Veracode CEO Bob Brennan on the Future of Software Security

provide a rich set of information about the state of applications out there, and we’re interested in having partnerships with them. Some of them, we will choose to build it ourselves, because we didn’t think they did a great job. Others we will choose to partner with them because we think they did a great job, but it’s not important to own it. And others we’ll buy. So inorganic growth will play a role, but all of the growth I’m speaking about for 2012 and 2013 is organic.

X: Are you looking to hire a lot more people?

BB: Here’s the thing that I’m mindful of. We hired over 100 people this past year. I’m coming up on my one-year anniversary. I don’t consider myself fully ramped. I’m pretty ramped, but most of those 100 are less ramped than me. So there’s a lot of productivity in our system that has yet to be realized. That’s not necessarily intuitive to the people we’re holding to very high standards for performance. I can say we’d like to hire between 50 and 80 during 2013.

X: What about your IPO prospects down the road?

BB: The IPO, if it marks anything, it marks the end of the beginning. I have a low badge number, and I’ve only been here a year. We’re still in the very early stages of this company, even if you’ve been here six years. When I talk about these big customers, they’re just getting going on this. With an IPO, you’re selling 15 to 25 percent of your company. So it’s very much the beginning. I don’t see it as an end state. I see it as a way to attract capital so that you can continue to grow as fast as possible.

It should be a byproduct of the business we’re building. We’re trying to build a sustainable Veracode. If you think about the elements of a sustainable company: you need spectacular market conditions, check. You need a business model that is predictable and recurring, check. You need good team DNA, check. You need leverage in your model, and our third-party program provides an obvious point of leverage. And you need a culture that responds quickly to changing conditions. That’s evolving but I feel good about it.

I worry if I seek out the markets. Let the markets pull you in, don’t try to push your way in.

X: You mentioned culture. Can you talk about Veracode’s culture, and what you have brought to it over the past year?

BB: It is a culture of competence. People really understand their role and the domain. The best application security experts in the world work here. And some of the best general security experts in the world work here. I believe you can affect the culture at the margin, but you cannot change the culture. One of the reasons I wanted to join the team was that there is a deep-seated belief that we do meaningful work, that we are making the technology industry better.

Our culture may have been described a year ago as a culture of expertise. We’ve been successful in bringing in more general business athleticism, and have that mix with the expertise. I’d say a culture of competence is emerging from one of expertise.

X: Is it closer to Iron Mountain’s culture or Cisco’s?

BB: Neither. Iron Mountain’s culture is one of operational excellence. If you have an appendicitis attack, we need to have your medical records in front of your doctor as you get there. Cisco’s culture was one of being able to maintain customer intimacy as it grew torridly. But I don’t think you pick your culture. You have to work on the margin of those things. I don’t think in terms of another company. And I love both those companies. But we’re not them.

X: What about the transition from a small startup to a mid-sized young company? How’s that going?

BB: There’s an issue of kinetic energy to process. We need to develop a Veracode way of doing things. There’s a Veracode way of hiring, on-boarding, responding to customers, dealing with conflict, setting expectations. If you just pivot the company from startup qualities to the right [big company], you basically get a really small big company. And that’s a nightmare. You need to keep everything on the left [startup qualities] while we go to a Veracode way of doing things.

The company was very conservative with how it spent money. We grew 76 percent last year going through a lot of

Author: Gregory T. Huang

Greg is a veteran journalist who has covered a wide range of science, technology, and business. As former editor in chief, he overaw daily news, features, and events across Xconomy's national network. Before joining Xconomy, he was a features editor at New Scientist magazine, where he edited and wrote articles on physics, technology, and neuroscience. Previously he was senior writer at Technology Review, where he reported on emerging technologies, R&D, and advances in computing, robotics, and applied physics. His writing has also appeared in Wired, Nature, and The Atlantic Monthly’s website. He was named a New York Times professional fellow in 2003. Greg is the co-author of Guanxi (Simon & Schuster, 2006), about Microsoft in China and the global competition for talent and technology. Before becoming a journalist, he did research at MIT’s Artificial Intelligence Lab. He has published 20 papers in scientific journals and conferences and spoken on innovation at Adobe, Amazon, eBay, Google, HP, Microsoft, Yahoo, and other organizations. He has a Master’s and Ph.D. in electrical engineering and computer science from MIT, and a B.S. in electrical engineering from the University of Illinois, Urbana-Champaign.