EP 91: How George Kurtz (CEO, Crowdstrike) Built A $65B+ Company

George Kurtz is the CEO of CrowdStrike, a $65B+ public cybersecurity company. In this episode, George reveals the surprising intricacies of paying ransom and discusses how CrowdStrike is dealing with increasing cybercrime in the age of AI. We also talk about CrowdStrike’s early days, including how the company found product market fit and the operating frameworks that brought them to the forefront of cybersecurity today. (0:00) Intro (1:52) The Journey to Founding CrowdStrike (2:38) The Difference Between Stopping Malware and Stopping Breaches (3:27) Inspiration Behind CrowdStrike's Unique Approach (4:30) Challenges of Building a New Architecture in Cybersecurity (5:10) The Decision to Leave McAfee and Start CrowdStrike (8:11) Early Days of CrowdStrike: Building the Product and Offering Services (9:45) Unexpected Beginnings of CrowdStrike's Intelligence Product (10:33) The Role of Incident Response in Cybersecurity (11:16) Journey to Becoming a Software Business (14:36) Evolution of CrowdStrike's Product Offering (19:54) The Importance of Building Trust and Credibility in Cybersecurity (20:27) The Role of Nation States and Cybercrime in the Growth of Cybersecurity Threats (25:09) Experience of Handling High-Profile Cybersecurity Incidents (26:16) The Importance of Having the Right Investors and Board Members (34:08) The Strategy Behind Competing with Big Players Like Microsoft (42:09) The Importance of Having the Right Team and Leadership (43:53) The Challenges and Rewards of Scaling a Cybersecurity Company (48:49) Hiring and Retaining the Right People (49:49) Understanding Different Types of Salespeople (51:52) The Importance of Marketing and PR in Business (55:59) The Role of Nation State, E Crime, and Hacktivism in Cybersecurity (1:05:03) Impact of AI on Cybersecurity (1:09:36) The Importance of Password Security (1:10:41) New SEC Reporting Rule for Cybersecurity Breaches (1:14:48) The Role of AI in the Future of Cybersecurity (1:17:42) The Journey to Entrepreneurship (1:19:58) Importance of Timing in Starting a Business (1:25:06) Impact of Early Life Experiences on Entrepreneurship (1:26:58) The Role of Sports in Developing Leadership Skills (1:29:41) Transition from Accounting to Entrepreneurship (1:29:55) Importance of Timing and Market Readiness in Entrepreneurship (1:35:32) The Role of Teamwork in Business Success Produced: Rashad Assir & Leah Clapper Mixed and edited: Justin Hrabovsky Executive Producer: Josh Machiz 🎙 Listen to the show Apple Podcasts: https://podcasts.apple.com/us/podcast/the-logan-bartlett-show/id1606770839 Spotify: https://open.spotify.com/show/5WqBqDb4br3LlyVrdqOYYb?si=3076e6c1b5c94d63&nd=1 Google Podcasts: https://podcasts.google.com/feed/aHR0cHM6Ly9mZWVkcy5zaW1wbGVjYXN0LmNvbS9zb0hJZkhWbg 🎥 Subscribe on YouTube: https://www.youtube.com/channel/UCugS0jD5IAdoqzjaNYzns7w?sub_confirmation=1 Follow on Socials 📸 Instagram - https://www.instagram.com/theloganbartlettshow 🐦 Twitter - https://twitter.com/loganbartshow 🎬 Clips on TikTok - https://www.tiktok.com/@theloganbartlettshow About the Show Logan Bartlett is a Software Investor at Redpoint Ventures - a Silicon Valley-based VC with $6B AUM and investments in Snowflake, DraftKings, Twilio, and Netflix. In each episode, Logan goes behind the scenes with world-class entrepreneurs and investors. If you're interested in the real inside baseball of tech, entrepreneurship, and start-up investing, tune in every Friday for new episodes. Executive Producer: Rashad Assir Producer: Leah Clapper Mixing and editing: Justin Hrabovsky Check out Unsupervised Learning, Redpoint's AI Podcast: https://www.youtube.com/@UCUl-s_Vp-Kkk_XVyDylNwLA 🎥 Subscribe on YouTube: https://www.youtube.com/channel/UCugS0jD5IAdoqzjaNYzns7w?sub_confirmation=1 Follow on Socials 📸 Instagram - https://www.instagram.com/theloganbartlettshow 📱 X - https://twitter.com/loganbartshow 🎬 Clips on TikTok - https://www.tiktok.com/@theloganbartlettshow About the Show Logan Bartlett is a Software Investor at Redpoint Ventures - a Silicon Valley-based VC with $6B AUM and investments in Snowflake, DraftKings, Twilio, and Netflix. In each episode of The Logan Bartlett Show, we sit down with the people behind today’s most important startups and extract the tactics, lessons, and frameworks they’ve learned the hard way. Conversations span hiring to GTM, product, growth, fundraising and everything in between - collectively forming the ultimate playbook to make you a better CEO, investor or board member. Tap follow and enable notifications to stay ahead of the game.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:05Logan Bartlett?

  Welcome to the Logan Bartlett Show. On this episode, what you're going to hear is a conversation I had with George Kurtz. George is the co-founder and CEO of CrowdStrike, a company worth tens of billions of dollars in the public markets. George and I had a fun conversation talking about a number of different things, including finding product market fit in the early days of CrowdStrike, his vision of turning the company from a service-oriented business into a cloud software platform, as well as his strategy for managing and hiring people at scale. We also touch on a number of different things related to the cybersecurity industry, including the impact of artificial intelligence and the

• 0:45Logan Bartlett?

  democratizing of cybersecurity attacks that are going to occur because of it, as well as the decision process that companies need to go through in deciding whether or not to pay ransomware or to risk customer or employee information being leaked on the public internet, and how George advises companies in that process. A really fun conversation with George that you'll hear now. George, thanks for doing this.

• 1:12Speaker 01

  Great to be here.

• 1:13Logan Bartlett?

  Nice weather in Scottsdale.

• 1:16Speaker 01

  Should be a little bit nicer, but yeah, I get a little rain this morning.

• 1:18Logan Bartlett?

  Yeah. So I want to talk about timing a market and determining when there's an opportunity for product market fit. So before starting CrowdStrike, you were the global CTO of McAfee.

• 1:30Speaker 01

  Yep.

• 1:31Logan Bartlett?

  What were the set of circumstances that led you to wanting to start CrowdStrike?

• 1:36Speaker 01

  Well, I got to McAfee in 2004 at a company called Founson. I sold to McAfee, spent seven years at McAfee, and then was general manager, so was running things, and then was asked to be the CTO, and turned it down twice because I didn't want to be just a tech guy. Ultimately, took it and was the best job that I had originally turned down, which gave me a much better appreciation for how challenged the security market was at that time. And really, when you look at what people were spending money on... They they should have been getting the outcome of not being breached, but they were basically spending money with players, Mac, they're smanting others that were focused on stopping malware, not stopping breaches.

• 2:18Logan Bartlett?

  And what's that distinction for people that aren't in the security industry?

• 2:21Speaker 01

  It sounds simple and it sounds similar, but it's vastly different. Malware is, there's a file that runs and I want to make sure it's good or bad. It's kind of a binary decision. And the problem is if you don't make the correct decision, you have what's known as silent failure. So the program runs, you get infected, you get compromised, ultimately get breached. So what I looked at is said like industry is focused on the wrong problem. They're trying to stop malware as opposed to stopping breaches. And it was just a different way to look at it and people really weren't looking at it that way. And the way we built the system is designed that there's no silent failure. You're going to have a failure in missing a file or something, but ultimately down the entire attack chain, you're going to see something that happens and you're going to be able to stop a breach.

• 3:05Speaker 01

  You might have an incident, but you stop a breach.

• 3:07Logan Bartlett?

  So you saw that that happening as well. And then there was a story about sitting on an airplane and seeing you were the CTO, watching someone else download, try to install an update for McAfee. Is that right?

• 3:18Speaker 01

  Yeah, so I, so I took over begrudgingly as a CTO job and I said it was a great job. Now, I wasn't running engineering, but I'm kind of sitting over the whole product portfolio. And I'm on a plane, I literally had circumnavigated the entire globe.

• 3:35Speaker 01

  I think I started in California and went all the way around through Australia and came back. And I was sitting, there was a guy that was catty corner to me, one row up. And he booted his computer and I could tell that it was McAfee because it had the logos on it, the encryption logos as it started. And it literally took 15 minutes for the thing to start. And he was talking to the flight attendant and he was reading his newspaper and just getting his coffee. And the thing is still grinding away. And I'm looking at that going, okay, that's just a terrible user experience. And I'm the, you know, I now inherited this as a CTO of McAfee. What could we do differently? And that really. Led me to think about using the cloud and coming up with a different architecture, a different focus, which ultimately I did go back to Mac and say, hey, we need to do

• 4:19Speaker 01

  these things if we want to be competitive. Nobody was really interested in, I worked for the CEO, nobody was so much interested in listening because they weren't, they wanted to sell the company.

• 4:28Logan Bartlett?

  I mean, similar story, I think Eric Yuan at Zoom did the same thing, wanted to start it in-house and then ultimately spun out to start the company. So, so the product architecture was older and cloud presented a new way of, a new delivery mechanism. And then they were focused on the, the, the wrong problems, I guess, for malware versus, versus breaches. So that, that happens and you say, okay, I'm going to go out and do this. Now you do short stint at Warburg, right, as an EIR, like kind of incubating this idea, is that right?

• 5:00Speaker 01

  Yeah. So essentially I, I went to, to Mac and said, hey, we need to do this. Nobody wanted to do it. It was going to take, you know, a number of years and it is not easy. This is part, part of the problem is like can't take Siebo and make it Salesforce. You can try, but you know, pretty much got to start over with a lot of this stuff.

• 5:17Logan Bartlett?

  Is that a technical thing or is that just like a change management, hey, people are getting paid to do this and it's too big of a

• 5:23Speaker 01

  It literally is everything, but if you look at how the Salesforce sells, how they get compensated, how the whole go-to-market motion, it was just AV product. And there was a much different mindset and DNA that you needed to, A go cloud. So two biggest things for me was the architecture was wrong, on-prem, it wasn't, it was just old, right? I mean, it was what it was.

• 5:43Logan Bartlett?

  It was right at one point.

• 5:45Speaker 01

  It was right at one point. So that point in time and to stop breaches, you needed a different architecture. So if you start with the premise of you're building something to stop breaches, you need to look at the architecture and it was wrong for that. It was fine for, at the time, you know, when it was built many years ago for signature based AV detection, but not for stopping breaches. So, you know, again, I went and said, hey, we need to do this. Nobody wanted to do it. I was very upfront with everybody because they knew I was, you know, sort of every couple of years I'd be Kind of re-upped, if you will, because I'm like, hey, you know, getting recruited. All these venture guys wanting to do another thing like, what are you thinking?

• 6:23Logan Bartlett?

  You're an entrepreneur and you did eight years at, you know, a big company, right?

• 6:26Speaker 01

  Yeah, yeah.

• 6:27Logan Bartlett?

  A nice run.

• 6:28Speaker 01

  Exactly. It was, it was a great run. Learned a lot, you know, really enjoy the people I've worked with. So from that perspective, I was just upfront and saying, hey, I'm, you know, if we're in the middle of selling the company, which we were, um, then I'm, you know, when we're done, I'm going to go do something else. And, you know, the Warburg guys actually wanted to buy Fountain while we were selling it to McAfee. And it didn't work out because they were kind of late and just was in the process. We sold to McAfee. It worked out better, you know, for me, just going through the experience at McAfee. So they kept in contact with me every year and they, they basically would call once a year, hey, you know, what are you thinking? And, uh, you know, normally it's like, hey, I'm busy having fun doing this and, you know, but always thinking. And then finally we had a conversation

• 7:11Speaker 01

  and, you know, I said, hey, we're selling this thing and I'm going to go do something else. So that's how the whole E I R piece came together.

• 7:17Logan Bartlett?

  Interesting. So, so now you're there and the initial product, as I understand it, and I think, uh, Excel had some memo from the early days that, that, uh, I think 20 B C posted online, a version of it. But the initial product that you had was services that you guys, you, you offered in addition to a software solution that you were going to go after what became this E D R space. But can you, can you talk about like what, once you get there, Warburg and you go give them a pitch and say, this is what I think it's going to be. What were the products you went to market with?

• 7:51Speaker 01

  Well, I mean, the whole idea was to build a cloud-based, um, there was no, E D R wasn't a term. It, it is all, I just looked at the slides before it came and it was literally what we built.

• 8:04Logan Bartlett?

  Did you make up the term E D R at that point?

• 8:06Speaker 01

  Or no, Gardner came up with the term.

• 8:08Logan Bartlett?

  Oh, interesting.

• 8:08Speaker 01

  We, uh, we were calling it endpoint activity monitoring, E A M. Then Gardner came up with something else. So, you know, we went with that, but there was no term. There was no M D R. There was no E D R. There was none of this stuff. And the original concept, we never would have been funded on the service company, but the original concept was, okay, we are going to, um, create this technology and we're going to integrate intelligence because we think you have to have an intelligence first approach, given. You're trying to beat adversaries, right? Not defeat malware, defeat adversaries. So we were building a whole intelligence team, which is now several hundred people. And we first, it's kind of an interesting story.

• 8:51Speaker 01

  The guy works and still works for me today, who runs intelligence. He wrote a blog on these threat actor groups. And it's much more common now to understand what's happening. Back then, it was all about advanced persistent threats and people didn't really have a good view of how it all worked. So he writes a blog and he basically puts it out and people liked it. Then he writes another blog and he sends me the draft because I'm doing everything. So I read the draft and I go, okay, looks good. I said, why don't you at the bottom put if you're interested in buying Crouch Strike Intelligence, you know, email [email protected]. And he said, well, we have a problem. I said, well, what's that? He goes, we don't have an email address called [email protected]. So I said, we can fix that. We'll, we'll add an email address. Just put it out there.

• 9:36Speaker 01

  And he goes, well, we don't have an intel product. I go, we can fix that too. Don't worry about it. So he ships it out. We got all kinds of inbounds going, oh, we wanna, we wanna buy security intelligence. And that's how we got the, the first incarnation. But we were always building the product. Obviously it takes a while. And then we, we, we had services doing incident response. So a lot of the incident response markets started at Foundstone and Kevin Mandi worked at Foundstone. Then Kevin went out when we sold the company to McAfee. He went and did his own company, which originally called Red Cliff Consulting, renamed to Mandi. And that, that was really the beginnings of the, of the incident response market.

• 10:16Logan Bartlett?

  And for people that maybe don't appreciate what incident response is or intelligence and all this, I mean, this is, if a, if a hack occurs or a breach occurs, this is helping people go in and figure out a postmortem, like people are showing up onsite and looking in log files and trying to figure out, hey, this was connected to this and they got this information and then went here, right?

• 10:38Speaker 01

  It's Ghostbusters when you have a breach. That's basically what it is.

• 10:41Logan Bartlett?

  Postmortem, let's figure out, is it done? What happened? All that stuff.

• 10:44Speaker 01

  To recreate it.

• 10:45Logan Bartlett?

  To recreate.

• 10:46Speaker 01

  Like CSI. But long story short, so we started the incident response practice along with the

• 10:47Speaker 01

  You've got to recreate.

• 10:52Speaker 01

  intelligence subscriptions as we were building the endpoint product. But the core focus from the company day one was always to build what we actually built.

• 10:59Logan Bartlett?

  You were always going to be a software business, but this service could serve as a tip of the spear.

• 11:06Speaker 01

  It's a tip of the spear because in security, it's a very, trust is big, right? And to have an intimate relationship with a customer where you're helping them is very important. And it serves another purpose, which is to actually understand how the breaches are happening. So if you have the latest intelligence and you're doing the biggest responses, you're always going to be front and center of knowing how to defeat the adversary.

• 11:31Logan Bartlett?

  So you're kind of productizing as you go along incrementally, like, hey, we learned this new thing. Can we build this into the product and make it better? And so is it a flywheel like that? Or that one goes into the other and then you're able to sell them?

• 11:45Speaker 01

  The product was so unique and differentiated in terms of how it worked and its architecture, still is today, that it was a little less about that. And it was more on how do you, this whole concept of an OODA loop. If you don't know what that is, you guys can at home can Google that.

• 12:02Logan Bartlett?

  Is that the snake eating itself?

• 12:03Speaker 01

  No, the OODA loop is, it's basically when you observe and then you decide and then you you kind of reorient yourself and then you make another decision. So in the Top Gun School, years ago, we were getting beat very badly. And there was a decision loop that came up with a guy named Boyd. And basically, it was this OODA loop. So it was basically understanding and orienting and then making fast decisions. That's the way the system was built. So what we were doing with the services team is that we were gathering the intel and the techniques to build into our system. So that's how it all worked. You needed the techniques of how breaches work and you needed the intel to build into this very fast loop system.

• 12:45Logan Bartlett?

  It's an interesting thing because you're you're building trust and credibility both from your blog posts as well as going onsite and helping people. And then you're saying, hey, to help you in the future in a more automated way, we also are building this product or going to have this product that you can you can use from there. Did the customers, were they fully aware that this other thing existed in the early days? Or were you just trying to get in and build trust and then knowing that was going to come down?

• 13:16Speaker 01

  Well, we worked with with some big companies, you know, to give us thoughts, ideas. We had our own idea. And if we if when we told somebody this idea, it wasn't, they're like, huh, you know, is that really going to work? And it was something so new and novel to be able to solve this from the cloud. So we couldn't just go to a customer and say, how would you do it? Because we would have gotten like tweak McAfee as opposed to reorient into something totally different. But at the end of the day, they wanted the problem solved. They had APTs, Advanced Persistent Threats, that was the term back then. And they had too many of them. They couldn't find them. Traditional technologies were failing. So they wanted something different. And we worked with many of them to basically get their ideas.

• 13:59Speaker 01

  And then we first started, you know, we got our release out and it was, you know, didn't do all that much. And then we just kept working on it, working on it and getting better, you know, at these OODA loops and what we call indicators of attack. These are attack patterns. And they're all built into the product today. And AI was, you know, before it's now kind of a buzzword, if machine learning was the big thing that we focused on to be able to solve problems without signatures. So that's that was those were the early days.

• 14:28Logan Bartlett?

  So you raised 25 million from Warburg?

• 14:31Speaker 01

  Uh huh.

• 14:32Logan Bartlett?

  And you're going about this building services as well as software. Are these teams distinct internally? Like, do you have people?

• 14:38Speaker 01

  Yeah, we actually had a it was a wholly owned subsidiary that did our our services.

• 14:42Logan Bartlett?

  Oh, interesting.

• 14:44Speaker 01

  And then we had our intel team, which was separate. So we had product, intel and services.

• 14:49Logan Bartlett?

  And so then you land with software at some point, right? This is the tip of the spear and you're selling some consulting services, then you land with software. And at that point, you're sitting alongside the big antivirus vendors and you're saying, hey, we'll help you with. With your breaches and help you figure out all of that stuff. And then at some point along the way, you were able to convince them, we actually, you don't even need antivirus software?

• 15:14Speaker 01

  Right, so what we first did is we basically, because nobody wanted to just throw out what they had, you know, certainly in the early days, we're, you know, five guys, a dog in a garage, right? So we had to basically come up with something in a particular use case, which was around visibility. And we would run side by side with any number of AV products that were out there. And then ultimately, as we built the prevention capabilities, you know, we basically, customers saw it for themselves, like, we were catching everything that the others weren't. And they're like, well, why don't we just use you? But the thing that we did different than just about everyone else in the industry, most of the other companies started as, certainly the ones we compete with, you know, they saw

• 15:57Speaker 01

  what we were doing and then they copied it, but they started as an AV product first, not a data product. And this is why architecturally, so many of these companies have challenges, because they were kind of on-prem, next-gen AV tools. And then they had to bolt on all the other pieces. We started with the hardest part, which was the data collection at scale, which allows us to operate much more effectively than our competitors out there in terms of scale, manageability, and ability to add more modules.

• 16:25Logan Bartlett?

  Roof Timeline, CrowdStrike was founded 2012, 13?

• 16:29Speaker 01

  Late 2011.

• 16:30Logan Bartlett?

  2011. How long was it service only? How long until you started selling software? How long until you had your first antivirus displacement?

• 16:39Speaker 01

  Yeah, so it was, again, it was, I mean, the product was always there. It took two years to really get the product out. So in the meantime, we're doing some of the other things, building our name up and gathering up. You know, the revenue was nice, small, but it was more what we needed out of it. So we did that for a couple of years. First release came out like two years later. And, you know, today's market, you can assemble a lot of the technologies. When we did it, it was, you know, I feel like the old guy was, you know, walking to school uphill in the snowstorm, right? Like, we had to build all this stuff. Graph technology. Was so nascent, we built our own. You just didn't go off the shelf and pick everything, right?

• 17:22Speaker 01

  So we built a lot of things ourselves that took two years to get it all out. But when we did, then we got a lot of feedback and then we iterated, iterated. And it was probably 2016, late before we really had kind of our next gen AV product. And then from there, we started to do displacements.

• 17:42Logan Bartlett?

  So late 2011 to 2013 ish, you're selling services and building the software product. 2013 to 2016, you're selling what EDR or whatever, right? And then at that point, you're selling antivirus. It's almost like a business school case study of like laddering up and going into, starting with something and then going into the next thing. And then that gives you the right to displace the competitors and the other thing. And in talking to some of your investors as well, it actually played out exactly. You founded it with this vision and it sort of played out exactly as you. Is that a fair characterization? It was very serendipitous or you were very prescient?

• 18:22Speaker 01

  It is. Well, you know, I got plenty of scars from doing other things. So what I knew in security was if you had the relationship, particularly on the services side, trusted relationship, you're going to be able to sell software. That isn't always the case in other industries, but security is. And I knew that from, from Foundstone because we had, when I started that, I said, okay, we're going to have software and technology. And we, we, we really invented vulnerability management because there was vulnerability assessment in the Foundstone days, but there was no management of it. So we kind of created that category. But when I was building the company, a lot of VCs are like, well, you can't have services and, and technology. And it's like, well, why can't you? So everybody fought me on that.

• 19:05Speaker 01

  And then ultimately it turned out to be a pretty good model, you know, as long as you have the right balance, right? You can't be.

• 19:09Logan Bartlett?

  Why is security unique in that regard?

• 19:11Speaker 01

  Because it's such a trusted relationship. When, when someone has a breach, it's, it's like only your doctor. Like you have a problem, you need it to be solved. And when somebody solves it, they're grateful. And it isn't, when someone's bleeding, like you, everything goes out the window. And it's like, stop the bleeding, solve the problem and you know, you become the hero. So if you have that level of trust all the way up through the board, then it sets credibility for selling the software products.

• 19:43Logan Bartlett?

  One of the things I think you guys did really well in the early days in building the trust in this was also giving faces to the new attacks that were coming in. And also, there was a set of circumstances going on in 2012, 2013, 14, 15, that we were just seeing an exponential growth in hacks and attacks and all of that. Can you talk a little bit about like the marketing and PR strategy of making this more real and tangible for people?

• 20:13Speaker 01

  Yeah, again, I mean, these were all firsts that we came out with. You would hear the term APT. And some of the folks in the industry had APT1, APT2, APT3. Okay, I didn't really know what that is, right? So I couldn't keep track of them either. And I mean, I know who the, I know what they were talking about, but it was just engineering stuff. Not that it's bad, but you know, we wanted to take a different approach. So what we said is, you know, there are actually humans behind this. So why don't we sort of give a face to this? Because it's, it isn't a, you know, it's a serious issue, right? It's not, you know, we've got funny characters and stuff, but it's a serious issue. How do we allow people to really understand that there's nation states, there's e-crime,

• 20:57Speaker 01

  there's hacktivism, and there's people behind it. And it's actually organized. So we came up with a whole adversary kind of universe. And, you know, we would name them by pandas and bears and other things, you know, bears for Russia, pandas China, there's others. But, so we can keep track of them. And then by campaign and by specific groups that are in each of these countries, we would, we would have, you know, Anchor Panda for the, you know, Chinese Navy and those sort of things. So we kept track of it. But when we would talk to a customer, we would say, hey, this is the group that's doing things. Or more impactfully, when they had an issue, we came in and did the services, we would say, okay, this is the group. Here are actually the pictures of the people.

• 21:42Speaker 01

  This is the who they're working for.

• 21:44Logan Bartlett?

  They're on vacation here and here they're boats, right?

• 21:46Speaker 01

  Yeah, like, we literally had this stuff. Like, there was New York Times articles that, you know, we literally had, it was all open source stuff. We were finding these people, knowing where they were operating out of, and that really hadn't been done before. But when you're talking to a CEO who just had an incident... Like now someone realizes the competitive juices get going, right? And it's like, oh, those are the people who want to do harm to us. And it put it into a different concept rather than bits and bytes and registry keys to like, there are dedicated groups who are organized for profit and for state-sponsored activities that want to do harm to you. And I think that helped kind of revolutionize how people thought about the threats.

• 22:25Logan Bartlett?

  You mentioned three different types of attacks that are out there. The underlying current within the market, we sort of talked about the architectural reasons and the cloud shift and all that. But what was happening that led to the importance of cybersecurity industry? And it's kind of served as a tailwind at your back over the course of this. Like, why has it gotten so much more prevalent in the last decade than it was prior?

• 22:50Speaker 01

  Cybersecurity or the attacks?

• 22:52Logan Bartlett?

  The attacks.

• 22:52Speaker 01

  The attacks got more prevalent because it really started with nation state. And then the e-crime, and there's always been kind of fraud in those things out there. But what we saw is that a lot of the nation state techniques were starting to bleed down into the cybercrime groups. So the cybercrime groups weren't always sophisticated enough to come up with like the ultimate sort of attacks. But as they became more public, they were able to commercialize it. So, you know, it's kind of like, I'll give you the analogy, like, it's really hard to make plutonium. But if you found it, somebody probably would be, figure out a way to make a bomb out of it, right?

• 23:37Speaker 01

  So this nation state, these techniques were starting to leak out. You had Snowden, you had a lot of other things where like very sophisticated attack methods were leaking out. And then you were having people being able to weaponize them. Then you combine that with the prolific, I mean, just almost exponential nature of vulnerabilities that are in the ecosystem, many from some of the large players that are out there, that, you know, there's just such a large attack surface and the complexity of technology. Continued to increase that there was more things to basically compromise. And that allowed other players to get into the game.

• 24:15Logan Bartlett?

  I'm sure along the way, there were many points of pinch yourself moments like what exactly, how I can't believe this is, this is going on, but we talked about nation states and you all have supported a number of different groups along the way related to US defense and I'm sure other countries as well. One of the, I guess notable ones that got a bunch of headlines was the DNC attack. Can you tell that story and what was that like for you at that moment in time, like when, when this starts to go on and Russian interference and the election and all that?

• 24:49Speaker 01

  This was, it was, we got called in by, by a law firm that we worked with and this was just standard fare. Like it wasn't.

• 24:56Logan Bartlett?

  It didn't feel.

• 24:57Speaker 01

  Didn't even like raise any, any flags or anything. We came in, did the investigation. We're like, okay, this is what happened.

• 25:02Logan Bartlett?

  This is five years post founding. This is post-election?

• 25:05Speaker 01

  2016.

• 25:06Logan Bartlett?

  Yeah. Post-election at this point or pre?

• 25:09Speaker 01

  I think it was pre.

• 25:10Logan Bartlett?

  Yeah.

• 25:10Speaker 01

  Yeah. So we, we got called like we do. We're, I mean, this professional outfit, you called in your dispatcher guys and gals and investigate. Here's the report. Didn't think much of it. And then obviously, you know, there was, there was a whole, you know, interesting, uh, series of events after that. And, uh, you know, I knew we've arrived when two heads of states mentioned our names. So.

• 25:35Logan Bartlett?

  Zelensky and Trump are talking about CrowdStrike and.

• 25:38Speaker 01

  Yeah.

• 25:38Logan Bartlett?

  Yeah. Yeah. That's a, that's an interesting, I'm sure that was a pretty surreal moment.

• 25:43Speaker 01

  It was. And, you know, again, we just, we just did our job, wrote the report and whatever happens after that, that's, we can't control. We don't get involved and we're not politicians or policymakers. We're, we're security folks.

• 25:55Logan Bartlett?

  Yeah. Makes sense. So, so the founding of the company, so you're at Warburg there. And I think I had heard you mention some of your VCs in the early days at Foundstone. There was an interesting comment about you never wanted to make someone's fund or have their ability to continue to exist to be predicated on your success. At Foundstone, it sounds like maybe there was some pressure to sell among the VCs or some people that were more short sighted. Is that a fair character?

• 26:22Speaker 01

  That is a fair characterization.

• 26:23Logan Bartlett?

  How did that impact you the next? Go around and thinking about your investors and picking Warburg and ultimately Excel.

• 26:29Speaker 01

  Well, it impacted me a lot because my first go around when I started the company, I was 29. First time doing it, it was like, you know, you don't have, you don't have a track record. So, you know, you kind of work with what you have and, you know, we had some decent backers and those sort of things. And they were good folks, but and they did a lot of investing in 99. So their funds pretty much blew up 2001. I remember raising money 2001, not so easy. And then 2004 came, didn't really want to sell the company. McAfee reached out and, you know, I was really on the fence of whether we should sell it or not. But there was a lot of pressure because we were literally the only thing in their fund that would have returned. Anyway, yeah, any capital. So.

• 27:09Logan Bartlett?

  And a lot of the names, by the way, I went back and looked up. Those names don't really exist or a lot of your original investors, I'm sure, on doing other stuff. As 99 vintage, a lot of people did. So I assume they were just looking for a win or.

• 27:24Speaker 01

  They're looking for a win.

• 27:25Logan Bartlett?

  Move on in some way.

• 27:26Speaker 01

  Yeah, they were, they were looking for a win like, like anything else. I mean, you know, your business, you got, you have LPs, you got to return capital and it's, it's part of the game that you're in. So anyway, again, not bad folks, but that's, that's the way they wanted to go.

• 27:38Logan Bartlett?

  Incentive structures.

• 27:39Speaker 01

  Incentive structures and, you know, we were kind of split whether we sell or not. We sold and really it all worked out. I mean, I can't, I wouldn't necessarily change anything, but from my perspective, when I started found someone like I wanted to be well, I mean, a project. I wanted to be well capitalized. Warburg, you did not your traditional series A, by the way, they, they did only one other series A like this, which was BEA.

• 28:02Logan Bartlett?

  Pretty good track record for the.

• 28:04Speaker 01

  Yeah.

• 28:04Logan Bartlett?

  They were once upon a time a very prominent venture firm back in the 1970s, 80s, but they've moved more into the private equity.

• 28:11Speaker 01

  Right, right. So to do a like, basically, I mean, you'd call it a C today, but in an A round on 25 slides is not a traditional thing for them. So they had plenty of money and then, you know, Excel.

• 28:25Speaker 01

  Samir kept pinging me and wanted to meet Samir Gandhi. He's a great board member. And I kind of put him off for a little bit and finally met him and, you know, we hit it off really well and got Excel in and then Google and others came in. But the whole idea was like, I was not going to let anybody in that wasn't necessarily named brand. And if I was gonna, if we were going to be the company that made their fund, I didn't want any part of it. Like, we're not going to make a fund for Excel or for Warburg or others. We're going to make it really good, but they don't need us to make the fund. So that's really what I was focused on.

• 29:03Logan Bartlett?

  I think now, in particular, people are being a little bit more discerning entrepreneurs in terms of some of these consideration sets. I think in the 2021 vintage, we were in the world of just highest price and whoever versus now there's a little bit more inputs into longevity and partner and all of that stuff, which from my perspective is great. But how did you go about thinking about what firms had longevity, lasting, you know, brands and all of that? Was there any tangible metrics around it? Or was it just, hey, Excel's a venerable name and Warburg's been around for a long time and they've...

• 29:44Speaker 01

  Well, I knew Warburg, so I knew the people. I think for me, it was like, I needed to get to know the people first. I knew the Warburg folks. That's why I did the deal with them. And then, you know, I got to know the Excel team really well and really liked them. And, you know, for me, it was always what I wanted to be. I didn't have flexibility in my life. I didn't really want to be working with people I didn't like. So, you know, we were able to kind of handpick who we wanted, investors and on the board and those sort of things. And, you know, it served us well because we, if we didn't have good board members, they wouldn't have seen the vision that I had and the company could have been sold.

• 30:24Speaker 01

  Many times over, super early, if we wanted to, but you know, we knew we could be a generational company. And the whole idea when I started it, which we didn't cover was, you know, there was Salesforce, there was Workday, there was ServiceNow, there was no platform company at security. There was no Salesforce of security. And it was just a missing element. And that's really what we wanted to be. And we wanted investors and board members who had that vision.

• 30:51Logan Bartlett?

  We talked about the data ingest versus the antivirus considerations from the early days. There were a handful of companies, we were fortunate enough to be investors in Sentinel One. Silence was another name. There's a few others that were founded, similarish, vintage. When you look back, the data ingest and antivirus is one component of it. Are there other things, just from a pure execution standpoint, that you feel like you all did really well? That might be transferable to an entrepreneur listening?

• 31:18Speaker 01

  Well, certainly, the approach that we took was different. I mean, the reason why Silence is now BlackBerry is because they just took one approach, which was antivirus, right?

• 31:28Logan Bartlett?

  Versus you did the hard thing first and built it for longevity.

• 31:31Speaker 01

  It's still hard for people to replicate. You know, even when I look at a lot of these new companies that come out, that just plug into, you know, an Amazon or Azure API and suck data in. They've got, you know, pull a graph database off the shelf, pull, you know, your UI of choice, React off the shelf, make something in, you know, a year or nine months and go out to market. Like, it's not hard to do that. So we did all the hard stuff first, and that really set us up. So I think what we did, and to the heart of your question, like, we didn't take shortcuts. And I had plenty of conversations with guys internal.

• 32:12Speaker 01

  I said, why do we have to do that? That's gold plate of plumbing. And they're like, George, you're gonna need it. And it was fantastic advice. But here's the thing that we never compromised on. And both Sentinel One and Silence did. They started as, you know, with on-prem technology. They had on-prem pieces. We never had that. No matter what, how we got pressured, we never had on-prem. The agents run wherever. But we never had an on-prem anything because it compromises the entire system. And that's where you run into scalability challenges and all kinds of other things. So my point in that is many young entrepreneurs. Who want that big deal from that bank who says we need on-prem will say, okay, we'll just make it work for you. And then it's a noose around their neck going forward.

• 32:54Logan Bartlett?

  I know competitors is probably something that you don't spend a ton of time thinking about, at least that original cohort. But there was a racing analogy that you talked about about mirrors and crashing when talking about competitors. Can you speak to that?

• 33:08Speaker 01

  And my general thoughts on that is the windshield is 20 times bigger than the rear view mirror. So you should spend more time looking at the windshield and going forward than looking out, you know, behind you or sideways. And I think the racing analogy holds true. If you're just driving near mirrors, you're going to go off the track and crash. So you have to be aware of your competitors. You have to respect your competitors. Your competitors are going to push you and make you better. But if you're focused out front, you're focused on the right thing going forward.

• 33:38Logan Bartlett?

  One of your competitors today, I guess, is Microsoft, which is a company that I don't think a lot of people aspire to compete with, at least in broad-based software today. I think they're a highly functioning org underneath Satya. But you guys have done a great job executing against them and competing or outcompeting them. How have you been able to do that within security?

• 33:59Speaker 01

  Not easily, but put a lot of hard work and, you know, a lot of focus. And I'll come back to your question in a minute. But a lot of people don't realize that many years ago, I found so Microsoft is one of our biggest customers. And many years ago, I did the first ever pen test, external pen test for Microsoft. So it's kind of a funny, you know, where life brings you. Now they're a big competitor of ours. But, you know, at the end of the day, what we're focused on, every day we get up, we think about how do we stop breaches, right? We're not thinking about building clouds. We're not thinking about building productivity apps or operating systems. We're thinking about how do we stop these breaches?

• 34:41Speaker 01

  Our architecture is fundamentally different. Microsoft architecture, A, number one, it's legacy AV. Two thousand and four, they bought an AV product. Guess what? Every day, there's six updates that come with signature updates. You know, same thing Mac and Symantec did. If Mac and Symantec works so well, there'd be no CrowdStrike. So when we look at someone like Microsoft, are they really solving the problem of stopping the breach? Most times, they're causing it because of the architecture, the vulnerabilities, their hygiene and those sort of things. So, you know, from our standpoint, trust is a big thing in security.

• 35:15Speaker 01

  Focus is a big item and having something that actually gives you the outcome is what people are paying for. So that's the way we've been able to execute. It's taking care of the customer and delivering what they want. A system that works at scale, single agent, it works. Overall, it's actually cheaper to run and manage and gives them the outcome. So that's how we compete it. They're a big competitor, of course. You know, you have to have a lot of respect. Satya team have done a great job, but you know, there's always room for multiple companies out there. And, you know, we've got our niche.

• 35:50Logan Bartlett?

  I've heard you talk about the two different stages of company execution. There's the evangelical leadership stage and then the scaling and delegating stage. Can you speak a little bit to that and what the distinctions between the two are?

• 36:03Speaker 01

  Yeah, and it really, it really, a lot of that comes around the selling piece of it, right? So you have evangelical scaling and coin operated. A lot of times when you're looking for sales organizations, but so I think, you know, from my perspective, when you first get out there and you're pitching something that doesn't have, it's a different approach. Right? You're in a category of endpoint. You're in a category of like, security is important, stop a breach. People, you know, started to get that. Nobody was doing cloud. So you have to be an evangelist. Starting with me, I had to go out, explain what it was, why I wanted to do. I had plenty of people laugh, you know, banks go, we'd never use that. I mean, I go through the story of that's never going to work, you know, et cetera, et cetera. But we got through all that.

• 36:46Speaker 01

  And once you can, once you get past the evangel phase, which I don't know if you ever passed, but once you kind of get past that, you have some scale, then you, you're hiring in a different set of people, particularly on the, on the sales side, you're scaling it up. And then, you know, at some point, and we're not in that phase at all, nor do I necessarily want to be in that phase, but you got the coin operated, you know, folks who just want to come in and take orders. So from my perspective, it's making sure that we got the right people for the right phase of the company. And when you move from evangelical to scaling, like you can't do everything and you really do have to delegate, that makes you got the right people on the bus.

• 37:24Logan Bartlett?

  You hired a number of roles, I think, earlier than conventional wisdom would recommend. Were there any of those that you feel like particularly benefited the company that maybe came in a stage earlier than a VC would recommend or something?

• 37:36Speaker 01

  Yeah. So one of my co-founders was actually our CFO, early days. He was my CFO at Foundstone. He was a great guy. He literally was retired, had to get him out of retirement and say, can you help me for a couple of years? And he only wanted to give me a few years. He wanted to go be with his grandkids. A odd choice of a CFO as a co-founder, I would say. And B, that was pretty early on, but I knew that you had to have the right foundation in the areas of accounting, in the areas of revenue recognition, in the hygiene of the company. And I see too many younger companies that I invest a lot in startups where it's

• 38:17Speaker 01

  like, you know, we'll get the CFO four years later. And it's like, well, if you do that, there's going to be a, you're going to have a huge mess on your hands. So when you look at what we did, ultimately when we went public, everything had to be audited. Everything was audited, by the way. So we, there wasn't a lot of hygiene that we had to go fix to be ready to be public. Whether you're going to be public or if you're going to sell the company, in most venture-backed companies, there has to be some exit, right? So pick one. You want to have the right finance team in place. And then you want to combine that with the right legal team. We knew the cloud was going to be difficult. We knew privacy was going to be an issue. We saw what was happening with others, right? I mean, you

• 38:59Speaker 01

  had Salesforce, you had Amazon, you had others. We, you know, it's an issue to put your data somewhere else. So we want to have the right legal people in place. So we really went out and tried to get the best folks. You know, our first GC was like the former GC of the FBI, like super senior. People were like, why do you need that guy? Well, because we need to put everything in place.

• 39:22Logan Bartlett?

  Interesting. Delegating, as you move from that evangelical leadership to scaling and delegating, I had heard you mention that ultimately you ran, you were able to run and assess different business units off of KPIs and dashboards. And that sort of gave you a feel for, can you speak to that and the willingness to pass and trust some of the responsibilities within an org to the different leadership team members?

• 39:50Speaker 01

  Yeah, it starts really with the people. So I had to make sure I had the right people in place, which I did. You know, for that stage, for the most part. And I couldn't do everything. So it was more like, what are the, what are the critical KPIs we need to look at? How do we manage those? And how do we course correct?

• 40:09Logan Bartlett?

  For each different functional area?

• 40:11Speaker 01

  For each different functional area. And really, you know, you only need three or four critical KPIs for each one. So I sat down with everyone and said, okay, well, what are the key ones? And if you couldn't tell me the key ones, that was problem number one. But we got through that. And, you know, to this day, we still, I don't think I'm ever satisfied with all the dashboards and the data, but we have a huge piece internally of dashboarding and KPIs and around everything. And it's, it's a journey. It's never an end state. Like you're never going to be happy with what you have and you always have to tweak it. You have to get out of the trap sometimes when you get big enough where people, you know, turn things that are yellow into green and tweak a number here or do something. And it's, so you look at it, you're like, okay, that looks good.

• 40:54Speaker 01

  But, you know, what's the sample size? Or what did you, you know, did you change how you actually are calibrating your, you know?

• 41:05Speaker 01

  Net promoter scores, those kind of things.

• 41:07Logan Bartlett?

  Yeah, there's a lot of, when you measure something, people are going to manage to it. And so you need to constantly analyze what the unintended consequences to the, to the.

• 41:18Speaker 01

  Yeah, and the inputs.

• 41:19Logan Bartlett?

  Yeah.

• 41:19Speaker 01

  Because you could look at something, wow, that looks good, but you know, did you talk to two customers or 2,000?

• 41:24Logan Bartlett?

  Hmm, yeah, that makes sense. What are some of the things you learned about managing and leading people that you knew when you were, was it E and Y, early days or?

• 41:35Speaker 01

  Yeah, Price Waterhouse EY.

• 41:37Logan Bartlett?

  PWC, when you were coming out and, or the original days of starting Foundstone. Um, as you look back on that, if you could tell yourself about leading thousands of people, is there anything that stands out?

• 41:49Speaker 01

  For me, it's, you know, and I've gained this over the years, but it really always is about starting with, with the best team that you possibly can. You know, A players will figure it out, you know, if, I always say, if you have, you know, a C player with an A game plan, you're, you're, you're still screwed. Right? So it's better to have an A player with, you know, a B game plan or something else because they're going to figure it out to get to the, to the outcome. So for me, it was starting with the best folks and we did that at CrowdStrike. I literally handpicked 20 of the top people, didn't matter where they were, and that became the founding team. But when I go, when I look back in time and I think about kind of what I learned is if you put the right people in place

• 42:28Speaker 01

  and you don't constrain their creativity, um, you, you, you get great results. And I think that was a key part, like when you're at Price Waterhouse or EY, great places, but it was very structured and you didn't always have the flexibility to kind of, you know, Bob Ross it, as we say, um, take the blank canvas. So, you know, for us, it was, here's a blank canvas, what, what pretty trees are we going to paint today on the Bob Ross canvas?

• 42:55Logan Bartlett?

  To that point, like, um, what are you looking for in a first meeting? And I guess specifically, I've heard you talk about possibility people versus parameter people.

• 43:05Speaker 01

  Yep.

• 43:05Logan Bartlett?

  Um, what's that distinction? And if you're interviewing someone, someone and trying to figure out if they're an A person?

• 43:11Speaker 01

  If it's all about the parameters, like then you kind of constrain yourself into a box. And you're only thinking about the parameters in your box. If you're thinking about the possibilities, it's like, okay, that hasn't been done before and it's really hard and you know, people haven't thought about it and you know, is there a market or not? Like you gotta figure all that out, but hey, it might be possible, right? As opposed to starting with, I call professor no's. You know, no, no, no. Like, and you know, if you're very parameter driven and your first answer is no, you're probably not going to be a good fit. And I think it's like, okay, well, get the white canvas out and what is the art of possible? Rather than the parameters that would constrain you from developing something new.

• 43:55Speaker 01

  Because if we weren't possibility people or just parameter people, there'd be no CrowdStrike. You know, you still have signature AV somewhere.

• 44:04Logan Bartlett?

  Are there questions you ask to try to tease that out in an interview?

• 44:08Speaker 01

  Yeah, I mean, I like to understand somebody's background first and just hear their life story. Because it tells me how they operate and what they've done and you know, what really drives them. And we can talk about what makes people take care in a minute if you want. But from my perspective, I'm always just trying to figure out are they, how do they solve problems and you know, how do they think about, are they competitive and what do they do in sports and those sort of things? Which gives me an idea on how they operate, what makes them tick. So I asked a lot of questions about that and you know, ask them what drives them. Do they love to win or do they hate to lose? And then I can tell like their personalities from there.

• 44:50Logan Bartlett?

  What's the distinction there? Love to win versus hate to lose? Which one's better?

• 44:53Speaker 01

  Well, it's all different and you know, somebody who's listened to this is going to just try to come up with the right answer next time they talk to me. But I think the, what I would say is,

• 45:04Speaker 01

  It's great to want to win, but if you look at the best athletes in the world, and I I met a lot of them, talked to them, they really hate to lose. Like, they, if you think about, like, you played sports, you win, how long does the win last? A lot shorter than the losses are. Okay, so if you played football, which you did, yeah. Yes. So you knew Saturday you lost, you gotta wait till next Saturday or two weeks from now. Yeah. That's kind of the way we, but again, there there isn't a right answer. Just trying to understand what makes people tick.

• 45:36Logan Bartlett?

  I heard you say that you never regretted firing someone too early, but often regretted keeping someone around too long.

• 45:41Speaker 01

  Yeah.

• 45:42Logan Bartlett?

  A lot of our companies are going through the the point in time, if they're successful, that the person that got you there might not be the person that takes you there.

• 45:48Speaker 01

  Right.

• 45:49Logan Bartlett?

  How do you think about that? Are there things that you should be asking if this person's the right to be on the journey with you?

• 45:58Speaker 01

  I think every day you have to look at the team and you have to think about, is that the right person for that role at that point in time? And at the at that point in time is important because when you're a hundred people, it might have been fantastic for that role, but at 5,000, they may not be. Doesn't make them bad, doesn't mean that they don't either have a home in your organization or maybe they they can find a home and leverage the experience they got. But I've never, and I really have asked the question to to many folks, you know, many CEOs, friends, et cetera. Have you ever regretted firing somebody too early? And the answer is no. I mean, normally it's like, oh, I let that person hang around too long. And, you know, we knew that person that was somebody we were friendly with or we, you know, they worked with us in five other places. Yeah, whatever story you want to come up with.

• 46:41Speaker 01

  I mean, it's never an easy thing because it's, you know, people's lives. But I think if you have the discipline to to say, like, for me, CrowdStrike is a special place, you should be an A player if you're here. If you're not an A player, then, you know, what are we doing? So not everybody's in, you know, can or will be an A player. But my point is, if that person isn't right for the job, then it's better for them and it's better for the company to, you know, give them a hug and and either find a different role, which is fine, or, you know, part ways. And and there are many folks that I'm still friendly with today that we parted ways just because it wasn't the right fit at that time. But you don't want to wait around.

• 47:20Logan Bartlett?

  Do you encourage managers, like, when they have that inkling, just to to obviously be thoughtful, but but act on it? Because it's not gonna, the toothpaste doesn't go back in the tube?

• 47:30Speaker 01

  Toothpaste doesn't go back in a tooth. We have a, I mean, one of our, our chairman, we have a saying like in racing that if you have a noise in a gearbox, it doesn't fix itself. Like it will not fix itself. Trust me, that thing is going to blow off. So if you have that inkling or you know, the noise is there, just get it fixed because it is not, you know, you can try to course correct and, and do those sort of things. I got it. But at some point, the hair on the back of your neck stands up. The little voice keeps saying like, I don't know if it's going to work out. You can convince yourself to not listen to little voice, or you can basically say like, like we tried,

• 48:10Speaker 01

  feedback was given. We, we're not going to get there or they don't have the skills. You know, there's attitude and aptitude. You gotta have both. And if it's not the right fit, then you gotta move on. And the problem is, and how you get mediocre organizations and, and the landscape is littered with mediocrity.

• 48:27Logan Bartlett?

  By definition, right?

• 48:28Speaker 01

  Yeah. You just let averages.

• 48:30Logan Bartlett?

  Yeah.

• 48:31Speaker 01

  Normal. You just let people hang around.

• 48:33Logan Bartlett?

  Uh, one of the other interesting, I guess, forcing functions or frameworks is if you, if you would hire that person back into that role again today or, or not.

• 48:43Speaker 01

  Yeah. So that, that's the way I look at it. Like what, what I, you know, the simple, and this is probably one of the best maybe takeaways from, from this whole podcast is just one thing, just to remember, forget everything else is if you ask yourself, would you hire that person for that job today? If it's a yes, great. If it's a no, then you gotta take action.

• 49:01Logan Bartlett?

  Yeah.

• 49:01Speaker 01

  You know, and um, you shouldn't wait around. Like there's always considerations of not tomorrow, but you know, maybe in two weeks or three weeks, but not two years from now.

• 49:11Logan Bartlett?

  It is an interesting framework of would you take that person or the field, right? It's like the gambling terms of like, everyone else that maybe I can interview or that specific person that I have today. And if your inclination is over there, uh, maybe that's your, that's your answer.

• 49:25Speaker 01

  Yeah. Cause people have a hard time coming up with the answer.

• 49:28Logan Bartlett?

  We touched on this a little bit, but the the different types of salespeople in the evangelical, the scaler and the coin operated. We talked about the leadership, different phases of this, but but the coin operated is that's just a transactional order taker?

• 49:46Speaker 01

  Just transactional, yeah.

• 49:47Logan Bartlett?

  And scaler is someone that comes in after the evangelical sale has occurred?

• 49:52Speaker 01

  Yeah, so so you basically, you know, evangelical is, hey, we've never heard of this product. We don't know this market. What is it going to do? Why do I even need it? What's my problem you're trying to solve? So you got to get through all that stuff. And then people go, well, this does works better or solves a problem and I'm willing to part with my money. And by the way, I I'm not sure if everyone appreciates, and I know you do, in your companies, how hard it is to actually get people like in enterprise to part with their money. It is a really difficult thing to do.

• 50:22Logan Bartlett?

  Yeah.

• 50:22Speaker 01

  Like, so you got to get past the somebody's going to write you a check for it. And then, once you have that, then it's like, OK, well, we have something about product-market fit. How do we scale this? How do we put all the sales processes in place? How do we, you know, put the marketing pieces to go to market? The engineering piece, like, we got to scale this thing. And on the sales side, you know, it's George making the sale or someone, you know, the senior team making the sale too. We can take all this and package it and put it into a scalable sales organization. And there's, you know, there's a real skill and art to that.

• 50:54Logan Bartlett?

  At that stage, are you more willing to hire for parameter people when when the packaging and the scaling is occurring?

• 51:02Speaker 01

  Yeah, you have to. And it's really a good point, because if you had all possible people, you may not have a zero execution, right?

• 51:09Logan Bartlett?

  Like, they'd all be wandering.

• 51:10Speaker 01

  They're all be wandering around. So they'd all be, you know, at the whiteboard, like, at some point, you have got to get the the deal in cash in the bank. So there does need to be some structure, right? Which is, there's a lot of things that we can do, but what's it going to take to get the deals done? What's it going to take by deal, by week, by month, by quarter, to make sure that you're going to hit the targets that you have in place?

• 51:32Logan Bartlett?

  We touched on some of this stuff earlier, but the early days of marketing and PR and just getting your name out there, I think you guys did a did a great job of. Was was that the founding team and just sort of the DNA there? Did you have a marketer? Was this a?

• 51:49Speaker 01

  Pretty much us, yeah.

• 51:50Logan Bartlett?

  Yeah.

• 51:51Speaker 01

  You know, the early folks had strong reputations and, you know, it's not our first rodeo and we were known. So it was relatively easy to be able to go out, take some of the intel that we had and some of the things that we were seeing and being able to explain that to to the industry at large and people were interested in that. So it definitely helped build credibility. I had written a book, a couple of books, and that was, that's kind of the best business card you have too. So that, you know, you kind of leverage all that to get your name out there and kind of stand up above the crowd.

• 52:24Logan Bartlett?

  Was the original book, by the way, was that with this in mind, that it would build your credibility or was it maybe I'm going to be an author?

• 52:31Speaker 01

  No, it wasn't to be an author. It was, when I, when I was doing, so when I was at Pricewaterhouse, I was in accounting. Got really bored of that, then moved into management consulting. And they basically, it's 93, they said, hey, can you sort out this internet thing? It might, might have legs. So I'm like, all right. So I looked into it and like, okay. You know, I mean, I was pretty good on technology and then really developed a lot of these pen testing methodologies that hadn't been developed. Like they just, again, it was the whiteboard. So I wanted to write it down because people were asking me about it. So that's how the first book really came about with a couple of others. And, you know, the whole idea, I kind of laughed because I think it would have made more

• 53:16Speaker 01

  working at, you know, a fast food job at the time than I got paid on the book like per hour. We put a lot into it. But it was really the best business card. And at Foundstone, we always had a saying is you want the people who read the book doing this work? Or you want the people who wrote the book? I don't know, you know, if I offered that to you, you'd probably want the guy or gal who wrote the book. So that was our business card. So we used that to our advantage at Foundstone and certainly at Crowstrack.

• 53:40Logan Bartlett?

  Were there any tactics of, I mean, it sounds like there was a lot of white papers or blog posts you guys did in the early days of PR and marketing? Anything that, that you look back on that was particularly useful or interesting that, that comes to mind?

• 54:00Speaker 01

  I think the fact that we were able to humanize these attacks, which no one really had done before, put a name to a face, you know, put how this all works, demystify this, you know, things happen in Ether, well, this is actually how it works. I think that really gave us a leg up and credibility as being experts in this space.

• 54:23Logan Bartlett?

  CrowdStrike doesn't really have a mission statement beyond stopping breaches, I guess. Is that, is that fair? How has that simplicity helped you kind of drive the company and set the vision?

• 54:34Speaker 01

  Well, I say we don't have a mission statement, we're on a mission. And that's true today, it's true when I started the company. In fact, when people would, we had this very Spartan sort of stealthy website, you know, one-page thing before we launched the company. If you wanted a job at CrowdStrike, when you emailed, it wasn't emailing jobs@crowdstrike, it was emailing [email protected]. And that really put it in perspective, like, we want people to sign up for the mission. And I think in security, if you have a mission and purpose, like, every day we're saving customers. I mean, there's countless stories of, you know, saving customers from e-crime groups or nation-states or what have you. So it really is a noble cause and we want it like-minded people who,

• 55:20Speaker 01

  and certainly in the early days, like, you know, they could have got a job at a big bank, they could have been assisted with a big bank, they could have done all kinds of stuff, and made more money on a cash basis, like, beyond CrowdStrike. Not the stock, but, you know, so what we want to do is we want to have people focused on that passion for our customers.

• 55:39Logan Bartlett?

  The state of cybersecurity today, I'm sure whenever you get asked about this, people are, it's bad and it's, there's, there's a lot of different groups out there. Can we talk about the different, there's nation-state, e-crime and hacktivism that you referenced earlier. What's the distinction between them? And what's the, I guess, how would you sort of draw the different perspectives of who's the more aggressive actors or anything along those lines?

• 56:03Speaker 01

  Well, nation-state is, you know, many of the places that you would suspect. It's really, you know, an operational mission of either gathering intelligence

• 56:15Speaker 01

  or planting

• 56:18Speaker 01

  Technologies for future use and/or potentially using it, which we've seen in the past in terms of destruction capability. It's the simplified version of it, right? So people get paid every day. They get up, you know, they're, they're in these organizations either by choice or not by choice, but their job, you know, nine to five is to be able to go out and get into companies. And it's like a, it's a full company that's designed. Who can get access? Who can get the data? Who can understand it? Who can operationalize it? That's what they do. So that's their, their, their goal. And that's happened for the last 4,000 years and it's going to continue to happen now. It's just easier to do because you have the internet. Yeah.

• 56:59Speaker 01

  Then you've got the e-crime actors who, well, people have been doing bad things for the last 4,000 years too. So now that's just, they can do it, you know? You used to have the pickpocket that would, pickpocket that would canvas one block radius. Now somebody sitting in their bedroom in their pajamas can, you know, they've got the whole world at their fingertips. Right? So it just makes their job a lot more scalable to steal more money and less risk. And hacktivism, you know, people have always been speaking out and, and having a view on things. And now it's a little bit easier to, to kind of get your view out there in ways that could be destructive to, to organizations. So it's, it continues to get worse just because the way I look at it is,

• 57:41Speaker 01

  security has to parallel the, the slope of the technology curve. So if we think about technology and I would argue that in 1993, when I got in the business, technology is pretty simple, you know, like for the internet. Yeah. You really didn't even have a firewall. You're like a router, you had a website, you know? You barely had a database. So super simple. Think about the technology, like the curve is, is hyperbolic in terms of like all the new innovation. So if security doesn't parallel the slope of that curve, that's really where you have problems. But there's so many more opportunities that it's become big business for security companies, but big business for governments, e-crime and others. And that's why we're in the state we are in today.

• 58:23Logan Bartlett?

  When e-crime occurs within a company and there's, I guess ransomware, or they're, they're asking you to pay something to get your information back. How do you help a company think through if that's the right decision for them? Or, or government, I guess is the case maybe versus setting a precedent that, you know, you pay if you get attacked?

• 58:42Speaker 01

  It's really, it's really a risk-based decision. You know, it's a business decision to be, to be clear. And I'll tell you a story and I'll get into details of your question, but a number of years back, we got a call on Friday at five because nothing good happens before.

• 58:58Logan Bartlett?

  I was gonna say all good calls come in at Friday at five.

• 59:00Speaker 01

  Friday at five, right? Yeah. Your deal that you want to get closed never comes in at Friday. At that point, it comes in, you know, two weeks later, but like IR call comes in. It was CEO of a new public company and they said, hey, we got, you know, like thousands of computers got taken out. They weren't a customer. They called me and said, can you help us? Yeah, we got on a call within an hour, sorted out and, you know, looked like ransomware. And, you know, we said, okay, we think this is what it would cost if you wanted to pay it. And as I said that, he, the words didn't even hit the air. They were hanging in the air. And he said, we pay it. And to be honest, if he could have paid it, he would have,

• 59:42Speaker 01

  and it would have been a much better outcome. He couldn't because it was actually destructive malware that was masquerading as ransomware. So there was nobody to pay.

• 59:52Logan Bartlett?

  What's that to say? I mean, destructive malware that was masking as ransomware? What does that actually mean?

• 59:58Speaker 01

  Yeah, it was basically a Russian-based attack that was designed to be destructive against Ukraine many years ago, but it was designed to look like ransomware.

• 1:00:10Logan Bartlett?

  So to look like, hey, if you pay this amount of money, we'll go away. And in truth, it's not that. It's actually trying to just attack and destroy.

• 1:00:17Speaker 01

  Exactly. Yeah, with that sole purpose. So, so they couldn't, they couldn't pay it. And then there was, you know, big recovery and those sort of things. But getting back to the point, you know, that was one area where he would have paid. It would have been a lot easier to pay and it would have been a lot less costly. So customers need to just make that decision. In today, in 2023, we deal with a lot of it.

• 1:00:39Speaker 01

  A lot of the customers do decide to pay because of, you have this kind of double ransomware, right? Now sometimes triple, where you've got the data that's being encrypted or the data stolen first. And then even if you restore from backups, which people have got better at, they'll just go to a dedicated leak site and dump data. So it's a bit of a hop's choice. Like, do you want all your data out there? Or do you want to? Pay and yes, you have an issue. Yes, it's reportable and those sort of things, but at least your data that, you know, maybe your customer's data is not floating around and they will actually, the e-crime actors will film the data destruction. They will actually write reports on how they got in. They will actually give recommendations and products.

• 1:01:24Speaker 01

  We happen to be one of the products they recommend. How about that?

• 1:01:27Logan Bartlett?

  Is that a channel for you? E-crime?

• 1:01:29Speaker 01

  The e-crime channel. It's just, you can't make this stuff up. Like when you actually see, you're like, did they just put together a consulting report and have product recommendation? Answer is yes. So that, that's how, that's how mechanized this whole process is.

• 1:01:43Logan Bartlett?

  Why, why do they do that? By the way, why do they help after the fact?

• 1:01:46Speaker 01

  They got paid. They're, they're trying to make the

• 1:01:50Logan Bartlett?

  It's just, it's just a product. Yeah. Yeah. They're saying, hey, this is what we

• 1:01:53Speaker 01

  This is what we found. This is how we got in. This is the data being destroyed.

• 1:02:00Speaker 01

  And you know, if, if there wasn't, if all of a sudden you, you paid and then the data got leaked, right? And the next guy paid and data got leaked. Somebody would go, well, why would I pay? Cause it's going to get leaked, right? There's, there has to be some level of

• 1:02:14Logan Bartlett?

  Brand?

• 1:02:15Speaker 01

  Yeah. Like, you know, honor among thieves, I guess, right? If, if no one was, if people were getting paid and not getting the outcome, that would stop pretty quickly, but people are paying. It doesn't mean they won't come back. Doesn't mean they can't do bad things, et cetera, et cetera. But they basically are, in most cases, holding up their end of the bargain. That depends on the group. Some groups have better reputations of

• 1:02:39Logan Bartlett?

  I mean, this is just for people that are outside of cyber are to make this totally clear. So I'm working at a big company and there's a group in Russia or wherever they are, and they hack into our systems and they get our credit card information or our customers' information or whatever it is. And they're saying, hey, you can have this back, but you need to pay us. And then if, if, if you pay them, then they're delivering you, hey, here's how we got in. Here's how you need to protect yourself. Here's our recommended vendors for it. And if not, they might go dump it on a, an exchange and it'll all be out there.

• 1:03:12Speaker 01

  That's it.

• 1:03:12Logan Bartlett?

  And so they're building their own ethical Uh, uh, or not ethical, but their own brand and reputation that if we get you and you pay us, then we'll help you, uh, which is kind of this funny prisoner's dilemma that.

• 1:03:26Speaker 01

  It is. And the groups that do incident response were one of, of, you know, one of the bigger ones that do it. We kind of know who the groups are and we have a view of whether, if you pay them, whether they're just going to still dump the data or what they're going to do. Right? So.

• 1:03:41Logan Bartlett?

  I'm curious, uh, and I realize this is probably a hard number, but let's take Fortune 500 companies, uh, and they get attacked. Are, uh, the, the ethical criminals, I guess would be the right term. Are most of them these days, uh, ethical in the way that they'll do? If you pay them, they'll actually do what they say they were going to do. Or is it?

• 1:04:00Speaker 01

  Yeah. I mean, I, I don't, I don't throw ethical in, in this.

• 1:04:03Logan Bartlett?

  Yeah, I know. It's hard.

• 1:04:04Speaker 01

  I think, do they, do they hold up their end of the bargain for, for some point in time? I would say for the most part, we've seen, you know, the, the, the bigger brand name ones.

• 1:04:15Logan Bartlett?

  It's hard to talk about criminals like this.

• 1:04:17Speaker 01

  It's not. And, you know, it's a super serious subject.

• 1:04:19Logan Bartlett?

  Totally. No.

• 1:04:20Speaker 01

  But, um, when you explain it to people, because somebody's going to, you know, maybe listen for the first time and they're going to go like, really? Does this happen? Like people break in, steal the data? If you don't pay them, they just go nuts. But if you pay them, like there's some honor of like, here's the video of it being destroyed. Here's the report. Here's, you know, it's kind of a crazy world.

• 1:04:39Logan Bartlett?

  It's a fascinating, uh, fascinating business out there. Um, what about, uh, AI in this, in this whole world? We've, uh, generally we don't make it very long. I don't think any podcast in technology these days makes it this long without really, you referenced it earlier, uh, back in the days when we called it machine learning, but now it's AI. How has AI changed some of the attack vectors for the potential criminals that we're talking about? And also how has the, the founding principles around AI benefited CrowdStrike and going forward?

• 1:05:12Speaker 01

  Well, was it founding principle of, you know, quote AI was, that was really more of a marketing term at the time was machine learning, which you can say is AI is fine, but you know, it was not generative AI. That, that really wasn't around. So, you know, for us, we, we.

• 1:05:26Speaker 01

  That's why the approach was get the data first, right? Because once you have the data, then it unlocks the AI piece of it. And that was, that's been very successful in, in stopping breaches and finding things that haven't been found before. Now, when you look at generative AI, we've got a product called Charlotte AI, which is essentially, you know, your virtual SOC assistant that not only can answer questions, but can do work on your behalf. So the whole goal for us is, how do you take eight hours of work and turn it into 10 minutes for a SOC analyst?

• 1:05:57Speaker 01

  So that's the goal. So I think there's a lot of promise for it from the, from the defenders, but obviously that can be used for malicious purposes as well. And for many years, we dealt with adversarial AI, teams trying to defeat our AI in terms of files and things of that nature. And, and now it's moved into more of like dark AI, which would be, you know, how do you use generative AI models that don't have guardrails, you know, like fraud GPT and others that are out there? So what that is going to allow, basically, what, what does all that mean? It means that you can democratize the, these very hard concepts of getting into a company or creating exploits or malware, and you can democratize that and make that available to

• 1:06:40Speaker 01

  a much larger population, because now it's, it's, you know, like, like ChatGPT for the, for the bad guys, right? They have their own, their own, it's not ChatGPT, but they have their own models, right? So you have many more folks who maybe don't have the expertise can now execute a campaign. That's one. And two, the time it takes to actually figure all this out is now compressed. And this is, this is part of the problem in security. It's really a time game of, you know, how much time do you, I guess you want to prevent it, but if something bad happens, you got to be able to, to react to it. And you can't do that in three days. You got to do that in, you know, under 60 minutes.

• 1:07:19Logan Bartlett?

  Is fraud AI is actually a, yeah. So, so there's a, there's a

• 1:07:24Speaker 01

  fraud GPT.

• 1:07:24Logan Bartlett?

  Fraud GPT, sorry. So there's a ChatGPT equivalent that doesn't have any guardrails on it. And if you want to do malicious attacks, you no longer need the expert sitting next to you saying, hey, let's try this permutation of, of this and do that. Now, Fraud GPT will do this on your behalf. And so it's while chat GPT or whatever it is is democratizing creativity or whatever it is, this is democratizing cybersecurity attacks for these bad actors. Is there, is that just the new state of what we need to deal with? And you

• 1:08:06Logan Bartlett?

  all and folks like yourself are just going to need to continue to get better? And is there anything we can do beyond about this type of thing going on?

• 1:08:16Speaker 01

  No, I mean, it's just, you know, first you got to be aware of it, understand how the adversaries work, right? And what makes them tick, which is really important, because this is why security intelligence is a hallmark of what we do. If you don't know what the offense plays, what they're going to be, it's hard to run be a defender. It's like football, right? You got to know what the playbook is over there. So that's the new playbook. And it goes back to security needs to parallel scope of the technology curve. You're not going to, nor should we want to inhibit any technology innovation. We should, as a security company and security practitioners, we should focus on how do we enable that new technology to be used safely? And in the main purpose, it was intended to be used for.

• 1:09:01Logan Bartlett?

  What's one thing you'd recommend any person listening at a company beyond by CrowdStrike, I guess, that they do to up their security posture or try to prevent some of these attacks from occurring?

• 1:09:16Speaker 01

  I mean, it extends through small companies to large enterprise. But one of the biggest areas of exposure is identity. And poor passwords, we've been going to RSA for 30 years, been talking there for 30 years, and we still have the conversation of like, poor passwords. And as an industry, we still haven't solved it. We've gotten better in areas, but we still haven't solved it. So I think having better passwords, password managers, two factor authentication, where possible, to enable those and many of the larger cloud providers and apps have that, that would be a big step in just preventing somebody from getting in. And then after that,

• 1:10:01Speaker 01

  it's, you know, having the right security technologies and it's, you know, really protect.

• 1:10:09Speaker 01

  Detect, respond, and now it's going to be report. That's going to be the fourth element because of the SEC reporting. But from, from the average person, you know, I think shoring up their identity and their passwords using two factors is going to be a good starting point.

• 1:10:21Logan Bartlett?

  Because you touched on it, the SEC reporting now for public companies, they have four days to

• 1:10:26Speaker 01

  Four days.

• 1:10:26Logan Bartlett?

  To disclose, once they know, then they have to

• 1:10:29Speaker 01

  Once it's, once they know it's considered material.

• 1:10:31Logan Bartlett?

  And when did that come to pass?

• 1:10:33Speaker 01

  December 15th, 2023.

• 1:10:34Logan Bartlett?

  2012, oh, so, so just recently, this is a, this is a new thing. And, uh, and so does that include like when any person within the org finds something out and they have to escalate it to the CEO and everyone has

• 1:10:45Speaker 01

  It's if you have an incident that is, um, I'm kind of paraphrasing, there's, there's little devils are in the detail of what's material, when you found it and those sort of things. But if you had sort of a material, material incident, then you have four days to be able to publicly disclose that, which is a tight timeframe, particularly if you do an incident response and trying to figure out the, the cone of exposure and compromise and where people, you know, if you have an active adversary in there and then you don't have enough time to kind of sort it all out, well, in four days, you know, you got to make a disclosure. And now what we're seeing, kind of get back to the ransomware pieces, we've actually seen ransomware groups who hadn't got paid, report to the SEC. So it's like triple extortion, you know, either your data is going to get dumped, it's

• 1:11:28Speaker 01

  going to be encrypted, or they're going to, if you're a public company, they're just going to run to the SEC and say, oh, by the way, we broke into them and they hadn't reported to you.

• 1:11:36Logan Bartlett?

  We've been talking for probably a decade, it feels like in this, uh, from my seat about like cyber security now being a boardroom level conversation, but we're, we're seeing now with this SEC rule being passed and we've seen a lot of, uh, big public companies, stock prices with all this stuff be very volatile. I assume we'll, we'll see even more of that going forward, uh, as a result of, a result of this.

• 1:11:59Speaker 01

  Yeah, and you know, you see a lot of companies that have issues. Um, any big company is going to have an incident and it's making sure that you, you try to make sure that incident doesn't turn into a catastrophic breach or what have you. I haven't run into too many companies, particularly bigger ones and, and public companies where They're not taking security seriously, or they're not spending money on security, or they're not trying to do the right things. I mean, each one is a different spectrum, and maybe you have different industries. But for the most part, people want to do the right thing. It's just, it's really hard. The adversaries are good. You have to be better, and you have to have, unfortunately, you have to have the right technologies, because many companies buy one of everything and two of everything else, and then they have

• 1:12:43Speaker 01

  a hodgepodge of things that don't work together. And wherever those little seams are in their security products, across the spectrum of what they need to do is where the adversaries generally hide.

• 1:12:53Logan Bartlett?

  We talk about network effects so much with consumer businesses, and we think about Facebook, or whatever, all that. But I guess the other term of accumulating advantages that come from some level of consolidation of cybersecurity tools, you all continue to benefit from the incremental customers you have, because you see more attack vectors, you know these groups, see them better. It's interesting to see a real enterprise accumulating advantage play out for you.

• 1:13:22Speaker 01

  That's the crowd and the crowd strike. People always ask me, well, how'd you come up with the name? You know, crowd is the crowdsourcing piece. Strike is the fact that you're operating from the cloud, and you have to, you know, dive down very quickly and make sure that you can deal with these things. And that's why the product is Falcon. It's the fastest diving, diving bird in the world, 200 miles an hour. So that's how we put it together, and it was that network effect. And literally from day one, that's why we started with the data. The more data we had, the smarter the system would get. And, you know, the more things that we could do. So we operate, we have agents in 176 countries. When I say agent, software that runs on someone's computer or cloud. And there are many attacks that we haven't seen. There aren't many techniques we haven't seen.

• 1:14:04Speaker 01

  So it gives a real advantage of this community immunity sort of approach. And then, you know, those sort of things get baked into the product and, you know, in the algorithms, and, you know, they, they auto-adjust themselves to be able to make sure that the rest of the community is protected as we see them.

• 1:14:20Logan Bartlett?

  What's decks in the cybersecurity industry as you kind of look out? Is AI the, the big one? Or are there other things that you're really paying attention to?

• 1:14:28Speaker 01

  When the early, early stages of AI, what it can do and how it works, and people are...

• 1:14:33Speaker 01

  Trying to figure out how they commercialize it, make money, how it actually adds value to a customer. So you have that. I think from a cloud perspective, that the cloud technologies are moving so quick, you know, used to be computing, storage, and now it's literally an alphabet soup of things that are out there that make all this work. And it's very complicated. So I think that's, that's really the new frontier, which is why we spent a tremendous amount of R and D dollars. And we're one of the largest cloud security companies, independent companies on the planet. So we think that's a great opportunity from a business perspective, but it's also a big opportunity for the adversaries.

• 1:15:11Logan Bartlett?

  I want to back up a little bit. We touched on your journey into being an entrepreneur. But what was, did you grow up thinking you were gonna start a company and Foundstone was just the manifestation of that? Or did you just kind of accidentally fall into?

• 1:15:26Speaker 01

  Yeah, I always wanted to do something on my own. I mean, I grew up, I had zero money and, you know, put myself through school and that kind of stuff. And then got an accounting degree because I didn't want to be a mainframe programmer, because I went to college in the eighties and really didn't, it didn't, didn't mean, you know, you couldn't be a Unix programmer or something back then. But a lot of it was around mainframes. Didn't want to do that. Really wanted a business degree because I knew I wanted to do something on my own. And yeah, that's how I picked accounting was I just thought it was a good way to, to have a foundational element, you know, understanding of business and, and how things work. And that's really, you know, I was, I've always been creative and sort

• 1:16:08Speaker 01

  of had that, you know, mindset that the, the security mindset is like, how do you think about how somebody's gonna break your system? But you're always thinking about the creativity, like what's next? How do we, what do we do? How do we solve problems? And, you know, for me, going out on my own with Foundstone to kind of solve a unique problem that I saw was Fun and you know, I honestly, I'd rather bet on myself than others. So that was, that was a big piece of it.

• 1:16:35Logan Bartlett?

  Uh, the original product and team, you, you all were in New Jersey at the time and I, I read that you met, your VC in the Minnesota airport or something to raise money. What was the, like, how did you get the group, the band together to go build?

• 1:16:50Speaker 01

  Yeah, we, we had all worked together at E and Y and, um, you know, we're kind of like, ah, this is, you know, there's things that we want to do and,

• 1:16:58Speaker 01

  you know, it was a fine place to work, but, but beginning had so many constraints because it, it, you know, independence issues and all kinds of things you couldn't do if you, if you were an independent company. So, um, that was, that was really it. We, we sort of got some folks together and said, hey, there, there's a problem in the industry, which is like, we can't, because we were doing a lot of pen testing and those sort of things and people couldn't find all the vulnerabilities. And at the time it was like desktop scanners, um, not enterprise vulnerability management solutions. So we, we said, well, why can't we take this simple desktop scanning assessment technology and make it an enterprise ready vulnerability management solution? And that's how, uh, that's how we literally created the term vulnerability management. It didn't exist before we, we, we put it out there.

• 1:17:44Speaker 01

  Because people were assessing, but they weren't managing and they weren't doing it at enterprise. So that's how, um, we got that going. And, you know, for me, it was just, um, blank sheet guy, like, how do you create new things? How do you solve problems? That's part of being an entrepreneur.

• 1:18:00Logan Bartlett?

  How, how does, how, how does the late twenties, uh, I assume, I mean, you were at least, I don't know if the others on the team were, but E and Y, uh, people in New Jersey, how, how did they end up finding their way to Silicon Valley investors and, and, uh, ultimately like getting this business going?

• 1:18:15Speaker 01

  First VC was out of Seattle and basically said, you could move to California or you can move to Seattle. And I said, nah, I'll move to California. And so I liked the weather a little bit better there. So that's how I got to California.

• 1:18:27Logan Bartlett?

  Wow. Yeah. I, I think that's pretty distinct from the, the way that VCs operate today with, uh, remote and all of that.

• 1:18:34Speaker 01

  Yeah. This wasn't a, this wasn't a choice.

• 1:18:36Logan Bartlett?

  Yeah. That's, uh, that's fascinating. Uh, and you guys have been remote. I mean, I referenced it. You've been remote-ish from the, from the start, from the early days?

• 1:18:44Speaker 01

  Remote first as a company. I mean, now we have many offices and, uh, you know, we're encouraging people who are near an office to go back in a couple of days a week, which is always a challenge post COVID, but. What I wanted to do in that foundational team, those first 20 people is to

• 1:19:03Speaker 01

  handpick

• 1:19:05Speaker 01

  the best folks, put them in place wherever they were at. And then we ran things remotely. And even I remember having the conversation with Samir Excel. You know, how's all that going to work? And I'm like, well, the most effective software model in the world is open source and everybody's all over the place. So I think we can try some of that and, you know, we'll make it work. And it did. And literally, I mean, we did this before Zoom. We did this before Slack. We did this like the tools we had were Stone Age in 2011 compared to today of what you can do. But we made it all work. We literally had tried, you know, tap a talk and you name the crazy stuff. We used it, but we made it all work. And then over time, it was, you know, still being able to have the flexibility

• 1:19:49Speaker 01

  to hire people that were remote, but then have offices that were really hubs where you can have some center of of gravity, not only in the U.S. but worldwide. So that's how we operate.

• 1:20:00Logan Bartlett?

  Are there first principles, things that you all do from an operating standpoint? Hey, everything needs to be written or everyone needs to be on a Zoom with their own screen or anything along those lines that you all do that you recommend?

• 1:20:12Speaker 01

  Well, when we first started and we were a remote company, we made everyone, no matter where they were, come into, at the time it was California, for one week of immersive training. And it was required that someone on e-staff had to teach some part of it. Every time we had someone that we ran a

• 1:20:31Logan Bartlett?

  E-staff executive?

• 1:20:32Speaker 01

  Executive staff. Yeah. So you just basically somebody that represented the executive staff had to go there, meet the people and teach them and tell the stories. Not the whole week, you know, but like their section of it. And we had to stop that with COVID, but we did that. It didn't matter whether you were a receptionist in Sydney. You flew to California and you basically got immersed for a week.

• 1:20:56Logan Bartlett?

  And that made it through thousands of

• 1:20:58Speaker 01

  Thousands of people.

• 1:20:59Logan Bartlett?

  Yeah.

• 1:20:59Speaker 01

  I mean, expensive, but it really helped build the culture.

• 1:21:03Speaker 01

  And it got people, you know, to buy into what we were doing. They weren't always in an office. They weren't always being touched. So you wanted to give them that foundational piece. So I think that was important. And then the other piece that we did is we, we had many sort of forced meetings and offices, not forced in a bad way, but hey, we're not going to see everybody in person for You know, for three months. So we're going to get the entire engineering team together over here. And again, there was expense associated with it, but we weren't paying for all the real estate. So we kind of balanced out. And that really made a big difference of getting everyone together to accelerate the collaboration.

• 1:21:39Logan Bartlett?

  So operating, it sounds like there's a methodology that you use for how you operate and run Crown Strike. Can you speak a little bit about that?

• 1:21:48Speaker 01

  Yeah, it's something I came up with over the years. I mean, it's nothing, you know, so for so formal, but it's, it's kind of what I use to, to try to operate a company. And I, I came up with just an acronym. So I can remember it called PETS, which is People, Execution, Time and Strategy. So I think a big part is you, you know, you have to have the right people. And there's a methodology of finding the right people who can execute. And, you know, there, there's sort of the, the say do ratio. There's a lot of saying, but not a lot of doing. They're probably not executors, right? And there's a piece that goes into how you execute, how you manage the business, how you understand your KPIs, and all the things that goes into making, you know, execution take place. And then there's a strategy piece of like, okay, what is the game plan here? What's the, you know,

• 1:22:33Speaker 01

  immediate game plan, medium term and long term? And then how do you put time around it? And the challenge I see with a lot of folks at organizations, even young entrepreneurs is like, like time matters, you know, I'm looking at a watch, not a calendar. So, you know, if you don't take all of those things and execute within the timeframe that you have, you know, I mean, if Crown Strike came out today, we'd be crushed because of the everyone else, you know, you know, that's doing all kinds of stuff, right? We, we were at the right time. We executed. We had the right people and we had the right strategy. We put it all together. So, you know, there's all subcategories of that. We don't have to go into, but that's just a simple way for me to look at it. If you don't have the right

• 1:23:16Speaker 01

  people, you can have the best, you know, strategy, it'll go nowhere. You're not going to execute unless you have the right people. And then you're certainly not going to do it within the timeframes you want. So that's really why it starts with a P. Going to come out, come up with a different acronym that would have started with something else, but it's With a P for that reason. So that's really the way I use it. I talk about it internally. People know it internally. And it's been, you know, a helpful but simplistic way to think about, you know, making crotch strike, you know, even better than it is today.

• 1:23:48Logan Bartlett?

  And so is that the the PETS acronym as it goes across, there's a bunch of sub questions that you'll ask within each department. And is this something that actually folds into a to KPIs and frameworks and all of that as well?

• 1:24:00Speaker 01

  Yeah, yeah, it's, you know, it's not so structured that I probably need to put pen to paper one day and write it all down, but.

• 1:24:10Logan Bartlett?

  Write another book.

• 1:24:10Speaker 01

  There you go. There you go. But I think if you take sort of those key principles, it can be applied across what we do in in many areas, you know, just getting people to think about it in the right way.

• 1:24:21Logan Bartlett?

  Early days growing up in New Jersey. So you you mentioned putting yourself through through school. I read around seven, your father passed away, is that right? And at that point, you took a job to be a newspaper.

• 1:24:37Speaker 01

  Yeah.

• 1:24:38Logan Bartlett?

  How did that experience, whatever, whatever part of it you want to speak to, influence you today as a founder operator?

• 1:24:46Speaker 01

  You know, it's one of those things that I think like if you look at the top entrepreneurs, there's probably always some level of trauma in their life, no matter what it was, that I think helps galvanize their thinking and their work ethic and and, you know, really who they become. So I think if you can take those life experiences and galvanize and turn them into something that you can build on, I think that's important. So when you don't have a lot of money, you gotta, you know, figure it out. You gotta go out,

• 1:25:20Speaker 01

  make your own luck. And I think if you realize, like, if you have no money and you're making it yourself and it's hard.

• 1:25:30Speaker 01

  You remember all those principles, you know, as you start companies. When you look at CrowdStrike, um, you know, I'm so, I still look at all the cash that comes in. You know, AR and cash are our biggest areas that we focus on, but it through our whole history of found zone and CrowdStrike, like expenses matter, cash matter. We were never a company that just spent at any cost and, you know, hope for the best. So I think those sort of blue collar experiences you can translate into running a company and how you deal with people and how you hire people and, um, you know, it's just life experiences that you file away and hopefully make you better.

• 1:26:13Logan Bartlett?

  My understanding is you played a lot of sports growing up. What, uh, any, any sports you look back on, you think were the most impactful to you? I know you still race today, so I don't know.

• 1:26:22Speaker 01

  I didn't, I didn't get to race. I mean, I did all kinds of crazy, you know, motorbikes and stuff like that, but, um, didn't have enough money. Racing is, can be expensive, so I didn't have enough money to do that. But I, the biggest one, I mean, I, I swam, I ran, I wrestled, I baseball, football. I think football was, was the biggest one for me, um, that was really impactful. It was a team sport. And, you know, I was never the biggest, the fastest, the, you know, go down the list. I think, you know, I was probably the, the guy with the biggest heart, put the most work in, which again translates into, into things that you do later in life. But I think, you know, working with a team, even today, you look at so many kids are just in their bedroom

• 1:27:07Speaker 01

  and they're playing video games and those sort of things. And it's, you know, sometimes it's good to be out, be on a team, understand how it feels to win, um, understand how it feels to lose and take all those life experiences. So I would say football was the biggest impact for me.

• 1:27:22Logan Bartlett?

  Football's an interesting one, as you referenced, and we talked about earlier, I, I played as well. And it's, um, I guess for our international audience, maybe they wouldn't, won't appreciate this point quite as much, but it. I so much appreciate it because every body type has a kind of different spot that they can potentially pay. If you're a big heavyset kid, you can do this. If you're a small fast kid, you can do that. And it requires such coordination among the group, right? Like just having one person do their own thing might work in basketball or soccer or whatever it is. But you all need to be in concert, kind of working together. And if one person fails, the whole team could fail and actually put each other at risk

• 1:28:04Logan Bartlett?

  in some way physically. And so I've thought it's a, I realize there's a lot of safety concerns around, around it and rightfully so. But there's so many good lessons I feel like I took away from that sport specifically.

• 1:28:17Speaker 01

  I absolutely, I agree. And we didn't, you know, we didn't have all of the fancy equipment, everything. Yes. Literally, I was telling the story the other day to somebody like, if, if you screwed up, you know, your punishment wasn't, was you didn't, you didn't get to go to the water trough. Like people, people are dying now because they don't get water. That was our punishment. No water for you. Like, you think about that. That makes no sense.

• 1:28:40Logan Bartlett?

  Yeah. Concussions were called shaken up or something like?

• 1:28:43Speaker 01

  Yeah, shake it off. Like, I can't tell you how many concussions we probably all had that we just, you know, we would, we'd just go back in. We had a coach that, you know, if you screwed up, you'd take his whistle on his, we would twirl it, whack in the helmet, your ears would be ringing for the next two hours.

• 1:28:58Logan Bartlett?

  I don't think that plays anymore.

• 1:28:59Speaker 01

  Not anymore. Yeah. But that's what we did.

• 1:29:01Logan Bartlett?

  You, you learn, you learn a lot of good lessons along that. We referenced Price Water House Coopers and working there in their early days. Did that, anything from that experience that you, you took with you today or as an entrepreneur specifically? Obviously, it led to your entrepreneurial journey. But any lessons of being an accountant right out of undergrad?

• 1:29:21Speaker 01

  Yeah. So I was an accountant. I was a intern. So I was in like a special program that I got to internship stuff and was able to work, you know, many, many long hours while I was still in school. And I think gave me, you know, an appreciation for attention and detail and probably work ethic. And I, again, I have so many stories. When I first got to Price Water outside. Literally was using 16 column and 10 key keyboard, you know, 10 key calculators, right? There was one PC, um, which barely worked. And so we were adding all this stuff up. But anyway, long story, there's plenty of stories around, you know, what we did to try to help make that a little bit better. But I remember when I first turned in my

• 1:30:05Speaker 01

  first set of work papers, and if you've ever seen these things, now I'm sure they're all electronic, but it was like a phone book. And I turned it in and the senior that I worked for, she literally, I was so proud, it took me months to audit accounts receivable for a big pharmaceutical company. And she went down, she looked down the side of this piece of paper, like not paper, but the, the work bundle. And she slid it back. And she goes, all the pages aren't, aren't even. I go, what do you mean they're not even? They're not even.

• 1:30:35Logan Bartlett?

  They're not lined up?

• 1:30:36Speaker 01

  And I had to literally go back and refold because you had, you had to use this little eight and a half by 11 cardboard thing. And then you had 16 column came out here, right? Dating myself. It'll fold it like twice. And then you had to put this, this little cardboard thing in so that everything was even. And I'm like, you gotta be frigging kidding me. Like this is the dumbest thing. But when I look back, it was attention to detail.

• 1:31:01Logan Bartlett?

  Yeah.

• 1:31:01Speaker 01

  Right? So it's, you know, why the Marines flip a quarter on the bed?

• 1:31:06Logan Bartlett?

  Yeah.

• 1:31:07Speaker 01

  I mean, can't make your bed right. You know, you're not looking at, you know, your equipment right.

• 1:31:12Logan Bartlett?

  It's funny, I have a funny one from investment banking, which I notice fonts all the time. And it's, it's like a, uh, if a presentation or something has like a different font in the chart than they do in the, uh, I just, I can't not see it. And it's just, it's funny, these things get kind of ingrained in you. And I'm sure you look at stacks of papers and will notice that stuff.

• 1:31:32Speaker 01

  Yeah, all that. But any little detail, my, my biggest pet peeve is if I see, and you've probably seen this, like, PowerPoints that have a date, but they're out of date. Like it's 2024. I shouldn't see a 2023. And if I see that, it's like, well, what else have you missed?

• 1:31:47Logan Bartlett?

  Totally. Oh, yeah. It opens up. It opens up a bunch of different questions along the way. As entrepreneurs, sort of think about the timing of an individual market and the tailwinds. We talked about the different components that you were you were thinking about. Is there a way of that you advise companies to sort of assess if now's the right time? Or if they're the right person to go out and actually start a business?

• 1:32:08Speaker 01

  Sure. Well, there's two pieces of that. One is the market ready and two is are you ready to go do that? Which sometimes are mutually exclusive, but I think from a market timing perspective, when I looked at Crouch, right? I saw that the need for security A wasn't going away. B, the outcome that people were paying for, literally people are paying billions of dollars for security. And they're still being breached, right? Because everyone's focused on malware. I mean, it's still a problem today. There's still security issues. But certainly back then, people were spending a lot of money with these legacy companies and firewall companies. And they're still being breached. I mean, is there a company that you know of that has been breached that didn't have a firewall?

• 1:32:49Logan Bartlett?

  No.

• 1:32:50Speaker 01

  They all have, right? So, I mean, okay, things are policy enforcer. So my, my point on that was like, there was an outcome that we needed to solve for. And people being breached was an issue. So I knew there was a better way to do it. Two, and this is really an important point, is I like markets where you have incumbents with high customer dissatisfaction. You ask any customer, and I was at Mac, I won't pick on Mac, like picked a whole lot of them. Did anyone really like their technology? 95% of customers like, no, this thing is slow. It takes too long. You know, it doesn't work. I'm still being breached. I need something better. So with that level of dissatisfaction, there's got to be a better solution. It was like perfect for us. And there are other markets like that.

• 1:33:33Speaker 01

  You know, if you're going to enter a market where everybody loves the product and people don't see the new problem. And, you know, they're not going to figure out what they need into the next five years. That may be a tougher slog, but for, for us, we knew high dissatisfaction, outcome that people wanted. And biggest Thing was we had a unique and differentiated approach.

• 1:33:50Logan Bartlett?

  Yeah, my framing of that, which actually my father in law used in his, his father of the bride speech was, was why now, why you and why this, like answering those three things. Why is this moment in time? Cause you can either be too early or too late. You're never, it's never the right day to start a company.

• 1:34:13Logan Bartlett?

  And ideally you're, you're going to be a little too early and then grow into it. And then why do you uniquely have a skillset to go do it? Because anyone else in the world could probably go do it. And then, and then why this, like why this approach to solving the problem versus anything else?

• 1:34:29Speaker 01

  Selling 101.

• 1:34:30Logan Bartlett?

  Yeah. And then, and then it's why does it, what, why does it matter? What happens if it's successful?

• 1:34:36Speaker 01

  Is he in sales too?

• 1:34:37Logan Bartlett?

  What?

• 1:34:37Speaker 01

  Is he in sales?

• 1:34:39Logan Bartlett?

  He was consulted, actually. It's an interesting, interesting thing. Yeah. Cool. There's a lot of ambitious people that might be listening to this thinking like, how do I rise within my organization or what, what is successful people within a company like CrowdStrike do? And I, I imagine you've had a lot of young people scale within your, your org. Are there commonalities, either characteristics or anything you would point to that like people that have really succeeded within CrowdStrike and have continued to scale within the organization?

• 1:35:08Speaker 01

  I think the people who've succeeded in CrowdStrike play for the name on the front of the jersey, not the back of the jersey. And you know, if you're always playing for the name on the back of the jersey, just because you're worried about your own career or yourself or something, that, that doesn't really work out so well. So the team aspect of what we do, I think people have pitched in, people have been thrown into areas where like they've maybe not had a lot of experience, but they had to figure it out, but they had the right attitude. And you know, again, it's attitude and aptitude. Maybe they don't have all the skills in an area or the experience, but they get the right attitude. And I think that is one of the key pieces. So we like really wicked, smart folks who have a, you know, start with a yes and play

• 1:35:52Speaker 01

  for the name on the front of the jersey and are really worried, just focused on getting stuff done. It doesn't really matter. I mean, there's 20 excuses you can come up with of why not to do things or why it was hard or dogging my homework or all that kind of stuff. It's like, none of that really flies. Like we gotta get stuff done. It's not going to be easy. Let's figure it all out, work together as a team. That, that's what we. That's what worked out well, I think, you know, the best for our culture. And if I was to give any advice, um, you know, if, if you focus on making the customer happy and you focus on being a team player, then a lot of the good things come. Like if you just focus on making a bunch of money and just yourself, people tend to get themselves derailed.

• 1:36:37Speaker 01

  And I think if you just, and certainly from a company building perspective, focus on the customer, the rest takes care of itself. And, you know, don't always, it's not always about you, you know, or the founder or the CEO or those sort of things, like it's a team sport and you've got to keep that in mind.

• 1:36:55Logan Bartlett?

  Awesome. Thanks for doing this.

• 1:36:56Speaker 01

  All right.