Brad Pollard, Tenable CIO

Luke [00:00:00] This is Atolio conversations, I’m Luke Alie. Brad Pollard is the CIO of cybersecurity company Tenable. Brad is one of a kind, and I’ll try not to steal his thunder here, but he’s a punk rock playing bootstrap technologist who has seen remarkable success over his career at several startups and high growth companies. He shares stories from throughout his career. His thoughts on good and bad startup cultures. Some of the best advice he’s ever gotten and more. And one last thing, since Brad still in the band, he was able to record his end, so please enjoy my very clear sounding conversation with Brad Pollard. Brad, thank you so much for coming on the podcast.

Brad [00:01:00] Absolutely was looking forward to it.

Luke [00:01:03] Awesome. Well, maybe we can just start by talking about your work with Tenable and a little bit about your background in technology.

Brad [00:01:11] Sure. I’ll do that in reverse order. So I got involved in technology as a result of trying to be a musician back in. I guess, you know, 1995 was trying to get my band on the World Wide Web, which was a new sort of thing, and started learning how to build websites and, you know, get online and all the other things that were hip in the day and ended up working for a small ISP in the late 90s. And that was like going to college all over again for something entirely different. I worked for a def owned ISP called Clark Net, where I learned American Sign Language, I learned Solaris, I learned Cisco iOS, I learned Perl, I learned everything there was in the world to learn and there was no end of things to learn and no end of people to teach you how to do it. So I became in love with the startup culture, mainly because it was for me it was like a punk rock band. There were no rules. You know, we were off building products that had never been built before, running an operation that I had never been exposed to. I have a degree in psychology, so I didn’t even know this stuff was out there and just met great people, really, really smart people. People that are now vice president at Salesforce, for instance. That was one of my first bosses who really got me engaged in, you know, learning more about how to run the operation, not just the technology. From there, I went to work for a company called Sourcefire, which was an intrusion detection company. I spent 12 years there before we were acquired by Cisco. And again, I, I ran it at that company like we did at the ISP. I ran it like a service that was really functional and we really scaled quickly and we were able to scale without not not linearly in it, but we were able to continue to run that service as we went from I was just like the 17th person hired to, you know, 1500 people when we got acquired by Cisco for three billion dollars. I spent two years at Cisco, really missed that startup culture and that growth culture. And there were some connections between Sourcefire and Tenable. And I found them and I engaged them and I got involved with Tenable to help them grow. I went there in twenty fifteen. We were about 400 people and this was pre-IPO. And now we are a publicly traded company. We’ve had three acquisitions and we were about 1500 people globally.

Luke [00:03:37] Wow. That’s an awesome arc. So it sounds like you’ve tended towards fairly big swings and exciting choices in your career.

Brad [00:03:49] Not on purpose. Like I, I really when I went to school, I went to school for psychology because people interested me and I was kind of curious about that thing. I bought my first computer after I graduated from college, which dates me a little bit in terms of being able to get through college with a word processor. But, you know, the the the clerk that company was based in a barn. You know, there were sheep outside. You know, we had mice climbing into Slayer’s boxes, chewing through boards. I mean, it was to me, it was like it was it was the antithesis of sort of what I thought jobs were supposed to be. You know, and it was kind of like, this is fun, you know, I’m learning every day I’m going to I’m going to work. I’m learning something I didn’t know how to do before every day. And it’s and it’s cool, you know? And then again, really crazy things happened in the first five years of my career. I went through three acquisitions, you know, and now then I went to work for a company called Exodus Communications in 2000, just exploded and then was exploded, like the best part of the bubble just completely fell apart. Chapter 11 acquisitions. I find myself working in Savas, like in this sort of sideways organization. It’s like this is not what I don’t want to do this, like I’m not. And it was this moment of clarity, which is like I’m not I’m not a technology guy. I’m a startup guy and I need to go find another startup. And that’s when I found that’s when I found Sourcefire. And I called one of my clerk at Startup Friends and said, Where are you? What are you doing? And he’s going to come here, it’s great, you know, it’s it’s a little weird, and I don’t I’m not sure it’s going to work, but everyone here is pretty good. And so that’s why I did and then end up being the best decision of my life, because I was there for 12 years before we got acquired for three billion dollars. And then, you know, and then I got to learn inside of Cisco and like, listen, I just got a great company and I learned a ton in the two years I was there. Things I used today, certainly things about, you know, bigger picture company strategy. So there’s there’s value in all of it, you know. But ultimately, as I was getting, you know, what do I want to spend all day, every day doing? Growth companies are a lot of fun, it’s really fun to to to have big moments, whether it be, you know, an IPO, which is which is kind of really cool when I got to go to the Nasdaq, when we did it and, you know, we’re standing in the middle of the street there and there’s my you know, I got my arm around a meet with my my director of support, Natalie Goodman, with me. And I’m like, oh, my God. Like, this is a thing that’s happening. And it was, you know, I own a suit. So I had a suit on, which was I guess that’s very grown up. But that’s the kind of stuff like that. There’s never part of the plan, you know. But I also, you know, you just go through the door that opens

Luke [00:06:38] wild, absolutely wild of. So I want to talk about that startup culture because there seems to be a clear benefit and draw to that innovative, fast paced punk rock startup culture. Right. And I guess as a CIO, I’m curious to hear your thoughts on what the drawbacks of that type of culture is and how you’ve learned to work with it.

Brad [00:07:07] The drawback with it is that the thing that makes it go can also be a problem. Right? So there’s in any startup culture, there is the notion of entrepreneurial spirit. And when you’re involved in governance, I call that cowboys and cowboys can cause problems. And the thing is how to how to embrace it is is well, frankly, is to embrace it. Right. Not to be binary about this way or that way. And I had to explain to me once by someone that I can’t recall who. But it was the answer is always yes. Let’s figure out how to make it work. And that way you engage your stakeholders and they have skin in the game when you have a binary approach to it, when you’re this governance body and someone says, I want to do X, Y, Z, and you say no, all that does is inspire shadow it. All that does is inspire smart people to go do it anyway and that just doesn’t scale. So if you want to stay a growth company and you want to keep that culture, you have to say yes and let’s figure out together. And then you partner with that person or that group of people and you work on a solution together. You don’t it’s not necessarily they’re asking you to do something for them. You’re saying, hey, I’m the technology arm of this company. This is your business unit. Let’s put something together that solves the problem and you’re going to be part of it. You’re going to help us find budget. You’re going to help us talk about the rules. We’re going to talk about we’re going to see how it integrates. And once people get involved in the process and they see everything that’s involved, you get a much better work product. And it takes a while to get that culture going because it’s just not that common, especially in large organizations. IT and governance bodies are perceived as red tape. Right. They’re perceived as something to slow down innovation rather than an innovation partner. Right. And I think there’s ways when you can say, hey, you know, we’ll let’s do a pilot, let’s have infosec review it, let’s do it in a way that’s control. We’re looking at access. We’re monitoring things. Let’s do it through our single sign on application. Let’s have this group of people work on it. Let’s do those things and just put, you know, enough guardrails on it so that it’s not a guy with a credit card speeding up an AWB thing with a wide open network, you know, available on the Internet that they’re copying data into. Right. I mean, that’s that’s something that whenever you hear something with with, you know, data leaks out there in the world, it’s always somebody had an AWB thing that wasn’t properly secured. And so it’s it’s almost like, you know, you don’t I don’t want innovators out there working without a net. And so you want people to do things, but you want to protect them in the process, which is which is like, hey, let’s let’s let’s just play in the right sandbox. And again, I never you know, when I say cowboy has a negative connotation to it and I don’t mean it to, you know, I think a lot of people are trying to solve problems or trying to solve problems fast, and they just don’t have the experience or the just the the big picture of what the possible impacts could be, which is why they let old guys like me be the CEO, because we’ve made all those mistakes right. And we’ve seen all those things happen. And I will tell you, you know, my workstation in two thousand was the source of a denial of service attack on Yahoo! Because I had an improperly secured RedHat installation that got popped. And we were in the data center where Yahoo! Was in Virginia and a friend of mine was sitting next to me. He was also the guitar player in my band at the time, Rich Fulton. And he said, Which machine is the plan? And I said, that’s me. He goes, Well, shut it off. You know, that’s where all the packets are coming from. And thus became my interest in cybersecurity because I had made the mistake. You know, I had a default installation. I hadn’t changed the route password. God knows what happened, you know, in that twenty four hours. And I ended up being the source of an attack. And so that’s where, you know, I’ve learned that the hard way, I just don’t want other people to learn stuff the hard way.

Luke [00:11:05] Oh, my God, it’s so stressful. But at the same time, I feel like I’m like, you know, maybe I like kind of an abstract managerial level. Like there’s a lot of good that can come from failures like that in terms of like building relationships and trust and stuff like that. Right.

Brad [00:11:27] I wouldn’t say you want to lose on purpose. Yeah. Fair. You know, so but I mean, I think that’s in the due course of things. How you react to a problem as a team is important. Right. There’s a couple of things. You know, again, I got I got great advice over the course of my career guy by the name of Tom Asharaf, who’s currently the chief product officer at Threat Quotient. He was the VP of product at at Sourcefire. And he’s definitely been a teacher of mine over the years. And my favorite thing from Thomas is bad news doesn’t get better with time. You know, as soon as you know something’s wrong, get on it, get everybody involved, rally and fix it. And that’s why we all do this right, because we solve problems and we fix things. So get on it. Tell people why it’s wrong. Tell them you know, and work together. And I think to to really answer your question through incidents, you become a stronger team. Right through, through and not in, it’s again, I’ve never. I’ve really never worked for somebody that yelled when something went wrong. I’ve always worked for really balanced executives that understand here’s the problem. I know you’re on it. Let me know. Keep me updated. And so that’s that’s the way I’ve always done it. And every time we have a conversation with you when like I say, they’ll call me, hey, this is happening. Let me call you back in an hour when I know more. OK. You know, and again, it goes with my assumption is that they want to fix as badly as I do, when you assume everybody in your team is working towards the same goal or that everybody wants to do a good job, and that becomes the culture where everybody wants to everybody wants to succeed. Everybody wants to do a good job. And that’s what you trust. People are going. They do it.

Luke [00:13:14] Yeah. Yeah. I think that that makes total sense. And and I think that Julie Colvin said it similarly when she said, like, get ugly early. And I think that’s something that I really appreciate about Attilio is like the sense of good faith that kind of permeates the culture here, right?

Brad [00:13:31] Yeah, especially the size that you guys are now. You have to have that. And I will give Marty Raasch credit for when when I started working there and he was the funniest guy. You know, we have we’d have meetings and I went and interviewed for that job and I left my first interview because I had tee time. I was playing golf and he called me and said, hey, you were here interviewing. And the guy said, you left. I said, tee time, you know, golf works, right? Like, you have to be there at that time. He’s like, would you come back in here, please? And I was like, sure. I mean, whatever. I mean, I’m I’m I don’t even I think was like twenty six years old or something and not really all that bright. And you know, I went back in and the guy was, you know, he, he said this is where this is going and I think we’re going to be successful. And you know, the first twenty people I hire here have to be have to get it. And I think you get it. And I was I was intrigued. I was like, this guy gets it. Like, he totally gets it. And so that’s when I was like. All right, you know, I took a pretty big pay cut to go to work there, too, and it was like but that was like the most the best decision I ever made because it was really much about he would do these meetings on Friday and it was like 20 of us standing in the room. Right. And he’s like, tell me what your name is and what the hell you do. And we go around the room and everyone would say whatever it was, this and the funny thing about that was there were no titles like everyone had titles, but everyone just sort of referred to what they did functionally. And it was it was really telling about the culture there. The people he had picked for that first 20 people were they were all doers. You know, there was no there was no kind of I’m the vice president of this or I’m the director of this. They was, you know, like and I sell product and I build product, you know? And candidly, I was like, I’m I’m the guy that cleans up all the crap. Right. Like the infrastructure guy. I’m the guy we’ve got a closet with two Cisco. Twenty four hundred, whatever they are in there, and pizza box FTP servers. And I had no idea the web server was in the janitor closet and I need to get that out of here. But that’s what it was like, you know. And so and that was like the really, really fun thing about that, that company for sure.

Luke [00:15:44] They did well, so do you feel like I mean, obviously it’s anecdotal and case to case, but do you feel like you’ve seen a difference in what was considered like startup culture in the mid to late 90s versus now?

Brad [00:15:57] I mean, I don’t even think I knew what a startup was in the mid to late 90s. You know, I grew up fixing cars and I didn’t know there was such a thing as startup companies, much less that they were lucrative if they were successful. Right. And I had never even considered it. Even when I started working there. I never and there like, here’s stock and look, what’s that for? And they were almost like, well, then there’s not stock, you know, but, you know, they could have and I wouldn’t have cared. Right. But it was interesting. And then, you know, the exposure there at that time, you know, pre bubble as everything was exploding was just like, what have I stumbled into? You know, what what is this and what is this world and what’s happening? And it was fascinating, you know, and it was fast paced and it was crazy. And I really enjoyed it. You know, I and even when and I will tell you, I remember being twenty seven years old playing golf on a Saturday with my friends and and like, the market was out through the roof and we were, you know, kind of like hotshot engineers at Exodus. You know, we were doing backboned engineering and peering with all the major providers and we thought we were as smart as you could possibly get. And I remember sitting in the golf cart going, this isn’t real. This isn’t going to last. This is this is this can’t be the way it is. And I mean, sure enough, like a month later, the market crashes and everyone comes back down to earth.

Luke [00:17:23] Yeah. Oh, God, what an absolutely wild ride it was.

Brad [00:17:28] It was crazy. It was just kind of like that moment of clarity like this isn’t normal.

Luke [00:17:35] Yeah. I mean, I feel like I feel like I can relate on a certain level. It says that, like, you know, it’s a very different flavor. But I’ve definitely somebody is motivated by, like, kind of collecting stories. And in the past I’ve definitely taken odd jobs that things like that just, you know, just be like this is another chapter in the book, you know what I mean?

Brad [00:17:57] Yeah. I mean and again, I tend to kind of go back to your your startup culture question. I mean, one the one thing I will tell you about it that’s different than some of the startups I’ve been in since. And so I you know, I went to another startup that which will remain nameless in between Cisco and Tenable, and their focus was an exit. They were talking about how do we get what we’re talking about, you know, all these things and it was what about the product, you know, build this thing and build this culture? And it was even kind of like, hey, you know, I had a conversation with CEO. I’m like, you’re losing your foundational people. Like, they have institutional knowledge. They they we can’t be burning people out, like that’s where the culture comes from. And that this company is not listed on my LinkedIn profile or anything. So I can be candid about it because no one can go research it. But it was it was you know, I immediately saw that the DNA for a successful startup wasn’t there only because I’d seen it at least twice. You know, the clerking at DNA, the Sourcefire DNA was I know what good Bones looks like. And it’s about people that really want to do something, you know, and do something different and do something well. And when you’re around those kind of people, it’s really, really inspiring. And it and it’s it makes working fun. And that’s what’s and that’s what started culture was like in the 90s. And like I said, I’ve known plenty of people now because there’s a you know, there’s 20 years of technology startups and there’s stories about, you know, quick exits and all this other stuff that, you know, if that’s the motivation, I don’t fault anybody for wanting a quick exit. That’s fine. You know, you know, money makes the world go around, but it’s so rare. I mean, you’re probably more likely to get struck by lightning than you are to start up a company that has a quick exit.

Luke [00:19:44] Well, you mentioned sort of the good bones of a startup. So I wanted to ask you, can you talk a little bit more about that?

Brad [00:19:52] Yes. So I would say the first thing I would say is technology, leadership. You know, no one like are the guys building the product really passionate about what they’re building? Do they believe that what they’re building is solving a problem, is making a difference? And why? You know, why do they think the thing that they built and why did they build it right? Did they build it to solve their own problems with the bill to solve a problem? That’s all that was out there. And what’s their passion around the technology they’re building? And that’s really easy to tell, especially the guys that I’ve worked for over the years, including the guys that tangible, you know, really passionate about what they’re building, what they’ve built. The second thing is really kind of there’s always a vibe about people in the office, you know, and it’s been harder over the past year with everyone being remote. But you certainly get a feel for if people are excited about wearing the sweatshirt or letting people know they work there and it all gets back to founders, right. It all gets back to leadership. If if leadership’s not excited about the company, don’t don’t be surprised if your individual contributors aren’t excited

Luke [00:20:54] about the company. Yeah, yeah. And speaking of speaking of leadership, you know, I think a topic that I’ve always been kind of interested in is is the role that mentorship plays in translating a lot of those skills. And you’ve mentioned a few mentors that you’ve had and some really great advice that you’ve gotten. And so I want to just hear a little bit more about what the role of mentorship has played in your career and maybe some of the mentors you’ve had and some of that advice that you’ve gotten.

Brad [00:21:21] Well, yeah. I mean, and again, I’ve been extraordinarily lucky. A couple and I’ll give you two. One was a gentleman by the name of Larry Abernathy at that Sourcefire. And I was just I guess I was just 27, 28 years old. And again, I was like a lot of engineers at that point in their career really convinced that I was really smart. I was really, really pretty impressed with myself. And I would write these long emails to people explaining to them why they were wrong and why I was right and why I was so smart and all these other things. And Larry told me was in his office and said, we all know you’re smart. Nobody cares, just get stuff done, stop writing books, just just focus, focus on doing the job every you know and everything else and don’t make this about, you know, don’t be don’t be a 26 year old dude like a grown man. And, you know, I never really looked at myself from the outside in like that and just said, I’m kind of a jerk. Like, that’s this is not who am I trying to impress or who am I try to insult? And I think is one of those moments where, you know, like the Grinch, my heart grew three sizes that day or whatever it was. And I just kind of went I got refocused quickly. And I will tell you, I went from being, you know, the guy that nobody wanted to work with, even though I could get stuff done to being a director within a year and to being a vice president five years after that, because I learned how to work with people and I learned that it wasn’t about me and I learned how to. I mean, that’s when I first started learning how to build relationships and partner with people and, you know, get off this my way or the highway of doing things because because I knew it all. And what did I know? I’d only been doing it for three or four years. Right. I don’t know why I thought I knew so much, but, you know, I did. And I was wrong. But I learned he was still the first guy that kind of just sat me down and say, you’re wrong. And maybe I was at an age where I was able to hear it, but it mattered and it definitely changed the course of my career. The other was the CEO of the second CEO of Sourcefire, John Burris, who was on the board. And I was on an audit committee. So I had to go to certain board meetings. I’m a 34 year old vice president. I mean, I know business. I had I was still out of my depth. I couldn’t even I would shake every meeting I went to. I’m like, why did they put me in this job? I just but I learned it on the fly, you know, again, credit to Wayne Jackson, who gave me the opportunity, and Imadi who supported me, and to Tom Asharaf and Chris Peterson and John Agron and John Zupanc and all these guys that didn’t let me fail in that process. I figured out how to do the job. But John was the best because, you know, he started as a board member. We were having dinner at an audit committee meeting and I said, when are you going to be the CEO? And I have no interest in that. That’s not going to happen. And within three months, he was the CEO of the company and he called me into his office and said, what do you know? How do you know any of these things? And I was terrified. And I was like, I don’t know. I just was making conversation because I’m wildly intimidated and, you know, so we talked for like an hour and he was just kind of sharing wisdom with me and he was kind of giving me this. I don’t know why, but I like you and you’ll be fine and all. So but along the way, he would call me into his office to just as a sounding board. I was the youngest member of the executive staff and he would just I would get Bradken out of my office and I would stand there and he would face like a tiger and just rubber duck stuff off me, just things. And I was like, John, am I supposed to answer these questions or am I just here so no one sees you talking to yourself? And, you know, he stopped one time and he said, You know, Brad. The person with the least words has the most power as a year, he goes, so stop talking and I will never forget I paid such attention to him in meetings after that and we would be in board meetings and there would be these long the chairman of board would say something or someone else or something, and then John would just sit up and say yes or no. And to that point, we were doing an ERP implementation and the chairman of the board was asking me all these questions. And I leaned up and I said yes. And I sat back and John was sitting next to me and he made this big smile and he gives us a really good job. And I said, Well, thanks. Is do you want an Eminem? It’s like, sure, and he put two Eminem in my hand and took one back because it does one Eminem good, not two on it. So I mean, I just I it was that kind of stuff that just made me laugh. And like, I had these these experiences with these guys that were luminaries in this business that kind of were giving me advice like that, that I mean, you can’t pay for

Luke [00:26:23] like one of them. So good. So, Brad, thank you so much for talking with me today.

Brad [00:26:31] Yeah, I know it’s fun. You know, when I met you guys in that other call, I was like, I really kind of liked your vibe when you you’re talking about and you get it. I think that’s important. Like where you guys are in the journey is like it’s a lot of fun, you know, and it’s it’s I really for all the. Times where it’s been really hard, sometimes having a conversation like this reminds me that I really have enjoyed it, you know, and it wasn’t easy and it wasn’t, you know, always the best time in the world. There have plenty of things that were really stressful. And, you know, especially when you don’t have the resources to do what you’re being asked to do, which happens to everybody. But at the end of the day, I really enjoyed, you know, watching other people’s careers grow, watching these companies grow, watching these founders enjoy success, because they gave me an opportunity, you know, watching these founders dreams come true for what they wrote their products for and given me the opportunity to to make a career, make a living. Working for them in the process has been a lot of fun.

Luke [00:27:38] Thanks to Brad for the conversation, thanks to Tom Tierney for the music and thanks to you for listening. Please be sure to subscribe to Attilio conversations and follow us on LinkedIn. And we’ll see you again in two weeks.