Brian Murphy is the founder and CEO of Reliaquest. ReliaQuest advances the delivery, reliability and outcomes of IT security for Fortune 2000 organisations in diverse industries. Since 2007, ReliaQuest has rapidly grown into one of the leading providers of IT security for some of the most recognizable corporations in the world. Core to its success is the comprehensive training it gives to staff and a very high retention rate. ET spoke to Murphy about the company, his personal experience as a business leader and the industry.
ET: What is your vision for ReliaQuest?
Brian Murphy: My vision for ReliaQuest is twofold. For the cyber industry it’s to increase visibility in the network. We’ve spent the past 20 years building tools and technologies. What we need to do is to make those things work together to get the visibility that we need in our networks.
We also want to put the customer back in control of their security spend. That means making the cost of being good come down and hopefully watch the cost of being bad increase.
ET: Who is your inspiration and why?
Brian Murphy: I grew up in a very blue collar environment. Just watching mom and dad get up every morning at odd hours and going to work at multiple jobs when they needed to and never complaining. I’m just trying to pay that back over time, for instilling that work ethic in me. I’ve learned best lessons by watching what people do. I think that’s been why they’ve been my biggest inspiration.
ET: How would you describe your leadership style?
Brian Murphy: I’d call it focused. It’s very driven around getting great people on a team and giving everybody a voice but at the same time being decisive. I’m very decisive, very focused, and my main goal is just ‘take care of the people around you’. Most problems can be solved if people feel like they’re cared about and that the people that they work around care.
ET: What are your personal challenges for the next 12 months?
Brian Murphy: The balance of personal health, family, and business. It’s the same thing everybody deals with. How do you fit it all in?
ET: What was your darkest business day and how did you overcome it?
Brian Murphy: Probably around the economic crash in 2008. How I solved it was I just turned the TV off. I stopped watching the news and decided to focus on what I could control. We put our heads down and keep chopping away and grew the company. It was the best thing that we ever did.
Just turn the television off and truly believe that the truth is in the middle, it’s never as good as you think, it’s never as bad as you think and keep moving forward.
ET: What was your proudest moment?
Brian Murphy: Recently there have been a lot of things that have happened right next to each other. Within a four month time period: walking through our 30 thousand square foot corporate centre, being named the Ernst and Young Entrepreneur of the Year for the state of Florida, seeing the hire of 70 people in five months, it’s our 10th anniversary, I turned 40, and I gave the commencement address to my Alma Matter at Florida State. I don’t often slow down and look around, I don’t enjoy the journey as much as I should. I was proudest that all that happened at the same time because it forced me to stop and look around if that makes sense. I have an 11 year old daughter and an 8 year old son, they were right in the middle of it. They were old enough to remember it. That was pretty cool.
ET: Can you share some tips for start-up CEO’s
Brian Murphy: First and foremost it’s got to be a business. Ideas are great but you must be able to execute it as a business. It’s got to be something that people are willing to pay for and you have to start with that in mind. Make sure that you’re always thinking through the processes from beginning to end. If you’re a technologist, don’t just focus on the tech. Make sure you have somebody around you that understands the business and vice versa. If you’re just a business person make sure you have a strong team around you. Never believe your own hype. The truth is in the middle. Stay laser focused on your objective. You’re going to be wrong and try to be the first person that knows your wrong. That conversation that you have in the mirror every morning, don’t lie to yourself
ET: Have you got any tips for all the CEO’s looking to raise funds?
Brian Murphy: Look for someone that’s going to be a partner beyond just money. If you don’t enjoy working with them during the due diligence process you will not enjoy working with them when they’re partners in your business. They have to add more value than just cash and it has to be somebody that you can work with in a candid environment.
ET: What was the latest business book you read or your favourite book on podcast?
Brian Murphy: I read probably on average two books a month. One I read earlier this year was, Shoe Dog by Phil Knight. I try to read books about industries that weren’t defined when someone defined it. I read The Tycoons, which was a detailed story of the rise of Carnegie and Rockefeller. There is an older 1920’s book that Henry Ford wrote himself. It’s called, My Life and Work. It’s a really difficult read. The English language has changed a lot in a hundred years . He also writes it like a mechanical engineer. It was fascinating to see how he was thinking through concepts that hadn’t yet been discovered. What I like about all of those stories is they were forced to find ways to train and develop workforces. They couldn’t just depend on someone else to do it for them, they had to create it
ET: What’s on the radar in terms of future technology for ReliaQuest?
Brian Murphy: For ReliaQuest, it all revolves around automation. I think automation is a term that’s used too much. We’ve been automating things since the beginning of the industrial revolution. For us, it’s looking at every single process within the organisation. Not just everything forward facing.
Also AI, artificial intelligence and machine learning. It will be a huge influence but I always like to caution around those terms. It’s one thing to recommend what video you should watch next because of the one that you just watched. It’s another thing to completely use machine learning in AI to analyse what could be a threat.
There are some ways we can use algorithms to automate some of the operational data that gets in the way of making security decisions. We can do that for our end customers, allowing them to make decisions quickly and only consume the relevant security data they need. For us, it’s about how do we remove the minutiae around our own people in their daily work and allow them to do the thinking. We have brilliant people on both the customer side and our employees. Allow them to use critical thinking skills, instead of just wading through data. I think it’s irresponsible right now for artificial intelligence companies to say they can completely automate the security process.
ET: I do see a danger with automation in that people automate their existing processes I think there’s more a case of rethinking both at the detail but at also the holistic level because there are different ways of doing things nowadays. Is that a fair thing to add?
Brian Murphy: Absolutely. It’s questioning everything. You’re right, we apply what we’ve learned over the years and try to fit it in new technology instead of stepping back and re-whiteboarding it. Sometimes you had limitations of technology and maybe limitations of training so you were forced to do things a certain way, now we’re not so let’s rethink that. That’s true innovation and automation, not simply creating another widget to jam something into.
ET: What are the key business challenges for the next 12 months?
Brian Murphy: Focusing on maintaining the culture and making sure that we’re planning far enough ahead of time. We are in the growth phase where we need to be thinking three and four years down the road but at the same time remaining agile enough to pivot in and out of decisions that we’re making across the company.
ET: What’s the worst and best decision you’ve made as a CEO?
Brian Murphy: The most frequent thing I’ve been wrong on is commercial real estate, leasing office space. It’s really difficult at our growth rate of 200-300% a year to guess right in office leasing. We’re constantly moving office space because we outgrow it so quickly. We now have now a good footing where we are with an industrial owner that can allow us to expand as much as we want. When you’re a smaller organisation, you don’t get the attention of those industrial owners, they don’t care until you get to a certain size.
I think easily the best decision that we’ve made is our focus on ReliaQuest University. Our focus on the belief that while there is a shortage worldwide of trained skilled cyber security professionals, there’s no shortage of people that would like to be. Taking that mindset into hiring people with attitude, energy, and effort and train them. That’s single handed been one of the reasons we have a 95% plus retention rate over the past 24 months as an organisation, which helps a lot.
The continued evolution of ReliaQuest University and the simulator that we’ve built is a game changer. We’ve spent a year building a simulated technology across security environment. We’ve invested a lot of money in professional development and training around performance training, emotional intelligence and leadership training. I think it’s the combination of taking really smart people and training them on the tools that they’re going to need and then letting them go create the automations of the future. We’re thought of as a security firm, but if you look at how the sauce is made and the recipe, it’s about training and development.
ET: What are the key challenges faced by the industry?
Brian Murphy: Increasing sharing and the speed at which we share information across the industry. Then it’s the noise. Everybody’s got a new box or new software and they all kind of say the same thing. When you’re a commercial buyer it’s really tough to know whether you’re buying the right thing or not because everybody’s advertising the same thing. You don’t want to go back to the board and say the thing we spent a million dollars on last year, that’s no good anymore, we need to go buy this new thing that’s a million dollars. I think that’s the problem with the industry, there can’t always be this new shiny thing out there, it’s really about process.
ET: Sharing threat information’s the quickest way to ensure a threat can be validated and tracked. STiX and Taxii are now part of a standard movement. How do we expand that sharing of threat data and automate use inside enterprises?
Brian Murphy: For me, we have to. We’re all aware that breaches are going to happen. I don’t think anybody’s denying it anymore. Lets quit making people be ashamed of the fact that it happens. If someone gets attacked on the street, we don’t ridicule them for being attacked. In cyberspace, there’s just as many of the good guys going, “Man, how did those guys get hit, that’s crazy, that should’ve never happened.” I think as an industry we need to treat it like someone attacked you on the street and think of it as, “Hey, my neighbour just got attacked.” Instead of, “Gosh, some other company that I don’t know.”
When we stop making it so difficult to share, sharing will increase. The way to increase sharing, is do it before something happens. You see it with the financial services, healthcare and retail industries who are pulling together their own councils and groups to allow for that confidential sharing. You’re not sharing any PII or any sensitive data, but you’re sharing attack patterns and how things happen, the different mistakes, the things that they saw. We need to make it okay to come out and say, “Hey, this happened. Let me share with you how it happened.”
ET: What’s the end game of ReliaQuest? Do you have an exit plan?
Brian Murphy: The end game of ReliaQuest is just to continue to scale. We have a wide open green field in front of us and we’re acquiring some of the most recognisable logos in the world. Every year, we are doubling and tripling. We want to continue to develop the brand and offer a great place for people to come and train, and develop as security professionals. We’re our own brand. We don’t want to go live in somebody else’s house. We’ve built a pretty good house here so we want to continue to grow. For me, I want to build something bigger than all of us. When you look back in history, it’s amazing to me around the world what groups of people come together and accomplish. I don’t think we’ve begun to start making that impact on the economy.
ET: How will IoT impact the security landscape over the next few years?
Brian Murphy: It’s already impacting us drastically. We’re going to continue to connect things. We want things faster, smarter and they become security challenges. Where we are getting a little bit better is where we are starting to think about security. The best firms, the best manufacturers of these IoT technologies are beginning with security in mind in the development of these applications. I think there’s a maturity in that development world but that’s a small segment of those manufacturers that are capable of doing that. We’re dealing with it every day. We don’t know the magnitude of the new technologies coming on. The older ones such as industrial systems, these things were always air gapped off and now they’re getting connected. We need to think through the ramifications. It doesn’t mean we shouldn’t connect them, it just means we need to begin thinking about security before we switch those things on. It’s going to make us better as a security industry, but it’s always a new challenge.
ET: Is there an area where you think the enterprise should do more to address the cyber security threat?
Brian Murphy: The organisations in the Fortune 1000 layer that are the best at security involve security in all the conversations. Security is not somebody that comes in after a decision’s been made, they’re brought in on the front end, the planning part of the decision making. They’re at board meetings and they’re actively engaged in new innovations for the company. If you start thinking about how security needs to work before you launch new initiatives, you put your teams in a much better place to anticipate what the risks are. We need to continue to involve security in the conversation earlier and give them a seat at the table, a permanent seat at the table.
It becomes a business driver in a lot of the ways that IT was 30 years ago. It was viewed as this back office thing and now it’s the front of the organisation. You’re starting to see that in security as well.
ET: How do you prioritise your day?
Brian Murphy: I try to read at least an hour and a half a day, whether that’s at 4 a.m. in the morning during take-off and landings or at the end of the night. People issues to me are always the priority. I don’t generally spend any time during the day on email. That’s very early in the morning or very late at night. With my executive leadership team, or really anybody on my team, don’t send me an email. If you need me, call me, send me a text, but let’s get efficient in how we communicate. I also believe you can only focus on one thing at a time so you set a course and a plan for the year.
Then you want to make sure that you’re doing what’s most important now. I don’t like to be spun around in circles by just the fires that pop up every day. If everything is important, then nothing is important so I try to stay laser focused on the biggest objectives in front of me.
Finally, be in the room. Don’t be in a meeting that you’re not engaged in because you shouldn’t be in the meeting then.
ET: Thank you Brian