Listen to the Audio
Enjoyed this podcast?
Share it with friends now!
Ryan Corey and Ralph Sita, co-founders of Cybrary, get an opportunity to interview Ron Gula, Gula Tech Adventures co-founder, former Tenable co-founder, and CEO, and Cybrary investor and board member. Ron talks Ryan and Ralph through his experiences as a tech, a business leader, and now an investor.
Ron's journey covers start-up development, fundraising, building relationships with investment stakeholders, and investment deals and flows. Ron has a unique insight into tech start-ups and uses this to support the next generation of start-ups globally, with a specific focus on cyber in the Mid-Atlantic region. His experience with creating new ideas, executing them technically, and bringing business leaders on-board lets Ron really connect with his technical audience. This mix of technical and business experience seems to be one of the keys to Ron's success in both the start-up and investment industries.
Ron shares with Ryan and Ralph his 5-slide PowerPoint for pitching to investors, and tips on what he looks for when investing. Issues such as the qualities he looks for in founders and the common mistakes he sees start-ups making when looking for A-series investors are just some of the topics that are covered. The trio discusses, in-depth, investments Gula Tech Adventures is currently making in the cybersecurity space. Ryan and Ralph share some interesting developments for Cybrary. Ron addresses why he has invested in Cybrary, the cyber skills gap, and how Cybrary fits into the picture.
If market trends in cybersecurity start-ups or tips from successful entrepreneurs for any stage of your start-up journey make you tick, tune in now to hear the open discussion between Ron, Ryan, and Ralph.
You can reach out to Ron on Twitter (@RonGula), or LinkedIn (Ron Gula). Or if you want to get in contact with Gula Tech Adventures about investing, you can send an email to firstname.lastname@example.org.
Ryan Corey: So glad to have Ron Gula here today. Thanks for joining us, appreciate that.
Ron is not only an investor in Cybrary but has also recently joined our board and has been a part of what we've been doing for several years now since the very early days. So we're super happy to have you here.
And I think today, what we're going to try to focus on, for the most part, is going to be around investment and what you're working on in the cyberspace in particular.
So why don't you start us off Ron, with an introduction of yourself, your background, and then what you're working on now
Ron Gula: Ryan, and Ralph, thanks for, thanks for having me. It's a pleasure to be here.
Ralph Sita: Thank you.
Ron: So a long time ago, it was born in upstate New York, and we're not going to go that far back, right?
Ralph: Yeah, skip ahead a few years [chuckles]
Ron: You know, I was pretty lucky when I was in the military, that my last tour was at the National Security Agency.
And while I was there, nobody called it cybersecurity. But basically, I was doing penetration testing and assessment, so large government networks, and I was doing this all like mid-90s and I thought this is only something big governments do. 25 years later, I'm still doing pretty much the same things, right? Helping people understand what's wrong with their network and what they could do to fix it and try to understand that. So, you know, along the way, I got to work with some amazing companies. I worked for a BBN; they invented the Internet. I got to work for USinternetworking; I kind of think they invented cloud hosting for SaaS.
While I was at USinternetworking, I had to deal with some hackers and I was using a system called Internet Security Systems. And it was a network intrusion detection system and I said, “Boy, I think I could write one kind of better than this.” And I wrote one called DRAGON. My wife, Cyndi and I, we ran that company and within 18 months of starting that company, we had sold it and had site-wide deployments at some big banks, part of the DoD, America Online, and stuff like that.
Ryan: 18 months?
Ron: It was pretty damn quick. And the folks we sold it to was Enterasys Networks. And the gentleman who was on the acquisition team, the business development team, Jack Hoffert, we became really good friends.
Ron: And we said, “Boy, we should go start a company, that's sort of the opposite of intrusion detection. Let's do this holistic monitoring of the network.” And we started Tenable Network Security.
And of course, we’re probably gonna talk about Tenable a good bit, but a long story short, I was CEO there for about 16 years, left, and I really got involved - both Cyndi and I got involved - with cyber investing. Everything from startups, all the way to pre-IPO companies.
Ralph: That's amazing. I mean, just the fact that you started a company, sold it after 18 months and just kept rolling into the next thing. Was there ever any, like, “Hey, let's take a little breather”, or was it too early in the ball game for that?
Ron: When I sold, so the first company was called Network Security Wizards. When we sold that, I had a lot of people tap me on the shoulder and say, “Hey, you should have raised, you know, 30 million dollars. We could have increased your exit and whatever”, but then all the things that we're going to talk about today were very, very apparent to me. You lose control, you get diluted. Now you're kind of working for somebody else and you're not working for your customers. And those were great lessons to learn really, really early on.
And having done it again at Tenable, of course, not 18 months, almost 18 years. We're trying to do that now with Gula Tech Adventures, where we're investing and trying to help that next generation of people all over the world, but frankly, a concentration here in the mid-Atlantic region.
Ryan: Yep. So obviously Cybrary is one of the companies that's on the portfolio of Gula Tech Adventures. Why don't you tell us a little bit about some of the other companies that you maybe recently invested in or earlier on invested in, and who's exciting you right now in the portfolio.
Ron: Yeah. So the big thing, when we started Gula Tech Adventures was we thought about going out and raising a fund and doing something a bit bigger, but we also wanted to start small and, and get better. Giving small advice, small amounts of money, but we've really increased things over the last couple of years.
So when we started out, we did a lot of what I considered angel or pre-series A type investing. Now we're doing mostly series A and we're actually funding other funds. So some of the committees that we've done that are in the area, right around the corner from you guys is Inky, they're a phishing AI email security company, up in Maple Long.
We not only are investors with DataTribe, and we work with a lot of their companies, but also RackTop is in there. And RackTop is a secure data storage. They talk about cyber convergence. You think about all the ways to store your data and all the things you need to bolt onto it. They got it all built-in and it works in the cloud. It works on-prem. It's pretty cool.
Ryan: How long have they been around?
Ron: They've been around for [pause]. I think they're approaching eight or nine years.
Ryan: Oh wow.
Ron: And the reason I had to pause for that, because they had RackTop Federal, which was a consulting company, and then they focused on this product company called RackTop Systems. So they recently sold that, which is an interesting way to help raise money for your company. Of course, down in D.C., we've had SCYTHE. I think you guys know Bryson Bort.
Ryan: Yeah we hear great things about them.
Ron: He’s got a great red team platform there, but I always like to say, if you want to see if China's hacked into your network and how good you are at detecting it, just go at it by site and then deploy it on your network and see if people can find it. If they can, you're probably good and if not, you probably got some hygiene and some processes and maybe some people to worry about there. So all sorts of fun companies in the area.
Ralph: Well, we'll go on that because I'm curious. I mean, you first started investing in companies and now you're starting to fund funds. What's the difference in the level of involvement that you have at both? I mean, you're talking to two founders right here, neither one of us knows what tomorrow's going to bring. We hope we do, but we're always looking for advice. How do you advise the fund? Or are you just a passive investor? How's it work?
Ron: So the thing that we had to realize at Gula Tech Adventures is that we're really unique. We're not a $300 million fund where you have to have LPs and you’re reporting to them, and you have to make big bats and get every penny back.
At the same time, we're not really angel investors either, we're just kind of investing a little bit of money, not really with any knowledge of - not that all angels, but you know, a lot of angels will invest outside of their swim lane. We are clearly staying in cybersecurity and we're trying to focus on things that we find interesting and interesting could be an interesting founder. I think you guys are going to do, I mean, Ralph, you're on your second company right here, so to speak, right? And Ryan, how old are you? 21, 22?
Ryan: Close to that.
Ron: You've got a couple more companies in here, right? So that's a lot of the stuff we look for in that, but at the same time we get people pitching us on their series B perhaps it's rally companies trying to come to the US for the first time. So we also look at it, does the cyber technology make a difference for the market? And if the technology is just not something that's 5% better than the current if it's truly an innovative thing, it's going to save the good guys from the bad guys, either reducing their costs or making them better at what they're doing, we want to make that really good. SCYTHE’s a great example of sure.
And there's a lot of the companies we're doing are, they're a little contrarian. Maybe they're not fully in the cloud, they think it’s going to come back. Maybe they don't believe in hygiene. I'm a big hygiene believer, but maybe they think you've got to do more hunting. So we're trying to support as much of that new stuff as we can.
Ryan: So that's the reason to also fund funds because your reach just widens basically?
Ron: Yeah, so the other thing is that being cyber industrialists, as I like to call what we're doing at Gula Tech Adventures, we don't have a huge staff, right? So we try to co-invest with other funds, we've done a lot of work with our portfolio companies. We've also done a lot of work with companies that we just really like, for example, Paladin, we've done two or three deals with them. ClearSky, we've done a couple deals with them. And it's nice to be able to have them bring folks from Gula Tech Adventures as an outsider, but also we kind of share deal flow, share industry news. I think I've been invited out to some of our portfolio funds like their off-sites and just get a very different perspective of the market. The big thing for us is I kinda counted it all up. We're in just about 50 companies with either direct or indirect investments through the other funds.
Ralph: That’s amazing.
Ron: So it's a great reach for the region.
Ryan: Yeah. One of the people who you could argue Cybrary may not even be here today, if it weren't for him, believing in us as our very first believer is Justin Label. And Justin recently raised a fund, which I believe you guys anchored. Gula Tech anchored that fund.
Tell us a little bit about what Justin's sort of thesis and focus is and how you guys have been able to work together.
Ron: Sure. So, Justin, I consider to be not only a very, very savvy investor in cyber, but he's a professional venture capitalist, right? So he worked at Bessemer for many numbers of years, his hit rate on companies is quite high.
I first met him when I spoke at a MACH37 event, just as we were thinking about starting Gula Tech Adventures. And we actually, co-invested a number of companies, like you said, he introduced me to you guys here. And we also had a couple of other companies that we've invested in together, including SCYTHE, including Protego, which just got acquired by Checkpoint.
And it's been really good. He has the same attitude on the region that we do. His approach is a little bit different than ours and a little bit different than DataTribe. And I kinda think it takes a lot of people with a lot of different approaches out there. Justin also has another foot clearly in the Valley, so he will make an effort to travel out West, understand what's going on in Silicon Valley. Understand what kind of techs out there. And there's a lot of differences between East Coast and West Coast cyber companies and software companies. So Justin's got a really clear view of both sides of the country here.
Ryan: Let's expand on that because that's too interesting of a point to leave on the table. What are some of those? You said there's a difference between sort of East Coast and West Coast cyber companies. What did you mean by that?
Ron: So, I don't want to be stereotypical and throw everybody into these categories. But in general, what I see from an East Coast company is that the tech is overdeveloped before the fundraising happens.
And from the West Coast companies, the concept is overdeveloped before the fundraising happens. So we'll really clearly see some companies, they'll pitch us on these amazing - again, I don't want to swimlane anybody's products out there, but you know - stuff that we've seen before, right? Intrusion detection, orchestration, authentication, amazingly built products on the East Coast with no real concept of go-to-market, who their competitors are or things like that.
On the other hand, I'll see West coast companies come out with amazing ideas. Really next-gen stuff and no code and maybe a PowerPoint, maybe some stuff like that,
Ryan: And funding in their pockets?
Ron: No they're trying to do that right now. Of course, not every company fits in, but those are the trends.
Ryan: So you can often raise with sort of a concept on the West Coast. Whereas you typically don't see that here on the East Coast, where if you're just a concept and you don't have any sort of revenue or customer traction….
Ron: But I think if you're a savvy investor, you really want to see both, right? You want to see a great idea with some proof. And I've actually written about this with the five slide pitch deck, which we can talk about a little bit. But ultimately, I've seen a lot of these great companies; the hit rate on investing is still not high.
You can have a great idea. Maybe you talk to 25 companies, you get two, maybe three term sheets. I don’t know the last time I had a company that got more than three or four term sheets at once. And that's usually after running a process where you're pitching five, six, seven, eight, ten people. Typically what happens is somebody is the first one to say, “I'll do an investment,” and then that'll come along; and that'll happen for East Coast companies, it'll happen for West Coast companies.
For those that struggle, all the stereotypes, like very often an East Coast company will say, “Oh, there's no funding here on the East Coast. We'll go to the West Coast.” And they'll do 10, 15 meetings and they might get one more investor when they might have done 10 or 15 meetings here by going to St. Louis or up in Boston or something like that.
And same thing on the West Coast; I've seen a lot of people who do their fundraising and there's usually something that's holding it back. Maybe it's valuation, maybe it's the competitiveness of what they're doing, maybe it's the long-term belief is not aligned with what the customers, what the venture capitalist wants. So it's very interesting.
Ralph: But you also mentioned that on the East Coast, you've seen a trend where the product is further along developed than it would be per se, on the West Coast side of the house. Is that something that’s indicative of the Maryland/Virginia/East Coast/New York mentality? I mean, do we have to find perfection before we're brave enough to bring it to an investor. Is that what you're seeing?
Ron: I think there's a trend there and it's changing. It's not like I never see a Maryland or Virginia startup that's at that early - of course, you want to talk as early as possible - but a lot of times I'll see code demonstrating proof of concept on my first meeting and I'll have a better sense of what the product does then what problem it solves. And that's a problem. That's definitely a problem.
Ralph: In fairness though, to this region, we're new at it, right? The East coast is new at asking for investment, as opposed to the Silicon Valley, the West of the left side of the...
Ryan: In particular, our region too, D.C.
Ron: Yeah, there's a couple of forces driving that, so Maryland was the center of venture capital, right? You had NEA basically born here in Maryland, right? You have Greenspring here now. These are old, huge funds. That the problem is when you make a lot of money, it's kind of hard to focus on the small things. And cause you only can put a little bit of money to work you have to do indirect investing and then you're having that same problem out West.
So constantly I will get calls from other funds, “Hey, Ron, can we do an introductory meeting? Can we share some deal flow, be nice to work on some things together,” because it's so hard to get those things.
Ryan: This is VCs? VCs reaching out to you on the phone?
Ralph: I was going to say your inbox, your cell phone has gotta be busy, quite a bit with just those inbound reaches.
Ron: But it's a lot of fun. I try to take it very personally and try to have good conversations and try to, cause sometimes companies can do all the right things and the market changes. Well, if the market changes.
It's like you might like Italian food, you might like seafood, so you want to invest in those kinds of restaurants. Well, if there's a burger joint that flips to Italian food, I know to call Ryan. It's literally the same thing with venture capital. If you kind of know what people like or what they don't like, you can kind of be a lot more efficient about doing these introductions and trying to grow the ecosystem.
Ryan: That's a great point and a lesson that we certainly learned kind of early on in raising money. Cybrary to date has raised $23 million. A lot of time was spent on the fundraising process. And so we kind of went down that path, we would take meetings with basically anybody, any fund that reached out to us. And what you come to realize is some of them just don't play the same ball game as you, they're not looking for your type of thing yet. You're wasting some time speaking with them.
Ralph: Or they're looking for someone two years, three years down the road too, which is hard to believe when we were trying to raise money, that they would take those types of interviews.
Ryan: And that's about building relationships too, right?
Ron: And if, in your guys' case, not only are you a cyber company, but you're also a training education company, so there's a lot of funds out there that would be interested in those kinds of things. And that's good.
So a company like Huntress Labs. Kyle, so clearly it's an endpoint/malware/EDR type product, but at the same time, they're focused on the NSP; the small IT. There's a whole other set of investors who might be interested in having a piece of that platform just because of how they focus on small businesses.
Ryan: Sure. That makes sense. So you mentioned something pretty interesting. I'd love to hear you talk about the five slide pitch deck, and also would love to hear your perspective on, you're not obviously not investing in every company that you meet with, so what are you looking for when you go in to make a cyber investment?
Ron: So we got like, what? five minutes to cover that. So when Tenable went public, 18 - I almost said last year, but welcome to 2020 Jenkins - when we went public, we actually had a couple of fundraising efforts and we had raised a good bit of money on the way up there.
And you go and you do these meetings and then almost like after a football game, you sit down with your coaches and try to figure out what you did. It's all about time management. If you're going to go in and pitch a fund, what are you going to say first? Literally, the chit chat that you do about, the Ravens or politics, is daylight you're burning doing that.
So it's the same thing. When you just have a slide deck, if somebody emails me a 30, 40, 50-page slide deck, and I get those like once or twice a week. How long do you think I'm going to read that? So it's tough and out of frustration, one day I'm like, “Look, all I really, really want are these five things.” Now, of course, who you are, where you live, you know what... - that's important. It's not the first thing you should say. If you've been on CNN. That's awesome. It doesn't mean you're a great product evangelist or a product manager. So the five things are real simple.
So what one is, what problem do you solve? Real simple. You have a hard time getting people to say, what problem do you solve? Why should I buy your product?
Second thing is, how do you solve it? A lot of times people confuse those things to lead with the “How do I solve this problem?” before describing the problem.
The third thing is, I want some sort of proof. I don't care what the proof is. It could be a patent, it could be a pilot. It could be a demo. And I've had all these kinds of things.
What are you gonna do with the money? What are you asking for the money? What do you want? And it doesn't have to be a full 99-point plan, like, “Hey, we want to raise half a million dollars to hire three developers, three salespeople, and get us to our series A.” I want a concise tweetable statement.
But then the last thing is a little bit more open, it's like, what is your vision? Do you have a sense that this is an acquisition? For your feature for somebody else's platform, are you going to build a public company? Are you going to open source as is your business model such that you're going to open-source something yet still make some, some good money? So the world can benefit from this. What vision do you want? And part of that also is what's the vision for you and your family and your employees in your company. And those are the five things I'm kind of looking for.
Ryan: I love that last one. I love the fifth one with, getting them to sort of paint you a vision for where this thing could go. And then the outcomes that are attached to that, because I think that that's one of the key things in maintaining a focus of being successful in building a company is you really do have to have this broader picture. And if you don't have that in mind, you're not marching toward something all in the same direction together as a team. So that's super interesting.
Ralph: Could have used those five points about five years ago, Ron, where were you?
Ron: Yeah, right. Yeah. Was busy working, getting Tenable above 150 million in revenue or so
Ralph: You get a pass.
Ron: Yeah, that's right. That's right.
Ryan: Okay. So then the second part of that there, what are you looking for in an investment? You see a lot of decks, what is it that sort of gets you over the hump to invest in a company?
Ron: So the return is important, but it's not the driving factor. If we think we're going to make money on a company - I mean, God's blessed us, we're doing quite well at Gulas. So if we see a company that is fun, it has got people that we can trust, people that are going to do something after this round. This is the thing I say, and you'd be surprised how often it doesn't cause, the best thing somebody can say to us during a pitch is, “Hey, once we're successful, we want to go and invest in other companies, as well.” I get that every now and then I can test that a little bit, but that's usually what we like. And we've had a number of our portfolio companies invest in other companies. I think you invested in -
Ron: NanoVMs - Thank you. Very good. But that's good. It gives you a broader sense of that. And then, you know, is the problem that's being worked on a tough problem. Something that's desired to be worked on. I mean, the world does not need a... - I don't want it - I've been so wrong on so many different things. So if you can convince me that the world needs another thing, then I'm good. I'm good with that. I certainly don't think that we are oversaturated with solutions. The awareness of what is needed is what's lacking. So I do think there's a lot more room for a lot more innovation, a lot more problems that need to be solved.
Ryan: That's great. And we're going to talk more about the future of cyber and what that could look like and kind of the direction you've seen it go in and probably just it's evolved so much just in the last few years as well.
So, I got your concept then for what you're looking for in the company itself. What about the founders? What about the people that you're investing in? What qualities are you looking for in them?
Ron: So I'm looking for trustworthiness. I'm looking for; can they communicate? Do they have a certain sense of being consistent? Do they say the same thing to an investor that they might say to the media? That they might say to their co-founders and then might say to their company and their customers. It's really hard to do all that. Imagine if you have children and you're married, you'd like to be able to talk to your kids and your spouse the same way it's hard to do. There's different levels of understanding.
It's the same thing, one of the classic things about being a good CEO and a good founder is the ability to just be consistent in the message. And the more consistent you are, the more likely everybody else is going to take your message and amplify it and not dilute it with little nuances of what they have. I used to be really against this. Like I never really wanted to get people talking points or tell them what to say. But the reality is, the more consistent you can be in what you're doing as a leader, the more likely people are going to hear it and repeat it and move on. So we want all that kind of stuff.
I was lucky enough to be somewhat technical and somewhat in business. So I do like to see combinations of that in our founders, people who are a hundred percent tech and struggling with communications and leadership and thinking, being able to take risks and take chances. That's tough. Sometimes it's depending on what you're doing. It's the right person for the right solution though.
Ryan: So you're looking for potential red flags on like emotional quotient type stuff or emotional intelligence type stuff.
Ralph: And yeah, I was just going to ask that, I mean, you want a consistent message from your CEO. But does sometimes there's empathy. I mean, can consistent message and empathy coexist when you're a CEO. I mean, you don't want to be wishy-washy and so on, but I mean, I get what you're trying to say. And again, as being a founder of startup businesses, the ones that I've bootstrapped when I've been involved with people and clients a lot, empathy always played a really big part in my role in all that. Maybe to my negative side a little bit. My message wasn't always consistent. Just to elaborate just a little bit more on that for me.
Ron: Well, it's okay to be personable. I mean, it's absolutely okay. To be personal, have a good relationship with your employees. The question is when you walk out of that room and if you can't be there for another month, what message did you leave them? And so I don't mind being both be somewhat personal empathetic understanding. Of course, you want to build culture, you want to do all those kinds of great things. The question is if you're a little bit of a one-off on your core message with everybody. Then nobody has your core message.
Ralph: Got it
Ryan: Yeah. So you, at some point had to transition from really being a tech guy to being a leader of a company, a CEO, right? What do you think made you particularly good at that transition? And maybe also, which side of the house did you like better? If there was one that you liked better.
Ron: So I really enjoy it. I mean, I was lucky, at Tenable and that's something else I look for in other companies is the founding team a team that can work together? Can they build a team? So I was really lucky at Tenable. So I had Jack Hoffert. I had Renaud Deraiso. And so Jack was president, very business-focused. I can still remember attending his first Black Hat together, just showing them like the opportunity in this kind of market and stuff.
Renaud Deraiso, the author of Nessus, CTO Tenable right now, amazing technical person. And we would have a lot of conversations about certain features, certain things like that. I also had Cyndi, so Cyndi Gula was the head of ops. So she had done almost every job you could do inside Tenable as we were getting bigger.
You know, when I think back of that, somebody who didn't have all those different pieces, in their org charts, part of their team, they really want to do them themselves or quickly get people who can switch those things out. So I definitely like to see people who can surround themselves with that.
Now, as far as myself, leadership versus technical, I really enjoyed all of my time at Tenable. But I always really liked the first 10 years. Cause the first 10 years, I could almost name everybody at the company, you know, and I would walk around, I'd see people and Cyndi is usually better than me at the names and stuff like that, but I really enjoyed walking around and see it.
Now that's not everybody's style. And some people find it a little intimidating. Like I used to remember, I would dress in very casual jeans, black t-shirt that kind of thing. And I'd be on an elevator and I was welcoming a new employee and he literally said, well, what do you do here? You know what I'm saying? I'm the CEO, it's that kind of thing. So that's a culture and style and it's fine.
The thing that I really enjoyed, I remember like mid-2010, 2015, anytime we did a roadmap meeting, I had some really good product leaders, really good technical leaders. And they would come in and give us like the wiring diagrams of what was next. And yeah, and I really enjoyed that quite a bit and it really set me up for supporting so many companies today because I can ask them at their roadmaps and talk about things technically still to this day. So I really enjoy that.
Ralph: Could you have done the same or similar CEO role at Tenable that you did without that baseline knowledge that you had as an engineer, as a technical guy.
Ryan: That's a great question.
Ron: I think it's possible. So Amit who took over for me, very technical, came from the MSSP space, running RIPS Tech, ran RSA, definitely exposed to lots of different technologies out there. When I was interviewing a lot of other CEOs for Tenable though, I had your typical like sales leader who are great communicators, great culture builders, and great answer in that first question. You know, what problem do you solve? But pretty light on the engineering thing. And that's not my style. And I was really glad that Amit was interested in the Tenable CEO job, cause I think you need this balance.
And I think more than once I asked you guys like, okay, technically, how are you guys doing here? You know what is this, what is that? And whether it's the technology of your platform, at Cybrary. The technology of how your sales model works, how your go-to-market works, how your partners work and that sort of it's just as complex as any cyber product.
Ryan: Sure, sure. That makes sense. Yeah. Our company really took a turn for the better when we had really solid technical leadership in place. So we hired Mike, our VP of engineering, also our CISO. And Mike really was able to transform the company by just bringing great technical people in around him and assembling that. And that's really helped us a ton grow as a company over the last, I would call it two years. Something like that.
So let's turn to the investor side of the table from the operator side. So you're an investor now. You're an investor in us. I think you've been a great one. I always kind of highlight you as being good at strong advice because you have so much experience operating. But also you make really great relationships or introductions for us that have really moved the needle for the company. So those are a couple of aspects that make you particularly good at what you do. I would love to hear from your days of being CEO what you worked with a lot of investors, there was a little bit later stage in the company, and when you brought on investors, but what to you then stood out as making somebody a really good investor.
Ron: So Tenable, we raised money from a couple of different folks. Like we had some great founding angel investors. I don't know that we've ever disclosed who they were, so I’m not going to say offhand. They were folks from the industry though, I'll say it like that. And they were very, very useful, in terms of like when we closed source Nessus. How did we communicate that? And this was when we really sort of got into this notion of the advice we got was this is a really, really hard thing that we're doing. We're communicating to our employees, to the public, to the open-source, you know? And, so that was, that was a really good use of that.
As we got larger, we raised money from Excel Partners and they brought sort of that West Coast grow big mentality and they were spot on right. I mean, they gave us a lot of really good advice at the beginning about how to think about large communities. So some of the stuff I shared with you guys about Cybrary’s large community of cyber trainees out there, we had very similar numbers with Nessus free users out there, and they thought about that. And then as we got bigger, we raised another round from Insight. That was a really large round we did just before we went public and Insight’s game was a little bit different than Excel’s in that they were a larger fund. They had a little bit more scale and sophistication. So they would introduce us to people like CTOs of fortune 20 companies. And I would happily take those meetings. But I was totally not prepared for it because when you're meeting the CTO of like a major motor company, of course, you gotta make hay, but you know, the person is worried about security or cyber, might be four or five or six levels down in the org chart. So you're almost landing a bit too high.
So after hearing all that, people whose work, I mean, literally, these venture capital funds have. Full-time staff who do nothing but track CISOs, track CTOs, track people in the community who can be very helpful, what you're doing. And I learned from that, that's what I try to do when I make an introduction. I really want to make sure that if someone's going to help you, there's a very clear reason why I'm doing an introduction.
Ryan: Gotcha. Gotcha. Yeah. That makes sense. So some lessons that you've learned over the years, you are an operator for a long period of time and now you're what - three years in, two years into being a full-time investor, basically?
Ryan: Does anything look different now that you're an investor when it comes to building a company that maybe didn't look the same to you, as the time of being a CEO.
Ron: So, when I was a CEO, you're responsible for everything. You're responsible for whatever your employees do, whether it's good or bad and how you manage that is the difference between being a CEO and not being a good CEO.
As an investor, you're basically available, but you're not responsible. And I spent a lot of time talking to other venture capitalists. They're like, look, you're a CEO. You're not running these companies. You know, so you can go in and give advice. They might take it. They might not take it. Don't take it personally. And that's one of the reasons we're able to scale. Any given time, I know that there's some sort of strategic issue that we have not overcome yet for any particular company. I've got that for every company I ever invest in. There's this other thing they could do that they haven't done yet? Don't ask me what yours is. I'm not going to go into it right now, right? You might not like my answers, right? But it's probably not too far off.
But then not being responsible, but being available, it really allows you, when something does go wrong, to really frame things quickly. And I've had more than once where I've been on the phone with a founder, something's happened. They've lost a Head of Sales. I've had a CEO die, you know, which is unfortunate, but part of life. I've had people get sued. I've had people have founders where they've had disputes and stuff like that. And if you have that sort of strategic view of what's going on with the industry, any of these technical problems that come up or tactical problems, you can be a better sort of listener. I've seen him before. It's not the first time. You know, you're still founders of an amazing company or there's always ways to say really good things.
Ryan: That's neat. That's neat. So maybe we can pivot here into cyber. Let's get back into cyber, and would love to hear, obviously we've watched the landscape move so fast. In fact, Cybrary talks about that all the time where, you know, cybersecurity is the fastest moving landscape in the world. New attack vectors are opening up in organizations and anywhere else every day. So, for you, what have you kind of seen the evolution of the industry be over the last three years as an investor. And then where do you sort of see things going?
Ron: So the way I look at the world, I participate in a couple of different things. Like the Cyber-Moonshot. I do a bunch of different things, you know, voluntarily for a number of different groups, right? The way I talk about it is there's this cyber poverty line where above the cyber poverty line, people have two things. They have hygiene for whatever their tech is, whether it's mobile, cloud, they've got some sort of defendable and maybe it's PCI, maybe it's MITRE ATT&CK Framework, maybe it's NIST. You would have a conversation with them. Like, yeah, those guys are doing good. The thing that they also have though, is they have the ability to hunt. They have the ability to know that even with all the hygiene in the world, they have to audit continuously. They have to hunt continuously. They have to look for things. So there's so many ways you can get attacked.
And basically, if you're not hunting and you don't have good hygiene, you're below what I call the cyber poverty line. And that could be because maybe you've done an underinvestment in cyber, maybe you're unaware of these problems. And when you think about being below the poverty line and then having to deal with the Cloud or Gmail or mobile or GDPR, or whatever's coming along. No wonder we're having such a hard time. So a lot of times when I look at RSA. I look at all the companies that are out there. Or even if I just look at what I get pitched on, I'm looking for people who can fill in gaps, both above and below that poverty line. There's plenty of ways to help people grow a good business and make a difference in both of those different areas.
Ralph: It's interesting to you because you talk about that poverty line and if you're dealing with a large credit card company, then you have to start worrying about, well, are they dealing with companies that are below the poverty line? So indirectly now you just become susceptible, to their hygiene and their lack of. Your world of who you have to deal with is just expanded and you don't even know that. So watch your own house, I guess, is the lesson to learn.
Ron: And so not only do you have that to kind of frame the world but then you also have the changes in the market, right? So we've had a huge growth in the stock market this year. I don't think we have a recession coming, which probably means there's going to be a recession now, so if you don't want to take advice from Ron Gula…
Ryan: You just jinxed it.
Ralph: Hey, yeah, Tommy sell my stocks.
Ron: Yeah. But you're seeing things like MasterCard just bought Risk Recon. So this is a credit card company, they just bought a third party risk company.
You know, how many great companies have taken private equity in the last couple of years? You know, it used to be private equity was the place you could go if you couldn't go public or raise it right now. There's some really good private equity, and because there's a lot of people who would be like, you know, I really could use some more cash and I really don't want the burden of being a public company. It's not that good for me. So the world has changed.
And part of that, technology moving so fast. Like the cloud, like what's Amazon going to do next is causing companies like Palo Alto and Checkpoint. Well, like Checkpoint buying Protego is a great example of that. So Protego is a product that only works pretty much with serverless security, so, Amazon as it is. And people like Checkpoint are willing to pay out for it. Palo was willing to pay up for PureSec. And so the point is that the market's moving so fast. The buyers are also changing.
So I think the last thing that's really going to change with cyber is people are a lot more aware of how it affects them personally. You know, everybody knows Alexa's listening. So you probably don't even have an Alexa in this room. It's probably listening to us somehow. Right? There's so much data being collected on us. And you know, for the first time you're kind of seeing public acknowledgment of offensive cyber, which happened last year for the first time. It's a real weapon. And it's probably gonna proliferate, not only to the FBI, not only to our state and local, but probably private investigators. So the world that we live in, is it going to be like this? One of these cyberpunk kinds of dystopian futures or is it going to be a little bit more, where things are secure and they just kind of work? It really looks like it's trending towards the dystopian. Those who don't invest in their cyber are going to get out really quick and not, might not even know it.
Ryan: Wow. Wow. Fascinating. Maybe transitioning in, I know we've got just a little bit of time left. We're coming up towards the end here; the skills gap. I know that you've been somebody who you've been talking about that and people ask you about it all the time. What are your general thoughts? What do you see? Is it a skills gap? And if so, what does it look like? And what are you seeing there?
Ron: So a couple of things. There were a couple of conferences, I've done two recently, where about a third of the attendees were women. So I was invited to go to a hacker trivia night over at a Jailbreak, which is sponsored by a Booz Allen's Dark Labs. And you look around this room and if this was 10 years ago, it would have been 98% men in hoodies. You know, that kind of thing. When we went the other night, I got to say about 25%, if not more where young women. And when I say young women, I mean, younger than me. So there's women in their 40s, 35, 45. I was very happy with that. And I’ve seen a lot more leaders out there who are coming from different diversity sure in cyber, which is really good.
Now, do we have this gap yet? We got a gap, but the way I frame it, I go back to that cyber poverty line. So those below the poverty line might not - they're underinvesting in IT, let alone cyber. You know, so there's an opportunity to help everybody there or educate them to go to more scalable solutions like cloud solutions and whatnot, but then even in a large enterprise, if you're good, you know, there's a lot of people who changed jobs. It's so common to lead a red team here and then go to another company, after a couple of years, because they're willing to pay up because there's a real limit of the number of people who can do those things. That's right. But those are two different kinds of skills. You're not going to learn how to be run on a red team at a major bank overnight. You've got to work your way up to upper at that thing.
I think my last comment on the skills gap is just the industry has done a poor job of getting people into it. Like if you said you were going to go and be a doctor. I might ask you if you think in cancer, you think in general practice, the general public has a good sense of that. They know the difference, a doctor and a nurse, someone who's researching a cure for cancer. But if I said I was going into cyber, there's a big difference between a CIO, an IT manager, somebody patching systems, somebody who's looking at logs, somebody who's doing your compliance audit and the general public still kind of gets a little bored when you talk about those kinds of things. And until we kind of make that real and make it more personal, I think we're always going to have the skills gap. People are always going to be wondering, what should I do? What am I missing out on? And I think one of the reasons I love Cybrary is because you guys do such a good job of exposing people to all these different disciplines. Maybe I can try forensics. Maybe I hate it. Maybe I take an audit course. I go, you know what? I kind of get this audit course, and I understand how it relates to cyber. Now, one of the big reasons I'm an investor, and I'm a big fan of being on your board and working with you guys.
Ryan: Yeah, thanks for that too. And yeah, it's definitely in our mission, we wanted to, we saw the exact same thing. It was far too great friction that existed in getting into the field. So like you just mentioned like different pathways that you can go down in cyber. You don't even have to necessarily be technical to be in this field. Right. I mean, governance, risk, and compliance. You don't have to be all that technical to understand, you know, a lot of the concepts -
Ralph: But they're bite-sized, we've made them bite-size for lack of better words, we've given people. Different career paths where they can follow it. Just not cyber, it's just not this very big and overwhelming.
Ryan: Yeah. You can go in any direction. And sort of vet them all out and see if you're going to have an interest later there. And if so, double down on one. But the friction to get into the space and then also the friction to transition into other parts of the space was super high. I mean, you know, you can't get into the field by going and taking a one week course for $7,000, and I think that you’re job-ready and work-role ready in this space. So with our mission, it was really to remove the friction so that we can bring away more people into this space at a scalable rate. And that's why we give so much knowledge away for free.
Ron: And supports the concept of continuous learning. Yeah, I'm a big fan. Like, if I gotta take a certification. Great. I'm going to come to take a class, sit and get it done and pass that thing. But what about the next thing and the next thing, you know, your next step.
Ryan: Especially in cyber, especially as fast-moving as it is. Yeah, for sure. So I think you'll be delighted to hear that starting tomorrow here on the engineering team and the product development team, the ability of the talent model for Cybrary is going to start being worked on. So the 2.67 million users that we have now, the people that are there, you know, continually developing skills will soon have a way to be found by employers. So it's going to start being built tomorrow.
Ralph: A dedicated team. Just going to say, guys, get it done. Go build, go build it.
Ryan: That's great. Did you have anything else?
Ralph: I did, I mean, I'm still amazed at, you and Cyndi. I mean, Cyndi, God bless her super, super sweet and intelligent person, in what you guys do at Gula Tech Adventures. You know, you're looking at investments, you're talking to founders. People are coming to you all the time. Have there been disagreements? Have there been times like, “Hey Ron, I want to invest in this.” “No, Cyndi, that's not a good idea.” “Or Cyndi, I wanna invest in this.” “No. Ron, that's ludicrous.” Do each of you have a little card in the back pocket that, “Hey, this is our one pass.” You can't argue. How do you do that?
Ron: So we try to work pretty closely as far as where the companies are at and what we can do to help them. And whether it's an introduction or that. If we don't invest in somebody, I always try to give some feedback as to why, but I'll never tell him, “Yeah. Cyndi didn't like you, or I didn't like you, or we didn't like how you got set up,” or something like that. I mean, I'll try to couch that in a much more positive kind of way. But the reality with 50 kinds of companies that we can kind of see into, I gotta tell ya, I mean, all 50 are doing great. Not one of them has any problems. Well, I wish, right. Well, not well, of course, but my point is that, you know, if things aren't going well, how do you deal with that? Right. Do you ignore them? Do you spend time on them? Cause one of the big things you have to do is you have a limited amount of time, you know?
So if a company is doing extremely well and they're on track to 5x or 10x, your investment. Can you work on them a little bit more and maybe get it to 15x or 20x. Versus a company that you might lose money worked just as hard on and maybe get your money back. And so we try to balance that and try to really, especially if it's just me and her, we haven't staffed up. And so we gotta be very, very selective about who's learning, who's listening and who we can help.
Ryan: And I think, you know, what the world of investment is starting to realize too, is that doubling down on your winners tends to be the right way to sort of think about things, right? If you could, because there's so much uncertainty in the early stages of a business that once you've kind of reached past a certain point as a business, you know relatively well that the business is going to at least have some sort of reasonable outcome with a high likelihood.
Ron: We put a lot of information on our website, gula.tech, but we don't simply have any LPs or we're not a public entity, we don't tell you like, oh, I think technically we invest in Cybrary four times, a couple of times. SCYTHE we're putting another round in. And they're Inky we did more. Polarity, we did more. That's a testament when you invest further on and further on. That's something I hope for all of our companies.
Ryan: Excellent. Well, this was great guys. I appreciate you doing this. Ron, where can people, maybe interested companies, who want to talk to you or anybody like that, where can they reach you? Where can they find you?
Ron: So I'm Ron Gula as @RonGula on Twitter, I'm also on LinkedIn, also Ron Gula. And if you want to just, unsolicited, send us something, you can send it to email@example.com. That's also listed at the bottom of the website gula.tech.
Ryan: Okay. Well, Ron, thank you very much for your time today, Ralph. This was great.
Ralph: Yeah, absolutely. Ron, always great to have here at Cybrary.
Ron: Happy New Year.
Ralph: Hey, thanks,
Ryan: Cybrary out.