards a conflict that is almost unimaginable, right? I believe that China could invade Taiwan as soon as 4 years from now, as soon as 2028. In fact, the book starts out with a detailed scenario of invasion that I spent a lot of time researching, spending time in Taiwan, spending time with military experts in Taiwan and in the US military. Thinking through how you would actually accomplish it. And if that happens, that will change the world in much greater ways than even the Ukraine conflict has changed the world. And it has obviously made us all less secure. It helped create more inflation. It created all kinds of instability in Europe and so forth. This is going to be 1,000 times more impactful. And particularly, of course, if the United States actually chooses to fight for Taiwan, as President Biden has now said on 4 occasions, that he would send American troops to fight for Taiwan, you're talking about a conflict between two nuclear powers, and who knows if it stays conventional.

So why should US citizens care about what happens in Taiwan?

Great question, and my book answers that question. So a number of reasons, and I'll talk about it from a purely sort of selfish American perspective, right? There's obviously humanitarian reasons, protecting freedom, democratic outpost in, in Asia. Taiwan is a very vibrant democracy. But, you know, frankly, that's also true of Ukraine, and we're not fighting for Ukraine, right? So why is Taiwan different? A lot of people would say, and some have said in political establishment in this country, that it's chips. And look, chips are important, and Taiwan is manufacturing about 60%, over 60% of the world's semiconductors, which are critical to everything, right? AI, manufacturing of iPhones and laptops and cars and microwaves, you name it. The entire economy runs on chips. So if China invades, that will end because those fabs will get destroyed very likely in the course of invasion, and it will be a disastrous outcome for the world immediately. But that's not really why we should care. I mean, it's, it's a little bit of a reason why, but it's not the main reason. The main reason is why, why we should care about Taiwan is is because we've actually cared about them from a national security perspective in this country for a very long time, long before the age of computing, long before chips were even a thing. In 1950, Douglas MacArthur, General MacArthur, called Taiwan, Formosa as it was called at the time, the unsinkable aircraft carrier because of its strategic geopolitical position in that region where Taiwan is sort of like the cork that keeps China bottled up. If you look at the map of China, and the region. And one of the things I do in the book is I actually rotate the map where I put China on top looking out down, and you immediately see the dilemma that they face because they're essentially contained by the US military bases and our allies in the region. So if they look out west, they see the Korean Peninsula with South Korea and significant numbers of American troops there. They look further down and they see Japan. Japanese islands that have American Marines on Okinawa and all kinds of military assets that we have on the Japanese islands. Further is Taiwan, which is really at the center of that first island chain, and which is, you know, they view as an outpost of America. And further down you have the Philippines, where we once again have American bases, right? So they're basically fully contained today. And if they take Taiwan, They'll be able to project their power across that entire region. They'll push us out. Today, that region is basically a lake for the United States Navy. That will end immediately. As soon as China takes Taiwan, they'll be able to put their submarines on the other side of the, of the island, put all sorts of sensors, will make it very, very dangerous for us to operate there. They'll kick us back basically all the way to Honolulu, and they'll dominate that region. Now, when I say dominate, I don't mean that they're going to invade Japan or Philippines. That's really, really tough to pull off. For anyone, but they're going to bully people around in the way that you see Russia bullying people around in their neighborhood, right? So, you know, you look, for example, at states like Armenia or Central Asian states, they're basically in Russian sphere of influence, not because they want to be, but because they have no choice, right? They're small power compared to the big bully that they're next to. And we're far away, we can't do anything for them, so they have to accommodate accommodates Russia. And in the same way, countries like Japan, South Korea, Philippines, and, and others in the region will have to accommodate China if China becomes a hegemon in the region. And they will become that hegemon if they take Taiwan. And the entire American strategy, of course, for centuries has been to prevent hegemony from developing in all parts of the globe, but particularly in Asia. That is the most important region in the world. Right? It's 50% of the world's GDP, most of the economic growth. A lot of our supply chains are reliant on, on these countries in Asia. To allow China to dominate Asia gives them enormous amount of power. So, you know, I basically believe that if China takes Taiwan, that will give them enormous influence in Asia. Giving them enormous influence in Asia gives them enormous influence in the world, and that means that America sort of pulls back into its own borders Now we are surrounded by two oceans, but that will mean the end of our superpower effectively around the world. That is not just helping the world in protecting trade routes as we're doing right now, for example, in the Red Sea, trying to keep them open against the threat of Houthi missiles, but it's also about— and supporting Ukraine against the invasion from Russia, but it's also about making the world safe for American goods, for Americans to participate in, right? The rise of American superpower is directly correlated to the rise of the US Navy. And in the 1900s, Teddy Roosevelt, in the early 1900s, sent the famous fleet, the US Navy fleet, around the world on a circumvention tour to basically announce that America has arrived, that we were now a global naval power. And you see the rise of America being traced directly to that, to those events and the developments in our naval capabilities that allowed us to project power all over the world, right? And that will be absolutely in danger if China takes Taiwan and dominates Asia. And that will be the end of the American century.

It's fascinating, Demetri. Like many of us, we're looking forward to reading the book. And as you gather these data points of how US Navy played a key role in establishing American power, there are a couple of questions that come up as you look at the next, let's say, 12 months. Number one is we're looking at presidential elections in the US. The two candidates are pretty obvious, Donald Trump and Joe Biden. And how will that change not just global policy, but cybersecurity, which is an integral part of the landscape today? Maybe it was important once. Today, cybersecurity is equally important, if not more important. So there are some of our friends who talk about US should get into the offensive side of cyber. There are some who talk about how we should continue to play defensive, but—

Well, we are. We've always been.

Thank you.

And there are some who say how technology can be exported but to select group of countries. All of these are going to get rolled up into this big political conundrum starting next 12 months. How do you see this playing out?

Yeah, so I've always believed, you know, in that phrase that a lot of people talk about that, you know, you may not be interested in geopolitics, but geopolitics is definitely interested in you. And that was also, by the way, an early decision in CrowdStrike when we met with our investors potential investors, we right off the bat said, we believe that you have to choose a side in this fight, that you can't be sort of an arms dealer to everyone, and even if you're providing defensive technologies, and that we told our investors, do not count on us ever selling in China, Russia, well, Iran, North Korea, where you can't sell anyway because of sanctions, right? At the time, there were no sanctions on Russia in 2011, and We said, make sure you're comfortable with that, because we are going to be detecting intrusions from those nation states. We're going to be attributing them. We're going to be calling them out. We're not going to be doing any business there. And a lot of companies did not want to take that, that path, right? Symantec and McAfee had business in China, had business in Russia, that I saw firsthand what was happening to it as I was putting out these reports. And it was basically being told, "Hey, Dmitri, like, this is really bad. Stop," when I was at McAfee. So, that— everyone needs to appreciate that we do have Balkanization taking place, and you got to pick a side. And, you know, for me, it was always easy. It was always going to be the side of this country, the side of America. But you're right. Any type of conflict these days has a cyber dimension. We're seeing it play out in Ukraine, where you've got cyber being an enabler with kinetic capabilities that are being launched, really, by both sides against each other. And of course, the most impactful cyberattack that had occurred so far in this war was the compromise of Viasat in the first hours of that conflict, a satellite communications provider to Ukraine. That was an American company, right, that was not a party to the conflict, didn't think that they had anything to do with them. Ukraine was just one of their many customers. But because it was one of their many customers, their networks were compromised, and malicious a firmware update was released to the terminals of many of their customers, mostly in Ukraine, but also outside of Ukraine, and they had to deal with that issue. So no one is unimpacted by this. And certainly, you know, when it comes to conflict with China, we're already seeing threat actors like Volt Typhoon, for example, that are breaking into critical infrastructure around this nation, not doing anything damaging yet, but doing reconnaissance, maybe prepositioning so that if conflict does arrive, they can do something damaging, trying to deter us from intervening potentially, maybe delaying us from being able to send resources to the region. So cyber plays a really fundamental role in all of that.

And, you know, Dmitry, like you correctly said, we may not be interested in geopolitics, but geopolitics is interested in you. You know, one example that I can quote is that as a seed stage investor, I'd invested in a company headquartered in Ukraine. Majority of the team is in Ukraine. And of course, as all of this started to unravel, we had to deal with the situation in real time, relocating the team to parts of Spain, parts of US.

Well, you were lucky, by the way, because— yeah, you were lucky because they closed the borders, right? And a lot of people couldn't leave. And I was dealing with a case where a friend of mine asked me to help. But, you know, he was invested in a cyber company that had also developers in Ukraine. And one of their developers did something stupid, violated the curfew, stayed up too late, was arrested, and was going to be sent to the front. Because immediately, basically, if you're arrested, you get mobilized. And they were asking me to help to at least move him into a cyber unit so that he could leverage the skills. There's no way to get him out. Once you're in, you're in. But probably taking a computer nerd and sending him to the front to be, you know, fodder for artillery was not the best thing for him or Ukraine. And, you know, those are the types of things that you have to deal with, right, when you're hiring people there in a war zone like that.

You know, last question from me, Dmitry, to end things. We talked about 4 different chapters today. We talked about Dmitry, the person, Dmitry the founder, Dmitry the investor, and Dmitry the policymaker. If we were to do this all over again in a couple years, what would be the fifth chapter? What's next?

I don't know. Look, if I succeed in my task here of sounding the alarm bells about China and actually getting us to do what is necessary to deter that war, I can die peacefully, right? I mean, that would be an incredible accomplishment. To help usher in. And, you know, I'll tell you a quick story, Sid. You've seen that email. I think I've shared it with you. But as you know, I was one of the first geopolitical forecasters to predict that Russia was going to invade Ukraine. I did so in December of 2021, almost 3 months before the start of that conflict. And I said that they were going to do it before the end of that winter. Unfortunately, it was proven right. But I didn't just say they were going to do it. I outlined in a long thread on Twitter all the reasons why. And that thread got a lot of attention, got a lot of retweets, got some criticism from people saying, "No way, this is not going to happen." But the war begins, and sometime later I get an email out of the blue from an individual I've never met who was an immigrant from Ukraine to the UK, and he said that he had encountered my thread and did not know me, was not in a cyber or technology industry, but got convinced by my arguments and tried to get his family to leave the country based on those arguments. The family refused, his parents there and siblings, they said, "This is all propaganda, this is nonsense, there's not gonna be any war." And he kept pushing and pushing and pushing, and finally on February 15th, right, the war begins February 24th, he manages to convince them to go to Turkey, he buys them tickets, for a brief vacation. He said, "Go for a couple of weeks and then you'll return." They leave, they don't return, 'cause the war starts, and they lived in Kharkiv, a city in eastern Ukraine. They lived on the outskirts of the city. Their neighborhood was pretty heavily shelled by the Russians. A number of their neighbors perished. And, you know, he wrote me this fairly emotional email saying that, you know, their lives may have been saved because he encountered my thread and pushed on them to leave. So, I've done a lot of things in cybersecurity. I don't think I'll ever have that type of impact in cybersecurity. And that was one family, one individual that maybe I had a little bit of a role in helping save their lives. And if I can play a very small role in helping to deter a much more disastrous war for the entire world and for this country with this book and with the efforts that we're doing at Silverado,— that would be an incredible accomplishment.

So maybe the fifth chapter is Dmitry the travel explorer or something like that. That will never happen.

There will always be new challenges. You know, one thing I don't do is I don't do any sort of forward career planning or the like. I never found that useful. I know a lot of people do that. I found it more useful to just look at the opportunities that come your way and try to recognize when they appear and grab them. So that's always been the case for me. You know, I didn't set out to be in cybersecurity. I just kind of stumbled upon it because of the hobby that my dad had, and I saw an opportunity there. I saw an opportunity to join CypherTrust out of college. I saw an opportunity to start CrowdStrike. So, you know, those were not planned things, but they just popped up, and, you know, I guess I was lucky enough to grab them, recognize that they existed, grab them.

Well, thank you, Dmitri, for joining us on Inside the Network. For all the listeners out there, if you want to hear more from Dmitry, you can listen to his own podcast, Geopolitics Decanted, or of course, you can buy his new book, which is now out, World on the Brink. You can get it on Amazon. Any other ways, Dmitry, that folks should follow you?

You know, on Twitter or X, you know, I'm @dlparovich, my first initial and my last name. And yeah, listen on the podcast, buy the book. Also, if you like the book, please review it. If you don't like it, don't review it. And I hope you enjoy it. Thanks so much.

Thank you.

Thank you, Dmitry. Thank you for joining us Inside the Network.

If you like this episode, please leave us a review and share it with others.

If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and send it to me first.

No, don't do that. Mahendra gets too many gifts already. Please reach out by email or LinkedIn.