Marty Roesch is the founder and CEO of Sourcefire, one of the very first commercial open source companies, that was acquired by Cisco in 2013 for $2.7 billion. On today’s episode, Jon Sakoda speaks with Marty Roesch on his journey to CEO, including how laser tag became his foray into cybersecurity and why he considers himself a “particularly good benevolent dictator”.
Marty Roesch is the founder and CEO of Sourcefire, one of the very first commercial open source companies, that was acquired by Cisco in 2013 for $2.7 billion. On today’s episode, Jon Sakoda speaks with Marty Roesch on his journey to CEO, including how laser tag became his foray into cybersecurity and why he considers himself a “particularly good benevolent dictator”.
Follow Jon Sakoda https://twitter.com/jonsakoda
Follow Marty Roesch https://twitter.com/mroesch
Follow Decibel https://twitter.com/DecibelVC
MARTY ROESCH: And I kind of—at that moment, I was like, if it's worth that much to you, it's probably worth a lot more. So, that's the moment that I said, I'm going to start my own company around Snort, and I'm going to go build a business model that's going to get people to want to pay for something that's free. That was the moment.
JON SAKODA: Welcome to the Decibel Podcast, the show where we bring founders together to talk about the personal journeys, the highs and lows, and the lessons learned along the way. I am so excited today to welcome my friend, Marty Roesch, the founder and CEO of Sourcefire. Marty created one of the very first commercial open source companies. I will say that Sourcefire eventually became a public company, and then it was successfully acquired by Cisco. Marty has been a founder advisor here at Decibel and a great friend to us.
So, without any further ado, Marty, say hi to everybody.
MARTY ROESCH: Hi, everyone. Thanks for having me on the podcast today, Jon. I appreciate it. It's kind of fun to talk about the old days and how things kind of came together, when doing this sort of thing was very far afield from normal.
JON SAKODA: Yeah. Let's start at the very beginning with your personal journey. So, maybe let's start with even where you grew up, and then eventually what led you to start an open source project, and then an open source company.
MARTY ROESCH: Well, that's the real way back machine. So, I got going on computers when I was very young. I think the first computer I had access to— and I grew up in Western New York. My dad was a school teacher. And through the school, I got my hands on an Apple II, way back in the day. And one of the people who kind of showed it to me introduced me to Basic right away. And I was probably somewhere between nine and 10 years old. And taught me how to write a calculator in Basic. So, I started messing around with that. And basically, I just kind of dabbled in computers, and I thought they were interesting and fun. And it was cool that you could kind of get this machine to do whatever you wanted it to do if you kind of knew the right things to poke.
JON SAKODA: I remember you once telling me a story about how you were somewhat of a hacker growing up. Do you remember this story?
MARTY ROESCH: Yes, I do. Me and my buddies used to play laser tag. And, you know, the laser tag receivers were only kind of one hemisphere. So we rigged them up so you could have two of them wired together so you could have a full 360 sensor. And I did a lot of that, the quote/unquote “electronics” work with that, a lot of experimentation and whatnot. This is before the internet, so you couldn't google it, with wiring pieces of these sensors together and trying to figure out what would work and what wouldn't.
JON SAKODA: Yeah. And so, talk to me about how Snort came about. So Snort is your first open source project, and you were famously the original author of what eventually became one of the most widely used security tools. So, where was its origins?
MARTY ROESCH: So, I was working for a government contractor at the time, and I finally had a cable modem at my house, and I was very interested in seeing if anybody was knocking on my door while I was at work during the day. Networks back then were a lot quieter, so this was something that you could actually do. So I started writing a sniffer, and I would leave it running and recording all the packets that came in. And I had written some sniffers before, but they were all kind of platform-specific and things like that. So, I wanted to write a platform-agnostic, portable sniffing program that could basically record all the traffic that came in while I was out at work. And then I would kind of sift through the packets at night.
It was called S. And I worked on it for about a month, and I thought, hey, you know—and this is 1998, so all of the kind of open source stuff was really out there and was gathering a lot of buzz. So, the Cathedral and the Bazaar paper had been written, and Linux was gaining momentum, and things like that. And I thought, hey, it might be interesting to do an open search project. Maybe I'll release this open source, get a few emails. It'd be a fun little rainy days and weekends project. So, I kind of packaged it up and learned how to use the tools to be able to get people to build on their own systems more easily.
JON SAKODA: That’s right, because back then there was no GitHub, right? So, it was a very, very different world to find people that were working on open source and to distribute it.
MARTY ROESCH: Yeah. So, there were kind of the early proto blogs almost. So this is, you know, late ‘98. And one of the more popular sites of the day was a site called Packet Storm Security. So I contacted the guy who owned the site, a guy named Ken Williams. And I said, “Hey, I've just wrote this new sniffer.” And I had decided, hey, I'm going to call it Snort, because the way it formats the packets in the printout, the display is kind of different than tcpdump and stuff like that. So, this is a sniffer, but more, and what's a sniff, but more? Well, that's a snort. So, I’m going to call this thing Snort.
JON SAKODA: Well-named, Marty. Well-named.
MARTY ROESCH: Thank you. So, yeah. So, I contacted Ken Williams and I said, “Hey, I've just wrote this new sniffer called Snort and I'm intending to develop it, so would you put it on your site?” And he did. And he gave it front page billing and stuff like that. And it got a few downloads, and I got a couple of emails and bug report, feature requests.
So I started servicing the community immediately as it developed, and essentially just started doing releases like adding features, doing releases. I started to add in intrusion detection features where you could tell it what to look for, and it would tell you when it saw it. So instead of just having all the packets to look through at night when I got home, I could tag specific things that I was looking for.
JON SAKODA: If I could maybe take a step back. So, you had initially developed S, which then became Snort, for your own purposes, right? You wanted to be able to look at traffic on a network and do so in a repeatable way. You then thought it would be fun and interesting to make it open source. Other people responded well to that. What was the personal motivation for continuing to work on it and develop it? I think it's always interesting to understand where people came from. And what was the passion that you had at the time for effectively giving away software for free and taking your time and energy and sharing that with the world?
MARTY ROESCH: Well, the interesting thing was, maybe I'll put this tool out, maybe a few people will use it. You know, I can put it on my resume. Hey, I wrote this open source thing. So, I was a little bit motivated there. But the thing that really motivated me, quite frankly, was the feedback, because you gotta understand, when you work as a government contractor and you're a software developer, you know what life is like. It's like, you get the specification in. Here's what you're going to build. You build it, you deliver it to the customer. And you might not hear anything for six months to a year before these guys get back to you and say, “Hey, I tried your tool out. The installer didn't work.” And then rinse, repeat. Oh, geez, what happened? Then you figure it out, and then you give it back to them. And they're like, you know.
JON SAKODA: I see. So, I mean, this is way before agile development and continuous delivery and giving people the capacity to sort of innovate and iterate all the time. You were, as a contractor, building custom software, shipping it, and then it took forever to get real feedback.
MARTY ROESCH: Yes. The typical response was radio silence for long periods of time. And with open source, it's like, I put it out, and the next morning I had emails. I was like, ooh, okay. Well, I can do this, and then put out another release and get more emails, and so on and so forth. So, this was all done via email at the time and later IRC, but it hooked me. It was like, ooh, this is great. I can get instant feedback on what I'm doing, and I can respond to that. And I can interact with the people who are using it directly. It's like, oh, this is so great.
JON SAKODA: It’s interesting, Marty, because today when people start companies, obviously the idea of taking five years to spec out a piece of software and to build it and to ship it, that died with Windows Vista, right? So, today I think people view the best practice for building a great product and having great product market fit is continuous feedback and iteration. And when I go back to when you did this, there was not yet software as a service and cloud. And there certainly wasn't a concept of agile development with SRE and DevOps. And it strikes me that you fundamentally understood that you needed to get great customer feedback, and that this was one of the best ways to do it back then.
MARTY ROESCH: Yeah, absolutely. I did 23 releases of Snort in the first year it was out. Every two weeks, I was cranking out a release. And I was doing this all in my spare time. I actually had a day job.
JON SAKODA: That is amazing. You know, I think every entrepreneur early on, they understand that they have to ship new features, but at the same time, they have to figure out how to ship quality and reliability. So there's always that trade-off of, I want to innovate, but then I've got to do as much QA as possible. And I think one way that I like to ask this question is like, when did you know that Snort was popular?
MARTY ROESCH: So, I really didn't understand how popular Snort had become. And about—this was in the late summer, I think of ‘99. So, Snort was less than a year old. And the way that Snort happened was that I'd come home from my day job, do whatever in the evening. And then, Snort actually happened between 10:00 PM and 3:00 AM, typically. So I'd write code, I'd QA, I’d do my own testing and things like that. And eventually, one night, I just phoned it in and pushed a release out. Didn't QA it very well. When I woke up in the morning, I had tons of email. And it's like, Snort’s broken here, Snort’s broken there.
It doesn't compile on SPARC anymore, Sun OS, and blah, blah, blah. And I was like, holy crap. Where'd all these people come from? It’s like, whoa, you guys do understand—
JON SAKODA: So, I’m sure you were some combination of elated and terrified at the same time.
MARTY ROESCH: Yes, I was, because some of the email addresses were coming from, bigbank.com and, gov.mil. So, it was like, holy crap. Where did all these people come from?
JON SAKODA: So, is that what eventually led you to start a commercial company, or then what happens?
MARTY ROESCH: Well, okay. So, shortly after that kind of aha moment, I start the Snort mailing list and kind of bring everybody together under one roof so we could act as a clearing house for all the—what's going on with Snort. And thousands of people joined up right away, and it was like, whoa, this is really cool.
Shortly after that, I went to my first SANS conference, so SANS Institute, and while I was there, I got recruited to go work at a West Coast-based startup.
JON SAKODA: And everyone says, “Marty, we use Snort. Can we hire you?”
MARTY ROESCH: Well, no. It was actually, I said, “Hey, my name is Marty Roesch.” And somebody went, “Holy crap. You’re the guy who wrote Snort.” And they recruited me that weekend to go work for that startup.
So, yeah, that was interesting. But I was only there for a little less than a year. And that startup kind of collapsed. And when I came out of that, I announced that that email address didn't work anymore. And everybody knew what that meant. So, the phone started ringing right away. Job offers were incoming. A lot of people knew who I was at that point. And I got to the point where it was like, so I'd worked at this startup as employee, I think, number 11. And I figured out pretty quickly, the first few people in the door are the people who really make money at these startups if it goes well and you put your heart and your soul into it. And really, startup culture, I fell in love with, because it was just so dynamic, and everybody was there for the mission. It wasn't like big companies, you know?
So, when I came out, it was like, you could go work for company X, Y, and Z. And, you know, I had to kind of figure out which path I wanted to take. And I kind of had just a few months before I had this first inkling of, maybe I could start a company around Snort. And I had no idea what that company would do or how it would do it to get people to pay for this thing that was free. But that seed was kind of planted in my head. Eventually, two things happened. One, I saw the survey results from a SANS Institute survey. One of the questions was, check all the the intrusion detection systems you're using, and Snort was checked 92% of the time. I was like, holy crap.
And the other was this attempted buyout. They put a pretty substantial—especially for me at the time, who'd never really had any money—pretty substantial cash offer plus stock to go bring Snort and work at this company. And I kind of—at that moment, I was like, if it's worth that much to you, it's probably worth a lot more. So, that's the moment that I decided, I'm going to start my own company around Snort, and I'm going to go build a business model that's going to get people to want to pay for something that's free. And that was the moment.
JON SAKODA: Well, so, we can all laugh now because it's become one of the more popular and one of the more successful ways to build a commercial company, is to build it around open source, which begins with free software. But back then, that was highly controversial.
So, if I take you way, way back, so you have this successful project. I believe we're starting to head into the internet bubble bursting, right? So, we go into 2000 and 2001. So, this is not necessarily an easy time to start a company. And on top of that, you have a highly controversial business model, which it's not yet widely known that startups can build and sell software this way. So, what were some of the early objections, challenges? Take us back to those days.
MARTY ROESCH: Okay. So, I got Sourcefire up on its feet, founded in January of 2001. And the initial objections that I got out of the gate when I started trying to raise money was, the only reason that people use this is because it's free not because it's good. And I was like, mm, I’ve seen the competition. I actually think it's good and it's free. The other big complaints were around, well, you know, what's to prevent IBM from taking your stuff and throwing a thousand engineers at it and building exactly what you're building? And I was like, my attitude about it. And it still is to this day.
Look, if you own an open source project and you are killed by somebody using your open source project, then, very cavalierly, I would say—this was 20 years ago—your company deserved to die. If you can't out-innovate IBM with your own technology, then why are you here?
So, there was a lot of that, but ultimately, the investment community had a really hard time figuring out why anybody was going to want to pay for this. Because this kind of value proposition model of understanding, especially in security, people want the functionality. But with security functionality, very frequently, what they really want is they want these functions, but they want to be able to do them at some kind of scale.
So, what I really comprehended in the early days was that Snort at the small scale solved problems, but that Snort at the large scale caused problems, and they’re different problems. And enterprises, which happen to have a lot of money, are willing to pay for the solution to that problem, because they really like the things that it does. They like the problem that it solves. So, I didn't say it as—I didn't have all that on board back then, but that was just kind of my primal instinct for this business model.
JON SAKODA: Well, I do want to talk about the primal instinct. Because again, now we're 20 years later, and this is becoming the best practice, right? The best practice is the community-driven community-led, product-led adoption. These are now the waves that everyone's trying to ride in software. 20 years ago, it's highly controversial. You've got everyone saying, this isn't going to work. What was it about your experience leading up to that moment that allowed you to do something in spite of everybody telling you that it's not going to work, or at its best, it's just highly controversial?
MARTY ROESCH: I feel like I had an insight into the problem, like a depth of insight into the problem that very few people really had. And that that business model really would work, because I did understand what the actual problems that people who were deploying these systems really have. And I think that's a customer empathy thing. We talk about customer empathy now. We didn't really talk about it back then. But I used to say this once in a while. My customers have headaches. Sourcefire sells aspirin, right? We solve your headaches, and we do it and it’s something that you pay for.
So, I guess I understood where the value was better than the people who were saying no, no, there is no value there. And because you've never done it right before, every answer is possible. Whereas the people who've been successful before, they tend to look to doing things the ways that have worked in the past. So, when you're unencumbered by success, freedom's just another word for nothing left to lose, right?
JON SAKODA: Yes.
MARTY ROESCH: You can do whatever you need to do to be successful. And you don't worry about kind of the conventional wisdom.
JON SAKODA: Yeah. May I ask, were you able to sustain that fearlessness over the last couple of decades? Do you feel like with some success, you somehow change, or do you feel like sometimes maybe we can even get calcified in our thinking?
MARTY ROESCH: Well, I think I largely have. I'm definitely more conservative than I used to be, because I know the answers now, right? So, I am no longer unencumbered by success. I'm actually encumbered by success. So, I have to be cognizant. And I think it's like an introspection thing, right? You have to be willing to call BS on yourself, because that's the only way that you kind of stay flexible. So, you have to be willing to re-examine your beliefs periodically.
And some beliefs are kind of fundamental, how you have to build a balanced organization. It’s so common in the security world for the guys who wrote the technology to go out and start a company, and refuse to admit that, go-to-market’s actually really important. In fact, that's the engine that keeps the company going. The engineering provides the vehicle to people wanting to pay money, but that whole go-to-market organization actually is invested in getting the money.
One of the things I learned early on in Sourcefire is that nobody in the organization understands each other's jobs, especially outside of the functional groups. And they have no respect for each other, right? So, the engineers don't respect the sales guys. They don't know what they're doing all day. Same for—you know, the engineers are just typing all day. Why is this taking so long? And the sales guys are just taking people out to dinner all day. Why aren’t we getting more money?
JON SAKODA: Well, let's talk about this, because some things have changed, but some things have stayed the same, Marty. And I do think today, as people are trying to learn from best practices, you were one of the first to really build a product-led company. And then eventually, that became a very successful monetized and go-to-market-led company. So, this tension, these trade-offs, they still exist today, right, of what should we be giving away for free? How loyal to the community should we be? So, what were some of the experiences that you had, and looking back, what are some of the lessons learned that you'd pass on to people?
MARTY ROESCH: So, once again, I kind of had a dictum. And the core dictum was, Snort will always be free. So, as we brought people in from kind of the normal software industry to work at Sourcefire and things like that, I would tell them, look, if you’re thinking, God, this feature, we just put in Snort is too hot to give away for free, clear your mind, because it's going out the door and we're not charging for it. Because snort was the kind of—it wasn't really a loss leader. It was the thing that got focus. It got attention, right?
And what I mean by that is that if we could engineer the best Snort that we could possibly engineer and attack the intrusion detection and prevention problem as hard as we could in this piece of free software, then we are the standard that everybody relies on and that everybody learns on. And as a result of that, when they have the problems that we solve, they'll be wanting to come to us to do it. So, the important thing would be to keep everybody's focus on Snort.
And the best way to do that is to build the absolute best program in software, free software, that we can, and never hold back on features, never hold back on capabilities that are in the system, because that's how you end up kind of losing the plot. You get into this whole how many angels can dance on the head of a pin thing, where you sit there trying to figure out, well, should this feature go in free, or should it not go in free, and stuff like that. Nope. Snort’s free. We compile it in this code base. It goes out the door for free. I don't care if I just invented a terabit per second pattern map or something like that.
JON SAKODA: Cold fusion, right. Whatever it is.
MARTY ROESCH: Yeah, cold fusion. Whatever it is, going out the door for free. Don't care. Because the thing that people are actually paying us for, once again, is manageability, scalability, performance, automation, and support. That's where we make our money. Snort is the thing that keeps all eyes on us and essentially farms our future customers. So, that kind of distinction, I think, as a dictum, it's really important that everybody understand it, so there is no debate. This is just how the world is.
Let's figure out how to monetize around that, as opposed to kind of trying to look at all the tea leaves and figure out well, this feature should be open source, but that feature should not, because that's kind of the path to madness. You end up in these giant meetings where everybody's trying to figure out what should be in there and what shouldn't be in there, and things like that.
JON SAKODA: Do you believe there has to be a dictator model, meaning somebody has to just draw the line in the sand every time and say, “This will always be free. These will always be available to the community?” I know for sure that over time, companies become bigger. There are more stakeholders. The founder still has a strong voice, but there are other voices in the room. And I know everyone out there feels this tension of, we need to at some point create commercial success for everybody. But at the same time, we have to stay true to this vision. And I know that you lived this for almost two decades.
MARTY ROESCH: Yes. I think the benevolent dictator model—I mean, maybe I'm a particularly benevolent dictator, but I think it really works.
JON SAKODA: I need to get you a t-shirt that says that.
MARTY ROESCH: Yeah.
JON SAKODA: I'm a particularly good benevolent dictator.
MARTY ROESCH: Yes, I would wear that t-shirt, for sure. But it’s important because as soon as you kind of dilute that absolute authority, especially for a critical component like Snort, then it's always possible to be undermined in ways that really undermine the overall mission. So, I think that’s an important kind of aspect of it.
And also, when you have a benevolent dictator, the buck does stop at that person. Maybe they drive the company off a cliff by accident, or you recover, right.? That's always the danger when you become reliant on kind of one person for something key. Or, they leave and kind of freeze up the organization to do whatever it's going to do. But then you've got this kind of king leader problem of who runs the kingdom.
JON SAKODA: Can I ask, because now that you can look back on effectively being not just a successful entrepreneur, but also a pioneer in an industry, what were some of the highest highs on that journey, and then also, what were some of the lowest lows along the way?
MARTY ROESCH: Hm. Okay. Let's see. I would say raising my first series A was a pretty high high. But it was kind of couched in exhaustion. So, when I raised the series A for Sourcefire, I had never raised a round of venture capital before, and I was doing it completely by myself. I had no executive team to work with. I had no support. It was just me—
JON SAKODA: And remind everybody, this is 2001, 2002. This is when it's the Great Depression in tech, right?
MARTY ROESCH: Oh yeah.
JON SAKODA: The bubble had just burst, and I think there was a thousand venture capital firms in 2000, and there was only about a hundred left by 2001.
MARTY ROESCH: Yeah. Right. They called it nuclear winter. And roll in with an open source story, and everybody’s like, “Yeah, the door’s right there. Have a nice day. Please get out. That's the dumbest thing I've ever heard.”
So, I got an initial tranche for my series A, and then I went out and I hit the road, and I engaged 18 different VC firms, I got four term sheets, and I eventually took my series A round. And that was pretty exciting. Although, once again, it's very couched in kind of the day-to-day just, I'm trying to hire, I'm trying to build this company, I'm trying to get all this stuff going finally.
I think when we went public in 2007, that was a big moment as well. I really enjoyed that. That was going from zero, like literally operating out of my living room, to being a public company in six years, was pretty crazy. That was great.
I think the, the Cisco acquisition was another great one. I remember that morning, getting up and we popped the news out for everybody and brought Sourcefire, all the people together and things like that. But I remember my phone being down to about 10% by 11:00 in the morning from just this giant flood of text messages, and emails, and phone calls, and everybody in the world giving me the the attaboy. That was a lot of fun.
Lowest lows? Let's see. There were a few of them. Well, my second CEO passed away. He developed colon cancer. And yeah, that was really rough because he was a good friend of mine, and it was hard to handle on a personal level, but I also had to be, to some degree, the chief mourning officer for the company, and delivered a eulogy at the funeral and all this other stuff. It was a very difficult time for me personally.
There were some other times when the markets crashed in 2008. Sourcefire, as a public company, we bottomed out at $3.89 cents a share, which was actually—
JON SAKODA: I remember that. I remember.
MARTY ROESCH: And you kind of wonder, what's going to happen to us at that point. And a year later, we were one of the top four fastest-growing stocks on NASDAQ, actually, which was another high. By the time we got acquired, our daily number was around 55 bucks a share, and we got acquired for $76 a share. So, just a huge success story over really a fairly short amount of time, five years.
JON SAKODA: You know what I think is interesting. Marty? Do you remember that the company was going to be acquired by Check Point?
MARTY ROESCH: Mm-hmm. Yep.
JON SAKODA: And then it got blocked by Cepheus. And I know that that's more common now, but did that feel like it was a gift at the time? I mean, clearly it was, but maybe at the time, it felt like that was a huge setback or a low point for the company?
MARTY ROESCH: Actually, no, not for me. I wasn't sad when that deal fell through. I thought we had a lot of potential and possibilities.
JON SAKODA: Oh, that’s so great.
MARTY ROESCH: It was announced in October of 2005. So, Sourcefire is like a four-year-old company at this point. And it fell apart in March of 2006, and we went public in March of 2007. So, the board really wanted the deal. They thought it was a good deal. It was a $225 million cash deal for really what was a small company at the time. And, you know, that's not a bad deal. I just felt like we had so much more in us. It almost felt like surrendering. And then the day where we found out Cepheus was like, this isn't happening, that was actually one of the better days, because I was like, yeah.
JON SAKODA: Yeah. Okay, cool.
MARTY ROESCH: We got a lot of fight left in us.
JON SAKODA: Oh, that's a great story, then. That’s a great story.
MARTY ROESCH: Mm-hmm.
JON SAKODA: So, looking back now, do you have any lessons for your younger self, things that you want to pass on to the younger version of you, or maybe founders who are like you who are out there today?
MARTY ROESCH: Well, don't split your series A into two tranches, that's for sure. It should be a series A and a series B. Left a lot on the table with that one.
JON SAKODA: Well, I mean, remind everybody, what was a series A back then? I mean, it must've been tiny, right? I mean...
MARTY ROESCH: It was $7.65 million, was my series A. So, yeah, it was pretty small, I think, from a lessons learned standpoint, one of the interesting things, I would say, is that, so right back in the beginning before I had an executive team, before I'd taken my series A, I was having a real hard time finding mentorship. And I had no idea what I'm doing. I have a degree in computer engineering and literally no other education. It's not even a master's. It’s just a bachelor's. And so, I read one management book ever, Peopleware. And so, I’m running this company, and I'm desperate for people to tell me, how do you do business?
So, I got in front of this executive, and I was having lunch with him. And I was like, okay, oh, great Yoda of business, tell me the secret to being successful in business. And he was like, hire good people. I was like, what? That's it? And that actually is very, very true. The strength of your organization is the strength of the people in it. And that sounds a little corny, but it is—if you have just an all-star team, you've got a much better chance of being successful than if you've got a bunch of people that you feel like you're always the smartest guy in the room and things like that. I never want to be the smartest guy in the room. I really want to have people in there who are way better at their jobs than I could ever be, because that means when we all come together, we can drive the whole organization forward much more effectively.
But there's a converse to that, which is don't hire bad people. And don't hire bad people actually isn't necessarily like bad at their job. They could be bad for the organization. So, maybe they're really good at their job, but they're also very toxic for the organization. They really break down kind of the cohesiveness of the internal culture of the organization, the ability of people to work together. I've seen that more than once. And it's very hard to pick up on, but you really gotta go with your gut on a lot of those things. Because if you're not enthusiastic about hiring somebody, especially somebody senior in the organization, for a reason, you really got to listen to your gut on that.
So, be smart about how you take investment. Get good legal advice. I didn't have that in the early days either. You gotta understand, in 2001, 2002, those were the years of no money, no clue, and no hope. We were just like a leaf in a stream, just kind of twisting around, waiting for things to happen to us, bouncing off the shore and stuff like that. We got through it. I don’t know, a little bit lucky, a little bit good. But the people that you bring to the table are really going to define how successful you can possibly be. And it's really important to nail those down. And it's very easy to blow that.
JON SAKODA: Yeah, no. I do think sometimes founders think that it's a reflection on them if they made the wrong hire. But I think what you're rightly saying is it's just such a stronger signal when you make a quick decision and let everybody know that you're looking out for the organization and that we all make mistakes, but the key is to make them quickly.
MARTY ROESCH: Yeah. We talked about ego. Humility is a big part of it too. One of the things that our mutual friend Harry Weller liked about me was that I was always willing to say when I didn't know something. The first partner meeting that I did at the VC firm that ended up leading the series A in Sourcefire, I got in the meeting and they were like, “What's your revenue last year?” I said, “X.”And they said, “What are your bookings?” And I said, “X.” And they were like, “Do you know the difference between bookings and revenue?” I was like, “No. What’s the difference? Tell me.” Once again, you can't be successful if you're like, “Well, of course I know what it is,” when you don’t, right?
JON SAKODA: Oh, that is such a great story.
MARTY ROESCH: I didn't know. There's all sorts of stuff I don't know. Nobody knows everything. And especially if you're doing it for the first time, and you're an excellent systems programmer, but you don't really know finance, you gotta tell somebody, I don't really know finance, please teach me. And I did that at Sourcefire, hired all these excellent people. And I watched them do their jobs, and I let them teach me. And I was always willing to admit, I have no idea how you do your job. Please teach me the basics of it so I can at least be conversant.
JON SAKODA: Awesome. I have two last things that I just want to cover. So, first, near the end, I always like to give everyone a chance to talk about what gives them passion today and how they like to give back.
MARTY ROESCH: Well, so, I do a fair amount. So, I do a lot of advisory work for first-time entrepreneurs. I actually have had a lot of people reach out to me over the last few years especially, and ask me for help getting them started, whether it be introductions to investors or investing myself, or just advice on how to do it.
A lot of people, once again, they come from the engineering side, especially in security. They come from the technical side of the world. And the question of how to do it, how to build a business and all the pieces that are required to do it, are actually pretty complicated, right? As you know, it’s not just building a great product, it's marketing, and sales, and operations, and finance, and AR, and accounts payable, and all the stuff. So, understanding that and getting somebody who can advise you, just like I was looking for 20 years ago when this guy was like, “Oh, hire good people,”—that's a big deal. And so, I couldn't find that, especially out here on the East Coast. I couldn't find that 20 years ago, so I try to be one of those people.
And I'm advising several companies, and I get on the phone with them any time they need me and talk through things with them, talking about investing, and talking about structuring the company, or even go through technology decisions that they're trying to make.
JON SAKODA: You mentioned one other thing that I do want to talk about. You mentioned that you are now encumbered by your success. Are there things in your career you look back on and you say, I learned something, but now with the fullness of time, I now have enough wisdom to know that I need to unlearn certain things?
MARTY ROESCH: Yeah. So, for example, as I've been looking at the next step of my journey, I’m evaluating market conditions and things like that. So, one of the things that I didn't know when I started Sourcefire was that it was extremely foolish to start Sourcefire, because it was a market that had already—the intrusion detection market, that bell had already happened. There were winners and losers. The market has shaken out. The acquisitions had happened. So, it was kind of a done game. And if I had known that at the time, if I had seen the progression of the market, I would have said, mm, probably don't want to go into intrusion detection. But there was an opportunity there because the first-generation vendors were not actually really great, and people still wanted to attack the problem, right?
JON SAKODA: That's right. That’s right. In some ways, because everybody thought it was a done deal, there was not as much innovation.
MARTY ROESCH: Right. Innovation dropped off the cliff.
JON SAKODA: Yeah.
MARTY ROESCH: So, as I go into this new opportunity, I start surveying the market, looking where the TAM is, where my total addressable market is, and if it’s big versus small, and where there's market opportunities and things like that. And to some degree, especially in the security space, where almost nothing is green field—there's very, very few times where something that's really net new happens—you look for the opportunities, and I say this kind of flippantly, but it's actually quite true, you’ve got to look for opportunities to suck less. You've got to find technologies that suck that are a real pain in the ass for their users to use, and look where there's opportunities to essentially, do something else, and do something better and innovate, and really bring a new way of thinking to the table.
So, the thing that I have to be careful about, really, is being too careful, and understanding there could be a large TAM that's poorly served by the existing vendors out there, and going after it, despite the fact that a market space could look fairly ossified when you're kind of looking at it from the outside, or Gardner doesn't like it, or all these things that we are trained to look for from being in the industry for 20 years. What do the analysts think? What's the market like?
So, yeah, just not being afraid to move, I think, is a—not being too smart, essentially, or too savvy about the market, I think, is one of the things that you gotta be really careful about, because that's where you miss opportunities, and disruption opportunities, and things like that.
JON SAKODA: Excellent. Well, Marty, you've been a real inspiration to a lot of founders. You've been an inspiration to me. I really, really, really think that it is amazing what you've done to help create an industry around open source software, and convincing people that the power of the community can be an even more powerful force in commercialization than anything else. So, I really enjoyed having you on this podcast, and thank you so much for joining us on the show.
MARTY ROESCH: Oh, you're welcome. Thank you, Jon. It was a fun conversation. I really enjoyed it.