Consider the water-plant operator who needs to connect at two in the morning. The equipment has a job to do. The security team has rules. A third-party specialist may have the knowledge required to keep things running, but being useful does not automatically make someone safe to admit. Ethan Schmertzler has spent years working in the space between those facts. It is a small administrative problem with rather large machinery attached.
Today, he is co-CEO and a founder of Dispel, alongside his brother Ian. The company provides secure access to industrial environments. Ethan’s route there includes psychology, front-end software engineering, and technology investment analysis. Away from work, he builds furniture. His biography has room for mountain journeys and an amateur-radio license. The combination is more interesting than a collection of cybersecurity acronyms.
The door that moves
In February 2016, Schmertzler published an argument for giving people greater control over their digital privacy. He described a defensive approach built around infrastructure that changes location, reducing an attacker’s opportunity to find a dependable target. Dispel’s early language was broad: privacy for people and organizations conducting business online. The industrial focus gave that ambition a particular place to operate.
The idea becomes easier to picture if you stop imagining a bigger lock. With Moving Target Defense, the network’s accessible infrastructure changes. An authorized user can still connect through the system, while an outsider has a less stable target to investigate. The difficult part is keeping that movement compatible with ordinary work. Nobody at a factory wants to hear that an ingenious defense has made Tuesday’s maintenance impossible.
Schmertzler has described the technology at the network level: virtual machines, public clouds, and changing routes. There is a useful tension in the design. The security infrastructure moves; the person using it should experience a service that works reliably. A disappearing entrance is only helpful if the invited guest can still get through it. Otherwise, you have invented a remarkably expensive inconvenience.
The access infrastructure changes. The operator still needs a dependable connection.
A psychology graduate at the controls
Schmertzler graduated cum laude from Middlebury College with a bachelor’s degree in psychology. His subsequent work included leading front-end engineering at Triplemint and analyzing early-stage and growth technology investments at National Security Equity Partners. His professional history also includes a summer analyst role at True Ventures. These are different vantage points on the same practical question: what will people actually do with a system?
An interface is where a plan meets somebody who did not design it. Buttons, permissions, and delays become the user’s experience of the entire product. That gives his earlier engineering work a clear relevance to secure access. A control can look perfectly sensible on a diagram and become a considerable nuisance in daily use. The person waiting for it experiences the nuisance, rather than the diagram.
His investment work introduced him to C4ISR, the family of technologies concerned with command, control, communications, computers, intelligence, surveillance, and reconnaissance. By 2014, he was involved in cyberdefense. Later, explaining his move toward industrial systems, he described a field in which tools designed for information technology did not transfer comfortably into operational environments. Machinery imposed its own conditions.
That distinction matters to his career. He did not describe industrial cybersecurity as a lifelong destination already selected in college. He described an interest in security and a problem that needed attention. The resulting business sits where software reaches physical equipment, and where designing for the person using the connection is part of designing the connection itself.
Emily, before the company
Long before Dispel, Ethan and Ian spent a childhood summer in Scotland and visited a wildlife center. Among its birds of prey was a barn owl named Emily. Ian remembers her quietly following them around the grounds. When she took to someone, she could fly over, settle on an arm, and tuck herself inside a jacket. The falcons and eagles had competition for the boys’ attention.
Emily later became part of the explanation for Dispel’s owl logo. The brothers associated her with quiet movement and an ability to be difficult to pin down. It is a family memory, pressed into service as a picture of how they wanted their security to behave. A company can spend a great deal on visual identity. This one had an owl already lodged in the founders’ childhood.
The anecdote supplies a bit of warmth to a business usually described in terms of networks and controls. It also makes the joint leadership less abstract: the brothers’ history predates their job titles. They now share the CEO role. The bird explains the emblem; the work of making a changing network usable belongs to the engineers and operators who built the company around it.
The water plant at two in the morning
Dispel began in Ethan’s New York City apartment. He has described building the company and raising seed funding in 2014; its current corporate history marks the beginning in 2015. By June 2019, he reported more than $10 million in annual recurring revenue. These are milestones from the company’s earlier life, rather than a running scoreboard for the present.
His explanation of the customer problem was unusually concrete. Operational teams needed constant uptime and the ability to reach a water plant in the middle of the night. Information-security teams needed to assess the risks of third-party access. Dispel had to make those requirements coexist. Both groups could be doing their jobs properly and still find themselves disagreeing about the same connection.
Schmertzler described working directly with large institutions and using local systems integrators in overseas markets where the company could not provide all the support itself. In 2019, he named Japan, Korea, and South Africa among markets taking on customers. International expansion, in this account, included the practical question of who would answer when help was needed.
The engineering imposed limits of its own. Moving traffic through additional network nodes adds delay. Automation has to keep disposable environments and changing entry points working at a scale customers can use. Schmertzler’s compact observation was, “Physics is physics.” It is an agreeable sentence to encounter in technology. Even a cloud-based business occasionally has to defer to the universe.
These constraints keep the story grounded. A changing path must still carry traffic. A remote specialist must still reach the equipment. A security team must still have confidence in the arrangement. The founder’s job includes making those needs intelligible to one another, as well as paying for the people who can turn the arrangement into working software.
Good company on an expedition
When Schmertzler talks about Dispel’s culture, he uses the phrase “good expedition behavior.” He has discussed a flat hierarchy and a place for life outside work. The expedition language has some biographical company: his outdoor experience includes Himalaya backpacking, sailing in the British Virgin Islands and Croatia, sea kayaking in Patagonia, and hiking in Italy.
An expedition is an appealing image for a team because the destination is shared and the consequences of poor coordination are difficult to ignore. It also leaves little room for mistaking a title for useful work. That is an interpretation of the metaphor, rather than a description of an undocumented day at Dispel. His stated preference for a flatter organization gives it a practical foothold.
Schmertzler serves on the NOLS Advisory Council. His other publicly described roles include industrial advice to NATO, membership in a CISA sector coordinating council, and a directorship with the National Defense Industrial Association. He also sits on Phillips Academy’s Addison Artist Council. The mix reaches beyond the company, into outdoor education, industrial security, and the arts.
Then there are the smaller details: cycling, skiing, cooking, photography, and a General-class amateur-radio license. None proves a management theory. They do, however, give the life outside work some actual contents. The person behind the remote-access business has reasons to go outside, make something, compose a photograph, or communicate by a different kind of network.
Who is actually at the keyboard?
In 2026, Dispel’s announcements have kept returning to the conditions around access. Integrated Threat Monitoring added a managed service for continuous monitoring and response. At Black Hat USA in August, the company introduced Identity, which brings government-ID checks and biometric matching into industrial remote access. Schmertzler’s concern was the person holding the account, including cases in which credentials have changed hands.
“Credentials can be phished or handed off.”Ethan Schmertzler · August 2026
In September, he published a practitioner brief on NIST’s water-sector remote-access guidance. In October, Dispel announced an engineering leadership change, naming Ken Young CTO and Chris DiLorenzo Founding Engineer. Schmertzler described the change as creating room for both leaders to do their work. The company’s development now includes people, oversight, and evidence alongside the moving network.
His own brief biography offers a quieter closing scene: spare time in a woodshop, building furniture. It would be too convenient to turn every joint in a table into a lesson about corporate leadership. Still, the detail fits a career concerned with making things usable. A piece of furniture eventually has to stand. A connection eventually has to reach its destination. Somewhere beyond the screen, a person has work to do.