Brendan Hannigan’s first security post came with a uniform, a long shift and an exit strategy of running away. He was a University College Dublin student spending a summer in Boston, taking whatever work he could find: a stint at Aris Barbecue in Faneuil Hall, minimum-wage jobs and then Pinkerton. The promised assignment sounded agreeable enough - checking IDs at a subsidized cafeteria. Before he earned that comfort, he was sent on a 24-hour tour near a film production, guarding a vehicle in a rough stretch of the city. A Marine stood beside him. Hannigan later admitted the Marine was useful because, if trouble arrived, his own plan contained little beyond speed.
He tells the story with the timing of someone who has spent years in cybersecurity and retained a sense of proportion. Software work can be tiring, he has said, but “we’re not coal miners.” Even a bad day in software is still pretty fine. The line does not dismiss pressure. It drains the theater from it. Hannigan’s career has included two founders’ journeys, a consequential acquisition, a global corporate division and the usual weather systems of venture-backed software. He prefers the problem to the pose.
01 / The useful detourThe class he did not choose
Growing up in Dublin, Hannigan expected science to be his route. He entered UCD interested in physics and chemistry. Then the university required its first-year science students to learn FORTRAN on a VAX. Chemistry experiments were stubborn. Programming was absorbing. He moved into computer science as quickly as the timetable allowed and graduated with honors.
At Digital Equipment Corporation in Ireland, he wrote software for terminal servers. The frontier was modest by present standards: moving from eight ports to 16, and from 9,600 baud to 19.2. It was still a frontier. The work taught him to see a network as a living system, with traffic, constraints and behavior that could be understood from code.
A job advertisement in a British newspaper pulled him back across the Atlantic. He interviewed in London, joined Motorola Codex in the Boston area and began writing switching software. Wellfleet Communications followed. Boston’s networking industry in the early 1990s offered the challenge he had gone looking for, and Hannigan settled in the United States.
Then came an apparent side road that would shape the operator. At Forrester Research, he joined the networking group and eventually ran its network and security practice. The late 1990s were a loud argument among switching, routing, Ethernet and Token Ring. Forrester made analysts state a view, write it clearly and survive review by a roomful of peers. Hannigan learned that being right about the technology was only half the job. A market also needs a frame, a position and a story people can repeat.
“You’ve just got to be in a company building things because otherwise you just get too frustrated.”Brendan Hannigan, on leaving the analyst’s seat
02 / The first buildFrom reading the melee to joining it
By 2003 he wanted back inside a company. At Q1 Labs, he met Sandy Bird, a gifted technical founder in Fredericton, New Brunswick. Hannigan did not arrive as chief executive. He began with marketing and technology responsibilities, became chief operating officer, then president and COO, and finally CEO in 2011. The progression matters. His authority grew beside his understanding of the product and the people who made it.
Q1 Labs built QRadar around security intelligence: gather signals from across an organization, correlate them and show the suspicious pattern hidden among ordinary events. The idea suited Hannigan’s mixed education. The engineer could understand the machinery. The former analyst could explain why a pile of isolated alerts was less useful than a coherent picture.
IBM acquired Q1 Labs in 2011. Hannigan had told the team they came to become number one in their market; the larger company, he believed, could accelerate the trip. IBM then made an unexpected request. A senior executive traveled to Massachusetts for lunch and asked Hannigan to lead a newly formed security division. He had never run anything at that scale. That was enough reason to try.
The division brought together products, research, services and the QRadar platform. Under Hannigan’s leadership, IBM Security grew into a business of roughly $2 billion in revenue. He describes the transition with a sailor’s distinction. In a small 420 or Optimist dinghy, a sailor must understand the whole boat: wind, tack, balance, movement. On a large vessel, a person can master one station without learning to sail the entire thing. Startup life had taught his team the whole boat. IBM gave them the instruments and crew for a much bigger one.
03 / The second buildThe permissions underneath the cloud
After the long Q1 and IBM run, Hannigan took about a year away. He later joined Polaris Partners as an entrepreneur partner, worked on investments, chaired container-security company Twistlock and served on boards including Flashpoint. Advising was satisfying. Building remained more so. The timing improved when Bird became available again.
They founded Sonrai in 2017, with offices in New York and deep engineering roots in Fredericton. The name means “data” in Irish. Sonrai launched publicly in 2019 with $18.5 million in Series A funding and a thesis that the public cloud had changed the security object itself. In a data center, teams could protect a perimeter and inspect devices. In a cloud, infrastructure arrives through code. A serverless function may exist for less than a minute and still possess a path to important information. Human users share the estate with applications, scripts and services, each carrying an identity and some collection of rights.
The innocent-looking permission chain
Direct access is only the first line. Effective access can travel through roles, services and inherited policy.
The practical question is wonderfully blunt: what can this entity do? A policy may show what an identity was granted directly. Effective permission can flow through roles and relationships, opening routes that no single configuration screen reveals. Across AWS, Azure and Google Cloud, tens of thousands of possible permissions turn an administrative list into a graph problem.
Sonrai maps that graph and watches what is actually used. Its Cloud Permissions Firewall, introduced in 2024, applies cloud-native policies to restrict unused sensitive access, services and regions. A permissions-on-demand workflow can return access when a legitimate need appears. One deployment publicized by the company reduced a customer’s identity and permissions work from an estimated six months to six days.
“Eliminate the ability for attackers to roam freely around inside a cloud without detection.”Brendan Hannigan’s concise advice to a growing enterprise
04 / The operating habitMake the system legible
The continuity across Hannigan’s work is less about a category called cybersecurity than a habit of legibility. At Digital, software moved traffic through ports. At Forrester, a clear argument organized a noisy market. At Q1 Labs, analytics assembled security events into a meaningful pattern. At Sonrai, a graph connects identity to action and action to data. Each chapter takes a system that grew too complicated for unaided attention and gives an operator a useful picture.
He also returns to people he trusts. Bird links the first company to the second. Polaris relationships extend back to the early 2000s. Hannigan has said that, with time, he increasingly wants to work on interesting things with people he likes. His hiring shorthand is a two-by-two matrix of intelligence and personality. The phrase is casual; the preference is serious. Complex work gets easier when the room contains both ability and generosity.
Outside the grand architecture, his public advice is disarmingly local. Get a password locker. Leave Zoom occasionally and make an old-fashioned phone call. In New York, where Sonrai is close to the large companies it serves, his preferred lunch meeting is Pershing Square by Grand Central. His favored pizza slice is at Gino’s on First Avenue. The cloud may contain 42,000 possible permissions. Lunch still benefits from a place everyone can find.
Hannigan’s latest concern is the pace of machine identities and AI agents. Software can now exercise a permission at machine speed, making an old excess-access problem move faster. His answer remains consistent: understand the relationship, remove what is unused, and make legitimate access available when required. It is an engineer’s response to a managerial mess.
A career can look inevitable when read backward. This one began with a science student surprised by FORTRAN, passed through a newspaper job advertisement and a Pinkerton shift, and kept bending toward the next system that needed explaining. Hannigan still prefers the small boat, close to the wind and responsible for the whole thing. There is usually another open door somewhere in the architecture. He would rather build the instrument that finds it.