Sign up for my newsletter to see more interviews with the biggest names in cybersecurity.

This week I was lucky enough to interview Stuart McClure.​ Stuart is the founder and CEO of cybersecurity firm Cylance and is a cybersecurity veteran. Stuart previously founded Foundstone (sold to McAfee for $90mm), started Ernst & Young’s security consulting practice, and was McAfee’s CTO before he left to start Cylance. Additionally, Stuart is also the creator and lead author of Hacking Exposed, the most successful security book of all time.

In news this week, the biggest theme was the prevalence of insider threats. A large proportion of cyber attacks can be attributed to human error on the inside.

I’d love to hear any feedback you have on the email and thanks for being a part of it!

(Drop me a note if you no longer want to receive these emails).​

There have been a lot of prominent figures in cybersecurity that have criticized the larger players like Symantec and McAfee for being too reliant on ineffective technology such as the antivirus. As McAfee’s former CTO, do you agree?

• Absolutely. There’s not much innovation with the larger players. There’s an unconscious dependency and need for survival on the past and since I’ve been in security, technologies like the antivirus have become less and less effective. This has severely hobbled their ability to make inroads and grow the industry.

You guys are the first “math-based” cybersecurity company to detect and prevent attacks. Can you explain what that means and how your approach is unique?

• We collect large amounts of data from trusted sources (bad and good guys) then we eliminate the “false samples.” We then run the filtered data through our machine learning algorithm and this algorithm determines the characteristics of these data that are most predictive of good and bad files. Our solution is then able to determine whether a file is good or bad with 99.9% accuracy.

Why are there not more players using this approach?

• A lot of bigger players have tried and failed. Microsoft is one example. The reason we’ve succeeded where they’ve failed is psychological; the big companies have their core businesses to fall back on when it doesn’t work out, but as a startup, we had to keep trying until we made it work or we were out of business.

How are you planning on dealing with the explosive growth of the attack surface created by the internet of things?

• Our solution is 100% portable so it can easily be applied to these devices. It’s definitely something we’re looking into.

John Hering of Lookout has said that the security industry is transforming from reactive defense, to predictive defense. Is that the thesis behind Cylance?

• We don’t let any bad files in, so we eliminate the need to be reactive.

You sold Foundstone for $90mm, you created E&Y’s security practice and you were CTO at McAfee; I’m sure there was no shortage of VCs lining up at your door when you decided to start Cylance. How did you choose Khosla, Fairhaven and then Blackstone for your most recent round?

• I wanted investors that I got along well with and that really understood my vision. I really liked the Fairhaven team and I met investors at Khosla and Blackstone through introductions from Fairhaven. I wanted investors that understood how to build a company from 0 to $1bn. There are a lot of investors that understand the broad strokes of building businesses but when it comes down to nuts and bolts decision making, they don’t get it.

How do you look for VCs to add value?

• The biggest way that a VC can add value is by getting me in front of the key decision makers of potential customers. I also look for patience from VCs. They need to understand that building a company takes time.

What’s your vision for the company?

• My vision is to take over the industry. I want to have the most effective solution for protecting exploitation at the end point. Currently companies have something like 10 layers of cyber defense. Why? Because each layer is only 10% effective. I want to be the only layer that they need.

New Research Shows Businesses Not Prioritizing Growing Insider Security Threat

• Survey shows that 73% of hacks that occurred in the last 12 Months attributed to Internal Sources. The insider threat should not be underestimated.

Security Think Tank: People and process remain the soft underbelly of banks

• Human error-not machine error-is a big cause of cyber attacks in financial institutions. Compliance doesn’t imply security but it’s a strong step forward.

Balancing Security and Usability

• A five part approach to tackling one of the CISO’s biggest dilemmas.

Raytheon Rumored to be Buying Websense for $1bn

• Websense is currently owned by Vista Equity Partners who took the company private for $907mm in May 2013. The acquisition comes after Raytheon passed on Blue Coat who was sold to Bain Capital last week for $2.4bn.

Interset Closes $10M in Funding to Expand Advanced Threat Detection Platform

• Interset aims to reduce the time it takes companies to respond to security threats by helping them detect and prioritize risks.

Pinterest Introduces Monetary Awards for “Bug Bounty” Program

• Pinterest has started paying researchers who can find vulnerabilities on pinterest.com $25-200 per bug that they discover. Interesting way of crowdsourcing security tests.

Website Hackers Slip Under The Radar With Impersonator Bots

• When it comes to web threats, bots are the preferred tool of today’s cyber criminals; more than 90 percent of all cyber attacks (e.g. DDoS attacks, web application threats) are executed by them and impersonator bots are the elite commando unit of bad bots.