Dug Song: Values over valuation—reflections on building Duo Security and leading with purpose

Welcome to Inside the Network. I'm Sid Trivedi.

I am Ross Haleduk.

And I am Mahendra Ramasinghani. We have spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators, and investors building the future of cyber.

We will talk about the hard parts of the founder journey, launching companies, getting to product market fit, raising capital, and scaling to an exit.

And yes, we will also be talking about epic failures.

But Mahendra, we're here to make the founder journey easier.

That is correct, Sid, but we cannot make it too much easier because startups are hard. And of course, you already knew that.

All right, you two, enough. Let's get started with this week's episode.

Our guest today is Doug Song. Doug is best known as the co-founder and former CEO of Duo Security, a company that transformed the way organizations approach security by making it simple, effective, and accessible. Under Doug's leadership, Duo grew from a small startup in Ann Arbor, Michigan to a global powerhouse with over 50,000 customers. The company was acquired by Cisco in 8 years for over $2 billion. And here's the best part: Duo is probably the only cybersecurity company that consumed less than $20 million to reach a unicorn status. In a day and age when the focus is on valuations and hype, Doug's focus continues to be on values and serving the customer. He is actually the only unicorn CEO we know who is embarrassed by that term unicorn. Doug's impact goes well beyond business success. A self-proclaimed software communist and a lifelong hacker, he has spent his career challenging the status quo, be it in security, company culture, or styles of leadership. From his early working days on OpenBSD and OpenSSH to founding Arbor Networks, and now shaping the next wave of innovation and entrepreneurs. Doug's philosophy has always been clear, or shall we say, Doug's dynasty, the Song Dynasty, has always been clear: put people first, solve real problems, and challenge the entire industry to do better. In today's conversation, we'll explore his journey from a gritty childhood in Baltimore spent hacking, to his approach of building a business, why he believes security can be better than a used car lemon market, and above all, how to build a culture that matters. Get ready for an insightful, no-nonsense conversation with one of cybersecurity's most original thinkers. Let us dive in.

Hi, Doug. Welcome to Inside the Network.

Hey Sid. Hey Mandrill. Hey Russ.

Let's get started with your early life way before Duo. And let's talk about you as a kid. You started using computers when you were around 8 years old doing data entry for your father's liquor store. I believe that was in West Baltimore. You grew up as a Korean immigrant and, you know, somebody who was working right from the early days. What lessons did you learn during those early days that later shaped your mindset as an entrepreneur?

Yeah. Um, uh, well, I guess part of that was, uh, realizing how difficult entrepreneurship was. My dad, uh, again, had, had two liquor stores. So the first was in West Baltimore. The second later was in Jessup, Maryland, about a mile from the state penitentiary. And, um, in both cases, these were not the best places you'd want to set that up. And so, so for a long time, I probably had a somewhat negative impression actually of, of building businesses and of of all that. Although I was proud, proud of what my dad did. I was, I thought it was cool to go with him to the store. I thought it was not so cool that I worked for so long for him for no money. But, uh, you know, that was the, the price of having a roof over my head. But yeah, I mean, I, I saw my dad build it from nothing and, and maybe more importantly, build it in community with folks that, um, you know, for me, formative in my life in a different way. Uh, many folks later in my career helped me with, uh, you know, access to, uh, opportunity and so forth.. But in my dad's store, I saw a lot of people who had basically none. And my, my dad had hired some homeless teens who lived in the motel next door. He also hired a, a returned citizen from the penitentiary who lived in an abandoned milk truck in our parking lot. And so I, I saw pretty early how business could actually be a positive force for good in creating an opportunity for folks. And Anyway, it has some bearing on how I thought about building the company later, but my company later, but those early days, sort of seeing my dad kind of make something from nothing and bring a lot of people with him along the way was sort of the biggest impression left with me that business could be a positive force, right, in society.

And was it your father who got you into data entry and computers in those early days, or was it just yourself? You said, hey, like, Computers are a useful thing in this case?

No, no, no, no. 8 years old in the '80s, I had no impression of computing outside of what my father had brought home, but he was a gadget freak. And so you name kind of any piece of consumer technology, we had probably the earliest version of it, the V1 of everything, of a bread maker, first CD-ROM, or sorry, CD player, and early PC, XT, AT sort of days. Running a liquor store off of software that I don't know where he found. It's called RetailMate, but it was one of the first pieces of software, I think, for retail that I'd ever heard of. But yeah, it was my access to a lot more opportunity online, pre-internet with BBSs and all that kind of thing. So I'm very glad that he was a gadget freak and that definitely rubbed off on me.

Doug, while at the University of Michigan, you joined the hacker collective Woowoo alongside the future tech leaders like WhatsApp's Jan Koum and Napster's Sean Fanning. Can you share a story of how the group's culture impacted the way you would eventually build companies? Yeah.

Yeah. I mean, you know, the group was never intended to build companies. You know, we were just a bunch of misfits on a misfit island working on, you know, computer security really as a hobby. And, uh, in each of us coming from a different place, right? That led us there. Some of us coming more from the kind of, you know, legacy sort of BBS kind of world. Others of us, I think Matt Conover, who was the founder of uwu, was, I think it was 14 years old, 14-year-old Mormon kid in Salt Lake City. And we never knew any of this until we met at the first DEF CON event that we all went to and were shocked sort of seeing what each other looked like and, you know, learning more about each other's backgrounds. But it really was sort of a motley crew of a bunch of folks who were just, just hacking for the fun of it. And the uwu ethos, uh, that I think was really I think really critical, right, to all of our kind of collective success was that it was sort of a band of brothers trying to work together on interesting projects, learning from each other, building. It's like, you know, I grew up skateboarding and doing graffiti, punk rock, and hacking. These were like, you know, my teenage hobbies were all sort of transgression, I guess, in some way or another. But what's unique kind of about all of them is that they're gift cultures. You know, they sort of really build upon kind of the contributions of their members, people pushing past and on top of kind of what anyone else has ever done. And so, so yeah, we valued each other for the inspiration that we had, right, for each other in creating new technology. And a lot of those projects were things that we ended up working together on, like Napster was a project, right, that Shawn Fanning was working on because he didn't have access to all the music, you know, that he wanted. And so at a time where many of us were burning and trading kind of, you know, CDRs and all this kind of stuff, sharing music, pirating music that way, Napster was a way to do that online that we just thought would be cool for us and turned out to be, well, very disruptive, right, to the music industry at large. And so anyway, so the other thing that I think Wu also did from a culture ethos perspective was everyone had really big ideas. You know, we were all just working on projects that ultimately just scratched our own itches, but it turns out there are many, many more people that had similar issues or concerns that led to kind of big opportunities from these things that we created. So yeah, there was just a basic belief in our ability to use technology to solve these kind of interesting problems. And again, a very supportive culture ethos of us all learning together how to do that.

It is interesting because the hacker collective culture has essentially created and shaped what we know today as the cybersecurity industry. But then if we look at the present day, there is no, like, there is no longer that culture. So what replaced it? What is the new incarnation of the hacker collective?

You know, I don't like to think that that's really true. I think that there are probably still folks out there that are kind of building things. Well, here's what I'll say. I think there's still very strong hacker culture at large, writ large, in the open source community, right? Where open source, you know, I'm here in Ann Arbor, which is an old hippie town, you know, the birthplace of the student anti-war movement and birthplace of punk rock, you know, Iggy Pop and all these bands and stuff. And, um, that's where I feel like open source folks are like software communists or software hippies, right? Like they, you know, sort of have still carry that kind of belief in ethos, um, and kind of, uh, working together, right? On, on, on, on a shared sort of commons. And I think that does exist in some ways, just that when money came into the security community in the way of a security industry being born, right, of our efforts, it made people somewhat less interested to share, or that some of this went into much smaller sort of groups and forums in which that sharing was happening in a different way. And so I know that there are still groups out there kind of, you know, working on projects and doing things together, but, um, but it is weird. I still hang out with a, there's a private group of a bunch of us old hackers from that era of OOWOO and TASO and ADM and all these kind of elite hacker groups or whatever, mostly European. And, uh, it's, it is interesting. You know, a lot of us do lament like, I don't even know where this stuff happens anymore, but it does, you know, I mean, in places like China or, you know, places like Iceland or, and there's always going to be kids with technology who are doing things with it that aren't supposed to.

So one more question on WooWoo, Doug. Did you and the rest of the hacker collective know that you would go on and do these amazing things? I mean, it's just pretty incredible to see that the quality of companies that have come out of a relatively small hacker collective.

No, I don't think— no, safe to say none of us had any inclination that, you know, we, we, we'd kind of build, you know, successful businesses right from what we were doing. I mean, in some cases, you know, we had interest, you know, certainly there was a tech scene happening and there was, you know, the rise of the internet bubble and all those kinds of things. But most of us felt like in some respects we had missed some of that, you know? And so we were just screwing around with stuff, exploring things for, for the sake of sort of a better understanding how this stuff works. We're finding ways to sort of, uh, you know, if not one up each other, you know, sort of. Beat those systems, you know? And so, you know, a lot of, I think what leads particularly young adolescent men to this sort of space is, you know, it, it's a, it's a little bit of bravado. It's a little bit of, uh, male ego sort of looking to take on these sort of challenges. And, and, and there's a whole socialization around sort of hacker, the hacker community that's, uh, it's also pretty toxic as actually as a result of that. But I do think that the positive angles on that are that people figure out how to sort of, it is adversarial, right? You sort of beat each other at these things. And I'm not a team sports guy in any respect, but I do think that hacking is one of those things that comes close, right? Because you sort of work as a group to kind of figure out how to go after something, a piece of software, a group, another group, another institution, organization. And and again, there's a real sense of accomplishment, right? And when you've accomplished those goals you were after, right? Going after it. So, but yeah, I think that kind of ethos applied to tech means that you'll have founders who will be successful almost no matter what. You know, Israel is a classic example, right? Where, you know, you have all these young 20-somethings in Unit 8200 and, you know, they're given sort of the budget, if not the budget, at least the scope of responsibility of like NSA and all this.. So they're, they're driven by mission. They're given all the resources. They have a bunch of training and a short amount of time in which to go and accomplish some pretty outsized goals, ton of responsibility, um, a sense of purpose. And so what do they do after, you know, a couple of years and they're, they're no longer sort of have to do that as part of the military while they go into companies. So, you know, so, you know, for me, sort of the, that, that Israeli program is, uh, is sort of like a natural, uh, kind of breeding ground for the kind of entrepreneurial mindset and problem solving and, you know, hacker ethos, right? That leads to all these kind of, which is why we've seen so much success out of that market.

So, you know, Doug, continuing on that cultural national ethos of when you look at Israel and 8200, you once gave a keynote titled Bad Koreans Do Good. Now, you know, there is of course expectations of certain stereotypes. You talked about the male ego, you talked about toxicity, you talk about how the collective cybersecurity world looks at Israeli founders. Talk to us about the Koreans. You know, there is not much that has been celebrated about Koreans. You're clearly a leader in the community. And tell us about the culture. What were some positives? What were some pressures on you growing up in a Korean family?

Yeah, well, I think, you know, East Asian, South Asian, actually most immigrant culture, especially, you know, for transplants here at the US. You know, it's, it's after a doctor, lawyer, engineer, right? Sort of, you know, you take your pick, but you, you have 3 choices. And, you know, that wasn't necessarily that different for me. You know, there's sort of set of high expectations, but, but to be frank, you know, my, both my parents were busy working. So I was a latchkey kid. Like many kids were in the '80s. I didn't see my parents typically until 9:00 PM when they came home from work. And so from the 3:00 PM when I came back from school and then fed myself and my sister, some cans of Dinnie Moore beef stew and, or Hormel chili out of some cans and microwave. You know, I was kind of on my own. And so, you know, the expectations for me were just get the grades, do well in school, learn to learn, and then the rest will be okay. I think it's true for a lot of immigrant families, right? There's the heavy focus on education and academic achievement leading to, again, sort of a natural sort of arc to success in some way. In my case, you know, it, um, I wouldn't say it came naturally, but I was fortunate that, you know, the grades were pretty straightforward for me to get. And the rest of the time I could go screw around and, you know, skateboard, spend all my time in the streets or online hacking or, you know, getting into other trouble. Um, and I'm just fortunate that again, my parents were unlike many other sort of Korean American parents in that that they were very flexible in terms of what they saw me do and success. I also lost my father when I was 18. So, you know, he was carjacked, stabbed 11 times, all this. And I, you know, occupational hazard in kind of running liquor stores, right, in bad places. And so from college onward, I basically had to kind of make it work on my own. So I worked 3 jobs and kind of do all this stuff. And so I think my mom was just happy that I was productive and not getting into too much trouble. I did have a bit of issue as a freshman. I got caught hacking at the university, but you know, that's how I ended up with a job working for the university for 4 years doing security and protecting them from people like me. And I was very proud of the fact that I could end up paying for my tuition and actually my sister's later through school with it. And so, so I don't know. I mean, I think you know, people often think of particularly East Asians and South Asians, right, as kind of model minorities, all this kind of thing, but forgetting that actually some of these communities have the widest disparity in terms of, you know, income and wealth and all this. And so I say like there's good Koreans or there's so-called bad Koreans, quote unquote. I just mean to say like, you know, I was sort of the kind of Korean in the group in a liquor store. Might not necessarily, you know, sort of different sort of family or home life. And, uh, and so again, you know, I think bad Koreans can do pretty, can do good too.

So, and then Doug, what advice would you have for, or how do you see the next generation where there is this constant, uh, internal debate amongst the immigrant community? We grew up with a certain set of values, but then here is America, which is all about entrepreneurship, all about breaking tradition. All about forging a new path. But how do you align those two when you look at the next generation? What advice would you have for the next generation of Koreans?

Yeah, well, you know, that's where I, I mean, the, the South Asian community has sort of demonstrated, I mean, again, look at Silicon Valley, look at like Ty and look at, uh, you know, look at all the, the CEOs now of all companies, right? And how, how much success there has been, right? From the desi community in this. And you see how sometimes that traditional focus on things like education can be an amazing grounding for the kind of uniquely American kind of ambition to go and create companies, to break with tradition, to start things and not just be great at executing or getting things done, but in innovating, right? Solving problems that we don't fully understand, often by doing things we've never done before. And so that sort of risk-taking ambition, right? Which is, I think, I don't want to say it's uniquely American, but I think that is the American dream, right? Like people come to this country, right? Wanting to go and forge their own path and create success and all that kind of thing. And if you pair that up with, again, the kind of just, you know, cultural sort of focus and discipline on education and the, you know, value and hard work and all this kind of thing, you know, it's just, I think it's unstoppable. And, you know, there's a bit of advice I do give, Asian dad advice. Not me, but actually I reference Jack Ma, you know, the former CEO of Alibaba on what an entrepreneurial career actually looks like. I tell kids like, it's not, it's not what you think, you know, you go to Silicon Valley and it's like, oh, you should be like Steve Jobs or Bill Gates or, you know, any of these folks that, you know, drop out of Mark Zuckerberg and drop out of college, you know, go start a company. And what you see kids doing when they do that is like you have 101 sort of bar crawl apps, right? Looking for the closest like bar special or something like this is not, it's not a real problem or a real business. And so Jack's rubric on this is quite different. He says like in your teens, learn to learn, right? Very Asian stereotypically. In your, in your 20s, follow a good leader, not a good company, because you always have the opportunity to go to a good company, right? Why park yourself at a Microsoft or Google or whatever if you know you can go and If you want to be an entrepreneur, go follow a good entrepreneur, right? See how they move, see how they execute with all the resources needed, see how they recruit people into that program, right, that are well beyond kind of anything that they deserve to be, anyone they deserve to be hiring at the stage of their business. Because there's a magic to that, right, to assembling kind of that and what that kind of entrepreneurial leadership and risk-taking and decision-making look like. And it's not even really risk-taking, it's about how you abate risk, right? Which is what those folks do really remarkably. And then in your 30s, figure out what you're good at, you know, find an industry or a path or figure out what your highest contribution is. And then your 40s, then you start. And that's very different than I think the American sort of model of at least tech entrepreneurship, or like, oh, drop out of school, you know, raise a bunch of money. And, but it actually tracks, right, with the results we see, right? We know that, you know, entrepreneurs who have had more professional experience and seen, you know, figured out what problems are worth solving in the world and kind of how they're best suited to do it, actually are much more effective in building really significant companies. And then the continuation of that is, you know, in your 50s, then it's your turn to bet on young people, right? So now you could be that good leader other people follow. And then your 60s, you should be drinking a daiquiri on the beach. And so, you know, I really like that rubric, which is my Asian dad's sort of model for entrepreneurship. But again, I think I don't take credit for it. It's Jack Ma who is much more smart, much smarter than I am.

Well, talking about your 20s and 30s, let's talk about that early career that, that you had. And you, you know, you spent 7 years at a company called Arbor Networks. You started off as a founding engineer. You built a whole bunch of security tools. DSNIF is one of them that's well documented. You can easily search it on Wikipedia and learn about, you know, the password sniffing capability that you provided. When you look back at those, you know, early kind of formation years in your career, was there a pivotal learning moment or something you— and this could be a positive learning moment. It could also be a failure that you experienced that helped you and shaped you as a leader and as an innovator.

Yeah. Well, from innovation perspective, I think the thing I realized quickly is that, you in many cases, security, the emperor has no clothes, right? Like, as a security person, you know, your sort of job as a professional of paranoia is to dispel all these myths about like, this piece of software is really secure, or these systems are inviolable. Like, a teenager, right, with a little bit of time on their hands and internet access can actually really do a lot of damage. They can kind of figure all this stuff out. And so, yeah, I mean, a lot of my activities early in my career, if you will, was simply just breaking other people's software. And being on the offensive side of security and technology, you realize really quickly that actually a lot of these companies and a lot of these products are not, you know, they're not anything that you couldn't do. I remember when we broke Check Point Firewall One, you know, we found like 9 ways through this thing and, you know, reverse engineered all their authentication protocols, their VPN protocols. And, you know, it led folks like Marcus Ranum to, contemplate whether some of the things we found were actually Mossad backdoors, right? In, uh, in these systems, because they were like zero-knowledge sort of exploits against their authentication protocols and so forth. And we presented this all at Black Hat. It was interesting to me to see the response. And I remember talking to Nir Zuk about this years later, who had built all this. And because he had to go and rewrite Checkpoint Firewall, and it's what Checkpoint NG— NG was a result of us basically destroying his, his first product, right? And so, and, you know, the thing you kind of realize as a young, somewhat brash attacker or, you know, security researcher is that actually, you know, there's, there's, you know, there's so many more problems still to be solved. And actually some of these solutions actually create their own problems. And so for me, you know, it was this kind of this realization that, wait a second, you know, it's sort of like, I don't want to say the emperor has no clothes, but, you know, in some cases, you know, security products are some of the most dangerous. Because they have so much access, right? And they sit in very important positions of privilege and management and control that, again, they're huge targets, right, for attackers to go after. We know this now, right, seeing kind of all this happen, but back then, you know, it was sort of assumed that no, these systems, these firewalls and all these, you know, are sort of inviolable. But, and so for me, it created this perspective that there's real opportunity to go after still in security that you could build where you even as like a small new startup. And so anyway, the, the other side of that was from pretty, from Arbor, you know, two other things. One was kind of, we, we built that company to create a kind of a whole new category of infrastructure security for the global carriers at a time where, you know, you know, a single teenage attacker like Mafiiboy in Canada could command thousands of machines to go point at a, I don't know, a bank and hold them hostage. And nothing, no one could do anything about it. You know, sort of realized that, wow, there's a fundamental issue in terms of security on the internet that is still unsolved. And so we worked really hard to create, you know, these kinds of systems as global solutions from the jump. And we're pretty successful in doing so, just the timing was quite difficult as the market had imploded, trying to sell to global carriers when they were putting their execs in jail during the telecom nuclear winter in the early 2000s that followed the first internet bubble being burst taught me really quickly about the need to be sort of nimble in business. And so, so a couple things. One, you know, Arbor was a good experience, but a difficult one in some ways because we built what I thought was an amazing culture and team. You know, every company since Arbor, I've had a group chat like IRC, just like we did in any of our hacking groups at the center of it until You know, Slack or HipChat first, and then later Slack came and created the real opportunity in that market. But, um, but we had a very online, very open source, very hacker sort of culture, right? To all this that I learned was really fundamental to building great products. The parts of that really got away from us, you know, by the time we were on a third CEO, fourth head of sales, you can really lose the soul of the business sometimes that way. And so again, one of the things I learned sort of deeply from an experience that was difficult for me at Arbor was how important culture and leadership really are. Because in a technology company, you have nothing else. You don't have factories or machines or land or, you know, all you have are people. And, uh, if you cannot lead those people well with integrity, with vision, with purpose, with care, with, uh, with inspiration, you really can't accomplish more, right? Together than, than you could apart. And so you, the alchemy of, of really organizational sort of leadership is something that I, I came to really respect and value deeply when, uh, when came time to start some of my own company later.

After spending years in cybersecurity, you took a fairly unusual detour joining a peer-to-peer TV startup around the time when YouTube also launched. Could you talk more towards how did stepping outside of security broaden your perspective as a technologist and also which of the new ideas and perspectives did you later bring back into security?

Thanks, Ross. This is an important one because I, you know, I think I used to joke with this about, I used to joke with a friend, Tom Tojic, who's a very well-known security hacker, researcher, and, you know, erstwhile founder, about how all of us who are serious about security, care about it deeply or kind of grew up in it, all have to leave. Because at some point you realize how bad the industry is. Sort of like, crunch all you want, someone else will always make more. It's an adversarial thing. So your software doesn't go out of style or is obsoleted by, it is broken, frankly, by attackers or bypassed or all these kind of things. And so it's not a matter of just getting ahead, but to stay ahead in security in a way that there's a real cost of innovation. But also, because of that, customers are accustomed to buying things that they don't really need. And, you know, we're not mature as a market, as an industry in security engineering, the way that, for instance, like NASA or even, you know, here on Earth, you know, our terrestrial sort of transportation safety boards are, right? Like a plane falls out of the sky only the same way, maybe once. Or maybe twice, because that's why everyone has black boxes. That's why, you know, there's an, you know, a TSP that looks at the root cause analysis and does all this, and we sort of stop kind of things from happening. But, but in security, it's like, wow, even the same organization sometimes are breached multiple times the same way. So, you know, it's like Groundhog Day in a, in the worst way, over and over again, where things were not burning, we're not getting better. And, uh, it was this hamster wheel of pain. Right, that companies are on. And so I do think sometimes, you know, because of that, security can be a lemon market, meaning it's like a used car market. People buy something, they don't know if it's any good or not until they've driven it off the lot. Then it breaks down and they're like, oh crap, I didn't realize this was no good. But by that time, you know, there's a company that's already made money and everyone. And so I think there's a fundamental problem in security that way. That for a lot of security people, right? People who actually grew up in this or really care about deeply in this way and identify with it, sometimes take a really cynical view of, which is, you know, oh, the industry is just snake oil or bad and blah, blah, blah. And you know, there's definitely some element of that, truth to that. And that's why I left, you know, I left security and I go do InnerTV 'cause I felt it was more honest living. And I felt like I was tired of trying to convince anybody that these things are real problems., or trying to compete against, you know, competitors who had, uh, were selling a bunch of air, right? Like you buy a box, put in the network, nothing's hap— nothing happens. And the vendor says, see, you're more secure. Nothing's happening. And I just was growing tired of that kind of, uh, you know, lack of value proposition and, and, and challenge, right? In, in the market. And so anyway, we built this inner TV company that was our— it was basically like atoning for my sins with Napster, uh, you know, It was live streaming peer-to-peer TV, very hard, difficult technical problem to solve. And one that we partnered, right, with, you know, the traditional kind of industry players to go and extend the reach, right, of terrestrial broadcast or satellite to, to internet viewers and so forth. But anyway, you know, it was, it struggled for other reasons. It's doing fine now, but, um, well, it turns out that basically you don't need peer-to-peer. It doesn't matter having a theoretically perfect distribution of video over application layer multicast. Where one person, one household gets the stream for the World Cup and shares it with everyone else, right, on their subnet. Doesn't matter, right? Unicast streams, polluting the backbone, all this stuff are just fine when it turns out it's all a big game theoretic model anyway of eyeball providers dumping kind of the ports to the content providers in settlement-free scraping agreements at the major internet exchanges and no one's paying for anything, right? It turns out that's just fine. And so there's, there's other ways that the world really works that kind of, you know, meant that our approach wasn't needed. But the lessons I learned other than technical around that were that you can build a business through word of mouth, right? Like Zattoo is a company that spent almost nothing on marketing and it did almost everything to engineer a viral acquisition model, right? Where we, we did track kind of the viral K coefficient of, of invites per user to any other user. We figured out how to drive engagement right on the platform. We figured out how to, again, scale these audiences, right, with offers and things that we could test in real time, right? And not have to take out a billboard ad and then see what happened the next month, right? And so there was a consumer kind of marketing angle, frankly, that I picked up from Zatu that we did apply to some of— well, we did it duo— to make security something that was much more accessible, widen the market for. But yeah, it all came from doing internet TV.

So Doug, as you look at your career arc, you know, Ann Arbor, or maybe going back to, you know, West Baltimore, Ann Arbor, then Zurich. I mean, from Zurich, you could have moved to literally any part of the world, you know, London, Silicon Valley, which is like this crucible or a magnet for people such as yourselves. But you've been extremely loyal to your roots in Ann Arbor. One of my most vivid memories of you in Ann Arbor is there's a cafe outside Zingerman's Sweetwater's where I was sitting and I hear this loud noise and it literally jolts me. And I see the noise was your skateboard hitting that brick paved path outside Zingerman's. And I see Doug Song like skateboarding by. So, I mean, you've been very loyal to the community in Ann Arbor. In fact, I remember that you also created a community at a brewery, a local brewery. You repurposed that for an entrepreneurial community. Tell us about this notion of geography, entrepreneurship, what draws people like you to certain geographies.

Yeah. Well, you know, I happened to, I didn't ever have an intention to be in Michigan. I was in Maryland when I was applying for college. I applied mostly to small liberal arts colleges in New England thinking I was going to go major in philosophy at a small liberal arts school. And I happened to apply to Michigan because I had a friend who went a year ahead of me and wrote back saying how great it was and how the application was so cheap. So that was it, you know, it was a cheap application and I, I did it because my friend said, hey, it's a good, it's a good fallback option or something. Turned out that was the best decision I ever made. I, um, I only realized this after I went to go visit some of these schools in New England, Williams and so forth, and realized, wow, it's just a bunch of just a bunch of white kids drinking in the woods. That's like not, that's just like not, not for me. And so I went to Michigan in part also because, you know, I'll just say I explored the network from afar when I was still in high school and I'd never seen a place with the kind of network for students with the number of commercial unicies as well as a, what they call a center for it was a supercomputing center, but they called it Center for Parallel Computing, but Cray's and all these systems that I had not seen anywhere except NASA Ames. And we won't really talk about that right now either, but basically, you know, I was amazed that a public research university would have all these kinds of resources for its students. And so that's one of the reasons I went and it was the best decision I ever made. It was, uh, it was great. The difficulty for me was that Ann Arbor is such a small town. Um, and I was used to, you know, hanging out in cities. But you know, it was, it was, it was an amazing undergraduate experience, great place. And, and what I came to appreciate was, uh, every place is about something, right? Like, I think Paul Graham once said something like this, like, you know, New York is about money and LA is about fame, right? And, and when I was growing up, you know, being in the shadow of DC, you know, DC was about power. You know, San Francisco was about disruption, right? Whatever that was. But a place like Ann Arbor, you know, Ann Arbor was, naturally about ideas. It's that sort of deep-rooted place. Like, it didn't matter how much money you had, didn't matter what— like, it was all about ideas and what crazy ideas you had. And this goes all the way back, right, to the hippie movement and the student anti-war movement and, you know, all these kinds of things. There's a culture here, right, kind of around this that's very, very deep. And so I love that. I love the fact that I could be inspired by the Conor O'Neills, you know, local Irish pub trivia night, you know, hearing all these Amazing people sort of killing it because like, oh man, that person seems, sounds like a world expert on, I don't know, Parkinson's disease or like whatever neurodegenerative disease because they are, they're actually, actually the world expert. They've written a bunch of books or, or even other people like, uh, I'm a theory of revolution or I love being a place where there are people where it's about those kinds of ideas and it wasn't just tech. And so though I love tech, I sort of feel like tech is just a sort of an approach or a skill set, a tool. In your toolkit to apply to all kinds of interesting problems. But there's so, the world is a much wider place. And so anyway, so I, I kind of fell in love with the community of, of people and ideas and idealists here. The other thing I, I'd say also is that, you know, I grew up in, uh, you know, in Baltimore and DC in a, a community of like skateboarders and punk rock and all that kind of stuff. And I'll just say, you know, like my first concert music show was a, a very important band to me now. Well, in '92 called Fugazi, which was, I kind of imprinted on, and this is a punk rock band that was very much about community. And every show had nonprofits and would donate money to, you know, all this kind of stuff. But I think punk rock in general is sort of contrarian and very much about community. And for me, a large part of that mindset, you know, there's like a security mindset, which we all understand, like the punk mindset is sort of resisting this pressure to conform, but without being just contrarian, which is its own kind of conformity., right? And so I feel like, you know, from that experience in kind of punk and growing up, I learned how to sort of rebel meaningfully, right? To sort of stand for something with integrity. And, uh, and here in Ann Arbor, you know, with all these kind of big thinkers and stuff, I sort of feel like I learned the lesson that, you know, the world is really resistant to change and progress. And so it's like purpose and meaning and impact requires sort of deep intention and actually sometimes subversion. And from hacking, like we're pretty good at that. So, and so I, I just feel like I'm in the right place. I feel like this is my home, these my people, this is the community that I care about and it's the community that helped me build my company. And so yeah, I feel, I feel like place matters and, uh, my ambition is to be a good neighbor, be a contributing member of my community. And also it's fun. It's fun being a part of a place where, you know, people see them kind of build alongside or with you. For many years and where you're rooting for them just as much as they're rooting for you. And so.

And it makes complete sense, Doug. One sort of observation that I remember having in Ann Arbor, which I kind of sorely miss in San Francisco, is that you could walk down and bump into somebody who was working on nanotechnology. You could walk down and bump into somebody who was working on biotech, cancer research, all this confluence of different brilliant minds in a very small place. Was so amazing. And the Valley, look, it is a sort of somewhat of a monoculture in its own way. There are now changes occurring, but I see why you speak of Ann Arbor as a place of ideas.

Talking about Ann Arbor being a place of ideas, Doug, you and Jon Oberheide, your co-founder at Duo, came up with a little idea that ended up becoming a pretty big company. You've talked about the early days in the past in other conversations and, and you've said that neither of you had any intention of building a company when you got started, you know, tinkering on the idea for what ended up becoming Duo Security. Could you talk a little bit about those early days and how did you switch from that? How did that mindset shift happen from, you know, tinkering to actually building a business?

Yeah, good question. I think for a lot of technical founders, and I consider myself one, though I was CEO of Duo, I was, uh, you know, I mean, I grew up hacking and, you know, my, my role had always been a technical one. All these other companies, although at Zatu, the internet TV company, I was actually managing engineering. I was VP engineering, not a co-founder, where I kind of learned some management rope, kind of learned the management ropes in someone else's business first. But with Duo, you know, the idea for Duo kind of came out of working at Barracuda Networks. You know, Barracuda was a company, and I don't know if you have had similar journeys yourselves or see this with other founders, but I tell people all the time, There's a time to earn, there's a time to learn. I think Mark Susterer had something like this, but you know, my point of view on this is there's so many lessons that are better learned on someone else's dime than your own. And so I've kind of flip-flopped my career of kind of starting a business or then joining someone else's or starting or, you know, 'cause you know, you can learn a lot right from what other people are doing. And at Barracuda, man, I wasn't there long., but it was, it made an impression in a big way for me because they had opened an Ann Arbor office. The company was based out of California. The founder had been Michigan alum, Dean Draco. But I'll be honest with you, I had friends of mine who were making fun of me for going there. They're like, wait a second, you were building all this like super sophisticated anomaly detection, behavioral anomaly detection kind of systems in your past and both Anza and both Arbor Networks, right? For wide area as well as for like all the big banks and financials. Like why would you go do open source spam appliance company? Like, what's that about? And I didn't have a great answer for them other than I saw them kind of picking up another market that didn't seem to be well served, right? Which are like smaller businesses and folks, you know, and I felt kind of deeply that I watched as security had spread beyond kind of the purview of just the banks, hospitals, and governments that had things to protect, then to every other target of chance, not of choice., right, that attackers were going after with these, uh, you know, phishing campaigns and everything else, sort of indiscriminate hacking. And so I left Barracuda after learning that there was a real market opportunity in democratizing security, right? Because, um, I mean, Barracuda was amazing in a lot of ways. They were building a version of something like Cisco or someone else might have, Blue Coat might have, at like a tenth of the cost., right? And with a model that everyone said, oh, you know, you crack the hood on like one of their boxes, you're like, wait a second, this is like 4-year-old Intel Celeron processor. Like, why would anyone run this? Like, what is this about? And, but you realize that they were, it was kind of wild. And again, I don't want to share too much about kind of their, their processor method or speak, um, any way would be interpreted negatively, but they were very clever, right? In terms of how they sourced not only components and assembled kind of their their platforms, although I would say that they had like a new hardware generation every 2 weeks, kind of wild. But even how they source their talent, right? They would pull people out of the gym after seeing them like, wow, that guy is like in here all the time, first in, last out. Let's put them on the phones and have them sell cybersecurity, like totally strange, but kind of amazing, right? How they were focused on kind of building operational sort of excellence, right? And what they were doing in ways that were pretty, pretty different. But anyway, long story short, you know, Barracuda was one where I saw the opportunity for security to be, to really be much more mass market. I just thought that we could do it without the channel and without the hardware, but I didn't know how or what we would do. All I saw were, there were companies that were being hacked that didn't seem to have any options, you know, like, like who was actually solving for their needs? Are they really going to go deploy a firewall? Because and my first company straight outta college was a security consultancy and it was for all the big banks and casinos and UN and so forth. But the small businesses, they had no chance, right, at securing themselves meaningfully. And so, so we didn't know, we didn't know what it would be and we were screwing around with, and actually when I left Barracuda, 'cause I was there to help them prepare for what would be their IPO. And when I left, you know, pre-IPO, my wife was 6 months pregnant with our second child. She's like, what have you been doing? Like, I do not understand this logic. And for me, it was, it was more that, no, no, no, I, there's a problem to be solved here. I don't know what it is. All I know is who I want to serve, right? That there's like, I want to build security for the 99%, not the 1%. Like attackers are going after everybody and no one has a focus on kind of how, how you solve that. And so I said, I don't, I don't know what that is, but you know, I, I just think I can do that in a way that's different, maybe better than what Veracrypt had done., but I had no idea what that would be. I just felt compelled to go in and try. And, uh, and it was some of these activities, like I remember seeing a small auto body shop here in Michigan get, get hacked by an attacker who siphoned $3 million out of them, right? In this, in this wire transfer and their bank Comerica, there's a, there's a lawsuit you can look up on this. Um, Comerican Experimental was the business, you know, the small auto body shop sued their bank who had issued them RSA tokens. And you look at this and you're like, wait a second, the bank did everything right, right? They extended the best security available to them, right, to the small customer, and they still got hacked and they still lost the money. And so who's at fault? And you realize that, wait, this is like a bad situation all around. And so, so anyway, so, you know, John O., I pulled in after I left Barracuda to go start something, but we didn't know what it would be. And I remember telling John, like, I don't know what we're going to do., but let's, let's, let's go have some fun, explore. He was in, in his second year of his PhD, so he was still a student. And, uh, and we just started hacking. I had like, came up with a bunch of different ideas. It was kind of a, kind of a woo-woo style kind of situation. Like, it's, you know, here's like 20 different things we could kind of work on. As we did, we tried kind of, it was just fun to hack with him. Jon was my, my student intern at Arbor. And so I knew what he was capable of and he's like a 10-year younger version of me. So. Yeah, it was a lot of fun just to hack around. But then we came across, you know, something which was a bunch of these folks we were talking to, you know, these customers were like, you know, the biggest problem we have is account takeover. I mean, they didn't call it that at the time, but they have, you know, people losing their passwords to phishing attacks and all that kind of thing and then taking over kind of their infrastructure or their business. And so we figured that we had to go and solve that problem. I didn't really want to go into two-factor authentication. In fact, when we looked at all this and we had, in fact, we had actually worked with a reseller that got us access to many more of their customers just to do some customer discovery, do some customer interviews and figure out kind of what problems they were facing and all this. And it was actually very disappointing to us. We realized that actually, you know, strong but usable and deployable two-factor authentication for this end of the market is something that is a huge opportunity that no one's really addressing. And I was pretty depressed because, you know, that's like a 35-year-old industry, you know, security in like the '80s and stuff. And so, so I didn't want to do two-factor and neither really did Jono, but, but it ended up being what was most impactful and important for the customers that we wanted to serve. And then we just kept going from there. But, but yeah, that was, that was kind of what Barracuda was about and leading us into kind of this opportunity.

What was so unique about Duo is that the company didn't really invent the multifactor authentication. As you mentioned, it was a 35-year-old market, but what it did do, it made it easy to deploy. It made it very easy to manage. It made it very easy to operationalize. And it can indeed be said that Duo was the first company in security that has gotten to a multi-billion-dollar exit, not because it invented some kind of a new way of securing infrastructure, but because of the user experience. And what are your thoughts around the importance of UX in cybersecurity?

Yeah, no, I think it was just overlooked. I think attackers had already change their MO, right? You know, and I was one of them, right? Like, why did I build these stuff? Because I realized that actually it was much easier to just tailgate users in to access to systems and environments than try to break through firewalls, although I did that too. And, you know, users have always been sort of that weak link, and access is always king, right, for attackers, right? If you have access and, you know, to what users can do, you bypass all other security controls, right? When you can simply, uh, put on the janitor's uniform and roam the casino freely, right? Like a casino heist. And so, yeah, we, we realized quickly that there were kind of 3 massive defects in terms of how strong authentication was being done. One, it was not usable, right? The hardware key with the numbers that change every minute and, you know, all this is just not really anything anyone wants to do, right? So you basically just frustrate your users, not the attackers. The second was that, again, there's a tremendous cost, right, to actually deploying this stuff, right? Putting little tiny computers in the pockets of every employee, it's like, you know, having not lose them or put them in the wash or, you know, whatever. It's, it's just not tenable. And of course, integrating that right in the path of every login, right, that you have to protect is just really painful. And then, uh, the last is, you know, it just, uh, it didn't provide for many buyers or many customers kind of the cost benefit. Right, of what, you know, they, they needed to protect themselves. They didn't understand how this would actually really stop the problem as a measure of first or last resort, right? Like, you know, at the time everyone was sort of so focused on like, well, prevention, detection is so much more important than prevention 'cause the attackers will always get in. And I was like, this is, this is sort of fatalistic. But this notion of, you know, the attackers will always sort of get in and you just need to be able to detect them and respond fast enough. I'm like, well, there's a whole class of business problems, right? In terms of that impact, like when I siphon out your money at 4:30 PM on a Friday, you know, just past the Fedwire, you know, head of the Fedwire, you know, limit and you're not getting that money back. There's no way to recover it. Like that is a game over sort of problem, right? For a lot of businesses. And, um, you know, I think it was only later that VCs sort of understood this when some of their portfolio companies were the ones kind of, you know, losing money out of like a $10 million A round, all being siphoned out by an attacker and no recovery. Those are things that I think sort of shifted sort of the mindset of investors thinking about this stuff too. But, uh, but no, I think of security engineering and design engineering as being two sides of the same coin, right? Not, not opposite. Everyone thinks, oh, security and usability, they're opposites, diametrically opposed, right? You, you can't have one without sort of sacrificing the other. But my point of view is that actually security engineering and design engineering are the same thing. It's how do you make the right things happen by default? And so we just had a strong focus on how do we make the strongest security the easiest for people to go deploy and use? It turns out, you know, we were at the right place at the right time with the rise of the cloud and the ability to deploy sort of services even to not software applications, but hardware sort of devices, right? Via the cloud with a device actually already sitting in everyone's pockets, in form of a cell phone, right? It's our smartphone, right? With applications that we could deliver, you know, we could create, you know, traditional sort of Orange Book terminology, a trusted path, right, to the user outside of kind of the main inline sort of band of access. We had all the pieces we needed to go and create something that would actually be much better, but also easier to use. And so that was really the focus. And again, as particularly smartphones got better, I didn't, for many, many years I didn't have a smartphone. I, um, you know, John was all about it, thought, um, 'cause I think the smart, I think the iPhone was less than 2 years old when we started Duo. And I was like, oh, that's a fad. What's that crap? You know, I, I love, you know, like I remember I never had a BlackBerry, but I always wanted one. I always thought the keyboard was so cool. But, uh, no, I was, I was admittedly a pessimist when it came to smartphone adoption. John was like, no, no, no, this is happening. But I also didn't trust it. I mean, part of it was like, I don't, I don't think, you know, Jono, like you, you and I know, like we can hack the hell out of this thing. Like this is probably not a very safe platform. We know we can probably take this thing to the cleaners if we wanted to, but it turns out, you know, that all got better. We had friends at all these places at Google and at Apple who, uh, built security in instead of waiting for it to be bolted on. And so for instance, there's no like antivirus market for iOS. There never will be, never should be, because, you know, they built in a secure element, right? A hardware root of trust, a trusted execution environment, root attestation protocols, secure boot sequence, root attestation protocol, all these things that is basically, again, the sort of delivery of the dream of the '80s or '90s, right? Of the Orange Book, right? Trusted computing base, all that stuff. So, you know, it's kind of amazing how far we've actually come in security in some ways. But really in the consumer sort of security, in the consumer sort of product world, right? Not as much the security industry per se, which might be a little bit controversial to say, but that's, you know, that's my story, I'm sticking to it. So yeah, so that's kind of my perspective. And increasingly, I think the future for security is more of that, right? Security that no one has to see, no one has to deal with, because it's just built in versus being bolted on. And it's an integral part, right, of any of the systems that we're using. Largely because these hyperscaler platforms and, you know, vendors, they own the horizontal and the vertical, right? The Microsofts, the Apples, the Googles, et cetera.

You clearly, the decisions that you made, Doug, at Duo when it came to user experience and design, the decisions you made that led to solid engineering, that translated into a lot of customers, a lot of economic value at 50,000 customers. Economic value would say $2+ billion that Cisco paid when they acquired Duo. How did you, continuing that arc of making decisions between user experience, between engineering, how did you navigate the situation between Cisco versus saying we could take this company public? It's sort of classic diversion of the roads to say, should I turn left? Should I turn right?

Yeah, that's a tough one that I haven't really talked very much about. Yeah, it's complicated. I'll put it this way. I think every CEO and founder, every CEO and every board, you know, have fiduciary responsibility, right? To seek the best outcome for a company and its shareholders. And, you know, Duo was one that we were, you know, we were one of the best performing SaaS companies of all time. Like, people don't really know a lot of this, but you know, there's a point every year at which Stool was cashflow positive, right? For almost all of our lifetime. I never had to necessarily go out and raise money. And we had a lot of folks come to us typically at the end of the year, 'cause I would basically blow them off. I had investors kind of reach out and I'd say, look, I'm busy building a company. If you wanted to chat, you know, why don't you come visit us in Ann Arbor at the end of the year in December in Michigan. Very few of them did. The smart ones all did. And they found that, you know, we were a company that we didn't really need a lot. And, you know, ultimately, you know, having raised $119 million, I spent $14 million of it to get to over $100 million in ARR and kept going. And so, you know, we, so we were on the path to IPO and, uh, and there were a bunch of things that were pretty remarkable about kind of what that path would have been in that, you know, I think only 100 companies had IPO'd, I think since 20— 2005, I forget what it was. Well, anyway, there's this whole rubric that, you know, our lead bankers had for us on how special Duo was. And, you know, I guess every banker will make you feel that way, but here they had like real details and stats and so forth that were really interesting for us. And so when we did get sort of interest, you know, like Cisco came at us one year and I was like, nope, no interest, you know, sorry. I still had to present to the board though, that, you know, that there was that there was interest. And of course, you know, my board was long the company. No, no, keep going. You know, this is a distraction. Don't worry about it. But we did end up, I ended up making sure that we ran a dual process because I said, look, you know, Ken, if this is sort of from one, you know, I'll just say that this was not a great offer, but maybe there's going to be others. And, you know, there's, I believed at the time we had a fiduciary duty to run down sort of a dual track and make sure that people understood what else was going on out there. Our last look basically at the private markets before we went to the public. And, and so I built out, you know, kind of all the things I needed to for our IPO. I, uh, had our ops meeting, put together the consortium of bankers. We had, um, built a public company board. I was, I, that's the thing I actually, one of the things I missed other than my team, I miss the other team I had, which was my board, but I loved my board. I built a really good board with people I really, really respected and really still look up to and still stay in touch with. But, uh, by the end of the day, when Cisco came back to us with a number that represented the largest multiple ever paid for a private software acquisition at the time, you know, I, I took a pause for a, a bit here with, with, with Bajano and, and, and my CFO at the time, who was not going to be my public company CFO. Um, I, I wanted him to be, but he was pretty clear he didn't want to be. And so we brought in another CFO and that was fine. But, uh, I, I think we had a difficult decision to make. Do we do that in the interest of our team and our shareholders as well as our investors and expand this kind of journey with Cisco's platform? Or do we just keep going? Why get off the train now? And at the end of the day, I think Cisco had a convincing argument that in fact, a lot of what the business could be, on, uh, as part of Cisco's, uh, broader security business. I think, but when we joined, it was like a $2.5 billion global security business. By the time we exited, it was like $5 billion, right? By the time I left, um, it was $5 billion. And, uh, Duo was the fastest part of that, right? Fastest growing business within Cisco for many years. Um, but, you know, these are hard decisions that come down to really sort of what what founders want to do. And, you know, full credit to my board. I mean, they didn't beat me up too bad about it because, you know, by and large they were like, why are you selling now? Why sell now? This is like, you know, this is crazy. Like we have, and you know, it's hard not to sort of look back at what could have been. I try not to. Life is too short for regrets anyway. I don't really have any necessarily about this, but it is, you know, by the math of it, you know, kind of what the business is doing today. So we're like, yeah, well, you know, that was an interesting decision. But again, I think we did expand kind of that to what was, you know, from the 50,000 customers we had coming into Cisco, but Cisco having many hundreds of thousands of more customers, right, that we go after, you know, meant something meaningful. And especially in ways that, you know, we had still yet to build out. We had done quite a bit of enterprise, you know, it was half of our business, but obviously Cisco had a ton of really large enterprise customers and relationships and also had a very global business, right? Where our entire rest of world business was, you know, pretty small, right? Like 15% of what Duo was doing by the time we came in. And so anyway, in many respects it made sense, right? For the continued scale and growth and trajectory of Duo as a business and company. But again, these are hard and any founder tells you otherwise, you know, either the company's not doing well or there's some other circumstances, but these are hard decisions, right? To have your baby, you know, sort of bought into another family. And when I left, you know, I left, yeah, well after John O. I think John O., I left kind of 2 years after John O. did. I felt basically a sense of responsibility for like the 8,000 people, right? That I came into the orbit of, in the leadership of, in, in global security business Cisco versus the 800 people I brought into it. But we made tremendous impact, you know, and not just in terms of our business, but in terms of, you know, Cisco's. And so, you know, that for that I'm, I'm proud and, uh, and hopefully, you know, hopefully, you know, G2 came later, felt and saw this contribution. Because, you know, there was sort of a SaaS cabal we had within Cisco to kind of help build all this and kind of really, you know, help take the business to the next level. And again, it did scale. Like, it doubled the global security business, right, in the time that we were there. So anyway, so, you know, I don't, like I said, life is too short for regrets. I don't necessarily have any about kind of exiting the business. But you always wonder, founders will always wonder about like, well, what else could have been? What would the other path have looked like?

You know, I remember doing a conversation with you, Mahendra, and Chengxi in 2021 on the CyberSeed community. I remember this exact same question, and this was when you were at home sitting at your desk and you actually pulled out the draft of the S1.

Right.

You said, you know, I think about this. I think about this more than you think.

It's just, Yeah. Yeah. Oh, I should probably not keep it by my desk. You know, put it somewhere else.

I was going to ask you if you still keep it.

So clearly you do. No, no, that's at home. I, you know, now we have another office here now. And then now we've been focusing on other things. We built a family office, built a foundation. We're kind of funding a lot of other people's companies. Yeah, I'm actually not doing as much security investing as you might expect, you know, although I did just make another security investment yesterday. But I am investing basically in almost everything else these days, from mushrooms to space, and I'm having a lot of fun doing that, particularly in Michigan where there's a lot of interesting founders and companies tackling global problems, but in ways that are very specific to what's here.

Well, let's get into the final section and just broader lessons for founders. And one of your leadership mantras has been to build a learning organization. Could you talk a little bit about what this learning-oriented culture is and why it matters for founders?

Yeah. Well, you know, I'll just say, I think this was just an artifact of us being in Ann Arbor, right? We talked about sort of the culture of ideas, but really, you know, what's Ann Arbor about actually? The team, the team, the team, right? The winningest college football program in history and national champions as of a little bit ago. Frankly. A different kind of disruption, which I think is, um, it really comes from sort of learning and doing. So, you know, I think, uh, you know, teamwork is important, but the ability to actually improve and learn together is actually the most important, right? As for any team, right? And, um, and so, you know, like I told my my folks, right? Just make sure that we keep ourselves sort of at least Midwest humble. We weren't smarter or we didn't work any harder and we weren't any better looking or anything like any of our competitors. The one thing we did better than any of our competitors was to find new routes of success, right? That we could own. 'Cause you know, just like a college football team, like if we were just steal like Ohio State's playbook and there's some people that might argue that we did, but in some other ways, but us running their plays, why would we be any more successful than they were, right? They figured out how to do this. They own that playbook. We need to build our own. And so in every part of the business, not just in tech or a product, but in sales and marketing and CS, we worked really hard to innovate, right? Do things that other companies weren't. In fact, when I hired my entire go-to-market team for Duo, we were pattern matching for something that we hadn't seen anywhere, which was high velocity, high volume inbound inside sales. In a way that I'd only seen anything similar at Barracuda, right? But this was even smaller ASPs and even higher velocity deals. And when I looked around, it was my early board, I was like, well, who else does business like this? And we're like, wait a second, Zendesk. Like Zendesk was the comp. And that's why I hired all these Zendesk people. I went after their, you know, head of North American sales or head of their marketing. And, you know, I even pulled in an advisor who then became later my COO. Who was also from Zendesk and worked with these folks. But basically, you know, that was the commercial engine for the business because we had built Duo's go-to-market so differently. And that only came as a result of, again, us trying things very different. Like, you know, we started the business with $5 a day AdWords, testing a bunch of things, seeing what people were interested in, trying to figure out if, again, there was a different signal in the market for security or people needing it than what was traditional, which was like, you know, through resellers and VARs and, you know, the folks who are also consulting, right, to their clientele on security strategy. So for many of our customers, they had nothing like that. They weren't engaging security VARs or anything like this. And so, so we tested our way to a bunch of that kind of stuff and found that, uh, again, it worked. And so over and over again, the only thing we did better than our competitors was we learned together new routes to success that our competitors never found or never took seriously. And so the practical advice I'd have for founders in thinking about how to do this is, well, one, hiring in a sort of college town where you have a large research university where you have a lot of bright-eyed, bushy-tailed talent looking to get into new things. Because the majority of my workforce at Duo had never worked in tech. Right? Like, there's not a lot of that here in Michigan. And so, so I need to augment where needed, right? With a couple leaders here and there, right? From the Valley or elsewhere. But, but again, the majority of my team had never worked tech or certainly had never worked in security. But we, we did have the security people where we needed them. And we had like a deep bench of hackers like myself and Jono and Duo Labs and a bunch of our product side. But, but again, we had just as many that weren't. And I think that was a huge part of our success because we had a very diverse team, diverse in all the ways, 40% actually of Duo was women and underrepresented minority, which is actually very different than cybersecurity, which I think is 11% typically. But we also hire people from all kinds of backgrounds that had no engineering background or whatever. Again, like a lot of my, the best hackers I ever worked with never had like a college degree or whatever sometimes. And so we could solve problems sort of from a bunch of different perspectives. And the largest part of, again, what we needed to be successful in doing so was building the kind of culture where that diversity of opinions or perspectives and ideas would lead to creativity, not conflict. You know, but I took to heart seriously what, what Steve Jobs once said about creativity, which is that it's not about having some idea no one's ever had before. It's about combining and smashing together ideas from different domains, right, to lead to some different result. And I believe that, I've seen that deeply. I mean, that's again, a lot of what kept me here in Arbor. So many different interesting ideas. Like when we were building Arbor Networks, even, you know, that second company, there were folks I hired from epidemiology, right? Who were helping us build like interesting viral models of self-propagating worm, right? Infection, right? Within enterprise. Networks, we never would have had any idea about how to do that and then how to defend against that and build like these sort of cell containment sort of algorithms. If, have we not sort of had access to people who had these crazy other sort of ideas, crazy to us, but you know, very well trod and very well understood, right? In, in other fields. And so, so the one is I think start by having as, as many different kinds of ideas and people as you can. We practically on our website, we had one question and for in all of our interviews, right, that we started with, which is what makes you unique, right? What makes you unique? Because I don't need 10 people with the same background in any meeting, right? I need, if they all have the same ideas and same opinions, the same background, I need one of them, not 10 of them, right? And so I need to understand like for any person we'd hire, especially in an early team, well, what do you think is special? That you can bring to us that we don't already have, right? How does that augment kind of our capability set, right? And what we think we can do. What do you know that we don't? What have you done that we haven't? All this kind of thing. And so, you know, that was really important to us and it led to so many more interesting conversations about then how do we tackle this? And again, but it just led to more challenges in terms of how we'd have to manage. But that's why I took management so seriously. So for early founders, like let's say, you know, in building a learning organization where you're bringing in a diversity, right, of talent in this way, you have to get good at management. You have to really focus on, again, how do you elicit the best out of those kind of diverse teams? And again, you know, you see elements of this in a lot of other, even big companies, right? Like I think Bezos has some really interesting lessons, right, to learn from Amazon that only later after he wrote some books or like someone wrote books about what he'd done, we realized, oh wait, that's just like us, right? Like disagree and commit. And I say that all the time. I say like, not disagree and commit. I say, well, you know, I don't agree with that, but we're all going to say, you know, we're all going to make sure that it happens, right? I'll go make some support that idea. And the only reason we did that is because we had a commitment to learning together and practically had rituals and operations to support that. You know, blameless retrospectives, right? Where we'd figure out what was right, not who was right. We had an unlimited book budget, Anyone who wanted to buy books and get smarter, well, why would we stop them? Buy those books, when you're done with them, put them on the shelf in the library and tell us what you learned, right? Share it with others so we can all sort of benefit. We had rituals like appreciations, which ended or started or ended every meeting in the company, including all hands meetings, even 3 to 5 minutes of people thanking each other publicly for the things that they'd seen others on the team do that made the team successful. But that's how you learn because we spend all our time sometimes as leaders trying to impart kind of our ideas and wisdom or whatever, not even wisdom, but like opinions, right, to our teams at large. But how do leaders ever hear about what's important, right, or what's working? And so, you know, we had these sort of cultural rituals like appreciations that were also leaning into the fact that, you know, positive feedback is so much more important than negative. But again, in all hands meetings, you have someone call, hey, you know, thanks, you know, Zoe, for uploading those leads within 24 hours from RSA. We had, This, you know, this many, um, sort of, uh, SAOs or opportunities created out of that. But anyway, anytime anyone did anything good, it was publicly called out in this way so that others could follow. And that's how we elevated and standardized excellence across our organization. It was not by accident. We built a culture of it and a culture that I didn't have to go and sort of be everywhere to sort of drive everyone, right? Was sort of, and in, you, you know, in so many other ways, like anytime we promote people, we, we, anyway, long story short, we had all kinds of systems by which again, we, we supported an organizational learning in the business. And that came from taking kind of our job as managers seriously. That, uh, again, just like as, you know, engineers, you're building systems, right, of code and all this kind of thing. But as managers and leaders, you're building systems of people. And work. And, and so we spent a lot of time really focusing on how to do that effectively, hiring, you know, folks from the university who also done, you know, instructional or, you know, curriculum design and built a whole L&D, learning and development sort of organization within Duo. We had, you know, training budgets for folks. We also had, again, a lot of internal conferences and ways in which we shared kind of our best practices with each other. Anyway, so there's a lot to it, but, That's these days with founders, that's what I spend a lot of my time doing, just making sure that other founders have more in their toolbox to kind of achieve success from the lessons we learned in trying to kind of build this stuff. But, you know, none of it's proprietary. I don't, and also none of it has to be done this way. I just think that there is probably, it's the most fun way to do it, right? Where everyone grows together and everyone can kind of claim success as a team.

Thank you, Doug. As you talk about spending more time with founders and you take this unique example of what Duo did in its culture. One fundamental question that comes up in this day and age is about capital efficiency or capital allocation, if you will. You know, we live in a day and age where seed rounds used to be $5, $10, $50 million. Now, gosh, seed rounds have exceeded— I mean, the numbers are staggering. You know, you're approaching $500 million, billion-dollar seed round.

My A round was $5 million. My seed round was $1 million and I had no pre-seed.

So, so I think this will be a great analogy. Walk us through your capital raising journey, but also share some advice with our audience, with our founders on how you managed every dollar so effectively and what can founders do when they think about money and not boast about valuations as opposed to creating value.

Yeah. Well, part of this is also just maybe the culture difference or the Midwest where because tech isn't sexy here, you know, like people look at you as a tech entrepreneur, like, what do you do? Like, what is that? You know, it's sort of kind of weeds out a lot of, I wouldn't say the, I don't wanna say wantrepreneurs. I mean, that's, that's kind of mean, but, but I mean to say that people don't care about those vanity metrics that are so important to people in the Valley. Uh, like I remember when, when we kind of did this round that, you know, we became a unicorn. At the time there's only like 100 unicorns, right? No, back then I was a little bit embarrassed about it. I didn't really want to talk about it. I was like, you know, I was like, I don't— so my team members like, oh, we're joining the unicorn club. I was like, please don't say that again. Like this, you know, like it's not, um, none of that matters. Like, you know, like, hey, do you see this, this new account we just closed? Or hey, did we just deploy? You know, like we, did you see we stopped the Russians again at this? You know, we had all kinds of other things to be proud of. That were really about kind of our customers, right? And our, you know, making them successful, not about us. But part of that is this kind of this look in Michigan of, again, always looking outward, right? Because, you know, Michigan has been, you know, a history of building industries through export in this way. And so, whereas again, I think in some ways in the Valley or places like New York City, you know, you can sort of be caught up in these echo chambers, right? Companies buying, like when startups buy from startups and all, I'm like, oh my God, this is like turtles all the way down. And so for us, you know, we were always focused on those kinds of results. And, you know, even in the early setup, we had monitors in our offices with every deal. Like we built, you know, kind of these software dashboards for our business that when we closed deals, we'd see them pop up and, you know, we all celebrate, bang the gong, all this kind of thing, you know, this. All that kind of stuff. And so for me, like, I know that historically in the security industry, there's been sort of this weird cultural divide, right? Between sort of the product and tech folks, and then sometimes the go-to-market teams and all that kind of stuff. I lived that, right? At these other companies. And I didn't want that for Duo. I just thought, look, you know, we're, we're building an integrated sort of go-to-market where the product is the marketing. When you kick the tires, try before you buy, you know, in SaaS, you know, you have to be product-led because there's nothing to install or remove. You know, it's product is the demo, uh, is the marketing. And so we worked to create a focus on the customer from the start. You know, every engineer, I mean, it's kind of weird to say, but like every engineer at Duo through my tenure anyway, had been part of a customer conversation directly at some point in their career. And they could even sign up on internally for sales calls, right? Where our reps were talking to the customer because they need to hear that. Even if they wasn't, even if they weren't going to say anything, they need to internalize that point of view. Like, what is the customer actually dealing with? Why do they come to us? What's the positive business outcome they're looking for, right? And looking for our solution. And it's created like a completely different empathy. And like at our all-hands meetings, we'd have a customer there, you know, talking about kind of all this stuff because, you know, that's why we have a business at all. And. And so anyway, we've spent a lot of time kind of focusing on, on that, that kind of orientation. And as a result of that, it leads to a fluency with the operations of the business. When, when people, you know, can empathize, they commiserate like, oh yeah, that part of our customer journey really does suck. Like, I need to fix that. Like, and people care differently, right? When they sort of are, have that sort of exposure and then point of view. The other thing we also did, you know, just pro tip for founders out there, we used to do a board report every 6 weeks ahead of every board meeting or every board call. So we quarterly board meetings, mid-quarter board calls, right? Checking in on progress mid-quarter with the board, see if there's anything they could do to help. Ahead of each one of them, I had a board report where as a Google document, I'd have each of my department heads write 3 to 5 paragraphs of the plans, progress, and problems in their business. Sales, marketing, customer success, product, technology, or, you know, engineering, whatever. And I'll write the preamble, which is the story of the business, and I'd share it with the board and they'd comment on it right before the board meetings. And we focus our board discussion on the 2 or 3 topics of strategic concern, right? I wouldn't just sit there reading the slides to them and, you know, I'm not doing weather reporting. I'm here to actually have us have a conversation about what we need to do with the company. And after a board meeting, we'd sanitize it. I would share it with the entire company. And so every year we had 8 of those reports, right? On an octave basis, right? Every 6 weeks. The first of those every year was our strategic plan. You stapled that together and it's the book of Duo. Every major decision, every major success, every major failure, every learning we ever had. And when I hired new people, not just executives, but even, you know, we do hiring class of like 30 people at a time. I used to do all the onboarding classes with —this on my team—we have them go and look at that. Read the last 4, 5, 6 board reports, you know, you will know everything that we've done. And it was amazing. They have these, you know, even fairly fresh college graduates come out of sort of a first week at Duo where they've committed code and they've also read kind of a year's worth of, you know, every major business decision we made and all the numbers and everything. And they're like, I know kung fu now, right? It's just like, they're like ready to go. And, and so it was that kind of, you know, actually you mentioned Zingerman's earlier in the call, but Zingerman's was a little bit inspiration for some of this. 'Cause you know, even as like a small, well, $70 million a year Jewish, Jewish deli vertically integrated with all their, these different businesses, they did open book finance, right? They, they shared all their, their, their numbers, operations with their entire team so people could actually have empathy for what they would have to do. And, and again, come up with their own solutions, right? To how to improve the business and the margins, all this kind stuff. That's what we did as well. It just, and it scaled really well. So again, it led to outsized performance for us every year, every year, you know, most of the years we doubled the team and we tripled revenue. And so, yeah, you know, it was a way to align all of our team to the realities, operating realities of the business and really see how to contribute because they could then create their own commitments, right? In planning and toward what we'd have to do to, to actually move the numbers, move the needle on these numbers and really help build something unique.

Doug, we're getting to the end of our conversation. You've been fantastic throughout it all. One last question for you. Since your success with Duo, you talked a little bit about, you know, all the things you've done post-Cisco, but one of those is you and your wife have spent, your wife Lynn have spent quite a bit of time thinking about how to give back to the community and how to reshape philanthropy through impact. Maybe just share with our listeners just one example of an initiative that you've undertaken with your wife and why you've done that.

Yeah, well, we started a foundation to give where we live and the kind of scope of our giving tends to be, you know, Southeast Michigan, although we've done some in Baltimore where I'm from as well. But in both cases, you know, we're doing this to create community wealth. You know, to be good neighbors, to help build the community that we want to be part of. And by community wealth, I don't mean just economic wealth, but, uh, you know, social, cultural, environmental, right? And so we think about sort of what it means to sort of build what I refer to, you know, MLK on this, right? But Martin Luther King talked about the beloved community, right? One free of, uh, hunger and hate. And I personally think that the tools that we can kind of apply and bring to sort of our community in this way are the lessons that we've learned in many cases from entrepreneurship, right? How to be successful doing these kind of things in ways that create much more shared prosperity and wealth. And so a lot of what we do these days is focusing on ecosystem building, making sure that many more people have the opportunity to do what we've done in terms of building a successful technology-driven business. And an example of things that we funded that's kind of caught fire in Detroit, which is a supermajority Black city, it's the Blackest city in the country, nearly 80% African American, is called Black Tech Cities. And it's a movement basically that we've helped to fund and support in, well, you have 12,000 members. Coming together to build again a culture of tech innovation that is welcoming and inclusive, right, of people across all the experiences that people have lived, right, in a city like Detroit. And so those are things that we're really excited about. And there's some great companies we invested in out of all that. You know, it's, we're trying to create sort of the virtuous cycle, right, of founders reinvesting kind of their not just their capital, but their expertise, right, into their ecosystems in this way. And so, yeah, though Duo was the first unicorn, first multibillion-dollar tech and venture-backed exit in Michigan, there have now been 9 more. And we've thankfully been able to invest in some of that along the way. And I think we can help drive a whole lot more of that success in a place like Michigan that really needs it. Detroit's not completely out of the woods, but it is a beautiful and amazing and emerging ecosystem, particularly in tech and startup land. And I encourage any of you, right, you're looking for amazing deals with founders who are built differently, you know, because you got to be pretty resilient, right, to kind of build tech in a place like Detroit and resourceful and scrappy. And again, like I said, every place is about something. Detroit is about resilience. It's about grit. You know, these are folks who again, who again, has just been through hell and back, right? The first city in the country to have gone bankrupt and all. But man, if you're looking for like resourceful founders, Detroit is full of them. And we're proud to be backing a lot of these folks. And so anyways, investors, if you ever want to look at this stuff, let me know. We're syndicating all kinds of deals. We write a lot of first checks to a lot of founders and you'd be surprised the scale and ambition of a bunch of these companies that are just like, like I just had one launch yesterday called Electric Plant Company, electricplant.co. And they're doing planetary scale. They're kind of building Neuralink for plants. So number one, that's like a bit of a mind bender, like talking to plants and hearing what they're saying. But the second is like the scale of what they're doing, which is like planetary scale. It's kind of amazing. We've got, we've got very ambitious founders building very practical businesses from the start, global ambitions, but acting locally. And, and so that's what we're supporting. And if anyone wants to ever want to join us on that, let me know. You know, we're happy to, happy to partner with folks.

Doug, as we wrap up, I want to take this opportunity to thank you on behalf of all the founders in our community, obviously on behalf of my co-hosts, Ross and Sid. And I was trying to think that what is the best way that your image can be presented to our audience? So in my head, I have one side of you, Doug, which is the skateboarding Doug that I— that image is seared in my head with a laser, okay? Right outside Zingerman. Now when I look at you and for the benefit of audience who may not have the pleasure of seeing you on camera. I see this shade of like a Dalai Lama-like look that has come on your face. I mean, I was watching a documentary about the Dalai Lama literally last night and I said, like, Doug's side profile is actually like the Dalai Lama. Okay. So if I draw this Venn diagram of a skateboarding Dalai Lama who's trusted in security, that is Doug Song for all of us. That's the Song dynasty that I feel like you're going to leave behind. So thank you, Doug, for all the good work and amazing culture that you built at Duo. We've never heard such a story of not just thoughtfulness, but creativity, rituals, and above all, care about the customer. I think that is one thing that our industry really needs to build upon. And so thank you for blazing a path into this future.

Well, thank you, Mahendra. Thank you, Sid and Ross. I guess I'll just leave with this. I don't know about Dalai Lama, but I will say, my father was a Buddhist monk back in the day and I always left an impression on me, this kind of story and history of the Buddha and also sort of the Bodhisattva's vow, right? Sort of if you've figured something out, you need to bring people with you, share, right? In that enlightenment, if you will, and everything else. So I'm always happy to help. And that's one of the things I love about the startup and tech community. Is that sort of built on that ethos, right, of kind of giving back or maybe even giving first, right, as the Techstars people like to say. So yeah, proud to help. And again, like I say, if any founders ever benefit or learn anything from me, my only ask is that they do so for others as well.

They pay forward. Thank you for joining us Inside the Network.

If you like this episode, please leave us a review and share it with others.

If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and send it to me first.

No, don't do that. Mahendra gets too many gifts already. Please reach out by email or LinkedIn.