Stuart McClure

Rahul Abhyankar [00:03] Stu, it's wonderful to have you on the show. Thanks for joining me on Product Leaders Journey.

Stuart McClure [00:07] Thank you, Rahul. It's been a long time and I'm looking forward to it.

Rahul Abhyankar [00:10] It has been. Stu, you are one of the topmost experts in cybersecurity. You've built a number of companies and taken them through successful exits, so you're a serial entrepreneur. What's your latest venture?

Stuart McClure [00:24] Well, in the cyber sphere, it's an AppSec company where we're using AI to predict and prevent code level vulnerabilities. Let's face it, 100% of cyber attacks are based on flaws in the code, either lack of features in the code or fundamental flaws inside the code vulnerabilities. So Qwiet AI is the name of the company. We used to be called ShiftLeft, but we just rebranded. We're driving the future, really, of AppSec with AI.

Rahul Abhyankar [00:54] One of the things that was always very fascinating about the cybersecurity space is that in many cases, when we build products to solve problems for customers, we try to make our products better and differentiated against competitors. But in the cybersecurity space, you've got the added dynamic of an active adversary that's trying to defeat your product. So there's a level of complexity beyond what you see in typical industries, and you have to think about how do you stay a step ahead of competitors. With what we're seeing with AI, isn't it natural that the bad guys are also going to be using AI?

Stuart McClure [01:33] 100%. I just had a talk about this actually last week. Not a lot of people are talking about that, though, even in our space, which is a little disturbing. Sure, we'll talk about WormGPT to create sort of a fake phish that works really well, or AutoGPT to help maybe automate some hacking, or PentestGPT, things like that. But that's where a lot of it stops, and we all know the bad guys use this tech way faster and quicker than the good guys do.

My goal always when we talk about this topic is to really orient everybody to this world that look, the bad guys already know this stuff. The bad guys are already leveraging it. How are you, as the good guy, going to leverage it? So for us, as cyber entrepreneur types, we have to be looking at the ways they're going to be leveraging AI, machine learning, generatively and predictively, and then finding solutions that we can leverage AI to defeat that same AI. And it will be AI to AI, I have no doubt about it. Just a question of when. So I'm constantly looking for the right founding team and the right founding idea, the right founding technology that can make a big difference and stay ahead of the adversary.

You know this from my experience with Cylance. Cylance was a truly predictive and preventative play. We took a look at every single execution element that was about to get executed on by the CPU and we said, is this blob safe or is it unsafe? Is it a hack or is it normal? And if it was bad or a hack, we would just block it. We wouldn't allow the CPU to actually execute those instructions. That was truly predictive and preventative. Unfortunately, I feel like the industry has just lost its way completely. It is so focused on detect and respond. Everybody's thrown their hands up and given up on the idea that prevention is even possible, even though I've proven it already with Cylance, and I want to prove it again now in the code space, and ultimately now in the AI versus AI space with some sort of cool idea down the road.

Rahul Abhyankar [03:38] You mentioned Cylance and I want to touch upon that, but let's rewind the clock a little bit. Even before that, you were at Ernst and Young, advising a lot of large organizations and C-level executives about cybersecurity risks. That was a services kind of play. How did you transition from services around security to products around security?

Stuart McClure [04:02] Ernst and Young was very services oriented. We actually built our own products inside of Ernst and Young as well. It was something called E-Security Online or something like that. It was a threat-based sort of thing, and we helped build some of that. But I was honored and privileged to help be that trusted advisor to countless companies around the globe in not just detecting a malicious threat actor inside of their company, but also to be able to respond and then prevent that threat actor in the future. We did a lot of pen testing, which of course required us to automate a lot of the tools because there were no simple, free tools to use. We had to build our own, so that software development experience came in really handy.

Rahul Abhyankar [04:49] And did that lead to founding Foundstone?

Stuart McClure [04:53] Well, in part. I had started writing the book Hacking Exposed before I had joined Ernst and Young, probably a year or two before joining Ernst and Young, at InfoWorld when I was an analyst there and helper in the labs. So I started writing the book. At my tail end of my career at Ernst and Young, I published the book September of 1999. That book was all about finding the techniques of the bad guy, the tools and techniques and procedures and protocols of the bad guys, and then documenting it for the good guys to learn about, the admins.

I published that book, which was a pen tester's dream book, and everybody just soaked it all up. There wasn't a lot of material on that, especially in a really recipe-driven approach. Do step one, then two, then three. We made it very scientific and not as much of an art form. So it appealed to the masses, and it was a natural next step to say, well gosh, why couldn't we just automate this whole methodology into a tool that does it automatically for you and scans your networks, looking for the problems, helping you identify what patches to fix or what configurations to change, et cetera. That was the beginning of Foundstone.

Rahul Abhyankar [06:06] Foundstone was a vulnerability assessment, and one of the really clever things that I thought you guys did at Foundstone was defining that one single metric, that score that encapsulated all the aspects of risk and whether there were countermeasures in place or not. That became a very objective way of just assessing the health of an environment. How did you guys come up with that?

Stuart McClure [06:33] We knew that one of the real weaknesses of the entire cyber programs and all these companies was creating a priority system. What we did very well at Foundstone was create problems for you as the administrator. We told you everything about fix your environment, and it usually wasn't a handful of things, it was usually hundreds and thousands or hundreds of thousands of recommendations. Well, that creates a lot of noise, and it's very challenging to understand what's more important than another.

So we said, well look, what if we could come up with a score that represented not just the vulnerability, but the exposure that it provides, the threats that are out there today, the exploitability, like all of these elements, and we put it in one place for you to measure and then now manage. Long before CVSS scores and all this stuff came about, we had the FoundScore, and the FoundScore ended up being incredibly successful in getting defense teams to see the value of applying our technology over anything else that was out there at the time, like Qualys or Nessus or any of this other stuff.

Rahul Abhyankar [07:40] That score was a very effective way of changing the language that customers used in defining their environment. Have you seen something similar in other industries when we build products? What's your advice for people thinking about building products to identify that one metric that customers can start to embrace and use and change the language around how you talk about a problem and a solution?

Stuart McClure [08:13] This goes back to Cylance. We did a lot of things wrong, but we did a few things right. One of the things we did there is we really understood how to demonstrate two things. One was self-evident value. So when we did our demos, you knew immediately the value of our solution, the way that we did the demo. Then the second part is we created a sense of urgency. These two elements tend to be the most compelling elements in a demo for you as someone that's creating a solution. So you always want to try to orient into those two possible places.

Self-evident value is hard. Not everybody can find a way to present their solution in a real self-evident way. Self-evident meaning you don't need to be there to explain it. You can just literally sound is off and you present it in a demo. If you can do that, then you have an incredibly compelling solution. And then the icing on the cake is, can that demo, again no sound, create a sense of urgency for the customer? If it does, well man, you have the one-two punch, you've got everything you need there.

To me, that's really where a lot of the industry falls down. We can't clearly articulate the value in a self-evident way, and we can't create that sense of urgency. That FoundScore, that scoring system, a lot of folks give up on it because it's not an easy formula to come through on.

Rahul Abhyankar [09:48] That's very well said. The two things that I got out of that are self-evident value and how does that then create a sense of urgency for the customer. That's really powerful because a lot of demos that we end up seeing only scratch the surface on how does the product work, and what are the 10 clicks that you need to do to get from one screen to the other screen, and the dashboard of reports and widgets that you see. But that's not an effective product demo at all.

Stuart McClure [10:16] No, it's just feature vomit is what I call it.

Rahul Abhyankar [10:19] Let's drill down into Foundstone a little bit. What were your key learnings starting from zero dollars, building the company up, and then a successful exit with McAfee?

Stuart McClure [10:32] Foundstone was not what I would call sort of high growth. We were a five-year company before we got acquired. We were a services-only company for the first year and a half, maybe two years. We had extreme tension between the services arm and the product arm, and that's a whole other story for another day, probably. But that's typically what you find. If you have a services arm, they see their value as being people in the mix and making decisions for their customers and helping them along day to day, and the technology is a threat to that. So you really need to build a services team that is highly oriented to automation and technology, and if you can't do that, then you're going to have this friction. We often had that at Foundstone actually.

But the really interesting part for us was it took a lot longer to build the tech, your customer profile, in an MVP, something that's minimally viable. But once we did, once we got to the appliances, we put the software on the appliances and once we got that starting to ship on its own, that's where we really started to scale. A little-known fact about Foundstone is we were still over 50% services when we got acquired in terms of revenue. So you would maybe be safe to call us a services-dominant play, even though our tech was what was getting all the headlines and what was compelling a lot of customers. We still had a very healthy services practice too.

Rahul Abhyankar [12:00] Is that something that you would do again? Was that the playbook at Cylance? Because you started with services and then pivoted into product. How does that transition?

Stuart McClure [12:14] I learned my lessons. With Cylance, I knew what not to do. By that point as well, we had about a two, two and a half year run where we had zero product revenue. It was all services. But the big change that I had to make for Cylance, for the services to be successful, were the people. I had to hire specifically for a product-centered company. The individuals that were coming in to help build our services practice had to be really oriented to the technology as the ultimate value creation of the company, and not necessarily adding more bodies onto the services practice.

By doing that, I felt like we set ourselves up to have the highest chance of success of doing the teeter-totter. Because you always start, in a service-to-product play, with 100% service. Then eventually the product comes and supplants it. The moment this supplanting happens, services teams really get nervous, unless you've hired them in specifically to tell them that this is what's going to happen, and don't be afraid. Because what we're going to do is, at a certain point, we're going to make sure that we always grow with the product. So I always said it was like a 90-10. I wanted a 90-10 mix. So if we're doing 900 million in product revenue, I want to do 100 million in services. No doubt about it, stuff like that. And then we would just grow along with product.

Rahul Abhyankar [13:38] Both at Foundstone and Cylance, what was the growth curve in terms of hiring? Because you are in a startup phase, you are rapidly hiring, and how do you then make sure that you are hiring the right people for the right role at the right time? How did that shape your perspective around hiring?

Stuart McClure [13:58] I've got to say I still have PTSD from those years, especially at Cylance. Cylance, I believe, are still on record as the fastest growing cybersecurity company, at least by raw revenue dollars. We basically went from zero in product revenue to 100 million in ARR in two years and two months. In that timeframe, there was a seven-month period in there where we went from 200 employees to 800 employees. So in seven months, we hired 600 people. We sourced them, recruited them, onboarded them, enabled them, et cetera. How many mistakes do you think we made in that process?

Rahul Abhyankar [14:42] Just the scale of growth, you're bound to make some mistakes there just because you're not going to have 100% batting average.

Stuart McClure [14:52] 100% exactly. I don't mean to say it was a mistake in hiring this person or that person. That's not what I'm saying. What I'm saying is that individuals' talents, skills, were misplaced inside of the existing infrastructure. They were never going to be successful in certain cases, and we didn't have the insight, the quantitative measure, like you talked about, the FoundScore. We didn't have the FoundScore for human beings. We still don't to this day, and it's largely what's motivated me to start another company, but we'll get to that later maybe.

Ultimately, we as human beings are incredibly complex and complicated, but at the end of the day, we all boil down into incredibly pattern-driven behaviors that are highly predictable. The problem is you have to be able to measure as many of these characteristics as humanly possible to get the highest predictability out of that human machine. So that's what I'm really keen to do as I go forward in my career, is to quantify both traits and cognitive biases in a way that allows us to predict success, failure, or struggle in a specific position, in a specific company. I'm just passionate about it because of all the PTSD I had.

Rahul Abhyankar [16:11] I'd love to drill into this a little bit deeper. When you talked about creating that score when it comes to humans, can that objectivity be brought to defining and capturing the traits of a person? Because humans are very subjective in nature. We change our behavior and our way of thinking depending upon the context and the environment and the people that we are with. How can you codify people in that sense?

Stuart McClure [16:39] One of my best examples, I'm going to give a demonstration, and forgive me if I've done this to you already, Rahul, but maybe for the audience that haven't heard this one. I want you to ask me a question and I'm going to respond. I'm going to write down something here real quick just to prove to you that I'm not just agreeing with whatever you say. The question is, where did you grow up? So you just asked me that question.

Rahul Abhyankar [17:04] Okay, Stu, where did you grow up?

Stuart McClure [17:06] Well, I grew up mostly in Guam, about eight years of my childhood in Guam, and then Hawaii, and then Colorado Springs in particular. A lot of people will naturally just ask the question, well, was your family in the military? It's almost 99% of the time.

So simply by stating those three or four things, 99% of the time they'll ask, oh, was your family in the military? And look, my family was not in the military. That's the short answer. We all are very pattern-driven. We see the world based on our perception and our constructs, and that makes it very, very predictable. But the problem is we don't have the data to predict it, and it's the collection of the data which is the most important.

So to your question, which is how do you provide an objective measure onto human behavior? That's the trick. Once we can get to there, and we are close actually to be able to measure that. There's multiple ways to measure this. There's sort of the direct measure, which is ask you questions, self-report, self-assessment. Another way is to simply watch your behavior, how you type, what you type, what you do, how you do it, blah, blah, blah. You can sort of measure all of that. Third is to ask peers around you, people that know you well, well, what's Rahul like working with him? Which of course they have a subjective measure of your objective measure, et cetera. And then there's public-private data, well, what can we collect on Rahul that'll tell us things about him, social media, private data. You bring all those things together and you have an incredibly powerful way to determine and predict, well, how will Rahul act in this setting, in this project, with this individual?

I've had the pleasure of working with you at McAfee. I've seen you in dynamics, executive team and otherwise. I don't know you inside and out, but I can certainly probably predict nine out of 10 times how you're going to react to a certain event because I've gotten to know you. I'm not saying that I would be able to guess the exact answer and things that you would say, but how you might respond to this person saying these things or that kind of thing. That largely just comes from a lifetime of experience of working with a lot of different people and understanding human behavior.

If we can teach a computer, teach a system, to learn about the traits and biases—and this is another part of it, this cognitive bias part, I think, is really fascinating. We are all driven by biases day in and day out. They're invisible to us. We rarely think about them, much less quantifying them. And yet they drive us every day, invisibly and consciously, and we're bound to them. We're almost slaves to them, in fact. So we really have to start to make ourselves aware of these biases.

I tend to have what I call entrepreneur bias, which is that because I found success in a couple of three things, I think I can make anything successful. Well, that's just not true. But that's what I think more times than not, and that's incorrect bias. You should at a minimum be aware of it and ideally feed that into your decision-making system. But there's countless others. There's Dunning-Kruger effect, there's spotlight bias. There's like 200 documented cognitive biases that drive us unconsciously all the time. What if you can measure all that? What if you can measure the traits, 200-plus professional traits, that make you successful at work? That to me is the next generation of the workplace.

Rahul Abhyankar [20:40] When you think about hiring, a lot of times we are making decisions on hiring based upon very short interactions and a short amount of data. How do you get that hiring decision right?

Stuart McClure [20:57] So little time interviewing somebody, and you're pulling basically from your old experiences, which come from old biases that you've built over time. It largely boils down to, hey, Rahul, is he a good guy? Is he a good guy? All right, well, let's hire him. What does that mean, he's a good guy or she's a good guy? We have no way of quantifying that today, but it's absolutely possible. We have to put a lot of energy and effort into that quantification and measurability, and then track it over time. I think that the forefront really of machine learning, AI on the predictive side, is to apply it to human behavior. So that's where I think a lot of the space has to go.

We've all done countless—once you hire somebody, then you're like, why aren't they working out? We do a 360, we do a nine-box, we do the annual reviews, monthly. And then you're stuck with people that are really not fitting in, whether it be culturally or hard skills-based or whatever. They're just not working out and you need to take action, but you have no way to sort of explain it. You're just like, look, it's not working out, and I've got to tell you, we've got to let you go, or the position you're in just doesn't work, we've got to look into positioning, things like that. But there's no way to actually help people.

Imagine going to somebody that's really not working out and saying, look, it's not working out, but that's because you're here. I'm going to tell you what, you go across the street to our competitor and you will thrive. I can't say how many times at Cylance we would let somebody go because they weren't working out for us. They would go to a competitor, and they were rock stars. Rock stars. So was it that they weren't good, or was it that they weren't good at Cylance? They weren't good at Cylance. Because the way our culture was, the way our biases were aligned, the way our traits were aligned, it just didn't align well. There's nothing wrong with it, it's just different. You just want to find higher alignment.

Rahul Abhyankar [23:04] Jim Collins talks about some of that in his book Good to Great, saying you've got to have the right people in the right seat on the bus. That's what I think you're referring to, that you may not be in the right seat in the right bus at the right time.

Stuart McClure [23:18] That's exactly it. That's what you want to find, but you need a system to do it. You need a way of measuring that can be applied to everybody, that allows for us to almost plot you on a graph. So we know, well, where are you aligned, where's the overlap? Well, here's the company and here's you. These positions inside this company would be great for you, but not those other ones, not these ones here, so you don't want to put them in that spot. And it's not based on hard skills. It's not like, well, he's a good programmer, she's great with numbers. No, no, no, that's a whole other beast. It's really about, are we culturally aligning you to be successful inside of a project, inside of a team, inside of an organization? That, to me, is the future.

Rahul Abhyankar [24:05] You've started a few companies and you've built them up, and there is a vision of what kind of company you want to build. That goes back to a sense of culture that you talked about. How do you define culture? And when you're starting a company, how do you have a vision for what kind of company you want to build?

Stuart McClure [24:25] The vision has to start first, for sure. Then you build the culture around it, I believe. I've always set my visions to be very big. Like, to prevent 100% of cyber attacks. Most people look at that and say, yeah, you're just nuts, you're just crazy. There's no such thing as 100%, much less can you prevent the stuff. But I usually set them pretty big. Cylance was to prevent attacks on everything under the sun. You set a big, big vision so that people know that we have a lot of work to do and there's a lot of ground to make up.

But then you start to align to that vision culturally. For me, these bigger visions of protection, prevention, this is really what drives me, and I'm such a mission-driven leader that I always align to something that helps somebody else. That, to me, is the ultimate purpose in life is to not just help yourself, but once you get to a place where you can help yourself, is to help others. So helping others, protecting others that can't protect themselves, was always a big drive for me in the cybersecurity space.

Defining the culture that makes up that vision and mission, and then ensuring that you hire and align continuously to that culture. Now, just like you said, though, you can define the culture all you want, but I guarantee you, you have hundreds of cultures in your organization. Just because you, at the top, say this is how it is, the likelihood of 100% of that lower level getting aligned is very slim. It falls off. And then all of a sudden, you just have dozens and dozens of individual cultures. You could have a culture by individual pairings on a team. You could have your own culture.

It's this aligning of all of these cultures, it's the Holy Grail. That's what CEOs strive for their whole careers, is to align everybody to the same mission. And it's this alignment of all these cultures, and that's why we call this the ethos of we, the culture of we. We found a new term and a new company called Wethos that does exactly this. Quantifies human trait behaviors as well as cognitive biases to measure individuals in specific projects and specific teams and aligning all of the cultures in an organization. To me, if you can do that, you're getting the most out of every individual and every team, and you're getting the highest efficiency, effectiveness, and high performance that you can.

Rahul Abhyankar [26:54] That's very powerful. There have been efforts or tools that have been used, and I've certainly taken some of those tests, and many people have, MBTI and DISC, and they give you an assessment that you are an INFJ or ENTJ. There are probably tests and assessments that create some codification based upon certain criteria. So when you talk about Wethos, how is that different or how is that better from the existing ways of assessing an individual?

Stuart McClure [27:27] Let's talk about this. Traditionally, the way we've gone to quantify human behavior has been around what we call personalities. It's the -ality of the person, and the personalities tend to be oriented to you personally, not professionally. A lot of the traits that you look for in a professional person at work are very different than you would look for in person.

Let me give you my best example. Extraversion. Introversion, extroversion, that tends to be one of the MBTI things. In my youth leading teams, I used to think, well, where do we want extroverts? Well, we want extroverts in the sales position. You want them to be super social and want to go talk to people and make everybody laugh, be the center of attention, and stuff like that. I can tell you, nine out of 10 of the most successful reps that I've ever seen are not extroverts, they're introverts.

Absolutely. But do you really even care? At a certain point, you realize it doesn't really map. They might be fun to talk about at a party, like between you and I, oh yeah, I'm an introvert, you're an introvert, aren't we cool together. But it doesn't help leaders and managers and, quite frankly, teammates to engage with you any better. To be more effective and more high-performing, you need to have things like, are you an effective communicator? Are you comfortable with conflict? Can you easily self-regulate your thoughts, your emotions? How open are you to ideas and cultures and opinions? These elements are what define the success of a team in a professional work setting. That's where we really splinter off from this sort of personality matrix to this really professional matrix. Now there are some overlap, for sure, but there are distinctive cognitive biases in particular, and traits that are very, very different that we focus on.

Rahul Abhyankar [29:31] That's interesting. What are the attributes that you measure at Wethos when it comes to how a person appears professionally in the work environment?

Stuart McClure [29:41] At Wethos, we really do believe that there are some core traits that you have to measure very effectively. Once you can measure those highly effectively and predictably, then you can offshoot from those core. The four core that we've been able to quantify are what we call ideas, relational, action, and order. Ideas and relational are all about how people make decisions. Action and order is how people act on decisions, or can act on them, or create them, or execute on them.

So it's how we make decisions and how we execute on decisions, and it bifurcates into those four categories. We have a scale, a one to five scale, which ends up being more like a 10 scale because we do half increments, and we measure you on those elements.

Let's say we have a team and they are high in ideas, so they're a five on ideas. And they're a five on relational, and they're a five on action—in other words, they're not the ones performing the action, they're the ones planning the action, trying to get other people to take the actions, and stuff like this. You get them all in the same room, insanely predictable what's going to happen. They're going to have great conversations. Everybody's going to agree on how to solve a problem, and no one's going to take action on it. There is a unique diversity in that team. Somebody that's like a two in ideas and maybe a three in action or two in action—you need to have diversity in your team to be a fully functioning, executable machine. That's what we do.

We allow you to understand each individual, their natural styles. We call it the Wethos styles, natural styles at work, how you work best, and give you the opportunities to stretch obviously from your natural style. But by understanding each other's natural styles, we know now how to adjust our own behavior.

I've had plenty of examples where we've had a tough decision to make. I know the team that's going to make this decision, and I know that certain people—I have one in my group that's like a super high five, you can't get higher than a five on the relational side than this person. So when we make the decision that something has to happen, they're always going to be thinking about the individual's feelings and how the decision will impact everyone else's feelings. So I have to be very cognizant of that and help them through, go that extra mile so that they feel like that relational side is not being ignored or brushed under the rug, that they're not being minimized, that the value of that individual is not being minimized. That all being a part of it, now you have a unified decision-making platform.

Colin Powell is famous, I think you probably remember, he was famous for telling everybody in his cabinet, look, here's the thing, you can argue the idea all day long in this setting environment. The moment you leave this room, the idea is your idea, not my idea. It's your idea, and you need to own it just as I do. That, in large part, I believe, the highly successful teams and effective teams can get to that place. The way to get to that place quicker is by understanding all of the natural styles and the way that people think in terms of making decisions, acting on the decisions.

So that's where Wethos really comes into play. It almost reimagines how work can be, because you're not bound to a position or a title, you're not bound to a project. Just because you have the title of software engineer doesn't mean that you wouldn't be good at accounting. If you have a natural style of attention to detail as part of your coding practice, well, you'd probably be good at accounting because you really get into numbers, you get into facts and figures, and you let the day get defined by rules, et cetera. Then you're going to do well in any sort of job that values attention to detail. So moving away from the position and moving into the project. Does that make sense?

Rahul Abhyankar [34:06] That makes sense. When we talk about high-performing teams, there's so much written and talked about building high-performing teams. But what you're saying here is you're codifying what it means to be a high-performing team so that, based upon the individual behavioral assessment, based upon those four axes—recapping what you said, ideas, relational, action, and order, and the first two relate to how a decision is made and then the last two relate to how do you execute upon that decision—that really creates a much more objective view of building what it means to build a high-performing team, that you need to have the diversity of individuals on that team across those four different axes.

Stuart McClure [34:53] Yes. And you need the ability to subjectively define high-performing, because you might have a company where they believe, no, everybody's got to be the same, and that's the way we high-perform. Okay, fine. So you believe everybody needs to be a five on all scales? Then define it as that. Or all ones on all scales, or whatever the template might be that you believe. Now, we believe a fully diversified, cognitively diversified team is the most high-performing potential team. Because you have all of the ingredients. You have the ingredients to success. Now, whether or not you orchestrate those ingredients into a successful outcome is really based on execution. But we can give you the roadmap.

Rahul Abhyankar [35:39] When we think about talent development in an organization, a lot of focus is really based upon identifying the gaps in skills that people have and then giving them the opportunities to close those gaps or those weaknesses. But what you're talking about really goes to identifying the strengths that people have and putting them in positions to leverage those strengths in the right team for the right project.

Stuart McClure [36:07] Exactly. It's basically measuring the qualities of the individual. Whether strengths or weaknesses, is totally subjective. At Cylance, this was a weakness, but at this one, it was a strength, they loved it. It just totally depends. But it's really the qualities of the individual. So by measuring those qualities, now you can ultimately define the best successful team makeup for your organization or for your company. To me, that is the future of work. So that's where this sort of framework and structure really come into play, is being able to define it and then measure it over time and allow the organization to define success in their own way.

Rahul Abhyankar [36:53] Do you foresee a future where that Wethos style score that gets computed or identified with me as a professional worker—can I take that Wethos style score and take that from one company to another?

Stuart McClure [37:11] Yes, the answer is yes. Once you understand those elements of your professionality, you can now apply that to any other organization or, more importantly, team that is measuring in that same construct. So you can know, look, I'm not really working out well in this team because their definition of success does not align to my natural style, but this team over in this department inside the company does, and I think that I would really thrive in there. We have a now objectively measurable way to prove that. Or we say, look, there's nobody really inside the company where I'm going to fit, but the company across the street very much aligns to my natural styles, and I'm going to go work for them on these three projects, and worry less about the position and more about the project. That can apply across different geographies, across different sizes of companies. And then you can understand how it relates to everyone else on your team or your project.

Rahul Abhyankar [38:12] This is a new company that you've launched?

Stuart McClure [38:15] Yes, we've just launched it and we'll be going more global with the company, but we've now formalized it, and it's kicking off incredibly well.

Rahul Abhyankar [38:26] Very cool. Wish you all the success with that.

Stuart McClure [38:28] Thanks so much.

Rahul Abhyankar [38:30] Going back to those two exits, Foundstone getting acquired by McAfee, Cylance getting acquired by BlackBerry, going from a startup into a large company, how do you protect the hustle? What were your learnings and any advice that you can share on that?

Stuart McClure [38:46] Protect the hustle. I like the way you put that. That's hard, it's really hard. That leads me actually to a book I'm reading right now, which I think we could probably talk about, maybe argue about for quite some time. The book's called Burn the Boats by Matt Higgins. The whole premise behind it is the historical reference to burning the boats and how meaningful it is to success. If there's always a plan B, the path of least resistance is often pursued. If there's no plan B, the only way forward is through, then you're going to go through.

I do believe there is something very powerful about that. So when you go into a large company where there's always plan B, you're pretty set. Your paycheck does not depend on this week's performance, or next week, or the week after. Maybe in a year or two it might depend on it. But then how much hustle—hustle has to be innate in you. It's not a trait that can be generated. It's either got to be in you or not in you.

It makes it very challenging. The only way I've tried to do it, and you could say marginal success, I guess, fairly successful inside McAfee at least, was again, centering around that mission and making sure that you align the individuals that you're partnering with to that mission, that they believe the same way. If I had people on my team that really didn't care about protecting people and actually wanted to just hurt people, then it probably wouldn't be all that successful. But if I have people that are there because I'm waking up every day because I want to protect my mom, my grandmother, my father, my daughter, from getting hacked—man, there's a drive then that comes from here. Not here. As you know, fights are not won here, they're won here. Right through the heart. That, to me, is where mission comes into play. You can align that part of the individual to the outcome that you want and you have a powerful formula.

Rahul Abhyankar [40:51] You talked about mission so much and your inherent desire to help people who cannot help themselves. How did that get shaped? Was there any incidents growing up in Guam, Hawaii, Colorado, or throughout your life that shaped your perspective around people and helping people identify with a bigger mission?

Stuart McClure [41:11] Yeah, there was. When I was 19, I was on a commercial airlines flight that blew a hole inside the fuselage and sucked nine people out of the plane. I was supposed to be in one of the seats that left the plane, but I turned down the upgrade at the last second on the plane from Honolulu to New Zealand. 19 years old, the brain's still really forming. I really go back to that moment in time.

We ended up surviving, but really to this day don't know how. We don't know how that plane got back safely, given all the parameters it was working on. After we landed and after all the investigation occurred, we realized that it was 100% preventable. I just couldn't quite compute this part. I went through a near-death experience, probably should have died at the age of 20, and yet it was preventable. I just couldn't quite—how did we allow this to happen? Even to this day, I have a hard time even articulating how did this happen if it was preventable?

I understand, lightning bolt comes out of the sky and strikes you, fine. But this is all man-made stuff. Why can't we prevent this? It was 100% preventable. I walked away with such a deep-seated drive and passion for preventing and thereby protecting those that can't protect themselves in the cyber sphere and in the compute world. Most people can't protect themselves. They don't know the adversary and how they think and work and execute their attacks. So they're never going to be able to defend against them. My drive really does, I believe, come from that fateful night over Honolulu.

Rahul Abhyankar [42:58] Wow, that's such a deeply impactful experience and just shifts your complete life in a different direction.

Stuart McClure [43:08] It certainly did mine.

Rahul Abhyankar [43:10] Stu, I feel like we could go on and on and have this conversation, so enriching. Maybe one last question is, when you think about perspectives and things that shape the world, a lot of history—understanding history is also related to that. If you were to go back in time to a period and era in history, what would that be and why?

Stuart McClure [43:35] You know what it would be. Have you ever seen the movie Lucy? Lucy was a movie that came out, I want to say in like 2014. Who was the actress in that? Hold on a second, you will like this. Scarlett Johansson, Morgan Freeman. Incredibly, I thought the storyline was incredible. There's a scene in there where they go backwards in time. It goes from the current day all the way back, honestly, before the earth was formed, and somehow they pull this thing off. One of the phases is where I would probably go to, which is where the early evolution of man occurred, and we all decided that working together was better than working by ourselves.

There was an anthropologist that just recently, I want to say, sort of discovered the very first evidence of civilization. And what do you think that was, the telltale sign of that first? That's where I would want to be, by the way, that moment in time when this anthropologist discovered the first healed femur bone in a human being.

If you break your femur and you're allowed for it to heal, you have to have help. Otherwise, you're just—you know, some animals' meal. Two million years ago or something like this. This was the oldest on record healed femur in the history of anthropology. That's where I'd want to be, on that day, in that field somewhere, when that person broke their femur. That, to me, would be just absolutely fascinating. What was happening there? How did we go from all for one to one for all?

Rahul Abhyankar [45:23] Very fascinating. I think that connects the dots on our conversation. When you think about individuals and teams, and how do you create that structure, that high-performing team, and the awareness that by ourselves we are not going to be able to achieve as much as what we can do collectively. I think that all connects together. That's fascinating.

Stuart McClure [45:46] That's exactly it. There's no way you're going to be successful by yourself. You have to find the most effective way of communicating and working together with others on a mission together to achieve it in the most effective and efficient, high-performing way possible. The only way to do that is with something like Wethos.

Rahul Abhyankar [46:03] Beautiful. Thank you so much for taking the time. I really appreciated this. It was such a fascinating conversation.

Stuart McClure [46:10] I always love catching up with you, buddy. Thanks so much, man. Take care.