Art Gilliland likes boundaries, which is fortunate because his working life has been a long argument about where to put them. He has dealt with malicious messages, vulnerable servers, privileged employees, cloud accounts, and now software agents that can act faster than anyone can revoke their badge. Across a quarter-century in cybersecurity, the nouns have changed. His question has remained admirably plain: who, or what, should be allowed to do which thing?
This is also the small joke tucked inside Delinea, the company he leads. The name was invented after Centrify and Thycotic, two established privileged-access businesses, were combined in 2021. It echoes “delineate” - drawing the line between rights a user needs and the ones that create needless risk. Corporate names often arrive dressed as mythology. This one is practically an instruction on the box.
Gilliland’s own path into the business was less linear. He studied economics at Carleton College, played defensive back, and in 1992 earned third-team Division III All-America recognition. The following year brought an NCAA postgraduate scholarship. Later came an MBA at Harvard Business School, where his listed activities included rugby, motorcycling, and finance. It is a splendidly compact portrait of a future security executive: contact, machinery, and spreadsheets.
The bouncer at the edge of the network
On a Delinea podcast, Gilliland ran through the breadth of his security experience. He had worked in every CISSP domain except physical security, he said, unless one counted his college stint as a bouncer. He did not. The host sensibly did. The anecdote is funny because the job description fits: inspect the arrival, read the context, permit legitimate entry, and be ready when the evening develops opinions.
His early corporate work included consulting at Gemini and roles at loyalty-software company Exchange Solutions. At IMlogic, he was part of the original team and served as vice president of products and marketing. Instant messaging was then spreading through offices with the usual bargain offered by new communications tools: more speed, followed briskly by more ways to cause trouble.
Gilliland became a named inventor on four patents for detecting and preventing malware across instant-messaging networks. The methods examined traffic patterns, automated users, fictitious buddies, and Bayesian filtering. Their language belongs to an earlier internet, but the instinct is current. Watch behavior. Create context. Interrupt the malicious pattern before it travels.
Symantec bought IMlogic in 2006. Gilliland stayed, moving through product engineering, management, strategy, field enablement, and operations. HP recruited him in 2012 to run Enterprise Security Products. The scale had changed enormously, from an early startup team to large global organizations, but his role remained that of translator: bring product architecture, business risk, and customer behavior into the same room and wait until they agree on a sentence.
Paranoia, properly applied
In 2014, while at HP, Gilliland received an email that appeared to come from a conference organizer he knew. It invited him to another event and included a photograph from a previous appearance. One detail snagged his attention: why was a picture arriving as a PDF instead of a JPEG? He asked experts to inspect it. The attachment contained malware tailored to him.
The story has survived because it makes cybersecurity personal without making it theatrical. The specialist was also a target. His advantage was neither invulnerability nor a silver bullet. It was noticing an odd format, pausing before opening it, and letting suspicion earn a second look. “Most executives aren’t as completely paranoid as I am,” he joked at the time. Here paranoia means quality control with sharper elbows.
Gilliland left HP in 2015 to become president and CEO of Skyport Systems, a secure-infrastructure startup. He described having worked at a company as its twelfth employee and having been a pre-product CEO. Skyport put him back inside the smaller-company experiment, securing infrastructure from hardware upward and selling it as a subscription service. Cisco acquired the business in 2018.
Then came a return to Symantec in 2019, this time as executive vice president and general manager of the enterprise business. After Broadcom acquired that business, he led integration and operations. It was useful rehearsal. In 2021 he became CEO of Centrify just as TPG was assembling its combination with Thycotic. Two rivals, each with years of product history, had to become one company without turning customer access into corporate indigestion.
A merger gets a verb
Thycotic was known for password vaulting and rotation; Centrify brought strengths in least privilege and remote access. Gilliland’s pitch for the combination was complementary acceleration: instead of separately building overlapping road maps, invest in a shared one. In early 2022, ThycoticCentrify became Delinea. The new brand gave equal partners neutral ground, while the underlying verb gave the product teams a test. Does this help a customer define and enforce the proper boundary?
The business widened its frame. Authomize, acquired in January 2024, added cloud-entitlement visibility and identity-threat detection. Fastpath, completed that April, added identity governance and access rights for business applications. Delinea said it finished 2024 with annual recurring revenue approaching $400 million, 95 percent recurring revenue, and more than 8,500 customer organizations. The figures matter here mainly as evidence that making enterprise controls easier to deploy is not a quaint preference.
Ease of use recurs in Gilliland’s interviews with almost comic consistency. Sophisticated security products traditionally came with what he once called “nerd knobs,” along with long installations and scarce specialists. His argument is not against depth. It is against forcing every customer to operate every dial before receiving value. A protection nobody deploys is an expensive ornament.
The same pragmatism appears in his management language. He emphasizes communication across functions, focused prioritization, and strong first-line managers. Delinea president Rick Hanson, who worked with him at Symantec and HP, has described a shared moral compass, ethics, integrity, and the implicit trust formed across those years. Gilliland’s own public remark about culture is revealingly selfish in the healthy sense: the workplace a CEO builds is also the workplace the CEO must inhabit.
When the user is made of software
Artificial intelligence has now given Gilliland’s old access question an unruly new subject. An AI agent is not merely an account waiting politely at login. It may call tools, query databases, reach a Kubernetes cluster, and take dozens of actions inside one session. It can be properly authenticated and still do something nobody intended. The permissions debate has moved from the doorway into the room.
Delinea signed an agreement to acquire StrongDM in January 2026 and completed it in March. StrongDM’s runtime-authorization model brought control closer to the moment an action occurs. In July, Delinea released capabilities for evaluating individual AI-agent actions before execution across databases, SSH hosts, cloud consoles, clusters, and MCP servers. Gilliland’s crisp summary was that “the perimeter has moved to inside the session.”
This shift explains his current aspirations better than any polished mission statement. He wants identity to become a control plane for modern security: discover the identities, understand context, grant access just in time, watch what happens, and remove standing privilege where the risk demands it. Humans, service accounts, machines, and agents all enter the model. The enforcement must run at their speed.
His board work has widened too. In March 2026, Skillsoft appointed him as a director, an Audit Committee member, and chair of its Talent and Compensation Committee. He had previously served on the boards of OneSpan and Gigamon. The Skillsoft role lands at a neat intersection: a learning company thinking about human and AI work, advised by an operator who has spent his career deciding how people and software should be trusted.
Practice the bad day
Gilliland’s advice to boards is grounded in rehearsal. He argues for tabletop exercises because breaches contain small communication and recovery details no plan captures on first writing. He has experienced significant incidents both as an adviser and inside affected companies. Practice reveals alternative pathways, missing preparations, and the awkward phone call nobody assigned. Every exercise teaches the organization where its real boundaries sit.
That may be the most portable idea in his career. Security is not a mood of permanent alarm. It is preparation expressed as judgment: notice the strange attachment, simplify the control, rehearse the breach, understand intent, govern the action rather than merely the entrance. The job is to help legitimate work move, while making misuse expensive and visible.
A defensive back studies movement before the ball arrives. A bouncer reads the doorway. A patent studies message patterns. A CEO studies organizations. Gilliland has occupied all four positions, though only three appear on the usual biography. At Delinea, he has turned them into one durable operating question. The future keeps inventing new things that want access. Someone still has to draw the line.