Thank you all for joining us for the first session of the Leaders Forum. Before we begin, I wanted to quickly share a few remarks on why we started this platform. One of the reasons we all come to HBS is to expand our view of the world, to learn from people whose experiences, choices, and perspectives can challenge how we think about leadership and what's possible in our own lives. Over the past year, Acha Patel, a fellow EC, and I felt there was an opportunity to create a central platform for those conversations, one open to the entire HBS and Harvard community where we can all come together for shared candid conversations with people who shape industries, institutions, and the world around us.
We've been incredibly fortunate to work with Dean Srikant, Professor Neeley, and the HBS administration to begin bringing that platform to life. And our hope is that several times a year, this room can become one where our entire community of RCs, ECs, partners, executive fellows, and the many more in our ecosystem can gather and hear candidly from extraordinary leaders that leave us thinking a little bit bigger about what's possible with our own careers. And so, thank you for being here at the very beginning.
Quick note on HBS community values. So we wanted to remind everyone in the audience of our shared commitment, of course, to these values, including respect for the rights, differences, and dignity of others, honesty and integrity in dealing with all members of the community, and accountability for personal behavior. And so we thank you in advance for contributing to an environment where differing ideas and viewpoints can be shared in a respectful manner for everyone's benefit in attendance.
With that, it's my great pleasure to welcome our first guest of the Leaders Forum, Mr. George Kurtz, founder and CEO of CrowdStrike, one of the world's largest software and cyber security companies, and co-owner of the Mercedes-AMG Petronas Formula 1 team. George, thanks for joining us.
Great. Thank you. Thank you for being here.
And before we start, I do have to thank you for the invite and, of course, Professor Neeley. And I will say my original application, I'm just going to assume many years ago got lost. But I appreciate that I'm invited back on campus now. So, thank you so much.
It's a great way to come back.
You've got a team here with you.
I got a team here with me.
It's been fantastic, really welcoming. We had some great exercises today. We feel like real MBA students, you know, we argued in our pods and we basically fought with AI and all those fun things. It was a really great event so far.
That's what we do day in, day out.
Sweet. Well, plenty for us to discuss over the next hour. Maybe we could first get started with CrowdStrike's inception. Specifically, you know, this is not your first business.
You started up Foundstone, another cyber security company, in 1999. You then were acquired by McAfee in 2004, which I'm sure everyone is familiar with. McAfee is the antivirus solution that was installed on basically every laptop back in the day. You led McAfee for several years as worldwide CTO, executive VP, in a very customer-facing role. So the first question is, why didn't McAfee build CrowdStrike?
Well, I can tell you the story, and it sort of goes back to when I got acquired in 2004. I didn't really want to sell my first company at the time, Foundstone. But I mean, there's a few lessons to go through with my original investor. So when I started Foundstone, it was 1999, and I was, I think, 30 at the time, and it's a different era now. Like, my first group of investors weren't blue-chip investors. So if you think about it, they took their 1999 fund, invested in us in '99, and then 2000, everything just blew up. So in 2004, we were really the only thing that was worth anything, and sort of the board was like, hey, they wanted to get an exit. You know, whose wife wanted a big house, who wanted to, you know, have a wedding. They went through the whole thing, and I'm like, if I ever do this again, I have to up-level my investors. But we got acquired in 2004, and then I had a bunch of different roles there, mostly GM-type roles, led enterprise sales for a bit, and then I was asked to be the CTO like two times, and I kept turning it down because, yes, I know the technology, but I didn't want to be just the tech guy. So the third time I said yes, the CEO I was working for basically said, can you just help me, give me a couple years because we want to sell the company, and that's how I got to McAfee.
Now, the question you asked is, well, why didn't McAfee do this? Well, when I got into the CTO role, you know the story as it goes, I was traveling on a plane. Now I'm the CTO, and I inherited the broader sort of strategy. I wasn't running engineering, and I was on a plane, and I was circumnavigating the globe. And I left from LA, went all the way through Europe, through Israel, off to Japan, to Australia, and then back around, and that was my trip. And one of the flights, I didn't get the upgrade, so I was back in coach, and I was catty-corner to a guy who opened up his laptop, and he started to boot the laptop, and it had McAfee on it, and it literally took 15 minutes for the thing to boot. And he was getting coffee and talking to the flight attendant, reading his paper, and I'm like, this is such a terrible experience. I can't believe now I've inherited as a CTO McAfee this thing, we have to fix it. So I went back to the guy I work for and said, hey, we've got to move to the cloud. We've got to change the architecture, and basically it was like, hey, we're going to sell the company. Thanks for the great idea. But I did say, okay, I did give you the idea, so if I ever do something on my own, you know, I gave you the idea. So that's why they didn't do it, and it was the long tail, typical innovator's dilemma of not being able to react in time, and ultimately they wanted to sell the company.
Totally. This feels like the quintessential innovator's dilemma, which is taught at HBS by
the late, great Clay Christensen. I'm curious, I mean, you left with what one of your longtime board members noted as the dream team from McAfee. It was you, Dimitri.
Curious, how did you think about the right composition of folks to be at the table when you first launched CrowdStrike?
Well, you had to find, it was all about the people. We have employee zero. There he is. I'm actually, funny enough, I'll tell the story, I'm actually employee 13. Now, how can you co-found a company and be employee 13? Well, when I was leaving McAfee, they're like, the CEO was leaving who was supposed to stay, and he's like, I'm going to leave. And I'm like, well, I'm actually starting a company. It's like, oh, you can't leave. So I stayed an extra couple of months, and I had all the money lined up, and I had the people lined up like Heisen, and basically our original investors, I'm going to get to your question, they were going to give us 25 million. I put money in as well, but until I landed, they only gave us 500,000. And they said, if you don't show up, they're not getting the rest of the money. So everyone, their partners, their people, everybody calls me every day basically saying, are you still coming? Did you remember that, right?
Well, you were there. You didn't need to call me. We're just happy to be there. So at the end of the day, what we focused on is getting the right people. And we literally handpicked the top 20 people from around the world to get the best people in the company. Where's Alex? He's there, too. So these original guys are basically still with the company, right?
Yeah. It's incredible.
That's amazing. I think there are some dogmas out there about how the employees that are right at inception might not be, you know, right for a certain level of scale. The fact that you have a lot of your founding members with you is a testament to, you know, the caliber of folks that you started up with. Curious. I mean, CrowdStrike from inception to now has changed quite a lot. One of the things we learned at HBS is that the CEO role is very dynamic as a business scales. And so curious, like, what was your own evolution as a CEO? Like, was there an area you had to change the most as a leader to adapt to the changing needs of the business?
Well, it's interesting because I was CEO in '99 when I started the company, which, you know, I didn't really know anything about being a CEO. I think I drew the short straw or something, or, you know, I had a business degree and an accounting degree, which is, that's a whole other story. But so you just kind of learn on the job, and again, it was a different time back then, but you kind of realize how much you don't know, and it really is focusing on hiring the best people around you and sort of thinking about each stage of the company. And I mean, I'll talk about this company because obviously I was the CEO before, and it was getting the right people early on, and then making sure that you can nurture those folks, but then also realize that as you grow the company, not every person is the right person for that role at that point in time. And I think that's, you know, one of the key things, you have to recognize who's good for, you know, 100 million or 500 million or a billion or beyond. And the reality is, like, everyone's skill set's a little different. Doesn't mean they're bad people, it just means that perhaps they're not right for the role at that point in time when you're scaling the company. And I think you have to move from doing everything and being in every little detail to really understanding, like, how do you delegate and how do you empower people once you kind of set the operating system of the company and you set the culture, and then you kind of let people do what they do, and then you've got to get out of the way. So, and that's always a hard thing when you start a company because you always want to be in the details of everything. But I think part of it is, like, just letting go in some of these areas and letting people do really what they do best. And that's, you know, you have to learn that over time, but if you can do that, you can really empower people to be the best that they can be.
And on the evolution of the different stakeholders in your business, I spoke about the employees, at the board level. Could you talk about how you think about board composition changing, you know, timing, the expertise that you want on the board? How do you think about that?
Well, I think it's important to have board members who, in my case, wanted to be there for the long haul. As I mentioned earlier, in my first company, they weren't there for the long haul. And they weren't, they're nice folks, but they weren't like blue-chip investors. And so if you look at, you know, the investors that we had now, we had Accel, we had Google, we had General Atlantic, we had IVP, we had Warburg Pincus. So, you know, they didn't need CrowdStrike to make their fund. This was a part of the problem in the first go-round that I had. They needed Foundstone to make their fund. So no one was really pressuring me to sell the company. I had plenty of offers to sell CrowdStrike, but no one pressured me. And I think, you know, everyone realized that if you have the right board members and they have the right vision that you have, that they're going to support you through thick and thin to get you to ultimately the best outcome. If the best outcome was selling a company, sure, we could have done that. But at some point we thought this is going to be pretty big and it should be a public company.
Right. So then coming to, I think, an area of scrutiny for CrowdStrike, July 2024, we had the global outage. CrowdStrike had to respond at a global scale. Without revisiting the technical details, could you walk us through, you know, the leadership decisions that you had to face in the first few hours, right? How did you go about gathering information, understanding the various uncertainties, determining the priorities?
Well, we're working on a case study on that now, and, you know, I think it was, I mean, it's really a testament to the whole company how we responded. But, you know, that first day, I was in the middle of the night for me, and I was on the East Coast. So someone, and it was like, if you've been in a hotel, normally you put your phone by your bed, but where I was, like, they didn't have power, so I put it on the other side of the room, and my phone was on silent, but it kept buzzing, but I never heard it. Someone ultimately was around, and, like, they basically got people to open up the room, and then I woke up, and I'm like, okay, this is, you know, you have messages and missed calls, like, what's going on? So I figured out, called into the CRT, and it was like, okay, this is, you know, we kind of know what happened, this is not good, and, you know, how we're going to respond to it. So we were going through all the technical fixes for the first couple hours, and then when the East Coast time kind of came around, it was like, you know, every news outlet in the world wanted to find out what was going on. They were calling. So I think a big thing for us and for me was to really try to be open and transparent and get in front of it, because really the whole world didn't know, like, what was, did we get hacked? What happened? You know, what was going on? And to complicate it, Microsoft actually had its own outage that day in its own cloud. So it was like, well, how much is CrowdStrike? Obviously, we know we had an issue, but how much was Microsoft? How much was us? What was going on? So the first show I went on was, I was with Savannah Guthrie on the Today Show. Um, lost my voice, you know. It was actually pretty funny. It was like I couldn't even, we were up all night dealing with it. So, you know, the whole thing was, how do you be transparent? How do you take ownership for it? And how do you tell people that you're going to fix it? And I think in a time of crisis, you know, there's a few things that are scarce, and that's sort of clarity and credibility. And if you don't sort of get in front of it and start, you know, telling people what happened and taking ownership, then, you know, the trust is going to be lost. So we did that. Then I got a phone, I got Cramer. He was off, and he never does any Zooms from his house. But he did, he got on the line, grilled me, which he should have. And, you know, I think that was, again, part of the response was, well, how do you get in front of something and take ownership and accountability? And ultimately, you know, that paid dividends for CrowdStrike to, you know, really where we are today.
So being transparent, taking ownership, I imagine there was a segment of the customer base that likely was a bit more apprehensive at that point. How do you think about replenishing trust over a longer-term journey with those customers?
Well, it's the old adage, trust is gained in drips and lost in buckets. I think when you look across the customer base, though, the customers have come to us and said, you know, because you guys were transparent, we actually, you built more trust with us. And that sort of Tylenol moment, you know, most of this group maybe haven't been around for that, but you probably know the story, but Tylenol moment of technology where you actually, like, said you had a problem and fixed it, ultimately built a lot of trust in our customers, and we've done, you know, even better over the years since that.
I think another revealing aspect of that time was how critical cybersecurity is to national security. And so given that CrowdStrike works very closely with many government agencies, how would you say CrowdStrike's responsibilities differ versus a typical software company?
Well, I think what you figure out, particularly when you go through something like we went through, is like, I don't think the rest of the world knew how big we were. Like, we were critical infrastructure, right? So if you're critical infrastructure and you are supporting the largest governments, the largest financial institutions, the largest hospitals, everything, right? We're huge, and we have a blue-chip customer base. So I think, you know, what's important is to realize that we are the folks, you know, sort of silently behind the scenes keeping everybody safe and letting those organizations do what they do best. And that's, it's a tall order. It's a big responsibility to think that you're protecting some of the largest organizations on the planet and their livelihood and their customer base depends on you. So I think that's something that we take very seriously, and we talk about our mission. We don't have a mission statement. You know, we're on a mission. And even in the early days of CrowdStrike, we didn't have an email address that was like jobs at CrowdStrike or careers at CrowdStrike. It basically was mission at CrowdStrike. And what we wanted people to do is to really sign up to the mission of stopping breaches and fighting the bad guys. And I think that is really, you know, that sort of mission-purpose ethos has really held us in good stead.
And on that mission of fighting adversaries, especially in the context of national interests, like, it's not just you as the only cybersecurity company doing that. You're working quite closely with potential competitors, right? And so I'm curious, can you talk about the co-opetition dynamic, perhaps, right? Where, you know, you want to retain your competitive advantage, but there is value in information sharing, right, and collaborating with those folks. What does that look like in practice?
I think the security industry has done really a good job of always sharing information. And some of it, you know, you may think it's competitive advantage that you might be sharing, but at the end of the day, you're trying to keep the world safe. You're trying to keep your customers safe. And by sharing that information, you know, you just get a better outcome. And typically you have these groups like the FS-ISAC or the ISACs where they have these sharing organizations, and that's worked for, you know, the better part of, you know, almost 30 years. But I think that's what makes the security community special, is it's the power of the community, the power of the crowd and the CrowdStrike that has helped security, you know, in my view, stay ahead of the adversary.
So the aggregate outcome is the priority.
Together.
So then coming to today, I mean, the cybersecurity landscape is more complex than ever. You just had your own keynote at Falcon two weeks ago talking about some of the events that have been taking headlines practically every other day. I mean, this past summer, OpenAI, Anthropic, and some of the other model developers have disclosed that, you know, some agents and models have been able to expand outside test environments and create real intrusions. Curious, what would you draw from those incidents? You know, what do you think they reveal about how the balance of advantage is changing between attackers that are trying to perpetuate these breaches and then the defenders protecting?
Well, when you look at this Hugging Face incident, it's a fascinating incident. My view is I think a lot of people actually got it wrong in terms of the takeaway. What I mean by that is you may look at it and go, wow, this is incredible. So you have these agents that, you know, basically worked on behalf of the collective, and, you know, the first wave knew they were going to die, and the second wave, like, they wrote things down for the second wave, and it goes on. It's like good sci-fi. And I think that the takeaway, though, for a lot of people is it was a fully autonomous attack end-to-end, which is true. But for me, the real takeaway was that the most advanced AI wasn't built for the defenders, it was built for the general purpose. And in fact, those agents were able to use it, and their guardrails were removed. But when the defenders needed to figure out what was going on, they actually didn't have access to the most advanced AI. They kept getting refused. So the takeaway for me was, yeah, it's incredible it acted end-to-end, but at the end of the day, you really have to have the best defensive AI to be able to combat the most effective offensive AI. And that, I think, is one of the areas where we'll see this event as a watershed event, and there's a lot of effort now going into defensive AI and basically putting the power back in the defender's hands.
So on putting power back in the defender's hands, you mentioned, right, speed is also, I mean, a real variable here. Attacks are becoming programmatic, right, almost instantaneous. How do you think about what decisions for defenders should be delegated to AI and be entirely programmatic, and where you actually think human judgment still is important?
Well, we talk about the agent state. It moved from the nation state to the agent state, and now the attack speed is not breakout time, which we used to talk about breaking out of a system and moving somewhere else. It's really the speed of inference. That's what we're dealing with. So when we look at the autonomous nature of defense, we want to get, and we aspire to get to a level five autonomy. That is a fully autonomous SOC. The industry is not there. We're not there, but the industry is not there. And there's still a human in the loop, which I think is still important. So you want to be able to take as much of the grunt work out of the equation for a SOC analyst, a security analyst, and you want to automate what AI is good at, looking at a lot of logs, figuring out what's happening, correlating things. But at the end of the day, when you drive automation with agents, which you will and we do, you know, at some point for the higher-order bits, you want to consult a human because the ecosystem is still fragile. And if you're going to take action, you want to take some of these things autonomously, but you also want a human in the loop to be able to really understand if something bad is actually happening and taking action at the appropriate time.
So keeping a human in the loop is kind of the protocol that you're advising to your customers?
In certain cases, yeah. You know, depending on what you're trying to automate, but right now I think where the industry is at, you want to take advantage of as much automation as you can. But at some point there's still a human in the loop. Even if you think about a Waymo, how many Waymos here in the Boston area? No?
No. Okay. So when you come out west, you know, Waymos are all over the place. But when a Waymo gets stuck, you go, okay, this thing gets stuck. What happens? It actually goes up to the cloud, and, you know, there's some guy or gal that's like looking at the video and the GPS going, okay, it's stuck. Let me give it the waypoints, and, you know, they're driving it with the joystick. And that's how it basically gets unstuck. So there's still, even in today's world, there's still a human in the loop on some of these things. And I think that's the way we look at it, is that the analyst becomes a pilot of the agents as opposed to like driving the car themselves.
Right, right. So you're collaborating with the defenders, right? Your customers and other partners. You're also collaborating with the model developers, right? The folks building the innate technology capabilities. Curious, how do you think these model developers need to collaborate with cybersecurity companies to enable safer AI?
Well, I think it's imperative that they do. And I think what the frontier model labs have figured out is that the security companies play a valuable role in delivering AI to customers. We have a trusted role, and we actually have the data that most of the frontier labs want, right? So we've got, like, as an example, we have 15 years of training data that we use because we've seen all these attacks, and we've actually labeled all these sort of events. Sometimes it's better to be lucky than good. Like in one of our parts of business, we were able to kind of label this like 10 years ago, and it now works for training data. But I think it's important to realize that it is a shared effort. Like if you look at the frontier labs, there's work that they have to do on safety and security and, you know, making the models and sort of the agent safer. But that's in training, right? And then you want to put guardrails around sort of, you know, sort of the inference. But the guardrails are not always going to work. And by the way, there's a lot of models that don't have guardrails, right? They're obliterated versions, if you will, where all the guardrails have been removed. So you have to be able to protect runtime. That's a big part of what we're focused on. So we have to work hand in hand together for the benefit of the customer, and I think for the benefit, you know, you look at the larger world. I mean, we'll probably talk about obviously some of the things that happened over the weekend, but it's in everybody's best interest to build in safety from the beginning and then also put the guardrails when these agents are out in the wild.
So then on that front, I mean, in some cases, the adversaries you're fighting, they're powered by agents from the closed models. In other cases, they're using open-weight models. And so how does your approach to fighting adversaries change in that case?
Well, I think I'm a huge fan of open-weight models, and I really do think that's a big part of our future. I mean, if you think about open source and Linux, you know, I've been using Linux when I started before there was even a 1.0 kernel. So I was in there early as a big fan of that thing, and obviously it powers like the world. So these open-weight models are going to be really important for everything that, you know, people want to do here. Like a big part of, I think, where the world is going is that you're going to have your own open-weight model. How many people have their own open-weight models now? Show hands that they use. Not too many. Okay. Well, you can get yourself a Spark, NVIDIA Spark, which are incredible. You can wait for the new Macs that come out, which are going to be the Studios. These are going to be like, for 15 grand, you're going to get like a couple hundred thousand worth of compute, and you're going to be able to run these models at the edge, and they're going to be incredible, and that really is going to be the future. So there's going to be a world where you're going to have a lot of work done with the open-weight models, and then you're also, and AI sovereignty and data sovereignty is going to be critical to that, and then you're going to have the frontier. As one of our customers, a big bank CIO, said it, when I need the Formula One of technology, I'm going to go to the frontier, and then for my sort of daily job and task, the open-weight models are going to be good enough because they're really not far behind the frontier, and that's the way it's going to work. So, you know, hopefully you have some takeaways. If you're not playing with these models, go download them. You can run some of these on a Mac if you're using a Mac, or get yourself a Spark or something and play around. It's an incredibly valuable skill to know.
It's a clear action item.
Yeah, action. I'm coming back. We're checking.
There we go. There we go. Looking overall at your journey at building CrowdStrike, you noted Good to Great as your favorite book. I think several folks in the audience are, okay, there we go, yeah, some folks are very familiar with the book. It's a book from 25 years ago, and it's a book, for those in the audience, about why certain companies are able to endure for long periods of time while other companies struggle. There are specific principles that they share. Curious, looking at your own business with CrowdStrike, are there specific principles that you think have proven particularly valuable, you know, in CrowdStrike being an enduring company? And are there any assumptions that need to change now with AI?
Yeah. So before I answer that, just because now we're sort of in the entrepreneurial area, I want to ask another question. How many people have been an entrepreneur? Show hands. Okay. How many people plan to be? Okay. Big group here. Okay. So that helps the framing. But I think, you know, for me, and again, maybe some takeaways, it really does start with the people. And you have to have the right people. You have to have the right premise. But the company's going to run on the right people. And, you know, you want to create something that's sustainable. And the big part of what I found, and this is why we picked the top 20 people wherever they were, we did remote work before it was fashionable. So in 2011, we were doing an all-remote company. Think about that. Our VCs, like Accel, one of our big ones, they're like, you're crazy. How is this thing going to work? You had people scattered all over the place. By the way, there wasn't Zoom. Like, there wasn't Teams. There, you know, we barely had, we had just janky software that never worked. I don't know how we even got it done. Like, we were using IRC and a few other things. It was crazy, but we got it all working. But we had the right people that I think were crazy enough to realize what couldn't be done, and that's a big part of when you get the right people and you put them in a room, well, they were scattered about, like, you can make magic. So my biggest takeaway is even if we had a crappy plan, we somehow would figure it out. And we had plenty, plenty of times, I think, what's our saying? We tried to fail and failed to fail, right?
Despite our best efforts.
Yeah. So, but we had the right people, and if you have that, even with bumps in the road, you're going to come out ahead.
