Rob Lee: Building Dragos into a multi-billion-dollar mission-driven cybersecurity company
Download MP3Welcome to Inside the Network. I'm Sid Trivedi.
Ross Haleliuk:I am Ross Haleliuk.
Mahendra Ramsinghani:And I am Mahendra Ramsinghani. We have spent decades building, investing, and researching cybersecurity companies.
Sid Trivedi:On this podcast, we invite you to join us Inside the Network, where we bring the best founders, operators, and investors building the future of cyber.
Ross Haleliuk:We will talk about the hard parts of the founder journey, launching companies, getting to product market fit, raising capital, and scaling to an exit. And, yes, we will also be talking about epic failures.
Sid Trivedi:But, Mahendra, we're here to make the founder journey easier.
Mahendra Ramsinghani:That is correct, Sid. But we cannot make it
Ross Haleliuk:too much easier because startups are hard, And, of course, you already knew that. Alright, you two. Enough. Let's get started with this week's episode.
Mahendra Ramsinghani:Every morning, you flip a switch, the lights come on. Turn on your kitchen faucet and water flows, gas, pipelines. Invisible to most of us is a technology layer that controls utilities and such critical systems. Operational technology or OT, the systems that control the physical world. These are not routers and servers, but PLCs, programmable logic controllers that run on protocols such as Modbus, not TCP IP.
Mahendra Ramsinghani:When these systems were designed, they were not connected to the internet and hence not considered to be vulnerable targets. Access control, authentication, encryption, all of these were luxuries in this domain. That has changed. Today, utility grids are imminently hackable. Ukraine, Venezuela, Stuxnet, Colonial Pipeline.
Mahendra Ramsinghani:The list goes on. The big difference is this. Hack an email server, you lose data. But if you hack an operational technology system, it impacts people's lives. IT security may be a business problem, but OT security is a public safety problem.
Mahendra Ramsinghani:It is a nation state problem. This is the new frontier of warfare, and one company is leading the charge in building and protecting critical infrastructure, Dragos. When founder Rob Lee saw this opportunity a decade ago, the market did not have a name for this category. He took over 100 rejections from the best PCs in Silicon Valley. No one thought this was a real problem, but Rob went on to raise over $400,000,000 anyway, built a unicorn, and kept growing steadily.
Mahendra Ramsinghani:There is much more in this episode than just building a company, raising capital, or making money. It is a story about a founder who brings a sense of purpose, duty, and most importantly, a sense of service. A founder who is not chasing vanity metrics nor exits, but wants Dragos to keep building for the next hundred years because the infrastructure Dragos protects is not going anywhere, and neither are the hackers trying to take it down.
Sid Trivedi:Welcome, Rob, to Inside the Network. Thanks. Thanks for having me. We're gonna talk about a whole bunch of different things today, but we wanna start from the very beginning, from your time at the academy and then moving to the agency. Yeah.
Sid Trivedi:We're gonna go very early first.
Rob Lee:First, this is like this is one those, like, hot ones interviews or something. Okay. Alright.
Sid Trivedi:Yeah. You you you just weren't prepared. That was the problem.
Rob Lee:This is what happens when I don't read the questions.
Sid Trivedi:You graduated from the US Air Force Academy, and you joined the Air Force as a cyber warfare operations officer. And you were also tasked with the NSA there. Mhmm. What got you excited about cybersecurity? I mean, it's not an obvious area within the air force.
Sid Trivedi:What did you learn in that time?
Rob Lee:You're just starting off demotivational, the whole thing. Like, it's it's basically I didn't wanna be a pilot. That that's that's the story. Like, it it wasn't like I was, like, super into cyber and tech and I was a computer science guy. That's but no.
Rob Lee:I I studied African studies, and, like, I had spent my time doing humanitarian work and, like, building control systems in places like Cameroon and getting excited about, like, what power and water does. And my parents were 25 year, you know, Seamasters. They were enlisted in the air force twenty five years, and I didn't like pilots. And I've met nice pilots since then. But growing up, to see some, like, 23 or 24 year old talking down to your father, you're like, alright, dude.
Rob Lee:I I'm I'm good without these people. And they'd sent me to South Korea to fly in a two seater f 16 to, like, show me. They're like, see? Yeah. Yeah.
Rob Lee:Okay. I was like, what? And they're like, it's it's great, isn't it? I was like, yeah. No.
Rob Lee:I like planes. I don't like pilots. And they're like, alright. Well, you're out. And they're like, well, what do you wanna do?
Rob Lee:And I was like, go back to Africa. And they're like, this is like, are we calm? You can be communications. We can get you to Africa. I was like, yeah.
Rob Lee:Cool. Okay. And then, like, en route, they switched it to cyber. And so I was one of the first cyber officers, and they sent me to, like, a six month schoolhouse, taught me all this stuff. And I was like, what about all the control systems?
Rob Lee:They're like, what are control systems? I'm like, oh, man. That's a lot of it. And then yeah. So I ended up doing alright.
Rob Lee:They kicked me off. They said, do wanna go to the White House? This would be good for you. Alright. And they're like, go do stuff with the president, help your career.
Rob Lee:I was like, what's my other option? They're like, Germany. I'm like, I'm gonna be drunk in Germany. Like, but what what hold on. The White House.
Rob Lee:Like, this is really good for you. I'm like, drunk in Germany. That sounds great. And so and also they had Africa command there, and so I was, like, super interested in that. And I got there, and it was basically an intelligence squadron that nobody ever heard of before.
Rob Lee:And then I had a commander there that was like, what do you know about control systems? And I was like, a little bit. You you should go over to this other place called the NSA. This is all, like, pre snow. And I was like, what's the NSA, dad?
Rob Lee:You know, like, one of those things. And they're like, just go in the corner. I'm like, alright. And so, yeah, I had a good had a good time. I walked in.
Rob Lee:They said, go find the unknown unknowns. I was like, what is that? They're like, I don't know. But Rumsfeld's really big into it. I'm like, alright.
Rob Lee:Cool. We're we're gonna go hunt and control system networks. And, yeah, I ended up building up the the government's mission on that stuff, and it was cool. It was fun.
Sid Trivedi:And on that topic, were there things you learned about the minds of these hackers through that role on the offensive side? Like, what did you learn in those early days? Obviously, you've learned a lot since then. But Yeah.
Rob Lee:I mean, so in SA, we didn't do offense. Right? So I I I did intelligence operations and defensive work, but I did get onto the offensive side of the house eventually, anyways, somebody else's AVT. I think we called it, like, free unsolicited penetration testing of foreign government assets, but it was good. I think couple things.
Rob Lee:Right? Like, understanding the tradecraft, understanding how things work behind the scenes is is always interesting. I think there's a lot of things cybersecurity defenders will say of, oh, here's why the adversary is doing that. Like, oh god. That's not why.
Rob Lee:And so that's useful context. You know, it's it's also just kind of humbling anyways where some of the stuff isn't that mysterious, some of the stuff's not that hard. You also realize that, like, everybody's got a job, health care, child care, everything else. So, like, your APTU is super interesting. Like, they're they're still getting yelled at at least twice a by somebody.
Rob Lee:They got PowerPoint management too, and they gotta get home by 05:30. You know? There's all sorts of stuff that just humanizes them, and then you just start looking for the human elements in the cyber operations more, and I and I find that to be super interesting in terms of what I would do in the private sector outside the industrial control system stuff. Obviously, I built the cyber threat intelligence course at SANS and taught a lot of people on that kind of stuff. And bringing that human flavor to CTI was something that I felt I could do better because I was on the offense.
Ross Haleliuk:Rob, as you've just mentioned, you studied African studies, not not exactly computer science.
Rob Lee:Yeah.
Ross Haleliuk:Then you taught yourself ICS security when literally nobody else in the intelligence community was studying it. You also wrote an award winning article, the failing of Air Force Cyber.
Rob Lee:Who do you guys do in your research? What did what did I just walk into? Alright. Alright. Alright.
Rob Lee:Go ahead. Sorry, man.
Ross Haleliuk:So you've essentially you've publicly criticized your own institution's approach to the career path in in security. What advice obviously, please do talk towards it, but also what advice would you give to a founder who sees a massive problem inside their organization or the industry, but is really afraid to speak up, thinking that their career will end before it even begins?
Rob Lee:Yeah. I mean, probably shouldn't take any advice from a kid from Alabama that studied African studies, but but what I would say is this. So I've always so on this on the failing of Air Force cyber thing, I was watching my NSA operators, junior enlisted guys and gals and others, and just really amazing people, the X-ray developers and signals intelligence officers and all this fun stuff. And then the Air Force be like, cyber? You can go do other cyber stuff like patching servers at the INOS.
Rob Lee:And I'm like, patching? Like, this is this guy's, like, one of the best exploit developers I've ever seen, and you think, like, cyber is just cyber. And they're like, yeah. It's cyber. It's a cyber field.
Rob Lee:I'm like, cool. So I just need a pilot. Right? It doesn't matter b 52, f 15, whatever. Just a you got you can know you know how wind works.
Rob Lee:Like, lift, not lift, stick go down, stick go up, trees big, trees small. Right? This this is okay. And it was just very obvious the level of hypocrisy they were applying to specialization of other fields versus ours, and I was tired. I look, most of my success at Dragos and everywhere else that brought me here was I I got pissed off at something and then went and channeled that anger.
Rob Lee:And so I I got pissed off watching my guys get abused and having their careers ruined over a pilot who didn't know anything about our field thinking that they were in charge because they flew. And so I, yeah, I wrote it publicly, which no one told me not to, for the record. Like, there was wasn't that kind of advice back then. And it was funny because the background context was that three star general who's in charge I'm sure he's a nice guy. Right?
Rob Lee:I never met him. But the three star general that was in charge was talk the chief of staff of the air force, the four star. It was a corona that all the generals were around. And general I think it was general Welsh, the four star, was like, alright. So then you wanna make this change, right, about, like, making it where they're all just cyber people.
Rob Lee:Right? He's like, yes, sir. Yes, sir. He's like, do do you think the do you think your your guys agree with you? And he's like, oh, yeah.
Rob Lee:Absolutely. I've got support of the force and everything. And he threw out a printed copy of my article to the three star. I was like, lieutenant Lee doesn't agree. And so that he was very upset at me.
Rob Lee:And he tried to ruin my career over, but luckily, like, my intelligence tribe took care of me. Otherwise, that would have been rough in life. So he tried everything he'd do to ruin me. Years later, he tried to join a board of directors at a power company, and they called me, and I like, no. I I wouldn't take him.
Rob Lee:So it was was fun. Anyways, look. Obviously, speak out, but be damn sure you're right or have enough humility to cage where you might not be right and say, hey. Here's an idea I have, and we gotta talk about it. But if you're gonna assert that you are right, better be able to back it up.
Rob Lee:And if not, take the price for it. That's fine. And so I've never felt shy in speaking out. I don't think anyone in the world has ever had to wonder my opinion, and so I I don't have any problem with that. But I'm always trying to be empathetic to everybody else's and also understand that there's competing ideas, and I want that.
Rob Lee:And if you're wrong, just just say you're wrong. It's better to be wrong than mistaken. You know?
Mahendra Ramsinghani:So, Rob, speaking of three star generals and and your outspokenness, You know, how did the transition from an agency like NSA occur to a start up world? Now very different worlds. One is very structured, very rigid, and, you know, the three star generals generals will not not like it if you sneeze in the wrong direction Yeah. To this other side where, you know, you're literally in charge of everything.
Rob Lee:Yeah. So I I definitely learned a lot by having good investors and good operators and then investors who have been operators and learning from the business and just trying to always soak it up. Right? It's curious
Mahendra Ramsinghani:I mean, come on, Rob.
Sid Trivedi:You don't have to
Mahendra Ramsinghani:sit you don't have to sit yet on your cap table. How can you say that?
Rob Lee:No. No. No. Let let Or
Mahendra Ramsinghani:me for that matter.
Rob Lee:I tried. I tried to get sit on my cap table, like, three times. Even once when I was like, dude, you you don't even deserve this anymore. Like, I just like you. Anyway, so I think it's I think it was his IC that got in the way.
Rob Lee:Maybe maybe that's the answer. You know, behind the scenes, he's telling him, don't do this. But anyways, so I've always tried to treat anything that's worth doing is worth being curious about, like, all the way through. So if you're gonna do cybersecurity, like, go build your own industrial control system labs and everything to teach yourself. Go do venture.
Rob Lee:All the elements of the business. Learn GAAP revenue accounting. Learn all that stuff. Right? Let's just just learn your business.
Rob Lee:But I I did find it interesting on the leadership thing where it was different aspects. Right? So I'd have, like, I'd have investors kind of me that didn't make it on the cap table. They'd be like, oh, I mean, it's a big thing to, like, lead a team. And I was like, yeah.
Rob Lee:We got, like, 10 people. And they're like, yeah. But is that weight crushing? I was like, I had, like, a 100 and something in the military who were doing combat operations. Like, I'll I'll be alright.
Rob Lee:They're like, is anybody gonna die? They're like, no. I'm like, well, cool. Cool. We'll be alright.
Rob Lee:I might lose you some money, but nobody's dying. We're good. And so there was definitely aspects of the military that was helpful for just confidence in in a lot of the did you know eat you know, leaders should go last? Leaders eat last? And sometimes, guys, that's, like, one zero one military training.
Rob Lee:So was there was some of the stuff that was very useful. But then there's, to your point, there's walking out and going, I've got really interesting experience, but it probably doesn't all copy and paste. So let me learn the problem first and then bring in the experience that's relevant instead of thinking that my experience is immediately relevant. And I find a lot of parallels of that with IT and OT security as well where there's actually some really great things that IT security can do in OT, but if you don't pause, stop, ask a couple questions, and figure out the problem first, then you're gonna apply the wrong lessons learned. And so I thought that was good.
Rob Lee:And in the NSA, when I was there pre Snowden, and I was I was there through Snowden era as well, but pre Snowden, you could do all sorts of things. Like, I remember walking in as a young kid, they were like, here's the the signals intelligence network. I'm like, what's the limitations? They're like, physics? I'm like, okay.
Rob Lee:And so I had access to everything. I don't think you get that anymore. But back then, it was an amazing learning laboratory to just see how everything worked, which was awesome.
Mahendra Ramsinghani:So what was the hardest thing though, Rob, when you look at your first year as a start up? Mhmm. There must be some struggles that kept you up at night. Talk to us about those.
Rob Lee:Yes. There's always struggles, but also remember most founders are psychopaths. Right? So, like, if you if you think about it, they are. It's I alone see this problem.
Rob Lee:You know? I alone can solve this problem. Like, I can take on giant companies. Like, there's something probably broken, but I think that's required. As long as you're humble about required.
Rob Lee:And there's a lot of difficult things. You know, it's very difficult to go and resonate with people and talk about an idea and get the buy in and not get to the finish. And I was very comfortable with somebody being like, you're an idiot. You're wrong. OT security is not a thing.
Rob Lee:Was like, alright. I'm gonna show you. That was fun. It was difficult to date Sid for a while or the Martin Cascados of the world and everybody else and, like, jive with people and be like, oh, man. I could go on a train with this guy.
Rob Lee:Like, this could be fun. And then, oh, nope. Sorry. Who was it? What's what's the guy's name?
Rob Lee:Andreessen. He, like, he got mad at me because of something I said in a meeting, and he blocked me on Twitter. I'm like, what the fuck? You know? So it's just like, you know, some of those things, it's like, dude, really?
Rob Lee:That's what this is? And, like and and so I think it's not rejection. It's rejection after you get excited about the the art of the possible. That is definitely a tough pill to swallow. And I think probably later on, that the one that sucks the most and still sucks to this day, and, like, I'm in open, like, heart on sleeves inside of Dragos about this, is it is really terrible to build a culture and mission that you love.
Rob Lee:You bring people in, you feel good about it, and then you find out someone's not having a good time, or if you find out worse, they just don't like you anyways. You know, I'll I'll I'll look at, like, a glass door review every now and then, you know, and like, oh god. You know? And so it's like, it hurts. It actually hurts of, like, oh, I know what I'm doing relative to everybody else.
Rob Lee:I know how we're taking care of you. I know how we're treating you, and I know the background context of how that story went, and and this is still what we're gonna say. That hurts. And I think I think that's uniquely a found maybe not, but I think it's it definitely hits harder on founder of, like, I built this place because I wanted to do something good. And if you don't see that and you wanna go somewhere else, that's fine.
Rob Lee:But for you to get toxic inside of it and take it out on people, that's that's a tough one.
Sid Trivedi:We're gonna talk a little bit about Dragos, but before we do it, this is a true story from last night. So I was with two two early, very young founders last night. I've just given them a term sheet and we're trying to, you know they have multiple offers and they're trying to, you know, decide, and they asked me a question, is a very good question. They said, hey. What are some investments you didn't do that you regret?
Sid Trivedi:And, you know, unsurprisingly, I said, you know, I really regret not investing in Rob and Reagos. A, because of, you know, just how much he has grown over that period of time, but but, b, also because it's the mission of safeguarding civilization is something that not every yeah. It's not every cybersecurity company is able to to say very articulately.
Rob Lee:No. I I appreciate that. It's funny. I I got the one of, like, the investor I'm glad I didn't do business with. It was so funny, though.
Rob Lee:You you know who it is, I'm pretty sure.
Sid Trivedi:But Yeah. I do.
Rob Lee:This is very large firm, and they, like, called me up saying, we wanna do the deal and we'll, you know, whatever. So I get in a meeting with him, and he's all, you will take our term sheet. I'm like, what? What? And he's like, you what how much are you raising?
Rob Lee:Like, a 100,000,000? He's like, I'll give you 500,000,000. I was like, yeah. That's not what I'm looking for. And he got, like, all pissy about it.
Rob Lee:And he's like, well, you know, BlackRock is giving you, like, 20 x. I'll give you, like, 25 x. I was like, yeah, but the historical five year average is, like, 15. This is gonna crash out. I can recover from 20.
Rob Lee:I can't recover from '25. And and he got so mad that he went and bought into one of my biggest competitors, and he screwed it up.
Sid Trivedi:This was the greatest deal that I made today.
Rob Lee:Like, was the best thing ever, is I lost him a bunch of money and screwed over a competitor by not doing the deal with him.
Sid Trivedi:It was wonderful. So on this topic of Dragos, you start this company about a decade ago, and you started with two other cofounders.
Rob Lee:In ten years this month. Yeah.
Sid Trivedi:Yeah. Ten years this month, John and Justin. Mhmm. Many people have talked about those early days and how you came and, you know, created this company after investigating the twenty fifteen Ukraine power grid attack. But very few have actually, you know, asked you this question around the fact that ten years later, John is still CTO.
Sid Trivedi:Justin is still chief data scientist. I mean, that is exceptionally rare. We're ten years into a private company that's scaled. You've got hundreds of employees. How did you maintain that relationship between the three of you and, you know, continue to work together after coming out of this very high ego, high clearance intelligence world?
Rob Lee:Yeah. That's it's I'm really glad you asked the question. I don't think I have gotten that one. I said this at our company kickoff though, of, like, I don't think most people appreciate, to your point, how rare it is, because how often cofounders screw up the company and the fights and the drama and whatever between them. And the only way it works because you've met me.
Rob Lee:Like, I I try to be humble, but let's be honest. Right? Like, the reality is John and Justin are two of the most humble people you ever meet in your life. And I remember when I pitched some of the ideas, like, we gotta do this. John was like, oh, cool.
Rob Lee:Alright. Well, I could you know, I'm creating the design. Anything else? I could be I could I could be, like, the CTO role, I'll, like, code and do this and blah blah blah. Justin was like, oh, cool.
Rob Lee:I got the analytics and the protocols and this and the other. And I was like, well, what do you want me to do? And they're like, I don't know. Like, don't know. Be the CEO.
Rob Lee:And so I was the least qualified of the three, and that's how I became the CEO. And the difference is John and Justin have always viewed it as my company. And I've always had to remind them, like, it's not. I remember I had to argue for them to take more equity in the beginning. I was like, no.
Rob Lee:Let's, like, split it out. It's the company here. And they're like, no, Rob. This is really your idea and this, that, and the other. We'll take less.
Rob Lee:I'm like, guys, don't be idiots. Like, just take it. Like, I've always had to advocate for them, and and there's probably some trust built there that I always advocate for them, but they're just super, super humble, and it is just as much theirs. And so many times, I think if you don't have a cofounder, you're gonna regret it, is my my take. And I'm I'm very much the I can go do this and take the hill whenever, but there are moments.
Rob Lee:You know, COVID hit, we had to do a layoff. The discussions around, hey. You're gonna get the funding for the next round. Hey. Here's this thing.
Rob Lee:There are components of discussions where I don't think they are as safe to have as you think they are unless it's a cofounder you're talking to. And I'm glad everybody has the right hand person or their CFO or whatever else, but there are certain moments that that cofounder relationship is really intimate and important, and I know it's been very valuable to me. But, yeah, they're they're still here kicking, but John's so humble. John was like, hey. Do you ever wanna have another CTO?
Rob Lee:Like, I could just go back to, like, coding. I love being an individual contributor. I'm like, stop. You're doing a great job. You know?
Rob Lee:They're just humble people.
Ross Haleliuk:You chose Data Tribe as your first investor, a startup studio that specifically works with founders coming out of the intelligence community and federal agencies. Most founders in the cyber space default to the Silicon Valley or to the Tel Aviv based investors, but you didn't. So why was DataTribe the right launchpad for Dragos? And more broadly, what advice would you give to a technical founder coming out of the government service about choosing their first investor? What should they look for at an investor that's not on a term sheet?
Rob Lee:Yeah. So I'll answer the second one first. So the the what are you looking for? Know your requirements. Okay?
Rob Lee:And what I mean by that is, like, just be honest with yourself. What do wanna do? I knew I wanted to build a hundred year kind of company, and it didn't matter to me is that is there a PE leader? Is there an IPO leader? Is there this?
Rob Lee:What has always mattered to me was autonomy, and I knew that you could divorce control and equity. You could divorce autonomy from structure. You could you could have certain terms that give you autonomy. And I wanted autonomy, especially knowing that OT is popular today, but it may not be tomorrow and that maybe the market swings, and and I needed to know that we could do it forever, and because it was a mission that was worth doing. So that was what was important to me.
Rob Lee:So I needed investors that understood that we were building something special towards a mission, and I understood the exchange. They're gonna give me money, and I'm gonna give them a lot more money back. I understand the relationship, but they were gonna allow me to have the autonomy to go do the mission. And so all the investors we took were of that type, but that's not everybody. Are you, hey.
Rob Lee:I wanna do my first company. I'd really love building companies. I I wanna have an exit and then get another one. Great. Well, there's great investors for So you gotta you gotta figure out what are your actual requirements and then and then ask your investors, show me the other companies like me.
Rob Lee:You know, those companies that will come to me and say, hey. We could help you IPO. I'm like, great. Who's the last five companies you IPO ed? It'd be crickets.
Rob Lee:I'm like, okay. Well, I'm probably not gonna be the first one then in your And so you'd ask those questions. In the context of I don't know if you hear my screaming other kids. I got four kids now, and three are under three. So, you know, VCs used to be difficult to manage.
Rob Lee:Now now it's not so much. But, anyways, when I when I look at Datatribe, it I'm very grateful for them. They were they were our first investor, and we probably wouldn't have got off the ground if we didn't have them. So that like, you gotta you gotta love them for that. I I I don't know that it was so much we chose Maryland versus The Valley.
Rob Lee:I went out to Sand Hill Road. I went out and did all that. The Valley didn't choose me. You know? Like, it was I think I took, like, a 123 venture capital meetings with a bunch of investors who are like, OT?
Rob Lee:Isn't that like legacy controls? Isn't that gonna go away? Like, isn't that one of them was like, I could introduce you to Facebook. I'm like, for what? You know, like, was very much like nobody that I talked to got it or a couple of the people I got I talked to were rightfully saying, hey, the economics of this and everything could be crazy.
Rob Lee:Like, was Sid, but it was it was your old boss, forget his name, but he was awesome. I consider him, like, one of the silverbacks of the industry. Like, he was he was a solid dude, and he flew out to see me in the AWI Airport, spent fifteen minutes to talk, whatever. Like, he was a superhuman dude, but the investment community was right. Like, looking back, Dragos looks kinda obvious, but come on, man.
Rob Lee:Like, crowded space, OT, what's gonna happen in it? This is long sales cycles. This, that, the other. Like, I always got that. Long story short, nothing that we were doing resonated with what the Valley was thinking at the time.
Rob Lee:And the value of the East Coast mafia, if you will, was they understood the importance of the mission piece so much that they were willing to take an extra risk on the front on the financials of it. Where I think the Silicon Valley firms, most of them, not all of them, but at least the ones I interacted with, had had a really well oiled machine of looking at where the finances were, and you could also have impact. And so I think that we were not a good fit for the Valley. And years later, when we were, you know, they they would make a couple comments that would piss me off. Like, yeah.
Rob Lee:Well, you could relocate your headquarters here and really access talent. I'm like, what do mean really access talent? And, like, all the all the people coming to NSA and everything else, you don't think that's talent? And I was like, alright. Tell you what.
Rob Lee:We're never taking a penny from Valley. And so I it became a thing later, but early on, it wasn't.
Ross Haleliuk:How has that changed? I mean, it's been, as you said, it's been ten years. If you're a technical founder coming out of the government service today, are you just looking at the Bay Area, or are you still looking at the East Coast of the Maryland venture?
Rob Lee:Mean, my flipping comment is in this market, I hope you're just talking to people that wanna return your calls. But, again, I still go back to that first answer of you gotta figure out what you wanna do. And there are some Silicon Valley firms that specialize and can really help you out in the paths that you wanna take, and there's some East Coast firms that have connections and and so forth that may be helpful for you. I guess I just held a really low bar for venture capitalists, and that is not to put down venture capitalists. Like, I've learned a lot from them, and it's been really interesting for me.
Rob Lee:I'm saying I never expected anything but capital. So it's all this like, oh, we can do this. We can set you up a customer introduction. We do that. I'm like, customer introductions.
Rob Lee:Like, that's my job. Like, Like, if I can't get customers, why why are you investing in me? And and so I looked for, I want principled, value based, just capital, and we're gonna hit hard times, and I want you to, like, be willing to go through that hard time with me. That's what I look for in investors. And I think you can find if that's what you want, I can find I I can find you those anywhere in the world.
Rob Lee:You can find those in Tel Aviv. You can find those in London. You can like, that's just an ethos around investment, and and I think you can find that anywhere. But but so I don't I I just think you gotta know what you want.
Mahendra Ramsinghani:So, Rob, switching over to part that the BCs love most, TAM. Right? Market size, the market category. And here you are coming to Sandal Road, and they're saying, oh, we should introduce you to Facebook. Yeah.
Mahendra Ramsinghani:And you're scratching your head clearly thinking, like, you know, who who is, you know, the stupid one here at this table? So the question that comes up is that OT wasn't even a category when you started. A lot of investors clearly want to invest in big categories. So you you could see something Mhmm. That others could not.
Mahendra Ramsinghani:You know, help us understand a little bit about what was giving you the conviction and how this category has evolved over time.
Rob Lee:Yeah. And it's my the question I hate the most, by the way. Not that one. That's a good question. But the question I hate the most is from venture capitalists that go, so what do you think the TAM is?
Rob Lee:And I'm like, that's your job. You know, like, I'm gonna I'm gonna give you, like, some innovative product and everything. You tell me if it's a market worth investing in. Like, what aren't aren't your LPs paying you for this? But, you know, I think it's a fair question, though.
Rob Lee:But what did I see? Number one, I saw the mission piece of it, and that I would have done even if it was a nonprofit of, like, we have to do this. I watched moms working in the field all days long in Cameron and Boya region to come home and all they wanted was to be able to have a wind turbine spin of a car battery to have LED lights so their kids could study in the evening and get out of the trap they were in. And to find out that there's people around the world that was like, I'm gonna hack that and turn that off, it's like you're a bad person. And so the idea of just focusing on making it really hard for bad people to do bad things to good people, that, like, that resonated with me a lot.
Rob Lee:So I would have done it anyways. But also, I thought everybody was missing something even back then when I looked at I like, guys, it's you're talking about connected physics. What do mean the TAM? Like, it's everything. You don't tell me that you're not gonna want data centers and infrastructure and manufacturing for I you didn't know that an AI revolution was gonna happen at point, but you knew anything in the modern world that you're doing, even though it's all cloud, cloud runs on infrastructure.
Rob Lee:And so it was always obvious that you were going to need energy, manufacturing, transportation, and core infrastructure, and that was always gonna be a part of society. I think a lot of times people look at cybersecurity trailing the IT industry in terms of growth patterns. Like, as IT expands and cybersecurity wallets expand as well, I looked at IT's expansion trailing sort of what happened in connected infrastructure. And and so I just thought it was a bigger space than anybody realized, and it was a mission worth doing. And those two things together, it was like, cool.
Rob Lee:We're gonna do this. Like, early on, we didn't think we were gonna be successful growing fast. I remember taking the series a check and telling my team, like, this may be the last dollar of funding we get. So let's not go hire a bunch of sales and marketing people. Let's put in the product and and treat it like it's the last dollar of funding we took.
Rob Lee:Now we raised another 420,000,000 after that, but at the time, was a good mindset. You know?
Mahendra Ramsinghani:And what were the first five customers like? You know, how hard, how easy was it? Can you sort of go back to the in the first few and narrate what the conversations were like? Because even in your latest RSA presentation, you talk about how ransomware in OT is mislabeled as an IT problem. You know, it's still the IT tends to overshadow OT all the time.
Mahendra Ramsinghani:So how are you able to sort of segregate the two in customer conversations?
Rob Lee:Yeah. So we found a lot of luck in the electric community to start with because they had been getting the briefings. Understood there was a threat, and they generally had resources to invest and had a really good community. And I think that's always been the component of our relationship is just that authenticity and transparency piece where I told them, like, look. Here's what I'm going to be building.
Rob Lee:It's gonna take me years to get there. If you buy in now, like, it's you're
Ross Haleliuk:early
Rob Lee:adopting. I'll I'll be tailored to your requirements and things like that, but, like, I'm not gonna over pitch you and tell you it slices and dices and all this stuff today, it doesn't. And because we took that approach with them, that I think that's why they're still with us, and it was very much alignment around the mission. And so I don't you know, every founder's journey is gonna be different, but I think the, hey. I've got a better mousetrap is a hard sell.
Rob Lee:I think the I want to go deliver against a vision. Do you wanna come with me? I think that is something that resonates with customers, and and you'll very quickly find the customers that it doesn't resonate with, and you don't wanna be spending your cycles and time, especially early on with those customers anyways. And I do think nowadays as well, just as as all this stuff is popping off, I don't think any of that has ever changed in terms of how we approach people. And I think we've been largely rewarded for staying consistent on these are our values.
Rob Lee:This is the mission. This is the vision. We're gonna deliver on it, but but we're gonna sell you on what's important here.
Sid Trivedi:Let's talk a little bit about scaling and scaling to that unicorn status. You you mentioned that you've raised almost half $1,000,000,000 for the company for Dragos now. You're now worth close to $2,000,000,000.
Rob Lee:You have I would over one one point seven was a couple years ago. I'd say we're worth well more than $2,000,000,000, Sid. Yeah.
Sid Trivedi:As a flask as a flask, Mark. But you're absolutely right.
Rob Lee:Okay. You
Sid Trivedi:have and I don't wanna reveal any new updates on valuation. No. No. No. There's no update.
Sid Trivedi:Cybersecurity podcast.
Rob Lee:Here first. No. No.
Sid Trivedi:You have over 600 employees, and you've got hundreds and hundreds of customers. What has changed the most, you know, from those early days that we spoke about to now? Is it board management? Is it managing hiring across those hundreds of employees? Is it thinking about product roadmap?
Sid Trivedi:Is it the GTM expectations? What's what's changed the most for you?
Rob Lee:I think I let's see. I think very much so I have gotten better at I was a little bit of a loyalist early on. Hey. You guys are coming with me on this journey. I'm gonna bring you on this journey.
Rob Lee:And one of my board member actually I I love Samir. So Samir Reddy over at Energy Impact Partners is just a phenomenal human being, phenomenal investor. And he told me, he's like, you're one of the better CEOs I've ever worked with, Robert. You have one of the worst flaws. And I was like, what is it?
Rob Lee:And he's like, you fire way too slow. It was like, you you will find somebody that came with you on the journey, and you just wanna save them, and you're not bringing them in military battles. Like, they're gonna get another job. Like, you're saving their life, like, it's okay. But you gotta move faster on your executives.
Rob Lee:And so then I got to the place of like, okay, if you've gotta ask the question, you know the answer. Let's go. And I told the team, hey, here's how we're gonna treat it, you know, very transparent about it all, but I I started moving on people faster when they weren't able to get to the place they needed to get to. And and that allowed us to make some hard changes. Like, I went through two CROs within two years, and I remember, like, even board members being like, well, don't you think this will make it harder or hire the third one?
Rob Lee:And this is gonna be an issue, and what signal does it send to the market? And I was like, yeah. Like, all those things, but in reality, what signals does it send internally if I don't make the change now? I was like, I gotta I gotta solve that before I'm worried about reception elsewhere. And and I put a lot of focus into the go to market team, and I remember standing up in in front of them, and the and the last guy that I fired, like, he was actually a really good person.
Rob Lee:It just it wasn't a good fit. And I remember standing in front of the sales organization at SKO and I said, hey. I just I just fired him. Like, was literally like news to them. I was like, he's out.
Rob Lee:I'm gonna do it myself. And they're like, what? I was like, I'm not bringing in another CRO for at least six months. I'm gonna make sure everybody here has the opportunity to see their ability to earn for the year, myself, with you all, hearing directly from you, then I'll get you the next CRO. And I remember just, like, sort of putting it on my back kind of discussions, and luckily, I had some great people, RevOps, and everybody else around me.
Rob Lee:We And just turned the organization around and the culture of it around and everything else. And now everything's, you know, sky high. And we we hit the point where revenue is decelerating, everything else. Now we're at the point where we're delivering eight points over what we did the previous year and and growth expectations on board and everything else. So it's just that was a defining moment for us.
Rob Lee:And then I also had a lot of because I'm a technical person anyways, I I very depending on the product road map and like the understanding of it and hey, forget the buzzwords, what does that do and why does that not do this over here? Maniacal with customers and and being out in the road a lot with customers. And and I I I don't know how many I don't know what the normal ratio is for CEOs and founders to customers, but I I'm in front of customers every day. And and so it gives me a great insight to constantly be holding accountable on that product roadmap and so forth. And my chief project officer, Jody, really stepped up and really put that structure in place where we've been able to launch right.
Rob Lee:Over the next eighteen months, we'll launch three, if not four, net new ARR modules on the platform without a single extra headcount request into the r and d organization because she is just, like, making it more efficient as we scale and using the right resources to do it. And so as my burn stays flat and my growth skyrockets, those are great places to be in where I don't need to raise a series e. We can go profitable without doing a series e, but, of course, we'll we'll probably do some injection of capital because I wanna take over the world. Anyways, but we don't need to, and that's a great place to be in. And I would say that mindset shift and that structure structure was the area that I put a lot more focus in as a CEO and growing as a CEO versus being the tech person that can do instant response.
Sid Trivedi:And as these companies scaled, CEOs always start to optimize for certain metrics to the board. Is there a board level metric that you just refuse to optimize on throughout this whole journey? And and why was you know, pick one. I know there's there's there's many, but, like, is there one that you're
Rob Lee:like You guys you guys have spoken something like that. Like, but remember the relationship. I I am maybe I'm not the easiest person to do it, but I I run the board and I keep the board very tight. And they'll always ask, well, I want this metric. I want this metric.
Rob Lee:I want this. I want this. And I go, great. It's not material. The answer is no.
Rob Lee:They're like, what? And I'm like, your investment is across this term sheet and our governance documents are this and Delaware law. Here is what you're entitled to, and the rest of it is wasting my time. And so we don't give up anything unless I think it has an ability to be an accountability metric. So if like, I do view a board's role besides being investors, right, because that's not always true, but a board's role is on governance and actually holding accountability, especially the executive team.
Rob Lee:If what you're asking for can allow you to affect a change that relates to governance or accountability, I'm all for giving it to you even if you didn't ask. If it's a I have a curiosity or I'm investing in 30 other companies and I'd really like to know this metric as I go and invest, I'm like, I'm not here for your, like, portfolio. We're not doing that. And so our board decks and everything else are pretty slimmed down. One of the ones that I always thought was stupid was burn to ARR ratio.
Rob Lee:This it's the too many of you listen to the All In podcast and forgot unit economics. Like, I I don't understand why this was big in Silicon Valley. Like, somebody came to me and was, like, pushing on this burn to ARR ratio. I'm like, great. Don't you care about, like, I don't know, LTV to CAC ratios as well?
Rob Lee:Because burn would imply around a customer sales cycle, but if I can show you a good return, what do you care? So if I can deliver you high seventies, low 80 margins, I can I said, what would it be a good one be? Would it be three? Would it be four? They're like, if you had three to four, LTV to CAC ratio would be great.
Rob Lee:I was like, great. I have 6.6. So can we stop talking about burn to ARR ratio now? And so just that's the one. Like, anytime you synthesize down an entire company's discussion on a metric and you're missing the assumptions that went into that metric, the assumptions on burn to ARR ratio is that you were like every other SaaS company.
Rob Lee:Therefore, your LTV to CAC ratio was largely the same. Therefore, a difference between a one and a four was a big difference. But if those assumptions aren't right, then the metric is just stupid. And if you're and if you don't understand what went into the metric, you just look stupid asking for it. And I and then that was the one that annoyed me the most.
Ross Haleliuk:Dragos now has operations spanning The United States, UK, Europe, Middle East, Australia, New Zealand, Japan, and Singapore. But OT, cyber is fundamentally a local problem. Problem. Right? Every electric grid, every water system, every petrochemical plant, they all operate differently.
Ross Haleliuk:You said before that cybersecurity challenges are global in nature but local in practice. How have you thought about this tension between scaling a platform company and serving customers that need those very specialized boots on the ground expertise? Yeah.
Rob Lee:You you gotta invest. And and and what makes Dragos great has to be what Dragos is everywhere, but you you can't be surprised that it doesn't succeed in a regional expansion, as an example. So as an example, people love that they can come to us to partner with us. So we've got great technology, We've also got subject matter experts and service professionals. We've also got instant responders.
Rob Lee:We've also got technical account managers that come along the journey with you. We have Dragos in a box. If I'm not able or willing to take Dragos in a box at that level of investment and put it in Singapore, don't go. Because it took me all of that to be successful in The US. Why would I think it would take me less to be successful in Singapore?
Rob Lee:And and I do think there's something special about cybersecurity, but especially special about infrastructure. Where you might talk about like, hey, that's my bank. It's like, that's our water system, that's our electric system, you know, there's a certain pride in the systems that serve our communities. And so for you to come in and be like, I have a WeWork office and I'm here with a reseller, but I really care about you, Like, I don't think that resonates in OT security that much. So we would get hit a lot where the Gartner's of the world and some would take off points in the quadrant to be like, well, you're not in all the places in the world.
Rob Lee:I'm like, yeah. I know. But neither are they. Like, that's just surface level. I was like, when we go somewhere, we're gonna go correctly.
Rob Lee:And what that's turned into is extraordinarily low churn where I routinely have, like, a 119% NDR and sub 3% churn on the business because customers know we're gonna treat them well. We had this and and just be honest with them. We had this great meeting with this Indian power company. They really wanted us to to be in India, and they said, we are not in India right now. I was like, you're right.
Rob Lee:I'm not, and I want to. And so here's the level of investment I'm willing to sign up. I need an anchor customer. I said, we do this. Here's what it's gonna be.
Rob Lee:And it's a government owned infrastructure, so they had to get into reverse auction. And they really wanted us, but they they had to go this route. And they said, hey. Can you go to this level of discount? And I said, no.
Rob Lee:And they're like, well, hold on. Why not? We really wanna do this could be great. And I was like, I I know, but I'm already gonna lose money coming to you. And if I have to cut to this level, gonna have to cut out the technical account manager.
Rob Lee:I'm gonna have to cut out the instant responder that wasn't part of the package that I'm now adding in. It's like, I can't come and do it correctly, so I'm not gonna be the right partner for you. So what I want you to do is go choose the lesser product, let it fail, talk to your management, and come back and call me in 2. And I've done that before with people and they come back in two or three years and have that conversation with you and they go, oh, you told me this is where it was gonna fail. You told me you couldn't just do it surface level.
Rob Lee:We're ready now. And and I think if you can have trust in your business enough to know that you're gonna be here longer than a quarter, you're allowed to have that kind of conversation.
Ross Haleliuk:For founders who are going international for the very first time, what is the one thing that you would wish you would have known when you opened that very first office outside of The US?
Rob Lee:So I think that was an area I wasn't too concerned about because by the time I was, like, 20 I was, like, mid twenties. I had been to, like, 43 different countries. Right? And so I military was great for that. And why I say this is what I think most founders make a mistake on is they think about the market and they get excited about the market and they don't realize they're a tourist.
Rob Lee:And so I can have a great reputation all over the world. People may know my name, but I'll never be Singaporean. Like, I can go anywhere in Saudi, they treat me like a brother. I will never be Saudi. And so the idea of, oh, I'm gonna go to your country as a guest in your home and act like I belong here, kick off the shoes and everything else, like, that's a mistake.
Rob Lee:And so you need to make sure you have the local partners and people that grew up in that community, and and you invest with employees that are from that community. Like, my my Saudi employees are Saudi. You know, my German employees are Germans. Like, I I make sure that it's part of the community, and we invest in that community. It's not, hey, we're here to be exploitative and come sell you stuff and walk away.
Rob Lee:It's, well, how are we also doing talent and workforce build up because that's important to How are we also making sure that that Germany is better because Dragos is here? How do we work with the Bavarian state police when they need us on an infrastructure attack because we're we're in your house, and we're just trying to be helpful? And I think I worry that a number of founders I see don't have that mindset. They go, oh, Germany is a big GDP, or the next place to go is Singapore, and, like, look at the market size. It's like, woah.
Rob Lee:Woah. Woah. You're watching too much TV. Like, you're not from that culture. Learn the culture first.
Mahendra Ramsinghani:You know, speaking of different markets, Rob, you you think about expansion, and then I also think about competition. So Nozomi, Clarity, these are sort of, quote, unquote, competitors. And Japan is essentially conquered now. So talk to us about your notion of competition. How should founders think about competition?
Mahendra Ramsinghani:Give give our audience a little, you know, insight into how do good founders treat competition.
Rob Lee:I like my competitors. Alright. Now I am deeply competitive. Most sane people will put, like, the first dollar that you sell or whatever up in, a frame and a wall. I got tombstones in my house from what my competitors sell, and so I'm deeply competitive.
Rob Lee:But I'm deeply respectful of the fact that most of them have signed up because I wanna make the world a better place, and they're on their own journey. And and so, like, I had dinner and drinks with the CEO of Clarity not too long ago in Munich. I like the guy a lot. Like, my interactions with him are like, dude, you're mission driven. I I'm going to bury you, and I'm I'm not gonna enjoy it.
Rob Lee:You know? Like, I it's like, I I love you. Like, you're a really good human being. Andrea over at Inazomi, lovely human. But you can't let the conversations when you're not in the room get to you.
Rob Lee:Because I've heard stuff that Edgard has said come back to me through VCs and whatever, and it's not all friendly. And if you let that get to you, there's context missing. I bet you he said something and it got interpreted one way or three ways and then passed around like a schoolgirl, you know, notes class and stuff. And then all of a sudden, people are getting mad at each other. It's like, why?
Rob Lee:So I view competitors to be necessary. I view the whole steel, sharpen, steel kind of mindset. But also, if you break bread with them and get to know them, most of them are legitimately good people. And the ones that aren't, you just decide to not spend your energy there. And and so I tell all my employees, like, our number one competitor is execution.
Rob Lee:Go do that. Outside of that, they're making the market a better place. And we don't you don't wanna be the only one marketing and selling to the market and trying to do all of this yourself. Like, they're opening up those opportunities too. Now, my deeply competitive nature is I know behind the scenes what's really going on with those companies, not just those two, but like, I I like to know my competitors.
Rob Lee:So I read all the blogs of, oh, we're an independent company forever, and I read all the blogs of this is a great growth round. I'm like, yeah. I the details on that. I know the details on that. That's BS.
Rob Lee:You talk about Japan being conquered. Like, alright. Cool. When's the last time anybody at OT was like, I'm really glad my OEM is providing my cybersecurity? I'm like, alright.
Rob Lee:Good good luck. And so I love being in Japan, flying over there later this year with our wonderful partner, Mechnica, just make sure we go up behind it. But if you ask me how I feel about them as people and even on, like, their tech and stuff, I think it's wonderful. And I think they've got great people. And if you stay around long enough, which I have the intent to do, some of my people will go to their house, some of their house will come to mine, and as long as we can all agree that all of them need to be treated with respect and I can trust that my people going over to you are gonna have a good time and I'll take in the Zomi employee every now and then, I can trust that they're gonna be great people that that you helped build up, Like, that's a net additive for customers.
Rob Lee:If you care about the mission, you can't look at that stuff as negative.
Sid Trivedi:As we kinda come to the the last section of our conversation, we wanted to chat a little bit about the the mission for Dragos, which is safeguarding civilization and, you know, how AI and geopolitics and other, you know, areas are impacting that mission. The the concept of of safeguarding civilization is important here because, really, you're protecting critical infrastructure, and, you know, that critical infrastructure powers the rest of the world. And that includes data centers, which we talk about deeply as we're thinking about the kind of the next generation of AI based models. Now since Stuxnet was first uncovered in 2010, digital warfare has grown pretty dramatically, and it's become the new battleground. And and you've spoken about this publicly, but we're already seeing a lot of that today with Ukraine, Russia.
Sid Trivedi:We're seeing it certainly right now ongoing with US, Israel, Iran. We've seen pockets of this, not a conflict, but a quiet one with US, Taiwan, China. I'm curious to get your broader thoughts on the current threat landscape, and what's the part of the current threat landscape that worries you, that keeps you up at night?
Rob Lee:Yeah. There's a lot of stuff that happens outside the media. Like, we're involved in half a dozen incident response cases right now that will never be in the media related to this Iranian conflict. And and as I look at it, there's a whole lot of, like, it's the same on some aspects. Aspects.
Rob Lee:Right? Right? The types of attacks that are worried with most in industrial networks tend to be misoperation. It's not, hey. There's an exploit in malware and look at privilege escalated on an hemachine interface.
Rob Lee:That's not all that interesting. It happens, but okay. Most of it is, well, if the electric operator can open up a circuit breaker, so can the adversary. If I can change a set point to change a valve setting, I can do it as an adversary. It's misoperation, and that's harder to deal with as well.
Rob Lee:And what worries me let me let me say, geopolitically, worries me is it's very obvious, and it has been for a long time, but it's it's the emperor's taking the clothes off a bit of everybody actually views civilian infrastructure as valid military targets. And they say they don't, and they say they won't, and don't worry. We won't bomb hospitals. Don't worry. We won't go on after electric grids.
Rob Lee:Don't worry. We won't hit data centers. And and then you can justify it all as military targets the moment you want to. And so it's necessary to do this mission because there's gonna be a lot of people who get if you don't. The the thing that worries me technology wise is we have thrown so much automation and complexity in these industrial networks and commonality of interesting software stacks and similar, that you can scale attacks in such a way that you can do physical destruction or at least physical disruption in ways you couldn't ten years ago.
Rob Lee:And so you you used to have infrastructure. You had to spend a lot of time and effort to go after one site, and there were still some people that would do it. Now you can put the time into building one capability that scales across hundreds of sites. And we are already starting to see state actors transfer knowledge and capabilities to non state actors and realizing their hackiness groups and similar can be a part of this game as well on the OT front. We had, you know, a group that was hacking Internet connected human machine interfaces and writing, like, Israel sucks on it, you know, one day.
Rob Lee:And then a month later, they're showing up with, like, program logic controller based implants, ladder logic manipulation, physical process disruption. It's like, you got a knock on the door. Like, you didn't just, like, learn that in a month. And and so as all of that happens, that proliferation happens at the same time that we're making all of our stuff more complex anyways, then we're like, hey. Let's also throw AI on top of grid monitoring and mining operations and similar.
Rob Lee:You're gonna start getting to a place where we have disruptions, explosions, downtime, etcetera, up to and including loss of human life, and we're not gonna know why. They won't be able to determine was it a cyber attack or not. It'll be something happened. How do we do root cause analysis? And they'd be like, well, did you collect the data ahead of the incident?
Rob Lee:And they're like, well, no. I'm like, alright. Well, we don't know. And and that's gonna make a lot of people and governments and everybody else deeply uncomfortable as it should, and that's that's you don't do a six month IT security project in OT. You're talking about a multiyear journey at a time that you're not looking in you're looking inside of a multiyear event window.
Rob Lee:So I I'm I'm worried that people are gonna die, and we won't know why.
Ross Haleliuk:You wrote after Davos that the next phase of the digital transformation is going to be about AI integration into OT. So that is AI being deployed directly into the control loop, making decisions that impact the physical world we live in. You also warned that the pace of adoption is going to outpace our ability to manage risks if we don't start acting today. What does that actually look like in practice? Practice?
Ross Haleliuk:Like, what what kind of scenarios keep you up at night when you think about AI controller running a gas turbine or managing a water treatment plant, and what should we be doing to prepare for that future?
Rob Lee:Yeah. Yeah. Good example of what it looks like in practice on the on the defender side is I've got a giant mining company as an example that when they go and put new control systems into process control environments, they're generally going between a twelve and eighteen month cycle with their vendor testing, validation, etcetera. Their CEO and board is pushing so hot and heavy on AI and anything with AI, like, get it out of the process, like, let them stop being stop thinking backwards and, like, let's let's let's lean forward that the same vendors are pitching stuff with the word AI appended to it and getting inside of the environment within three months. And so it's just not the level of testing and validation you want when when accidents lead to death.
Rob Lee:And so we are we are seeing a rapid adoption of things that also may not be here. The market's gonna reset to some degree. I don't think it'd be a giant bubble, but it'll be reset to some degree. You're gonna have startups that are now part of critical infrastructure that are no longer in existence the next day, and you gotta manage that as well. And so on the op side, it's risky.
Rob Lee:Now you start adding in the fact that an adversary can misoperate equipment, cause an explosion, whatever, and there's so many communications and so much complexity in system one versus system two and so forth across this environment, you won't be able to determine it. The ability to get ahead of it is the stuff that we talk about, like visibility detection response. It's it's all the same stuff. We're really talking about being able to collect data and do things with data. And if you collect the right datasets, you can use that same data for operational value, you can use it for cybersecurity value, you can use it for root cause analysis, but you gotta have the data collection.
Rob Lee:And and I am, again, deeply worried about the adversaries that understand that and know how to take advantage of it. And we are running into still some weird fights. I still get people saying, oh, IT, OT. What's the difference between the two? You know, I I'll talk to presidents and CEOs and boards and they understand it faster than CSOs sometimes that are just like, I don't know.
Rob Lee:I've been doing this for the last twenty years. I'm like, yeah. I know. You've never been in ops. Like, it's different.
Rob Lee:And or, you know, there's a firewall company that talked about how all OT attacks originate in IT networks, so why wouldn't you just protect the IT networks? And it's a great paper by a great brand, but then you go and you wait. Well, hold on now. None of your stuff's deployed in I in OT. All of your telemetry is coming out of IT.
Rob Lee:So when you go into your telemetry and look for OT attacks, you would only ever see it come out of IT. So you're just making it up. Like, you you it's not, I guess, not made up, but the collection bias is gonna mislead an entire community on what they need to be doing as a result. So it's it's not like fighting inside the house is what worries me. And if you really wanna get controversial, the thing that scares me the most is used to you had CEOs of infrastructure companies that came from the industry.
Rob Lee:You had you had Tom Fanning at Southern Company started the switchyard. You had Bill Furman at American Energy Power. He started in public power, Nebraska public power district. You had CEOs and board members that knew what business they were in. So when they got big projects pushed them at the board level, they'd be like, I don't think that's actually how that works.
Rob Lee:So that's gonna you know, that's not gonna do that job. What I'm seeing the most now is investment bankers installed as CEOs or private equity folks or the CFO that came over, but had only been there for two years getting installed as CEO, and nobody around the boardroom having industry experience. And so they're authorizing things that sound really good and push the envelope of these of these industrial companies and AI and digitization and all this without understanding the consequence and understanding what can go wrong. You know, safety rules are written in blood. Cybersecurity, know, standards are written by committee.
Rob Lee:And so that is gonna take us to a really weird place if we're not careful.
Sid Trivedi:Just on that topic, I mean, I think the one thing we've had in the startup community, particularly in the cyber startup community, is OT security is not considered an area that you can go and innovate in. I'm curious just what do you see where there's an opportunity for new founders? We have lots of, you know, operators listing in on on this show, and they try to think about, like, new ideas. Like, what would be one thing that you'd say, hey. This is why I think you should look at this space, and here are some areas that you may wanna spend some time in that we're not spending a ton of time in today.
Rob Lee:Yeah. I think I think there's a lot of untapped space. I think people look at OT security as a category, in the same way they have like those market scapes, and they'll be like, here's the firewalls, and here's OT, and here's this. I'm like, guys, it's the whole market scape again. Like, it's a it's a market.
Rob Lee:So you'd have OT endpoint if it made sense. Like, you'd have OT backup and recovery. You could have OT. Not everything. There's some IT security stuff that works well, but quite a bit is untapped space to do interesting and innovative things in OT.
Rob Lee:You just have to understand why is this truly different than the IT answer and where is the pain point that actually is worth addressing. I'll I'll give you some so, like, good example. I I'm I'm gonna get beat up by some friends here. I personally don't think secure mode access into OT is all that different than IT. I can't find a reason.
Rob Lee:I could have bought one of those companies on equity, made a bunch of money. I I I just couldn't get behind it. Now if you're talking like Lior over waterfall doing data diodes, that's different. But I mean like secure access stuff. I I I don't see why I could recommend to a customer not to deploy like BeyondTrust or Zscaler or something instead.
Rob Lee:If I look at backup and recovery, that's uniquely looking at, like, ladder logic and the orchestration across industrial environments and stuff. That's a very unique space you're not gonna get in a typical backup and recovery solution. Or I still think there's a really interesting market. It's not truly cyber, but looking at, like, process analytics. Like, there's been a bunch of companies that have tried that over the years, but I still think that's there's a there there of finding how to use the exact same datasets to drive operational value that is a revenue generator for those companies.
Rob Lee:I also think that the AI stuff will be super interesting. I like what Frenos is doing in in terms of, like, looking at how to use AI across intelligence and similar to prioritize and and constantly do some level of assessment work in your infrastructure. Yeah. I I actually like NetRise, looking at how they're doing product security, and they're looking deeply into the supply chain aspect of it. And your supply chain is complex in IT.
Rob Lee:Don't get me wrong. You got some pretty major vendors, Cisco, Microsoft, etcetera. Etcetera. We have hundreds and hundreds and hundreds of diversified vendors across thirty year life cycles. The supply chain issue for us in OT is very interesting.
Rob Lee:And so where there's unique value that you could say that this is gonna be a twenty or thirty year thing, I think you got an OT story. If you're thinking it's a two to five year thing, that's not a life cycle we consider an OT.
Mahendra Ramsinghani:Rob, just speaking of life cycles and the time span and the duration of which you operate in compared to the rest of the industry, you know, couple of thoughts in closing. Where do you see yourself, and how do you define success, let's say, ten years from now?
Rob Lee:Mhmm. Yeah. I I told my company that I wanna build a hundred year company. And what that means to me is, again, I'm not so worried about the structure. I wanna know that there's Drago's permanence, which includes focusing on OT no matter what, and an autonomy to make those choices.
Rob Lee:And what a hundred year company means to me is I'm gonna be dead, and everybody in the company that I love and value and makes this culture is gonna be gone. So how do I know that the the Dragos team next, the Dragos team a hundred years from now, embodies the same values and mission ethos and focus and can stay focused on that mission? So a lot of the time and effort I put in now and talking to future investors and the strategy of it and restructuring my board structure and all these things going forward is, okay, not ten years, but a hundred. How how do I know the guy or gal or other after me and this team is living inside of this structure? How do we how do we lay that foundation?
Rob Lee:And and and I spend probably an uncomfortable amount of time thinking about that these days, but but it is my priority. And so as I go out and talk to investors and so forth, when they're like, oh, here's the next round valuation. Like, I don't know what it's gonna be in a hundred years. That's what it is right now is not that interesting. I I need to understand all the rest of the discussion.
Mahendra Ramsinghani:You know, Rob, in Silicon Valley, some of the VCs talk about missionaries versus mercenaries. And I find this entire conversation, I'm sure my cohost, Ross and Sid, would agree that here is a missionary who's not in Silicon Valley. He's quite far away from Silicon Valley. He's doing true work in protecting national infrastructure. You know, as a lieutenant colonel, you know, you're part of the team that designs national response to infrastructure attacks.
Mahendra Ramsinghani:You know, that's the part of service that very few people know and understand. You do work at Sands as well to continue to spread your knowledge and wisdom. So in closing, I can say that, you know, there are very rare founders who can operate the way you do. You know, there's a peacetime CEO. There's a wartime CEO.
Mahendra Ramsinghani:And war, not just good inside the company, but war is going on outside. And we feel like the way you're conducting yourself and building this company is truly remarkable. I'm sure a lot of our audience members will get a lot of inspiration from this episode. So thank you so much for joining us.
Rob Lee:Yeah. Thanks for having me, guys. And, I am all bluster and everything aside, the investor and operator community has added a whole heck of a lot to these discussions, and I've I've definitely always learned from you guys over the years. May maybe I haven't learned as much from Sid as he'd like, but I I still learned. So, anyways, thanks for thanks for having me, guys.
Sid Trivedi:Thank you for joining us Inside the Network.
Ross Haleliuk:If you like this episode, please leave us a review and share it with others.
Mahendra Ramsinghani:If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and send it to me first.
Sid Trivedi:No. Don't do that. Mahendra gets too many gifts already. Please reach out by email or LinkedIn.
