Panel: So You Want to Be a Founder?

Panel: So You Want to Be a Founder?

Speakers: Brian McHenry (Moderator), Justin Shattuck, Wesley Hales, Jonathan DiVincenzo (JD), Lee Weiner

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=0K81-1huQDw

Overview

The "So You Want to Be a Founder?" panel at BSides NYC offered a candid, no-holds-barred look into the exhilarating yet often brutal world of startup entrepreneurship, particularly within the cybersecurity domain. Moderated by Brian McHenry, co-founder of BSidesNYC and a veteran of corporate development at F5, the discussion featured an impressive lineup of founders and startup leaders: Justin Shattuck (CSO, Resilience; founder, Loryka), Wesley Hales (founder, LeakSignal; ex-Shape Security/F5), Jonathan DiVincenzo (JD) (founder, Impart Security; ex-Signal Sciences/Fastly), and Lee Weiner (CEO, TrojAI; ex-Rapid7). This diverse group brought a wealth of experience, sharing invaluable lessons learned from both resounding successes and significant failures.

The core of the panel revolved around demystifying the entrepreneurial journey, moving beyond the glamorous narratives of unicorn valuations to expose the gritty realities of building a company from the ground up. The speakers delved into the personal sacrifices, the relentless pursuit of funding, the art of team building, and the psychological toll of leading a nascent venture. For anyone contemplating the leap into entrepreneurship, especially in the fast-paced and competitive cybersecurity landscape, this talk served as a crucial reality check and a practical guide, emphasizing that passion, resilience, and a deep understanding of market problems are far more critical than a flawless business plan or a desire for quick riches.

The relevance of this panel to the BSides NYC audience, largely composed of cybersecurity professionals, cannot be overstated. The industry is a hotbed of innovation, constantly demanding new solutions to evolving threats. Many attendees likely harbor ideas for new tools, services, or platforms. This panel provided a direct conduit to the experiences of those who have successfully navigated this path, offering actionable insights into transforming an idea into a viable business. It underscored that while the technical acumen to identify and solve security problems is essential, the business acumen—understanding market needs, securing investment, and building a cohesive team—is equally vital for a startup's survival and growth.

Background

▶ Watch: Panel and moderator introduction, co-founding BSidesNYC (0:00)

The cybersecurity sector is characterized by rapid technological advancement and an ever-present arms race between attackers and defenders. This dynamic environment naturally fosters a vibrant startup ecosystem, where new companies emerge to address specific vulnerabilities, enhance existing defenses, or introduce disruptive security paradigms. However, the path from a brilliant idea to a successful, sustainable company is fraught with challenges, many of which are not covered in traditional business education or technical training. This panel aimed to bridge that gap by sharing lived experiences from seasoned entrepreneurs and startup executives.

The panelists brought a rich tapestry of prior work and entrepreneurial journeys:

• Justin Shattuck bootstrapped his intelligence company, Loryka, which was successfully acquired in 2018. His experience highlights the lean, self-funded approach to growth.
• Wesley Hales has a 20-year background spanning software engineering and cybersecurity. He was an early engineer at Shape Security, a bot protection startup that achieved a significant exit, being acquired by F5 for a billion dollars in 2020. He also candidly shared experiences from other venture-backed startups that "imploded," providing a balanced view of success and failure. He then founded LeakSignal in 2022.
• Jonathan DiVincenzo (JD), also a software engineer by trade, witnessed successful acquisitions at Edgecast (by Verizon) and Signal Sciences (a next-gen WAF acquired by Fastly). These experiences motivated him to found Impart Security, leveraging insights gained from working within successful, acquired startups.
• Lee Weiner began his cybersecurity career in identity management in 1998, seeing multiple companies through acquisitions (e.g., IAMlogic by Symantec). His extensive tenure at Rapid7, where he led product engineering and M&A, provided deep insights into both building and acquiring technology companies. He now serves as CEO of TrojAI, an early-stage company focused on AI security.
• Brian McHenry, beyond co-founding BSidesNYC, spent 16 years at F5, with a significant portion dedicated to corporate development, evaluating startups as potential acquisition targets. This perspective from the "other side of the fence" offered crucial context on what larger companies look for in emerging ventures.

The fundamental "problem" addressed by the panel is the significant knowledge gap faced by aspiring founders. Many possess technical expertise or a novel idea but lack practical understanding of the entrepreneurial lifecycle: securing funding (bootstrapping vs. angel investment vs. venture capital), building a resilient founding team, navigating market validation, and enduring the immense personal and professional pressures. The panelists’ collective experiences served as a practical guide, offering insights into these critical areas that are often learned only through trial and error—a costly approach in the high-stakes world of startups. They emphasized that while a strong technical solution is a prerequisite, it is merely the starting point; the real journey involves mastering the art and science of business creation.

Key Findings

▶ Watch: Justin Shattuck on founding and selling bootstrapped Loryka (1:13)

The panel distilled years of collective entrepreneurial experience into several critical findings for aspiring founders:

• The Overwhelming Weight of Responsibility: Lee Weiner articulated a profound truth: founders bear an immense, often indescribable, weight. This responsibility extends beyond merely developing a product; it encompasses the financial well-being of employees, the satisfaction of customers, and the very survival of the "baby" they are creating. Making payroll isn't always easy, and this constant pressure shapes every decision.
• Manufacturing Interest and Embracing Rejection in Fundraising: JD highlighted that securing venture capital is a process of "manufacturing interest." Investors are constantly pitched, and initial rejections or forgetfulness are common. Success often comes when external validation or market buzz makes an idea "cool," prompting previously dismissive investors to suddenly express interest. This necessitates a super thick skin and the ability to not take "no" personally, wiping it off and moving on quickly. Wesley Hales added that for him, it wasn't about finding the "right" investor, but rather those who genuinely "believed in the vision and the idea" amidst numerous rejections.
• The Indispensable "Why": The panelists strongly cautioned against founding a company solely for financial gain. Lee Weiner emphasized that if the motivation isn't a deep-seated passion for solving a problem that keeps you up at 3 AM, the journey will likely be unsustainable. Justin Shattuck added the importance of distinguishing between market "needs" versus "wants," ensuring the problem being solved is truly critical. JD echoed this, stating that one must "really want to do it" and be prepared to put "parts of your life on hold for 5 to 7 to 10 years."
• Experience as the Ultimate Educator: Wesley Hales and JD both advocated for gaining experience at early-stage startups (e.g., Series A or Series B companies) before attempting to found one. Working as an individual contributor, then transitioning to roles like sales or customer success, provides a holistic understanding of how a startup operates, how products are implemented, and how customer relationships are managed. This exposure to the ecosystem of investors (like Kleiner Perkins and Sequoia) and the dynamics of a growing company is invaluable.
• Critical Qualities for Co-founders and Early Hires: JD stressed that co-founders must share the same intense commitment and desire to "win it," understanding that weekends may cease to exist. Lee Weiner added that early team members must be "super comfortable with uncertainty, and ambiguity, and change." He advises hiring for experience and noting that individuals from very large, structured corporations often struggle in the chaotic environment of a five-person startup. Wesley Hales emphasized finding co-founders "smarter than you," especially a flexible and resilient first engineer for the core product. He also advised founders to "hire too fast" and "fire too slow," a common and costly mistake.
• The Difficulty of Acquiring First Users: JD described getting the first 0 to 1 users as "the hardest thing we'd ever done," even with an extensive network. It involves relentless cold outreach, leveraging every personal and co-founder connection, and meticulously refining the value proposition. Lee Weiner warned against deviating from the ideal customer profile (ICP), noting that signing on early customers who don't fit the target can lead to significant strategic missteps. Wesley Hales found "magic" in hearing large enterprises express a pre-existing need for what LeakSignal was building, confirming market validation.
• Problem First, Tech Stack Second: When asked about selecting an initial tech stack, the panelists converged on a fundamental principle: focus on the business problem you are solving, then choose the fastest way to build the solution. Investors, particularly at early stages, are primarily interested in the problem and your proposed solution, not the specific underlying technology stack (e.g., IIS or specific AI frameworks). Justin Shattuck advised treating open-source projects (like GitHub repositories) as products, ensuring well-tagged and searchable readme files to aid discovery.

Technical Deep Dive

▶ Watch: Wesley Hales on Shape Security's billion-dollar acquisition (2:03)

While the "So You Want to Be a Founder?" panel did not delve into the technical intricacies of specific software, protocols, or architectures in the traditional sense of a security conference talk, it offered a profound technical deep dive into the process of building technology companies. The "technical" aspect here lies in the strategic, operational, and intellectual rigor required to conceive, develop, and scale a technical product in a highly specialized field like cybersecurity.

The panelists themselves represent diverse technical domains within cybersecurity:

• Shape Security, where Wesley Hales was an early engineer, specialized in bot protection, a complex area involving real-time analysis of web traffic, behavioral analytics, and machine learning to differentiate legitimate user activity from automated attacks. This requires sophisticated understanding of network protocols, web application architectures, and adversarial techniques.
• Signal Sciences, where JD gained experience, focused on next-gen Web Application Firewalls (WAFs). This technology involves deep packet inspection, anomaly detection, and policy enforcement at the application layer to protect against common web vulnerabilities (e.g., SQL injection, cross-site scripting, API abuse). The technical challenge here is to provide comprehensive protection with minimal false positives and low latency, often integrating directly into modern CI/CD pipelines.
• Loryka, Justin Shattuck's bootstrapped company, was an intelligence company. This implies the collection, analysis, and dissemination of threat intelligence, which relies on robust data pipelines, sophisticated data science, and potentially offensive security capabilities to gather insights.
• TrojAI, Lee Weiner's current venture, is focused on AI security. This is an emerging and highly technical field addressing vulnerabilities in machine learning models, such as adversarial attacks (data poisoning, model evasion) and privacy concerns. Developing solutions in this space requires deep expertise in AI/ML, cryptography, and robust software engineering.
• Resilience, where Justin Shattuck is CSO, operates in cyber insurance. While seemingly a business-focused domain, the underlying platforms for assessing risk, underwriting policies, and managing claims often involve advanced data analytics, security posture assessment tools, and integrations with various security technologies.

The "technical deep dive" of this panel, therefore, was not about how these technologies work, but how one builds a company to create such technologies. Key technical considerations from an entrepreneurial perspective included:

• Problem-First Approach: The emphasis on identifying a genuine business problem before coding a solution is a fundamental principle of effective product development in any technical field. Building a technically brilliant solution to a non-existent problem is a common startup pitfall.
• Prototyping and Iteration: Wesley Hales mentioned the value of creating "small projects" (e.g., GitHub projects) to test ideas and get feedback. This iterative approach, common in agile software development, is critical for early-stage startups to validate their technical solutions with minimal investment.
• Flexibility in Tech Stack: The advice to choose the "fastest way" to solve a problem implies a pragmatic approach to technology selection, prioritizing speed to market and validation over theoretical elegance. This might mean leveraging existing cloud services, open-source components, or readily available frameworks rather than building everything from scratch.
• Community Engagement: Leveraging platforms like GitHub and Slack channels related to specific technologies (e.g., Cloud Native Computing Foundation (CNCF)) for feedback on early projects is a technical strategy for market validation and community building.
• The "Uncapped Optimism" of Engineers: While not strictly technical, the panelists highlighted the need for engineers who are not just skilled but also possess immense resilience and an ability to thrive in ambiguous, rapidly changing technical environments. This is a critical "technical" hiring consideration for early-stage ventures.

In essence, the panel provided a blueprint for the "technical founder"—someone who translates deep technical understanding into a viable business, navigating the unique challenges of developing and commercializing cutting-edge solutions in cybersecurity.

Demo / Proof of Concept

▶ Watch: JD DiVincenzo's journey through multiple successful startup acquisitions (2:55)

This panel discussion was an interactive session focused on advice and shared experiences, rather than a presentation of a specific product or technology. Therefore, there was no demo or proof of concept demonstrated during the talk. The content centered entirely on the strategic, financial, and human aspects of founding and scaling a company.

Defensive Implications

▶ Watch: Lee Weiner on the profound weight of founding responsibility (5:06)

While "So You Want to Be a Founder?" is not a technical security talk in the traditional sense, its insights carry significant defensive implications for both aspiring entrepreneurs and the broader cybersecurity ecosystem. These implications revolve around building resilient companies that can effectively contribute to global security, and safeguarding individual founders from common pitfalls.

For aspiring founders, the advice offered by the panel serves as a critical defensive playbook against the high mortality rate of startups:

• Defense Against Building Unwanted Products: The emphasis on understanding genuine market "needs" versus "wants" and rigorously validating ideas with potential customers (the ICP) is a defense against wasting time and capital on solutions nobody will buy. Justin Shattuck's point about observing "pains" and "challenges" people describe with existing tools is a proactive defense strategy for identifying true market gaps.
• Defense Against Financial Mismanagement: The distinction between bootstrapping (making cash "go as far as you can") and venture capital (managing external expectations and "dry powder") provides a defensive framework for financial strategy. Wesley Hales's advice on understanding an investor's fund health and asking challenging questions about their capabilities acts as a defense against partnering with misaligned or unstable investors. JD's warning against hiring a VP of marketing too early is a defense against premature scaling and unnecessary burn.
• Defense Against Team Dysfunction and Burnout: The panel highlighted the critical importance of selecting co-founders and early hires who are passionate, comfortable with ambiguity and change, and possess resilience and uncapped optimism. This is a defense against internal strife, high turnover, and the breakdown of team morale under pressure. Lee Weiner's blunt advice to "fire too slow" is a defense against prolonging detrimental team dynamics.
• Defense Against Isolation and Ignorance: The recommendation to actively engage with the cybersecurity community, leverage angel investors for advice and connections, and talk to other founders (e.g., through Slack groups) is a defense against operating in a vacuum. This network provides a source of mentorship, feedback, and potential talent, mitigating risks associated with inexperience.
• Defense Against Ego-Driven Decisions: Justin Shattuck noted there's "not a lot of room for ego" in startups. The humility to seek feedback, admit what you don't know, and accept rejection is a defense against self-sabotage and tunnel vision.

For the broader cybersecurity industry, the panel's message implicitly supports the continuous defense against evolving threats:

• Fostering Innovation: By educating potential founders on the realities and strategies for startup success, the panel encourages the creation of new, innovative security companies. These companies are vital for developing the next generation of defensive tools and approaches, strengthening the overall security posture against sophisticated adversaries.
• Informed Investment and Acquisition: Brian McHenry's perspective from F5's corporate development team underscores how larger entities evaluate startups. Understanding this process allows founders to better position their companies for potential investment or acquisition, ensuring that promising defensive technologies can be scaled and integrated into broader solutions.
• Community Resilience: The collaborative spirit emphasized by the panelists (e.g., "most folks are actually super friendly in cyber security") reinforces the idea that collective knowledge sharing and mutual support are crucial for the health and innovation of the entire defensive ecosystem.

In essence, the defensive implications of this talk are about building robust, sustainable, and impactful cybersecurity companies. By understanding and implementing the strategies discussed, founders can "defend" their ventures against the myriad challenges of the startup world, ultimately contributing to a stronger and more innovative defense landscape for everyone.

Key Takeaways

• Entrepreneurship Demands Utmost Commitment and Passion: Founding a company is a long-term commitment (5-10+ years) requiring significant personal sacrifices. Success is driven by an unwavering passion for solving a specific, real-world problem, not primarily by the desire for financial gain.
• Master the Art of Fundraising and Embrace Rejection: Securing funding involves actively "manufacturing interest" and facing constant "no's." Founders must develop thick skin, learn from rejection, and understand the nuances of angel vs. venture capital funding, including questioning investors about their "dry powder" and fund health.
• Gain Practical Experience and Build a Strong Network: Work at early-stage startups (Series A/B) to learn the full spectrum of company operations, from engineering to sales and customer success. Leverage industry events like BSidesNYC and professional networks for mentorship, connections, and early feedback.
• Strategic Team Building is Paramount: Co-founders and early hires must share the founder's passion and commitment, be comfortable with uncertainty, ambiguity, and change, and be willing to wear "multiple hats." Prioritize hiring slowly for the right cultural and skill fit, and address underperformance decisively.
• Validate Ideas Relentlessly and Prioritize the Problem: Focus on solving a genuine market "need" rather than a "want." Get early customer feedback through cold outreach, leveraging networks, and even offering free access. When building, prioritize the business problem and choose the fastest way to a solution, as the specific tech stack is less critical to early investors than the problem being solved.
• Maintain Resilience and Humility: The startup journey is full of "ups and downs." Resilience and "uncapped optimism" are essential. Avoid ego-driven decisions, actively seek diverse feedback, and be prepared to iterate and adjust your vision based on market realities.

About the Speaker(s)

• Brian McHenry (Moderator): A co-founder of BSidesNYC, Brian brings a dual perspective to the startup world. He spent 16 years at F5, with his last six years dedicated to the company's corporate development team, where he was responsible for evaluating startups as potential acquisition targets. This experience provided him with unique insights into what larger organizations seek in emerging companies.
• Justin Shattuck: Currently the Chief Security Officer (CSO) of Resilience, a cyber insurance company, Justin previously founded and successfully sold his own intelligence company, Loryka, in 2018. His entrepreneurial journey with Loryka was bootstrapped, offering a valuable perspective on building a company without external venture capital.
• Wesley Hales: The founder of LeakSignal, which he started in 2022, Wesley has approximately 20 years of experience as a software engineer and cybersecurity professional. He was an early software engineer at Shape Security, a bot protection startup that was acquired by F5 for $1 billion in 2020. His background includes experience with both highly successful, venture-backed startups and those that did not succeed.
• Jonathan DiVincenzo (JD): Founder of Impart Security, based in San Francisco. JD's career as a software engineer included stints at Edgecast, which was acquired by Verizon, and Signal Sciences, a next-gen WAF company that was acquired by Fastly. These experiences provided him with a clear view of successful startup growth and exit strategies before he embarked on his own founding journey.
• Lee Weiner: The CEO of TrojAI, an early-stage startup focused on AI security. Lee's extensive cybersecurity career began in 1998, working in identity management software. He has been part of multiple companies that were acquired, including IAMlogic (by Symantec). Prior to TrojAI, he spent 11 years at Rapid7, where he held significant leadership roles overseeing product engineering and Mergers & Acquisitions (M&A).