Casey Ellis is the founder of BugCrowd, the first open marketplace for vulnerability disclosure and commercial bug bounties. On today’s episode, Jon Sakoda speaks with Casey on the early economics of paying people to hack companies, why ethical hackers are an amazing source of criminal creativity, and why every founder needs to ultimately fix their known vulnerabilities:

• Why the Economics of Bug Bounties are 20x the Status Quo [11:23-14:42] - Casey had global access to talent around the world and saw that there was a huge opportunity to empower the best and brightest hackers to be paid for finding vulnerabilities. This was a 20x improvement on traditional pen testing and opened the floodgates on bringing traditional hacking out of the dark and into the light.
• How the Best Hackers and Companies Find Success Together [15:04-24:30] - Bugcrowd early on attracted some of the best hackers onto its platform, but ultimately needed to teach companies how to engage. Setting the right reward incentives, the right targets, and offering responsive feedback were key to getting the right level of engagement on the marketplace in the early innings. Now, most high value tech companies have successful programs.
• Why Prioritizing Health Fixes is Life or Death [32:45-39:18] - Like many founders, Casey prioritized his startup ahead of other important health issues, which ultimately led to a cardiac emergency requiring open heart surgery. He is now back in action but has an important lesson to share with founders on the importance of taking care of your known vulnerabilities and investing in proactive and preventative care in advance of real issues.

Yaron Singer is the Founder and CEO of Robust Intelligence, the early leader in AI security that was recently acquired by Cisco. On today’s episode, Jon Sakoda speaks with Yaron on how academics need to decide on the right time to start a company, why the capabilities and risks of AI for many industries need to be approached end to end, and why startups should seek to dispel many of the myths of being acquired:

• Why Skateboarding Prepared Me Well for Entrepreneurship [4:10 - 5:45] - Yaron early on picked up skateboarding as one of his first hobbies. He realized that in order to improve in skateboarding, you need to learn both physical and mental resilience. Your body has to endure quite a bit to get better! He was also inspired by those who pushed the sport by creating new tricks and techniques. This ultimately inspired him to chart his own course as a founder.
• Why AI Has an Inconvenient Truth [15:25 - 17:15] - Yaron was a PHD student at Berkeley and ultimately became a professor of computer science at Harvard. Along the way, he learned the great power and also the great limitations of using machine learning and AI for many applications. As much as we would like to move quickly to embrace the power of AI, we don’t always understand how to do so safely. Yaron has ultimately dedicated his career to helping people step into the fear of the unknown by using his products.
• Dispelling the Myths of Getting Acquired [17:30 - 22:50] - Many founders told Yaron that partnering with a large company like Cisco would be a risk. Perhaps they would steal his intellectual property or compete with him directly? Yaron believes strongly that the benefits of partnering have outweighed the risk, and that every founder must make the most of partnership opportunities with large companies that can ultimately lead to successful M&A events.

Dmitri Alperovitch is the Co-Founder and former CTO of Crowdstrike, one of the most valuable cybersecurity companies founded in the modern era that defined the Endpoint Detection and Response (EDR) category. On today’s episode, Jon Sakoda speaks with Dmitri on why email security was one of the best places to learn cybersecurity, the hardest parts of finding product-market fit in a new category, and how all of his learnings inside of larger companies ultimately inspired him to start Crowdstrike:

• Why E-Mail Security Was the Best Place to Learn About Adversaries [7:15 - 14:32] - Dmitri’s early career at CipherTrust put him on the front lines of stopping email spam. This was a rapidly changing field that taught him that adversaries could make changes in hours, not days or weeks. This mindset taught him that there are no silver bullets and that our defenses must always adapt quickly to ever changing threats.
• Building a Services and Software Company Together to Own the Category [33:53 - 39:34] - In the early days of Crowdstrike, the team built an elite services team that gave them insight into how nation state adversaries were breaching customers. This gave them unique lead generation and IP that helped them build their endpoint security solution which ultimately became the category leader in EDR.
• How Targeting Existing Budgets Unlocked Revenue Growth [39:35 - 45:15] - Crowdstrike early on complemented existing AV solutions with an advanced EDR and IR offering, primarily targeting companies who understood nation state attacks. Their revenue growth accelerated when they offered to replace traditional anti-virus and could access existing budgets for endpoint security. This move ultimately gave them a much larger TAM leading up to their IPO.