Marty Roesch: Scaling Sourcefire and creating a new way to monetize open source security software

Welcome to Inside the Network. I'm Sid Trivedi.

I am Ross Haliluk.

And I am Mahendra Ramsinghani.

We've spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators, and investors building the future of cyber.

Our guest today is Marty Rash, founder of Sourcefire. Sourcefire, a company that led the intrusion detection and protection, or IDS/IPS as it's called. He raised 4 rounds of financing from leading VCs like NEA, Sierra Ventures, and Sequoia, completed a successful public offering, later to be acquired by Cisco for almost $3 billion. At the time, it was the largest cybersecurity exit. Almost 2 decades after starting Sourcefire, Marty has gone back full circle to being a CEO of a startup called Netography. In full disclosure, my investment firm SecureOctane is an investor in Netography. But this is not a commercial for the company as much as the art and science of building a company, taking it public, and doing it all over again. We will hear from Marty about his entrepreneurial bug. It has bitten him twice now and how founders can find insights and inspiration from his journey.

Hi, Marty. Welcome to Inside the Network.

Hi Sid, thanks. Great to be here. Thanks for having me.

So we have a few different topics that we're going to try to cover today. We have 4 different topics. And the first topic, which is the most important one, is we describe it as "there and back again," which is after completing this entire cycle, the cycle of a founder from starting a company all the way to taking it public, you came back again to an early-stage startup. And this one is called Netography. And you decided to choose to suffer this pain for another bout of entrepreneurship. I'd love to understand why you did that and what was the motivation? How was it different this time around than the last time around with Sourcefire?

Oh yeah, motivation, boy, that's a good one. You know, like I was saying before we started recording, the new fun startup saying, we do these things not because they are easy, but because we thought they would be easy. It's really interesting. Sourcefire was a big journey from me by myself in my living room to public company to acquired was a 12-year adventure. I learned a lot and I had a really amazing time doing it even though it's hard and you labor in obscurity while you're getting going and things like that. But from a motivation standpoint, I guess I really felt like I wasn't really necessarily done with my career. I really like working freely. You know, anytime you go work for a big company, you're submerged within that company's culture and priorities and all the other things that come along with that, like, you know, stability and health insurance, which are actually pretty nice, it turns out. But when you're doing a startup, you have the breathtaking clarity of somebody with nothing to lose and no established kind of history. And as I like to say, when I'm advising entrepreneurs, you're unencumbered by success. You don't have anything that's kind of weighing you down like customers and these expectations and things like that. So it's this extremely free way to work and it lets you actually create new stuff. And this is a talk track that I've kind of had for a really long time about where innovation comes from in the cybersecurity industry. And it really comes from startups. You don't see the big giant mega corporations really driving innovation. It comes out of startups and they eventually either turn into big companies or get acquired by the big companies. And their ideas and technologies integrated into the larger whole. So yeah, for me, motivation was certainly all of that, chance to go be innovative again, a chance to operate in an unencumbered fashion. But it was also, to some degree, almost a little bit of frustration with what I saw. So after Sourcefire, we got acquired by Cisco and I worked at Cisco for almost 6 years as the chief architect for the security group there. And that was really interesting, work, obviously, big company with huge scope, huge remit. But you're back to that, well, it's really hard to innovate in these kinds of environments kind of problem. So I left and I kind of semi-retired, sailing and went and had some fun. And then the pandemic hit in the beginning of 2020. And just like everybody else, I was sitting on my couch in my sweatpants, wondering what I should do with myself. So I had the ability to sit there because that's all I could really do and think about what I wanted to do with myself. And, you know, in the run-up to Sourcefire, there was a lot of working by myself alone and collaborating with people over the internet and things like that, which is exactly, uh, essentially the, the environment at the beginning of the pandemic. So I started thinking about doing new things and I started teaching myself. I needed to get up to speed on relevant technologies that people were, uh, using these days, like taught myself Go and Rust because I'm an old school C programmer and, uh, like Nobody wants to use programming C anymore because it's quote unquote unsafe. But anyway, so I worked on a variety of things, but I got enticed by the Netography team. I was advising them before I came to the company and they were really doing something that was fundamentally new, but it was also something that I really believed in because I had very similar notions of the way that kind of network security technology should go. And then what happened once they invited me to come work here, I started looking around the industry to just see what the state of things was and nobody had moved the ball forward. I was like, I was shocked and to some degree kind of horrified that all of the network security architectures for the most part were still on the old models of looking at packets and appliances and central management platforms and all this other stuff that are just, you know, just don't work in the world that we're in. So I think part of it was, I was interested in doing something new. And because, you know, all of a sudden we all had a bunch of time on our hands with the pandemic, I was like, well, I should go do another startup because of course, what else am I going to do? Am I going to go join some giant megacorp or am I going to go do my own thing? And then the Natography thing came along and I was like, oh, this is cool. Oh, and nobody else has moved the ball forward.

And Marty, how big was the team, the Natography team when you joined? And did that concern you in any way?

The team was 8 people when I got here. It didn't really concern me. I'm used to working small. You don't need to have a big team to do interesting things, obviously all the way back into the late '90s with Snort, right? That was initially just me and then people collaborating over the internet, and that didn't bother me at all. It's a very capable team. People have been there and done that. This, it's not a bunch of, uh, kids doing this. This is a bunch of people who've been building real stuff for a long time. So I wasn't really bothered by that at all.

In our last episode, Ron Gula, the co-founder and the former CEO of Tenable, mentioned that you were actually roommates at Clarkson University. And it looks like both of you had a similar journey. You both built open source projects, which became quite successful products, built startups from the inception to IPO. And that's where the similarity seems to end. Since leaving Tenable, Aron became an early stage investor, started a foundation, and is going down an influencer path on YouTube. What other possibilities did you explore before jumping into the startup world again? And before you answer that question, what did you guys talk about when you were roommates?

What did we talk about? Well, we were, you know, in our early 20s. We were big gamers, uh, believe it or not. We became fast friends very quickly my freshman year of college. He lived across the hall from me, and, um, we both loved, uh, uh, flight simulators. There was a combat flight simulator called Falcon, and, uh, I had the very unique attribute of having a 90-foot-long RS-232 cable that I could string between our rooms so we could play against each other. So yeah, that's kind of how things started. We used to talk about technology and all the stuff you expect kind of the late '80s, early '90s, UFOs and aliens and engineering. And we had kind of similar science fiction backgrounds in terms of our reading and stuff like that. So yeah, we had tons to talk about. We were very complementary nerds and had a lot of nerd things to always stay in sync on. Anyway. Yeah, let's see the things, the other things that I considered. So I've been doing some advising. I've been on boards and things like that. Obviously I've kind of done the startup journey from soup to nuts. So a lot of people get pointed my way and ask for help. And, you know, one of the things that I do is, you know, any entrepreneur who darkens my doorstep and says, hey, I'm starting a new tech company. Could you please help me figure some things out? I always say yes, because when I was getting started in 2001 in central Maryland, right after the dot-com bubble burst, advisors were few and far between. So So I'm always willing to help. So I did some of that and I was on some boards and I started thinking about, you know, like I said, what I wanted to do. The actual first thing that I really worked on and almost decided to go into was working on essentially dealing with disinformation and deepfakes. This was back in 2020, 2021. I was starting to, you know, I became kind of painfully aware over the last, whatever, 8 years that information warfare was being waged at scale on defenseless populations. Of all the Western countries. And it seemed to me that there wasn't a lot of effort being expended on, you know, like trying to deal with things like deepfakes and they were gonna become a huge problem. We're seeing it more and more now as we get into another election cycle. But we also see there's other problems out there like Zoom call hijacking and things like that where you can, you know, put up a convincing avatar in real time to hijack a call. So anyway, I investigated that and I was looking at it kind of from the trust side. And trying to figure out, instead of trying to detect deepfakes, which, you know, may or may not be achievable over the long term because you get in this arms race with the deepfake generation technologists, I was trying to go to the other side of it and try to figure out how to validate that, uh, you know, validate what was real essentially, because there were a number of organizations that kind of traffic in being trustworthy, like media organizations and software companies and things like that. So being able to validate that materials were in fact authentic, I thought was the direction to go. So I did a lot of work on that. I actually built some technology and, you know, put some provisional patents together and things of that nature. Then I kind of came to the conclusion that the amount of money that was going to be required to actually do the upfront work to do the trust level validating for this stuff was going to be immense. You'd have to be like a Google or Microsoft to pull it off. So I decided not to go that direction. But I did I did spend time actually building technology, writing code, things like that. I also looked at doing kind of a mobile work from wherever security bastion, like thing you could carry around in your pocket. But I decided that was silly after doing some research on it and building some prototypes. I was like, nah, that's probably— people don't want to take things around with them. So I decided not to pursue that. And then the Netography thing came up. So yeah, built some stuff, taught myself some stuff, did a lot of advising and things like that. But I like to build things.

Tell us more about the UFO. That is probably one of the most fascinating topics that both you and Ron mentioned. We didn't get, like, we didn't have enough time to talk with Ron about it. So now you're the victim.

Tell us. Well, you know, there's always the question, are they real or are they not? And especially, you know, back then, not everybody was carrying a high-res camera around in their pocket. So it was, there was a lot of fuzzy video of weird things and lights in the sky and stuff like that. And one of my hobbies is astronomy.. And I got into astronomy when I was a teenager. So I spent a lot of time looking at the sky. I was always interested in that question, especially growing up in that era that I did. And I never saw anything that wasn't explainable up there. But, you know, definitely had a few head-scratcher evenings over the years. Anyway, so yeah, Ron and I used to talk about, well, what do you think? Are there aliens out there? Is there life on other worlds? Are UFOs visiting us? And we had these discussions. The funny thing, so Ron was in the Air Force and He was doing pilot training and things of that nature. He eventually ended up going to the intel side of the world. And we had a pact. If he ever saw anything that proved it one way or the other, if he just, if he told me he bought a cat, then I would know that he finally found just direct evidence because he was allergic to cats. Wow. And the real punchline is he eventually got married to a woman who actually owned a cat. So he did have a cat, but it wasn't related to aliens.

We'll never know. We'll never know. I mean, it could be, it could be that that was the sign.

Maybe that level of commitment was, you know, him, like, it was like a side nudge. He couldn't say it, but, you know.

Well, as somebody who went to Cornell in upstate New York, just hearing about two founders in cyber at Clarkson going and building two different companies that have had such an amazing impact, it's just truly spectacular to hear. Let's talk a little bit about Netography. What's the problem that Netography is solving, and, and why does this problem prevail? I'm just curious how you thought about the, the idea.

Yeah, so it's a bit of a journey. So, you know, for me, the foundation of it goes all the way back to, uh, about 2010 or so. So this is in the late Sourcefire days, a few years before we got acquired, and I was starting to notice the, the trends in the industry of companies moving more and more to the cloud, and it was still pretty early in the adoption phase back then, but you know, you definitely saw it coming. Like this was obviously going to happen. And also the increasingly pervasive use of network encryption, which obviously if you're doing deep packet inspection, which was our raison d'être at Sourcefire, is very problematic because you have to either play all these topology tricks to get into the path of clear text traffic, or you have to buy decryptors, or you just have to ignore traffic. And as more and more of it becomes encrypted, it gets to be a larger and larger TCO problem as well. So you had the TCO problem posed by encryption. How am I going to deal with it? Get taps and aggregators and decryptors and things like that to present clear text traffic to my inspector. But you also had this dispersion problem of things moving to the cloud. So the networks are dispersing. I coined this term at Netography. I call them atomized networks. We have all these atoms of presence that are scattered across multi-cloud environments plus on-prem. And the way that we were deploying, you know, packet inspection technology was primarily watching the north-south ingress-egress traffic only, and was completely blind to what's going on across the lateral ocean east-west environment. So this was, you know, I saw this as a problem and I started thinking about, well, you know, one of my jobs at Sourcefire was to prevent strategic surprise, like don't let us, you know, get caught with our feet flat as something is emerging and turning into a problem that we're gonna have to deal with as a company. I started looking at architectures for dealing with the world where the networks are increasingly dispersed, the traffic is increasingly encrypted. Also, you've got this, you know, this kind of ephemeral problem to deal with in the cloud where things come and go very quickly, or they can, as well as just the general diversity of the environments like multi-cloud plus on-prem or even IT and OT, and what the implications of this were for trying to observe what's going on at a network level in those environments. So it turns into an architectural question. The architectures that we built over the last 25 years really aren't suitable to the networks that we're in today. So that was the, the concept. If you agree with that, that notion, then how would you address it? Well, I had a model that I was really interested in, and it was actually based on EDR technology. So at Sourcefire, we had acquired one of the pioneering EDR vendors, company called Immunet, and they built a technology called AMP, which is now Cisco's EDR. And the way that it worked essentially is you had an agent that ran on your host. It collected metadata about what was being executed on that host, shipped it up to a cloud backend. All the detection heavy lifting was done there. And then it shipped, you know, answers or directives back down to the agent and said, oh, block that process. That's malware or whatever. So I thought that was a really fascinating architecture because it allows you to do really cool things like, you know, update detection one time in the cloud and all of your customers simultaneously get protected. So it's not like on Microsoft Tuesday in the old Sourcefire days where it's like, I have to roll out 20 new rules to 3,500 customers and they have to actually, you know, integrate them on their management platform, test them in their environments, deploy them to their sensor infrastructures and things like that. It's, I update once, everybody's protected. Cool. Super cool. So I was thinking about, okay, well, what would we, you know, what would we do if we wanted to do that on the network? And my conclusion was essentially, I can't ship all the packets from the network up to a cloud backend. That's obviously insane. That would never work. But it could ship metadata, right? Just like the endpoints are processing metadata, we can ship metadata up to the cloud backend to do the detection there and then signal back to the collectors, "Hey, I see something that I don't like. Do something about it." So I kind of, you know, I had a rough draft of this idea and I thought that that would probably work. It would scale really well. It could operate in the cloud as well as on-prem. It doesn't care about encryption because I'm not looking at the application layer. Doesn't care about the environment because the data that we'd be collecting about the, you know, the activities in the environment, the metadata, would be universal every place we were. So we could write, you know, generic detection around this. So I thought, okay, this is pretty cool. And I mentioned it to some of my coworkers, and I mentioned it a little bit in the Cisco days, but we never, never really took it anywhere. And then Barrett and Dan, co-founders of Netography, basically had largely the same observations and conclusions from their vantage point of building internet-scale anti-DDoS services and things like that. And they said there's got to be a better way. So they started working on this architecture. And as, as much as it's anything, it is a modern architecture for doing network security observability across any environment in real time. So it's not like everybody's throwing everything into data lakes right now. Data lakes are great, but they're not real-time systems for saying, oh, this just happened, let's do something about it immediately. They're dashboards and reporting and things of that nature. So at Netography, we've essentially gone to a metadata-driven platform for being able to, in real time, do streaming analytics of the data as it arrives and marry it up with context, not just about the activities that are occurring in the environment, but we also pull context from the tech stacks of the companies that we're in. So if you've got like Wiz and you've got Tenable and you've got Axonius and you've got Clarity or CrowdStrike, we can essentially leverage their APIs to access what they know and then pull that in to decorate the activities that we're observing. So it's not just the core data type that we deal with as flow data. So VPC, Cloud Flow Logs, or NetFlow, or IPFIX. So it's not just, you know, this IP address talking to that IP address on these ports for this long with this many bytes starting at this time and ending at this time. It's, you know, Marty's computer, Marty's laptop connected to a vending machine in the break room and shipped 40 gigs of data to it. Don't know what that is. You're probably not going to be super happy when you figure it out though. So that's the idea here. And the other cool thing, here's the rabbit out of the hat, I can do this without having to deploy anything. I don't need to deploy any appliances. I don't need to deploy any agents to make it work. It just leverages the infrastructure you've already got. So it's a live-off-the-land architecture. That's what we're doing. And what it really is is an architectural innovation, you know, taking this thing and really nobody else does this. Like there are no real-time streaming analytics platforms for network data like this that operate at scale across, you know, multi-cloud plus on-prem, blah, blah, blah. I don't want to turn this into a commercial, but it is really unique. And it's very interesting because, you know, most people hear it and they're like, oh, are you a SIEM? It's like, no, we're operating on fundamental data. We're an event generator, not an event consumer, you know? So it's a very different approach and it requires people to think about the problem differently and say to themselves, geez, maybe, you know, detecting every Log4j attack that floats in off the public internet actually isn't very important, but detecting when somebody breaks out of a zero-trust containment environment actually is really important. And I can do that with this architecture. I can't do it with the old architecture.

Thank you for that wonderful and very comprehensive description of Netography, Marty. Clearly, your passion is evident in why you have come back to the startup world. Let's switch gears a little bit to go-to-market. What you did at Sourcefire was pretty fascinating. Right out of the gate, you signed up like these 4 amazing logos, PricewaterhouseCoopers, Intel, SAIC, International Paper. Now we as VCs often tell our founders like, don't go to the big companies too early in the game, go to the middle market, call your friends. And you took the contrarian approach and pulled off 6-figure contracts right out of the gate at Sourcefire. And now you're doing it again at Netography with Goldman Sachs and a bunch of other customers as well. What advice do you have for founders and how can they tactically change their thinking to go after the big customers?

Yeah, well, I think, you know, it's a bit of a chicken and egg problem. So at Sourcefire, we had this really crazy unfair advantage in that all these places were already using our core technology, right? Snort is an open source engine, is already embedded in all these places and every place else. Task was just letting everybody know we existed for the most part for the first couple of years. So because everybody was super excited about the idea of, oh, enterprise-grade Snort, absolutely, sign me up. So that was, and the Sourcefire business model was a very contrarian business model. This was me with my engineering degree and nothing else basically, but confidence in myself saying, I think we can get people to pay for something that's free. And you know, people did, but man, when I took that business model on the road. And I said, hey, I'm a guy with a computer engineering degree. I've never built or run a company before, but I started this one. And not only do I have new technology, but I have a new business model nobody's ever pulled off before. Definitely give me millions of dollars to go see if I can make this work. People were not super enthused about that idea because let's face it, who's this clown, right? We know he's a good coder because all these people are using his stuff. But what does he know about building business models and businesses and things like that? So going after the enterprises for me, the whole thesis of Sourcefire was essentially, you know, like why do you rob banks? Because that's where the money is. Why do you go to the enterprise? Because that's where the money is. And in Sourcefire particularly, the whole idea was snort on the small scale solves problems, snort on the large scale causes problems, and the problems that it causes are different than the ones that it solves. And the companies that it produces the biggest problems for also tend to have the most money and the biggest problem, right? So just go to those guys. And I was right. So I think you've got to know your market, like you understand your value proposition and who your market really is. Because yes, you can go do a lot of $10,000 deals or a lot, you know, a stupendous number of $1,000 deals, but doing the elephant hunting thing is high risk, high reward. But also, if you know, out of the gate, like I did, these guys are already using this stuff. I mean, I had big banks contacting me, sending me computers. They're like, hey, could you keep Snort ported to True64 on the DEC Alphas? Because we're using it here at the bank and we don't want to port it ourselves. So we'll just send you hardware and bulletproof service contract and just let us know what you need. It's like, okay, great. So I knew all these guys were already using this stuff. In fact, I was kind of shocked at all the places that were using it. So yeah, for me, it was kind of a no-brainer to go there. Netography, it's a little different now. And the reason that we're going to the bigs out of the box is because we've been selling to them. The leadership team at this company has an immense track record of building, you know, real technologies for the large enterprise. Nobody doubts that we're serious when we say the things that we say and talk about the things that we talk about. So that whole, I don't, you know, are these guys wearing clown shoes question from the other side of the table gets answered in a big hurry. You know, oh, this guy is responsible for, the IDS/IPS industry, a lot of the core technologies there. My chief product officer is a guy named Dave Meltzer. He was the— built the competing technology to Sourcefire when we started and went on to become, you know, over the years went and did startups and was the CTO at Tripwire for a long time. Like, he's got a big track record. Dan Murphy, who's our CTO, you know, one of the guys who built the anti-DDoS industry. So like people, you know, going to large enterprise, these guys just take us seriously because they know we're not kidding around. Which is great, and a lot of startups can't do that. But you really have to know who's going to be the most interested in the problem that you solve, and it kind of doesn't matter what size they are once you figure that out. Because if you find your ICP, right, your ideal customer profile, it just starts spinning like a flywheel. So you shouldn't be afraid of going to large enterprise if the large enterprise has the problem that you're addressing, uh, the worst, because they'll probably be the most interested. But it's a little harder to get into sometimes. So, with Sourcefire, it was a bottoms-up approach. We got the techies first and then went up the ladder. And Netography, we're kind of starting top-down because we have the relationships with the CISOs, so we don't need to treat it the same way that we used to. Although right now I'm thinking real hard about adding a bottoms-up approach because I feel like if more technologists got exposure to what we're doing, they would be picking up adoption faster.

And talking about selling to large enterprises, we know that industry research firms such as Gartner and Forrester and vendors and also the training organizations like SANS have a fairly big role to play in helping to create categories and helping to define acronyms and also in educating buyers to ultimately direct their software budgets towards making a certain purchase. Both of these organizations like Gartner and SANS played a pretty big role and from what I understand had meaningful impacts on your decision to start Sourcefire and also informed your thinking around future product development. Do you think these kinds of organizations should play such big role in the future? And even more importantly, do you think founders should interact and work with them today, and how should they do it?

Yeah, that's a big question. So SANS was really influential in the early days of Sourcefire because they're the ones who kind of put the bug in my ear that Snort was a lot more popular than you think it is. I thought there were a few thousand users of Snort, something like that. I saw survey results in the fall of 2000 that showed that they surveyed their student body and one of the questions was, you know, check all that apply, check all the intrusion detection technologies that you use and you can, you know, select multiple. So it was checked 92% of the time. I was like, oh, okay, I had no idea. So yeah, I had that and Stephen Northcutt, of course, was my first seed investor in the company, helped me get it going. He saw what I was doing and thought it was interesting and you know, put his money where his mouth was. So that was obviously very helpful as well. But SANS is a training organization and I was, I was an instructor there for the first couple years of Sourcefire and even before Sourcefire, what happened was that, you know, it was almost like a get 'em while they're young, teach 'em this is the way that you do intrusion detection and they adopt that kind of mindset and everything that's not that looks weird to them. So that was hugely helpful and influential. I still run into CISOs who was like, I took your SANS course in 2001 and it was great. And you know, or I used Snort, you know, it's one of the tools that I used when I was just getting going in security. It taught me a lot. It's hugely, hugely influential still. So that's, that's really pretty, pretty interesting how that continues to be influential today. And then Gartner, Gartner's, you know, Gartner is an interesting animal. Gartner doesn't make or break a company, but it does make the phone ring. Being in that upper right-hand quadrant gets the phone ringing because when, you know, all other things being equal, when people are saying, I need CSPM, or I need a firewall, or I need whatever, especially the large enterprise customers that you're going to sell to. If you're a guy like me, one of the first places they're going to look just to get a list of the companies they should be considering is looking at the Magic Quadrants and looking to see if there's a category and is there a definition for this and do these guys fit in certain places and not in others. And to some degree, you have to play the game. And it's, I guess I would say, have kind of a nuanced view on them. They can be helpful. Like they can help you define your category. They can help you figure out what you, you know, how you should be positioning things, you know, review your verbiage, give you feedback that they're getting from the market and things like that. They also, sometimes they, I would say they kind of overstepped their remit like 20 years ago when they declared intrusion detection dead or things like that, which I think is a little more of a speculative thing, right? And they were saying, well, IDS is dead. And IPS is going to replace it because nobody needs to detect these attacks. They just need to block them. But of course, there's a lot more nuance to it than that. And you just, you know, you can't make those kind of blanket statements necessarily, although it's become kind of a time-honored tradition in this industry to declare, you know, XYZ dead when I've got the new mousetrap. So yeah, I think, you know, Gartner does bring stuff to the table. Your need to interact with them in the early days of your company, unless you're selling to the customers that they're advising, I would say you should be working on other stuff, gaining momentum in the business and things like that, because they're not really going to help you if your customers aren't paying attention to them. As you get bigger and you do start getting into the enterprise and maybe you do become part of a competitive category, that's when they get a lot more useful because you can talk about how you stack up and talk to them about how customers perceive you and things of that nature. And that can be really useful. So yeah, both organizations I think are, are pretty unique in their own ways and useful in their own ways. I think if I had a, a a free-to-use version of Netography. I might go to SANS conferences or something like that to show people how to do the new architecture for network security. If you think network security is going the direction that I think it's going, then you might want to check it out.

Marty, you mentioned Snort a couple of times, and I'd love to dig in a little bit on Snort. And before I do that, in our last episode, we talked about Tenable's journey and how Tenable was built on top of an open source project called Nessus. Sourcefire similarly was also built on top of an open source project called Snort, which you referenced, which was an open source IDS/IPS solution that you created back in 1998. Now Tenable decided to commercialize Nessus and make it proprietary software, but you chose to keep Snort open source throughout. How did you figure out a way to monetize free software, and what lessons did you learn about commercializing open source that still hold true in today's world? Because now we are seeing a significant number of commercial open source projects that are being created. And in today's world of cloud, AI, and this direct-to-developer motion.

Well, so I think different approaches that we took with Snort versus Tenable with Nessus to some degree are driven by kind of the nature of the technologies. And what I mean by that is that I think that, well, I gotta be a little careful here 'cause I don't want to say anything that's technically incorrect, but I think that Nessus as an engine kind of got into a certain shape and didn't have to evolve as much or as frequently as an intrusion detection engine would because of what it's doing, right? It's connecting to things and interrogating them and running through vulnerability management data and stuff like that. Whereas Snort, as attacks evolved, Snort had to evolve with them. As evasions evolved, Snort had to evolve with it. As the complexity of attacks on the network evolved, the complexity of Snort's detection engine had to evolve. So Snort was an evolving piece of software that was constantly adding like, like really new functional features to it and incorporating new ideas and things like that. So I would almost say it's more of a living piece of software because it needs to, because the pace of innovation on it needs to be so high. And I think that the problem that Ron and the the guys with Nessus and Renault were having with Nessus was that it was a relatively more static piece of technology that had content as the primary driver, and it was maybe a little too easy to adopt the engine and generate your own content, and they just felt like they were hemorrhaging opportunity, essentially. With us, I believed that driving innovation into the Snort engine was the best way to keep everybody's eyes on us across the entire industry. Like, so everybody who's doing deep packet inspection-based intrusion detection and prevention, even in the next generation firewalls, I felt that if we continued to drive the pace of innovation where you'd be nuts to look at anything else and give it away for free, because don't forget, that's not monetizing necessarily the engine. I'm monetizing solving the problem that people who are using the engine have, and that's different. So that's, that was the method to my madness. And, and I was very emphatic about it. You know, early on in Sourcefire when I was hiring executives and things like that, I told them we are going to continue to develop Snort and give it away for free and make it the best engine we possibly can and give all the innovation that we put into it away for free. And I don't want to hear it. And we're never going to have discussions about closing it because that's not the game we're going to play. We're going to monetize the fact that operating Snort at scale is actually very difficult, right? It's got to be on appliances. They have to run at certain line rates. They have to be supported. You've got this huge curation cycle involved with all of this stuff of the content that's driving the detections as well as the engines themselves. The backend management platform. That's what people were paying for, right? So, you know, in a nutshell, the things that people were paying for in Sourcefire days were scalability, manageability, performance, automation, and support, right? Those were the things that people were giving us money for. Snort we gave away for free, but if you want to make Snort perform and scale, you had to pay. And that was the model. And, you know, and it worked. So it's called the open core model now. It has a name. And yeah, more companies are using it. And open core models and kind of similar approaches, maybe more Tenable-like approaches where there's a free-to-use version and then there's a pay version are certainly much more common today. But yeah, back then they were very experimental. But I had real opinions on it. I actually, the thing that I spent the most time figuring out how to start Sourcefire was what the business model was actually going to be like. Thought about it for maybe 4 or 5 months. I had lots of advice from different people. What it should be. Should it be, you know, should I do CD-ROMs and try to get them distributed at, you know, CompUSA? Should I, you know, make little consumer-size appliances and try to get in the consumer market? Should I do the enterprise model that I did? You know, what should we do? So yeah, and none of these questions were like well answered at the time. They were all very speculative. And I sat there and I thought about, well, you know, what are the problems that people actually have with this thing? And that was the That's what became the Sourcefire business model. Like, what sort of causes headaches? Sourcefire is going to sell aspirin.

Talking about building successful companies, we know that resellers and distributors account for a large percentage of the revenue of successful public cybersecurity companies. And I believe in case with Sourcefire, it did account for over or roughly 46% of the revenue at the time of its IPO. One of the interesting data points that I found when writing my book was that 9 out of $10 is spent on via channel partners in the industry. How did you get comfortable with direct versus the channel mix? And also, when and how should founders engage channel partners?

I got comfortable with selling through the channel as the company matured. We started out as a fairly direct company and we had a couple of kind of channel initiatives that went okay, but not great until we really kind of locked in on it in the 2008, 2009 timeframe. And came up with a kind of a multi-stage graduated channel engagement model where, you know, the more effort the channel partner did, the more margin they would get and stuff like that. So we come up with a much more sophisticated channel model as time wore on. But, you know, the channel gives you scale, right? If you're going to get sales scale, you really need to have an effective channel program beyond a certain point because you only have so many marketing dollars. You only have so many people you can put in the field to go find deals and things like that. Channels. Have the relationships with the customers that you want to sell to. They know where the deals are. They might know about deals that you're never going to find out about. So there's many advantages that they have. They also have the working relationship and the trust relationship with a lot of these customers. So they can really smooth out your approach to a new customer. So I think that, yeah, the channel can be really, really effective, but you have to prove yourself in the market to get their attention. There has to be margin there that they can take advantage of. You know, if you are capable of doing only generating $50 of margin for them per deal, that's not very interesting. Sourcefire, one appliance could run a quarter million dollars. If they're getting 30 points of margin on it, that's a pretty good day, right? If they sell one of those or if they sell 10 of them to some big enterprise and all of a sudden you're talking some real dollars here. So getting their attention requires you to be able to throw off enough cash essentially so that they're getting paid. If 50 points of margin is only $50, nobody's going to be interested. But if it's $50,000, Everybody's going to be interested. So that's the, that's the real thing. But yeah, to an entrepreneur in the early days, probably you're not going to get the channel's interest until you've got a sufficient amount of sales volume that they see, okay, this is a real repeatable, you know, product market fits there. They've got a repeatable sales motion. We can take them to our trusted customers and engage with them. And, you know, they've got a support organization that can support us. Both from a sales enablement standpoint as well as a tech support standpoint. They've got a well-developed sales engineering core that can dig in on the technical questions that arise, all those kinds of things.

You know, the only question I had, Marty, as a follow-up there was, is there a specific number of customers or a specific revenue dollar that you'd say is necessary? And at that point, you should start engaging Channel?

I would say, Probably the right time to do it is when you're becoming capacity constrained. So one of the ways you can look at your, your selling is, are you capacity constrained or are you opportunity constrained when you're in the market? If you're capacity constrained and you don't have the ability, especially to grow into the capacity that you need to have because you don't have the cash or whatever, that's a perfect time to go engage the channel. This is at a certain size, probably somewhere between $5 and $10 million ARR if you're selling a, you know, an ARR kind of revenue model. That's probably when these guys are going to start engaging. We're already in the channel. We already have channel partners that we're working with and we're still relatively small. But once again, everybody knows us, so they're willing to work with us out of the gate. They know that we know how to run a real channel program. I think the, for the first-time entrepreneur, you know, getting the company up to a certain revenue level, but like probably at least $5 to $10 million before you go try to engage the channel is important. And At that size, you should, if you're becoming capacity constrained because your demand is extremely high, that's probably a good time to go engage the channel. But if you're capacity constrained because I've only got 2 sales guys and I can only, you know, make so many phone calls a day, maybe less so, right? Until you get to a certain revenue cliff.

But let's spend a little time on the Cisco acquisition. I know that was at the time one of the largest acquisitions that had happened in cybersecurity, almost $3 billion. You were growing at a phenomenal clip. You had created a new category. All of that is public, but what is not quite, you know, available to the benefit of our audience is what happened. How do these exit negotiations occur? You know, what happens? How long does it take? What are the ups and downs? Can you walk us through some of the behind the scenes there?

Sure. Yeah. So that was a very interesting time in the industry. A lot of things were going on. So this is at the beginning of 2013 is when all this got rolling. And there'd been a kind of, there were a few external things going on and there were some internal things going on at Sourcefire. The external things that were going on was the emergence of Palo Alto as a next-gen firewall company and leader, as well as FireEye doing this kind of, you know, quote-unquote signature-free malware and attack detection. And they were both doing things that we were doing in different directions. They were both extremely well-funded companies. There were no expectations of profitability anytime soon for either one of them. I think at the time Palo Alto was spending 97 cents for every dollar that it brought in on go-to-market. I mean, it was insane how much money these guys had at their disposal and how freely they could operate as a result of that. And same thing with FireEye. They had their appliances doing malware detonation and things like that that, you know, sounded good. And everybody was really having these kind of very rosy predictions that we were entering the age of signatureless detection and stuff like that. And I was, you know, a contrarian on that, as I saw often then. But, you know, the fact of the matter was that these guys were operating in the market and they were competing. We were trying to go to market with EDR and building our own next-generation firewall. So we had kind of this two-front war going on at the same time that we're trying to stay the preeminent vendor in the IPS space. To, to forge into these new fields against companies, despite the fact that we were a public company, I think we were doing in 2013, we were doing about $220 million a year in revenue and growing at about 40%. And that was good, but our profitability was, we were locked into our business model. So Wall Street had expectations of our operating margins and profitability and stuff like that. So I wanted to compete with these guys because I knew we were either going to have to compete with them or, you know, we were going to have a problem. So we were going to have to free up cash to be able to go fight this new two-front war in addition to working our existing markets. So on our earnings call, beginning of 2013, I told Wall Street basically that we were going to hold our net operating margins flat for this year instead of trying to expand them to free up, I think it was either $12 or $16 million to go duke it out with these two incredibly well-funded new companies. So, so that's what we were going to do. And we were trying to figure out how to juggle all of this at the time. At the same time, I had just recently gotten back into the CEO seat at Sourcefire because our CEO that I had hired in 2008, a gentleman named Jon Burris, had passed away due to cancer, unfortunately. And he was a great mentor, really super solid guy. I still remember a lot of his, a lot of his teachings and sayings. But unfortunately, he had passed away. So I'm back in the, in the CEO CEO of my company after, you know, 10 years of being out of it, basically. So that was going on. We had a lot of uncertainty in the business. And then at RSA, actually in 2013, we had some sit-down meetings. This is in February of 2013. We had some sit-down meetings with Chris Young and the gang. So Chris was the new GM of the security business and he was really interested in the next-gen firewall work that we were doing. We had just entered the market with our own next-gen firewall, built our own firewall from scratch. To run alongside with the IPS technology. So they were very interested in that. And, you know, we came to find out was that Cisco had tried to build their own next-generation firewall, but it had been kind of a flop. So they were feeling like they were being pressured by Palo Alto at the time to come up with a better answer. And we were one of the only games in town essentially to do that. So they started talking to us about that and we started talking to them about what we were building as well as our cool new EDR technology called AMP. And they decided to engage. So we went from the initial meeting in February of 2013 to announcing the acquisition in July of 2013. So pretty quick, like 6 months, and that's really quick for Cisco also, and it was a large deal. So yeah, it was, uh, it was really interesting. And the dynamics of doing the deal, there are a lot of pieces to the puzzle. Once we determined they were really interested in engaging, we hired a banker, Catalyst, and they were, you know, great to work with. They did a lot of analysis with us to figure out if the deal that had been offered was fair and what kind of price expansion we were going to have to have and things like that if we wanted to grow the stock price. We were trading at the time around $53 a share and Cisco had offered us $76 a share. So it was pretty substantial premium on the stock price. So we did all the math and got all the bankers involved and, you know, all that stuff. Made the decision, but it was a tough decision for me because Sourcefire, you know, the business was a great business and we were doing great things, but the company was such an amazingly great place to work with all the people that we had there and how gelled the team was and just what a nice place to work it was. You know, the management team, we got along very, very well. We are still friends to this day. And yeah, it was just, it was a very unique environment. We didn't really have politics there. We had a very outward-focused culture. That was just focused on building great products for our customers and for competing as hard as we could in the market. And that really kept people aligned with, with just being successful. So I was— one of my major kind of holdups on doing the deal or not was just, it's going to change things. And when it does, you know, we're never— it's going to be hard to recapture the magic. And that is, that has proved to be true. So yeah, Sourcefire was, was a very unique animal and getting the deal done with, with Cisco. There was ups and downs. There was all sorts of things in play, but it was kind of fascinating too. I got to work with Jon Chambers directly and he's an industry legend himself. And he was calling me up at Saturday mornings and asking me how the deal's coming along and stuff like that. So it was a really exciting time. But yeah, there were definitely pros and cons to it. And as an entrepreneur, what I would recommend is one of the things that I say to almost all of the entrepreneurs that I work with when I'm advising is you have to figure out what your victory conditions are. Like, what is success to you? Is it IPOing a company? IPOs are vanishingly rare for a software company. The NEA guys used to have a slide that showed the odds that you had of going from founder of tech company to funded to IPOing or any exit to an IPO. I think the odds was of all companies started that were tech companies that produced a business plan that put it in front of a VC, it's about 1 in 80,000. And, you know, those are pretty terrible odds until you look at the Powerball lottery odds and all of a sudden they're actually quite good odds. But you should always figure out what your victory conditions are because that will inform you when is enough enough. What can I say? Yes, we did a great job. We did what we came here to do and we're ready to, you know, take it someplace else to the next level, to another level, either IPO or take this acquisition offer that's on the table and things like that. So, you know, when you look at a deal like the deal that Barracuda guys put on the table in front of us, that was nowhere close to a victory in my estimation. When the Cisco guys came along and gave us a, you know, 40-something percent, you know, boost on our trading price, it was like, yeah, that's— you can call that success. Also, one of the things that kind of ground away at me in the background as I was deciding whether or not I wanted to take this, you know, special magical thing that I had built, sell it to Cisco, was, um, don't be Yahoo. If you remember, very famously, Yahoo had a had a $40 billion offer on the table from Microsoft and told them to go pound sand. And 2 years later, they're worth like $4 billion or $2 billion or something like that. Don't be those guys. That's always something you got to keep in the back of your mind is there is a failure option. We can always screw this thing up later, right? So that's the thing an entrepreneur always has to also keep in the back of your mind. Be humble, right? You have to have some level of humility. Is this going to continue forever this way? Or are there potholes that we could fall into? Are there, you know, problems that we could have that are insurmountable? That sort of thing. And when the Cisco deal came along, it was pretty obvious that was victory. We can be happy and a job well done.

Marty, you spoke about investors and these critical junctures of decision-making at Sourcefire pretty extensively. You had three quite big-name investors on your board at Sourcefire. You had Ashim Chaudhary, and for context for the listeners, Ashim joined your board before he had joined Greylock, so he wasn't even a VC at the time that he joined your board. Then you had Tim Gullery, who's at Sierra Ventures, and you had Harry Wheeler, who's since passed away unfortunately but was at NEA at the time. And all three of these kind of big-name VCs were relatively early in their venture careers when they joined the Sourcefire board. What was it like working with the three of them? What did you learn from them? What annoyed you about them? Oh boy.

Let's see. I gotta be a little careful here. So I never got particularly annoyed with any of them. I think the most annoying thing that I ran into on a relatively frequent basis was kind of Silicon Valley groupthink. I remember very distinctly in 2008 when the markets were melting down and, you know, the whole Sequoia note had come out about, you know, hard times ahead and things like that. We went into a board meeting and I think this is in November of 2008 or maybe October of 2008, something like that. We went into a board meeting and like the VC board members were like, you have to fire 20% of your team like immediately. And we're like, whoa, what? And you know, we were like, I think we were 400 people at that time. It's like, we're going to fire 80 people. I mean, we're growing like this. Why are we firing all these people? It's like, you just have to. And you know, we explained to them very calmly, look guys, we are not at all And we're a 400-person company and we're something like $100 million in revenue or $80 million in revenue and growing at like 40 or 60%. Like, guys, we are not at all opportunity constrained right now. We are absolutely capacity constrained with our ability to sell this product. Like, nobody's taking their foot off the gas from a buying standpoint. And this is a cybersecurity thing. Like, let's all remember, kids, cybersecurity is plumbing. The pipes are always leaking. Everybody needs security all the time. So That's the mindset. And we did ultimately fire, I think, 4 people. It was like, we just use it as an opportunity because it's like, well, we got to fire somebody. And there were 4 people. It's like, well, we've been kicking these names around for a while anyway. So I guess we should just do that and call it good enough. So we did. And yeah, that, you know, so the groupthink thing is sometimes a problem, but, you know, a lot of times they're willing to be reasonable, especially if you back it up with numbers. You can show them, no, no. This is actually not a problem for us. Although independent of what we were saying and how the business was doing, our stock did bottom out below $4 a share in November of 2008, you know, so $3.89, I think it was. And, you know, a year later we were trading at $26 because we kept beating and raising every quarter. So anyway, yeah, it was really the boardroom was pretty interesting. Harry was awesome. He was a believer. He was the kind of VC you want. That really believes in your vision and really believes in your— believes in you and what you're saying, what you're doing and how you're doing it. He may not understand it 100%, but his level of enthusiasm and just support was phenomenal. Tim was pretty early. He was a true believer right from the beginning. They actually found me at the RSA show, I think in 2002. We did our first booth there. We had a 10 by 10 booth with a big pig on the backdrop and, you know, he had this big crowd of people standing around us and we clearly had no idea what we were doing. You know, we had raw appliances just sitting there on the, you know, on the table in front of people and just, you know, showing them what it could do and our crappy GUI and stuff like that. But he saw the crowd and he started asking around and realized there was an opportunity here. And he was a very enthusiastic investor. Ashim came in a little bit later, but he was, you know, with his background in marketing at Checkpoint, he was seen as somebody who could really help us flesh out the, uh, the marketing story. And he was great too. A lot of great insights, a lot of great access also. He knew everybody. So that was always really nice to have as well. Yeah. So it was very interesting and we were all a lot younger. I mean, this was 20+ years ago now. Uh, so, uh, it was a very interesting group of people, but they were generally very supportive and, you know, a lot of enthusiasm for what we were doing. And, you know, when I turned out to, I think, I think everybody around the table, including me, felt a lot smarter when it turned out I was right about my business model. So, uh, yeah, I think, uh, you know, nothing succeeds like success. And, uh, it was a great group of people. They let us operate, uh, for the most part. So there's always going to be annoyances in boardrooms, you know, people who, you know, depending on where they come from, their, their background, whether or not they've been responsible for operational profit loss and things like that. They can be more or less help in different areas. You've always got to pay close attention, not just to who's going to be in your boardroom, but what their backgrounds are and where they come from and kind of the types of help that they're going to be able to give and things like that. But yeah, great group of people. We had really great luck in the early to middle ages of the Sourcefire board, just very talented investors around us.

So the lesson there, Marty, is that avoid groupthink, especially if it comes from Silicon Valley. And I think you have a unique advantage when you're based in the DC area. I think you and Ron both avoided the Silicon Valley group thing very elegantly. One interesting data point about capital is that at Sourcefire, you raised 4 rounds and before going public, you consumed only $35 million. In fact, $20 million was still in the bank at the time of going public. And here at Netography, 20 years later, your Series A is like $45 million. Jon Schipp, you know, very different numbers, very different times. You know, two decades have passed by. Uh, what are some observations about the flow of capital? What advice do you have for founders in these times?

Yeah, well, Sourcefire was incredibly capital efficient, amazingly enough, but things were pretty different back then. So the company got going right after the tech bubble burst, um, which was kind of fascinating because, you know, the downtimes is when people get hungry again. And the good times is when people get complacent and to some degree when the money's out there, they'll want it. So the team that we had, especially in the early days of Sourcefire, very famously, the company's management team was largely solidified by year 2 of the company and stayed with the company for the full ride. So it was a really interesting team in that we got the team right almost immediately out of the gate, which is very, very difficult to do. Yeah, on the money side of things, the capital efficiency that we had then is very difficult to replicate now because this company started right at the tail end of the last boom period. So, and I shouldn't say it started, I should be a little careful about that because it started a few years before that. But when I came on board was right at the tail end of 2021 and people were very expensive in '21 and '22. There's inflation. We're operating in AWS now. So our ongoing operational costs for, you know, providing our service are always there. You can do much more, you know, when you're selling appliances, you buy what you need and you put them together and you ship them out to customers, you get margin right away. We have to have all this reserve capacity at Amazon in case one of our customers blows up or something like that. So we end up with, you're paying $100,000 a month for your Amazon bill. You know, that's just an expense that's baked into the business. Also, you know, in the early days of Sourcefire, when I hired my first CEO, I at the time was only paying myself like $75,000 a year. So he basically set a flat salary cap for all the C-level people at the company of $150K, and that was it. So everybody was like at this level and we'll start giving raises and getting people to more market prices as we're successful or not. And now, like, people have expectations that are well beyond that. Nobody wants to be— well, you know, they're working from home and if they live in San Francisco, they're going to want a different salary than, you know, if they work in Columbia, Maryland, or, you know, Annapolis, Maryland, where I am. So that also kind of weighs on it as well. So yeah, the expenses, they're very different expense model now. People are much more expensive as well. The marketing is much more advanced, but also commensurately expensive, whether or not the market emerges for you. So yeah, the expense load seems to be much higher than it ever was in the original days. But I think that's, you know, the market economics are different now and the tooling that's out there is different and things like that. We didn't have Salesforce. When I was getting going. And now we do, and, you know, we pay thousands of dollars a month for that, so on and so forth. But you gotta spend money to make money, and that's, you know, how you gain efficiency in these businesses these days, where you can have fewer people doing more things. And that's the theory of it, but sometimes it works better than others.

Thanks, Marty. So having covered the past and the present of building companies, let's Let's place our hand on the crystal ball in, and in our last question, let's briefly talk about the future. You've been in the industry for quite some time. You've been around for over two decades, enough to witness several generations of companies, a variety of geopolitical developments, and different cohorts of practitioners and entrepreneurs trying to move the industry forward. What do you think security is going to look like 10 years from now? And finally, what future should the early-stage entrepreneurs be preparing to in this AI-first world?

Well, one of the things that having 20+ years in the security industry and longer than that involved in the tech industry has taught me is that we always have to be careful about, you know, straightlining approximations. You know, two points, two data points does not a trend make. So AI is ascendant right now, but we all have to remind ourselves that AI has been ascendant many times over the past 40 years. And, you know, there's a term called AI winter, which was coined after several rises and falls of AI. I remember when I was in college, one of my computer engineering professors working on expert systems, which is what AI— you know, you couldn't call your stuff AI anymore, it had to be called expert systems because you couldn't get funding for AI because we were in an AI winter. All right, so that said, I think that, you know, in the future, I would like to think that there are going to be fewer security companies, but it's hard to see it incentivized at all except for by the smoking craters left by security companies that have failed and kind of the barriers to entry to this industry, which are quite frankly few. So there's that. I think that, you know, the cloud's with us to stay, so you're going to have to build for the cloud, but there is a whole world out there of things that aren't the cloud that you need to consider. So, you know, one of the things that we do at Netography is we bring together a composite view of your multi-cloud world plus your on-prem IT and OT world, right? Really cool. Nobody's ever really pulled that picture together before. So while, you know, we are kind of cloud-first with what we do, we're cloud-hosted, in fact, we remember that there is an on-prem world. We remember that there is an OT world. And, you know, you also have to remember a lot of the security technologies and approaches are, uh, are cyclic as well. So I kind of joke around and say, you know, it's 1995 in the cloud. And what I mean when I say that is that most cloud security is access policies and some light firewalling and a lot of, you know, host-based security, essentially agents, log analytics is the vast majority of cloud security these days. And to some degree, everybody forgot about the network, but, you know, I think they forgot about the network because the tooling that was out there was the architectures were incorrect and And that's kind of our whole thing. But yeah, you have to, you know, as you're thinking about what the security industry is going to look like and things like that, if you look backwards, you'll see the trends. You know, when I was getting going with Sourcefire, there was a big resurgence in endpoint security, like Okina and things like that. And then IPS came out and IPS eventually morphed into next-gen firewalls, but then We saw advanced persistent threats become a thing, and APTs were really best addressed by endpoint defenses once again. So we saw the emergence of EDR swing the needle back towards defense on the endpoint. Then we saw everybody go to the cloud, and then all of a sudden log analytics get important again. And we see vendors like Splunk explode as everybody's trying to instrument their networks to be able to look, or, you know, their enterprises to be able to pull all the logs together and things like that. So these things kind of wax and wane as time goes on. And that's just going to keep happening, this kind of three-legged stool of the network, the workload/device/whatever, the, you know, this endpoint processing that's going on. And then, you know, looking at all the logs that are produced by things. And I think that's just going to keep going. We have interesting, I would say, revolutions or unlocks that happen as a result of larger trends here, like AI is one of them. The cloud has actually been really interesting because EDR was possible because of the cloud. You couldn't do EDR until the cloud existed. Once the cloud existed, you unlock the ability to do EDR. 4 or 5 years after that, you saw the first cloud-based log management platforms and SIEMs and things like that, like Sumo Logic. They emerged and then the network didn't show up really until, and this is, you know, me talking my book, until Netography showed up. Like nobody ever tried to do it, but you know, the cloud's unlocked the ability for Netography to exist by letting us take this this, you know, this metadata-driven model and make it happen. So is AI going to be another one of those unlocks that produce a new wave of security vendors that are built on capabilities that are unlocked by AI? I think the jury's out. Everybody wants to use— like, if you want to be taken seriously by investors right now, you've got to put AI somewhere in your pitch. So everybody's definitely, everybody's definitely trying to figure out ways to, to make it relevant, whether or not it is, you know. It would be nice to speak English to my product and have it spit out my proprietary language, for example. It'd be nice to have it summarize my events in a human-readable format so you don't have to actually understand IP addresses and port numbers and things like that on the one hand. But on the other hand, the amount of cost that's involved to be able to provide that capability is different. So, you know, where is that cost gonna exist in these model, in these business models? And all that stuff's gonna have to be worked out. But I would say there's probably some unlocks coming from LLMs you know, the emergence of LLMs, and it's not just chatbots, but, you know, being able to use products more intelligently and more intuitively that are going to be unlocked by AI. And then you get to the other things that we can do with it. So, you know, AI is becoming more and more advanced, but I look at my product, for example. So today we are aggregating across all of our customers trillions of data points a year, trillions. And so you'd have to be insane not to look at that and say, ooh, there's an AI application there, I bet you. And there probably is, but think about all the money that's gotta be spent to train a model that can look across all this data and like detect weird, detect bad, detect, you know, things you wanna detect. And then curating that model on an ongoing basis and things like that. And is it worth it? Is it worth spending all that time and money? Is it gonna give us unique insights that can't be gotten in other ways, that sort of thing? And everybody's gotta be asking this question because people are real sloppy about how they use AI. And I know you're all aware of this. People are very sloppy about how they apply the words AI and ML and things like that. That to what their products can actually do. You know, if your AI is a data center in India, you know, and for some companies it absolutely is, it's putting the lie to the entire industry. It's basically making the entire industry look bad because then you've got, you know, kind of this noise problem that everybody has to try to break through where you got to get through the noise floor of all these companies or the majority of these companies are spinning, you know, just pure fantasy. And then there's a small number of companies that are actually executing, providing things of real value. Yeah. So I don't think, you know, I don't think the network's going away. I don't think malware's going away. I don't think ransomware's going away. I don't think bad actors are going away. Maybe we have some nation-state level stuff that goes on where, you know, it becomes much more financially or physically costly to mount these cyberattacks. You know, maybe the government gets into it a lot more than they are right now. That'd be interesting to see. But you know, the thing that you can depend on is that it will definitely look very different in 10 years than it looks today, just like 10 years ago when we were just, you know, cloud adoption was on the rise, but, you know, the trends that were really, I think, unlocked by the pandemic of remote work and work from home and more motion to the cloud and things like that, and these much more dispersed network environments, I think all those things were driven by the emergence of the pandemic. So, you know, you never know what the actual triggers are going to be for these things as well. So, Something could come along like aliens coming out of a UFO or something that say, "Oh, we have much better ways of doing networking than you guys thought of." Maybe that's what Ron was trying to tell me when he married that woman who wanted to kill him.

Marty, I know the industry is glad for sure that you and Ron did not end up chasing UFOs. Both of you have built iconic companies. Decades of your life have gone into building products that have helped millions of users worldwide. And, you know, we want to thank you for your service and inspiration that you provide to founders. Building companies, raising capital, building teams is not easy. You've done that once and you're back at it again. So that shows that you're persistent and will continue to play this game for a long time to come. We certainly look forward to have you and Ron again, maybe to just discuss the UFO part.

Wonderful.

Absolutely. Wonderful. Thank you so much, Marty. Thank you for your time. We really enjoyed the conversation today.

Oh, I enjoyed it too. Thanks very much. I should give a shout out to Ron's wife, Cindy. That woman's actually— her name is Cindy and she's a lovely person. So I don't want her to be offended that I didn't mention her. But yes, thanks very much for the opportunity today. I appreciate it. It was a lot of fun talking to you guys.

Thanks, Marty.

Thank you, Marty.

Thank you for joining us Inside the Network.

If you like this episode, please leave us a review and share it with others.

If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and send it to me first.

No, don't do that. Mahendra gets too many gifts already. Please reach out by email or LinkedIn.