Martin Roesch founded cybersecurity software firm Sourcefire in 2001 with the goal of making money on a widely used and freely distributed security program he had built years earlier called Snort. Twelve-and-a-half years later, Cisco bought the company for $2.7 billion. Now that’s what you call making money. In an interview last week at start-up hub 1776, Roesch shared lessons learned along the way with a gathering of tech and security enthusiasts:
Admit what you don’t know.
In 2002, Roesch was flying back and forth between Sourcefire’s Columbia headquarters and the offices of West Coast investors. Every time he returned, there was a new face in the office.
The company went from four employees to 30 in less than six months.
“I was very, very scared. We were growing so quickly and things felt out of control and I didn’t have any experience with what we were doing. I was terrified I was going to screw up and kill us all,” he said.
So Roesch made a decision that more egotistical founders might find difficult: He hired someone to take over as chief executive who had the business acumen to complement his technical know-how.
Hire the right executive team.
Roesch sifted through 20 résumés from CEO candidates. He narrowed the pool to nine, then three. Then he hit a wall.
“On paper, their CEO skills look the same,” Roesch said. “I decided the tie breaker was ... I had to figure out which person I got along with best. What I did to figure that out was I forced them to hang out with me.”
They watched football games, played rounds of pool, and drank cases of beer. In the end, Wayne Jackson got the job. He stayed with the company until 2008; Roesch said they remain close friends and even co-own a boat.
“You never want the founder and CEO pointing fingers at each other. If that ever happens, you’re in a world of hurt because then you’ve got this misaligned top-of-the-pyramid leadership,” he said.
Make big bets when needed.
Technology research firm Gartner published a report in 2003 with a declaration that threatened to kill Sourefire’s business before it really got going: Intrusion detection software is out. Intrusion prevention software is in.
Sourcefire, at the time, built intrusion detection software.
Rather than rush to create intrusion prevention software that Roesch figured would be inferior to competitors, Sourcefire designed completely different technology that no one was asking for or, in his words, knew they needed. It wound up being a big seller.
“You have to understand when you need to make small bets and when you need to make bet-the-company huge bets,” Roesch said. “You are going to need to make those bets.”
Don’t build customers what they think they want.
If Henry Ford asked customers what they wanted before he manufactured the automobile, their responses would have likely been a faster horse, Roesch said. As a founder, you must know what your customers need, sometimes before they even realize it.
For example, Sourcefire built software to distinguish serious threats from benign threats so that companies could focus their attention and resources on the most critical attacks to their networks.
If you only build products that customers ask of you, then the company may be solving symptoms rather than a deeper problem that the customer doesn’t yet see, Roesch said.
Know when it’s time to sell.
Before Roesch incorporated Sourcefire, another technology firm offered him $250,000 to buy Snort, his open-source security software. If it was worth that much to them now, Roesch thought, it would probably be worth even more down the road.
When Cisco came calling 12 years later with a $2.7 billion check in hand, the thought process was much different.
“You don’t want to be one of these companies that has a great deal on the table in front of them and says, ‘No, we’re going to eclipse that.’”
“We did the math. We looked how long it would take us to get to [that size] ourselves naturally. We thought in the interest of our shareholders and due to the scope of the deal ... that this was the right time,” he said.