A marketer who reads the dependency tree
Every modern product is mostly other people's code. The login form on your bank. The CSV parser inside your payroll provider. The encryption library buried six imports deep in your CRM. Eighty percent of any shipped application is open source, and somebody, somewhere, is responsible for knowing what's in it.
That somebody, more and more often, is a customer of FOSSA. And FOSSA - founded by Kevin Wang in 2015, headquartered at 114 Sansome in San Francisco, fifty-seven people and counting - is now run by Aaron Williams.
The promotion was not the obvious one. Aaron joined in May 2022 as VP of Marketing. He was promoted to CMO. Then, in early 2026, the board moved him into the CEO seat and slid founder Wang up to Chairman. Marketers rarely get the keys to enterprise software companies. The board, which counts Bain Capital and Costanoa Ventures among its members, decided this one would.
The shape of the company he inherited
Twenty years of selling code to coders
Read the resume backward. Williams started at Sun Microsystems, the company that gave the world Java and treated developer relations like a religion. He's been working that vein ever since.
Where he's been
D2iQ was Kubernetes when Kubernetes was still spelled with a lowercase k. OmniSci ran SQL on GPUs before that was a trend. Civis Analytics built data science tools for political campaigns and Fortune 500s. The throughline isn't an industry; it's a kind of buyer: an engineer who has opinions, a budget, and very little patience.
Timeline
Two Case Western Reserve degrees - a B.S. in Computer Engineering and an M.S. in Computer Science. Twenty years of marketing. The CEO title finally caught up to the diplomas.
What FOSSA actually does
Automated detection of every open source license inside a codebase, plus policy enforcement so legal stops being the bottleneck.
Generate, ingest, analyze, and share software bills of materials in the formats regulators and customers now demand.
Real-time vulnerability detection across packages, containers, snippets, and binaries - with prioritization that matches actual risk.
Categories like this used to be a checkbox on an enterprise compliance audit. Then governments started writing SBOM requirements into procurement contracts. Then security incidents like Log4j made everyone read their dependency trees. FOSSA had the rails already built.
What he's like, near as we can tell
Williams's public footprint is quiet. A LinkedIn page. A Twitter handle that is, charmingly, just his initials: @_arw_. A speaking slot at FOSSY 2023 about how to sell compliance to engineers who, by training and disposition, suspect compliance is a trap.
That talk is the closest thing to a manifesto on file. The premise: engineers will tolerate a security or license review when it makes their day easier and their pull request faster. They will sabotage it, politely, when it does not. FOSSA's product team has spent a decade hunting for the line between the two. Williams's job, first as marketer and now as CEO, is to make sure the line stays on FOSSA's side.
The trajectory says something about who Aaron is. Engineer by training. Founder twice over before Mesosphere. Pickier about audiences than about industries. Comfortable handing the spotlight to the founder for almost four years before stepping into it.
- Operator - long stretches at the VP layer suggest he ships, not just pitches.
- Developer-empathetic - careers spent at companies whose buyers run terminals.
- Community-first - the D2iQ years were not coincidence.
- Pragmatic about compliance - he literally titled a talk about it.
The room behind the curtain
FOSSA's cap table reads like a software supply chain investor convention. Institutional money from Bain Capital, Costanoa Ventures, and Canvas Ventures. Angels including Marc Benioff (Salesforce) and Steve Chen (YouTube). A Series B of $23.2M in 2020, with additional financing rounds bringing total funding to roughly $43.5M as of mid-2025.
The strange specific
His Twitter is @_arw_. Just initials, bracketed by underscores. Pre-vanity-URL energy.
Lives in Santa Clara. Runs a San Francisco company. Commutes both directions of the Caltrain culture war.
Founded and ran two entertainment-tech startups as CEO before the marketing chapter. The CEO title is not new - the stage is.
Spoke at FOSSY 2023, Friday July 14, 2-3pm, room E148. The title was a one-line product positioning doc.
The bet
Aaron Williams is betting that the unglamorous layer of modern software - what's in your code, who wrote it, what license attaches to it, whether it has a known vulnerability - becomes a default of enterprise engineering, the way version control did a decade ago and CI/CD did after that. Not a tool you choose; a tool you assume. He runs the company best positioned to be that default.
If he's right, FOSSA stops being a procurement line item and starts being a standard. If he's wrong, the category gets absorbed into a larger security platform and the marketer-CEO becomes a case study about whether revenue leaders should ever run product-led companies. Either outcome is interesting. Most CEO seats are not.