Colby DeRodeff and the trouble with collecting everything

Colby DeRodeff has a job title that seldom appears in a cybersecurity funding announcement: vineyard manager. At Rockbound Cellars, the Paso Robles estate he owns with his wife, Fiorella, his responsibilities include the vines. There is something pleasingly literal about that assignment. A software company can call almost anything a platform. A vineyard eventually has to produce grapes.

The two bought their 33-acre property in 2018. They had built careers in the Bay Area, he in cybersecurity startups, she supporting NASA wind tunnels. Their move to the Central Coast gave them another enterprise to build. Fiorella leads the winemaking; Colby manages the vineyard. Their working lives now include both security telemetry and the decidedly less abstract business of growing fruit.

In March 2025, Rockbound opened a tasting room at the Bottle Shop in Paso Robles’ Railroad Historic District. A photograph from the opening shows the couple with their son, Felix, behind the counter. Bottles line the walls. The family is gathered beneath the winery’s name. For a person whose professional work involves detecting unwelcome visitors, it is a cheerful second business: inviting people in.

His other business, Abstract, starts with an uncomfortable question for the industry in which he has spent much of his career. If security teams can collect ever more information, why does making use of it remain so difficult? DeRodeff helped build the generation of tools that made central collection possible. Now he wants to change the sequence of events.

An early seat at the console

DeRodeff joined ArcSight in 2001 as an early employee. Security information and event management, usually shortened to SIEM, offered a compelling proposition: bring records from different systems together so that defenders could see connections. A suspicious event on one machine might make more sense beside an event on another. Collection was the beginning of a larger conversation.

His work crossed product deployments, professional services and engineering. Later, he managed technical marketing. These are useful places to learn where a product’s elegant explanation meets a customer’s awkward reality. A deployment has a way of introducing exceptions that never made it into the presentation. His career grew around the work of translating between those two worlds.

In 2007, he coauthored Physical and Logical Security Convergence: Powered By Enterprise Security Management with Brian Contos, William Crowell and Dan Dunkel. Its scope connected computer security with physical systems, including access controls and video surveillance. The book’s contents moved from collection to processing, real-time analysis, response and storage. Questions about how separate signals fit together were already part of his work.

He subsequently held a senior leadership role at Silver Tail Systems, which worked in fraud detection. His professional biography links his time at ArcSight to its public offering and acquisition by HP, and his Silver Tail tenure to that company’s acquisition by RSA/EMC. These were separate companies solving different problems, with DeRodeff working where technical capabilities had to become something customers could use.

The information needs somewhere to go

In 2013, DeRodeff and Greg Martin founded ThreatStream, later renamed Anomali. The company addressed threat intelligence: information about attackers, their methods and the infrastructure they use. The challenge was to make that information operational. A list of dangerous addresses is only helpful if it can reach the systems and people deciding what to investigate.

As Anomali’s chief strategy officer, DeRodeff’s remit included strategy, business development and worldwide field operations. ThreatStream’s early advisory board drew people from Cisco, Cloudera and OSG Consulting. Its March 2015 announcement described a platform that brought intelligence from hundreds of feeds into existing security infrastructure. The ambition required connections among both technologies and organizations.

Another move followed in November 2018, when Verodin appointed him chief technology officer. Verodin’s Security Instrumentation Platform tested the effectiveness of security controls. Buying a defensive tool and establishing that it works are separate activities. The company sought evidence about gaps, configuration problems and spending that failed to deliver its intended protection.

That appointment makes a useful hinge in his career. ArcSight dealt with events. Anomali dealt with intelligence. Verodin dealt with validation. Across those assignments, the practical question kept returning: what can an organization actually do with what it knows? A purchasing decision could begin the work. It could hardly finish it.

Before the data lands

Abstract was founded in 2023 and emerged from stealth in March 2024 with an $8.5 million seed round. The launch announcement named DeRodeff, Ryan Clough and Aaron Shelmire as cofounders. Chris Camacho was also identified as a cofounder in a subsequent announcement that May. Abstract’s proposal was to correlate security information while it was moving between systems.

In a July 2025 essay, DeRodeff returned to his early ArcSight experience to explain the change. Centralizing information had addressed the problem of its time. The volume, speed and distribution of modern data called for a different approach, he argued. Waiting for information to be stored and indexed introduced a delay before detection could begin.

“Move detection into the stream,” he wrote. The wording is compact, but its consequences are architectural. Detection can happen before the information arrives at its final destination. Records needed for compliance can follow a different route from records needed for immediate investigation. The same organization may need to retain something without paying to send it through every expensive analytical step.

Abstract calls its approach composable security operations. The components can be assembled and changed, rather than requiring every function to come from one tightly bound system. That is the company’s proposition, with all the execution work that a proposition entails. For DeRodeff, the attraction is giving security teams more control over where information travels and what they do with it.

His April 2025 appearance on Enterprise Security Weekly was organized around security data strategy. The questions were foundational: the challenges, the myths, the tools and the decisions a strategy requires. It is a revealing topic for a founder selling technology. Choosing a destination for the data is easier once someone has decided what the data is supposed to accomplish.

A login is part of the job

DeRodeff’s writing about leadership is considerably less abstract. In January 2024, before the company’s public launch, he published an essay about executives working alongside their teams. He described doing quality assurance, joining proofs of concept and learning the product well enough to demonstrate it. Leadership, in this account, includes having a working login.

He also offered a small concession to professional boundaries. He enjoys reviewing development updates on Friday afternoons, but jokes that his own code might get him expelled from GitHub. The joke gives his argument some air. Staying involved does not require pretending to be the best person at every task. It requires enough contact with the work to understand what colleagues are trying to accomplish.

The same essay asks leaders to share defeats as well as victories, examine their own behavior and keep working with customers after the sale. His 2024 conversation on The SaaS CFO covered another side of company building: choosing investors and drawing on experienced advisers. Product decisions, fundraising and customer experience were treated as connected responsibilities.

There is a concrete example of a professional relationship carrying forward. Christopher Key, Verodin’s cofounder and chief executive when DeRodeff joined as CTO, became an Abstract board member in May 2024. Their association crossed companies. By then, they had already worked on the question of proving security effectiveness, a useful shared history for another attempt to change how security teams operate.

Knowing the product well enough to demonstrate it is part of the job.DeRodeff’s leadership argument, paraphrased

Money, machines and happy customers

In July 2026, Abstract announced a $25 million financing co-led by Cheyenne Ventures and AVP. The round brought total funding to nearly $50 million. Alongside it, the company reported 380 percent year-over-year growth in annual recurring revenue and 264 percent net revenue retention. Those are company-reported business results, measuring revenue growth and the changing value of existing customer relationships.

The money was earmarked for more detection coverage, broader use of Astro AI across security operations and expansion of the commercial team. By September, Abstract had appointed Jonathan Eller as its first chief revenue officer. For a founder, such milestones change the work: an architecture that persuades early customers must also be supported by an organization capable of serving more of them.

DeRodeff’s welcome to Eller included an unusually plain target: 100 happy customers. In his telling, Eller had been considering retirement before conversations with Abstract’s team, board, partners and customers pulled him toward the company. The important adjective in their shared milestone was “happy.” It is a more demanding qualification than a sales count alone.

On The Cybersecurity Bridge in March 2026, DeRodeff discussed AI in terms of specific jobs, including normalizing records and helping analysts handle alerts. He recalled the manual work of categorizing events from many vendors. His account put automation close to the labor it might remove. He also argued that security needs context about an organization’s assets and identities, alongside information about threats.

Asked for advice to security professionals, he said, “Get comfortable with being uncomfortable.” Coming from an early ArcSight employee now advocating a different architecture, the advice carries a particular implication. Experience can tell you why something was built. It also leaves you responsible for noticing when the conditions around it have changed.

The vineyard offers a more visible division of responsibilities. Fiorella makes the wine; Colby tends the growing operation. In software, his public arguments keep returning to what happens before an analyst reaches a conclusion: which information arrives, how it is prepared and whether it is useful. These are different enterprises, each with its own timetable and its own customer. Both give him plenty to attend to before the finished result reaches somebody else.