Hugh Njemanze and the trouble with knowing too much

At Black Hat in 2024, Hugh Njemanze encountered a peculiar kind of funeral. Vendors were declaring security information and event management dead while promoting their own security information and event management products. The deceased, apparently, was still taking orders.

Njemanze had helped build the category they were burying. He co-founded ArcSight in May 2000, served as its chief technology officer, and watched it become part of Hewlett-Packard a decade later. By the time of this latest obituary, he was President & Founder at Anomali, working on another generation of security software.

His response was to argue for changes in how the technology worked. Faster analysis. Software designed for cloud infrastructure. A cost structure that did not punish customers for collecting the evidence they needed. There was plenty to fix, in his view, without commissioning a headstone.

That episode offers a way into his career. Across enterprise search, security analytics, and threat intelligence, Njemanze has worked where information becomes difficult to use. Computers are quite capable of accumulating clues. Getting them to help a person reach a decision has proved a more durable occupation.

Before the security console

His technical foundation includes a B.S. in computer science from Purdue University. At Apple, he worked in software engineering and helped architect the Data Access Language, known as DAL. His subsequent career took him to Verity, a company making knowledge retrieval software.

From 1993 to 2000, he held several positions there, ultimately becoming CTO. Enterprise search and cybersecurity might occupy different budgets, but their proximity is easy to see: both ask software to retrieve something useful from material that a human could not comfortably inspect alone.

ArcSight gave him a different setting for the information problem. Networks produce records of what their devices and applications are doing. Taken separately, those records can be difficult to interpret. Correlating them can expose activity that warrants investigation. ArcSight helped make that work a product that organizations could buy and operate.

Njemanze’s responsibilities were substantial and specific. He led product development, information technology deployment, and product research. By March 2002, he held the CTO and executive vice president of research and development roles. This was an engineering brief with responsibility for turning a technical proposition into working software.

The patent record supplies a closer view of the machinery. His listed inventions include work on synchronizing network security devices, modifying timestamps, and correlating events using time-based rules. The names sound less dramatic than the threats a security team investigates. They concern the practical details that let records from different places be examined together. Some patents list Njemanze alone; others list collaborators, including Pravin Kothari, Hector Aguilar-Macias, and Christian Beedgen. The record shows an inventor working on particular components, alongside the executive responsible for the larger product.

The deal, and the next desk

In October 2010, HP completed its acquisition of ArcSight for $43.50 a share, at an enterprise value of $1.5 billion. A figure like that tends to swallow the rest of a career in the retelling. It supplies a convenient ending, complete with arithmetic.

Njemanze’s work continued inside the acquiring company. His responsibilities expanded to engineering and research and development across HP’s Enterprise Security Products group. HP described his remit as overseeing product strategy, development, and support. The acquisition changed the organization around the work and widened the territory he was responsible for.

That same year, he received the Northern California Ernst & Young Entrepreneur Of The Year award in the Software category. Recognition and a corporate transaction made 2010 an eventful year. Neither explains the next move on its own.

He subsequently became an advisor and entrepreneur at Kleiner Perkins Caufield & Byers. In February 2013, Qualys announced that he had joined its technical advisory board. The assignment was to contribute his experience as Qualys expanded its cloud security platform. He had moved from building inside a large organization to advising people building elsewhere.

These roles matter because they complicate the usual startup shorthand. A founder’s career can include product architecture, management, acquisition integration, and advice. The job title changes faster than the need to understand what a customer is trying to accomplish.

A list is only the beginning

ThreatStream was already operating when Njemanze became CEO in June 2014. His appointment was announced the following month. The company’s founder, Greg Martin, remained CTO, while Colby DeRodeff took on chief strategy responsibilities. Anomali now lists Njemanze as President & Founder; his arrival as chief executive is a distinct event in that history.

ThreatStream offered a proposition with an obvious appeal: collect information about cyber threats and make it available to organizations trying to defend themselves. Njemanze also emphasized trusted sharing. Businesses might recognize the collective benefit of exchanging threat information and still struggle with the technology and the willingness required to do it.

His appointment announcement described that obstacle in both technical and cultural terms. Collaboration needed a workable arrangement. A useful platform had to fit institutions that were understandably cautious about what they disclosed and to whom.

By February 2016, he was explaining another obstacle: intelligence that never reaches the tools where defensive work happens. He described an elaborate relay involving email, research across portals, requests to security operations teams, and reports coming back. Each handoff gave a useful piece of information another opportunity to become somebody’s unfinished task.

“More threat intelligence is interesting, but not useful until you add it to your technology to utilize it.”

Hugh Njemanze, February 2016

His language was plain. The value of a threat feed depended on its connection to a customer’s existing defenses. The quantity of information available could be impressive while the practical benefit remained elusive. A warehouse full of warning labels is an odd substitute for putting one on the right door.

That February, ThreatStream became Anomali. The product retained the ThreatStream name as the business expanded its offerings. The change gave the company room for a broader identity, while the underlying argument remained recognizable: intelligence should help a business decide what matters inside its own environment.

The president picks up a bass

On March 1, 2021, Ahmed Rubaie became Anomali’s CEO. Njemanze moved to president and remained on the board. The announcement said he had worked with the board on the change. It was a leadership transition with an ongoing role for the outgoing chief executive.

The person behind these titles also turns up in a different set of credits. The Brian Estlin Confluence, a six-piece electric jazz group, lists Hugh Njemanze on bass alongside saxophone, trumpet, guitar, keyboards, and drums. An album credit is a pleasantly economical biography. It tells you what someone actually played.

At Anomali’s 2024 go-to-market kickoff, the bass came to a company occasion. The gathering included talks, workshops, team activities, and dinner at Kincaid’s. Njemanze performed with an AI backing band. After years spent helping software deal with human work, here was software helping with his accompaniment.

There is no need to turn the bass into a theory of management. It is enough that a security software executive has another practice, with other collaborators and a different kind of listening. The recording credits name an ensemble. His professional history, too, contains plenty of collaborators.

A public recommendation from Tony Osime describes learning from Njemanze as a pleasure, with insights accompanied by humor. It is one person’s assessment, but it fits beside the more formal record without requiring a personality invented from job titles. Patents and executive biographies leave rather little room for the dinner set.

How much history can you afford to remember?

His later public discussions keep returning to what security teams can realistically do. At Detect LIVE in July 2025, he joined Christian Karam and analyst Francis Odum to discuss the SIEM market. Their subjects included architectural limits, increasing data volumes, and pricing that forces customers to make uncomfortable choices about retention.

The issue has a detective-story quality. An organization may only understand the importance of an old event after learning something new about an attacker. Its ability to investigate then depends on whether it kept the relevant records and can search them. Yesterday’s unremarkable detail can become today’s question.

Njemanze advocated analysis across the period relevant to an investigation, rather than accepting narrow windows by default. This is an ambition for the systems he builds and discusses. Its significance lies in the user’s predicament: deciding in advance which evidence will matter later is a demanding way to run an investigation.

His public work has also reached audiences beyond security practitioners. FEI Silicon Valley named him as a panelist for its March 31, 2026 event in Palo Alto on cybersecurity and CFOs. The program framed cyber risk through financial exposure, spending priorities, disclosure, and business resilience. The audience changed; the demand for a usable decision remained familiar.

There is a long distance between helping architect a data access language at Apple and talking about cyber risk with finance executives. Njemanze’s intervening work makes the route intelligible. Search, correlation, threat sharing, and investigation all depend on bringing information within reach of the person who needs it.

The career has produced companies, patents, an award, and a continuing argument about security software. Its most revealing thread may be the impatience with stopping at collection. Once the clues have arrived, someone still has to work out what to do. Njemanze keeps building around that moment. Occasionally, he also brings a bass.