For Julie Cullivan, working in Silicon Valley following college was the equivalent of getting thrown into the fire. It was the late eighties, and like many who descended into the budding startup ecosystem, she was immediately steeped in the culture of fast-growing tech companies, replete with big ideas, rapid execution, and the region’s insatiable thirst for innovation. Though she often found herself on the operations side of the business, an early opportunity in sales propelled her career—and shaped her technological expertise.
“I think what is interesting when you work in Silicon Valley is that you come into these companies where you not only had to understand what the company did, and why it was valuable, but you actually had to get quite technical to do your job there,” Cullivan says. “I really cut my teeth.”
Yet, despite roles at Oracle, EMC, and McAfee (now Intel Security) under her belt, Cullivan feared she lacked the experience when she was asked to help oversee business operations at FireEye, a publicly held network security company.
In fact, she says it wasn’t until after her interview that Cullivan realized the company was looking for a chief information officer. She had to think about it.
“I’d never been a CIO before,” Cullivan explains. “And there were other ‘true experts’ in the field. But I found that understanding the business side of things really helps when looking at technologies and business improvements to make the company more efficient and profitable. All the roles are about execution. It’s helped me to build relationships with key stakeholders on the
business side.”
Those relationships have proven invaluable. Cullivan accepted the position in 2013—just nine months before FireEye went public—meaning even more eyes were positioned on the company to see how it would perform.
“A lot of companies have been breached and they don’t even know it. That’s where the real risk comes in—what kind of information were they able to extract, what kind of malware were they able to inject? It’s not an IT problem—it’s a company risk problem.”
Now, while FireEye has been around for about a decade, Cullivan says its business has exploded over the past four years. It’s not hard to see why—cyberattacks are on the rise. “The threat landscape has changed dramatically,” Cullivan says. “I think what we’re finding is that attackers are far more sophisticated, often well-funded, and extremely persistent. The stakes are getting higher.”
It seems like every week a major corporation has fallen victim to the nimble work of cybercriminals, but it is less commonly known that attackers have access to a breached system for an average of 205 days before they are detected. Most breaches occur to companies significantly smaller than the corporations that make major news headlines, and 97 percent of systems are still breached, despite having security systems squarely in place.
It’s safe to say that FireEye is a leader in the cybersecurity space. On a technical level, the network security company provides “automated threat forensics and dynamic malware protection against advanced cyber threats.” In more relatable terms, FireEye helps companies prevent embarrassing or detrimental data breaches as well as respond to many breaches that have already
taken place.
FireEye has more than 4,000 customers in sixty-seven countries—including more than 600 customers who fall on the Forbes Global 2000. Multinational professional services firm Deloitte called FireEye the fastest growing cybersecurity firm in North America.
Since 2014, cybersecurity incidents have increased by roughly 38 percent, with the cost of a single data breach reaching a cool $3.79 million. Simply put, having good security is no longer good enough. Companies are finally ready to take a proactive—rather than a reactive—stance against cybercrimes, according to Cullivan.
“A lot of companies have been breached and they don’t even know it,” Cullivan says. “That’s where the real risk comes in—what kind of information were they able to extract, what kind of malware were they able to inject? It’s not an IT problem—it’s a company risk problem. I don’t have to convince people this is a problem. It’s becoming much more real to everybody.”
Implementing an effective cybersecurity program can seem like a Sisyphean task. “When you’re responsible for protecting an organization, it’s a big burden to bear,” Cullivan says.
Yet, FireEye thrives due to its adaptive defense model. Most other security firms’ technology has to understand a threat to protect an organization from it. FireEye builds technology that identifies unknown malicious or suspicious activity—and allows an organization to analyze and prevent it before it is deployed. While security breaches are often inevitable in this day and age, they don’t have to be detrimental.
In addition to creating and leveraging the right technology (such as the cloud), FireEye heavily relies on its exclusive trove of security intelligence—an asset that allows the company to detect, analyze, and prevent cybersecurity threats in real time.
“We have incredibly strong intelligence information, not just about the attacks themselves, but who might be behind the attacks, and what tactics they use,” Cullivan says. “Often with these attacks there is a chain: it starts with one event, but then creates vulnerabilities in other areas. We look at the entire attack rather than just the event.”
FireEye achieves this by recognizing the importance of having a security-as-top-of-mind team across the entire IT organization, according to Cullivan. When she first arrived at FireEye, the CIO says her team was “very small and barely hanging on.” But as the company’s growth exploded globally, she had to build up her team of twenty to more than
180 people.
Having a seat at the executive table and great alignment with her peers made that growth possible. “We’re able to leverage all of FireEye’s technology, intelligence, and services to help us augment our own staff,” Cullivan explains. “Staying on top of security threats takes constant, continuous attention and education.”
Perhaps those days in Silicon Valley have created an effectual CIO, after all.
“It’s certainly been interesting from a market opportunity perspective,” Cullivan says. “We’re kind of like a company of first responders. That’s exciting. But as much as I see opportunity for FireEye products and services, it means we have to be very focused on protecting our own organization with better technology, better intelligence, and a prioritized way of reacting to any noise in the system.”
That combination of the right technology, program, and people is what keeps companies ahead of sophisticated hackers, according to Cullivan, who adds, “No CIO can protect the organization alone.”
