Building a Cybersecurity Startup: Lessons From Illumio CEO Andrew Rubin

In 2013, Andrew Rubin and PJ Kirner founded a cybersecurity company called Illumio on a thesis most of the industry wasn’t ready to hear: perimeter security alone would not be enough. Breaches would become inevitable, and organizations needed a fundamentally different approach to containing them — a category now known as microsegmentation.

Thirteen years later, Illumio has raised $557 million, reached a $2.75 billion valuation, crossed $100 million in annual revenue, and serves roughly 20% of the Fortune 100. On episode 88, Rubin reflected on a journey that included years of doubt, a co-founder’s departure, and the long wait for a market to catch up to an idea ahead of its time.

Start with the problem, not the ambition

Rubin didn’t set out to be an entrepreneur. “I didn’t wake up one day and say, I want to be an entrepreneur. I woke up and said, I’m passionate about this. I see the world changing.” The problem was specific: perimeter security had been the default for decades, but its track record was deteriorating as breaches got bigger and more frequent. Rubin and Kirner recognized organizations needed a way to contain threats that got past the perimeter. His background in sales engineering and product management at an intrusion-detection company gave him the market’s architecture, buying patterns, and failure modes well before writing a business plan.

The perimeter was always going to fail

Illumio’s whole thesis is the one that echoes across so much of modern security: the wall around the office can’t hold, so control has to move inward. It’s why an attacker who reaches a single unsecured printer is already inside the trust boundary, why browser security became the new control point, and why identity, not infrastructure, is the real boundary. Microsegmentation was Illumio’s answer — contain the breach so one foothold doesn’t become full control. Today 70% of security professionals call microsegmentation essential for zero trust, but only 5% of organizations have implemented it; Gartner projects 25% by 2027. The market Rubin identified in 2013 is now crossing from early adopters into the mainstream.

Timing is the variable you don’t control

Illumio spent its first years in stealth, and Rubin estimates it took seven to eight years to reach the inflection point where it felt like a durable business. He’s explicit about timing: “Those two words — luck and timing — when you use them in this context, are totally interchangeable. Your luck is your timing.” The hard work and perseverance are table stakes; what you can’t control is whether the market is ready. “When you ask your new technology to be adopted by a market… what you’re actually doing is asking other people to change their behavior. The technology is the easy part.”

Crossing the chasm

Rubin credits Geoffrey Moore’s Crossing the Chasm as central to Illumio’s strategy — the gap between visionary early adopters and the pragmatic majority where products either break through or die. Illumio’s early customers were financial services and large tech, historical security early adopters. The signal that the chasm was being crossed: “All of a sudden we saw airlines and transportation and logistics… Suddenly we were selling to commercial enterprise.” Cybersecurity has an inverted-chasm wrinkle — large enterprises with sophisticated teams adopt first, and getting to mid-market and SMBs is where many startups fail.

The hardest moments, and the proudest

The hardest single conversation was when Kirner decided to leave. The two had been “brothers tied at the hip,” but Kirner wanted to return to early-stage building, and Illumio had matured past that phase. The other constant difficulty: letting people go “never gets easier and is always going to be, at a human level, the hardest part of the job.”

Rubin’s proudest moment wasn’t a number. “There was a moment where we woke up and realized the company was bigger than any of us. If for whatever reason I was not at work tomorrow, Illumio is Illumio.” Getting from early fragility — where losing one team member could threaten everything — to institutional resilience is, in his view, the defining achievement of a startup that survives.

Lessons for founders

Rubin’s thirteen years distill into principles that are practical rather than aspirational: fall in love with the problem, not the ambition; find a co-founder who complements you; accept that timing is the variable you don’t control; study the adoption curve; build for resilience, not just growth; learn from every mistake and try not to repeat it; and remember that selling — recruiting, raising, closing, explaining the vision — is not a dirty word. For technical founders uncomfortable with that last one, his advice: “I don’t think it’s about becoming a salesperson. It’s about rounding out the skill set to get comfortable having both sides of the conversation.” It’s the same reason we help technical teams turn security into something that closes deals rather than something that slows them down.