Ron Gula: Bootstrapping Tenable to $100M revenue and becoming an influencer

Welcome to Inside the Network. I'm Sid Trivedi.

I am Ross Halidook.

And I am Mahendra Ramasinghani. We have spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators, and investors building the future of cyber.

We will talk about the hard parts of the founder journey, launching companies, getting to product-market fit, raising capital, and scaling to an exit.

And yes, we will also be talking about epic failures.

But Mahendra, we're here to make the founder journey easier.

That is correct, Sid. But we cannot make it too much easier because startups are hard. And of course, you already knew that.

All right, you two, enough. Let's get started with this week's episode. Welcome, Ron, to Inside the Network. Before we go into the episode, we just got out of RSA. It was an exciting conference. There were over 50,000 attendees and it was great to see you there too. What were your key learnings? What did you see?

I think the biggest thing I saw was the excellent use of artificial intelligence. People who were doing AI for security talked about it like that. There was no high-level, superfluous marketing there. And I still can call it the RS AI conference because AI is going to eat the cyber industry. So that was some of my feedback there.

Yeah. So for me, I haven't really spent all that much time on the floor. In the minutes or tens of minutes I did go around, the one thing that stood out was I don't remember which vendor specifically was this. And I genuinely don't remember. Not only I don't want to call them out, but I don't remember the actual vendor. What It was interesting to see, there was a company that didn't have a booth, so it had an empty space, and it just had a sign redirecting people to another booth, essentially saying that, hey, this vendor was acquired by this other big company, please go to that other big company and talk to them. To me, that was the most insane marketing decision, insane marketing choice. You essentially had, like, it doesn't matter who you are as a vendor, what matters is that You got a space which you can fill however you want, and that is how you decided to go about it. So to me, that was the most insane part. The most interesting and the most unexpected was probably the fact that there were quite a few, well, there were few, there were not enough companies tackling AI for security or security for AI, but specifically AI for security. I believe it was only Protect.ai and maybe one or two other vendors that were in that space, and everybody else did not really have a large presence. Or any presence on the floor. That was surprising. And then there was also probably one or two vendors in the AI SOC space or AI engineer for SOC, and the rest are still probably in stealth. So that was surprising and unexpected.

For me, I think the most surprising thing was just seeing Keanu Reeves in an actual marketing commercial for a cybersecurity company. Like that, it was just, it was unexpected. We've seen over the years, we've had a whole bunch of high-quality athletes, actors, titans of industry go and promote cybersecurity, but it was very unexpected. In terms of what I didn't expect, I think the number of nations that had not just boots, but a large presence, whether that's the United States. I mean, the Secretary of State Tony Blinken came and did a keynote, which was amazing, just given the fact that just days before he was in Israel trying to negotiate a ceasefire, and then he ended up going to Ukraine right after this. So he ended up spending his Monday coming in, doing a keynote at RSA, a cybersecurity conference, in the middle of 2 very, very large conflicts that are happening globally. I think it gave us a sense of how much, not just the United States, but you also had presence from Germany, presence from Israel and other countries who were physically there in the expo halls, but also in sessions, just how much different nations care about cybersecurity. We got to see it in full force. That was different. Mahendra?

No, that's a very interesting point, Sid, about how the role of government is becoming more and more front and center, not just in Washington, D.C., where policy papers are being churned out, but actually being a part of the floor, being a part of the conference, coming and speaking at these events. And so I couldn't agree more that the role of government is becoming more and more amplified. You know, for me, the parts that were interesting, you know, to Ross's point, the companies getting acquired where a booth is empty. You know, I spoke with several VCs who were talking about companies getting offers. So one company that is about $5-6 million in revenues has an $800 million offer at the table, acquisition offer. And I was asking the CEO like, "Hallelujah, why did you take it?" And the CEO says, "Well, because I have a VC giving me $200 million at a billion-dollar valuation." So as much as all the doom and gloom that we hear about companies sort of not being able to raise money, here are some outliers that I heard. Another interesting data point I heard was I talked to a bunch of CISOs asking their views on AI. And consistently, most of the CISOs said 99.9% of whatever this AI snake oil is bullshit, literally. And so I had to sort of like say, hey, wait a sec, but those are my companies. Those are investors who are all excited about AI. And the CISO would be like, yeah, yeah, yeah, your excitement becomes my problem.

Too much fun. Well, you know, Ron, let's go a little bit into kind of a few different parts of your life, and we're going to start with a little bit of information on what you were doing before Tenable. Of course, we'll talk about the Tenable story and all the learnings you have had. We'll talk a little bit about after Tenable, both in terms of your investing career, which is now quite long, as well as a little bit about what you're doing to try to influence the industry, both through your foundation work and, and other work you've done. But let's start with your background and your childhood. Tell us a little bit about Ron before Tenable. Everyone talks about Ron, you know, this very famous founder of Tenable and CEO for 15 years, but very few folks have really understood your background and where you came from.

I appreciate the opportunity to share that because I think everybody in cybersecurity should think about what they're doing as equal importance as we try to professionalize our industry. But I was fortunate enough to grow up my mom and dad lived up in Syracuse, New York. Grew up in upstate New York, went to Clarkson University. One of my roommates was, uh, Marty Rush, the guy that did Sourcefire, right? So we were good friends back in the day, and, and, uh, he's doing his own thing at Dentography now. But from Clarkson, I joined the Air Force. I wanted to be a fighter pilot. I actually got into fighter pilot flight school. There's a flight school where you can go to instead of having to be the first in your class to get an F-16 or an F-22, you would have to be anybody in this class and you get something. But it turns out I pulled a little bit of G's and it didn't really work out too well for me. So I got out of that and got into my first love, which was always computers. And from there I ended up working on a tour at the National Security Agency where I was doing penetration testing in the '90s. And nobody called it cyber back then, it was information operations, CNO, CNA, computer network defense, all that kind of good stuff. But I got to be involved with some national exercises, something called Eligible Receiver, which you can Google and find a few things, but it was kind of a cool test that was interesting. I was involved with that a good bit and on the planning side. And I got out, worked for a— it's a bad term, but a Beltway contractor, BBN, the people who invented the internet. I got to meet the guy that did the sign and stuff like that. Got to learn how to do government procurement. But from there, I really started working at startups. I joined a company called US Internetworking, was sort of like a Cloud 1.0 company. And they were doing things like buying PeopleSoft and Exchange licenses and selling them to multiple customers. Nobody heard of SaaS back in the day. So I got to understand new licensing and selling new licensing with new models and whatnot. But while I was there, I was running intrusion detection, something called risk mitigation. I wasn't the CISO. I was the guy doing the pen testing and keeping the hackers out. And, um, I had the idea to write Dragon.. And I came home one day, talked to my wife Cindy, and said, I need you to figure out the business side of things. I'm going to figure out how to write a product and sell it. And within 18 months, we had sold that product for just a couple double digits. We had massive deployments at the DOD, Citibank, AOL, that kind of stuff. And the people that bought us were from Interesis, Jack Hufford. And we ended up going on to start Tenable Network Security. So that's a fun story. I love telling it. And, you know, everything we did was kind of building upon what we did in the past. And I'm just trying to give back now.

Very interesting. Ron, you started doing information security well before it was called cyber. And it's interesting to me, what was security like at that time? How many people worked in the industry? What was the industry like? Where did you meet others? Did you indeed congregate as a community or was it still all very disconnected?

So there was a lot of interesting overlap. So, you know, working at the NSA, working as a pen tester, the world went through a number of changes, right? We used to hoard exploits. So if you were on the scene in the '90s and you had zero days, you would trade them. And I still remember trading zero days with various people. And then something changed in the late '90s, early 2000s. All of a sudden it became the cool thing to publish and get credit for that. So that was a really big deal. Uh, there was always collaboration. Like, I mean, Gene Spafford, Matt Bishop, a lot of these graybeards, they would come by, you know, the NSA. We'd see these people, you know, at RSA. We would talk to them, and there was a lot of collaboration there. But cyber wasn't really cyber until people's websites started getting hacked and people started, you know, stealing money from banks and that sort of thing. And then the whole industry just kind of, kind of exploded. And if you didn't kind of grow up in the industry, it's people on the outside who it's become so insular that if you didn't grow up in the industry, it's really hard to get into the industry. I'm sure we'll talk about that a good bit because we speak so many different languages and we have so many things that we do in cyber that just turn non-cyber people off, whether it's the language of talking about hunting the Russians or the Chinese on the network, right? Which can be a little too overly militaristic and maybe turn off certain parts of the demographic and stuff, or just the jargon that we do. It's not very inviting to people who want to make decisions about important things about where their data is going. So that's the biggest things I've seen change over the last probably 15, 20 years is just the popularity of cybersecurity and the continued lack of understanding of what it does because the technology just changes so fast.

And just, you know, following up on that, Ron, This question that Ross asked about how the cyber community was so early when you got started, did you think that you wanted to go into cyber? Was cyber even a category that you defined? You talked about your Air Force days. I've read that you wanted to be a pilot, and, and that would have been kind of partly your dream. So how did you kind of fall into cyber?

Yeah, I, I think I'm going to coin something new. I don't think I've said on other, other shows, which is not only my failed fighter pilot, but, but the basic plan was to, to go to fighter pilot school and get involved with like the UFO program. And, uh, so when I started working at the NSA, people were like, oh, are you working with, with the UFOs? Like, no, I'm not working with that. Of course you are, right? So, so that, that, you know, I really wanted to do that sort of stuff. And one of the reasons that got me into cyber is I was reading, uh, you know, the online UFO stories, that sort of thing. And I'm not going to say I was reading them on YouTube, that was more like a bulletin board you had to get with a modem or something like that right back in the day. But right next to those UFO stories was frack, right next to that was an 8LGM. So I was able to, to go from that to, oh, there's a lot of really, really good things to teach yourself about that. So that's, that's how I kind of got, got into it. I think a lot of people back in the day got into it because it was this sort of edgy are you a hacker, are you an information security researcher? Regardless, you had to spend a lot of time teaching yourself about how does SNMP work, how does Ethernet work, how does these various protocols work.

One of the refreshing parts about you, Ron, is how you and Cindy together have played this role in cybersecurity. The two of you are both investing, doing good work at the foundation, even at RSA. You're such a well-integrated couple, both in your personal lives as well as your work lives. In cybersecurity, we rarely see this. In fact, the only other person I can think of is Caleb Sima. You know, he invited his mom to a talk he gave on AI. And, you know, the audience just loved it that he had brought his mom. And I saw his pictures. He brought his kids to RSA. So share with us how we as human beings and individuals can learn from some of the things you're doing here.

So it's interesting. I didn't set out to do— this is the third company I've done with Cindy now, and it's not— everybody comes up to us and says, oh my gosh, it's so good, so unique, and it's so nice to see a loving couple out there do work. But the reality is you can work— I just— we were just speaking at a military conference called HammerCon, and we said, look, this is something you can't do. Like, you cannot command an aircraft carrier and your spouse cannot be in charge of the F-18 squadron, right? It's just not something— can't do that in government. A lot of big corporations, you can't do that. But if you start your own company, you can do whatever you want. And it really, really worked out that when you take a risk to start a company, your spouse is taking that risk too. And I think sometimes people start companies and maybe the other spouse is working and it gives you this kind of a cushion, and there's nothing wrong with that. But at the time, Cindy and I were, were both sort of thinking, hey, let's go all in on this and work on it together. And it, it worked out. Maybe there's another universe where it didn't work out, but, but it worked out in this universe. And not only do we do it once, but we did it again with Tenable. And in that story, you know, Cindy was very gracious and very much back room, not front and center. And you could get a little, got a little bit of negative connotations with the husband-wife sort of mom-and-pop shop would be the negative term there. But now with Gula Tech Adventures, we speak together a lot. She's keynoted on her own. She's on the boards of companies, you know, and we work on a lot of stuff at Gula Tech Adventures as a team. So that's, you know, some very excited about that. And, you know, not just for, you know, trying to represent a nice good marriage and how to do teamwork and stuff, but it really helps us when we talk to other companies, even if the founders aren't married, right? Or just Maybe it's a father and son, right? Or maybe it's just two people from college. You have to answer questions like, how do you make decisions? How do you resolve conflict? What are your goals? And work on those communications. So that's really like the messages that we have to say is like, it just really refines what are your goals, how do you communicate, and what are the risks that you're taking.

And you know, the most important part here, Ron, is that when Cindy steps up, you know, at RSA, we don't see this balance of gender, balance of diversity. And so very, very grateful that both of you do this together. It also gives opportunity to a lot of other female founders and more importantly, female CISOs who sometimes feel like they may not necessarily have a voice in the room or they may feel not as empowered. So thank you. I know Cindy's not with us today, but please extend our gratitude to her.

I will. I will. And we do get that. It's funny because we do get the opportunity to speak on a lot of different things. We've done a lot of different donations through our our foundation, a lot of different competitions. And, you know, we're not experts in the things that we've tried to support, even though we know that they're there. So one of the ones we did was benefited, you know, just increasing cyber awareness at the boardroom level. And, you know, the group that won it ended up getting almost 1,000 women trained in the Qualified Technical Expert is the standard. I was pretty excited about that because that really increases diversity, really increases not just diversity of, of the sexes and, and, and stuff, but actual diversity of thought. And, and that's really where I think the nation really benefits. Like, I— like, don't get me wrong, I'm, I'm quite happy that we have a diverse group of people and stuff, but I like diversity of thought and approaches so much more. And the comment I usually make about Cindy and I is, I think one of the reasons we work well together, we're both engineers, we're more worried about having the correct solution than being perceived as having the right solution. So it's, it's pretty good. And I think one of the things that stories out there, if you ever watch Ozarks, you know, the lead character, he'll, there'll be a very stressful situation and somebody will say something. He'll be like, that's not helpful. That's very much how we look things like what is helpful, what gets us the right things and how do you communicate about that?

Interesting. One of the things you've just mentioned was about the risks of starting companies. And I'm very curious because today it feels as if The whole idea of entrepreneurship has, to a certain degree, been de-risked, right? There has been a lot of education around starting companies. There is a fairly mature venture and investor ecosystem. What was it like when you were starting your first business?

So it's interesting, you know, coming out of the NSA, coming out of the Air Force, you don't really get a whole lot of, here's how to transition to civilian, here's how to transition and start a company. Nowadays, you do. The military has great programs on transitioning you know, veterans of the private sector. And, but back in the day, it was very much, oh, go, go work at a Beltway bandit, get picked up by somebody there. You'll have a, you'll have a good career. You're an engineer, that kind of thing. There wasn't anybody tapping on your shoulder that says, look, if you got a couple ideas, you can get some coders and start a company. So literally I would go to some economic development, some, it was basically meetings with businesses. And I'm sitting next to people who have like cupcake shops, right? And I'm good. They're working hard. They're working just as hard as we are, but it's a different set of stuff when you're doing cyber. So what we did in the late '90s, early 2000s, we kind of did on our own, right? We never really talked to venture capital people. We never really had what I would consider professional go-to-market training. We never really had any of that stuff. And we did quite well. And people are astounded that we, you know, brought a company to market and sold it to the federal government, sold it to the intelligence community, sold it to major banks, and got acquired. We had multiple offers for what we did. So now when we do investing, like one of my biggest questions is like, what's your risk here? Like why you don't need to raise money to like build a nuclear reactor, right? You, you need to sell some stuff. Usually the founders selling stuff. And I guess we have a lot more higher expectations of startup companies. And we're also very, very aware that when you start a company, one of the biggest risks if you're successful is somebody might come along and make you an offer that you will take, right? Well, you're, you're 18 months into it and here comes Cisco and they buy you that, that happens quite a quite a bit. So we understand that founder's journey a whole lot. But at the same time, we just, we know a lot of founders, it just, the team didn't work. And, you know, a lot of businesses don't make it past that first year or two years, or they, they get into that zombie state where they're making services and it's a business, but it's not a product business, that sort of stuff.

Well, we bounce around the idea of tenable a few times already. So let's go into it. In a little bit more detail. In late 2002, you get started with this new company, and that company in the early days is focused on vulnerability assessment and management and ends up going and creating this new category, which is called cyber exposure management today. But in those very formative years, how did you pick Jack Hufford and Renaud Derayson to work together to go and start Tenable and How were you even dividing up responsibilities? Was it that you were CEO and somebody was CTO and someone was CPO, or were you kind of working together? How did you make that decision?

Yeah, I, I love telling the story because everybody really needs a great set of founders and a great team. And, you know, the way I talk about it is I had, I had Cindy, I had Jack, I had Renaud. They all worked extremely well together. And, and it was a really interesting story, right? So Jack knew Cindy and I. He had done the diligence on acquiring Network Security Wizards for, for InteraSys. So he knew how well Cindy ran the books, ran the operations, ran the board meetings, ran all that kind of stuff. And of all the companies they acquired, they said ours was the easiest, not because we were the, the smallest, but it was the most well organized. It just kind of made sense. Engineers running all that, that kind of stuff. So Cindy and Jack really did a lot of the initial, how does the company work? How do we do payroll? How do we get an office? How do we do all that, that kind of stuff? Renaud and I did a lot of the original coding. I had the CT— I, I was probably one of the few founders had the CEO and CTO style. Renaud's very public right now, but in the early days, Renaud was not as public. So I would introduce myself as CEO, CTO, and that's actually something I'll, I'll criticize myself for because I actually will call that out. And, you know, if you're a founder and you're the CEO, great. If you're technical, that's, that's great too. But, but I got lucky. I mean, every one of those people smarter than I am in their areas, and I can speak their language. So I could still speak code, speak architecture. The thing that I think I brought to Renaud and and Jack and Cindy was having been a pentester, having been, you know, an operator, I can put myself in the operator's shoes. Now I'm speaking the customer's language and everybody else's way. But the reality is disagreements, but we really agreed on a lot of things. I mean, and we went 15 years or so, became super, super successful. We really, really worked well together. And, uh, you know, I definitely miss working with those folks every day, but the culture that we put together is really kind of— I think Meet Your Ends doing a great great job. But a lot of times when I hear people who are working at Tenable, first thing they say is, love working here, love that culture. It's very enduring. That's kind of that gestation. Oh, there's one other story. You never know how you're going to do it. But when I was doing Dragon, we had worked with Renault on taking Nessus vulnerability scans and mapping them to attacks. Because one of the things you would do with network intrusion detection is you could see an attack go into a Linux computer. But if that computer in fact was a Windows computer, maybe you could ignore that attack. So having done that type of correlation with Renault, we were like, we knew about Nessus, we knew Renault, we thought it'd be really, really good to have that as part of the Tenable platform.

You talked a little bit about dividing up responsibilities. I'm curious, while you can work together as a team and you have so many folks in those formative years, who made the executive decision when there were these arguments between yourself Jack, Renaud, and Cindy, who was the person who would say, well, this is the way we're going to go after a debate?

Well, I mean, I was, I was CEO, so I got to make a lot of those decisions, but it wasn't like my way or the highway every day. You don't go 16 years making a unilateral decision, you know, all the time like that. So I wouldn't, I just, I almost feel a little uncomfortable talking about it like that. But the reality is we talked about it quite a bit, right? And there were a lot of things that when you really start to, like, I'll give you a good example. When we do like, okay, we're going to change the internal framework architecture of Nessus. Great. Are we going to suffer some customer features? Maybe for a quarter or two, but we're going to then do it. So Cindy and Jack would have a tremendous amount of trust of like Renaud and I when we made something like that. Another thing that we did is we switched today in 2024. I mean, everybody sells things. Everything's ARR, everything's SaaS, right? But back in the late '90s, you sold things perpetual. And he sold a separate maintenance discussion, right? Well, flipping from that to SaaS was tough, and Bruno, believe it or not, had a lot of empathy for the customers. And, you know, sometimes was much more on the side of, oh no, we can't, you know, we can't let the customers down, and, and that sort of thing. And then there's, you know, so it's, it's a really interesting, you know, discussion at that point. But I'll just tell you that the discussions we had were very healthy, very well respectful and it was, it was good. Now, the hard part though was when Cindy and I were on different pages, right? Because when Cindy and I were on different pages, it's sort of like, hey, mom and dad are fighting, right? And it's like, no, no, we're engineers talking about, you know, these situations and, and that sort of thing. And we recognize it does put people in a, uh, an awkward com— you know, an awkward position. But, you know, you don't, you don't hide the fact, right? I mean, it's, uh, voluntary related is how we like to talk about it.

Ron, Nexus was originally built as an open source solution for vulnerability scanning. And then in 2005, it became a proprietary software. Since you've just, you were just talking about subscriptions. What was the journey of monetizing open source nearly two decades ago? Like, how did you navigate it? Like, what was hard about it?

Yeah. So when, when we went through that, that was something that if people said, like, what was something you did well that was really risky? That was something we did really, really well because we were able to communicate communicate the change to people and communicate why we did it and, you know, give people alternatives. Like the, you know, we basically, the fork was out there, right? So it wasn't like we were taking it away from people, right? We, it was still out there. But the reality is like everybody thinks of open source as free and written by a community. Well, today, if I said open source, the vast majority of people focus on free. And they don't really focus on community, right? So the community who was doing the Nessus work was tenable. And we literally, we had like hundreds of engineers writing code and we said, this is not sustainable. Like this is not a sustainable, you know, sort of long-term thing. So we wanted to change that to make a better product for people because we saw all of these vulnerabilities coming and stuff like that. And also back in the day, we were actually also penalized for open source. We would go into deals where it would be like, if it's a half a million dollar deal and, and a bank would be like, you need to buy like half a million dollars of, of indemnification insurance because someday somebody might sue you and then sue us because of, uh, because of your, your source code that you're using. So, so we were, we were incentivized by the market to kind of go this way, you know, which is a really interesting thing because nowadays almost everybody's, everybody's SaaS offering has some open source code on the backend., but people don't know it or see it because it's behind a mobile app or behind a web. And, uh, you know, there's plenty of that stuff, that stuff floating around out there. But, um, but yeah, that was the biggest, the biggest thing I'm proud about with that is that we communicated it really well. We had some really good advisors on how to communicate that and put that out. And it was, uh, no, no regrets there at all.

So Ron, let's shift gears a little bit into the venture capital side of the journey at Tenable. So Tenable raised a $50 million Series A after almost 10 years of operations. First, talk to us about what that 10 years was like. You completely bypassed the classical formula that most founders use, which is I first need money to build something. And here you are saying, we're going to build it. And not only build it, we'll keep building it for 10 years. I mean, talk to us about that phase of the journey. How did you do it? What were some internal debates with Cindy, with Renaud, with Jack, all the ups and downs?

So the stories I like to tell about that time are for founders who are going through the struggle right now. So when we started Tenable, we were fortunate to, you know, have come off of an exit with Intera. So we had a little bit of money. We were not a couple less zeros than what we're dealing with today, so to speak, but we were able to float a payroll check. Here and there. And so when we talk to founders about going it and going through tough times and deferring salary and that sort of thing, it's really because we've, we've lived it. And what that allowed us to do is get to a point where Tenable was basically cashflow positive. And at that time we did that raise, we had $50 million in the bank. So people ask, well, why did you raise? And it was for a couple, couple of reasons. So, so one, you know, you really can't go public with somebody who owns 100% of the stock. I don't own 100% of the stock, right? But I had a good bit of it, right? It's a lot more than most founders, like the employees and the founders of Tenable. We owned that company. There were no investors that had like a third or 45%, right? So, so we were not diluted at all by, by that. But at the same time, that can get you an acquisition, you know, which is good. And again, that's a good goal, not wrong. But if you're looking to go bigger, you're not going to go public with that, right? So the story then is secondary sales. And this gets really obtuse really quick, but the reality is, is all those raises we did benefited the employees and the founders in such a way that they were basically pocketing money, you know, and then going back to work the next day. And we had multiple moments when we did that raise where like we pulled people into a room and we had to explain what secondary sales were and also have to say like, well, you could sell right now and pay off your house or hold it and maybe, you know, someday there'll be a public offering, right? That's an awkward and very fun conversation. I hope every founder has the ability to do. But then we also had like tactical issues. Like, you know, we were just being like, today it's different, but in the early 2000s, former NSA founder, lives in Maryland right next to NSA. I can tell you for a fact that we're doing $45, $40, $50 million of revenue, product revenue. Everybody else from California hears, oh, they're a services government contractor company, right? So raising $50 million from an excellent, you know, venture capital firm, you know, Accel Partners, was a really, really big statement. You know, so that was, that was where, uh, where we were, we were looking at the time.

That's very fascinating, Ron. Can you share with us how the initial contact with Accel occurred and then what was the post-investment phase like for the next few— before Insight stepped in with another $250 million check?

Yeah, so I give Ping Li from Accel Partners all the credit. So Ping would meet with Jack, then he would meet with me and Jack pretty much at every RSA and every Black Hat. And every year we doubled where we were last year, and it was just one of those things. We were machines. We just kept doing what we were doing because every year we thought, oh, maybe this will be the year we get acquired. So we weren't thinking about going long until we started hanging out with Peng. We had a couple other funds that were talking to us and stuff like that. But it's for the client, the employees we had at Tenable, again, coming from sort of the Maryland, Virginia area. You know, it's a different thing. There weren't companies going IPO in the cyber market. We were one of those first things. So it was really good to have Accel Partners come in and, you know, Ping and the team there came in and met the employees. You know, we did a lot of that. I mean, you know, they were minority of it, $50 million check, minority investors. That's kind of, again, a little uncomfortable for them too, flying to the East Coast. You know, that was interesting. Of course, you know, today this kind of stuff happens all the time, but Again, early 2000s, mid-2000s, it was, um, it was interesting. So then, you know, as we matured, we really got that pre-IPO type of thought. And, uh, we hired, uh, Steve Vince. And Steve Vince, the current CFO of Tenable, a local Howard County where I'm from today, joined and just completely transformed. And like, I have so much respect for, uh, you know, the team that got us to where that point. But when Steve came in, professional CFO, FP&A, all that kind of stuff. And all of a sudden I could start seeing 4 years, 5 years into the future. And with all sorts of models that really allowed us to start thinking about, oh, maybe it'd make a lot of sense to raise a lot more money at that secondary thing and take another bite at that apple. And along the way we had a couple M&A offers, didn't really take them, had to make some decisions there. But And I think any company on a run-up like that happens. And of course, I stepped away, you know, with the idea that Amit's going to take it public, and that's exactly what happened.

Well, I think that what you built is quite phenomenal. I just wanted to read some statistics for the benefit of our audience. The company had 20,000 customers at the time you went public. You know, that is a significant number. Now, what is interesting is that the average contract value, or ACV as we might call it, was $5,000 per customer. So that's how you were up almost about $200 million in revenues. Did the VCs fight back on the ACV saying that this is too small an ACV with a very large number of customers? You know, because most VCs, you know, we like six-figure contract values with a smaller number of logos, but here you are with exactly the opposite. Can you share a little more of what happened inside the VC conversations around these numbers?

So, you know, Tenable today, it's very different as far as what they offer than what than when I was running it. But when we were running it, you know, we basically had, had Nessus, which was a vulnerability scanner. And, you know, we, we added a lot of value to Nessus, but it was basically a single-user type of, um, of thing. And it went from an unlimited thing for maybe $1,200 a year to maybe a per-IP thing for, you know, a couple thousand dollars a year. And, and, but it was per-user thing. And then we had Security Center, which was really the enterprise offering. And you could buy some things for it, but that was the $250,000, the $100,000 thing. So you constantly had these two buckets of revenue that all had a little bit different there. And then, you know, we were a little bit late to the cloud game compared to some of our competitors, but we added Tenable.io, and that's where we've been pushing a lot of the customers, which is sort of a blend of you can't do as sophisticated of some of the analysis you need to do with Security Center, but it's certainly more sophisticated than Nessus. And of course, Tenable's done a lot of acquisitions, you know, since then. But, but the conversation was always, and this is where I go back to all the venture capital we do today, how do I license the thing that I sell? So I mean, at some points, you know, we had people using Nessus and we said, well, maybe if we gave Nessus away for free, we could charge a premium for these these enterprise insights and analysis of the data and that sort of thing. And on the other hand, you're like, well, maybe if you gave the analysis away for free, you could sell more Nessus scanners because more people will like that. And, you know, I don't think we ever got to an answer because, you know, when I was navigating it, it was, there were, you know, the GRC people wanted to add Nessus to what they were doing. There was no SOAR, there was no, you know, the SIEM guys wanted to add scanners to what they were doing. Of course now, you know, you've got people who do just asset discovery, like Axonius and stuff like that. And, you know, I would view that as competition, even though one's sort of IT management, one's vulnerability management. They're, they're related, but they're, you know, they're very, very different things. And of course, I didn't talk at all about the cloud and SaaS and mobile devices and all that kind of stuff. That's one of the reasons the Tenable product line right now is, they call it cyber exposure. Like a lot of those things don't even have, you know, IP addresses right now because they're ephemeral. They come and go. So that's kind of where we're at.

You correctly said, Ron, that the company is very different today. And as I was looking at the most recent financial materials that are posted on the company's website, it has almost 1,700 large customers, large meaning more than 100,000 ACV, and it's gone from $200 million revenues when it went public to today, it's almost north of $800 million. So It has added $600 million to top line in 5 years compared to 0 to 15 years, it added $200 million top line. So very different business. I mean, how do you as a leader see these two different phases of growth? You know, one was a phase of gradual sort of incline and the other is a very rapid scaling that Amit is leading.

Yeah, I was— so Amit's very good at that. Like, I mean, obviously when when we were doing all these things. He, he had a good career at RSA and NetWitness. He had some good time with the, the federal government for, for a brief stint as the czar. So he had a lot of exposure to how do we get a technology like this in the hands of a lot of people, right? And you got to have partners, right? You got to have the sales, so you got to have the branding and have all that, all that kind of stuff. So they've done an excellent job with this. Amit's been at this just as long as we have. When we did Dragon, we were working with him at his first cyber company called RipTech. So, uh, you know, I had a lot of confidence in him being able to, uh, to do this. But, uh, but for the most part, you know, when you have a brand that's iconic like that— I mean, you know, while I was there, we were able to get a DoD site license, federal government more or less site license, and, you know, do things like that all across the world.

You—

how do you build up on that? Well, you got to do some acquisitions, you got to maintain those partnerships, and you gotta— you gotta keep doing those, those, those kind of relationships. So I've been very happy with what they've been able to do, but I'm going to not pretend like I'm responsible for any of that stuff since I've left. I made the conscious decision to very much not hover and just, you know, be a fan, right? Like, some former founders want to hang out on the board or Twitter or whatever, and I really try not to do that.

Well, talking about not hovering, you know, you kind of have this 14-year reign from 2002 to summer of 2016, as CEO and co-founder. And then in the summer of 2016, you hand the keys over to Amit and you become a board chairman. And then you do that for another 6 months. And by December of 2016, you also resigned from the board, if I'm correct. And, you know, correct me if I'm wrong. And in January, you and Cindy go and start this new organization called Gula Tech Adventures. And the mandate in the early days was to focus on early-stage security startups But could you give us a sense for what was the strategy there? Because it was very different from— we've had Dmitry on and Dmitry invests in startups, but he's not doing it through some type of structured vehicle the way that you and Cindy are doing it. So give us a sense for why you did that.

So when, when we left, you know, we wanted it— we wanted to be active in cyber. And you can't be active in cyber and just do policy. You can't be active in cyber and just do philanthropy. And you can't be active in cyber and just do venture, right? I mean, people have careers in all three of those fields. But when you look at like the whole nation and some of the complexities that we have to follow, we really purposely called Gula Tech Adventures, Adventures, and not Ventures. And it's funny, more than once I've done an interview where they said, Ron Gula, founder of, you know, Gula Tech Ventures, you know, but it's, it's an adventure because we think it's all very, very related. And we're being very purposeful about trying to balance the, you know, all those different kinds of works. Now there's a lot of ways to slice this. I've talked to a lot of folks who are very philanthropic. Tropic, and they invest a lot, and you don't even know their names. And they're, you know, but they've got— they write big checks and that sort of thing, but they chose to be private. Now, you had Dmitry on at your last episode. Dmitry's doing Silverado Policy Accelerator, very public about that. He's very private about his direct investments and that sort of thing. He does a lot in cyber and outside of cyber. You know, we've chosen to do certain things. My point is there's a lot of ways to go there. We really found this balance And, uh, there's a great interview from some guy named Ross who basically called us a cyber impact hub, which I thought was awesome. I've used that a couple times for what we're doing, but the reality is we're trying to do a number of things. It's just be a resource to people who make policy, people be a resource to people who are inventing this because we don't have enough people to fight China and Russia. We don't have enough people to protect ourselves from ourselves. Like we're inventing more stuff that exploits our data and our privacy than I think the Russians and Chinese do to us on any given day. So it's, you know, how do you beat that drum and create an ecosystem that is doing that? Of course, we're not doing it alone either. We co-invest with a lot of great other funds. We do a lot of cyber philanthropy with other great cyber philanthropists. So, so there's a, you know, we're happy to be sort of doing our part.

Gulitech Adventures is indeed a very different organization, partly because if I'm not mistaken, up until now you have not officially raised the fund, correct? It is your own money that you've decided to put in towards the investing. What made you choose that path? Like, what made you not go out, just raise a fund and play with somebody else's money?

So we thought about it. We thought about it. You know, we've put a little bit more than $100 million to work and some of the money we've recycled. So it's probably a slightly bigger, bigger number than that. But the reality is when we left Tenable, we were responsible for, I think it was 600, 700 people. So the first few years of doing this, Cindy and I didn't want to hire anybody. We've got a great, great team right now. It's a small team, but we're going to try to just use our time and some equity to get things done. And now we're at the point we need, we need some help. But if I take a dollar from you, Ross, and I invest it, I feel like I'm going to have to give you a report on what I'm doing for that dollar. And I didn't want to do that, right? I'd rather attract people to invest in the companies that we're working with. And have them have the relationship with, uh, with the companies. And, and that's also something that's a little untraditional. Like most people in my position will do something called a special purpose vehicle where I'll get a percentage of that, but now I'm involved in managing that and, and whatnot. And I just, we just didn't want to do that. Plus, like, I think a lot of what we have to say is really important and they should listen to us, but we're not the only voice in the room. So, uh, if sometimes a family office is going to have, uh, just as much to say as another venture fund. And I want the founders to be exposed to stuff because I mean, first thing I realized in this business is a lot of VCs get really lucky, right? And a lot of times that you tell somebody do X, Y, and Z, you're going to do well. It's probably the right advice, but it might not, might not happen, right? So it's, we're trying to be, you know, part of the ecosystem and do our part, like I said.

So Gula Tech Adventures right now has over 50 companies in its portfolio. What have you learned since you've made the first investment? What are you now doing differently? How are you evaluating companies? And if, if something has changed, then what, what is it?

So what's, what's interesting is that you can work really hard on a company. First of all, what does that mean, right? If you're a founder, you're probably like, oh man, these VCs don't do anything for us, right? But, but if you look at the point of view from the VC, maybe you have 10 companies. Okay, so what do you do for those 10 companies during your 5 days of the week, right? You can do one introduction per 10 companies. That's actually a lot of work. You got to contact people. Do you really want to meet this company that has a cyber widget that does that? It's a little opportunistic. And so basically what I've learned is I've learned sort of two things. You know, one, when it comes to pitching companies, we want to know five things. What problem do you solve? How do you solve it? Give me some proof. What's your ask and what's your vision of success? And those five things are hard to answer for first-time founders. Like they're embarrassed to say, I want to go IPO. They're embarrassed to say that if I raise $500,000 from you, I'm going to make $1 million in revenue next year. They don't, they don't know that, right? But what do they know? What do they want to say? So we want to, we want to know those, those kind of things. And then the second thing though is that luck has a lot to do with this industry. Timing, luck, and it's not a reflection on the founder though. We have a lot of former military founders, former intelligence community founders who had stellar careers, stellar pitch decks, stellar idea. They go to market, falls flat, and they think they're a failure. They're not a failure, right? I mean, how do you, how can you predict the buying behavior of, you know, 100 CISOs in the federal government, for example, you know, that kind of thing. So there is a little bit of luck, a little bit of humility, and, you know, that's something we just want to impart onto those folks.

You know, speaking of luck, Ron, and timing, of course, you know, I recall a key management company I had invested. This was key management in the cloud in 2012. So 10 years ago, Everybody was so intrigued by the idea. They're like, how can you do this?

This is so cool.

Not a single buyer. And to add some salt to that wound, some of the buyers said, this is so cool, but do you really think that I'm going to hand over my keys to you, your little startup that's going to do this in the cloud? So unfortunately, that company was a loss. We had to shut it down. Another sort of market timing stories about homomorphic homomorphic encryption. I remember nerding out with this founder and he was like, yes, I could run full homomorphic and we could run so many operations on these blobs of data and blah, blah, blah. Andy Pectual, Chime is an investor, and Index wrote a small check. We all got excited, wrote a small check. 3 years later, like, you know, again, shut the company down. So, there are so many of these stories that we find in our journey and I couldn't agree more about luck, humility, market timing. I mean, these are things that are completely outside our control. You have this view of working with founders. I love the 5 questions that you sort of present to them and force their thinking into being very precise and crisp. What advice do you give them to stay tenacious like you have been, to build a culture like you did at Tenable, and, and more importantly, not to lose this essence of being a good human being.

So it's different for every founder, this concept of being a good human being, like what is the right thing to do? And just like many funds, we had companies that had to do layoffs over the last year or two years and they had to cut to profitability. That's tough, right? So I really felt like some cases, board meeting, very antiseptic. Hey, this was done. Maybe call the founder after, hey, how'd it go? Like, are you doing okay? Right? You know, where are you at? Right? So A little bit of that. Sometimes it's a little bit of, look, you have to do this or you will be out of business in 6 months. And that's tough, right? Having said that, I've also been involved with a lot of companies who have just had great cultures. They've really nailed it. Some of the founders I'm working with are wise beyond their years as far as building a culture and rapidly removing people who might be a counter to that culture and that sort of thing. But what I've found is my style is not everybody else's style. So I'm a little hands-off when I let people run the companies the way they want to run them. It's their companies, you know, that, that kind of thing. But there's a lot of ways you can do things. But also, you know, being a CEO today in 2024, when you look at the world politics, when you look at what's going on in the country, it's a lot different than when I was CEO, right? There's a number of things you got to deal— you got a lot of legal things, you got a lot of political things, you got a lot of sensitivity things. So I do spend a little bit of time, you know, making sure people are not overly focused on things that aren't counterintuitive to their business, but at the same time, you've got to be sensitive to all of those kind of things as well. What I really like is when my portfolio companies work with each other. So I've got a couple OEMs and cross-customers, cross-licenses. That hardly ever happens in the industry. And I think the fact that we have any, I'm quite happy about that. And we also, we do our Gulletec event parties and cigar parties and that sort of thing. And that's always, again, I like that cigars and bourbon. Some people might not drink, they might not smoke. They don't have to come, but you get to kind of do things that you want to do. But that's how we kind of bring that culture kind of back to everybody else.

Well, for the last part, you know, as we come to the end of this session with you, Ron, we wanted to talk a little bit about Ron the influencer. And perhaps the first big question I have is you have this organization, Gula Tech Adventures. But alongside Cyndi, you also have Gula Tech Foundation. And with Gula Tech Foundation, you're trying to support nonprofits. And your mission is to defend the nation's cyberspace. Could you give us a sense for what are the problems you're trying to solve? How does the foundation even work? And what are the types of initiatives that you hope the foundation will support?

So when we first started Gula Tech Adventures, you know, we've always been philanthropic. We would put— we would do a donation. I think one of the first ones we did was like NPower. NPower is a great organization that just helps people who can't, you know, get the education they want in cyber and IT and kind of put them through a system, helps them find a job. Great. But we would list those things almost like investments on the website. We used to have a website with our portfolio companies and our philanthropy. But what we weren't doing is we didn't have the bandwidth to join the boards of all those, come in and work with them on a daily basis and stuff. So we were, we really wanted to do something that could help them the most. Without— I mean, with a small organization without tying up our time. So Cindy's idea was to, you know, do the foundation and basically make it a competition. And because what happened is we get these pitch decks, people just email, they find us on LinkedIn, oh, I want you to look at this deck. Well, we'd read the deck, and this is where we came up with the 5-slide pitch deck, by the way. We're reading this, we're like, we really don't know, is this a nonprofit or is this a for-profit company, right? Some people's decks weren't that good. And then from that, not only did we get the 5-slide pitch deck, but we realized the nonprofit's journey was basically identical to a startup's journey. But rather than raising a seed A, B, and C, you know, if you got a, maybe a grant from a foundation, maybe you could get a grant from Department of Homeland Security. I don't think people are aware how much the federal government gives to nonprofits in cyber, for, you know, for example. And maybe if you do that, Maybe you get an even bigger grant from like Microsoft or Google or something like that. And that's exactly what goes on in there. So we recognized that design pattern and said, we're going to just not write checks and not talk about it. We're going to make it a competition and make a big deal. So we got a grant committee. We also want to be very purposeful. And so we did topic to topic to topic. So one of the topics, first topics we did was increasing African American engagement in cybersecurity. So nonprofits out there that, uh, that focused on that sort of thing. And we've done about 7 of these grants. We didn't do a grant this year. We're very focused on just, we're kind of retooling a little bit. We're going to probably make some announcements down the road, but the grant structure was really good. Almost everybody that received a grant from us went on to get a bigger grant from somebody else, much like in the venture capital world. So I'm very happy about that. We list everything at, if you go to gula.tech, gula.tech, go to the foundation page. They're all listed there. Sometimes we've done videos with these, these organizations to get a sense of what they are. My last plug for people, look, in cyber, there's a lot of people who have the imposter syndrome. I don't know why that is. Uh, cause I think everybody I meet is really, really good, but man, you want to feel like you're giving back, volunteer at a nonprofit. It doesn't necessarily even have to be a cyber nonprofit. Go to your local hospital, go to your, go to your town and just see what you can do. And believe me, you can do a lot. The nation needs everybody in cyber to do, you know, do their part.

Talking about different ways of influencing the industry, over the past several years I've built Venture in Security, and last year it has achieved over 500,000 reads, which is, it's a lot for a blog. And frankly, I know how hard it is to create consistently valuable content. Given that your YouTube channel as of right now has over 100,000 subscribers, What motivated you to start creating content? How much time do you allocate to do it? What does the process for you look like?

So it's interesting. When we first started the YouTube channel, I was going more for like a Joe Rogan type of thing. I put a lot of effort into being able to sit down with good quality microphones in person. And then COVID happened, right? So I literally, I mean, we do this out of our home, having strangers. Well, not strangers, but you know what I mean? People come to the house and sit there and do the interview. And, you know, we do some, and we were able to score some really interesting interviews back then, like the, the cast of the reboot of MacGyver and, and stuff like that. But, you know, getting a following— I mean, Ross, you're very gracious to bring, bring that up, but it's no small task. Like, you've got to be on top of the content and the, the SEO and, and just do things in the right, right things. But for us, when we switched from doing the live interviews to more just me talking about a topic with some fancy graphics or something like that, that seemed to really resonate with a lot of people. So I've doubled down on that. We've been doing like one episode a week. We're up to like 250 episodes. And, uh, you know, I think the fancy graphics help, but that's a gimmick. It's, I think the content is really what sells. The other thing is that it's not just cyber, like we focus on startup messaging. So, you know, we'll do how to name your company, but we'll also do like obtuse topics like, you know,, uh, when, when should you defer salary if you're having payroll, you know, if you're having cash flow issues, right? And that's a tough thing to talk about. Um, but, but that got, that seemed to resonate with a lot of people. So we're quite happy with that, that following, and we're going to keep putting some more effort into it. I, um, I really like, everybody says they know AI. So my excuse for spending time with the graphics is everything I do has some sort of AI technology behind it. So I feel like I'm working with, with AI. If you've seen some of the videos where the characters just talk to each other, 100% AI-generated. Didn't move a keyframe or anything like that for that stuff. So it's crazy how far that technology comes.

So Ron, here you are, 3 decades of innovation, entrepreneurship. Now you're giving back to the community with a very big heart. So look at the first phase of cybersecurity. It's about demonstrating your intellect, demonstrating your ego, demonstrating your skill. And now, you here are demonstrating a big heart in your philanthropy and the work you're doing with your videos, which by the way are so cool. In fact, I particularly enjoyed the one where you talk about how a booth can be designed so that it attracts the right kind of traffic in a show like RSA. It's such a simple topic, but nobody has done that. So, thank you for continuing to keep your creative juices alive and continuing to innovate yourself. I think for a lot of us, you will be the Joe Rogan of cybersecurity, or you might be the Top Gun, you know, Air Force pilot for cybersecurity. But as we look at your next phase of your journey, how do you continue to challenge yourself? How do you think about what the next 5, 10 years of Cindy and Ron Gula would look like?

That's— thank you for those comments. I mean, we put a lot of effort into the investing, the philanthropy, and getting that out. So I appreciate those comments. You know, I, I think if anything, anybody who's going to try to predict the next 5 years is, it's tough. I think we've got a good view of things because we get pitched a lot of stuff. So there's a couple, couple things like we spend a lot of time with policymakers and everybody wants to know how can we get the DOD more secure? How can we get the nation more secure? And I mean, we've seen so many different things. Our answer there is we want, we want people to think of, you know, IT and data like healthcare and just call it data care. And I was literally like, I'm an advisor for the Military Cyber Professionals Association. And we had a, I don't want to go into a whole lot, but the comment was, look, even though this is the military, you know, some of this stuff is care and feeding of the data. And it's kind of, we need to make the people who are patching the systems feel like they're just as important as the people who are hacking Iran and, and China and Russia. So unless until we have that mindset, you know, where we can get cyber people to be just as well respected as a doctor. Or a lawyer, you know, I think we're going to have a hard time there. And the second thing we're tracking is AI. And I mean, I think there's a lot of opportunities for productivity and for the betterment of humanity, you know, with, with AI in general. But there's a lot of opportunities for things to happen where, you know, only certain companies control the AI and, you know, they get to see what we're asking, kind of like what happens now when we query Google and and stuff like that. And that, that can really, really hurt society, especially if things go a little bit more draconian than they have been, you know, in the past. So we're tracking a lot of that stuff. You know, there's— disinformation is such a big problem right now. I'm actually working on a video where I have somebody from the future come back to RSA and they have a conversation about how they, they, um, do things. And they literally say, well, you know, We really don't know much about IT security from the 2000s because of the AI and disinformation wars, right? And it's so you never know what's going to happen, right? But that's really what we're looking at. We're blessed. We do a lot of really fun things and we get to go to a lot of fun places, but we're pretty focused. I mean, every year I go to RSA and I'm like, this is my last RSA. I'm never going back. And then I leave and I go, oh my God, that was so much better than what I thought it was. I'll come back next year. —because it's important, the work everybody's doing.

Well, thank you so much, Ron, for being so generous today with your time, talking about pre-Tenable, the early years, the formative years, starting two companies, then starting Tenable, then your investing background, all of the work you're doing today to influence the industry. For our listeners, what's the best way to connect with Ron, hear more about Ron? Should they just search Gula Tech Adventures, or is there specific channel or way you want folks to subscribe to you?

LinkedIn's the easiest way. So I'm Ron Gula on LinkedIn. You know, I got my start in computers from my dad. My dad's also Ron Gula and he has a LinkedIn account. So if you see a guy without a picture that doesn't have gray, that has gray hair more than mine, that's not me. That's my dad. But having said that, LinkedIn's fine. You know, if you come to the YouTube channel, check it out. You know, what I'm always looking for is if people have questions. I usually get people, hey, can I come pick your brain? I'm like, that's one of my most annoying asks because I do want to say yes, but I'm like, chances are the questions you have, I've already done a video on. So my feeling is if I haven't answered somebody's question, send me that question. I'll make a video and we can talk about it. So that's the best way to get a hold of us.

Thanks so much, Ron. Thank you.

Thank you, Ron.

Hey, thanks for the opportunity and good luck with your launch, guys. It's going to be great. You've got some great guests coming up.

Thank you for joining us Inside the Network.

If you like this episode, please leave us a review and share it with others.

If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and send it to me first.

No, don't do that. Mahendra gets too many gifts. GIFs already. Please reach out by email or LinkedIn.