Building a Cybersecurity Startup: Lessons From Illumio CEO Andrew Rubin

In 2013, Andrew Rubin and PJ Kirner founded a cybersecurity company called Illumio on a thesis most of the industry wasn’t ready to hear: perimeter security alone would not be enough. Breaches would become inevitable, and organizations needed a fundamentally different way to contain them, a category now known as microsegmentation.

Thirteen years later, Illumio has raised more than $550 million, was valued at $2.75 billion in its 2021 Series F, crossed $100 million in bookings, and counts roughly 20% of the Fortune 100 as customers. On episode 88, Rubin reflected on a journey that included years of doubt, a co-founder’s departure, and the long wait for a market to catch up to an idea ahead of its time. Two threads run through that conversation, and this post follows both: how the company got built, and the security idea underneath it, which turns out to be a plan any startup can borrow.

Why did Illumio bet against the perimeter in 2013?

Rubin didn’t set out to be an entrepreneur. “I didn’t wake up one day and say, I want to be an entrepreneur. I woke up and said, I’m passionate about this. I see the world changing.” The problem was specific. Perimeter security had been the default for decades, and its track record was deteriorating as breaches got bigger and more frequent. Rubin and Kirner recognized that organizations needed a way to contain threats that got past the perimeter. Rubin’s years at Cymtec Systems, an intrusion-detection company where he ran sales and later served as CEO, gave him the market’s architecture, buying patterns and failure modes well before he wrote a business plan.

Three shifts made the timing right, even if the market didn’t know it yet. Computing was becoming dynamic: with AWS and virtualization, workloads appeared and disappeared in minutes. Applications were becoming more interconnected. And the lateral-movement problem, an attacker walking from one compromised machine to the next inside a flat network, was getting worse. Static firewall rules at the edge couldn’t keep up with any of the three, and a control that lived with the workload could.

The mission mattered too. Security is a hard industry to stay in, and Rubin is clear about why people do: “There’s a mission-driven element to being on the good side of a very real war.”

What is breach containment, and how does microsegmentation stop lateral movement?

The failure Illumio was built around is now written into the standards. NIST SP 800-207, Zero Trust Architecture, puts it in one sentence: “Perimeter-based network security has also been shown to be insufficient since once attackers breach the perimeter, further lateral movement is unhindered.” Zero trust, in NIST’s framing, “assume[s] that an attacker is present in the environment” and grants no implicit trust to a user or device “based solely on their physical or network location.”

Microsegmentation is the network-side control that makes that assumption real. CISA’s July 2025 guidance, Microsegmentation in Zero Trust, Part One, defines it as “a networking control that limits connections to a zone or segment” and explains that it “works by protecting a smaller group of resources, thereby reducing the attack surface, limiting lateral movement and increasing visibility.” Illumio’s own definition is plainer: “Microsegmentation means splitting a network into smaller, separate sections that are isolated from each other,” so that “if one part is attacked, the rest of the network remains safe.”

The difference from old-fashioned network segmentation (a VLAN for guest Wi-Fi, another for the office) is granularity. Policy is written per workload, application or device, and it follows the workload wherever it runs: a data center, a cloud account, a container. Gartner’s 2023 Market Guide for Microsegmentation, as quoted by Illumio, put the shift in numbers: “By 2026, 60% of enterprises working toward Zero Trust architecture will use more than one deployment form of microsegmentation, which is up from less than 5% in 2023.” The market Rubin identified in 2013 crossed from early adopters into the mainstream roughly a decade later.

The idea echoes across so much of modern security: the wall around the office can’t hold on its own, so control has to move inward. It’s why an attacker who reaches a single unsecured printer is already inside the trust boundary, why browser security became the new control point, why identity, not infrastructure, is the real boundary, and why a shared secret at any hop moves the perimeter rather than removing it. Containment is what makes those controls forgiving. When one of them fails, and one will, the failure stays local.

Why does security spending keep rising while breaches get worse?

Rubin’s sharpest line on the episode is about the industry’s scorecard:

“We’re spending more on cyber every year, and our track record keeps getting worse, not better.”

Andrew Rubin, founder and CEO of Illumio, on episode 88

The numbers back him. IBM’s Cost of a Data Breach Report 2026 puts the global average cost of a breach at $4.99 million, up 12% in a year and a record high, and counts a 56% increase in AI-driven attacks. Rubin’s read is that this is a model problem rather than a tooling problem. Defenders are missing more often; when they miss, the breaches are bigger, they hit systemically important targets, and the stolen data is worth more than it used to be. Every year the budget grows and every year the outcomes deteriorate, which tells you the strategy behind the budget has stopped matching the speed of the people attacking it.

The containment model changes what the next dollar buys. Under a perimeter model, extra spend buys a taller wall with the same blast radius behind it. Under a containment model, the same dollar buys a smaller blast radius: segmentation, detection that catches the lateral move, and recovery from a known-good state. Keep the wall, but stop betting everything on it. The logic also lines up with where AI is pushing attackers. The autonomous attack tooling now finding weaknesses and moving deeper into networks with little human input is fast, and speed on the attacker’s side is a strong argument for architecture that limits how far speed can carry them.

For a Series A or B company, this is good news. A containment-first architecture is mostly a set of design decisions, and design decisions are cheapest while the system is small. The enterprise buyer whose security team asks how you would contain a compromised container is asking whether you made those decisions early, and the founder who did has an easier sale.

How long does it take to build a cybersecurity company?

Illumio spent its first year in stealth, coming out in 2014, and Rubin estimates it took seven to eight years to reach the inflection point where it felt like a durable business. “The overnight success story is usually a decade or more in the making.” He’s explicit about what he could and couldn’t control along the way:

“Those two words — luck and timing — when you use them in this context, are totally interchangeable. Your luck is your timing.”

Andrew Rubin, founder and CEO of Illumio, on episode 88

Hard work and perseverance are table stakes. What you can’t control is whether the market is ready. “When you ask your new technology to be adopted by a market… what you’re actually doing is asking other people to change their behavior. The technology is the easy part.” Or, more compactly: “Luck in startups isn’t chance — it’s timing you don’t control.”

That lesson lands differently depending on what you’re building. Kevin Kane, whose post-quantum cryptography company we covered in What Is Deep Tech?, waited years for the science to work in real networks; Rubin waited years for buyers to change how they thought about their own networks. Both are the same wait. The technology was ready before the world was, and the founder’s job in the meantime was to keep the company alive and keep making the argument.

How does a cybersecurity startup cross the chasm?

Rubin credits Geoffrey Moore’s Crossing the Chasm as central to Illumio’s strategy: the drop between visionary early adopters and the pragmatic majority, where products either break through or die. Illumio’s early customers were financial services and large tech, the historical security early adopters. The signal that the chasm was being crossed: “All of a sudden we saw airlines and transportation and logistics… Suddenly we were selling to commercial enterprise.”

Cybersecurity has an inverted-chasm wrinkle. In most software categories small companies adopt first and the enterprise follows years later. In security, the large enterprises with sophisticated teams adopt first, because they feel the problem first and have the staff to evaluate a new control. Getting from there down to the mid-market and to smaller companies is where many security startups stall. Gartner’s observation in the same 2023 guide that “midsize organizations are evaluating microsegmentation solutions, which is a relatively new development” is what that crossing looks like from the analyst’s chair. Garrett Smith’s Reveal Technology crossed a similar divide in the opposite direction, from the corporal on the ground up to the program office, which we covered in How to Build a Defense Tech Startup. The common thread is knowing exactly who feels the problem first and building for them without apology.

Why is selling the founder’s real job, recruiting included?

The point Rubin makes most forcefully is about selling. Most CEOs think their main job is closing customers. The hardest sales job he has is recruiting: if you can’t sell your vision to the people who will build the product, there is nothing to ship and nothing to sell. “Selling is about being passionate and helping others understand why it matters.” In his telling, selling is a deep competency in your own domain that lets you move people toward the mission, whether the person across the table is a candidate, an investor, a board member or a buyer.

For technical founders uncomfortable with that, his advice: “I don’t think it’s about becoming a salesperson. It’s about rounding out the skill set to get comfortable having both sides of the conversation.”

We see the same thing from the other side of the table. When a Series A company sells into a bank or an insurer, the security conversation is part of the sale: the questionnaire, the SOC 2 report, the architecture review where someone asks how far a compromised container could get. Founders who can hold both sides of that conversation close faster, which is the idea behind our sales support work: turning security into something that closes deals instead of something that slows them down.

What do you learn from losses, and when is the company bigger than you?

“You learn very little from your wins and almost everything from your failures.”

Andrew Rubin, founder and CEO of Illumio, on episode 88

Rubin’s version of this is unsentimental. You will make mistake after mistake. The goal is to avoid repeating the same failure twice, and even then you probably will. A team that is allowed to fail in the open produces the data you need to improve; a team that hides the mess produces a surprise later. Winning feels good and teaches you almost nothing, so the founders who chase only the highs are throwing away most of their education.

The hardest moments were human. The hardest single conversation was when Kirner decided to leave. The two had been “brothers tied at the hip,” but Kirner wanted to return to early-stage building, and Illumio had matured past that phase. The other constant difficulty, letting people go, “never gets easier and is always going to be, at a human level, the hardest part of the job.” Recruiting a great person feels like a massive win for the boat; letting one go feels equally bad, even when it is the right move for the team and for the individual. If you find it easy, you’re doing it wrong.

His proudest moment wasn’t a number.

“There was a moment where we woke up and realized the company was bigger than any of us. If for whatever reason I was not at work tomorrow, Illumio is Illumio.”

Andrew Rubin, founder and CEO of Illumio, on episode 88

Founders obsess over “the number,” the revenue mark that supposedly changes the DNA of the business. Rubin’s experience is that it doesn’t. The real shift happens when the company no longer depends on any one person, the founder included: if he didn’t show up tomorrow, Illumio would still deliver, the board would find a successor, and the machine would keep turning. Getting from early fragility, where losing one engineer could threaten everything, to institutional resilience is, in his view, the defining achievement of a startup that survives. It is also the same idea as his product. A company, like a network, is resilient when no single failure can take down the whole.

What a startup should take from Illumio’s playbook

Rubin’s thirteen years distill into principles that are practical rather than aspirational: fall in love with the problem, not the ambition; find a co-founder who complements you; accept that timing is the variable you don’t control; study the adoption curve; build for resilience, not just growth; learn from every mistake and try not to repeat it; and remember that selling (recruiting, raising, closing, explaining the vision) is not a dirty word.

The product thesis translates just as directly, and you don’t need a Fortune 100 budget to apply it. Assume the front door fails, and design so one foothold stays one foothold:

• Segment what you have. Separate production from development and CI, give each service its own identity and credentials, and write network policy (cloud security groups, Kubernetes network policies) so the web tier can reach the database and nothing else. CISA’s guidance is explicit that implementing zero trust “is a journey rather than a wholesale replacement of infrastructure or processes,” so start with the segment around your most valuable data.
• Catch the lateral move. Containment buys time; someone has to use it. Logging and alerting on east-west traffic and unusual credential use are what turn a contained breach into a short one, and they are what our monitoring and response team runs for companies that don’t have a SOC of their own yet.
• Test the assumption. A penetration test scoped as “assume the attacker already has a developer laptop” shows how far a foothold actually travels in your environment, which is a far more useful answer than whether the front door holds.
• Plan the recovery. Containment limits the damage; immutable backups and tested restores are how you come back from whatever damage is left.

Who does that work is the in-house, on-demand, or do-nothing decision we wrote about in In-House, On-Demand, or YOLO?, and it’s the subject of our live founder webinar on October 6. If you want a second set of eyes on how far a single compromised credential could travel in your environment today, our product security team starts with exactly that question. And if you’d rather hear the founder’s version first, Andrew tells it in 46 minutes on episode 88.