Deke George and the trouble with a reassuring answer

Deke George had a useful description for corporate risk management: a game of telephone. The message passed between departments, each with its own vocabulary and priorities. By the time it reached someone who could make a decision, what survived? In 2010, reflecting on the Secure360 conference in the Twin Cities, he put his finger on a problem that no clever piece of software could settle by itself.

He was responding to a presentation by security researcher Rich Mogull. Risk was abstract, consequences could be distant, and people were inclined to deal with whatever needed attention immediately. George enjoyed the challenge of making these awkward subjects intelligible. His addition was organizational: send that already difficult idea through several departments, and understanding becomes a much more ambitious undertaking.

It is a revealing place to begin with the co-founder and former CEO of NetSPI. His business tested security. His writing kept returning to the people who had to interpret the results. A vulnerability could be demonstrated on a screen; persuading a company to treat it seriously involved a rather larger cast.

Before the warning, the evidence

George studied physics at Middlebury College, earning a Bachelor of Arts. He began his career helping establish the computer-forensics program at Ontrack, working on computer fraud and evidence cases in the United States and overseas. That was work concerned with establishing what had happened. NetSPI, founded with Seth Peter in 2001, would make a business of examining what could happen.

The distinction gives his career a coherent shape. Computer evidence has to support an account of events. A security assessment has to support a decision about exposure. In both cases, an assertion becomes more useful when someone can show the workings. George's subsequent experience included consulting, sales and leadership: several different places along the route between a technical finding and a customer's decision.

A colleague, Dave Payne, described that movement from technical work into sales and then entrepreneurship in a public recommendation. He emphasized George's persistence in relationships and attention to customers. John Morris likewise singled out his business judgment and ability to build lasting relationships. Those are colleagues' assessments, but they help explain how the technical career and the commercial career fitted together.

Who gets to hear the bad news?

By October 2009, George was looking closely at where chief information security officers sat in the organization chart. The title alone told an incomplete story. Reporting lines varied, and those lines helped determine how a company understood risk. He observed that more risk-sensitive businesses tended to place security leadership higher in the hierarchy, sometimes outside the IT department altogether.

He also noticed that the board could become a regular audience regardless of the formal reporting structure. It was an observation about access as much as authority. A person can be responsible for a problem without having a particularly direct route to the people who control the response. George expected the security role to gain prominence as these arrangements evolved.

In March 2011 he made the board's responsibility more explicit. Directors needed understandable information, recurring attention to security and a willingness to fund it. Technical teams, in turn, had a duty to explain exposure in terms directors could use. The argument distributed the work across both sides of the conversation. A boardroom full of puzzled expressions was hardly a security control.

“making the point to a non-IT oriented board takes tangible events and understandable facts.”

Deke George · 2011

A pass mark can be too comforting

His interest in communication did not make him indifferent to technical detail. In an April 2010 discussion of payment-card compliance, George examined how a high audit pass rate could coexist with doubts about whether organizations took security seriously. He was reading a survey of assessors and questioning the comfort its numbers appeared to offer.

The concerns were specific: judgment in the auditing process, reliance on compensating controls, and the gap between owning protective technology and implementing it correctly. He wanted stronger verification and competent, honest assessment. Compliance could help a company begin to deal with risk. Its usefulness depended on what people actually checked and how seriously management treated the result.

He had already taken this curiosity abroad. After a European PCI community meeting in 2009, he wrote about adoption, enforcement and the limits of familiar defenses as transactions moved online. The interesting part was the combination: technology, banks, card brands and local expectations all affected behavior. A standard had to travel through institutions before it could change a working business.

The door beside the application

In July 2011, George challenged another reassuring idea: that an organization could consider its network dealt with and move its attention almost entirely to applications. NetSPI's application-security work had grown, and cheaper scanning tools had changed the market for network assessments. He still wanted customers to examine the whole environment.

His list was concrete: patching exceptions, weak system configurations, neglected databases, embedded passwords and inappropriate trust relationships. Then came physical operations, business processes and people. An attacker could combine these weaknesses. A company's division of labor did not oblige an intruder to stay within the same departmental boundaries.

George's proposed scope covered process, physical security, networks, systems, databases and applications. The appeal was practical: examine the available routes together. There is something faintly comic about spending a meeting debating the most sophisticated defense while an ordinary weakness waits politely elsewhere. His work depended on making that possibility visible before a hostile visitor supplied the demonstration.

A raised eyebrow in Las Vegas

George's conference writing also had a dry edge. After Black Hat in August 2011, he praised individual presentations and the parties, yet thought the industry itself seemed short of energy. Bigger audiences, more media attention and larger budgets had not produced the shared sense of direction he had hoped to see.

He enjoyed Moxie Marlinspike's presentation, found Nelson Elhage's work on KVM interesting and welcomed discussion of mobile security. He could appreciate the research while asking harder questions about the businesses surrounding it. The contrast made his account more interesting than an attendance report: he was watching both the stage and the market forming around it.

That concern predated the conference. In 2009 he had examined successive waves of security acquisitions, worrying about integration, focus and independence. Buying several capable businesses did not automatically explain how their work would fit together. For a founder running a specialist firm, the question had obvious commercial relevance. He was thinking about what scale might preserve, and what it might complicate.

Sixteen years before institutional money

NetSPI announced its first institutional financing in April 2017, sixteen years after its founding. Sunstone Partners led the growth investment. The intended uses included product development, additional services, new markets and geographic expansion. George joined a board that also included Sunstone's Gustavo Alberelli and Michael Biggee, alongside Scott Hammack and Stuart Scholly.

The company's proposition already combined professional services with its CorrelatedVM software. That combination matters to the story: expert work generated findings; software helped customers organize and use them. George described clients facing business, regulatory and governance pressures. The customer had several reasons to commission a test, and needed a workable way to handle what followed.

Later in 2017, Aaron Shilts arrived as president and chief operating officer, bringing experience leading services at Optiv and FishNet Security. George remained CEO. The additions extended to software engineering, sales, marketing and product management. Growing the company meant building the organization around the testing work, with separate responsibilities for delivering it, developing the software and reaching customers.

The handover after the growth

On January 26, 2021, NetSPI announced that Shilts would become president and CEO, with George moving to chairman and remaining involved. The announcement followed 35 percent organic revenue growth in 2020, more than 150 new clients and a team exceeding 200 people. Revenue had tripled since 2017 while the company remained profitable.

The figures mark the scale of the business at the handover, rather than a claim about any one person's contribution. NetSPI credited its penetration-testing-as-a-service model, expanded services and the acquisition of Silent Break Security. Its Resolve platform connected customers with testing results and remediation work. The business had acquired more machinery for turning specialist attention into an ongoing service.

George was still concerned with governance. A 2020 webinar brought him together with former CIA chief information security officer Bob Bigman and moderator Dan Raywood. The discussion covered program design, teams, automation and implementation. In that conversation, George emphasized the people needed to move from a compliance focus toward a better understanding of risk. The old telephone problem had survived several generations of technology.

Following the investigation

His later public connections extend into security operations. Wirespeed names George among its original investors, alongside figures including Gary Fish and Jeremiah Grossman. Its founding team includes Jake Reynolds, who previously helped build NetSPI's testing and attack-surface-management products. There is a recognizable connection here between people who built security services and a newer business working on investigation and response.

Coalition announced its acquisition of Wirespeed on November 6, 2025. For George's profile, the significance is a documented investment connection to another part of the security workflow. At Command Zero, he has also publicly endorsed tools that help analysts investigate complex cases and report consistently. His attention reaches beyond discovering a weakness to the work required when an alert needs an answer.

Across these episodes, the recurring concern is what happens between knowing and acting. The young company needed customers to understand an assessment. The growing company needed systems and leaders to deliver it. Directors needed facts they could use. Investigators needed a way through their cases. George's career keeps arriving at that unglamorous junction where the evidence must become somebody's next task. It is a good place to ask another question.