Andrew Rubin was almost 13 years into Illumio when he sat down with Jon, and he still talks about the company as a journey in progress. He opened by handing the credit to the team and borrowing a line from the people who advised him along the way.
“But I will definitely start off by saying that the expression that a number of my mentors have reminded me of, which is the overnight success story, a decade or more in the making, there’s no doubt about it that we’re living that journey.”
Andrew Rubin, at 1:52
Andrew is Illumio’s chief executive officer and founder. He started the company with PJ Kirner in 2013 to simplify microsegmentation, and Illumio now calls itself a breach containment company, with a platform made of Illumio Insights, for AI cloud detection and response, and Illumio Segmentation, for stopping lateral movement (Illumio). Before Illumio he spent nearly nine years at Cymtec Systems, as vice president of sales from 2004 and then as chief executive officer from 2006 to 2012, after six years in business development at VoiceNet (LinkedIn). His Illumio bio says he is the executive sponsor for some of its largest customers, including Citi, HSBC, Salesforce and Microsoft, that Goldman Sachs has named him to its 100 Most Intriguing Entrepreneurs seven times, and that EY named him a 2024 Bay Area Entrepreneur of the Year. He sits on the board of Emigrant Bank and graduated from Washington University in St. Louis with a degree in finance (Illumio).
Where we sit, so you can weigh what follows: YSecurity helps startups pass the security reviews enterprise buyers run, and the question of how far one compromised machine could travel comes up in almost every architecture review we sit in on. Jon McLachlan hosted this one on his own. We recorded in the fall of 2025, and the episode aired on February 10, 2026. Our companion post, Building a Cybersecurity Startup, turns the security idea under Illumio into a plan for a young company. This page stays with the tape.
Two reasons to be a security person
Jon asked whether Andrew thinks of himself as a security person. Yes, he said, for two reasons. The obvious one is the day job. He is one member of an 800-person team that builds security software and brings it to customers to make them more resilient. The second reason is the one he wanted to talk about.
“I think there’s a second-order answer, though, that’s kind of important, which is there aren’t a lot of folks who decide to spend their career in cybersecurity who don’t have some part of that decision be driven by more of a mission-driven attitude, where it’s not just the job itself, but it’s a desire to try and actually participate in what is definitely a very real war nowadays and be on the good side.”
Andrew Rubin, at 2:35
He compared it to people who go into physical security or join the military, and he was honest that the passion came later.
“I will say, I can’t tell you growing up that I knew that I was passionate about it, but I definitely got passionate about it. And actually, I’m more passionate about it today than I ever have been.”
Andrew Rubin, at 3:16
The same idea shows up in his investor’s profile of him. In January 2022, General Catalyst, one of Illumio’s earliest backers, posted four minutes on why he stays in security.
Born from a problem nobody was solving
Jon summed up Illumio for listeners with a figure from the company’s earliest pitch. When Illumio announced its Series C in April 2015, Andrew said that “Perimeter security solutions leave 80 percent of the data center and cloud exposed” (Illumio). Then Jon asked what inspired Andrew’s jump into the entrepreneurial space. Andrew rejected the premise.
“I have to tell you, I don’t really think about it as what inspired the entrepreneurial jump. I actually think that’s just sort of a derivative consequence.”
Andrew Rubin, at 4:11
What comes first, in his view, is the problem.
“I really believe that companies are typically born, and founders who are around that table when the company is born, they’re born out of recognizing that there’s a problem that large incumbent vendors aren’t solving.”
Andrew Rubin, at 4:20
There are two ways that happens. Sometimes the incumbents become legacy vendors. They got big, they stopped innovating as aggressively as they did in the early days, and as the world changed, their products fit less well. The other way is the Illumio story. The perimeter had been the default in cybersecurity for 40 or 50 years.
“Cyber had one job, sort of one mission, which was keep the bad folks out.”
Andrew Rubin, at 5:05
Spending more, missing more
The problem with the perimeter, Andrew said, doesn’t need a spreadsheet to see. Pick up a newspaper. For ten years and more, the record of stopping attackers at the door has been far from perfect, and it has been getting worse faster.
“We’re missing more often.”
Andrew Rubin, at 5:36
“When we miss, the breaches are bigger, they’re happening in more important and more systemically critical places, and the data and the information getting stolen is getting more valuable.”
Andrew Rubin, at 5:37
Then he put all of it in one sentence.
“Another way to say all that is, we’re spending more on cyber every year and our track record seems to be getting worse, not better.”
Andrew Rubin, at 5:50
He was careful about who he blamed, which was nobody.
“I don’t think that that’s an indictment of any vendor or any technology or any security control. I think it’s actually just proof that the world is changing.”
Andrew Rubin, at 5:57
The infrastructure we run our lives on is changing faster than it ever has, he said, and attackers take advantage of the change. The spending half of his sentence has a public number behind it. When Illumio raised its Series F in June 2021, its announcement cited a Gartner forecast that worldwide security spending would top $150 billion that year, and named Colonial Pipeline, JBS and Microsoft Exchange as proof that legacy security wasn’t holding (Illumio).
When the perimeter misses
Illumio’s founding question came straight out of that record.
“In our case, the problem was very simple. It’s what you said, which is the perimeter serves a purpose. But what happens when the perimeter misses?”
Andrew Rubin, at 6:35
“How do we prevent these things from going from small problems to catastrophes every time?”
Andrew Rubin, at 6:43
Colonial Pipeline is the textbook case of the question. In May 2021, attackers got in with the password for an inactive VPN account that didn’t have multi-factor authentication. The ransomware mainly hit billing systems, and the oil pumping systems kept running, but the company halted all pipeline operations to contain the attack, and the pipeline carries about 45% of the fuel used on the East Coast (Wikipedia). One password at the door, and the damage was decided by how far the attack might spread.
What an attacker does after the door has a name. MITRE ATT&CK files it as lateral movement, the tactic where “The adversary is trying to move through your environment,” often with legitimate credentials and the network’s own tools (MITRE ATT&CK). Stopping that movement is the job Illumio was built for. Andrew said they saw the problem early.
“We recognized we were probably pretty early in recognizing it. Some would actually argue that maybe we were a few years too early.”
Andrew Rubin, at 6:51
Illumio’s own numbers show how wide the gap still is. In a survey of 700 IT and security leaders that Illumio commissioned from CyberEdge Group, published in March 2026, 95% said they can detect unauthorized lateral movement and 46% said they struggle to stop it. Only 17% can isolate a compromised workload in near real time, and 51% take hours, days or even weeks (Illumio).
He closed the answer by repeating that the company came from the problem, not from a plan to start a company.
“I didn’t wake up one day and say, I want to be an entrepreneur. I woke up and said, I’m passionate about this. I see the world changing.”
Andrew Rubin, at 7:10
Hopefully a safer one
Jon summarized it as falling in love with a problem nobody had solved and deciding to build a better future. Andrew added two words.
“Hopefully a safer one.”
Andrew Rubin, at 7:36
“I count a safer future as a better future for sure.”
Jon McLachlan, at 7:37
“I would argue that they’re highly correlated.”
Andrew Rubin, at 7:40
Selling, not sales
Jon asked for Andrew’s superpower. Andrew pushed back on the word, since most people have one thing they’re best at rather than a superpower, and then named his.
“But in my case, I’m going to use the word selling, but I don’t mean sales.”
Andrew Rubin, at 8:07
“To me, selling is about becoming deeply passionate about something, becoming competent in understanding it and the domain that it operates in.”
Andrew Rubin, at 8:12
As CEO, he said, selling runs through every part of the job, and the most important sale isn’t the one people expect.
“Arguably, the most important sales job I have is not selling the software to customers, it’s selling when I’m recruiting people to join the team.”
Andrew Rubin, at 8:35
“Because without those people, there is no Illumio, and without those people, there’s nothing to build, there’s nothing to sell.”
Andrew Rubin, at 8:43
Then come customers and partners, one of his happiest places, as everybody at Illumio knows. Early in the company’s life, it was investors too. In each case he’s selling the same things, the company, the mission, the team and the vision, and the method doesn’t change.
“and then getting out there and asking questions, listening to answers, taking criticism, and using all that to become better at selling whatever it is that you’re out there selling every day.”
Andrew Rubin, at 9:30
Everything is selling
Jon said the passion is contagious, and that a lot of technical founders who come on the show describe selling as something they were forced to learn. Sometimes it’s more natural than that.
“You just get so passionate about something and really sink your teeth into it.”
Jon McLachlan, at 10:33
He called the idea “everything is selling” and credited a Daniel Pink book with helping him move from technical founder toward people, relationships and the problem itself. The book is To Sell Is Human: The Surprising Truth About Moving Others, from 2012. Pink’s later books happen to cover two more of this episode’s subjects, When: The Scientific Secrets of Perfect Timing in 2018, and The Power of Regret in 2022 (Wikipedia). Then Jon asked Andrew whether a book or a mentor had grounded him.
Not a technical founder
Andrew started with the label.
“By that definition, I am not a technical founder.”
Andrew Rubin, at 11:48
The definition he meant is the usual one, a founder who came up with a computer science degree, coding, as an architect or an engineer. Andrew came up on the sales engineering and product management side, talking about technology rather than building it. His LinkedIn bears that out, from business development at VoiceNet to vice president of sales at Cymtec Systems before he ran it (LinkedIn). For founders who did come up as engineers, he said, the moment comes early when they have to explain the value of the product and not just how it works.
“And so I don’t think it’s about becoming a salesperson per se. I think it’s about just rounding out the skill set to get comfortable having both sides of the conversation.”
Andrew Rubin, at 12:14
Venkat Thiruvengadam of DuploCloud described the same blend from the engineering side on episode 87, where he called himself a techno-commercial person, a technical person who can put technology to good commercial use.
His advice was the one Jon had already given, with a sharper edge on who to talk to.
“Surround yourself with mentors, and in particular, ones who bring skill sets to the conversation that don’t reinforce the ones you already have, but are the skill sets that you don’t have, that you can actually talk to them and learn.”
Andrew Rubin, at 13:02
“And don’t be embarrassed or shy about asking for help.”
Andrew Rubin, at 13:15
Mistake after mistake
Jon agreed there’s no point in suffering alone, and added a line he has said on this show before.
“It’s not a failure until you give up, right?”
Jon McLachlan, at 13:31
Andrew took it from there, starting with an old saying.
“So, I mean, look, everybody knows that the expression’s been around for a long time about you learn very little from your wins and you learn a ton from your losses.”
Andrew Rubin, at 13:33
The saying only works, he said, if you treat a mistake as a lesson and not as a failure, and if you go in expecting to make them.
“You have to have a mindset that accepts that you’re going to screw things up.”
Andrew Rubin, at 13:59
Every company and every team, he said, should expect to make mistake after mistake, with two rules.
“The only two requirements are, one, learn from every one you make, and two, try not to make the same one again.”
Andrew Rubin, at 14:08
“And even that is going to be a mistake that you make, because you will make the same mistake again, inevitably.”
Andrew Rubin, at 14:14
Jon called it the secret formula. Andrew said the good news is that it isn’t a secret, because anyone who has built anything will tell you it’s tough day after tough day, and that’s where you get stronger.
“And you have to start by having the mindset open to accepting that and not beating yourself or the team up as if the mistake itself is the problem.”
Andrew Rubin, at 14:41
“Get comfortable being uncomfortable.”
Jon McLachlan, at 14:50
Jon made the same point with Vivek Ramachandran of SquareX on episode 49, where Vivek’s rule for a team after a mistake was to support it rather than point fingers.
Bigger than any of us
Then Jon asked a question Andrew called one of the hardest to answer.
“What’s been your proudest day so far in your journey?”
Jon McLachlan, at 14:56
“I gotta tell you, that may be one of the toughest questions to answer, if you try and chronologically pick a single day.”
Andrew Rubin, at 15:00
There were plenty of proud days, a deal that closed, a hire they made. What he offered instead was an inflection point. First he set aside the milestones founders usually get asked about, the hundredth employee, the five hundredth, the first $100 million in revenue.
“I have never once thought about a number and said, wow, when we cross that mark, something will be different.”
Andrew Rubin, at 16:11
The moment was a realization, and he didn’t claim it alone. Jon added that it was shared with the whole company, and Andrew agreed.
“there definitely was a moment where we woke up and realized the company was bigger than any of us. Where, if for whatever reason, I was not at work tomorrow, Illumio is Illumio.”
Andrew Rubin, at 16:40
“And the board will do its job and find the next CEO.”
Andrew Rubin, at 16:52
The next CEO wouldn’t be the founder, he said, but the company would keep going, because of what it built and the value it delivers to customers. Losing a long-time or important team member still hurts. It just no longer changes the trajectory. That wasn’t true at the start.
“And so in the early days, we always had that feeling like, wow, we really hope so-and-so doesn’t leave, because we don’t know what we would do.”
Andrew Rubin, at 17:47
He was careful to say this isn’t a comment on startups versus big companies, or on anyone’s career choice. It’s a particular experience.
“It’s a journey that very few people are lucky enough to go on in their career.”
Andrew Rubin, at 18:28
It is also, in a way, the same idea as his product. A company that no single departure can sink is built the way Illumio wants networks built, so that one failure stays one failure.
Rowboat or ship
Jon said getting there takes dedication, and the focus to say no to a lot of distractions. Then he reached for a picture.
“if the machinery is working and it’s not, like, a fragile, you know, very delicate thing, and it has armor that’s built around it that can withstand sort of the weather, like, okay, let’s take this boat out to sea.”
Jon McLachlan, at 19:15
Andrew liked it right away.
“Jon, I’ve never heard it described that way, but I actually love that metaphor, because it is sort of like, is it a fragile rowboat or is it a big, sturdy ship?”
Andrew Rubin, at 19:30
Jon asked how long it took to reach the ocean liner stage. Andrew wouldn’t go that far.
“I’m not so sure I would describe it as an ocean liner just yet. I definitely feel like we’re not a rowboat anymore.”
Andrew Rubin, at 19:58
Seven or eight years
He doesn’t usually look back, he said, except to learn something.
“But I’m a very big believer in waking up every day and literally looking forward.”
Andrew Rubin, at 20:07
But he put a number on the inflection point.
“But the reality is that inflection moment that I described, I would say in our journey, it probably took somewhere, probably around seven or eight years.”
Andrew Rubin, at 20:17
The first couple of years were pre-revenue.
“Back then, everybody called it stealth mode.”
Andrew Rubin, at 20:35
They were building what became the minimum viable product, and the selling that followed took at least five or six years more. The public record follows the same arc. In September 2013, All Things D covered the young company as a stealth security startup when it raised $34 million from General Catalyst (All Things D). By April 2015, Illumio had raised more than $142 million in 27 months, with BlackRock and Accel joining Formation 8, Andreessen Horowitz and General Catalyst (Illumio). The $225 million Series F, at a $2.75 billion valuation, came in June 2021, eight and a half years after the company started, about where Andrew puts the inflection (Illumio).
Nobody used the term
The slow start had a cause. Illumio was selling into a category that didn’t exist yet.
“As I mentioned, you know, when we started Illumio, zero trust, nobody used the term.”
Andrew Rubin, at 20:47
“Segmentation, if it’s possible to have even fewer people than nobody using the term, that would be an accurate statement.”
Andrew Rubin, at 20:52
“We didn’t have a category. We didn’t have a market. Forrester and Gartner had never written anything about these things.”
Andrew Rubin, at 20:59
The idea was older than the market. The Jericho Forum was already discussing “de-perimeterisation” in 2003, Google began its BeyondCorp program after the Operation Aurora attacks of 2009, and Forrester analyst John Kindervag used the term zero trust model in 2010 (Wikipedia). Kindervag is now Illumio’s chief evangelist. The analysts caught up over the next decade. Forrester named Illumio a Leader in its zero trust ecosystem platform Wave in the third quarter of 2020 (Illumio), and by 2024 it was publishing a Wave for microsegmentation alone, in which it called Illumio “the original microsegmentation specialist” (Illumio).
Andrew knows how the other version of the story goes. Founders with a brilliant idea, ten years too early, and a later team that builds the company that wins the category.
“Fortunately, we weren’t so early that we missed altogether.”
Andrew Rubin, at 21:10
“We’re here, and so we weren’t too early. But we were very, very early.”
Andrew Rubin, at 21:38
Your luck is your timing
Jon said timing is so important with these things. Andrew went further than that.
“I actually think those two words, when you use them in this context, are totally interchangeable. Your luck is your timing.”
Andrew Rubin, at 21:59
“It’s not luck in the sense of traditional luck, like walking into a casino and hoping that you get lucky.”
Andrew Rubin, at 22:06
The hard work isn’t the lucky part, he said. That is the price of admission.
“And it’s table stakes to show up, work hard, not give up.”
Andrew Rubin, at 22:28
The luck is having the right idea, doing the work, and then getting the timing right on the part you don’t control, the market and the shifts in the technology landscape. Watching where the world is going is part of the job. Some of it isn’t.
“But there is an element of timing that you literally have absolutely no control over.”
Andrew Rubin, at 23:17
Or Eshed of LayerX gave a different answer to the same question on episode 98, “is it luck or is it wisdom?”, and pointed at a trend he treats as permanent. And Drata’s founders, on episode 64, reached a billion-dollar valuation about ten months after launch, in a market that was ready for them. Illumio’s market wasn’t, yet.
Innovation without adoption
Jon’s answer was the longest he gave on the episode, and it’s about the part of timing founders can least control, other people.
“It just drives me crazy, because we’re like, innovation without adoption, is that really innovation?”
Jon McLachlan, at 23:28
When you ask a market to adopt your product, he said, timing matters a great deal.
“because what you’re actually doing is you’re actually asking other people to change their behavior.”
Jon McLachlan, at 23:46
“The technology is the easy part. These computers, they only do what we tell them to do. But humans, we’re intricate, we’re complex, we’re interesting.”
Jon McLachlan, at 23:52
So the ask has to be compelling, and how compelling it is depends on everyone else’s context.
“It’s based on when, right?”
Jon McLachlan, at 24:15
The chasm without a Magic Quadrant
Andrew loved that, and tied it to a model.
“I’m a huge fan, and definitely more of a fan now than ever before, of Moore’s adoption curve.”
Andrew Rubin, at 24:21
“I never really understood how critically important it is.”
Andrew Rubin, at 24:29
The curve is Geoffrey Moore’s, from Crossing the Chasm (1991), which adapts Everett Rogers’ diffusion of innovations to technology markets. Moore’s chasm is the gap between the early adopters, the visionaries, and the early majority, the pragmatists, and he calls the move across it the most difficult step (Wikipedia). Andrew’s version is simple. Only a small part of any market goes first.
“By definition, there’s going to be a small part of the population, 5%, 10%, 15%, whatever number we want to decide it is, that is going to go before everybody else.”
Andrew Rubin, at 25:00
The open question is whether the problem you solve turns out to be one most everybody has.
“If you build something where the rest of the world doesn’t show up, there’s only so far you’re ever gonna get.”
Andrew Rubin, at 25:52
What made the picture so powerful for Illumio was the debate it framed. A buyer’s usual proof that a problem is broad, an analyst report, didn’t exist.
“And so for us, that curve, that very, very simple picture, became so powerful, because the debate that we were always having was, without a Gartner Magic Quadrant, without a Forrester Wave, without any of these things that we all look to to sort of validate that this is a broad problem across the majority of organizations, we didn’t have those things.”
Andrew Rubin, at 25:57
Their early customers were early adopters, a very small subset of the world, and the question was whether Illumio would reach the chasm and fall in. Getting through that, he said, takes domain expertise, watching how the world evolves, and a willingness to persevere through tough times and a lot of doubt. Jon called it a privilege.
“You get to. You get to grapple with that problem, right? It’s a privilege in hindsight if you cross the chasm. I’m not sure it feels that way if you fall in it.”
Andrew Rubin, at 27:10
Airlines and logistics
Jon asked whether the rowboat moment and the chasm were the same moment. Andrew said they were highly correlated, and that there was no single day.
“Obviously, that wasn’t a light switch moment, but as we saw more data and more indication and more anecdote that that was happening, we saw our customer base become more diversified.”
Andrew Rubin, at 27:32
“Instead of only selling to a couple of industries that are always security early adopters, financial services, certain areas within tech, all of a sudden we saw airlines and transportation and logistics and things that showed up.”
Andrew Rubin, at 27:46
“We were always selling to very large global enterprise. Suddenly we were selling to commercial enterprise.”
Andrew Rubin, at 27:59
Quarter over quarter, it started to feel mainstream, and that built the confidence that the years of investment had laid a real foundation.
“and that it was possible that we could build a skyscraper on top of it.”
Andrew Rubin, at 28:40
The customer list today reflects the early adopters and the crossing both. Illumio says it protects more than 15 of the Fortune 100, six of the ten largest global banks and three of the five largest enterprise SaaS companies (Illumio). In August 2026 it named BNP Paribas, eBay and Microsoft among its customers, and said Microsoft has deployed Illumio Insights and Illumio Segmentation across its entire corporate IT environment (Illumio).
Brothers tied at the hip
Jon asked about the most difficult moment. Andrew said that, like many of the toughest moments, it turned out to be a great thing in hindsight, and that he would never forget it.
“But I will never, ever forget, you know, I started Illumio with PJ Kirner.”
Andrew Rubin, at 29:01
“He is and always will be the genius behind the idea.”
Andrew Rubin, at 29:05
After a long time, Kirner decided he was ready to go back to a room with a couple of people, in true startup mode, and start again from a whiteboard. The first conversation about it was one of the hardest Andrew has had.
“And of course, at that moment in time, we had been brothers tied at the hip for a long time, had been through every aspect and every moment of the journey together.”
Andrew Rubin, at 29:37
It worked out better than he expected.
“It turns out, like a lot of things, that his gut and intuition, first of all, was wildly ahead of mine.”
Andrew Rubin, at 29:58
“And by the way, he’s in that room with a small group with a whiteboard building what I’m sure is going to be the next great company, doing what he loves most.”
Andrew Rubin, at 30:10
The hardest part of the job
The second hard thing, he said, isn’t specific to a CEO.
“anybody who has ever led any group of people, ever, is going to tell you that having to let somebody go never gets easier and is always going to be, at a human level, the hardest part of the job.”
Andrew Rubin, at 30:37
“And even if you know you are doing it for all of the right reasons, for the team, for the company, and even if it’s the right reasons for that individual, it is still a human task.”
Andrew Rubin, at 30:50
Recruiting someone great feels like a win for the whole boat, and the opposite conversation feels as bad in the other direction.
“And the only thing you can hope for is that you’re doing the right thing, because hindsight is 20/20.”
Andrew Rubin, at 31:22
Jon called it a short-term pain that never gets easier. Never. Vijay Balasubramaniyan of Pindrop told us on episode 57 about walking every laid-off employee out himself, which he says taught him to be a more measured CEO.
The race speeds up
Jon asked about the next five years, the hardest problems the security community will face. Andrew said he wouldn’t give the stunningly obvious answer about AI changing everything. He went straight to the part specific to security.
“In cyber, I think there’s a particular sharp edge to the AI conversation, which is, like everything, we have to remember that the defenders and the attackers equally, and sometimes not equally, have access to tools, meaning the attackers are gonna have access to AI no differently than the defenders.”
Andrew Rubin, at 32:08
“If AI, and I think it’s also universally agreed and obvious, is moving faster than anything that any of us have ever seen or contemplated, then that means that the race that we’re in is gonna speed up a lot.”
Andrew Rubin, at 32:31
“And that means that the consequences of getting things right will be dramatic, and the consequences of getting things wrong will be equally dramatic.”
Andrew Rubin, at 32:43
It comes up in his customer conversations, and inside the company it cuts two ways.
“It’s certainly a conversation inside of the Illumio building, both in terms of how we’re gonna use it and how it’s gonna make its way into our products.”
Andrew Rubin, at 33:00
“Both statements are already true and will continue to become more true.”
Andrew Rubin, at 33:06
That was literal. On October 21, 2025, around when we recorded, Illumio announced Insights Agent, an AI guide inside Illumio Insights that gives each security role its own alerts and one-click remediation recommendations (Illumio). Andrew was also clear about what he wasn’t saying.
“And so I’m not saying that it is gloom and doom, end of the world.”
Andrew Rubin, at 33:30
Without the rule of law
What he was saying is that the stakes of an old game are going up.
“I’m simply saying that the stakes of the game that we all play, which is trying to stay ahead of people who really, number one, want to do bad things, number two, operate without the rule of law, and number three, operate without the morals and ethics that the defenders, by definition, operate within, it’s a very, very scary landscape when you think about it in that context.”
Andrew Rubin, at 33:40
It’s already happening, he said, and over the next couple of years it will show up as new attack criteria and new attack motions, and new people too.
“We’re going to see a set of attack motions. We’re gonna see, by the way, a new group of attackers that we’ve never seen in the past.”
Andrew Rubin, at 34:10
“And we’re gonna have to figure out how to deal with that.”
Andrew Rubin, at 34:22
More stuff for the attackers
At the same time, everything attackers can aim at is growing. Data center capacity, network bandwidth and traffic, compute and applications are all growing parabolically, he said, faster than they ever have, with more traffic flowing over networks globally.
“And in our world, you know what that all equals? More attack surface. That’s more stuff for the attackers to go after.”
Andrew Rubin, at 34:45
Most of the excitement is about what the new infrastructure enables. Some of us, he said, notice what it also creates.
“Or another way to say it is a lot more places for the attackers to go and try and be right.”
Andrew Rubin, at 35:06
“There’s a huge bullseye on all of that new attack surface.”
Jon McLachlan, at 35:16
Part of that new surface is the software acting on our behalf. In October 2026, Illumio published Licensed to Act, a survey of 1,100 IT and security decision-makers run by Sapio Research. It found that 70% of organizations now let AI make decisions or take actions that needed a person’s approval a year earlier, that 49% can see and audit every action an AI agent takes, and that 26% have had an AI agent or tool connect to systems without security approval (Illumio). An agent with a service account is one more place an attacker can try to be right, so it deserves the same treatment as any other workload, its own credentials and only the paths its job needs.
Not paid in Bitcoin
Then Andrew made the point that ties the episode to the world outside security.
“So one of the things that I think is really important to point out is that all crime, and really it’s been true for hundreds of years, maybe thousands of years, but all crime, if you really generalize it, it stems from one of two places.”
Andrew Rubin, at 35:20
“Economic crime, you’re stealing something for economic value.”
Andrew Rubin, at 35:35
“The other crime, and quite honestly, the one that is a lot scarier, is crime that comes from what I’ll describe as political or belief-based motivation.”
Andrew Rubin, at 35:39
In the real world and the cyber world alike, he said, the second kind is the scarier version.
“Nation states don’t generally commit cybercrime to get paid in Bitcoin.”
Andrew Rubin, at 35:57
“Nation states commit cybercrime to spy on their enemies, to figure out how to use the information for real economic sabotage, potentially to do harm.”
Andrew Rubin, at 36:03
Some of that harm stays in cyberspace, he said, and some of it may be meant for the kinetic world. He didn’t wave off the other kind.
“And I’m not belittling the economic-driven crime problem, because ransomware is a huge problem, especially when it hits a local school district or a hospital in a small community.”
Andrew Rubin, at 36:31
The public record has a clear example of the second kind. In February 2024, CISA, the NSA and the FBI warned that Volt Typhoon, a group sponsored by the People’s Republic of China, was pre-positioning on IT networks of US critical infrastructure “for disruptive or destructive cyberattacks” in the event of a major crisis or conflict. The agencies had seen the group keep footholds in some victim networks for at least five years, positioned “to enable lateral movement to OT assets,” and said its choice of targets wasn’t consistent with traditional espionage (CISA). That’s Andrew’s point in one advisory. Nobody was asking for a ransom, and the danger was how far the access could reach.
“This is new territory.”
Andrew Rubin, at 37:28
A team sport
Jon called it uncharted, and said he’s optimistic because smart people are taking on problems like protecting infrastructure beyond the perimeter.
“I think as a community, as a security community, we get this opportunity to build the future that we want, and hopefully it’s more secure.”
Jon McLachlan, at 37:32
“Same here, and it is in every sense of the word a team sport.”
Andrew Rubin, at 38:07
The team shows up every day, he said, partly for the mission, and partly because they want to build a big, important company and aren’t shy about it. The way to get there is to build great software for a big problem, because customers will adopt it.
“They’ll give you their voice and their direction. So that becomes your roadmap.”
Andrew Rubin, at 38:39
And he summed up what he thinks Illumio’s work should look like from the outside.
“It’s really, you know, the work may be very hard and very complicated and very technical, but the actual description of what we do shouldn’t be.”
Andrew Rubin, at 38:55
The description really is short. Stop one breach from reaching everything else. Yair Grindlinger of Surf AI made the same case from the access side on episode 105, shrink what a breach can reach. Trevor Hilligoss of SpyCloud explained on episode 86 why the foothold usually isn’t aimed at you in the first place, which is one more reason to plan for the foothold rather than the door.
Advice is not regret
Jon’s last question was the time machine. If Andrew could meet his younger self, would he, and what would he say?
“Yes, I would. Tons of advice.”
Andrew Rubin, at 39:23
First he separated two things people tend to mix up, in his personal life and his professional one. Going back to give yourself advice, which might well change things, is one.
“That is very different than having regret about what you did.”
Andrew Rubin, at 39:57
He doesn’t have the regret. He said openly that he’s in awe of what he’s been part of and the team he gets to work with.
“Even the worst days, I’m still amazed that I get to do this every day.”
Andrew Rubin, at 40:21
“And I’m definitely more excited now than I’ve ever been.”
Andrew Rubin, at 40:25
The advice, though, he has. A thousand things he’d do differently, and one at the top of the list.
“I think the one at the top of the list, I really wish that I wasn’t, early on in my career, so concerned about the path that my career would take.”
Andrew Rubin, at 40:46
He was more focused on the road and the outcome than on figuring out what he loved and what he was passionate about.
“and just go find a venue to participate in doing that in, and the road will pave itself, and the outcome will likely be good or great.”
Andrew Rubin, at 41:13
A careful career path matters if your goal is to climb a ladder in a large organization, he said. That wasn’t him.
“But I was always a little off that beaten path.”
Andrew Rubin, at 41:40
“And it did take longer to change than I wish it had.”
Andrew Rubin, at 42:02
“Now, that’s a really elegant answer.”
Jon McLachlan, at 42:04
The distinction between regret and advice is the subject of a whole book by the author Jon cited earlier, Daniel Pink’s The Power of Regret.
Take a beat
Andrew came back to the superpower question with a power he says he doesn’t have.
“I’ll tell you one power, forget about superpower, one power that I know I don’t have, and I am working on it and encouraging it in myself, and as CEO, is I am so forward-looking that sometimes I don’t take a beat, take a breath, and sort of say, wow, look at what just happened.”
Andrew Rubin, at 42:25
He’s better at it for the team than for himself.
“As a leader, I want the team to take a beat, and to, you know, when we release something really important or close a really important new customer, I want people to celebrate that.”
Andrew Rubin, at 42:50
“I’m not as good at that myself as I want to be.”
Andrew Rubin, at 43:01
It isn’t about perfect, he said, or even close to perfect.
“It’s just figuring out how you can move the needle a little bit forward every single day.”
Andrew Rubin, at 43:14
Vivek Ramachandran made the case for celebrating every small win on episode 49. Andrew’s version is the same advice, from someone who admits he has to remind himself.
There is still there
Jon called it the growth mindset, and asked whether Andrew had ever met a founder who was satisfied.
“Have you ever met a founder that’s like, yep, we’re done?”
Jon McLachlan, at 43:27
“Yeah, we’re there. I don’t know where there is, but I know that there is still there.”
Andrew Rubin, at 43:30
What happened after the tape
Two months after Illumio announced Insights Agent, Andrew posted that it was generally available, and framed it in the terms of the episode.
The only thing that matters is how fast you detect and contain them
Andrew Rubin · December 15, 2025
The episode aired on February 10, 2026. In March, Illumio added Network Posture to Insights, which measures lateral movement risk from live network traffic and reports against frameworks including NIST CSF, PCI DSS, SOC 2 and DORA, and showed it at RSAC (Illumio). In April, Andrew wrote about the same shift from keeping attackers out to limiting the damage, in a Wall Street Journal paid program, which is sponsored content rather than the Journal’s reporting.
The more important question is: what happens next?
Andrew Rubin · April 23, 2026
In August, Forrester’s Wave for microsegmentation named Illumio a Leader and a Customer Favorite among 10 vendors, and Andrew’s comment in the announcement restated the founding thesis, that “breaches are inevitable, but cyber disasters are not” (Illumio). Later that month the episode went up on YouTube. In October, Illumio released a free book from John Kindervag, the analyst who named zero trust, with chapters from 11 practitioners on zero trust when AI speeds up the attacks (Illumio).
what does Zero Trust look like when attacks move at machine speed?
Andrew Rubin · October 1, 2026
The thesis from the tape has aged into the industry’s vocabulary. In 2013 nobody used the words, by Andrew’s account. Today the analyst reports, the government advisories and Illumio’s own surveys all talk about lateral movement and containment. The open question is the one Andrew asked at the start, what happens when the perimeter misses, and that is a question every company can answer for itself. Our blast radius playbook walks through how, and when the containment fails anyway, our guide to immutable backups and ransomware recovery covers the way back.
Did you catch it? A six-question quiz
Interactive · six questions
Did you catch it?
Six questions on what Andrew and Jon actually said, with the timestamp for each answer. The answers are under each question for anyone reading without JavaScript.
-
Which expression does Andrew say his mentors reminded him of?
- Move fast and break things
- The overnight success story, a decade or more in the making
- Fake it until you make it
b. "which is the overnight success story, a decade or more in the making" Transcript, 1:58.
-
What does Andrew call arguably his most important sales job?
- Closing the biggest customers
- Raising the next round
- Recruiting people to join the team
c. "Arguably, the most important sales job I have is not selling the software to customers, it's selling when I'm recruiting people to join the team." Transcript, 8:35.
-
About how long does Andrew say it took to reach the moment the company felt bigger than any of its founders?
- Two years
- Seven or eight years
- Fifteen years
b. "it probably took somewhere, probably around seven or eight years." Transcript, 20:23.
-
Which two words does Andrew call totally interchangeable?
- Luck and timing
- Sales and marketing
- Prevention and detection
a. "Your luck is your timing." Transcript, 22:04.
-
Which new customers told Illumio it was crossing the chasm?
- More of the same large banks
- Airlines, transportation and logistics
- Mostly government agencies
b. "all of a sudden we saw airlines and transportation and logistics and things that showed up." Transcript, 27:54.
-
According to Andrew, what do nation states generally not commit cybercrime for?
- To spy on their enemies
- To get paid in Bitcoin
- For economic sabotage
b. "Nation states don't generally commit cybercrime to get paid in Bitcoin." Transcript, 35:57.
Is your network a rowboat or a ship?
Andrew’s founding question was what happens when the perimeter misses. This scorecard asks eight questions about what one compromised machine could reach in your company today, from the developer laptop to the person who holds the admin keys. It takes about two minutes.
Scorecard · eight questions
Is your network a rowboat or a ship?
Answer for your production environment and the people and machines that can reach it, contractors included. If two answers fit, pick the lower one.
-
If an attacker took over one developer's laptop today, what could it reach?
- Production, through the VPN or saved credentials
- Staging and internal tools, but not production
- Only what that developer's role needs, with production behind its own boundary
"But what happens when the perimeter misses?" See When the perimeter misses.
-
Are production, staging and your build systems kept apart?
- They share a network or a cloud account
- Separate accounts, with broad trust between them
- Separate accounts or networks, with only the paths each one needs
"How do we prevent these things from going from small problems to catastrophes every time?" See When the perimeter misses.
-
Do you know which of your systems talk to which?
- Not really
- There's a diagram from when we built it
- A map built from real traffic, reviewed on a schedule
"I think it's actually just proof that the world is changing." See Spending more, missing more.
-
Does each service, and each AI agent, have its own credentials?
- Services share keys or one admin account
- One set of credentials per environment
- Each one has its own, with only the access its job needs
"That's more stuff for the attackers to go after." See More stuff for the attackers.
-
Would you notice an attacker moving from one internal system to another?
- Probably not
- Only if they trip an alert at the edge
- Yes, we alert on unusual internal traffic and credential use, and someone is watching
"then that means that the race that we're in is gonna speed up a lot." See The race speeds up.
-
How fast can you cut one compromised machine off from everything else?
- Hours or days, if we can at all
- Within the hour, with a runbook
- In minutes, with a policy we've already tested
"And that means that the consequences of getting things right will be dramatic, and the consequences of getting things wrong will be equally dramatic." See The race speeds up.
-
When did someone last test what one foothold can reach?
- Never
- We test the front door, from the outside
- An assume-breach test from inside, in the last year
"you learn very little from your wins and you learn a ton from your losses." See Mistake after mistake.
-
If the one person who holds the admin keys were out tomorrow, would security keep running?
- No
- Mostly, after a scramble
- Yes, with shared ownership, runbooks and break-glass access
"Where, if for whatever reason, I was not at work tomorrow, Illumio is Illumio." See Bigger than any of us.
One foothold could probably reach most of what matters. Start with the two moves that shrink the blast radius fastest: put production behind its own boundary, and give every service and agent its own credentials.
Some walls are in place. Close the gaps next: a map of real traffic, alerts on movement between internal systems, and a tested way to cut off one compromised machine in minutes.
A breach would probably stay a small problem. Keep it that way as you grow, because the environment changes faster than the map, and test it from the inside at least once a year.
How far does one foothold reach?
A segment boundary decides how much of your environment one compromised machine can touch. Put in your own estimates to see the difference it makes.
Calculator
How far does one foothold reach?
Three estimates: how many servers, containers and other workloads you run, how many groups your network policy keeps apart by default, and the share of workloads outside a group that one compromised machine could still reach through the paths you allow.
One compromised machine could reach about 47 of your 200 workloads, 24% of the environment. In a flat network it could reach all 200. The other 153 sit behind a boundary it would have to find a way across.
A rough model, not a measurement. It assumes segments of equal size and a foothold that can reach everything inside its own segment. A map of real traffic replaces all three estimates with real numbers, and a penetration test that starts from inside shows what an attacker could actually do with them.
From VoiceNet to the Forrester Wave
Everything on this page sits on one timeline, from Andrew’s first job to the reports of 2026. Filter it by thread.
Timeline · 1998 to 2026
From VoiceNet to the Forrester Wave
Filter by thread. Dates are from the public record except where marked as part of this show.
- VoiceNet
Andrew starts as a business development analyst, and is director of business development from 2000 to 2004 (LinkedIn).
- De-perimeterisation
The Jericho Forum names the trend of IT systems outgrowing the perimeter (Wikipedia).
- Cymtec Systems
Vice president of sales, and chief executive officer from July 2006 to December 2012 (LinkedIn).
- Zero trust gets a name
Forrester analyst John Kindervag uses the term zero trust model (Wikipedia).
- Illumio
Andrew and PJ Kirner start the company to simplify microsegmentation (Illumio).
- A stealth startup
Illumio raises $34 million from General Catalyst while still in stealth (All Things D).
- Series C
$100 million, bringing the total to more than $142 million in 27 months (Illumio).
- Series D
$125 million, led by clients advised by J.P. Morgan Asset Management (Wikipedia).
- A first Wave
Forrester names Illumio a Leader among zero trust ecosystem platform providers (Illumio).
- Colonial Pipeline
One VPN password without MFA, and the company halts the whole pipeline to contain the attack (Wikipedia).
- Series F
$225 million at a $2.75 billion valuation, led by Thoma Bravo (Illumio).
- Volt Typhoon
CISA, the NSA and the FBI warn of footholds kept for at least five years in US critical infrastructure (CISA).
- Entrepreneur of the Year
EY names Andrew a 2024 Bay Area award winner (Illumio).
- A Wave for microsegmentation
Forrester evaluates 11 vendors and calls Illumio the original microsegmentation specialist (Illumio).
- Illumio Insights
Illumio introduces its AI cloud detection and response product (Illumio).
- Two boards
Andrew joins the board of Emigrant Bank, and former CIA director George Tenet joins Illumio's (LinkedIn, Illumio).
- Insights Agent
An AI guide with role-specific alerts and one-click remediation recommendations (Illumio).
- We record episode 88
"Your luck is your timing." (Transcript).
- Generally available
Andrew announces Insights Agent is live (LinkedIn).
- Episode 88 airs
On Podbean, Apple Podcasts and Spotify (Apple Podcasts).
- The containment gap
In a survey Illumio commissioned, 95% say they can detect lateral movement and 46% struggle to stop it (Illumio).
- Network Posture
Lateral movement risk measured from live traffic, shown at RSAC (Illumio).
- A paid program
Andrew on resilience in a sponsored Wall Street Journal placement (LinkedIn).
- A Leader and a Customer Favorite
Forrester's Wave for microsegmentation, among 10 vendors (Illumio).
- On YouTube
Episode 88 goes up as a video (YouTube).
- Zero trust at machine speed
John Kindervag's book with 11 contributors, free from Illumio (Illumio).
- Licensed to Act
70% of organizations now let AI act where a person had to approve a year earlier (Illumio).
What to do this week
Five things, in the order Andrew’s founding question suggests.
- Assume the perimeter misses. Pick one developer laptop and one production server and write down everything each could reach if an attacker had it. The scorecard above is a quick first pass, and our blast radius playbook goes deeper.
- Draw the map from traffic, not memory. Most cloud providers can log the flows between your workloads. Turn that on for a week and compare it to the diagram you have. The paths nobody remembers are the ones to close first.
- Put production behind its own boundary. Separate accounts or networks for production, staging and build systems, with only the paths each needs. The calculator shows what the first few boundaries are worth.
- Give every service and every AI agent its own credentials. Shared keys turn one foothold into all of them. Scope each one to its job, and make sure you can revoke one without breaking the rest.
- Test from the inside. Ask for a penetration test that starts with an attacker who already has a laptop or a service account, and time how long it takes you to cut that machine off. Our penetration testing and product security teams run exactly that kind of assume-breach exercise for startups, and you can book 15 minutes with us.