A robust cybersecurity program takes more than software, it takes the right people.
Brian M. Ahern, CEO of Boston-based cybersecurity company Threat Stack, who has spent 16 years in the business believes that axiom to be true.
“Companies continue to keep buying technology, thinking that technology is the answer,” said Ahern. But expertise – that costly human behind the scenes – as well as good strategy are also needed to secure systems and data, he said, especially as organizations now rely on others’ servers through cloud services and storage.
Ahern has spent 16 years in the business -- In 2002, he founded Industrial Defender, a cybersecurity firm protecting control systems for the oil and gas, utility and chemical industries. That company was snapped up by Lockheed Martin in 2014.
“Our focus as a company is really to enable businesses to securely and competently embrace the benefits of the cloud, while also … helping them to address the skill shortage,” he said.
Founded about six years ago, Threat Stack has grown to a full-service cybersecurity company in Downtown Crossing, employing 150 and serving 450 customers. The company boasts of not only using technology and people to detect cyber break-ins, triage compromised systems, and thwart threats, but also to spot and plug holes that bad actors can penetrate. The company has raised more than $72 million from investors such as Eight Roads Investors and F-Prime Capital Partners – with a big $45 million raise last year – and expects to bump its headcount up to 185 by the end of this year. Last week, the company named Pete Cheslock as vice president of technical operations.
BostInno spoke with Ahern this week about securing organizations on the cloud, building up Industrial Defender, and Threat Stack’s eye on possibly buying other firms to expand, its fundraising plans and whether going public is in the cards.
Ahern's main argument around security is that as companies move to cloud services, they benefit from the ability to scale up, but increase their risk of attacks.
"The movement to the cloud obviously moves the entire physical stack out of our customers’ environment and into the cloud service providers’, so they no longer have physical-access controls around it. They are relying on the cloud-service providers to provide a certain amount of protection inside their data center," he said.
But while cloud-service providers say they will secure the "perimeters" of the cloud, they're not protecting what's inside, he said. "Where the applications are running and data is being stored, they put that responsibility onto their customers."
And the threats are many, as the headlines tell us so often -- routers are at risk, cities such as Atlanta prove vulnerable to cyber attack, a bug can infect websites like Comcast's and email is now eyed as the weakest link of computer networking. Bad actors often come in the form of angry employees or other “insiders,” said Ahern, but also through stolen passwords, accidents, even foreign-nation states infiltrating cloud servers.
Yet, he said, a lot of companies sacrifice security for speed.
“There’s this interesting dynamic where the market is looking to leverage the benefits of the cloud and are willing to put security at risk because of it,” he said. “The movement to the cloud is really transforming the way security teams and operations teams need to work together. Historically, in the traditional data center world, you could have a security team and operations team that work autonomously from one another. But with the movement to the cloud, these two teams need to coexist to effectively secure infrastructure.”
Though Threat Stack primarily serves U.S.-based companies with under a billion dollars in revenue, the business is now looking to expand in West Europe. The company could also grow by buying up other firms to enhance intellectual property.
Reflecting on his role at Industrial Defender and lessons he brought to Threat Stack, Ahern said the two companies contrast sharply because the former took in no venture capital.
“We bootstrapped that company and ran it. You learn a lot about how to run a company in both the ups and the downs when you’re not relying on venture capital,” Ahern noted.
The gig also taught him how to look at security and compliance from a business perspective.
“If you look at security, it’s nothing more than an insurance policy, and compliance is nothing more than a corporate tax. Neither one of those has a justifiable return on investments unless you’ve been breached or have been fined. The real return on investment comes when you can leverage automation to drive operational efficiency inside an organization.”
The CEO said he brought that concept to Threat Stack, transforming it from a “point solution” to a full-service company by 2016.
Now, armed with enough capital to run the company into early 2020, ThreatStack might just have a shot at going public.
“I fundamentally believe that there is an opportunity for cloud-native security companies – maybe one or two of them – to go public in the next three to five years,” he said. “And I like to think that the combination of our uniqueness and our growth puts us in that conversation.”
Ahern was tight-lipped about whether an acquisition was a possibility.
But he did offer: “What I do know to be a fact is that at our stage, right now, we’re not a candidate to go public. … But I genuinely believe there will be a cloud-native IPO and I’d like to think that Threat Stack will have a strong seat at that table.”
