The Face of New Media for Cybersecurity with Cole Grolmus, Founder Strategy Of Security

Cole Grolmus, thank you for joining me on this interview series, Noise to Signal. You are an N of one. There is no one like you in cybersecurity media. You are a student of cybersecurity companies and the ecosystem. You study them, you research them, and you influence them through your writing. You are an army of one.

And a founder and CEO of Strategy of Security. And your work requires a lot of effort, but you make it seem like it's effortless. And my sense is it must have taken a lot of effort to get where you are today. So I'm curious what has been the journey like to get started with Strategy of Security?

Yeah, thank you for having me. Honored to be here. you know, I it's i I've been doing this for five years, but it's been twenty plus years in the making, right? I think I I think there are parts of this journey that I could trace, you know, all the way back to when I started using computers at twelve and for sure when I started working, you know, and having a chance to work in the the industry like at a fairly young age. But, you know, I I I I think what ultimately came together was like

the the culmination of that journey over a really long period of time and and a lot of inten a r a lot of really intentional thought around, you know, what is it that I'm good at, what is a unique point of view that I can bring to the industry and what feels very like natural to me.

And there is there is one thing I want to add. You have been doing this despite lack of despite lack of sleep. You just had a second kid. So congratulations on that. despite that you have been doing amazing work. Your writing is really amazing. and my sense is like this was this is not your first rodeo. You tried something else, you failed, and then you landed up on strategy of security. What was that like? Yeah.

Yeah, I mean I I did a run, you know, a after my time at PwC, like I spent, you know, a decade plus call it intern through you know directorate at PwC, mostly in the cybersecurity advisory practice. and the the reason I left was not to do this, it was to start a proper startup. You know, there was there there was a a long period of time where I always thought that I wanted to be, you know, a proper a proper founder like you and had to give it a go. You know, it was just one of those things that I could never

never make it to the end of my life and feel like I hadn't attempted that. And so did that kind of, you know, the the short of that was like a couple year run, you know, really giving that a go. tried to build the age AI agents before we before we had nomenclature for that. And you know, five this was like, you know, more than five years ago. We just didn't really have the tooling. But you know, we we were kind of at the stage of like, I I got my open AI playground API key from Greg Brockman.

Personally. Like that's how that's how early we were in attempting to do some of that. And it it just, you know, it was it kind of ended up being a little bit too early and kind of the, you know, ultimately like the wrong time of my life. But all this is to say, you know, that that didn't work out, or I kind of decided that I didn't want to to do that anymore after a couple year run. but what that led to was like some really good reflection around what it was that I wanted to do next. And I think that w that's kind of the important part that that got me to

you know, what I've been doing with strategy of security. Like being a founder is really hard. I have a ton of respect for, you know, like startup founders that are trying to build venture scale companies. You know, I I just kind of realized that I didn't want to do that. You know, that's that's a hard that's a hard realization and it took a lot of pain to get to that point. You know, but I reached a point of acceptance where it was like, this it's just it's not, you know, it's not really for me. It's not what I want to do. But

That doesn't mean that I have to go get a job either. Like I was in a fortunate spot where I could take some time and figure out what I wanted to do next. You know, and so I I took the better part of a summer, wrote sixty-five thousand words, which for a point of reference is like half a book, around

In those were those words for yourself or was were you writing it for public consumption on like substantial?

No, that was totally for me. It was all it was it I mean, I I'm like s you gotta remember I'm like sitting on by far the biggest fail failure of my life, right? And I I just ripped it all down to the studs and I was like, what went wrong? What do I really like? What do I wanna do more of? What do I want to do less of? What am I good at? What am I bad at? Like like all of the above. Right. And you know, a as it turns out, like through, you know, a very intentional exploration exploration through all of that,

I you I I kind of read something that was really close to this. Like I knew I knew that it was directionally like I'm decent at writing. I w I have an MBA, like so I've I've you know, I've been through formal strategy training. I've ten years of experience as a practitioner in like a hard knocks PhD enterprise environment like PwC. Like there there are a lot of things that are commercially useful. Like it wasn't like I was gonna go be a poet. Right. So

I and I d you know, I don't know. I just I don't I wouldn't have been able I wouldn't have been good at that. And so it was kind of just like, hey, there, you know, there are enough things that came together that are that are actually like commercially interesting as as an independent business. And and by the way, I picked up a lot of skills along the way that to help me fend for myself as a you know as a founder. And so, you know, there there's just enough things that I that I'm good at i in in that area, you know, that are what is what you s what that are are what you see today.

that I I just I felt like it was something I had to do. And so that was the plan for me to come up with what is it that I could do for the next ten plus years. Like that was my objective starting out. And it wasn't what ready to commit to forever yet, but it was, you know, what can I do for a while and give this a run? And and that was this. So I I would say now, I mean, you know, this is this is probably my last job. Like after after having done this for five years and and enjoyed the process and gotten some validation, like

I don't wanna do anything else. This is what I wanna do for the rest of my

There are two there are two follow up questions I have. One is, you know, like the early days of you know, the days when you got the API key from from the open open AI founder, that was probably the worst.

Time to be a founder because things were changing so fast. Every day, every week, there was a new paradigm on how to build stuff. First it was RAG, and then there was vector search, and then there was something else. And now it is, you know, now I guess it is settling on the agentic AI wave. The second question I had for question I had for you was what were the lessons learned from that journey? You know, writing that 65,000 novel, you know, like deep introspection. What were some

the lessons learned from your point of view in terms of getting to strategy of security?

Yeah, the the answer to those or at least my answer to those two things might be closer together than what you might think. I mean, I I think we were probably even before some of the tooling that you were talking about, right? I mean, we're we're we're we're way pr way pre this is like twenty eighteen, twenty nineteen, twenty twenty. So, you know so yes it was a bad time, like heading into a pandem little did we know when we left the firm like we were heading into a pandemic, which, you know, what i I don't want to place blame there. I mean, that wasn't what caused this, it just didn't help.

Yeah.

Yeah.

I see.

You know, but but but I think like you know, we were in a time where like way pre Chat GPT, like LLMs barely worked at that point. I mean, you could go into the playground and you could get like sort of a response, but not really. I mean, so so what we were trying to build never was really around that. You know, we were kind of back in the, you know, pandas and proper machine learning and a lot of a lot of things like that, trying to build an agent. So it it was pretty primitive. So I I guess I would say the timing of that definitely mattered. Again, we didn't

know we didn't know at the time that that that all this other tech was gonna come together but I would say if I were trying to build this today it would have it would look a lot more sane it would it would be a lot easier to do you know and and and all that so it it that definitely would have that definitely would have helped. But I think what I learned along the way though was like starting a startup or really any business, but especially a startup is like incredibly hard. I mean the odds are just stacked against you from the beginning.

Yeah.

i even if you have everything working in your favor, right? And I think at the time what I you know, what I what I had to admit, I didn't know going in or wasn't willing to admit going in, but what I had to acknowledge was there were too many parts of that job that I didn't have the skill set for. Like I I I mean, yes, I I went to business school and management information systems, but like

Mm.

I'm not really a good programmer. Like I know what I want to build, I'm not really a good programmer, so it was, you know, it was hard for me. you know, could I write code? Did it look respectable? Sure. You know, but it was a it it definitely wasn't an advantage. It was sort of mitigating a disadvantage at the time. You know, and and there I don't know, there were just kind of enough other parts about the founder journey that I I wasn't really suited for, and so it didn't it didn't really work. And and we were building outside of cybersecurity. Like that's that's worth noting too. Like

Right.

Hmm.

It was a little bit adjacent to what we had done at PwC so it wasn't completely bananas, but like, you know, I was also you know, so so a person who's not really that good at writing code working in a in a in a domain that is not my core domain. Like you can look at that in hindsight and be like, well that probably wasn't a good idea, and you're and you would be right. So, you know, I I I think it's a little bit different now. I mean, I c I can fend a lot better for myself with, you know, AI coding assistance and, you know, all the luxuries that we have today, but

Thank you.

But I think like that was one of the big lessons on the way out for me was look like it it's hard to do this anyway. You have to you have to align everything you possibly can, like layers upon layers of strengths and do what is like very natural to you in order to have a chance at being successful.

I agree. Yeah, I mean it's it's very hard. There are so many, you know, you don't realize how many functions you have to take on as a founder to, you know, to scale the company. And every and every space is something that you've not worked on. A lot there are a lot of spaces that you've never had to touch upon, and then you're there are nobody else to help you out. You just have to do it yourself. One of the you know, the thing I want to touch upon is one of your greatest contributions is the mapping of the cybersecurity ecosystem. And you know, and I say that because

As founders, we're always struggling to figure out which category we belong in. And there are there are new categories coming up every now and then, right? You know, Gartner comes out with a category, Forrester comes out with a category, and then you try to figure out which category you belong in, which categories don't belong in, and so on and so forth. And you went in and you did a deep dive in terms of mapping out the ecosystem so that even if you're not like very attuned to the market, you can figure out what is the lay of the land.

And figure out where you fit. So, talk us through your journey through one of your most viral posts, I believe. I think it it draws more traffic to your website even today, com compared to all the other writings that you do. What was the what was what were you thinking in in those days? Why did you write that piece?

So this is, you know, kind of early. I started strategy security like end of summer, fall 2021, after after my like time off or my exploration time. you know, and what I what I quickly realized, again, with a heavy dose of humility, walking into this project and you know, with with some confidence, but trying to rebuild my own confidence in many ways, if I were to admit that. It, you know, it was like I I realized what I didn't know, right? Like

e even after doing cybersecurity prof very professionally at you know at PwC one of top consulting firms in the world for over a decade, like when you're out there on your own trying to cover the industry with a broad mandate, like I r I realized what I didn't know. And and and so all the things you just described about the the challenges of navigating and mapping the cybersecurity industry were were like what I realized. And so I I made that for myself.

Yeah.

Like the the plan was always to publish it, right? But you know, at the time I had the I had the time, I had the freedom to sit there and like actually put all this together. And it was it was largely for my own ability to navigate the industry or at least like quickly orient myself to, you know, where wherever a certain company or wherever a certain topic was in the industry. you know, but but ended up publishing it and that was that was definitely one of my first

Pro probably f fair to say my first big hit for sure. I mean I had written some other things, you know, that but at that point it was very, you know, very early days, like hundreds of readers, type of a thing. This has really turned into more of a project. Like it was a post, but I would say that the ecosystem itself has lived, you know, far and wide beyond the original post. And it's it's in some ways kind of like a canonical reference now in the industry.

I'm curious, was this was this intended to do a very small subset of the industry you wanted to take on? Then as soon as you dug dove into that topic you realize it's wa way bigger than that, or would would did you always intend to make it like a mapping of the entire ecosystem?

It was c more of the latter. I I I knew enough for sure to realize how broad the industry was. And I I think one of the core insights looking at it in retrospect that I was right about walking in is like

I have always had the point of view dating early back early in my career that like you need a balance of business and technical things. Like there's val there's especially like cybersecurity is a very technical industry and like that tends to be valued. I have always been pretty evenly split, you know, between the two. or at least having more of a business background than than what many folks in the industry do.

Mm.

Like I've just always been empathetic towards that side of it, right? And and one of the things that I knew walking into that was, hey, I think people are kind of looking at cybersecurity like this, like pure play cybersecurity, you know, but like in reality, there's this entire ecosystem around it, especially if you were go to go to, you know, capital markets, you know, vent venture venture capital, private equity, you know, all that. Like e I mean, even equity analysts who cover the industry or

You know, you it within the industry you have all kinds of GTM people and and you know other functions of people who work within the industry, but they may not call themselves like cybersecurity people per se. And and I just I just felt like that needed some recognition because that like that's a major part of the industry. Like if you I've never actually run the data behind that, but like if you were to look at the number of people sitting in each of those camps, like you know, very technical, employed by you know, cybersecurity professional.

Mm.

would recognize themselves as such versus another discipline that happens to be working in cybersecurity. There's tons of those people. And and I just felt like that was a good like that all comprehensively needed to be accounted for. And so I was trying to go like both really wide and fairly deep. And that's why, you know, in some ways this thing is as gnarly and as overwhelming as it looks, is because that was on purpose. It was not to try to abstract away the the complexity

Well exactly.

Mm.

It was to it was to actually say, Hey, like, this is how complex our industry is. I want you to know that. Let me just give you a tool to help you navigate that complexity.

And it seems like you have this natural tendency or a natural pull towards a good strategy. Once you see a good strategy, you get naturally drawn to it. I I believe you wrote about the one password blue ocean strategy. And you know I think that even that went viral. Right. And you you look at you you you study all these companies, you see when you see a good strategy, you just latch onto it and you write really well about that strategy. So I'm curious, like how did that play?

out the blue ocean strategy from one password. That was I believe that was one of your vital posts as well.

Yeah, that was probably the that was probably the second really big hit. you know, so that that that I that one I sat down and probably wrote over the course of, you know, s I don't know, sixty hours over a couple of weeks in the frozen tundra of February in Minnesota, in in early twenty twenty two. It you know, it was I don't know, it was just it I I'm very much a student of strategy. I mean, you know, again, that was like one of my emphasis in MBA school, along with like the technology side of that and you know, kind of

Back to undergrad. So, you know, I've I've always I've always cared a lot about strategy. That's one of the main orientations of what I like to write about. I just think One Password is fascinating business, right? I mean, you know, again, this is this is like fresh off of their Series C, you know. But long story short, you've got a company that's been around at at the time for like 15 plus years who had hardly raised any capital and was at hundreds of millions of dollars of business.

Yeah.

And I you know had a very unique brand, just a very unique story in the industry in general. And so I I felt like it was very undercovered. And you like I the funny thing is I find this all the time now. Like like there are a lot of great companies in cybersecurity, including some pretty big ones, that like just have not had people cover them at the level of depth that I think you know, that that I think they're worth. And and that was the first time I really did that. Like I would say that was my first really serious attempt at like taking one company and really going

Yeah.

This is same

You know, super deep on it. But you know, they yeah, that article that article was huge. I mean, I heard from all corners of the internet on that one, including people who I never would have expected to read myself.

And the and the funny thing is if things are going well for you as a founder, you don't you don't re you don't really need all that recognition anyway, because you know, you have your rev you have revenue, you have customers, you just you know, you're just scaling your good go to market and br you know and just scaling the revenue from there. And the other aspect that you write a lot about is the earnings transcripts. And you know, the the one of the reasons I gravitate towards your writing is, you know, if some if some of the some of the some of the analysis that you write, especially

In the space that I've worked in. If I wrote it, it would be this guy is an insider, he knows about these companies, he's worked at these companies, no big deal. But you write with the same level of clarity as an outsider, with the brutality of like a grand chess master. Like you, you, you have there is there is a level of honesty in there. When I read it, it rings true.

especially for the companies that I've been at, and I'm like, how does how does like Cole write so clearly about and that's why I trust other the other writings that you do, because I, you know, if you do well in the space that I s at least I claim to understand really well, and you write really well on those topics, then it's a good proxy that he probably writes really well on the other topics that I don't understand really well as well.

Yeah. so I you know, I definitely try to as far as like scope of coverage, I mean I I tend to focus mostly on like the later stage or the public, you know, public cybersecurity companies like later stage well funded, you know well funded companies that are pretty widely known. And then, you know, I I do definitely spend some time covering startups, but it tends to be like markets of startups. So, you know, w once in a while there'll be one that is really interesting that I just cover on its own, but like

Yeah.

I the on average it's probably like a group of startups in, you know, an emerging an emerging industry or one that I can definitely see a lot of activity around and try to draw the strategic themes from there. I think on the on the approach part, like on one hand I'm Midwestern, right? And so Midwestern people are pretty polite. I've grown up in the Midwest for the whole time, you know, my entire life, and so

Minnesota is the capital of passive aggression. There's probably some of that that I've channeled. you know, so it's it's not I try not to be overly critical, right? So I don't I don't wanna go out and just tread a company

You're very honest you're very honest in your writing, you say it

Ye yeah, I think there's a difference between there's a fine line between being critical and being honest, right? And so like I I don't want to be critical just for the sake of being critical and you know, there are probably times where like privately I would criticize something, but like I'm just not gonna do that in public because I don't I don't wanna intentionally eviscerate a company just because I can, right? But at the same time, like I think there's i i the other end of the spectrum is like I can talk to you positively about something and make something look better than what it should.

Yeah.

Mm.

I'm probably guilty as charged of that, but I would much rather sit on that side than like being critical just for the sake of getting views. I think in the middle though, and what you're getting at is like there's this level of intellectual honesty in there where and and I think I think if you were to just reflect more broadly on strategy, right? Like the only way to be good at strategy is to be brutally honest. Like even if you even if it doesn't, even if the final product doesn't come out that way, like the thinking behind it needs to be brutally honest.

Right. It's it's it's really hard to do strategy well if you're lying to yourself or your client. Right. And so that's kind of where that's where it's it has to be is just the recognition and the maturity to know like, hey, this is going really well, here's why, or that hey, this is not going very well, and here's why. And and and and then I can kind of craft the message around that, right? But but sometimes in analysis, like it has to be blunt. It has to just be like, look, I don't think this working. Or or I don't think this is going to work. And it's and and that's some of the responsibility that I

Mm.

have is like people take what I say seriously, good and bad. And so I I cannot put lipstick on a pig, so to speak, when I shouldn't.

Hang on. What's let's let's let's switch gears. I want to talk about I want to talk about the state of the union for cybersecurity, cybersecurity media. My sense is a lot of it is pay-for-play. So as a result of it, you never know what is true, what is not true. And someone l someone like you shows up with a dose of honesty, it pulls the readers towards that kind of media.

in terms of you know trust, honesty, rigor in the research and so on. What do you think is you know, is good or bad with the current state of the union for cybersecurity media?

I you know, I think in some ways it's never been better and never been worse. And I know that that that might be a that might be a contradiction. I you know, I I I think never been worse is probably along the lines of what you're saying, right? Where I and and I think that that goes up and down, right? I mean I you know, I think I think I'm certainly not in the, you know, big analyst firm, you know, Gardner Force are gonna die camp. Like they'll they'll be around forever, they serve their purpose, they do what they do fairly well. I mean

the stock price is what it is and I think they have challenges. But like they're they're resilient businesses. They've been around for a long time. They'll figure it out. So, you know, I think I think they have their role, right? And I and I just yeah, I mean I can understand why people, you know, have distrust in the media and why or the cybersecurity media and and like why some of the pay for play aspects of both large and small firms can be challenging to navigate.

The the thing that I think is good though, and again, you know, again, this is just me kind of reflecting on my own five year journey as a as a independent person. Like I think five years ago when I was starting this, it was kind of just starting to become possible to do this as an independent discipline, right? Like there there really weren't, you know, there were some people, I guess, I mean, you know, there you have the the the OG people like Richard Richard Stenon who have been out here doing this for a long time, but you know, for the for the

Okay.

Yeah.

for for the rest of us mortals, it it was kind of a new a new thing. And so, you know, I that was kind of a small bet that I took at the beginning of this was like, hey, I think I think through the combination of, you know, the the publishing platforms out there, like late I mean, little did I know like AI would come later. That would be a lot more helpful. and I think more just the climate. I mean I think I my sense was just people were more receptive to listening to independent people than they ever really had been before.

So, you know, I think I think that's been really good. Like it like it's it's you know, it's been an amazing journey for me to be able to be independent since day one. I've you know, I've had the opportunity to write about a lot of things I really like. I have amazing clients, like it all it all just works. And like there's a a small cohort of like my peer group, you know, Chris Hughes, Ross Halluc, Francis Sodom, James Rohti. Like you could name a a few other people who have all

Mike Forvet, you know, who have all kind of started around the same time and have all been able to do, you know, their part of it. And so I think that's cool where like it the the punchline is like it can all coexist. I like I think it's really neat where like none of us are sitting here trying to take down Gartner. Like that's just that's not that's not what this is. It's like there's just room there's more room in the industry for more voices. And I think you know people people like to hear from that. I think that that's been a fun

The the follow up I have for that is do you think these hefty fees hold on?

Follow up to that is I have is do you think these hefty fees are sustainable in the age of AI? if this high quality work gets done by independent media, you know you are leading the charge, you're one of the people leading the charge on that. Do you think these hefty fees are sustainable? you know, given the amount of research AI agents can do, AI analysts can do for you, or does it not matter?

I mean I think I think the people who I I think it's kinda gar Gartner's kind of like an annuity, right? I if if by hefty fees we're referencing like the the original old school analyst firms, like i I think it's gonna continue to exist. I mean, is their business gonna grow like wildfire? I don't think so. I mean it might, you know, even slowly decay, but I think it's always gonna be around. I I think no matter which size of firm you're looking at, like as a person who's spent a lot of time

using I mean doing all kinds of research, including AI research, you know, for for my own work, like the one thing that's always gonna matter, or at least will matter for a while, that I think may always be durable is human judgment. Right. I I'm I'm still pretty surprised by how often even you know frontier AI and or you know agent tooling gives me back something that's wrong. Like like

And for a person who has a really high quality bar, or at least enough, enough intuition to know like, hey, this isn't quite right, I'm surprised at how often it's wrong. Like nothing will teach you, n n n nothing will be more eye-opening about how wrong these things can be when it it like when they go out and they find like like they'll go out and find my own research that I did on something and they'll reference like a strategy security post.

I see.

And it'll return like like this happens with public companies all the time. That's like oddly, I I mean I've written about it, I've become sort of like a a a semi-go-to person in aspects of that. Like I'll be doing public company research and it will return my own result back to me, not knowing that I wrote it. And I'll be like, this was wrong, or this is this is like outdated, it has changed, and I should really go back and I should really go back and clean that up. Or like, it would have been nice to add this as well. You know, so so it's it's stuff like that that makes you realize pretty quickly that like.

Did

Yeah, these things are really good and they're fun and I love them and and I w you know I I would use them all day long. But like you gotta have a human with some judgment on the other side of that or you're gonna go sideways for

Has it ha has have the new tools changed the way you work? Has it resulted in creating more work or is it has it resulted in doing much more impactful work for you?

I I I'm still working harder than ever. Like they definitely they they they save time on a lot of things, but they, you know, don't save time on other things. I think the way that I would put it is like, you know, there there were probably aspects of manual research gathering that I was doing at the beginning of this that like aren't really valuable for me to do. Like like like my unique judgment is not around gathering research. It's it's probably like steps after that.

Okay.

Right. Or in some so in some ways they've probably improved that. Or like they can take a broader swipe faster. And like I have also learned how to direct, you know, deep research to be able to to find things or or filter things better than what you know, better than what I could have or you know, they would undirected. You know, so I think in that sense it's been really good. or or that's that's taken away some work. But but I think I think the flip side of it is is is it's also opened up some possibilities that were that

were never there before. Like there are some things that I would code or things that I would analyze or pieces that I would write now. You know, like a good a good example just to put a practical thing behind this is I I did this piece at like when doe when DOGE was kind of kicking in and there were a lot of concerns in the industry around you know funding cuts and what's going to happen. You know, what's what like what's the trickle effect of that going to be in cybersecurity. Like

I realized that nobody had really unpacked like that entire funding tree and like how things flow down. And you look into that a little bit and it's like, this is pretty complicated. And and it's it it actually like takes a little bit of thought to figure out what might happen there. And so I didn't really know a lot about this. I mean I've wor I've worked like in the public sector a little bit, but not I would never consider myself to be an expert. I mean, certainly not at the level like a Chris Hughes or somebody like that would be. You know, but but I just realized, you know, hey, I think I could actually probably figure this out. It's just sort of

blood, sweat and tears thing where if if I just, you know, pound on deep research for a couple of weeks, it'll probably give me back something pretty sensical. And you know, and it did. And so I did this entire like, you know, mapping of like where a lot of funding is coming from from different parts of the the federal government and, you know, put out a fairly well regarded research product. Like, you know, but when Brian Krebs was chiming in on it, I was like, okay, we did something here that, you know, that that that people thought was good. And

How do you how do you know something has gone viral?

You know, and if if you've if you've re if you've written like l let me put it this way I've done a lot more, you know, the it's the math always works out, right? Where most of what you write will get like some kind of reaction. Like I don't write to the void very often anymore. You know, but but but I I know what like kind of an average thing looks like. And and then there's just kind of this feeling that you get. I've just done it enough times, or or this feedback that you get of writing something that's better than average, or or for sure way better than average.

Yeah.

You you just know. I mean like like either other people go ahead.

So I think what I wanted to say when Nikesh I think there's one of the things which when Nikesh Orora says something So so how do you know something has gone viral?

I can go back to that. I can go back to that. Yeah.

I mean one example like when when Nikesh Aurora chimes in on something that I've I've written, which has happened four or five times now. so it's you know, he's not afraid to engage with with anybody, including you know, including the independent people. I I I will say I've got a pretty good I think I've got a pretty good good batting on batting average on that so far. I'm probably three for four or four for five on him, you know, chiming in and thanking me instead of him chiming in and trying to rip me apart. but

But

But that's what that's when you know is when you've got you know, when you've got like well known figures in the industry chiming

And the one thing I like about one thing I like about your writing is you're not in this ambulance chasing mode. There are there are two modes, at least from my the the way you break into my feed is one is one is you write about areas that you're you have competency in. So something you know an area that you re know really well about and you you are very methodical in choosing about writing about them.

And the second p the pieces that that come through my in my feed at least are when you don't know anything about it and you do a deep research. You go in like like the DOGE thing. You d you didn't know a lot about, but then you take the time, the blood, sweat and tears, and then you you go deep into that topic, write about, you know, and you add your spin to it, your analysis to it, your research to it, and then it then the the the end product really shines through.

Yeah, I have a pretty high bar for quality in general. I mean, that's something that I I've always held in high regard, even well.

And you have to right. I mean, as an independent writer, you have to have a very high bar for

You don't have to. I mean, I a lot a lot of what you see, I mean, that's probably one of the things that you you know, if you were back to your criticism of like things have never been worse, right? Like anybody can write things on the internet now, right? And and they and they do sometimes. And so, you know, I I I I think that that's, you know, strategically and and just personally, I mean, again, this is this is a personality trait, not necessarily a strategy. It just trigger it translated into that. But like, you know, I I I I think when you've been through the

The

the PwC the PcW boot camp, so to speak, you you just you have a different appreciation for what like an extremely high level of quality is and then I think I'm also, you know, my my mom would say that I'm a perfectionist. And so I think you put those two things together and like that's what I've always tried to do. And so, you know, that that that's probably a feature and a bug, I would say like what I what I write, you know, I'm I'm sometimes I get it wrong. I mean and I've been called on that before it happens, but like

What I write, I try to try to produce at like a pretty high level of quality. But like the flip side of that is there's probably things that I should or could write about that I just don't either because I don't feel like I know enough about it just yet, or you know, I just haven't had the time yet to put in the the research to be able to hit a point where I feel like I should write about it. That's what I'm trying to work on now, is like, you know, can

Can AI, can experience, can like combination of several factors like get me to the place where I can increase the volume or incase increase the breadth like just a little bit? That I think that would be a good place.

I'm curious, do you strive for a unique perspective? Like you know, something like I don't know if you have read about the Glasswing thing or the Mythos you know, everyone has opinions, everyone has like a lot of opinions on it. When you see something like that blowing up, do you strive for a unique perspective? If and if you have one, you come and write about it, or you just l leave it at that. If there is nothing new you can add to the conversation, you just leave it? Did does that play into your thinking as you're thinking to write about some of these things?

yeah, that's it's something I debate every day with whether I whether I cover, you know, the news or whether I cover something that's a little bit more evergreen and durable. You know, I I mean the Glasswing thing's a pretty good example, right? Like I that one I did decide that I was gonna chime in on. Sometimes I just will keep the bat on my shoulder or, you know, sit it out. But you I don't want I don't want to sit everything out either, right? I mean I don't think it's I I think there's times where I r I I feel like I should chime in and people are expecting me to and they want my perspective and so I do feel some obligation to do that, but like

Yeah.

Yeah.

There are other cases where it's like, hey, you know, there there are other people who are better off covering this one than me. You know, the the the Glasswing one is probably an example where it didn't work out very well. Like I I debated whether I should chime in at all. You know, I kind of convinced myself to do it. I ended up writing by my standard would be like a fairly mid analysis of it, or I think I took the wrong a little bit like the wrong approach of the marketing and partnership aspect of it and and when you know, the the vibe of the industry was clearly against the marketing aspect of it and I should have known better. And so

Hmm.

Yeah, yeah.

I didn't really get blasted, but it wasn't really a good post either from a performance standpoint. So, you know, I don't know. It i you just you gotta pick and choose and it's okay.

One of the reasons you started strategy of Security is to cover the commercial side of cybersecurity. you know, you wanted to marry the commercial to the business and the tech side to bring in that complete analysis in strategy of security. So I want to switch gears into talking about the commercial realities of cybersecurity. my my question is like

What is what is some of the biggest f mistakes like early stage founders make when they're trying to navigate the cybersecurity ecosystem from your point of view?

Yeah, this is like somewhat drawing back to things I alluded to in the earlier part of the discussion around you know the ecosystem and like my own journey as a as a solopreneur, as an entrepreneur, like

I see a lot of companies, right? I mean, my job is to sit here, you know, although I focus on some of the later stage, like I see a lot of companies, and especially in some of my client work, especially for M&A, like I look at a lot of I look at a lot of companies. And so, you know, I what what worries me all the time is when I start to see a lot of companies in one space, just because it just because that seems to be like a space that either there was

Yeah.

A reasonably successful exit, and then people will say, well, there can be another successful exit, or they take that as a signal, and you know, then they want to get into it. Or, you know, maybe worse yet is, hey, I'm not really a cybersecurity person, but cybersecurity seems like a really hot industry. I'm gonna go do a cybersecurity startup. you know, I d I just I I think that I think that's really hard. I mean, again, I think it's so hard to start a startup anyway. And I think that

Hmm.

walking into it with you know things working against you like, I don't have that much domain knowledge, or hey, you know, I I I I worked in cybersecurity, but it was really like this one, you know, maybe I was an identity person, but I'm gonna go start a vulnerability management startup. Like you y you probably shouldn't. I mean, I'm sure there's cases where it's it's worked out that way. And it's not to say that you have to be, you know, an absolute insider to be able to to do this, but

Idiot.

I do think if if if if it's just hey, I'm gonna I hey, I wanna start a startup and then I'm gonna figure that out later, like like that was that that's probably a tough way to do.

Do you do you see like an unhealthy pattern? You know, you you talked about this this the VCs backing the same types of companies in a category. Do you see that there is an unhealthy pattern where the the well funded VCs are jumping into the market, spending two dollars to gain one dollar? How does that how does that impact the cybersecurity market from the way you see it?

Yeah, I mean I definitely think there are, you know, there are case I I don't know what I don't even even know what the term is. I mean there probably is a term and I'm probably not using the right one, but like blitz scaling for cybersecurity, right? Where it's just, you know, we're gonna w I I mean not to point fingers at Wiz, but like to to follow kind of a Wiz like model or, you know, models from like other other parts of the tech ecosystem where it's, you know, hey, there's

There's this market that that that is gonna be really hot and like we're gonna just pour a ton of money into it and we're gonna go, you know, buy customers or, you know, even jump into like shady aspects of customer acquisition where, you know, I'm gonna buy them vacations or whatever it takes to be able to get a customer. Like I it's you know, can you win that way? Probably. You know, is it are you playing with fire? Yeah. I mean, it I don't know, it just doesn't match my definition of like what a good durable

business is and and I I think that that's definitely like a concerning anytime that happens it's definitely it's definitely concerning. I mean again like you can probably get away with it but is is that healthy? I don't I don't think so. You know, I I'm much more of a fan and and I try to cover like companies that are, you know, very, very durable, like the one passwords of the world or you know companies like that who have

Yeah.

you know, gone through this this very long journey, you know, to get to where they are. And not not that growing fast is the problem. I mean, there are companies that, you know, that just find fit right away and they do really well, right? But like I just think when you're trying to artificially do that by throwing money at the problem and like crossing boundaries, I think I think that's that's not good for us.

There are two there are two ways to look at it. One is there is an influx of there is an influx of new companies trying to trying to gain trying to gain market share, trying to grade market share, ride the AI wave and so on. And the second way to look at this is, and there is a lot of fear around this, there is a lot of F.U.D. around this. Well, all these I cybersecurity companies are going to die. Like so so one narrative is the future is so good, you don't have to work anymore.

Elon Musk is you know the work will be optional. Like work will be optional. And and the second narrative is all these companies are going die. You know, give the money back to the shareholders, you know, shut shut this shut them down. Where do you land on these on on these two diverging points of views?

Yeah, I mean I I'm probably in this interesting position where like I've been doing this for long enough to you know not be a curmudgeon but at least like remember what it was like or have seen enough things to be skeptical. But then I'm also young enough where I'm like using all this stuff and like really optimistic about the future. And so it's it's an interesting existence. It's an interesting time to be alive for sure. I'm definitely not I'm not in the camp at all of like AI is gonna kill these cybersecurity companies. I mean c like come on. I you know at PwC I've seen people

Not even not even crowd strike. Not even crowd strike.

CrowdStrike's an amazing business. Palo Alto Networks is an amazing business. You know, I I don't know. I mean there you know, there's life cycles of companies. I mean the names may change, but like no, cybersecurity is the industry is not is not going away. I I mean I think there are things that are gonna change. Like our businesses certainly have to adapt. You know, I mean and and you you can even see with CrowdStrike. Like there there were endpoint security companies before CrowdStrike, but CrowdStrike brought cybersecurity to the cloud and that was kind of their, you know, core innovation or or you know, but like

Yeah.

C Mention.

George Curse knew what was doing. Like that was very intentional. And he had been sitting there waiting for that opportunity for a while and built the company that he wanted to build. And, you know, and it worked out. But like, you know, no, AI is not going to kill all these cybersecurity companies. Like, you if you if you tie this back to a much, much broader trend, like, very long discussion short, any era of technology that has happened, like you can follow Mary Meeker's pattern all the way through. You know, she's kind of the famous VC that characterizes these.

these technology eras, like and even even before what she would have covered, like, you you just see that security was always an afterthought, right? And and sometimes it took decades for security to enter the equation.

Even AI even in AI, security is an afterthought. Now everyone is thinking talking about GRC for AI, visibility into AI, what are these agents doing? Every aspect of that. I don't think security has been thought through and now everyone is thinking about security for AI as well.

Yeah, I mean I think they're I think the the cycle is getting tighter. Like you could you know, you could probably make the argument a little bit more recently that like mobile kind of got addressed right away and th and there you know there were really never like a huge exit in mobile that came out of that because they were it was a little bit tighter. You know, is is AI perfect in security? I mean, you know, no. Like like Anthropic just had two problem two self-inflicted problems last week. You know, so so there's there there there's definitely work to be done there and their incentives are still aligned towards

Mm.

Competing and building Frontier A and all of that. You know, so I would say they're a little bit more mindful of security in the than they ever have been, but like the the the service area of that is also way wider too. I mean, there's just so there's so much more and it's it's it's mo it's a much bigger shift of a paradigm that I think there's gonna be plenty. And and I think the l the last point on this too is like even if they do get good at security, right? Like you can kind of trace this back to even like cloud security or endpoint security or whatever, like

Guess what? Microsoft eventually got into the endpoint security market and has a multi-billion dollar business there. Like all of the major cloud providers have cloud security businesses. Like by them getting in that market, did they just wipe out everybody else in you know that was like a pure play cybersecurity company in that space? No. Like they're gonna get their pound of flesh, but they're not gonna wipe everybody.

What class of companies will die because of AI? What what categories in in the sense like what would be the form of those companies that fail to I guess tr fail to innovate will f you know, die in the age of AI?

I'll give like a very like paradigm-based answer on that, I think is the best the best prescriptive answer I can give there. Like I think if you just had a good SaaS company and then you just say we're gonna leave it at that, right? Like we're not gonna we're not gonna really bake AI into the product, or if we do, it's gonna be pretty mid AI, like, yeah, our chatbot is super innovative. you know, our co pilot is very innovative, like then I think you're probably in trouble.

Right. I think if you just kinda sit on what you did, you know, or or I I don't know, maybe this will happen with some of the PE back companies that are trying to cut costs. But like I I think if you if you don't really take AI seriously, if you don't have the imagination to think like what would be different about my product, and what and how would my customers use it if I had, you know, a v very very advanced AI. This is kinda along Jason Lemkin like SASR thinking in this category that I thought I've always thought is really good of just

Mm-hmm.

You know, you you're probably better off trying to build you're you're better off trying to build the best agent in your space within your existing company and within your existing customer base. Like that is a huge advantage versus like trying to start that from scratch. Of course there'll be companies who will be started from scratch. I hope yours is one of them, that you know

Yeah.

felt like it was better to be outside of the space that they were in and and the companies that are established there and like you just gotta be on the outside and rebuild from scratch. But I think that a lot of the companies in cybersecurity that do well are gonna like have a very serious reinvention and come out way better

Yeah.

And then you know, we talked about we talked about in a companies dying in AI. What ha I mean, I'm also seeing a lot of careers dying in AI. So what do you think is the future, what do you think is the future of cybersecurity professional in the age of AI?

I think it it it it it leads you to be a little bit more of a generalist, I think. I mean not that there's no room for specialists, but you know, I I think the the i i I'm sort of self reflecting here and answering my own, you know, career evol evolution in some ways. Like, you know, I've just always been a generalist. I'm just I've just I I'd I'd I I'm interested in a lot of things in cybersecurity. I have some domain expertise, you know, but I also I'm interested in things outside of that or at least like broader tech and business and strategy. And so

Yeah.

You know, it I I feel like I've never been better. Like I've never had more fun doing what I'm doing. Like I I I just thoroughly enjoy this. And I've probably never done better work and I hope that it continues to get better because of AI, right? But it's it's been like a very serious reinvention, you know, e even dating back to like when I you know when I started this and re and reflecting and then you know and then what AI has allowed me to do since then. Like

You you just get you kind of have to keep reinventing yourself. I mean, I don't I don't mean to sound like trite about that, but I I think that it's i i i i if if you're just if you just kind of accept the reality of like this this this frontier AI is gonna keep getting better and like the tools are gonna change week by week and I'm just gonna have to continuously reinvent wh who I am and what I do as a professional, like

You're gonna do great. Like like you're get you get more leverage by the week. Like like like everything just keeps getting better. Like what you can do more is better. What you don't like you can get rid of. Like it's just it's an amazing existence. But I I think if you know, un un unfortunately from my point of view anyway, like we do have this camp in the industry of like AI is terrible and I d it should go away and it needs to be regulated and I'm not gonna use it and like it's completely useless. And like I I don't know about that either. Like there's

You know, there's been some I there's been enough tech trends that I've lived through that like, okay, yeah, this was a nothing burger and they really were pretty useless, or at least they didn't match the hype. Like, if you use if you use Frontier AI and Agents for like twenty-four hours y and you don't see how this makes the world meaningfully different, like I don't know what you're doing. It's it's so it's so much fun. It changed it's like my work is different in Janu like since January 2026.

I've completely reinvented the way that I work. And and and I probably reinvented it like before that, right?

Huh.

Wow, how what changed in January twenty twenty-six?

I don't do anything without an agent anymore. Like almost nothing.

What's your what's your go to agent?

It's i I kind of like have open claw plus at this point. Like you could look at that as like an aggregator of several different tools underneath that. You know, so that being like coding agents and you know perplexity computer turns out to be really cool. Like that does some good research and just you know, it you kind of have to insulate yourself against that, right? Like on one hand, some of you know, some s like Claude code has been my go-to for a long time. Like I r you know, I really like that as a as a tool and it's a really good one. But like

There's always new stuff that comes out too. And so you, you know, without having to like reinvent your stack all the time, it was nice to be able to have this like aggregation layer that at least allows me some level of consistency, but then, you know, be able to try and like swap different parts underneath it as well.

Super interesting. Cole, this has been an amazing, amazing interview. You're way too generous with your time. Your insights are fascinating. What's what's next for Cole? What's the next big thing that is dropping from Cole Grolmus

Sleep. definitely definitely the the next big thing will be will be will be much more thought out because I will have slept much better because the baby is closer to making it through the the night. but no, I mean I'm sort of serious about that. That definitely that definitely would help my cause. But you know, I I mean I think it's again, I think it I think it's like an amazing time to be alive like I've been gutching about here. Like I've never had more fun.

At work and I've been doing tech for fun since I was like twelve or or or younger. You know, I just I think there's never been a better time to be doing this. I think we're, you know, in some i albeit in like a terrifying era, I think we're also in an era that we're all gonna reflect very fondly on and be like, wow, this was like a really amazing time to be to be working in. And I I I try to appreciate that. Like again, I've done this long enough that I think I remember what it was like before then.

My kids are just gonna take this for granted and they're never gonna realize the era that you know that that we grew up in. You know, so I'm I'm trying to enjoy it and I'm I'm trying to but I'm also hopeful like that I have a long time to be able to continue.

Awesome, awesome. Cole, thank you for joining me on the series. This was an amazing interview. let's check back in in a year f year from now and see how much you have progressed with your AI agents.

Yeah, we'll see. Thank you.

Thank you. I'll stop the recording.