John Watters’ interest in cyber security intensified at the turn of the new millennium as he was looking at new investment themes. He made strategic investments in Archer Technologies and TippingPoint Technologies and a controlling investment in iDefense. When Symantec bought Riptech, Recourse and SecurityFocus on the same day in August of 2002, he realized that he was in the right place at the right time. He began commuting from Dallas to Washington, D.C. and became chairman and CEO, in which capacity he served through VeriSign’s 2005 acquisition of iDefense. iDefense was Watters' first introduction to the cybersecurity industry as an operator, not just an investor. Following the sale, Watters supported the transition to VeriSign, then took time off with his family. In 2007, he started the cyber-risk management business iSIGHT Partners, where he today serves as chairman and CEO.
TheNewNewInternet: What are some of your duties as chairman and CEO?
Watters: Well, like in most small companies, you do everything that needs to be done, whether that’s customer relations, financial analysis, or recruiting talent. At the end of the day, I am a resource manager who ensures we resource the company to the level required to meet or exceed the level of customer expectations we set.
TNNI: What are some of the methods you are using to find top talent?
Watters: Word of mouth. Reputationally, when you treat your people well and empower a culture of hard work, creativity and passionate execution, you create a culture that attracts talented people, what I call A people. Ultimately, A people hire A people and you end up with a company full of A talent. The biggest mistake people make is letting B talent hire. If A people hire B people, then B people hire C people and C people hire F people ““ a death spiral.
TNNI: What are some of your core competencies?
Watters: Strategic vision and customer management. Building close relationships with customers, making sure they feel comfortable sharing with us what they like and do not like about our products, our strategic roadmap and our engagement model in a way that helps shape the company’s strategic direction. Everything we build maps to the community of requirements set by our customers. We are not building something we think people need, putting it on a shelf and hoping we can sell it. The close alignment between our customers’ goals and our product, strategic development and customer engagement model has definitely been the key throughout this business venture.
TNNI: What are some risk-management strategies you provide for clients?
Watters: The fundamental risk-management strategy that we employ is mapping threat intelligence to business impact in a quantifiable way that helps customers understand the return on investment associated with various countermeasures employed against threats. If you think about it, customers are managing massive risk portfolios – different vendors, customer relationships, data centers ripe with customer data, employees’ personal information, IP portfolios, IT architectures, etc. Customers manage this risk portfolio by investing in people, process, and technology; they shape their investment based on their general understanding of the threat conditions that are relevant to the risks they manage and the businesses they operate. Yet, this is currently done at a very intuitive level. Our value lies in helping build a link between a granular threat intelligence component that is relevant to a certain industry and certain customers that operate in that industry. This granular threat intelligence then maps to a specific impact to their business in terms of a change in their risk profile, which enables customers to precisely invest against that threat in a way that reduces risk in the most cost effective way. Generally, I’ve used a lot of the portfolio risk management principles in which I was formally trained while working in the financial, economics and portfolio management world and have now married those concepts inside the risk-management world for cyber security in a way that maps threat intelligence against business impact with economic outcomes. It's simply applying known concepts and constructs in a different industry and modifying the nomenclature.
TNNI: What are some of the major security threats in the cyber arena?
Watters: Not unlike our customers, criminal interests are attracted to low risk/high reward opportunities. Organized criminal groups now make more money in cyber crime than from the narcotics trade. That is a clear reflection of an adversarial shift from the kinetic to the non-kinetic world, where anybody can steal money namelessly, facelessly, with minimum risk and a high degree of operating leverage in a way that is both efficient and productive. In addition, a criminal group only needs a limited number of people and financial resources to be successful. The gravitational pull into electronic crime has created a meaningful shift in the risk dimension. As a result, competition among criminal groups has gone global, and the pace of innovation has shifted from trying to innovate faster than your target to faster than your competitor. Innovation pace has become a function of the competitive environment in which criminals live, an environment that is resource unlimited, rule unlimited, law unlimited and pace intensive. You’ve got an innovation engine in the criminal marketplace spurring the merchandising of all the tools, tradecraft, infrastructure and personnel that can not only be used for criminal purposes, but operationalized as well. Traditional infrastructure used for good things can now be purchased or rented and used for bad things in an easily deployable way. A government can target another government through traditional criminal tools. A criminal group can target someone for political purposes using criminal tools. The interplay between motivations and TTP has been dislocated by this merchandised infrastructure. Capability that initially built and supported electronic commerce is now being used to support electronic crime and is available to anybody who wants to use that capability for whatever purpose. Political, criminal, geopolitical, national ““ you name it, it’s for sale. It is much like being able to buy a gun at a sporting goods store. If you shoot skeet, it's a sport. If you shoot yourself, it’s suicide. If you shoot your neighbor, it’s murder. If you shoot a soldier in time of war, that’s just a casualty of war ““ the cause was still a gun wound. If you use it to rob a bank, it's armed robbery. It is who uses the weapon and for what purpose that defines the nature of the threat. Today, cyber weapons are widely available, so the motivational shift and attraction to that battle space has intensified as a means to an end that is highly efficient in delivering financial results for criminal groups.
TNNI: What are some of your top priorities for the coming years?
Watters: Engineer our business for the next stage of growth. When you grow a company as fast as we have the last three years, it's important to pause and make sure you get all of your efficiencies and processes established and scalable. We're not going to let the wheels fall off. After our team's hard work driving excellent growth, we are pausing to make sure we get all of our operational efficiencies in place, rechecking our positions with every customer to make sure their expectations are being met, getting input from our customers as we build the strategic direction for our next stage of growth and engineering the platforms that will enable us to scale efficiently – then we will scale the business.
TNNI: You have spent considerable time working with charities. Can you talk a little bit about that?
Watters: As the father of five children who have had excellent educational opportunities, I have always been compelled to focus on providing similar opportunities for inner-city children ““ which has been my calling for the past 15 years. Oftentimes, there are very well intentioned, well-resourced individuals who donate money to charities, yielding results that fall well short of what they could be if they had donated both time and money. Bringing entrepreneurial skills to philanthropy can really create a leveraged effect. My principle objective in philanthropy is leveraged giving, where you establish models of investment that have a clear multiplier effect. For example, we run a program for inner-city middle school children that helps prepare them for scholarship opportunities into the finest private schools in Dallas. Students go to school on weekends, receive enhanced academic training, test-prep skills and socialize with kids from the target private high schools. These young kids get to know the student mentors and become comfortable in the environment. Here's the leverage associated with working with middle school children, who are at peak risk of gang membership, drug addiction and a whole host of bad options: The program costs roughly $25,000 a year, in addition to hundreds of hours donated by the student mentors who volunteer their time. On average, these children, in aggregate, receive $300,000 a year in scholarship money from private high schools. The same kids receiving scholarships in high school are receiving $1.2 million, cumulatively, in college. So, your $25,000 investment translates to $1.5 million of funding from other institutions, enabling a pathway for a child from an inner-city school to a productive place in society. Another example of leveraged giving outside of education is Compassion Highway. We find truckers who are running empty runs. Let’s say that a trucker is going to pick up something in Albuquerque and bring it back to Dallas, but is running empty from Dallas to Albuquerque. We find out what goods are available for donation in Dallas and whether the truck driver is willing to load, deliver and unload the goods at the final destination if we pay for fuel. We’ve had experiences where we spend $500 or $600 on fuel and get $80,000 worth of goods delivered free to an orphanage ““ another leveraged-giving model.
TNNI: What is something most people would be surprised to learn about you?
Watters: I avoid traditional learning techniques, am not an avid reader, and spend more time thinking than reading. Successful innovators blend the hypothetical with the practical“¦ and find a way to communicate their vision simply. Our ideas are generated through interaction with everyone around us. I learn from interacting with people and engaging their opinions, usually one on one or in small groups. Innovation isn't driven from the podium ““ it's derived from intersection between the hypothetical and the practical, both tactically and strategically. While we certainly employ the best ideas around, those ideas are brought to the table to support or contradict the hypothesis being challenged at the time. In order to innovate in new markets, creativity needn’t be bound by the historical ““ only the observable and the hypothetical. I constantly ask questions of customers, competitors, employees, friends and anyone else that will share their opinion“¦ the answer usually lies somewhere between the opinion pool and a concept that no one ever even thought of. My success has been born out of a clear understanding that what is theoretically elegant versus executable ““ our business always tries to intersect the future rather replicating the current. It's a risky way to roll, but way more fun.