Rob Lee: Building Dragos into a multi-billion-dollar mission-driven cybersecurity company

Welcome to Inside the Network. I'm Sid Trivedi.

I am Ross Haleduk.

And I am Mahendra Ramasinghani. We have spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators, and investors Building the future of cyber.

We will talk about the hard parts of the founder journey, launching companies, getting to product market fit, raising capital, and scaling to an exit.

And yes, we will also be talking about epic failures.

But Mahendra, we're here to make the founder journey easier.

That is correct, Sid, but we cannot make it too much easier because startups are hard. And of course, you already knew that.

All right, you two, enough. Let's get started with this video. Episode.

Every morning you flip a switch, the lights come on. Turn on your kitchen faucet and water flows. Gas pipelines. Invisible to most of us is a technology layer that controls utilities and such critical systems. Operational technology, or OT, the systems that control the physical world. These are not routers and servers, but PLCs, programmable logic controllers, that run on protocols such as Modbus, not TCP/IP. When these systems were designed, they were not connected to the internet and hence not considered to be vulnerable targets. Access control, authentication, encryption, all of these were luxuries in this domain. That has changed. Today, utility grids are imminently hackable. Ukraine, Venezuela, Stuxnet, Colonial Pipeline, the list goes on. The big difference is this: hack an email server, you lose data. But if you hack an operational technology system, it impacts people's lives. IT security may be a business problem, but OT security is a public safety problem. It is a nation-state problem. This is the new frontier of warfare, and one company is leading the charge in building and protecting critical infrastructure: Dragos. When founder Rob Lee saw this opportunity a decade ago, the market did not have a name for this category. He took over 100 rejections from the best VCs in Silicon Valley. No one thought this was a real problem. But Rob went on to raise over $400 million anyway, built a unicorn, and kept growing steadily. There is much more in this episode than just building a company, raising capital, or making money. It is a story about a founder who brings a sense of purpose, duty, and most importantly, a sense of service. A founder who is not chasing vanity metrics nor exits but wants Dragoz to keep building for the next 100 years because the infrastructure Dragoz protects is not going anywhere and neither are the hackers trying to take it down.

Welcome, Rob, to Inside the Network.

Thanks. Thanks for having me.

We're going to talk about a whole bunch of different things today, but we want to start from the very beginning. From your time at the Academy and then moving to the agency. Yeah, we're going to go very early first.

This is like, this is one of those like, uh, Hot Ones interviews or something. Okay.

All right.

Yeah. You, you just weren't prepared.

That was the problem.

This is what happens when I don't read the questions.

You graduated from the U.S. Air Force Academy and you joined the Air Force as a Cyber Warfare Operations Officer. And you were also tasked with the NSA there. What got you excited about cybersecurity? I mean, it's not an obvious area within the Air Force. And what did you learn in that time?

You're just starting off demotivational. The whole thing, like, it's, it's basically I didn't want to be a pilot. That, that's, that's the story. Like, it wasn't like I was like super into cyber and tech and I was a computer science guy. That's— no, I, I studied African studies and like I spent my time doing humanitarian work and like building control systems in places like Cameroon and getting excited about like what power and water does. Was. And my parents were 25-year, you know, CMAS sergeants. They were enlisted in the Air Force 25 years. And I didn't like pilots. And I've met nice pilots since then, but growing up to see some like 23 or 24-year-old talking down to your father, you're like, all right, dude, I'm good without these people. And, uh, they'd sent me to South Korea to fly in a two-seater F-16 to like show me. They're like, see? Yeah, yeah, okay. I was like, what? They're like, it's, it's great, isn't it? I was like, Yeah, no, I like planes. I don't like pilots. And they're like, all right, well you're out. Uh, and they're like, well, what do you wanna do? And I was like, go back to Africa. And they were like, uh, this is like, uh, we comm, you could be communications. We get you to Africa. I was like, yeah, cool. Okay. And then like en route they switched it to cyber. And so I was one of the first cyber officers. Uh, and they sent me to a 6-month schoolhouse, taught me all this stuff. And I was like, what about all the control systems? They're like, what are control systems? I'm like, oh man, that's, a lot of it. And then, yeah, so I ended up doing all right. They kicked me off. They said, you want to go to the White House? This would be good for you. All right. You're like, go do stuff for the president, help your career. And I was like, what's my other option? They're like, Germany. I'm like, I'm going to be a drunk in Germany. They're like, but what? Hold on, the White House. Like, this is really good for you. I'm like, drunk in Germany. That sounds great. And so, and also they had Africa Command there. And so I was like super interested in that. And I got there and I was basically an intelligence squadron that nobody ever heard of before. And then Had a commander there that was like, what do you know about control systems? And I was like, uh, a little bit. And they're like, you should go over to this other place called the NSA. And this is all like pre-Snowden. I was like, what's the NSA, dad? You know, like one of those things. And they're like, just go in the corner. I'm like, all right. And so yeah, I had a good, had a good time. I walked in, they said, uh, go find the unknown unknowns. I was like, what is that? And they're like, I don't know, but Rumsfeld's really big into it. I'm like, all right, cool. We're, we're gonna go hunt in control system networks. And, uh, yeah, I ended up building out the, the government's mission on that stuff and it was cool. It was fun.

And on that topic, were there things you learned about the minds of these hackers through that role on the offensive side? Like, what did you learn in those early days? Obviously you've learned a lot since then, but—

Yeah, I mean, so NSA, we didn't do offense, right? So I did intelligence operations and defensive work, but I did get onto the offensive side of the house eventually anyways. Um, somebody else's APT, I think we called it like free unsolicited penetration testing of foreign government assets. But, uh, it was good. I think a couple things, right? Like understanding the tradecraft, understanding how things work behind the scenes is, is always interesting. I think there's a lot of things cybersecurity defenders will say of like, well, here's why the adversary is doing that. Like, oh God, that's not why. Um, and so that's useful context. You know, it's, it's also just kind of humbling anyways, where some of the stuff isn't that mysterious. Some of that stuff's not that hard. You also realize that like everybody's got a job, healthcare, childcare, everything else. So like your APT who's super interesting, like they're, they're still getting yelled at at least twice a day by somebody. They get PowerPoint management too, and they gotta get home by 5:30. You know, there's all sorts of stuff that just humanizes them. And then you just start looking for the human elements in the cyber operations more. And I, and I find that to be, um, super interesting in terms of what I would do in the private sector outside the industrial control system stuff. Obviously I built the Cyber Threat Intelligence course at SANS and taught a lot of people on that kind of stuff. Bringing that human flavor to CTI was something that I felt I could do better because I was on the offense.

Rob, as you've just mentioned, you studied African studies, not exactly computer science. And then you taught yourself ICS security when literally nobody else in the intelligence community was studying it. You also wrote an award-winning article, The Failing of Air Force Cyber.

What are you guys doing your research? What did I just walk into? All right. All right. All right. Go ahead. Sorry, man.

So you've essentially, you've publicly criticized your own institution's approach to the career path in security. What advice, obviously please do talk towards it, but also what advice would you give to a founder who sees a massive problem inside their organization or the industry, but is really afraid to speak up thinking that their career will end before it even begins?

Yeah, I mean, probably shouldn't take any advice from a kid from Alabama that studied African studies, but what I would say is this, so I've always, so on this, on the failing of Air Force cyber thing, I was watching my NSA operators, junior enlisted guys and gals and others, and just really amazing people, um, be exploit developers and signals intelligence officers and all this fun stuff. And then the Air Force would be like, cyber, you can go do other cyber stuff, like patching servers at the INOSC. And I'm like, patching? Like, this is like, this guy's like one of the best exploit developers I've ever seen. And you think like cyber's just cyber. And they're like, yeah, it's cyber. It's a cyber field. I'm like, cool. So I just need a pilot, right? It doesn't matter. B-52, F-15, whatever.

Just a pilot.

You got, you can know, you know how wind works, like lift, not lift, stick go down, stick go up, trees big, trees small, right? This is okay. And it was just very obvious the level of hypocrisy they were applying to specialization of other fields versus ours. Uh, and I was tired. I look at most of my success at Dragos and everywhere else that brought me here was I got pissed off at something and then went and channel that anger. And so I, I got pissed off watching my guys get abused and having their careers ruined over a pilot who didn't know anything about our field, thinking that they were in charge because they flew. Um, and so I, yeah, I wrote it publicly, um, which no one told me not to, for the record. Like, there was— wasn't that kind of advice back then. And it was funny because the background context was that 3-star general who's in charge— I'm sure he's a nice guy, right? I never met him, but Uh, the 3-star general that was in charge was talking to the chief of staff of the Air Force, the 4-star, and it was a Corona, all the generals were around. And, uh, General, I know it was General Welsh, the 4-star, was like, all right, so then you wanna make this change, right? About like, um, making it where they're all just cyber people, right? And he's like, yes sir, yes sir. And he's like, do you, do you think the, do you think your, your guys agree with you? And he's like, oh yeah, absolutely. I've got support of the force and everything. And he threw out a printed copy of my article to the 3-star and was like, Lieutenant Lee doesn't agree. And so that was, he was very upset at me. And he tried to ruin my career over, but luckily like my intelligence tribe took care of me. Otherwise that would've been rough in life. So he tried everything he could do to ruin me. Years later, he tried to join a board of directors at a power company and they called me and I was like, nah, I wouldn't take him. So it was fun. Anyways, look, obviously speak out, but be damn sure you're right or have enough humility to cage where you might not be right and say, hey, here's an idea I have and we gotta talk about it. But if you're gonna assert that you are right, better be able to back it up. And if not, take the price for it, that's fine. And so I've never felt shy in speaking out. I don't think anyone in the world has ever had to wonder my opinion. And so I don't have any problem with that, but I'm always trying to be empathetic to everybody else's and also understand that there's competing ideas and I want that. And if you're wrong, just say you're wrong. It's better to be wrong than mistaken, you know?

So Rob, speaking of three-star generals and your outspokenness, Uh, you know, how did the transition from an agency like NSA, uh, occur to a startup world? Now, very different worlds. Uh, one is very structured, very rigid, and, you know, the 3-star generals will not like it if you sneeze in the wrong direction.

Yeah.

To this other side where, you know, you're literally, uh, in charge of everything.

Yeah.

So I, I definitely learned a lot by having good investors. Operators and investors who've been operators and learning from the business and just trying to always soak it up, right? It's curiosity.

I mean, come on, Rob, you don't have to sit yet on your cap table.

How can you say that? No, no, no, no, no. Let me, for that matter. I tried, I tried to get set on my cap table like 3 times. Even once when I was like, dude, you don't even deserve this anymore. Like, I just like you. Anyway, so I think it was his IC that got in the way. Maybe that's the answer. Um, you know, behind the scenes he's telling him, don't do this. But anyways, um, so I've always tried to treat anything that's worth doing is worth being curious about, like all the way through. So if you're gonna do cybersecurity, like go build your own industrial control system labs and everything, teach yourself. Gonna do venture, learn all the elements of the business, learn GAAP revenue accounting, learn all that stuff, right? Let's just, just learn your business. Um, but I, I did find it interesting on the leadership thing where it was different aspects, right? So I'd have like, I'd have investors come to me that didn't make it on the cap table. They'd be like, oh, I mean, it's a big thing to like lead a team. And I was like, yeah, we got like 10 people. And they're like, yeah, but is that weight crushing? I was like, I had like 100 and something in the military and we're doing combat operations. Like, I'll be all right. They're like, is anybody gonna die? And they're like, no. I'm like, well, cool, cool. We'll be all right. I might lose you some money, but nobody's dying. We're good. And so there was definitely aspects of the military that was helpful for just confidence and a lot of the, did you know, you know, leaders should go last, leaders eat last. And so I was like, guys, that's like 101 military training. So it was, there was some of the stuff that was very useful, but then there's, to your point, there's walking out and going, I've got really interesting experience, but it probably doesn't all copy and paste. So let me learn the problem first and then bring in the experience that's relevant instead of thinking that my experience is immediately relevant. And I find a lot of parallels with that with IT and OT security as well, where there's actually some really great things that IT security can do in OT. But if you don't pause, stop, ask a couple questions and figure out the problem first, then you're going to apply the wrong lessons learned. And so I thought that was good. And the NSA, when I was there pre-Snowden, and I was, I was there through Snowden era as well, but pre-Snowden, you could do all sorts of things. Like, I remember walking in as a young kid and they were like, here's the signals intelligence network. And I'm like, what's the limitations? They're like, physics. And I was like, okay. And so I had access to everything. I don't think you get that anymore, but back then it was an amazing learning laboratory to just see how everything worked, which was awesome.

So what was the hardest thing though, Rob, when you look at your first year as a startup? There must be some struggles that kept you up at night. Talk to us about those.

Yeah, so there's always struggles, but also remember most founders are psychopaths, right? So like, if you think about it, they are. It's, I alone see this problem. You know, I alone can solve this problem. Like I can take on giant companies. Like there's something probably broken. But Uh, I think that's required. As long as you're humble about it, it's a bit required. And there's a lot of difficult things. You know, it's very difficult to go and resonate with people and talk about an idea and get the buy-in and not get to the finish. I was very comfortable with somebody being like, you're an idiot, you're wrong, OT security is not a thing. I was like, all right, I'm gonna show you. That was fun. It was difficult to date Sid for a while, or the Martin Cascados of the world and everybody else and like jive with people and be like, oh man, I could go on a journey with this guy. Like this could be fun. And then, oh, nope, sorry. Uh, uh, who was it? What's, what's the guy's name? Andreessen. He like, he got mad at me 'cause of something I said in a meeting and he blocked me on Twitter. I'm like, what the fuck? You know? So it's just like, you know, some of those things it's like, dude, really? That's what this is? And like, and, and so I think it's not rejection, it's rejection after you get excited about the the art of the possible. That is definitely a tough pill to swallow. And I think probably later on, the one that sucks the most and still sucks to this day, and like, I'm an open, like, heart on sleeves inside of Dragos about this, is it is really terrible to build a culture and mission that you love. You bring people in, you feel good about it, and then you find out someone's not having a good time, or find out worse, they just don't like you anyways., you know, I'll, I'll, I'll look at like a Glassdoor review every now and then, you know, and like, oh God, you know, it's, it's like, it hurts. It actually hurts of like, oh, I know what I'm doing relative to everybody else. I know how we're taking care of you. I know how we're treating you. I, I know the background context of how that story went and, and this is still what we're gonna say. That, that hurts. And, uh, I think, I think that's uniquely a founder, maybe not, but I think it's, it definitely hits harder on founder of like, I built this place. Because I wanted to do something good. And if you don't see that and you wanna go somewhere else, that's fine. But for you to get toxic inside of it and take it out on people, that's, that's a tough one.

We're gonna talk a little bit about Dragos, but before we do it, this is a true story from last night. So I was with two, two early, very young founders last night. I've just given them a term sheet and we're trying to, you know, they have multiple offers and they're trying to, you know, decide. And they asked me a question, which is a very good question. They said, hey, What are some investments you didn't do that you regret? And, you know, unsurprisingly, I said, you know, I really regret not investing in Rob Andreagos. A, because of, you know, just how much he has grown over that period of time. But, but B, also because it's the mission of safeguarding civilization is something that not every, yeah, it's not every cybersecurity company is able to, to say very articulately.

It's funny. I got the one of like the investor I'm glad I didn't do business with. It was so funny. You know who it is. Pretty sure, but yeah, I do. There's this very large firm and, uh, they like called me up saying we want to do the deal and we'll, you know, whatever. So I get in the meeting with him and he's all, uh, you will take our term sheet. I'm like, what, what? And he's like, you, what, how much you raising? Like $100 million? He's like, I'll give you $500 million. I was like, yeah, that's not what I'm looking for. And, uh, he got like all pissy about it and he's like, well, you know, BlackRock is giving you like 20x, I'll give you like 25x. I was like, yeah, but the historical 5-year average is like 15. This is going to crash out. I can recover from 20, I can't recover from 25. And, and he got so mad that he went and bought into one of my biggest competitors and he screwed it up. This was the greatest deal that I made the day. Like, it was the best thing ever is I lost him a bunch of money and screwed over a competitor by not doing the deal with him. It was wonderful.

So on this topic of Dragos, You start this company about a decade ago and you started with two other co-founders.

10 years this month.

Yeah. Yeah.

10 years this month, Jon and Justin.

Mm-hmm.

Many people have talked about those early days and how you came and, you know, created this company after investigating the 2015 Ukraine power grid attack. But very few have actually, you know, asked you this question around the fact that 10 years later, Jon is still CTO.

Uh-huh.

Justin is still chief data scientist. I mean, that is exceptionally rare. We're 10 years into a private company that's scaled. You've got hundreds of employees. How did you maintain that relationship between the three of you and, you know, continue to work together after coming out of this very high ego, high clearance intelligence world?

Yeah, that's— it's— I'm really glad you asked the question. I don't think I have gotten that one. Um, I said this at our company kickoff though, of like, I don't think most people appreciate to your point, how rare it is, 'cause how often co-founders screw up the company and the fights and the drama and whatever between them. And the only way it works, 'cause you've met me, like I, I try to be humble, but let's be honest, right? Like the reality is Jon and Justin are two of the most humble people you ever meet in your life. And I remember when I pitched them the idea, I was like, we gotta do this. Jon was like, oh cool. All right, well I could, you know, I'm great at the design, everything else. I could be, I could, I could do like the CTO role and I'll like code and do this and blah, blah, blah. Justin was like, oh cool, I got the analytics and the protocols and this, that, and the other. And I was like, well, what do you want me to do? And they're like, I don't know, like, I don't know, be the CEO. And so I was the least qualified of the three and that's how I became the CEO. And the difference is Jon and Justin have always viewed it as my company and I've always had to remind them like, it's not. I remember I had to argue for them to take more equity in the beginning. I was like, no, let's like split it up. It's the three's company here. And they're like, no, Rob, this is really your idea and this, that, and the other, we'll take less. I'm like, guys, don't be idiots. Like, just take it. I've always had to advocate for them. Uh, and, and there's probably some trust built there that I always advocate for them, but they're just super, super humble and it is just as much theirs. And so many times I think if you don't have a co-founder, you're gonna regret it, is my, my take. And I'm, I'm very much the, I can go do this and take the hill and whatever. But there are moments, you know, COVID hit, we had to do a layoff. The, um, discussions around, hey, you're gonna get the funding for the next round. The, Hey, here's this thing. There are components of discussions where I don't think they're as safe to have as you think they are, unless it's a co-founder you're talking to. And I'm glad everybody has the right-hand person or their CFO or whatever else, but there's certain moments that that co-founder relationship is really intimate and important. And, uh, I know it's been very valuable to me, but yeah, they're, they're still here kicking. But Jon's so humble. Jon was like, hey, if you ever want to have another CTO, like I could just go back to like coding. I love being an individual contributor. I'm like, stop, you're doing a great job. You know, they're just, humble people.

You chose DataTribe as your first investor, a startup studio that specifically works with founders coming out of the intelligence community and federal agencies. Most founders in the cyberspace default to the Silicon Valley or to the Tel Aviv-based investors, but you didn't. So why was DataTribe the right launchpad for Dragos? And more broadly, what advice would you give to a technical founder coming out of the government service about choosing their first investor? What should they look for at an investor that's not on a term sheet?

Yeah, so I'll answer the second one first. So the, uh, the, what are you looking for? Know your requirements. Okay. And what I mean by that is like, just be honest with yourself. What do you want to do? I knew I wanted to build a 100-year kind of company and it didn't matter to me. Is that, is there a PE later? Is there an IPO later? Is there this, that? What has always mattered to me was autonomy. And I knew that you could divorce control and equity. You could divorce autonomy from structure. You could, you could have certain terms that give you autonomy. And I wanted autonomy, especially knowing that OT is popular today, but it may not be tomorrow. And then maybe the market swings and, and I needed to know that we could do it forever. And 'cause it was a mission that was worth doing. So that was what was important to me. So I needed investors that understood that we were building something special towards a mission. And I understood the exchange. They're gonna gimme money and I'm gonna give 'em a lot more money back. I understand the relationship., but they were gonna allow me to have the autonomy to go do the mission. And so all the investors we took were of that type, but that's not everybody. Are you, hey, I wanna do my first company. I'd really love building companies. I, I wanna have an exit and then get another one. Great. Well, there's great investors for that. So you gotta, you gotta figure out what are your actual requirements and then, and then ask your investors, show me the other companies like me. You know, there was companies that would come to me and say, hey, we could help you IPO. I'm like, great, whose last 5 companies you IPO'd? And be crickets. I'm like, okay, well I'm probably not gonna be the first one then in your portfolio. And so you'd ask those questions in the context of, I don't know if you hear my screaming other kids. I got 4 kids now and 3 are under 3. So, you know, VCs used to be difficult to manage. Now it's not so much. But anyways, when I look at DataTribe, I'm very grateful for them. They were our first investor and we probably wouldn't have got off the ground if we didn't have them. So that like, you gotta love them for that. I don't know that it was so much we chose Maryland versus the Valley. I went out to Sand Hill Road, I went out and did all that. The Valley didn't choose me, you know, like it was, I think I took like 123 venture capital meetings with a bunch of investors who are like, OT, isn't that like legacy controls? Isn't that gonna go away? Like, isn't I think one of 'em was like, I could introduce you to Facebook. I'm like, for what? You know, like it was very much like nobody that I talked to got it or a couple of the people I got, I talked to were rightfully saying, hey, the economics of this and everything could be crazy. Like it was Sid, but it was, it was your old boss. I forget his name, but he was awesome. I considered him like one of the silverbacks of the industry. Like he was, he was a solid dude and he flew out to see me in BAWI airport, just spent 15 minutes to talk, whatever. Like it was super human, dude. But the investment community was right. Like looking back, Dragos looks kind of obvious, but come on, man. Like crowded space, OT, what's gonna happen in it? This is long sales cycles, this, that, and the other. Like, I always got that. Long story short, nothing that we were doing resonated with what the Valley was thinking at the time. And the value of the East Coast mafia, if you will, was they understood the importance of the mission piece so much that they were willing to take an extra risk on the, on the financials of it. Where I think the Silicon Valley firms most of them, not all of them, but at least the ones I interacted with, had had a really well-oiled machine of looking at where the finances were, and you could also have impact. Um, and so I think that we were not a good fit for the Valley. And years later, when we were, you know, they, they would make a couple comments that would piss me off, like, yeah, well, you could relocate your headquarters here and really access talent. I'm like, what do you mean really access talent? And they're like, all the, all the people coming to NSA and everything else, you don't think that's talent? And I was like, all right, tell you what, we're never taking up any for the Valley. And so it became a thing later, but early on it wasn't.

How has that changed? I mean, it's been, as you've said, it's been 10 years. If you're a technical founder coming out of the government service today, are you looking at the Bay Area or are you still looking at the East Coast at the Maryland venture ecosystem?

I mean, my flippant comment is in this market, I hope you're just talking to people that want to return your calls. But again, I still go back to that first answer of you got to figure out what you want to do. And there are some Silicon Valley firms that specialize and can really help you out in the paths that you want to take. And there's some East Coast firms that have connections and, and so forth that may be helpful for you. I guess I just held a really low bar for venture capitalists, and that is not to put down venture capitalists. Like, I've learned a lot from them and it's been really interesting for me. I'm saying I never expected anything but capital. So it was all this like, oh, we can do this, we can set you up with customer introductions, we do that. I'm like, customer introductions, like that's my job. Like if I can't get customers, why, why are you investing in me? And, and so I looked for, I want principled value-based, just capital and we're gonna hit hard times and I want you to, on like, be willing to go through that hard time with me. That's what I looked for in investors. And I think you can find, if that's what you want, I can find, I can find you those anywhere in the world. You can find those in Tel Aviv, you can find those in London, you can find like, that's just, an ethos around investment. And I think you can find that anywhere. But so I just think you gotta know what you want.

So Rob, switching over to part that the VCs love most, TAM, right? Market size, market category. And here you are coming to Sand Hill Road and they're saying, oh, we should introduce you to Facebook. And you're scratching your head clearly thinking like, you know, who is, you know, the stupid one here at this table? Uh, so the question that comes up is that OT wasn't even a category when you started. A lot of investors clearly want to invest in big categories, so you, you could see something that others could not. Uh, you know, help us understand a little bit about what was, uh, giving you the conviction and how this category has evolved over time.

Yeah, and it's my— the question I hate the most, by the way. Not that one, that's a good question, but the question I hate the most is from venture capitalists. They go, so what do you think the TAM is? And I'm like, that's your job. You're like, I'm gonna, I'm gonna give you like some innovative product and everything. You tell me if it's a market worth investing in. Like, aren't your LPs paying you for this? Um, but, uh, you know, I think it's a fair question though. But what did I see? Number one, I saw the mission piece of it. And that I would have done even if it was a nonprofit of like, we have to do this. I watched moms working in the field all day long in Cameron and Boyer region to come home and all they wanted. Was to be able to have a wind turbine spin up a car battery to have LED lights so their kids could study in the evening and get outta the trap they were in. And to find out that there's people around the world that was like, I'm gonna hack that and turn that off. It's like, you're a bad person. And so the idea of just focusing on making it really hard for bad people to do bad things to good people, that like, that resonated with me a lot. So I would've done it anyways, but also I thought everybody was missing something even back then. When I looked at, I was like, guys, it's, you're talking about connected physics. What do you mean the TAM? Like, it's everything. You don't tell me that you're not gonna want data centers and infrastructure and manufacturing for AI. You didn't know that an AI revolution was gonna happen at that point, but you knew anything in the modern world that you're doing, even though it was all cloud, well, cloud runs on infrastructure. And so it was always obvious that you were going to need energy, manufacturing, transportation, and core infrastructure. And that was always going to be a part of society. I think a lot of times people look at cybersecurity trailing the IT industry in terms of growth patterns. Like, as IT expands, then cybersecurity wallets expand as well. I looked at IT's expansion trailing sort of what happened in connected infrastructure. And, and so I just thought it was a bigger space than anybody realized, and it was a mission worth doing. And those two things together, it was like, cool, we're going to do this. Like, early on, we didn't think we were going to be successful growing fast. I remember taking the Series A check and telling my team like, this may be the last dollar of funding we get, so let's not go hire a bunch of sales and marketing people. Let's put in the product and treat it like it's the last dollar of funding we took. Now we raised another $420 million after that, but at the time it was a good mindset, you know.

And what were the first 5 customers like? You know, how hard, how easy was it? Can you sort of go back to the, in the first few and narrate what the conversations were like? Because even in your latest RSA presentation, you talk about how ransomware in OT is mislabeled as an IT problem. You know, it's still the IT tends to overshadow OT all the time. So how are you able to sort of segregate the two in customer conversations?

Yeah, so we found a lot of luck in the electric community to start with because they had been getting the briefings. They'd understood there was a threat and they generally had resources to invest and had a really good community.. And I think that's always been the component of our relationship is just that authenticity and transparency piece where I told him like, look, here's what I'm going to be building. It's gonna take me years to get there. If you buy in now, like it's, you're early adopting. I'll, I'll be tailored to your requirements and things like that. But like, I'm not gonna overpitch you and tell you it slices and dices and all this stuff today. It doesn't. And because we took that approach with them, that I think that's why they're still with us. And it was very much alignment around the mission. And so I don't, you know, every founder's journey is going to be different, but I think the, hey, I've got a better mousetrap is a hard sell. I think the, I want to go deliver against a vision, do you want to come with me? I think that is something that resonates with customers and you'll very quickly find the customers that it doesn't resonate with and you don't want to be spending your cycles and time, especially early on with those customers anyways. And I do think Um, nowadays as well, just as, as all this stuff is popping off, I don't think any of that has ever changed, um, in terms of how we approach people. And I think we've been largely rewarded for staying consistent on these are our values, this is the mission, this is the vision, we're gonna deliver, um, on it. But, but we're gonna sell you on what's important here.

Let's talk a little bit about scaling and scaling to that unicorn status. You, you mentioned that you've raised almost half a billion dollars. For the company, for Dracos now. You're now worth close to $2 billion.

You have over— I would like— 1.7 was a couple years ago. I'd say we're worth well more than $2 billion, say.

As a flask, as a flask, Mark, but you're absolutely right.

Okay.

You have— and I don't want to reveal any new updates on valuation.

No, no, no, no, no.

There's no update.

Cybersecurity podcast.

You're first. No, no.

Uh, you have over 600 employees. And you've got hundreds and hundreds of customers. What has changed the most, you know, from those early days that we spoke about to now? Is it board management? Is it managing hiring across those hundreds of employees? Is it thinking about product roadmap? Is it the GTM expectations? What's changed the most for you?

I think I, let's see, I think very much so I have gotten better at I was a little bit of a loyalist early on. Hey, you guys are coming with me on this journey. I'm gonna bring you on this journey. And one of my board members, actually, I love Samir. So Samir Reddy over at Energy Impact Partners, just a phenomenal human being, phenomenal investor. And he told me, he's like, you're one of the better CEOs I've ever worked with, Robert. You have one of the worst flaws. And I was like, what is it? And he's like, you fire way too slow. It was like, you will find somebody that came with you on the journey and you just want to save them and you're not bringing them in military battles. Like, they're gonna get another job. Like, you're not saving their life. Like, it's okay, but you gotta move faster on your executives. And so then I got to the place of like, okay, if you gotta ask the question, you know the answer, let's go. And I told the team, hey, here's how we're gonna treat it. How, you know, very transparent about it all. But I, I started moving on people faster when they weren't able to get to the place they needed to get to. And, and that allowed us to make some hard changes. Like, I went through 2 CROs within 2 years. And I remember like even board member being like, well, don't you think this will make it harder or hire the third one? This is gonna be issue. And what signal does it send to the market? And I was like, yeah, I was like all those things. But in reality, what signals does it send internally if I don't make the change now? I was like, I gotta, I gotta solve that before I'm worried about reception elsewhere. And, and I put a lot of focus into the go-to-market team. And I remember standing up in, in front of them and the, and the last guy that I fired, like he was actually really good person. It just, it wasn't a good fit. And, uh, I remember standing in front of the sales organization at SKO and I said, hey, I just, I just fired him. Like it was literally like news to them. I was like, he's out. I'm going to do it myself. They're like, what? I was like, I'm not bringing in another CRO for at least 6 months. I'm going to make sure everybody here has the opportunity to see their ability to earn for the year myself with you all hearing directly from you. Then I'll get you the next CRO.. And I remember just like sort of putting it on my back kind of discussions. And luckily I had some great people, RevOps and everybody else around me, and we just turned the organization around and the culture of it around and everything else. And now everything's, you know, sky high. And we, we hit the point where revenue is decelerating, everything else. Now we're at the point where we're delivering 8 points over what we did the previous year and, and growth expectations, the board and everything else. So it's just, that was a defining moment for us. And then I also had, a lot of, because I'm a technical person anyways, I, I am very demanding on the product roadmap and like the understanding of it and hey, forget the buzzwords, what does that do and why does that not do this over here? And maniacal with customers and, and being out on the road a lot with customers. And, and I, I, I don't know how many, I don't know what the normal ratio is for CEOs and founders to customers, but I, I'm in front of customers every day. And, and so it gives me a great insight to constantly be holding accountable on that product roadmap and so forth. And my, uh, chief project officer Jody, really stepped up and really put that structure in place where we've been able to launch over the next 18 months, we'll launch 3, if not 4, net new ARR modules on the platform without a single extra headcount request into the R&D organization because she is just like making it more efficient as we scale and using the right resources to do it. And so as my burn stays flat and my growth skyrockets, those are great places to be in where I don't need to raise a Series E. We can go profitable without doing a Series E. But of course we'll, we'll probably do some injection of capital because I want to take over the world anyways. But, um, I, we don't need to, and that's a great place to be in. And I would say that mindset shift and that structure was the area that I put a lot more focus in as a CEO and growing as a CEO versus being the tech person that can do instant response.

And as these companies scaled, CEOs always start to optimize for certain metrics to the board. Is there a board-level metric that you just refuse to optimize on throughout this whole journey? And, and why was— you know, pick one.

I know there's, there's, there's many, but like, is there one that you're like, you guys are— you guys are smoking something? Like, no. Like, but remember the relationship. I, I am— maybe I'm not the easiest person to do with, but I, I run the board and I keep the board very tight. And they'll always ask, well, I want this metric, I want this metric, I want this, I want this. And I go, great, it's not material. The answer's no. And they're like, what? And I'm like, your investment is across this term sheet and our governance documents are this in Delaware law. Here is what you are entitled to and the rest of it is wasting my time. And so we don't give up anything unless I think it has an ability to be an accountability metric. So if like, I do view a board's role Besides being investors, right? Because that's not always true, but a board's role is on governance and actually holding accountability, especially the executive team. If what you're asking for can allow you to affect a change that relates to governance or accountability, I'm all for giving it to you, even if you didn't ask. If it's a, I have a curiosity, or I'm investing in 30 other companies and I'd really like to know this metric as I go and invest, I'm like, I'm not here for your, like, portfolio. We're not doing that. And so our board decks and everything else are pretty slimmed down. One of the ones that I always thought was stupid was burn-to-ARR ratio. This, it's the, too many of you listened to the All In podcast and forgot unit economics. Like I, I don't understand why this was big in Silicon Valley. Like somebody came to me and was like pushing on this burn-to-ARR ratio. I'm like, great. Don't you care about like, I don't know, LTV to CAC ratios as well? Because burn would imply around a customer sales cycle. But if I can show you a good return, What do you care? So if I can deliver you high 70s, low 80 margins, I can, uh, I said, what would it be a good one be? Would it be 3? Would it be 4? And they're like, if you had 3 to 4 LTV to CAC ratio, it'd be great. I was like, great, I have 6.6. So can we stop talking about burn-to-ARR ratio now? And so just, that's the one, like anytime you synthesize down an entire company's discussion on a metric and you're missing the assumptions that went into that metric, the assumptions on burn-to-ARR ratio is that you were like every other SaaS company. Therefore, your LTV to CAC ratio is largely the same. Therefore, a difference between a 1 and a 4 was a big difference. But if those assumptions aren't right, then the metric is just stupid. And if you're— if you don't understand what went into the metric, you just look stupid asking for it. And then that was the one that annoyed me the most.

Dragos now has operations spanning the United States, UK, Europe, Middle East, Australia, New Zealand, Japan, and Singapore. But OT, cyber is fundamentally a local problem. Right? Every electric grid, every water system, every petrochemical plant, they all operate differently. You've said before that cybersecurity challenges are global in nature, but local in practice. How have you thought about this tension between scaling a platform company and serving customers that need those very specialized boots on the ground expertise?

Yeah, you got to invest. And what makes Dragos great has to be what Dragos is everywhere, or you, you can't be surprised that it doesn't succeed in a regional expansion, as an example. So as an example, people love that they can come to us to partner with us. So we've got great technology. We've also got subject matter experts and services professionals. We've also got incident responders. We've also got technical account managers that come along the journey with you. We have Dragos in a box. If I'm not able or willing to take Dragos in a box at that level of investment and put it in Singapore, don't go, because it took me all of that to be successful in the US. Why would I think it would take me less to be successful in Singapore? And, and I do think there's something special about cybersecurity, but especially special about infrastructure where you might talk about like, hey, that's my bank. It's like, that's our water system, that's our electric system. You know, there's a certain pride in the systems that serve our communities. And so for you to come in and be like, I have a WeWork office, and I'm here with a reseller, but I really care about you. Like, I don't think that resonates in OT security that much. So we would get hit a lot where, um, the Gartners of the world and stuff would take off points in the quadrant to be like, well, you're not in all the places in the world. I'm like, yeah, I know, but neither are they. Like, that's just surface level. I was like, when we go somewhere, we're going to go correctly. And what that's turned into is extraordinarily low churn. Where I routinely have like 119% NDR and sub-3% churn on the business because customers know we're going to treat them well. We had this, and just be honest with them. We had this great meeting with this Indian power company. They really wanted us to be in India and they said, you're not in India right now. I was like, you're right. I'm not. And I want to. And so here's the level of investment I'm willing to sign up. I need an anchor customer. I was like, we do this. Here's what it's going to be. And it's a government-owned infrastructure. So they had to get into a reverse auction. And they really wanted us, but they, they had to go this route and they said, hey, can you go to this level of discount? And I said no. And they're like, well, hold on, why not? We really want to do it. This could be great. And I was like, I know, but I'm already going to lose money coming to you. And if I have to cut to this level, I'm going to have to cut out the technical account manager. I'm going to have to cut out the instant responder that wasn't part of the package that I'm now adding in. I was like, I can't come and do it correctly. So I'm not going to be the right partner for you. So what I want you to do is go choose the lesser product, let it fail, talk to your management, and come back and call me in 2 years. And I've done that before with people, and they come back in 2 or 3 years and have that conversation with you, and they go, oh, you told me this is where it was going to fail. You told me you couldn't just do it surface level. We're ready now. And, and I think if you can have trust in your business enough to know that you're going to be here longer than a quarter, you're allowed to have that kind of conversation.

For founders who are going international for the very first time, what is the one thing that you would wish you would have known when you opened that very first office outside of the US?

So I think that was an area I wasn't too concerned about because by the time I was like 20-something, I was like mid-20s, I'd been to like 43 different countries, right? And so I, military was great for that. And why I say this is what I think most founders make a mistake on is they think about the market and they get excited about the market and they don't realize they're a tourist. And so I can have a great reputation all over the world and people may know my name, but I'll never be Singaporean. I can go anywhere in Saudi, they treat me like a brother. I will never be Saudi. And so the idea of, oh, I'm going to go to your country as a guest in your home and act like I belong here, kick off the shoes and everything else, like, that's a mistake. And so you need to make sure you have the local partners and people that grew up in that community, and you invest with employees that are from that community. Like, my Saudi employees are Saudi, you know, my German employees are Germans. Like, I make sure that it's part of the community and we invest in that community. It's not, hey, we're here to be exploitative and come sell you stuff and walk away. It's, well, how are we also doing talent and workforce buildup because that's important to you? How are we also making sure that, that Germany is better because Dragos is here? How do we work with the Bavarian State Police when they need us on an infrastructure attack because we're, we're in your house and we're just trying to be helpful? And I think I, I worry that a number of founders I see don't have that mindset. They go, oh, Germany is a big GDP, or, um, the next place to go is Singapore, and like, look at the market size and I was like, whoa, whoa, whoa, whoa, you're watching too much TV. Like you are not from that culture. Learn the culture first.

You know, speaking of different markets, Rob, you know, you think about expansion and then you also think about competition. So Nozomi, Clarity, these are sort of quote unquote competitors and Japan is essentially conquered now. So talk to us about your notion of competition. How should founders think about competition? Give our audience a little, uh, you know, insight into, uh, how do good founders treat competition?

I like my competitors. All right. Now I am deeply competitive. Most sane people will put like the first dollar that you sell or whatever up in like a frame and a wall. I got tombstones in my house from when my competitors sell. Um, and so I'm deeply competitive, but I'm deeply respectful of the fact that most of them have signed up because I wanna make the world a better place and they're on their own journey. And so like I had dinner and drinks with the CEO of Clarity not too long ago in Munich. I like the guy a lot. Like my interactions with him, I was like, dude, you're mission-driven. I, I'm going to bury you and I'm, I'm not gonna enjoy it. You know, like I just like, I, I love you. Like you're a really good human being. Andrea over at, at Azomi, lovely human. But you can't let the conversations when you're not in the room get to you. Cause I've heard stuff that Edgard has said come back to me through VCs and whatever, and it's not all friendly. And if you let that get to you, there's context missing. I bet you he said something and it got interpreted one way or three ways and then passed around like a schoolgirl, you know, notes class and stuff. And then all of a sudden people are getting mad at each other and it's like, why? So I view competitors to be necessary. I view the whole steel sharpen steel kind of mindset. But also if you break bread with them and get to know them, most of them are legitimately good people. And the ones that aren't, you just decide to not spend your energy there. And, and so I tell all my employees, like, our number one competitor is execution. Go do that. Outside of that, they're making the market a better place. And we don't, you don't want to be the only one marketing and selling to the market and trying to do all of this yourself. Like, they're opening up those opportunities too. Now, my deeply competitive nature is I know behind the scenes what's really going on with those companies, not just those two, but like, I, I like to know my competitors. So I read all the blogs of, oh, we're an independent company forever. And I read all the blogs of, this is a great growth round. I'm like, yeah, I know the details on that.

Know the details on that.

That's BS. Uh, you talk about Japan being, uh, conquered, like, all right, cool. When's the last time anybody at OT was like, I'm really glad my OEM is providing my cybersecurity? Like, all right, good, good luck. And so I love being in Japan, flying over there later this year with our wonderful partner Macnica, just make sure we go up behind it. But if you ask me how I feel about them as people, and even on like their tech and stuff, I think it's wonderful. I think they've got great people. And if you stay around long enough, which I have the intent to do, some of my people will go to their house, some of their house will come to mine. And as long as we can all agree that all of them need to be treated with respect, and I can trust that my people going over to you are gonna have a good time, and I'll take in a Zomi employee every now and then, I can trust that they're gonna be great people that, that you help build up. Like, that's a net additive for customers. If you care about the mission, you can't look at that stuff as negative.

As we kind of come to the, the last section of our conversation, we wanted to chat a little bit about the, the mission for Dragos, which is safeguarding civilization, and, you know, how AI and geopolitics and other, you know, areas are impacting that mission. The, the concept of, of safeguarding civilization is important here because really you're protecting critical infrastructure, and, you know, that critical infrastructure powers the rest of the world, and that includes data centers, which we talk about deeply as we're thinking about kind of the next generation of AI-based models. Now, since Stuxnet was first uncovered in 2010, digital warfare has grown pretty dramatically and it's become the new battleground. And, and you've spoken about this publicly, but we're already seeing a lot of that today with Ukraine, Russia. We're seeing it certainly right now ongoing with US, Israel, Iran. We've seen pockets of this, not a conflict, but a quiet one with US, Taiwan, China. I'm curious to get your broader thoughts on the current threat landscape and what's the part of the current threat landscape that worries you, that keeps you up at night?

Yeah, there's a lot of stuff that happens outside the media. Like, we're involved in half a dozen incident response cases right now that will never be in the media, um, related to this Iranian conflict. Um, and, and as I look at it, there's a whole lot of like, it's the same on some aspects, right? The types of attacks that we're worried with most in industrial networks, tend to be misoperation. It's not, hey, there's an exploit in malware and look at privilege escalated on a human-machine interface. That's not all that interesting. It happens, but okay. Most of it is, well, if the electric operator can open up a circuit breaker, so can the adversary. If I can change a set point to change a valve setting, I can do it as an adversary. It's misoperation, and that's harder to deal with as well. And what worries me— let me, let me say geopolitically what worries me is it's very obvious, and it has been for a long time, but it's, it's the Emperor's taking the clothes off a bit of everybody actually views civilian infrastructure as valid military targets. And they say they don't, and they say they won't, and don't worry, we won't bomb hospitals. Don't worry, we won't go in after electric grids. Don't worry, we won't hit data centers. And then you can justify it all as military targets the moment you want to. And so, um, it's necessary to do this mission because there's going to be a lot of people that get hurt. If you don't. The, the thing that worries me technology-wise is we have thrown so much automation and complexity in these industrial networks and commonality of interesting software stacks and similar that you can scale attacks in such a way that you can do physical destruction or at least physical disruption in, in ways you couldn't 10 years ago. And so you, you used to have infrastructure, you had to spend a lot of time and effort to go after one site. And there was still some people that would do it. Now you can put the time into building one capability that scales across hundreds of sites. And we are already starting to see state actors transfer knowledge and capabilities to non-state actors, and they're realizing their hacktivist groups and similar can be a part of this game as well on the OT front. We had, you know, a group that was hacking internet-connected human-machine interfaces and writing like, Israel sucks on it, you know, one day, and then a month later they're showing up with like program logic controller-based implants, ladder logic manipulation, physical process disruption. It's like you got a knock on the door. Like, you didn't just like learn that in a month. And, and so as all of that happens, that proliferation happens at the same time that we're making all of our stuff more complex anyways, then we're like, hey, let's also throw AI on top of grid monitoring and mining operations and similar. You're going to start getting to a place where we have disruptions, explosions, downtime, etc., up to and including the loss of human life and we're not going to know why. They won't be able to determine was it a cyberattack or not. It'll be something happened. How do we do root cause analysis? And it'd be like, well, did you collect the data ahead of the incident? And they're like, well, no. I'm like, all right, well, we don't know. And, and that's going to make a lot of people in governments and everybody else deeply uncomfortable, as it should. And that's, that's— you don't do a 6-month IT security project in OT. You're talking about a multi-year journey at a time that you're not looking in, you're looking inside of a multi-year, um, event window. So I, I'm, I'm worried that people are gonna die and we won't know why.

You wrote after Davos that the next phase of the digital transformation is going to be about AI integration into OT. So that is AI being deployed directly into the control loop, making decisions that impact the physical world we live in. Uh, you also warned that the pace of adoption is going to outpace our ability to manage risks if we don't start acting today. What does that actually look like in practice? Like what kind of scenarios keep you up at night when you think about AI controller running a gas turbine or managing a water treatment plant? And what should we be doing to prepare for that future?

Yeah.

Yeah. Good example of what it looks like in practice on the, on the Defender side. Is I've got a giant mining company as an example that when they go and put new control systems into process control environments, they're generally going between a 12 and 18 month cycle with their vendor testing, validation, et cetera. Their CEO and board is pushing so hot and heavy on AI and anything with AI, like get it out of the process. Like let, no, stop being, stop thinking backwards and like let's, let's, let's lean forward that the same vendors are pitching stuff with the word AI appended to it and getting inside of the environment within 3 months. And so it's just not the level of testing and validation you want when, when accidents lead to death. And so we are, we are seeing a rapid adoption of things that also may not be here. The market's going to reset to some degree. I don't think it'll be a giant bubble, but it'll reset to some degree. You're going to have startups that are now part of critical infrastructure that are no longer in existence the next day, and you got to manage that as well. And so on the ops side, it's risky. Now you start adding in the fact that an adversary can misoperate equipment, cause an explosion, whatever. And there's so many communications and so much complexity and system 1 versus system 2 and so forth across this environment, you won't be able to determine it. The ability to get ahead of it is the stuff that we talk about, like visibility, detection, response. It's, it's all the same stuff. We're really talking about be able to collect data and do things with data. And if you collect the right data sets, you can use that same data for operational value. You can use it for cybersecurity value, you can use it for root cause analysis, but you gotta have the data collection.. And I am again, deeply worried about the adversaries that understand that and know how to take advantage of it. And we are running into still some weird fights. I still get people saying, oh, IT, OT, what's the difference between the two? You know, I'll talk to presidents and CEOs and boards and they understand it faster than CISOs sometimes that are just like, I don't know, I've been doing this for the last 20 years. I'm like, yeah, I know, but you've never been in ops. Like it's different. And, or, you know, there's a firewall company that talked about how all OT attacks originate in IT networks, so why wouldn't you just protect the IT networks? And it's a great paper by a great brand, but then you go and you wait, well, hold on now, none of your stuff's deployed in, in OT. All of your telemetry is coming out of IT. So when you go into your telemetry and look for OT attacks, you would only ever see it come out of IT. So you're just making it up. Like you, you, it's not, I guess not made up, but the collection bias is gonna mislead an entire community. On what they need to be doing as a result. So it's, it's that like fighting inside the house is what worries me. And if you really want to get controversial, the thing that scares me the most is used to, you had CEOs of infrastructure companies that came from the industry. You had, you had Tom Fanning at Southern Company started the switchyard. You had Bill Fuhrman at American Energy Power. He started in public power in Nebraska, public power district. He, you had CEOs and board members that knew what business they were in. So when they got big projects pushed them at the board level, they'd be like, ah, I don't think that's actually how that works. Or that's gonna, well, no, it's not gonna do that job. What I'm seeing the most now is investment bankers installed as CEOs or private equity folks, or the CFO that came over but had only been there for 2 years getting installed as CEO and nobody around the boardroom having industry experience. And so they're authorizing things that sound really good and push the envelope of these, these industrial companies and AI and digitization and all this. Without understanding the consequence and understanding what can go wrong. You know, safety rules are written in blood. Cybersecurity, you know, standards are written by committee. And so that is going to take us to a really weird place if we're not careful.

Just on that topic, I mean, I think the one thing we've had in the startup community, particularly in the cyber startup community, is OT security is not considered an area that you can go and innovate in. I'm curious, just what do you see where there's an opportunity for new founders? And we have lots of, you know, operators listening in on the show and they try to think about like new ideas. Like what would be one thing that you'd say, hey, this is why I think you should look at this space and here are some areas that you may want to spend some time in that we're not spending a ton of time in today.

Yeah, I think, I think there's a lot of untapped space. I think people look at OT security as a category in the same way they have like those market scapes and they'll be like, here's the firewalls and here's OT and here's this. I'm like, guys, it's the whole market scape again. Like, it's a, it's a market. So you could have OT endpoint if it made sense. Like, you'd have OT backup and recovery, you could have OT— not everything. There's some IT security stuff that works well, but quite a bit is untapped space to do interesting and innovative things in OT. You just have to understand why is this truly different than the IT answer, and where's the pain point that actually is worth addressing. Um, I'll, I'll give you some, uh, advice. So like, good example, I, I'm, I'm gonna get beat up by some friends here. I personally don't think secure mode access into OT is all that different than IT. I can't find a reason. I could have bought one of those companies on equity, made a bunch of money. I, I, I just couldn't get behind it. Uh, now if you're talking like Lior over Waterfall doing data diodes, that's different. But I mean like secure mode access stuff. I, I don't see why I could recommend to a customer not to deploy like BeyondTrust or Zscaler or something instead. If I look at backup and recovery, that's uniquely looking at like ladder logic and the orchestration across industrial environments and stuff. That's a very unique space you're not going to get in a typical backup and recovery solution. Or I still think there's a really interesting market. It's not truly cyber, but looking at like process analytics, like there's been a bunch of companies that have tried that over the years. I still think that's— there's a there there of finding how to use the exact same datasets to drive operational value that is a revenue generator for those companies. I also think that the AI stuff will be super interesting. I like what Frenos is doing in terms of like looking at how to use AI across intelligence and similar to prioritize and constantly do some level of assessment work in your infrastructure. Yeah, I actually like NetRise. Looking at how they're doing product security and they're looking deeply into the supply chain aspect of it. And your supply chain is complex in IT, don't get me wrong, but you got some pretty major vendors, Cisco, Microsoft, et cetera. We have hundreds and hundreds and hundreds of diversified vendors across 30-year lifecycles. The supply chain issue for us in OT is very interesting. And so where there's unique value that you could say that this is gonna be a 20 or 30-year thing, I think you got an OT story. If you're thinking it's a 2 to 5 year thing, that's not a lifecycle we consider an OT.

Rob, just speaking of lifecycles and the timespan and the duration of which you operate in compared to the rest of the industry, you know, a couple of thoughts in closing. Where do you see yourself and how do you define success, let's say, 10 years from now?

Yeah, I told my company that I want to build a 100-year company. And what that means to me is, again, I'm not so worried about the structure. I want to know that there's Drago's permanence, which includes focusing on OT no matter what, and an autonomy to make those choices. And what a 100-year company means to me is I'm going to be dead, and everybody in the company that I love and value and makes this culture is going to be gone. So how do I know that the, the Drago's team next, the Drago team 100 years from now embodies the same values and mission ethos and focus and can stay focused on that mission. So a lot of the time and effort I put in now and talking to future investors and the strategy of it and restructuring my board structure and all these things going forward is, okay, not 10 years, but 100. How, how do I know the guy or gal or other after me and this team is living inside of this structure? How do we, how do we lay that foundation?. And, and, and I spend probably an uncomfortable amount of time thinking about that these days. Um, but, but it is my priority. And so as I go out and talk to investors and so forth, when they're like, oh, here's the next round valuation. I'm like, I don't know what it's gonna be in 100 years. That's what it is right now is not that interesting. I, I need to understand all the rest of the discussion.

You know, Rob, uh, in Silicon Valley, some of the VCs talk about missionaries versus mercenaries. And I find this entire conversation, I'm sure my co-hosts Ross and Sid would agree that here is a missionary who's not in Silicon Valley. He's quite far away from Silicon Valley. He's doing true work in protecting national infrastructure. As a Lieutenant Colonel, you're part of the team that designs national response to infrastructure attacks. That's the part of service that very few people know and understand. You do work at SANS as well to continue to spread your knowledge and wisdom. So in closing, I can say that there are very rare founders who can operate the way you do. There's a peacetime CEO, there's a wartime CEO, and war, not just inside the company, but war is going on outside. And we feel like the way you're conducting yourself and building this company is truly remarkable. I'm sure a lot of our audience members will get a lot of inspiration from this episode. So thank you so much for joining us.

Yeah, thanks for having me, guys. And again, all bluster and everything aside, the investor and operator community has added a whole heck of a lot to these discussions. And I've definitely always learned from you guys over the years. Maybe I haven't learned as much from Sid as he'd like, but I still learned. So anyways, thanks for having me, guys.

Thank you for joining us Inside the Network.

If you like this episode, please leave us a review and share it with others.

If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and send it to me first.

No, don't do that. Mahendra gets too many gifts already. Please reach out by email or LinkedIn.