Glenn Chisholm and the problem beyond the login

Glenn Chisholm had already helped build software to defend computers when he decided that the next company should follow the people using them. In 2017, he left Cylance, joined forces with Carbon Black co-founder Ben Johnson and former Cylance chief data scientist Matt Wolff, and started Obsidian Security. Their earlier work had put them close to enterprise customers. Those conversations kept exposing another difficulty: understanding who was using an account, what they could reach, and whether their activity belonged there.

It was a promisingly unglamorous place to begin. The office application is where someone updates a customer record, shares a document or checks a payslip. Give the wrong person the right account and ordinary business software becomes remarkably accommodating. A criminal need not announce an arrival with the digital equivalent of a crowbar. Sometimes the system helpfully holds the door.

Chisholm's explanation for starting again was refreshingly concrete. Building products was enjoyable. Customers had problems that he and Johnson thought they could solve. He called it an “enjoyable challenge.” That is a modest phrase for voluntarily returning to the beginning of a company, where a large part of the job consists of persuading excellent people to join something still being assembled.

Two rivals, one customer problem

The founding team crossed competitive lines. Chisholm had led technology and product work at Cylance; Johnson had co-founded Carbon Black. They had known each other for years and had previously explored ways to connect their companies' products. A mutual friend suggested a startup. Wolff brought another existing connection: he and Johnson had crossed paths at the National Security Agency.

The geography helped. Johnson was ready to exchange Chicago winters for Southern California, and the founders established the company in Newport Beach. Talent, nearby universities, airports and access to Silicon Valley all figured in the attraction. There are elaborate theories about the formation of technology clusters. Occasionally, wanting colleagues nearby and a less punishing winter will do.

Greylock led a $9.5 million Series A announced in June 2017. Asheem Chandna and Sarah Guo joined the board. Before the investment came whiteboard sessions, dinners and conversations with potential enterprise customers. The early work was deliberately practical: recruit the engineering and data science team, build alongside design partners, and test whether the proposed product addressed a problem customers actually had.

The company initially described its territory as user security across hybrid cloud environments. That wording matters. Obsidian did not arrive in 2017 with every subsequent product category neatly attached. Its founders were following a change in how companies worked, and the language evolved as the business took shape. The starting point was the account and the person behind it.

Before the startup, the responsibility

Chisholm's earlier career included research at the San Diego Supercomputer Center and engineering at Cisco. His education combined computer science at Curtin University with an MBA from Melbourne Business School. That combination sits comfortably beside the jobs that followed: technical decisions, product decisions and the business consequences of getting either wrong.

At Telstra, he became the telecommunications company's first chief information security officer. His responsibilities extended to security operations and to services used by managed-services and consumer customers across the Asia-Pacific region. Before selling a security product, he had occupied the seat of the person expected to make security work across a large organization.

A CISO has to decide which problems deserve attention, how a defense fits existing operations and what happens when people need to keep doing their jobs. Chisholm's subsequent roles brought him to the other side of that conversation. At Cylance, as chief technology officer, he directed product strategy and led research and development teams, connecting technical work with something customers would deploy.

Cylance used machine learning to identify malware. Chisholm's work there covered the product, engineering and research organizations. He left for Obsidian in 2017, before BlackBerry later acquired Cylance. The sequence is useful: his move into a new company came while there was another security problem to pursue, rather than after waiting for that acquisition to close.

The mathematics under the job title

There is a more technical entry on Chisholm's record than the usual sequence of executive titles. He co-authored a 2016 research paper with Michael Wojnowicz, Di Zhang, Xuan Zhao and Wolff on reducing the size of very large datasets. Its title, “Projecting ‘better than randomly’,” has the pleasing restraint of a researcher making a measurable claim.

One experiment involved malware classification using more than 10 million samples and almost 100,000 features. The authors developed a large-sample version of randomized principal component analysis, then compared it with random projections. Across the tested target dimensions, the method reduced classification error by between 37% and 54%. These were experimental results under specified conditions, rather than a claim about every security product.

The underlying question is understandable even without the mathematics: how do you compress an enormous amount of information while keeping what matters for a decision? Security products face that sort of question constantly. An executive who appears on a paper about it has left a different kind of public footprint from an executive whose involvement ends at the product launch.

The quiet business of stealing a paycheck

By December 2021, Chisholm was writing about a much less cinematic form of cybercrime: attacks on employee self-service systems. His example concerned compromised Workday accounts. Attackers could redirect wages or take tax documents. The attraction was repetition. An account containing information about one employee might appear limited, while a collection of those accounts could make a worthwhile criminal business.

His explanation paid attention to the awkward details. Employees change bank information infrequently, yet across a large workforce such changes are routine. That makes an individual malicious edit difficult to distinguish from normal administration. Security teams also need visibility into software managed by other business departments. The difficulty sits between people, permissions and organizational boundaries.

For a reader accustomed to hearing about spectacular breaches, the subject is usefully deflating. Payroll fraud requires very little theatrical ambition. The criminal would prefer the transaction to look boring. Chisholm's interest in those mechanics gives the account-security argument an everyday consequence: the money someone expected to receive for doing their work.

In a separate piece on extending zero trust to SaaS applications, he argued that checking identity at the entrance leaves work unfinished. Stolen sessions, connected applications and accounts without a human user also require scrutiny. The application itself carries information about privileges, configuration and behavior. Authentication opens the conversation; ongoing activity supplies the rest.

A face designed for radio

As Obsidian grew, Chisholm's title changed. Hasan Imam became chief executive at the start of 2021, and Chisholm subsequently served as chairman and chief product officer. In April 2025, Obsidian appointed Khanh Tran as its new CPO. Chisholm now appears on the company's board and serves as an operating partner at SYN Ventures.

His public appearances span both the mechanics and the larger stakes of security. In February 2021, he joined journalist Nicole Perlroth for a Greymatter conversation about the cyber arms race. In an April 2023 Techstrong TV interview, the focus was closer to the administrator's desk: misconfigurations, threats, entitlements and compliance across SaaS applications.

Then there is the less ceremonial version of the speaker biography. Sharing an interview recorded around RSA Conference 2024, Chisholm made a joke about his suitability for radio. Ryan Golden had nevertheless got him on camera. It is a small joke, but a welcome one in an industry whose public vocabulary can make even a software setting sound like a matter for a war cabinet.

A 2022 post celebrating Obsidian's Series C offered another glimpse of how he describes the work. He credited colleagues' effort and curiosity, thanked co-founders who challenged him, and acknowledged investors and advisers by name. The public account of the milestone was populated by people. The funding announcement supplied the number; his response supplied the relationships.

“Typically, mine is a face designed for radio.”

Glenn Chisholm, sharing his RSA 2024 interview

The next account may belong to an agent

The company's problem has continued to change. In August 2026, Obsidian announced an $85 million Series D at a $1.1 billion valuation. The round was led by Crescent Cove Advisors, with existing investors participating. The business was now describing its work around non-human identities and AI agents operating inside third-party applications.

The connection to its beginnings is easy to see. A human account can have too much access; an automated agent can inherit that access and use it. Understanding permissions and connections remains central even when the actor changes. Obsidian's announced capabilities included agent access governance, runtime protection and inventories of the servers and models supporting agent activity.

Those announcements belong to the company and its current leadership. Chisholm's present role places him in a wider set of security businesses. His SYN biography includes board work at Obsidian, Delphos Labs, Icite and Miggo, alongside earlier board roles at Hexadite and Vulcan Cyber. His experience now reaches founders through investment and governance as well as through products.

There is a useful continuity across that career: operating a defense, helping engineers turn research into software, starting a company around customer conversations, and then working with other company builders. Each job supplies a different view of the same purchasing decision. Someone has to live with the product after the demonstration is over.

Return to the original attraction: an enjoyable challenge. The phrase leaves room for difficulty without requiring a heroic pose. In Chisholm's career, the work has moved from telecommunications and computers into accounts, applications and now the companies securing automated actors. The ordinary question survives every change in vocabulary: who has access, what are they doing with it, and who is paying attention?