Lessons Learned from My Experiences as a Tech CEO

When I joined Bugcrowd as Chief Executive Officer, I had a set of goals in mind. I can proudly say we blew past most of those goals and are well positioned to achieve the remaining few. I am blessed to have had a very supportive Board and the broader Bugcrowd team that helped me grow from a go-to-market leader to a CEO of a global crowdsourced security company.

After Bugcrowd’s early years as a single service company, it became clear that we needed to evolve into a multi-product platform company to utilize key insights from the platform to address multiple customer use cases. We knew we had a technical transformation on our hands, but we didn't realize how much our company culture would need to transform as well. And we could not have anticipated a global pandemic, streets flooding with demands for social justice, and the raid on the U.S. Capitol which created a sense of uncertainty and anxiety around the world. I wanted to share the best of what I learned in the hope that it’s helpful in your own leadership journeys and for my plans moving forward.

Like most companies, the last three years marked a tectonic shift for our employees – adjusting to working fully remote, missing water-cooler conversations, balancing work and family life, and dealing with the constant anxiety of the unknown. We learned a lot during this time. Remarkably, we kept a globally distributed workforce of 275 people healthy and committed. Our hackers continued to hack for good and earn money – some to pay for their friends’ unexpected Covid medical bills and some to buy their extended families a home. I grew a lot as a CEO, and in full transparency, I got plenty of bruises along the way that I learned from and that helped the company grow.

Balance short-term results with a long-term future

As a first time CEO, I quickly realized that my previous leadership experiences required me to be accountable for results only a few quarters out. As CEO, I had to balance short-term results with our long-term future. This meant picking the right things to work on in the present that would enable the desired future. I picked three pillars to keep the entire company centered:

1. Establish a well-defined “core” driven by our product capabilities, customer segments, and company purpose?
2. Maximize the value that our Crowd of ethical hackers and employees deliver
3. Create the right guardrails and standards to guide our execution?

Pillars 1 and 2 drove our competitive differentiation. The bug bounty market was evolving in parallel – customers saw the value of ethical hackers, but it was also the peak of the vanity metrics (e.g. number of hackers signed up) and feature/functionality arms race. We had to change the game and focus on what mattered most: offering multiple products on a single platform that delivered far more value for both our researchers and our customers.?

Pillar 3 kept the company on track so individual leaders knew how to make decisions to enable pillars 1 and 2. On the surface, this may not look like transformation. But getting the company more focused and more consistent in its ability to execute was transformative, especially given the external macro environment.?

In five years, these three pillars drove 6X topline revenue growth, path to profitability, 8X customer growth, 3X employee growth and an amazing Net Revenue Retention.?

Be a broken record – all the time, in every arena?

How often have you heard “I didn’t know that was the strategy” or “No one told me”? I realized my job was to continually look for opportunities to connect the team’s work to the company’s strategy. Each year I’d outline our strategy during our annual sales kickoff and then make it a point to repeat it at least 7-10 times throughout the year in forums big and small. It’s important to continuously help interpret the relevant outside market vis-a-vis our internal core so everyone can clearly communicate the business we are in and state what success looks like.?

I also learned being heard requires being vulnerable and open to uncomfortable discussions, particularly if change is afoot. I distinctly remember one such discussion, it was May of 2020, the pandemic was raging, there was uncertainty everywhere, and we had already adjusted our operating and hiring plan to stay ahead of the forecasted storm. The U.S. government had recently launched the Paycheck Protection Program (PPP) to help businesses retain their employees. I was convinced that this program was not targeted for companies with our characteristics. But several people called me out on my decision to not take the PPP loan and asked what my answer would be to the employee and their family if we were required to lay them off when things got worse. I was finding myself in new waters with this question. What really helped was the open discussions I had with the Board, community members, employees, and other confidants where I was able to share my dilemma. After two tough days of conversations with multiple viewpoints, I reached the same conclusion with stronger conviction: the PPP loan was not for companies like us. We grew as a company in 2020, never needed the PPP loan, and retained our amazing team.?

Additionally, I learned that I could not please everyone all the time. In retrospect, I sometimes found myself trying to convince people about initiatives for too long which made me feel depleted at times. But I wanted to feel like everyone was on board and supportive when a "disagree but commit" might have been the better approach. My desire to bring everyone along instead of just pulling the team along sometimes delayed or compromised plans. It is very important to balance the servant-leadership style by serving other people’s highest priority needs while empowering them to develop and perform as highly as possible.

Focus on people-related priorities and the ‘why’

Contrary to the popular belief that cybersecurity is all about the next best technology, I believe that cybersecurity is inherently a human challenge and opportunity. There is no innovation that enables you to stay perpetually ahead of the bad guys. People write code. People break code. And, people help people secure code. Bugcrowd’s team and our researchers were our most valuable assets. Without them, there was no way to deliver against our core value proposition to “fast-find, fast-fix” vulnerabilities.?

Also, refreshingly, not every hacker in our Crowd hacks just to make money. One of our annual researcher reports showed that 45% of ethical hackers in our Crowd hacked for non-cash motivations, such as safeguarding the digital economy, being treated fairly and at parity, or being recognized for their contributions. It was only natural for us to invest in building a holistic total rewards model, which focused on intrinsic and extrinsic compensation and complemented it with a robust 30-60-90 day on-boarding to make both the hacker and employee stakeholders successful. The goal was to create an empathetic environment where both employees and researchers feel safe, trusted and rewarded at parity for giving all they have to give.

These human capital investments and initiatives were huge and added to the already full plates of our team. We had to build new processes and systems and help our internal staff that struggled with the load get comfortable. What really helped us was always starting with the “why” behind each initiative and how it would benefit all stakeholders. After they understood why we were doing it, then we could talk about the specifics of any new initiative. This practice of taking the time to explain “why” for any initiative mattered to employees and researchers. It helped them link our actions or practices with our strategy. When that happened, we got better adoption, commitment, and motivation.

I am convinced that creating a human-first environment that is optimized for how people like to work and are driven by a higher purpose doesn’t sacrifice excellence or performance. In fact, it creates more stability, innovation, and higher performing teams – Bugcrowders proved that everyday!?

Measuring what matters only helps if everyone sees the part they play

I'm always struck by the magic created when a scorecard is not just a grading system for what's important, but lets people see connections. It’s not always obvious how marketing activities radically impact sales or how product teams hitting their milestones impacts revenue. It's easy for functional leaders to only focus on metrics in their area. A good scorecard reveals interdependencies and forces accountability that crosses functional silos. When everyone else can see that interconnectedness, the CEO doesn’t need to solely drive alignment.?

An important part of leadership is about protecting an organization from internal rivalries that can destroy organizational efficiency or culture. By making sure my team had a short set of cross-functional metrics that were closely tied to our vision and strategy, I saw trust and cooperation thrive. Managers became enablers instead of enforcers, and the organization pulled together to deliver stronger results. It really matters when your scorecard provides guardrails and guides the team’s priorities so that everyone sees the part they play.

What’s Next?

While we accomplished a lot, it’s also now time for me to look for my next challenge and to welcome a new leader to Bugcrowd to take the company to the next level. I am deeply thankful for Founder Casey Ellis’s partnership, the Board’s trust and guidance, and the incredible love from the Bugcrowd team, our researchers, and customers. As I start a new chapter, I take the amazing memories from my journey at Bugcrowd to heart as a proud parent enjoying Bugcrowd’s next chapter.?

I’d love to hear from you if you found this useful or just to chat via LinkedIn or at [email protected].