Rick Snyder: How a Founder, VC and Governor is building a safer digital future

Welcome to Inside the Network. I'm Sid Trivedi.

I'm Ross Halelu.

And I am Mahendra Ramsinghani.

We've spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators, and investors building the future of cyber.

Today, in this election special episode of Inside the Network, we welcome a unique entrepreneur whose career spans multiple domains, public as well as private. Rick Snyder is the former two-term governor of Michigan and now a co-founder of a company called Sensai, which is short for sensible cyber. A visionary entrepreneur, a seasoned venture capitalist, and a transformative public servant, Governor Snyder's career is a masterclass in its depth and impact. He first rocketed to prominence as a chief operating officer of Gateway Computers, where he orchestrated a staggering tenfold growth from $600 million in revenues to over $6 billion. Managing 13,000 employees and completing a successful public offering. He then went on to co-found Ardesta, a venture fund whose name means spark in Greek. It's a fitting metaphor for Snyder's ability to ignite innovation and growth. But it was his next move that truly sets him apart. Transitioning from the boardroom to the campaign trail, Snyder ran for governor of Michigan with the unforgettable slogan, "One Tough Nerd." For two consecutive terms, he steered the state of Michigan with a laser focus on fiscal responsibility, job creation, and technology-driven progress. Now, in a full circle back to his entrepreneurial roots, Snyder has co-founded Senseye, a rapidly growing cybersecurity startup which has secured over 100 customers in its first year of operations. In full disclosure, my investment firm Secure Octane is an investor in Sellsy. As we navigate an increasingly complex digital landscape and a highly charged political climate, Governor Snyder's unique blend of technology savvy, savviness, and governance experience couldn't be more relevant. He brings unparalleled insights into this critical intersection of technology, governance, politics, and cybersecurity. With the election season upon us, there is no better person to speak about this crucial role of cybersecurity, and of course, there is no better person to speak about startups and building companies as well. Let's get started.

Welcome, Governor Snyder, to Inside the Network.

Well, Sid, it's great to be with you, and please call me Rick. I mean, I was in public service and I got called a lot of names, so Rick is a pretty positive way to represent things rather than the formal version. So let's keep it simple. It's great to be with you.

Well, I will try to— I'll just try to call you Rick in that case. We won't use any of the more complex names you've had over the years as governor. Well, Rick, we're going to go through a couple of different things, you know, in your journey. We'll start with cyber and its importance in elections, which is certainly a conversation right now in kind of the political environment. We'll talk a little bit about your journey with Sensai, your new startup, and then we'll talk broadly about entrepreneurship, fundraising, capital, and other topics. So let's start with cyber and the importance on elections, and maybe let's just start with kind of your background. Rumor has it that you are the youngest partner at a CPA firm.

Well, let me put it to you this way. I'm 66. I'm on my 5th career. And the reason why is I'm a nerd that doesn't play golf. So, what are you going to do? So, I've had a very varied career during my lifetime. I was at Coopers Lybrand in the '80s, which is now PricewaterhouseCoopers. I was a tax partner and then an M&A partner. I made partner in 6 years. That was pretty cool. In the '90s, I actually went to Gateway Computers and I was the number 2 guy there working for Ted Wait. That was a blast. That was the golden era of PCs. So we grew from 600 people to 13,000. We grew from $600 million to $6 billion in revenue. We were— became a Fortune 500 company. Just incredible. So that was a blast. And then Ted wanted to move the company to California and my family and I moved back to Michigan. So in the 2000s, I did venture capital. Not as good as you do, Sid, but I was trying. I had $200 million venture firms, largely doing the toughest work. We were doing university tech transfer for most of our engagements and trying to build an industry in Michigan. And we built some cool companies. And then around 2009 or so, looking at Michigan, it was a disaster, our state. We are 50 out of 50. So my wife called me out and challenged me to run for governor. And I ran. Uh, the interesting part, you might find this interesting, is I I would meet people that said, "Do you know if you apply the margin of error, you could be a negative number in the polling?" So I call my early supporters the Margin of Error Club, and it proves good democracy still works. I got elected for 2 terms and did that during the 2010s, and then 8 years. There are term limits in Michigan. I was out of a job, and what else do you do? You go do a startup. And cybersecurity is a passion I've had my whole life. One thing I tell people, I've been the beneficiary of amazing technology for 30, 40 years. People find it hard to believe it's been going on that long, but it has. And I view if you're going to be a beneficiary of that technology, it's important to be equally responsible about the scary things, the negative things, and that's cybersecurity. So I'm pumped up. I view it as a way to keep on giving back and to do it in a young company to help the public. Because we have a calling in our company to make small and medium-sized organizations safer. It's a good cause. We need to do more.

Rick, I was, you know, it's funny. You've had these kind of 6 different careers. And most folks after they finish their, you know, their journey as governor, they would typically go into a speaking circuit or retire. Obviously, you don't play golf but many would go and play golf. But you chose not just a path to kind of, you know, a very traditional path of going on the speaking circuit or starting some type of nonprofit or doing something that candidly would be less work. You chose a very active path, which is being a founder and going into a category like cyber, which is a category with a lot of founders and a lot of cybersecurity companies, over 4,000 from what we know at least. Why did you choose that path? I mean, you talked a little bit about your personal passion for cyber, but you could have gone and spoken about cyber at conferences instead of being a founder.

Yeah, no, I appreciate that. Well, first thing I'll tell you, uh, this goes back to starting companies and the venture capital and all those days. Starting a company is not a fully rational act. You got to be a little bit crazy. And what do I mean by that is it's about seeing something that other people don't see, because if other people saw it, it'd already be done. And when you look at cybersecurity, you're right, Sid, and, and you know this, uh, the Although you guys know this probably better than I do, there's a tremendously successful cybersecurity industry out there. The issue is, is that industry was built largely for enterprise. It was built to handle large organizations and it does it well. And how does it work is you build some incredible technology product that tends to be fairly specialized, that then these big organizations have really smart people that are cybersecurity experts or IT experts. They know how to source them, buy them, implement them, use them. And they're still getting hacked. There are about 500,000 of those organizations in the United States, big enterprises. So then the question comes, what about the 6 million small and medium-sized organizations in this country? They're largely sitting ducks that are living on borrowed time. If you look, and we've got the data to back that up, to show how risky it is out there for these organizations. Who's there to help them? So I view this as a real calling. This is a way to go help people, make them safer, and it's something that's badly needed in our nation. It's needed in the world. And so we saw something. I had some great co-founders. Let's be those crazy people and go do something about it. So what the heck, we founded Senseye, which is short for sensible cyber, to bring it to sort of— I I don't want cyber people to take it wrong, but they think of most of us like we're from Mars, that we don't speak normal language because we use all these acronyms. And our goal is to do it in plain language with regular people.

You know, I think the one thing you said about when you started this comment on startups, it reminded me of another episode we had with Marty Roche, the founder of Sourcefire, where he said, "We do these things because, not because they were easy, but because we thought they were easy." And I think that's probably the best way to put it.

No, it's true. You gotta be a, you just go for it. And this is the, this is what makes the, you know, an entrepreneur, a real entrepreneur is do you have that personality profile to persevere, not to be deterred because there's no organization. There may be a startup out there that was the perfect one that hit everything right and had everything happen, but stuff's gonna happen. And the real question is how do you respond? And I also like to say, it's, are you used to that fast-paced environment where you have to do everything from making this strategic decision to go make the copy? And a lot of people aren't suited for those kind of environments either. So I am— I love doing startup stuff. And again, I'm willing to sign up to say I'm a nerd, but I'm also a little crazy.

Yeah. Talking about stuff happening, cybersecurity is increasingly becoming more and more vital in ensuring the integrity of the elections, critical infrastructures, and public service. You pioneered an interesting partnership called the Michigan Model which was widely shared by all the states by the National Governors Association. Could you share the genesis of this innovative program?

Sure. So when I became governor, this was back in 2011, cybersecurity was not being done very much or very well by state government or by government period. And so I thought we needed to do something about it. And so we started a significant initiative. Actually, two of my co-founders in Senseye were part of that. David Behan was Chief Information Officer for the state of Michigan. And then Dave Kelly stood up and ran the Cyber Command for the Michigan State Police. So we collectively said, we wanna make Michigan the best. We wanna be that role model. And we did. And it's really cool. The National Governors Association, if you go ask the model for good state government, they'll talk about us. But it was about first, well, I should say it's 2 or 3 levels. One level was hardening the state government itself, doing all those good practices, following the National Institute of Standards and Technology cybersecurity framework. And we did that. One fun story I'll tell you is, so we started cyber awareness training and it was the famous one. David would be traveling around and he would be doing follow-up and he had found cabinet directors, people running huge departments saying, you know, they hadn't done their cyber awareness training. And so David said, "Why didn't you do it?" And they'd say, "Hey, I'm too busy." And David would say, "Well, the governor finished his." And they said, "Well, I'll get mine done." So that's the kind of culture we brought to state government. But we also went beyond state government. We went out to the industry. We went out and brought together the infrastructure companies, the utilities, all those companies in Michigan. We brought together healthcare and we brought together financial services and we brought them in councils where we could have open discussions about how we could help them be better in each one of those areas. And we actually passed a law to allow better sharing for information, 'cause these companies were worried about sharing too much with the state because of FOIA, the Freedom of Information Act. We actually made it so we didn't have to disclose everything, that if we learned something, we could be that party sharing it with other parties to get good information out. And I think that was very forward-looking. We also created something, and I'll give you the far-out one, we created the Cyber Civilian Corps. Because the question is, is if we had a massive cyberattack in the United States, would we have the resources to respond? And the answer is no. We would not have enough people to do what needed to be done. So I said, how would we handle this if it was a non-cyber incident? Well, the answer is you'd call out the National Guard. So I said, let's build a group like the National Guard that are the Citizen Cyber Warriors. So we actually created this group because— and I went to the federal government to say, can you make this part of the National Guard? They laughed at me. But can we create something to do that? So we actually created a corps of individuals and we passed a law to give them some immunity so they could work on companies in the right situations without worrying about legal liability. And we trained them up and they were so excited to help. And they're there to be called up if we had a massive cyberattack to go help other parties. Isn't that how we should act as Americans, helping one another? And it's interesting now, Congress has now sort of taken up this idea. They forgot where it came from. This goes back to 2012. But I hope eventually the federal government will figure it out and add it to be a component of the National Guard.

I think that's the classic advantage that you get when you have somebody who's been a chief operating officer of a publicly traded company and a VC stepping into the role of a governor. You're able to think about how these public-private partnerships can come together effectively. Our next question sort of leads into this balance of regulation and cybersecurity. On one side, we see the standards that NIST propagates, which are very helpful to all of us. But on the other side, we also hear in the industry that some of these regulatory overhang is punitive, it is too heavy-handed. And how can that balance be struck between not being too heavy-handed yet being efficient? In fact, I remember when your first term was in progress, you had announced over 100 different outdated laws that were affecting the industry that needed to be cleaned up. So if you had a whiteboard and you had to strike the right balance, what are some things you, you would recommend that should be done?

Yeah, great question, Mahendra. And we did. We got rid of over 2,000 regulations. And we do need to do more in our country. We all know that on this call. So what I would suggest is, is the NIST program of coming up with standards is a good idea. Requiring things to be done is not a great idea generally. And I'll give you a great illustration in another context. The first bill I signed as governor was called MEAP. How's that for another acronym? It was the Michigan Environmental Assurance Program. And what it was, was for the farmers in Michigan. And if you want to get a group of farmers mad, tell them you're going to regulate them. Same thing with a bunch of cyber entrepreneurs or IT entrepreneurs. You're going to get them mad if you try to regulate them. But what we did is we came up with a set of voluntary standards that we could certify them on, and then they could use that in their marketing and go tell people about how they'd met certain standards. And the farmers loved it. Again, we didn't have to— force them. They wanted to do it because they knew there— these were better practices, these were good smart things to do. And if you drive around Michigan, you'll actually see a whole bunch of signs that are these MEEP signs saying they've been certified in this area, certified in that area. So this is a problem with government, is too often their attitude is we got to prescribe things for people, we got to tell them what to do, rather than saying how can we come up with common sense standards and get more people to help one another achieve those goals. So I think there's a much better positive path to say, let's get on board and do it for the right reasons and let people take credit for doing good things that are helping others and helping make themselves safer.

Rick, when you're talking about the things you did, it surely sounds like it's easy to get different parts of the government to talk to one another and to work together. But we also know that that's not quite true. So I'm curious, what would you say the startup founders need to know about partnering and working with the government in order for them to be be successful at what they're trying to do?

Uh, the first thing you have to do is sort of put yourself in their shoes. Again, you're, you're talking a big cultural gulf there. And the illustration I'll give you is I mentioned how I did venture capital and I was doing university tech transfer deals, and that's really tough. And one of the reasons a lot of deals never happened is you had like fast-moving entrepreneurial people ready to go, and then you go talk to an attorney at a university And I can tell you that a lot of times us fast-moving entrepreneurs coming in to talk to this university attorney would say something that was so offensive to that university attorney, you would show up on the bottom of their stack fairly quickly. And you'd never knew what you said that was wrong rather than putting yourself in their seat and coming up with a mutual way to benefit, to come out ahead of doing that. And understand where they're coming from. So, the same thing's true of any situation of put yourself in the position of the person you're trying to interact with and look for that win-win. If you get on that parameter where they view it as a win-lose, you know, you're in trouble, particularly if it's a government regulator. So, my model is always what's the win-win because that's building a relationship. If you have a win-lose, that's a transaction that's not sustainable and And working with the government, you may not even have a transaction or get out of the gate.

Rick, obviously this is a unique time period. We have a, a very big election season, and certainly on November 5th here in the United States, citizens will go out and vote. You, you've held public office, you have a perspective, and we talked a little bit about the Michigan model. But just for the public, how concerned should the public be about the likelihood of nation-state threat actors trying to influence the elections using cybersecurity? And broadly, how concerned should the public be about the potential for cyber warfare, which is very different to kind of like a hacker coming in and stealing a little bit of money here and there?

Yeah, we should be concerned. It is a real issue. It's not something to be paranoid about, but we do need to do more and we need to be thoughtful about it. Generally, our election system is very good, very safe. The last election was very good and very safe, regardless of what anybody says. One thing that really makes it work is the distributed nature of the system. It is very distributed. I mean, you're talking down to precincts, or talking about townships or counties or villages that are independent of one another, that you can do a good job. That also presents the challenge though. Because they don't understand cybersecurity. So that's where we need to work together to make sure they have some good practices. But to do wide-scale stuff would be extremely difficult from a cybersecurity attack side. And you're right, Sid, it's not going to come from the cyber criminals. It's a nation-state issue.

If you—

and I actually have talked about this before, I wrote a piece once— if you are actually going to do a cyber attack in the most efficient fashion as a bad nation state looking at us is what you should do is go find 2 or 3 of the swing precincts or communities. You would go to Michigan, Pennsylvania, Georgia, you know, like in those elections where, you know, the election's getting decided in these places, and you would specifically target them and mess with their results and try to get that out. You would actually publicize the fact that you messed with them, because then you would create this creeping thing to say all the other ones are okay, but the ones, the swing ones that decide the election are biased. That's the greatest threat from a pure cybersecurity point of view. So what I would say, again, we can't do every place in the country. We should prioritize those swing places as the places that deserve the greatest attention and need the greatest amount of help because, again, they don't have the resources on their own. So I would focus in on that. From a cybersecurity side. The bigger issue in our elections is not pure cybersecurity, it's misinformation. And that's what we're seeing today. And that is a really scary thing. The amount of misinformation, you know, is not what we really do as cyber people, but if people ask me what's my greatest concern or threat to elections, it's misinformation more than a cyber hack at this point. But again, I would go back and try to figure out those swing districts and do whatever else more we could help them.

There are indeed many problems when it comes to cybersecurity. And the good news is that despite everything that we are hearing on a daily basis about, you know, the elections and the cybersecurity around the elections, there are many entrepreneurs working very hard on trying to solve a lot of the problems we are discussing here. And one of the companies we get to talk about today is the company you are leading, is Senseye. Senseye provides a FICO-like score to measure the company's cybersecurity health. Tell us more about this approach. We know that cyber threats are constantly evolving, and given that, how does the score adapt? And why do you believe the business owner should start caring?

Yeah, thank you for asking, Ross. I'm very proud of how we created the Senseye score because it's easily understandable and it's based on the best framework. It's based on NIST. So one of my co-founders, Dave Kelly, uh, actually went through the framework and broke it down into bite-sized chunks to say, uh, let's make these into a questionnaire. So we have 39 questions, collects over 100 and some data points, but to make it really work, we build an algorithm to go with that. We assign points to each one of those items and we did it based on our experiences. So that's where our know-how came in. So for example, you get more points for cyber awareness training than for, you know, how you do a backup. So we assign these points and to make it understandable, we build it on a 1,000-point scale and we made it like a credit score. So like you said, so the way I describe it is if you're 800 or better, we tell people you're in the safer zone. If you're 600 to 800, you're in the improving range. If you're below 600, you're on borrowed time, you're in the red zone. And I usually say you have 3 main choices. You can stream Star Wars: Learn the Force, you can go to religious services, or you can get help from somebody like us or get help because you need help. So the wild part of that is, is we originally did that. The Senseye score was created as part of our normal solution. We do a wraparound service for an annual subscription for our clients. And to start that process, we were doing the score and then building a health plan. The score is so cool, we broke it out and said, we'll do a score for anyone for free. So you can go to the Sensii website and do a score unguided if you'd like, if you knew enough. We prefer to do guided because a lot of times people don't even understand all the questions. But we've collected several hundred scores and did a report about that. So to give you an idea, after doing hundreds of scores, so this is statistically significant for the United States, for organizations, The average score was 488. That's scary. It's interesting. Our average client score was 333 because we had clients that knew they needed help. But only 5— only about 6% of companies are 800+. 25% are between 600 and 800. Almost 70%, 69% are below 600. The United States is in serious trouble.

And on this topic, I mean, obviously you publish these survey results. What were the top cyber challenges for businesses and what were some of the misconceptions that have continued to prevail?

Yeah, the issue is, is the missing pieces are fairly pervasive. I mean, a lot of these are actually back to the basics. I mean, passwords, complex passwords, multifactor authentication are missing from these organizations. One of the ones that scare me the most And it's more on the response and recovery side, but it really illustrates the point because we do a lot, you know, on the detection, prevention, identify side. But the lack of incident response plans is really scary. I mean, it's in the 60-some percent range of organizations that don't have an incident response plan. And let me tell you, the way I go to people, I say, okay, do you have a fire evacuation plan in your business? Yes. If you're, the central part, the Midwestern part, do you have a tornado plan, sheltering plan? If you're, unfortunately, it's terrible what Helene and all this, do you have a hurricane plan? Yes. And then I'll say, do you have an incident response plan for a cyber attack? Huh? And then you like to ask people, what's the most likely of those three things to happen? It's the cyber attack. And then it's easy to point out to 'em, and again, I always question the data to some degree, but I'll use the general industry norm. Is if you don't have an incident response plan, you're down for 22 days. If you have a good incident response plan, you'll be back up within 1, 2, or 3 days. What a difference. I mean, what's going to happen to your business in those 3 weeks? I mean, you may not be in business still. So this goes to the point about how poorly prepared we are and why we need to help one another.

Governor Vanu started since I—

I thought it was Rick Nelma. You're going back to governor.

Sorry, sorry. You know, Larry lived in Michigan. Once a governor, always a governor. I have to somehow snap that synapse in my brain, but I'll try. Let me try again. Rick, when you started Sensai, you had this notion of RPA, you know, which was, I thought, was very refreshing. Maybe you can define what RPA means for our audience, and then I have a follow-up question which I'll come to that.

Yeah, so RPA actually goes back to when I became governor because I have this attitude, this positive attitude about solving problems. And people would keep on bugging me, what's this all about? You don't criticize anyone. You're not calling anyone names. You're not blaming anyone else. You, you're just out working, trying to solve a problem. And so I didn't know what to do. So being an accountant, I did the best marketing I could. I came up with a name for it. And the name I came up with was Relentless Positive Action. So what is Relentless Positive Action? It's no blame, no credit. What's the problem? What's the solution? And be relentless in pursuit of solutions, which in the government context was really important because you don't get everything you want. A lot of it's compromise negotiation. And I view it as, yeah, be happy if you got 50% of what you're shooting for because you can go work on the next 50% next time.

In fact, I do remember during your second term, there was a televised debate you had with one of the lead candidates who was competing for the governorship. And during that entire debate, you never put any blame. And after that televised debate was over, I remember a lot of us saying, that is a model debate, or at least how a model candidate should behave. Of course, things have gone a very, very different direction over the years. But using relentless positive action and cybersecurity, which the industry uses this other acronym called FUD. If you talk to the CISOs or the buyers, Most of the salespeople practitioners try to use fear, uncertainty, or doubt. And the CISOs are constantly in this state of mind of what's the next thing that's going to happen to me? This product salesperson is using all kinds of pressure tactics. Speak to us about the culture and how this cultural shift needs to occur.

Yeah, because a lot of it is too often people look at cybersecurity as a binary proposition. It's like, you'll buy this whole suite of packages and you'll be safe. And if you don't buy this, you're unsafe. No one is safe. I clear that up with people right out of the gate. Anybody that uses the word safe in a sales pitch or any context for cybersecurity is full of it. You can be safer. And using Relentless Positive Action to say is, overnight, you're not going to be able to do all the things you should. So I'll go back to our score. If you have a score of 333, you don't flip a switch and you're at 1,000. The question is, what are the most important things you do next to be safer? And how do you approach that in a fashion that's reasonable, rational, aggressive? Because again, you don't want to be passive about this, but how do you start moving in the right direction? And every step you take, you're going to be safer by doing additional activities on that path. So get on the path to being better off. I tell people too often people think about cybersecurity as a technology issue. It is not. Technology is critical, important to it. But I say the number one priority when I talk to someone, I'm trying to get them to go from a passive or a non-culture to an active cybersecurity culture. If you have an active cybersecurity culture, you're on the path to being safer. And what I tell people, I understand it's not the only day cybersecurity for most people. We're not normal people. We're a little weird. We're in the cyber world. World here is the day you get hacked, and then it's going to consume your life. So I said, I never want it to be your top priority, but it needs to be a priority where you're actively working on being safer. That's RPA.

I want to move things from, from Sensai and talk a little bit about entrepreneurship in more general terms. And you flagged how you've had this wide array of experiences, these kind of 6 careers across both the private sector and the public sector. You've been a founder, you've been a VC, you've been a CEO of a multi-billion-dollar public company, you've been governor. What advice do you have for younger founders who are starting this journey, and particularly starting it during a complex time in the world? I mean, there's just so many things going on. There's the macroeconomic situation, there's geopolitical unrest, there's obviously civil unrest that we have. In the country. What advice do you have just broadly for founders on how to navigate the environment?

Yeah, I'd give them 3 things. First, recognize it's a team sport. And it's always interesting to me that when you go to universities and colleges, they talk about their entrepreneurship programs. And I think a lot of them are mistargeted. Um, and what do I mean by that? They get caught up in this sole founder thing. That there's this personality that— and again, it's wonderful to have that and it does work. But if you look at all those situations, typically there's a few other people that are with them that don't get the credit the same way, don't get the attention. People don't recognize them, but it wouldn't happen without them. So it's teamwork to find the right team of— because everyone— well, not everyone recognizes it, but you have a certain skill set. You need those complementary skills. In a startup in all the different areas to be successful usually. So teamwork's the first thing. The second one is the planning model. I don't believe in traditional planning. My model's vision, engage, adjust, accelerate. If you do traditional planning, you're gonna die of old age before you get it implemented. So it's a common sense vision and you go, you engage and learn about what's going on in the real world. Of pilots, you know, beta customers, alpha customers, find out what's really going on. And after you have some experience, stop and adjust to what that real-world experience is. And that, again, if I ask each one of you, how often have you seen an early business model shift once they've actually started doing this alpha beta stuff and learned that we thought the market was here, but to make it work, we had to step back and move it to the right or the left or up or down. And then once you have that, then you accelerate, then you go. So that's the other thing. The third thing is, and people underestimate this, and no offense, you guys are great capitalists, uh, getting the capital is critical, but they tend to underestimate the first customer. And it's about showing real commercial use of what you're doing. So when I do economic development program, I have been doing economic development for a long time. Uh, we had to strengthen the capital network in Michigan, but we did a really cool program called Pure Michigan Business Connect. And what we did is we went to the big companies in Michigan and said, can we get you to change how you're doing things instead of doing your normal procurement process that a young startup never could adapt to? And you'd never give them the time of day and figure out how to put it in easy terms and give them a shot at doing that work. And We didn't have to pay them a lot of money. I mean, they understood the principle and they did it. And literally it led to billions of dollars of extra sales in Michigan. But it was that first customer for a lot of young companies. Because once you have that, then it's easy, much easier for you guys to decide to invest in someone if they can see, you know, you've proven it out with this customer and it's a reputable one and you want to go.

Yes, Rick, getting that first customer is definitely a critical milestone. In fact, probably much more critical than even raising capital. And yet fundraising is still incredibly important. You have been a VC yourself and now back on the other side of the table raising, uh, capital for a startup. How has the experience been for you, and what advice would you—

is it happy hour yet? Are there cocktails now available for this discussion?

Not yet, not yet.

So No, you're on the other side of the world and it's a challenging world and you got to get used to being told no. I mean, that's part of defining an entrepreneur. A lot of people would quit. So, if you're going to go out and do this, you got to assume you're going to get 20, 30, 40 nos from getting that first yes and be ready for that and learn from getting those nos. Every time somebody tells you that, you're going to learn something about what they think of your business model and how you need to adapt that. So it is a challenge. One of the jokes, given my history, is a lot of times when I was doing venture, I ended up becoming chair of the board. And the reason was I wasn't smarter than anybody else, but since I'd been on the founder side and I was on the VC side, I could do universal interpretation, you know, like that translator thing. Because if you think about it, the founder CEO generally took the money but didn't love their VCs very much. And didn't like the fact they had people coming in telling them what to do. At least in their perception, they were being told what to do. And if you're the venture capitalist, you're going there that I'm giving this person really good advice. I've done this 10 times and they're not listening to me. And it's very frustrating. And it was like, here's the steps you need to take. We know how to build companies. We know how to do all this. We know how to hopefully make you wealthy if we work together. And it's like they're going, this guy's driving me nuts, or this woman's driving me nuts because they're not listening. So, I found it really valuable having been on both sides that I could go to one side or the other and say, let's just notch it back a couple steps. Let's step back a little bit. And now let me explain to you what it looks like from their side. And understand, it's back to that earlier point about how do you do the win-win? And how do you learn to give trust to people? How do you initially learn to give trust? Because the only way you build trust is by giving trust that's got reciprocity to it, that's given back. So when you're doing this board thing or you're doing this dance, it's like, don't think about win-loses. It's like, I'm not trying to get the best terms for my VC because I don't want them— they gotta win too. And vice versa. It's like, if I'm negotiating with this founder, I don't wanna squeeze 'em so hard that they feel they're gonna lose. That's a bad answer. So how do you come up with win-wins? And then how do you build this trust relationship? Because once you build that, then things go a lot more smoothly.

Yes. And Rick, having been on both sides, what advice would you have for the investment community?

Try to find old guys like me. They have been around because a lot of cases it's like people just lack the experience and again, the temperament to understand people mean well. I mean, any time I work with anyone, I don't assume somebody is a bad person. I mean, there are some bad people out there, but you sort through them pretty quick. And learn to have the experience and maturity to just not overreact too quickly and to listen and learn and be better for it in terms of going through that process. One quick story I'll share with you from the VC side, when I always did it, we literally, because we were working with university professors, I would literally give them a list of the best attorneys in town in the area that they were in to represent them because my nightmare doing a deal was for the person on the other side to have a crummy attorney. I mean, somebody that didn't know how to deal, that didn't understand things, because the problem was, is that was their trusted person. And if they're getting bad advice, there's nothing I can do about it. So they always wondered, why would I do that? It's like, no, I want you to have somebody really smart, really good, really experienced on the other side, because they're going to help you navigate through this and things are going to go a lot better.

One of the things you talked about, Rick, was going through challenging times, how you take 20, 30, 40 nos from every investor as you raise capital. Now, if you widen the aperture in your career as chief operating officer of a publicly traded company, in your role as two-term role as governor, you know, as a VC, there have been lots of ups and downs. I remember once when I visited your office, I saw some shiny stones that were kept along the ledge. And you talked about how you use that as one of your techniques to disengage. Talk to us about some of your techniques of building your emotional resilience that our audience would care about.

Yeah, so I'll give you a couple illustrations. When I was at Gateway, we actually had an activist hedge fund come after us for seats on the board and everything else. That was stressful. The cool part is you can actually go do a— do a web search, you'll find the activist investor joined our board. And today he'll talk about how good it was and how well we worked together, because that goes back to win-wins and building trust. He didn't know everything going on in the company. Once we got him in, I could explain more to him and we worked things out, and he was a value-add in terms of that process. When I was governor, my honeymoon ended my first budget. We had a multi-billion dollar deficit in our state. So I had to come out with a budget that cut a lot of people. I had hundreds, thousands of people out on the yard by the Capitol calling me names. That's why Rick is a pretty good choice these days. And so I had a lot of protests, but always what helped me get through that was understanding that's free speech. They have the right to do that. There are hundreds or thousands, but I represent 10 million people and they're representing their interests. I'm here to represent all those people. So you had to put it back in the big picture. So in the startup context, the other thing I would say, and we talked a little bit about it, is when you run into that wall, when you run into that challenge or you're all stressed out, don't just keep walking into the wall. I always recommend people take a couple steps back and change the focal point, broaden your base in the focal point and look at it. And you may see an open door there that you didn't see because you were so busy walking into the wall. The last one I'll give you is a test I've shared with my kids. I call it the 5-year rule. And what's the 5-year rule? Is to think about life in 5 years and ask yourself the question, how material is this in my life 5 years from now? Not today. And almost anything you deal with will be in a much better perspective. It may look terrible today. You may think your life is over, but in the big picture, 5 years from now, it's like, did you eat crow? Did you have a mess? Did you mess up? Did something go wrong? But 5 years later, hopefully you're bigger, better, and stronger for it, and you've learned something.

One of the interesting dimensions of your startup journey as a CEO has been the fact that you're now on the public affairs advisory board of a $100 billion company called Palo Alto Networks. So these are wide spectrums. On one side, you have a startup. On another side, you have a very large company. How do you navigate this kind of a spectrum and what are some win-wins that you can develop in this kind of a scenario?

Yeah, well, the cool part is I'm a nerd. I love to learn about everything. So it actually complements one another because again, they're vastly different and we're in vastly different markets. We don't really compete. They're enterprise, we're small and medium-sized organizations, but we have a common interest: cybersecurity and how to communicate that. 'Cause again, I sort of mentioned that early on, is to most of the world, we're weird people. We're aliens. We're like from Mars. We speak a strange language. We use acronyms. It's tough to understand stuff. But by working with them, how can we make people safer? That's the point to never forget. Again, what's the vision? And the vision is a safer world. They're a huge success story. They've done tremendously well at it. I'm hoping I can give them good insight on how they can particularly do that in the public sector. So it's an honor to work with them. And then at the same time, I'm hearing how they're handling these huge issues, where, how artificial intelligence is affecting things, how all these other highly sophisticated things are, where back in Sensye, we're hoping to get somebody not to reuse a password in many cases. So they sort of complement one another. And I think that's how you'd be better and stronger is by broadening your portfolio.

As we wrap things up, Rick, you've talked a lot about advice for founders, advice for VCs, general advice for the public. What advice do you have for the cyber industry? And if there's one thing you could change, what would that be?

I think it's working hard to communicate to real people more effectively and to get the concept about we're not trying to terrify you. But you can't ignore this. And we're not trying to tell you this should dominate your life because it shouldn't. It shouldn't be your top priority. But if you don't put it on your list, if you don't do something about it, you're at real risk. And sooner or later you're going to get hit. And we don't want to see that happen. The second part of that is once you define that to them, we also need to work harder about giving them a rational path to get through it. And again, this is simple steps. That's where the Senseye score is cool because we can sort of say, yeah, start with some policies, start with cyber awareness training, start with doing this or that. You don't have to do everything to be all the safer package day one. But let's get you taking, you know, steps towards that path because once they see the value of that, it works.

Artificial intelligence seems to be everywhere. How do you see the future of cyber shaping up?

Yeah, AI is the most hyped term known to man currently. The cool part is being a proud nerd, I have to share, this is where I'm a proud nerd, is I was going into places talking about AI 10 years ago and I did it on purpose because I thought people, I just want to see their reaction and they go, wow, that sounds really cool. They didn't even know it meant artificial intelligence back then. Now most people have figured that out, but there's a huge hype bubble that's going on. But there's huge substance to artificial intelligence. So it's that normal adoption wave. It's overreaching. It will clear out. But things are really going to change because of artificial intelligence. In the cyber context, I describe it as an arms race. The bad guys and the good guys are both going to use it. The bad guys in some ways have an advantage because they're going to go on offense first while we're figuring out defense. But we need to both be participating in it. The easiest illustrations is for them to write a cool phishing email used to be hard. It was broken English. It didn't make sense. Now it's like you think you're in Shakespeare or something if they wanted to make it sound like that. So that's a real problem. But to give you an illustration how we're using it in Senseye, we just launched our first AI tool, which is to basically help do cyber alerts to our clients. We've inventoried their systems. It's all these zero-day events and the threat feeds have all the scary stuff going on. We were trying to use humans to match it all up and then send them remediation steps. We now have an AI tool we built with another young startup partner to basically look at the threat feeds, look at our inventory of our clients, match them up, and then go to the remediation database, pull that in and put it all together and then still have a human review it because AI does screw up and get it out. So that's going to make us much more efficient in helping make our clients safer. So both sides need to be using it and it will— it is an arms race.

So, Rick, if you had to do this all over again, you've been a founder, an investor, VC, and a governor. If you had to pick one of those three, which one would you pick?

Well, what I'd say, Henry, I'd give you two answers. And the reason is, is I became— I was a much better governor because I'd done those other roles. Because too often political people spend their whole life in politics. And I think I had a chance to learn about where most people are coming from, what it takes to run a business, what it takes to start a business. That was a huge advantage. And I understand basic economics. That helps a lot too. So, but what if you gave me a choice today? I'm having fun being a founder, but public service would probably be the one that stands out the most. And the reason is, is I had an opportunity to help 10 million people that are my friends, families, people around me. And that's a special thing. That you have an opportunity just to go help people. But Senseye is among about as close to that as you get, because we talked about what small and medium-sized organizations are doing, are not doing in cyber. And I got a company making people safer.

You know, with 6 million businesses and average of, let's assume, 10 employees per business, you know, that's a wide net that they're casting up from 10 million to 50, 60 million possibly. So Thank you, Governor, Rick. I can't help myself. See, in closing, we have had several guests. They come from backgrounds that are largely serial entrepreneurs. Our audience tends to learn from them and how they build good startups. This is our first and probably the last guest that has such a wide range of experience in startups, in venture capital, you know, two separate funds that you ran of $100 million each, probably had a portfolio of maybe 40, 50 companies that you managed very successfully, and then a two-term governor. So thank you for your years of service, uh, your wisdom and experience that you've shared with us today. I'm sure our audience will benefit tremendously. Thank you.

Thank you.

Thank you for joining us Inside the Network.

If you like this episode, please leave us a review and share it with others.

If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and send it to me first.

No, don't do that. Mahendra gets too many gifts already. Please reach out by email or LinkedIn.