Written in its company’s handbook, there’s one rule for working at Dragos. “Don’t be an asshole.”
“The first key to our success is our people and that we hire good people,” said Robert Lee, the company’s founder and chief executive, in an interview with TechCrunch. “I think building a successful team is about having a standard and saying that I expect you all to be adults and not need a million HR policies,” he said.
Lee’s management approach revolves around his company’s greatest asset — his staff. With 125 employees, the company has seen rapid growth since its founding in 2016 but puts great importance on maintaining the company’s relaxed but productive culture.
Lee said he doesn’t want to change its culture dynamics by growing too fast, micromanaging, or burdening his staff with strict expense policies. “If you’re stuck laid over at night, but you see there’s one seat left on a redeye and it’s a first class seat that’s going to cost six times more but it gets you home — go for it,” he said.
But he doesn’t compromise on his “don’t be an asshole” rule. “Say something sexist and a Slack channel? Yeah, you’re fired,” he said.
Lee founded Dragos after working as a former cyber warfare operations officer at the National Security Agency. Dragos works to secure industrial control systems (ICS), the necessary devices crucial to the continued operations of power plants, energy suppliers and other critical infrastructure.
Lee described ICS security as “all of the things in I.T. plus physics.” In other words, it’s about finding the threats targeting critical infrastructure facilities and understanding how the hackers work in order to stop hackers from controlling the gas turbines in power facility, for example.
Once a plot from a science fiction film, powerful malware like Stuxnet and Triton have emerged in recent years and targeted facilities — with near-disastrous consequences.
After leaving the NSA to found Dragos, Lee took his knowledge and expertise to the private sector where he felt he would have greater impact.
“It was clear to me that the government had an understanding that the threats were real and the view that threat actors were really trying to compromise critical infrastructure,” he said. “But the government didn’t have the insight was actually what was happening in the environment and the government doesn’t have the data because it’s not inside the company networks.” With its proprietary technology, Dragos can monitor industrial enterprise networks to detect threats and act on the intelligence it gathers.
But despite the importance of the job, the Maryland-based security startup doesn’t vie for headlines.
Where other companies are keen to attribute blame by pointing the finger at who the hackers are or who they’re working for, Dragos focuses solely on how the hackers are doing it. Instead, the company builds up profiles on the hackers’ tactics, techniques and procedures that they say help detect and neutralize threats in the future.
“Does that help our trustworthiness? Yes. Does that hurt our business? Yes,” said Lee.
“We get we get left out of a lot of media coverage that would be very good for our company,” he said. “But not only does it not help our community, but we’re talking about things that impact safety, reliability and people’s lives,” he said. “It’s fine to educate but I don’t want my people going out being braggadocios about the threats.”
Lee wasn’t disparaging to other companies, but would prefer the company to maintain its “heads down kind-of attitude” than chasing headlines. To him it’s more important to have his customers praise the work the company does — from the industrial giants to the smaller regional facilities.
In its three years, Dragos has raised $47 million in two rounds of funding. Lee said he’s continuously looking to raise new funds while “being a good steward” of the funds he’s received to date, but outright ruled out an acquisition or merger.
“If the company gets acquired, we failed,” he said. Lee said Dragos was offered several “pretty life-changing” exits amounting to hundreds of millions of dollars.
“Our goal isn’t to get acquired,” he said. “And it was so cool as a team to talk about it and turn it down.”
By being acquired, Lee said it would harm competition in the wide ICS space, which sorely needs dedication to the issues and not become an afterthought.
“One of the most strategic risks to the industry community today is that enterprises look at ICS as an add-on,” he said. “The moment we start looking at gas turbines as an add-on, we failed and that’s when security takes a real hit.”
Lee said in order to grow and improve competition across the array of ICS-focused companies, he’s looking to raise more funds with a prospect of taking the company public. “It’s going to be a pain in the ass,” he said, “but we need to grow the near that level so that other companies can enter the space as well.”
“If we go the distance, then we’ll grow competitors and have companies pop up out of nowhere doing things that maybe we don’t want to do or important to ask what are important for the community,” he said. Lee said he’s less concerned about profitability but more focused on “putting as much money in the engine as possible” to grow his team at the rate and pace that makes the company successful and opens the doors for other startups to contribute.
Notwithstanding the one rule in his company’s handbook, Lee said his advice for founders is to know from the very start what they are trying to be accomplished.
“A CEO’s job right off the bat is really knowing the game,” he said. “I really want to build a company that is going to accomplish this mission.”
“What is what are you trying to do? What are you trying to accomplish? Take a real candid look at that and see if you have the potential to be successful,” he said. “The basics of building a company are your team, that there’s a market you’re going, the mission statements or that you’re taking with you and what you’re going to build.” He said companies that hire smart people without a plan but pivot until they find something that works is like “throwing shit at a wall until something sticks” and that’s not fair to the other people are going to come along that journey with you and are taking more risk than you are.
“Just be honest with your people — and be honest with your self,” he said.
Read more:
Comment