Corelight CEO Brian Dye on Experimenting and Scaling a Cybersecurity Company

Corelight's Mission and Origins

• 💡 Corelight operates in network detection response, helping enterprises and governments find and disrupt advanced cyberattacks, protecting critical infrastructure globally.
• 🚀 The company originated from an open-source project called Bro (later Zeke) in the mid-90s, initially funded by the National Science Foundation (NSF).
• ✅ Corelight transitioned from a services model to a product company to meet customer demands for performance and reliability, prioritizing customer satisfaction by hiring a Head of Customer Success before a Head of Product.

Leadership Transition and Self-Awareness

• 🎯 Brian Dye joined Corelight after a career at large cyber firms, drawn by its open-source heritage as proof of product-market fit and its unique culture.
• 🔑 He became CEO when founding CEO Greg Bell chose to focus on community and customer engagement rather than scaling systems, demonstrating low ego and selflessness.
• 🧠 Brian's decision to accept the CEO role involved self-awareness, evaluating if he was the best fit and complementing his weaknesses (like sales management) with a board chair and new CRO.

Scaling Challenges and Strategies

• 📈 Key scaling challenges included hiring effectively by bringing on a full-time recruiter early to screen for cultural fit.
• 🗺️ Implementing a clear customer segmentation model was crucial to focus sales efforts, avoid wasting cycles on non-target customers, and build appropriate routes to market.
• 🌱 Corelight invested in defining its authentic culture to ensure it was amplified, not diluted, during rapid growth, recognizing culture dictates communication, decision-making, and trust.

Fostering a Culture of Experimentation

• 🧪 Corelight actively encourages experimentation across all functions, from product to sales and marketing, even celebrating “best mistakes” to support risk-taking.
• 📊 The company allocates resources using a three-horizon strategy: 70% on flagship products, 20% on up-and-comers, and 10% on raw experimentation.
• 💡 New hires are encouraged to “build the company” by constantly evaluating and changing processes, acknowledging that every process has a shelf life of about 18 months.

Navigating Open Source and AI

• 🤖 Corelight found an unexpected “gift” with Gen AI: customers were already using large language models (LLMs) to automate security investigations with Corelight's open-source data.
• 🤝 This is because LLMs trained on the public internet had already processed Corelight's open-source project data, offering customers the choice of packaged Gen AI or rolling their own.
• ⚖️ The company balances its open-source community and commercial interests by committing to the BSD licensing model, investing in community capabilities, and not forking code internally.

Key Learnings for Founders

• ⚠️ Founders should be explicit about customer success and time to value, as initial sales don't always equate to true product-market fit or readiness to scale.
• 👥 It's vital to know how to hire for cultural fit from the outset, as rapid growth without this can dilute culture and create friction in the hiring process.
• 🧭 Leaders must continuously adapt their style to the company's scale, empowering teams to make decisions and fostering initiative, even if it means letting go of control.