Trust Me, It Takes a Village

At my very core, I’m really just a geek.

A computer-building, Neuromancer-reading, software writing, hardware hacking, hopelessly passionate geek. That’s been true since I took my family’s TV apart as a kid. My dad, always a sweet and patient man, just asked if I could put it back together again and seemed glad (and relieved) when I managed to do just that.

I’ve always had a natural curiosity in how big, complex systems work. That curiosity really started everything for me, and in a lot of ways, it’s what has propelled me to where I am today.

My journey and career are largely associated with one technology, but my story — my success — is really about people.

When I first began working on Snort, it was truly a labor of love. There were only a few big known names in the cybersecurity field, and I knew if I wanted to build up my reputation, I needed to create something impactful.  

when I had a product I felt good about and was proud of… I gave it away for free.

I spent a lot of very late nights toiling away in a spare bedroom at my house as I dreamt up and built this new software. The room had computer parts scattered everywhere and was generally a mess, but there was no place else I wanted to be. After making whatever progress I could, I’d collapse in my bed for an hour or two, then head off to my day job before repeating the process all over again.

Finally, when I had a product I felt good about and was proud of… I gave it away for free.

The idea of open source was still relatively new and primitive — this concept that software should be created for communities rather than corporations. Having read different geek manifestos and stuff like Eric Raymond’s The Cathedral & the Bazaar, I found myself drawn to it all. And, especially in that early phase, it wasn’t about making a quick buck.

What open source provided that was crucial to me was validation. All I wanted was to see if what I had created was worthwhile to anybody. At that point the dream for me was having a small collection of users who believed in Snort who I could point to them as an example of why I should be taken seriously in this field.

What ended up happening was pretty far beyond my wildest dreams.

I wasn’t over the moon about the bad release, but the fact that people cared that there was a bad release. That was awesome.

When I released my product out into the open-source world, it became this living, breathing, evolving entity. I became addicted to the feedback I got from users, all the little tweaks I could implement to make Snort better.

I felt like I might be onto something, but I truly didn’t understand what I had built until I did a bad release.

I would always do my own quality assurance testing before sending out an update, and one night — for one reason or another — I happened to skimp on it. I went to bed and when I woke up the next morning my inbox was flood. I had emails upon emails from people telling me about the different ways the release was broken. I decided to create a mailing list so the community could get on the same page for bug fixes and before I knew it, thousands of people had joined.

I was over the moon. Well, I wasn’t over the moon about the bad release, but the fact that people cared that there was a bad release. That was awesome. People cared about something I had made.

In a little less than two years, Snort went from its first lines of code to being the most popular intrusion detection software in the world. And I perhaps most proud of the thriving community of users it had attracted, contributors like Erek Adams and Fyodor Yarochkin, who helped shape both me and my project.

Just after Snort celebrated its second birthday I decided to do something that most people didn’t think was possible: I started a product company around my open-source project.

I knew I had developed an incredibly popular, free security technology and I thought I had a business model that would work to get people to want to pay for it. As my team at Sourcefire and I developed enterprise-grade offerings around it, I felt sure that we could produce very competitive products and build stuff that was fundamentally better than our competitors.

But what I learned quickly was that the best products don’t always win. In the world of enterprise security companies, many times it’s the best go-to-market strategy in addition to solid products that win. And on that front, I needed help — and that was going to require a lot of money.

If you’re trying to do something new or ambitious, there’s plenty of people willing to tell you why it won’t work. I never let those people discourage me

Early on, a lot of VC’s didn’t see how we could make money with Snort. After all, how do you make money selling something that’s free? For this to work, I had to rely on a different kind of business model — a freemium model relying on offering a free core product with enterprise-grade infrastructure built on top of it — and a lot of investors told me straight up I would never make a dime trying that approach.

Fortunately, and this is something that’s helped me quite a bit in my career, I’m pretty good at kind of dismissing doubters.

If you’re trying to do something new or ambitious, there’s plenty of people willing to tell you why it won’t work. I never let those people discourage me, I just figured their preexisting experiences and biases made what I was doing seem deeply foreign to them. In the long run, if you want to be successful when you’re doing something really new it’s more important to find people who know things that you don’t and are willing to put their belief in what you’re trying to do. Those are the people you actually need in order to turn a bunch of “crazy” ideas into a business.

One of those people for me early on was my first angel investor Stephen Northcutt.

As the CEO at the SANS Institute, Stephen truly was an expert in this field, and the fact that he saw potential in my company meant more to me than anyone else’s doubt ever could. He gave me $100,000 out of his own pocket to pursue my dream, and with his investment, I ran the entire company for ten months on a shoestring budget. But it was during that ten months that I learned so many crucial lessons that ended up propelling Sourcefire forward.

I was feeling pretty good about being on the right track with my ideas but suddenly I found myself as a technologist who was going to need a lot of help from a variety of people if this thing was going to be successful. I needed people who knew a lot more about the business of doing business than I did.

I needed someone like Paul Volkman.

My journey and career are largely associated with one technology, but my story — my success — is really about people.

Paul was the first actual sales guy I ever interviewed to work for Sourcefire. I still think back fondly about the first time we met was at my office.

(By office, I mean kitchen table — for the first year we ran the entire company from my home.)

So there I was, bouncing my six-month-old daughter on my knee as I sat across from this guy who could have found a job at plenty of other more established businesses. And even though he had plenty of reasons to dismiss my whole operation as having no money, no clue, and no hope — and honestly, in that situation, who could have blamed him? — instead Paul did something pretty incredible: He believed in me.

Not only that, he ended up telling all of his friends from his previous company about why they should believe in me too. And it was those people who Paul reached out to that would form what became the core executive team of Sourcefire — the CEO Wayne Jackson, COO Tom McDonough, and four people (three Johns and Allen) who formed the core of our sales leadership team and stuck with the company through its entire run.

Once seasoned pros and institutional money joined the party, things changed a lot for me.

It was that injection of talent and money that afforded me the opportunity to focus on the things I was good at, rather than spending so much time worrying about the things I wasn’t. Being able to leverage the expertise of the people who joined the company alongside the functional security experts we had on board is what really turned my idea into a company.

That’s truly why I believe my story is one about people. Yes, I had a product I greatly believed in, but without all these different individuals from various backgrounds coming together with one purpose, it wouldn’t have mattered.

And that’s why I’m so grateful to all of them, and always will be.

Fast forward 16 years and it’s almost overwhelming to reflect on how much has changed. Sourcefire’s continued growth and eventual acquisition by Cisco resulted in me being exposed to so many different people who left an indelible mark on me both professionally and personally.  As I look forward, there is no greater mission than to continue to enable people to protect themselves from security threats in this constantly changing and increasingly digital world. I am also reminded that there is also no greater responsibility.  In the security business, nobody pays us to think about rainbows and unicorns.

I have learned so much from others throughout my career — and specifically from mentors who have been there and done that. I know as well as anyone that creating something new is a difficult and at times lonely road, so I’m eager to work with Decibel which will give me the opportunity to be the kind of mentor that I sought out during my early years in this industry.

I am still really just a geek who is fascinated by complex systems, but I’m also now someone that wants to give back to help other founders.  

Marty Roesch, Founder of Sourcefire

‍